[CacheStorage] Pad and bin opaque resource sizes.

content/browser/cache_storage/cache_storage_cache.cc

Index: content/browser/cache_storage/cache_storage_cache.cc
diff --git a/content/browser/cache_storage/cache_storage_cache.cc b/content/browser/cache_storage/cache_storage_cache.cc
index a120339b5d9c1bccf7d60979c248d805a032b29f..e3599b29134337a72de7cff56836de30d400e35c 100644
--- a/content/browser/cache_storage/cache_storage_cache.cc
+++ b/content/browser/cache_storage/cache_storage_cache.cc
@@ -6,6 +6,7 @@
 
 #include <stddef.h>
 #include <algorithm>
+#include <functional>
 #include <limits>
 #include <memory>
 #include <string>
@@ -28,6 +29,8 @@
 #include "content/browser/cache_storage/cache_storage_scheduler.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/referrer.h"
+#include "crypto/hmac.h"
+#include "crypto/symmetric_key.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
@@ -254,6 +257,23 @@ std::unique_ptr<ServiceWorkerResponse> CreateResponse(
           metadata.response().cors_exposed_header_names().end()));
 }
 
+// The size of opaque (non-cors) resource responses are padded in order
+// to obfuscate their actual size.
+bool ShouldPadResourceSize(const ServiceWorkerResponse& response) {
+  switch (response.response_type) {
+    case blink::kWebServiceWorkerResponseTypeBasic:
+    case blink::kWebServiceWorkerResponseTypeCORS:
+    case blink::kWebServiceWorkerResponseTypeDefault:
+    case blink::kWebServiceWorkerResponseTypeError:
+      return false;
+    case blink::kWebServiceWorkerResponseTypeOpaque:
+    case blink::kWebServiceWorkerResponseTypeOpaqueRedirect:
+      return !response.url_list.empty();
+  }
+  NOTREACHED();
+  return false;
+}
+
 }  // namespace
 
 // The state needed to pass between CacheStorageCache::Put callbacks.
@@ -291,10 +311,12 @@ struct CacheStorageCache::QueryCacheResult {
 struct CacheStorageCache::QueryCacheContext {
   QueryCacheContext(std::unique_ptr<ServiceWorkerFetchRequest> request,
                     const CacheStorageCacheQueryParams& options,
-                    const QueryCacheCallback& callback)
+                    const QueryCacheCallback& callback,
+                    uint32_t query_types)
       : request(std::move(request)),
         options(options),
         callback(callback),
+        query_types(query_types),
         matches(base::MakeUnique<QueryCacheResults>()) {}
 
   ~QueryCacheContext() {
@@ -311,7 +333,7 @@ struct CacheStorageCache::QueryCacheContext {
   std::unique_ptr<ServiceWorkerFetchRequest> request;
   CacheStorageCacheQueryParams options;
   QueryCacheCallback callback;
-  QueryCacheType query_type;
+  uint32_t query_types = 0x0;
   size_t estimated_out_bytes = 0;
 
   // Iteration state
@@ -332,11 +354,13 @@ std::unique_ptr<CacheStorageCache> CacheStorageCache::CreateMemoryCache(
     CacheStorage* cache_storage,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
-    base::WeakPtr<storage::BlobStorageContext> blob_context) {
+    base::WeakPtr<storage::BlobStorageContext> blob_context,
+    std::unique_ptr<crypto::SymmetricKey> cache_padding_key) {
   CacheStorageCache* cache = new CacheStorageCache(
       origin, cache_name, base::FilePath(), cache_storage,
       std::move(request_context_getter), std::move(quota_manager_proxy),
-      blob_context, 0 /* cache_size */);
+      blob_context, 0 /* cache_size */, 0 /* cache_padding */,
+      std::move(cache_padding_key));
   cache->SetObserver(cache_storage);
   cache->InitBackend();
   return base::WrapUnique(cache);
@@ -351,11 +375,13 @@ std::unique_ptr<CacheStorageCache> CacheStorageCache::CreatePersistentCache(
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context,
-    int64_t cache_size) {
+    int64_t cache_size,
+    int64_t cache_padding,
+    std::unique_ptr<crypto::SymmetricKey> cache_padding_key) {
   CacheStorageCache* cache = new CacheStorageCache(
       origin, cache_name, path, cache_storage,
       std::move(request_context_getter), std::move(quota_manager_proxy),
-      blob_context, cache_size);
+      blob_context, cache_size, cache_padding, std::move(cache_padding_key));
   cache->SetObserver(cache_storage), cache->InitBackend();
   return base::WrapUnique(cache);
 }
@@ -587,7 +613,9 @@ CacheStorageCache::CacheStorageCache(
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context,
-    int64_t cache_size)
+    int64_t cache_size,
+    int64_t cache_padding,
+    std::unique_ptr<crypto::SymmetricKey> cache_padding_key)
     : origin_(origin),
       cache_name_(cache_name),
       path_(path),
@@ -598,12 +626,15 @@ CacheStorageCache::CacheStorageCache(
       scheduler_(
           new CacheStorageScheduler(CacheStorageSchedulerClient::CLIENT_CACHE)),
       cache_size_(cache_size),
+      cache_padding_(cache_padding),
+      cache_padding_key_(std::move(cache_padding_key)),
       max_query_size_bytes_(kMaxQueryCacheResultBytes),
       cache_observer_(nullptr),
       memory_only_(path.empty()),
       weak_ptr_factory_(this) {
   DCHECK(!origin_.is_empty());
   DCHECK(quota_manager_proxy_.get());
+  DCHECK(cache_padding_key_.get());
 
   quota_manager_proxy_->NotifyOriginInUse(origin_);
 }
@@ -611,10 +642,12 @@ CacheStorageCache::CacheStorageCache(
 void CacheStorageCache::QueryCache(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& options,
-    QueryCacheType query_type,
+    uint32_t query_types,
     const QueryCacheCallback& callback) {
-  DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
-  if (backend_state_ != BACKEND_OPEN) {
+  DCHECK_NE(
+      QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_WITH_BODIES,
+      query_types & (QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_WITH_BODIES));
+  if (backend_state_ == BACKEND_CLOSED) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE,
                  std::unique_ptr<QueryCacheResults>());
     return;
@@ -627,9 +660,8 @@ void CacheStorageCache::QueryCache(
   }
 
   ServiceWorkerFetchRequest* request_ptr = request.get();
-  std::unique_ptr<QueryCacheContext> query_cache_context(
-      new QueryCacheContext(std::move(request), options, callback));
-  query_cache_context->query_type = query_type;
+  std::unique_ptr<QueryCacheContext> query_cache_context(new QueryCacheContext(
+      std::move(request), options, callback, query_types));
 
   if (query_cache_context->request &&
       !query_cache_context->request->url.is_empty() && !options.ignore_search) {
@@ -710,7 +742,7 @@ void CacheStorageCache::QueryCacheFilterEntry(
   disk_cache::ScopedEntryPtr entry(query_cache_context->enumerated_entry);
   query_cache_context->enumerated_entry = nullptr;
 
-  if (backend_state_ != BACKEND_OPEN) {
+  if (backend_state_ == BACKEND_CLOSED) {
     QueryCacheCallback callback = query_cache_context->callback;
     callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND,
                  std::move(query_cache_context->matches));
@@ -772,54 +804,48 @@ void CacheStorageCache::QueryCacheDidReadMetadata(
     return;
   }
 
-  if (query_cache_context->query_type == QueryCacheType::CACHE_ENTRIES) {
-    match->request.reset();
-    match->response.reset();
+  if (query_cache_context->query_types & QUERY_CACHE_ENTRIES)
     match->entry = std::move(entry);
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
-  }
 
-  query_cache_context->estimated_out_bytes +=
-      match->request->EstimatedStructSize();
-  if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
-                                      std::unique_ptr<QueryCacheResults>());
-    return;
-  }
-
-  if (query_cache_context->query_type == QueryCacheType::REQUESTS) {
-    match->response.reset();
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
+  if (query_cache_context->query_types & QUERY_CACHE_REQUESTS) {
+    query_cache_context->estimated_out_bytes +=
+        match->request->EstimatedStructSize();
+    if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+  } else {
+    match->request.reset();
   }
 
-  DCHECK_EQ(QueryCacheType::REQUESTS_AND_RESPONSES,
-            query_cache_context->query_type);
-
-  query_cache_context->estimated_out_bytes +=
-      match->response->EstimatedStructSize();
-  if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
-                                      std::unique_ptr<QueryCacheResults>());
-    return;
-  }
+  if (query_cache_context->query_types & QUERY_CACHE_RESPONSES_WITH_BODIES) {
+    query_cache_context->estimated_out_bytes +=
+        match->response->EstimatedStructSize();
+    if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+    if (entry->GetDataSize(INDEX_RESPONSE_BODY) == 0) {
+      QueryCacheOpenNextEntry(std::move(query_cache_context));
+      return;
+    }
 
-  if (entry->GetDataSize(INDEX_RESPONSE_BODY) == 0) {
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
-  }
+    if (!blob_storage_context_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
 
-  if (!blob_storage_context_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE,
-                                      base::MakeUnique<QueryCacheResults>());
-    return;
+    std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
+        PopulateResponseBody(std::move(entry), match->response.get());
+    match->blob_handle = std::move(blob_data_handle);
+  } else if (!(query_cache_context->query_types &
+               QUERY_CACHE_RESPONSES_NO_BODIES)) {
+    match->response.reset();
   }
 
-  std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
-      PopulateResponseBody(std::move(entry), match->response.get());
-  match->blob_handle = std::move(blob_data_handle);
-
   QueryCacheOpenNextEntry(std::move(query_cache_context));
 }
 
@@ -829,6 +855,25 @@ bool CacheStorageCache::QueryCacheResultCompare(const QueryCacheResult& lhs,
   return lhs.entry_time < rhs.entry_time;
 }
 
+// static
+int64_t CacheStorageCache::CalculateResponsePadding(
+    const ServiceWorkerResponse& response,
+    const crypto::SymmetricKey* padding_key) {
+  const uint64_t kPaddingRange = 400 * 1024;
+
+  if (!ShouldPadResourceSize(response))
+    return 0;
+
+  const std::string& url = response.url_list.back().spec();
+  crypto::HMAC hmac(crypto::HMAC::SHA256);
+  std::vector<uint8_t> digest(hmac.DigestLength());
+  if (!hmac.Init(padding_key) || !hmac.Sign(url, &digest[0], digest.size())) {
+    LOG(FATAL) << "Failed to calculate HMAC.";
+  }
+  uint64_t val = *(reinterpret_cast<uint64_t*>(&digest[0]));
+  return val % kPaddingRange;
+}
+
 void CacheStorageCache::MatchImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
@@ -875,7 +920,7 @@ void CacheStorageCache::MatchAllImpl(
   }
 
   QueryCache(std::move(request), options,
-             QueryCacheType::REQUESTS_AND_RESPONSES,
+             QUERY_CACHE_REQUESTS | QUERY_CACHE_RESPONSES_WITH_BODIES,
              base::Bind(&CacheStorageCache::MatchAllDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
@@ -1064,25 +1109,37 @@ void CacheStorageCache::PutImpl(std::unique_ptr<PutContext> put_context) {
     return;
   }
 
-  std::string key = put_context->request->url.spec();
-
-  net::CompletionCallback callback = base::Bind(
-      &CacheStorageCache::PutDidDoomEntry, weak_ptr_factory_.GetWeakPtr(),
-      base::Passed(std::move(put_context)));
-
-  int rv = backend_->DoomEntry(key, callback);
-  if (rv != net::ERR_IO_PENDING)
-    callback.Run(rv);
+  // Explicitly delete the incumbent resource (which may not exist). This is
+  // only done so that it's padding will be decremented from the calculated
+  // cache padding.
+  auto delete_request = base::MakeUnique<ServiceWorkerFetchRequest>(
+      put_context->request->url, "", ServiceWorkerHeaderMap(), Referrer(),
+      false);
+
+  CacheStorageCacheQueryParams query_options;
+  query_options.ignore_method = true;
+  query_options.ignore_vary = true;
+  DeleteImpl(std::move(delete_request), query_options,

[jkarlin, 2017/06/15 16:08:35]

It hurts to call DeleteImpl here, as it's going to seriously slow down put
operations, but so be it. Can you add a TODO to see if we can find a faster way?

For instance, something that morlovich@ is working on is adding a few bits to
the backend's index that we can put whatever we want in and access
synchronously. We might use a bit to signal that the resource is opaque.

[cmumford, 2017/06/20 18:22:04]

Done. Unfortunately morlovich's abandoned his index change.

+             base::Bind(&CacheStorageCache::PutDidDeleteEntry,
+                        weak_ptr_factory_.GetWeakPtr(),
+                        base::Passed(std::move(put_context))));
 }
 
-void CacheStorageCache::PutDidDoomEntry(std::unique_ptr<PutContext> put_context,
-                                        int rv) {
+void CacheStorageCache::PutDidDeleteEntry(
+    std::unique_ptr<PutContext> put_context,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_results) {
   if (backend_state_ != BACKEND_OPEN) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
-  // |rv| is ignored as doom entry can fail if the entry doesn't exist.
+  if (error != CACHE_STORAGE_OK && error != CACHE_STORAGE_ERROR_NOT_FOUND) {
+    cache_padding_ -= CalculateResponsePadding(*put_context->response,

[jkarlin, 2017/06/15 16:08:35]

Hmm, shouldn't delete take care of removing the cache_padding in case of error?

[cmumford, 2017/06/20 18:22:04]

This is the read of the old cache entry that must currently be done to know if
it's there, and even opaque. I don't believe it's possible to get an error and
also get response. That being said, I moved this outside of the check as it
doesn't impact performance and is less confusing.

Also, I should have been using the query_result's response instead of the one
from put_context.

+                                               cache_padding_key_.get());
+    put_context->callback.Run(error);
+    return;
+  }
 
   std::unique_ptr<disk_cache::Entry*> scoped_entry_ptr(
       new disk_cache::Entry*());
@@ -1095,11 +1152,11 @@ void CacheStorageCache::PutDidDoomEntry(std::unique_ptr<PutContext> put_context,
       base::Passed(std::move(scoped_entry_ptr)),
       base::Passed(std::move(put_context)));
 
-  int create_rv = backend_ptr->CreateEntry(request_ptr->url.spec(), entry_ptr,
-                                           create_entry_callback);
+  int rv = backend_ptr->CreateEntry(request_ptr->url.spec(), entry_ptr,
+                                    create_entry_callback);
 
-  if (create_rv != net::ERR_IO_PENDING)
-    create_entry_callback.Run(create_rv);
+  if (rv != net::ERR_IO_PENDING)
+    create_entry_callback.Run(rv);
 }
 
 void CacheStorageCache::PutDidCreateEntry(
@@ -1184,6 +1241,8 @@ void CacheStorageCache::PutDidWriteHeaders(
 
   if (rv > 0)
     storage::RecordBytesWritten(kRecordBytesLabel, rv);
+  cache_padding_ += CalculateResponsePadding(*put_context->response,

[jkarlin, 2017/06/15 16:08:35]

Ah, there is another place that we need to bump the cache_padding_, and that's
when side data (e.g., compiled javascript) is written to the cache such as in
WriteSideDataDidWrite. I need to think more about this, but perhaps for metadata
we could add HMAC(private_key, URL + "METADATA") so that it has a different (but
also consistent for the url) pad. WDYT?

We could not count the side data against the cache's quota, but implementing
that would be tricky since we rely on the backend's CalculateSizeOfAllEntries to
get the size quickly and that includes the side data size.

[cmumford, 2017/06/20 18:22:04]

A few thoughts.

1. If we did ignore the side data, as we do now, what are the security
implications of that?

2. If we pad the side data then we'd also need to decrement it in
PutDidDeleteEntry. I don't believe that data comes back in QueryCacheResult, so
it would be another call to DiskCache::GetDataSize() in order to determine if
we've cached compiled JavaScript.

Or am I missing something obvious in #2?

[jkarlin, 2017/06/26 17:59:19]

We'd leak the size of whatever side-data is stored. I'm aware of compiled
javascript being stored, I'm not sure if there are other consumers. So if the
attacker knows the size of the compiled javascript for a resource, then they
know what the original script is. That doesn't seem terrible, but it's enough to
make me uncomfortable. Especially since we don't know what other consumers may
come in the future.
Yes, we'd need to call GetDataSize. That's synchronous and fast, no concerns
there.

+                                             cache_padding_key_.get());
 
   // The metadata is written, now for the response content. The data is streamed
   // from the blob into the cache entry.
@@ -1233,6 +1292,54 @@ void CacheStorageCache::PutDidWriteBlobToCache(
   UpdateCacheSize(base::Bind(put_context->callback, CACHE_STORAGE_OK));
 }
 
+void CacheStorageCache::CalculateCacheSizePadding(
+    const SizePaddingCallback& got_sizes_callback) {
+  net::CompletionCallback got_size_callback =
+      base::Bind(&CacheStorageCache::CalculateCacheSizePaddingGotSize,
+                 weak_ptr_factory_.GetWeakPtr(), std::move(got_sizes_callback));
+
+  int rv = backend_->CalculateSizeOfAllEntries(got_size_callback);
+  if (rv != net::ERR_IO_PENDING)
+    got_size_callback.Run(rv);
+}
+
+void CacheStorageCache::CalculateCacheSizePaddingGotSize(
+    const SizePaddingCallback& callback,
+    int cache_size) {
+  // Enumerating entries is only done during cache initialization.
+  DCHECK_EQ(backend_state_, BACKEND_UNINITIALIZED);
+  std::unique_ptr<ServiceWorkerFetchRequest> request;
+  CacheStorageCacheQueryParams options;
+  options.ignore_search = true;
+  QueryCache(std::move(request), options,
+             QUERY_CACHE_REQUESTS | QUERY_CACHE_RESPONSES_WITH_BODIES,

[jkarlin, 2017/06/15 16:08:35]

You want QUERY_CACHE_RESPONSES_NO_BODIES here I think as you just need the URL
and response type right? I don't think you need QUERY_CACHE_REQUESTS either.

[cmumford, 2017/06/20 18:22:04]

Yes, that was unnecessary - thx.

+             base::Bind(&CacheStorageCache::PaddingDidQueryCache,
+                        weak_ptr_factory_.GetWeakPtr(), std::move(callback),
+                        cache_size));
+}
+
+void CacheStorageCache::PaddingDidQueryCache(
+    const SizePaddingCallback& callback,
+    int cache_size,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_cache_results) {
+  int64_t cache_padding = 0;
+  if (error == CACHE_STORAGE_OK) {
+    for (const auto& result : *query_cache_results)
+      cache_padding +=
+          CalculateResponsePadding(*result.response, cache_padding_key_.get());
+  }
+
+  callback.Run(cache_size, cache_padding);
+}
+
+void CacheStorageCache::CalculateCacheSize(
+    const net::CompletionCallback& callback) {
+  int rv = backend_->CalculateSizeOfAllEntries(callback);
+  if (rv != net::ERR_IO_PENDING)
+    callback.Run(rv);
+}
+
 void CacheStorageCache::UpdateCacheSize(const base::Closure& callback) {
   if (backend_state_ != BACKEND_OPEN)
     return;
@@ -1240,13 +1347,9 @@ void CacheStorageCache::UpdateCacheSize(const base::Closure& callback) {
   // Note that the callback holds a cache handle to keep the cache alive during
   // the operation since this UpdateCacheSize is often run after an operation
   // completes and runs its callback.
-  int rv = backend_->CalculateSizeOfAllEntries(
-      base::Bind(&CacheStorageCache::UpdateCacheSizeGotSize,
-                 weak_ptr_factory_.GetWeakPtr(),
-                 base::Passed(CreateCacheHandle()), callback));
-
-  if (rv != net::ERR_IO_PENDING)
-    UpdateCacheSizeGotSize(CreateCacheHandle(), callback, rv);
+  CalculateCacheSize(base::Bind(&CacheStorageCache::UpdateCacheSizeGotSize,
+                                weak_ptr_factory_.GetWeakPtr(),
+                                base::Passed(CreateCacheHandle()), callback));
 }
 
 void CacheStorageCache::UpdateCacheSizeGotSize(
@@ -1254,17 +1357,16 @@ void CacheStorageCache::UpdateCacheSizeGotSize(
     const base::Closure& callback,
     int current_cache_size) {
   DCHECK_NE(current_cache_size, CacheStorage::kSizeUnknown);
-  int64_t old_cache_size = cache_size_;
   cache_size_ = current_cache_size;
-
-  int64_t size_delta = current_cache_size - old_cache_size;
+  int64_t size_delta = PaddedCacheSize() - last_reported_size_;
+  last_reported_size_ = PaddedCacheSize();
 
   quota_manager_proxy_->NotifyStorageModified(
       storage::QuotaClient::kServiceWorkerCache, origin_,
       storage::kStorageTypeTemporary, size_delta);
 
   if (cache_observer_)
-    cache_observer_->CacheSizeUpdated(this, current_cache_size);
+    cache_observer_->CacheSizeUpdated(this, PaddedCacheSize());
 
   callback.Run();
 }
@@ -1281,47 +1383,63 @@ void CacheStorageCache::Delete(const CacheStorageBatchOperation& operation,
           operation.request.headers, operation.request.referrer,
           operation.request.is_reload));
 
+  QueryCacheCallback delete_callback =
+      base::Bind(&CacheStorageCache::DeleteDidDelete,
+                 weak_ptr_factory_.GetWeakPtr(), callback);
+
   scheduler_->ScheduleOperation(
       base::Bind(&CacheStorageCache::DeleteImpl, weak_ptr_factory_.GetWeakPtr(),
                  base::Passed(std::move(request)), operation.match_params,
-                 scheduler_->WrapCallbackToRunNext(callback)));
+                 scheduler_->WrapCallbackToRunNext(delete_callback)));
+}
+
+void CacheStorageCache::DeleteDidDelete(
+    const ErrorCallback& callback,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_results) {
+  callback.Run(error);
 }
 
 void CacheStorageCache::DeleteImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
-    const ErrorCallback& callback) {
+    const QueryCacheCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
-    callback.Run(CACHE_STORAGE_ERROR_STORAGE);
+    callback.Run(CACHE_STORAGE_ERROR_STORAGE,
+                 base::MakeUnique<QueryCacheResults>());
     return;
   }
 
-  QueryCache(std::move(request), match_params, QueryCacheType::CACHE_ENTRIES,
+  QueryCache(std::move(request), match_params,
+             QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_NO_BODIES,
              base::Bind(&CacheStorageCache::DeleteDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::DeleteDidQueryCache(
-    const ErrorCallback& callback,
+    const QueryCacheCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
-    callback.Run(error);
+    callback.Run(error, std::move(query_cache_results));
     return;
   }
 
   if (query_cache_results->empty()) {
-    callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND);
+    callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND, std::move(query_cache_results));
     return;
   }
 
   for (auto& result : *query_cache_results) {
     disk_cache::ScopedEntryPtr entry = std::move(result.entry);
+    cache_padding_ -=
+        CalculateResponsePadding(*result.response, cache_padding_key_.get());
     entry->Doom();
   }
 
-  UpdateCacheSize(base::Bind(callback, CACHE_STORAGE_OK));
+  UpdateCacheSize(base::Bind(callback, CACHE_STORAGE_OK,
+                             base::Passed(std::move(query_cache_results))));
 }
 
 void CacheStorageCache::KeysImpl(
@@ -1334,7 +1452,7 @@ void CacheStorageCache::KeysImpl(
     return;
   }
 
-  QueryCache(std::move(request), options, QueryCacheType::REQUESTS,
+  QueryCache(std::move(request), options, QUERY_CACHE_REQUESTS,
              base::Bind(&CacheStorageCache::KeysDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
@@ -1367,7 +1485,14 @@ void CacheStorageCache::CloseImpl(const base::Closure& callback) {
 void CacheStorageCache::SizeImpl(const SizeCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
 
-  int64_t size = backend_state_ == BACKEND_OPEN ? cache_size_ : 0;
+  // TODO(cmumford): Can CacheStorage::kSizeUnknown be returned instead of zero?
+  if (backend_state_ != BACKEND_OPEN) {
+    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                  base::Bind(callback, 0));
+    return;
+  }
+
+  int64_t size = backend_state_ == BACKEND_OPEN ? PaddedCacheSize() : 0;
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
                                                 base::Bind(callback, size));
 }
@@ -1460,10 +1585,41 @@ void CacheStorageCache::InitGotCacheSize(const base::Closure& callback,
         << " does not match size from index: " << cache_size_;
     UMA_HISTOGRAM_COUNTS_10M("ServiceWorkerCache.IndexSizeDifference",
                              std::abs(cache_size_ - cache_size));
-    // Disabled for crbug.com/681900.
-    // DCHECK_EQ(cache_size_, cache_size);
+    if (cache_size_ != cache_size) {
+      // If the actual size doesn't match the cached size, then assume the
+      // cached padding is also incorrect and recalculate.
+      CalculateCacheSizePaddingGotSize(
+          base::Bind(&CacheStorageCache::InitGotCacheSizeAndPadding,
+                     weak_ptr_factory_.GetWeakPtr(), callback,
+                     cache_create_error),
+          cache_size);
+      return;
+    }
   }
+
+  if (cache_padding_ == CacheStorage::kSizeUnknown || cache_padding_ < 0) {

[jkarlin, 2017/06/15 16:08:35]

Can you add a comment somewhere around here that we're assuming that if
cache_size_ matches cache_size then we also assume that the padding is correct
since it's stored at the same time.

[cmumford, 2017/06/20 18:22:04]

The comment above on line 1589 is almost the inverse of your requested comment.
I'll invert the comment, but leave it at that location. Let me know if you want
it moved.

+    CalculateCacheSizePaddingGotSize(
+        base::Bind(&CacheStorageCache::InitGotCacheSizeAndPadding,
+                   weak_ptr_factory_.GetWeakPtr(), callback,
+                   cache_create_error),
+        cache_size);
+    return;
+  }
+
+  // If cached size matches actual size then assume cached padding is still
+  // correct.
+  InitGotCacheSizeAndPadding(callback, cache_create_error, cache_size,
+                             cache_padding_);
+}
+
+void CacheStorageCache::InitGotCacheSizeAndPadding(
+    const base::Closure& callback,
+    CacheStorageError cache_create_error,
+    int64_t cache_size,
+    int64_t cache_padding) {
   cache_size_ = cache_size;
+  cache_padding_ = cache_padding;
+
   initializing_ = false;
   backend_state_ = (cache_create_error == CACHE_STORAGE_OK && backend_ &&
                     backend_state_ == BACKEND_UNINITIALIZED)
@@ -1474,7 +1630,7 @@ void CacheStorageCache::InitGotCacheSize(const base::Closure& callback,
                             cache_create_error, CACHE_STORAGE_ERROR_LAST + 1);
 
   if (cache_observer_)
-    cache_observer_->CacheSizeUpdated(this, cache_size_);
+    cache_observer_->CacheSizeUpdated(this, PaddedCacheSize());
 
   callback.Run();
 }
@@ -1501,4 +1657,12 @@ CacheStorageCache::CreateCacheHandle() {
   return cache_storage_->CreateCacheHandle(this);
 }
 
+int64_t CacheStorageCache::PaddedCacheSize() const {
+  if (cache_size_ == CacheStorage::kSizeUnknown ||
+      cache_padding_ == CacheStorage::kSizeUnknown) {
+    return CacheStorage::kSizeUnknown;
+  }
+  return cache_size_ + cache_padding_;
+}
+
 }  // namespace content