Initial implementation of Chrome-Freshness header.

net/http/http_cache_transaction.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_cache_transaction.h"
 
 #include "build/build_config.h"
 
 #if defined(OS_POSIX)
 #include <unistd.h>
 #endif
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
+#include "base/format_macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/rand_util.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/time/time.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/load_flags.h"
 #include "net/base/load_timing_info.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 #include "net/base/upload_data_stream.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/http/disk_based_cert_cache.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_request_info.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_transaction.h"
 #include "net/http/http_util.h"
 #include "net/http/partial_data.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_config_service.h"
 
 using base::Time;
 using base::TimeDelta;
 using base::TimeTicks;
 
 namespace {
 
+// TODO(ricea): Move this to HttpResponseHeaders once it is standardised.
+static const char kFreshnessHeader[] = "Chrome-Freshness";

[rvargas (doing something else), 2014/07/24 00:54:06]

Shouldn't we use some other prefix that states more clearly that this is
private/experimental/not part of any standard? X-?

In fact, while there was a discussion about supporting stale-while-revalidate, I
don't think I've seen any official talk about the new header (I'm well aware of
its value for server-side measurements). Given that this is not part of any
standard, should there be something posted somewhere around the open web
platform? (I don't follow those lists so I don't know if that happened already,
or what is our policy about starting to send random headers from Chrome).

Which reminds me that this code should go directly into builds of other browsers
than Chrome...

[Adam Rice, 2014/07/28 11:11:13]

Okay, I've changed to "Chromium-Resource-Freshness" for now.

+
 // Stores data relevant to the statistics of writing and reading entire
 // certificate chains using DiskBasedCertCache. |num_pending_ops| is the number
 // of certificates in the chain that have pending operations in the
 // DiskBasedCertCache. |start_time| is the time that the read and write
 // commands began being issued to the DiskBasedCertCache.
 // TODO(brandonsalmon): Remove this when it is no longer necessary to
 // collect data.
 class SharedChainData : public base::RefCounted<SharedChainData> {
  public:
   SharedChainData(int num_ops, TimeTicks start)
@@ skipping 164 matching lines @@
 
 void RecordNoStoreHeaderHistogram(int load_flags,
                                   const net::HttpResponseInfo* response) {
   if (load_flags & net::LOAD_MAIN_FRAME) {
     UMA_HISTOGRAM_BOOLEAN(
         "Net.MainFrameNoStore",
         response->headers->HasHeaderValue("cache-control", "no-store"));
   }
 }
 
+// TODO(ricea): Move this to a more appropriate home. Also, this is closely

[rvargas (doing something else), 2014/07/24 00:54:06]

I think we should move this to http_response_headers with this cl.

[Adam Rice, 2014/07/28 11:11:13]

Done.

+// based on HttpResponseHeaders::GetMaxAgeValue so they should probably share
+// implementation.
+bool GetStaleWhileRevalidateValue(const net::HttpResponseHeaders& headers,
+                                  TimeDelta* result) {
+  const std::string name = "cache-control";

[rvargas (doing something else), 2014/07/24 00:54:06]

nit: remove const and use constructor initialization instead of assignment.

[Adam Rice, 2014/07/28 11:11:13]

Done.

+  std::string value;
+
+  const char kStaleWhileRevalidatePrefix[] = "stale-while-revalidate=";
+  const size_t kStaleWhileRevalidatePrefixLen =
+      arraysize(kStaleWhileRevalidatePrefix) - 1;
+
+  void* iter = NULL;
+  while (headers.EnumerateHeader(&iter, name, &value)) {
+    if (value.size() > kStaleWhileRevalidatePrefixLen &&
+        LowerCaseEqualsASCII(value.begin(),
+                             value.begin() + kStaleWhileRevalidatePrefixLen,
+                             kStaleWhileRevalidatePrefix)) {
+      int64 seconds = 0;
+      const base::StringPiece parameter = base::StringPiece(
+          value.begin() + kStaleWhileRevalidatePrefixLen, value.end());
+      if (!base::StringToInt64(parameter, &seconds) || seconds < 0)
+        continue;
+      *result = TimeDelta::FromSeconds(seconds);
+      return true;
+    }
+  }
+
+  return false;
+}
+
 }  // namespace
 
 namespace net {
 
 struct HeaderNameAndValue {
   const char* name;
   const char* value;
 };
 
 // If the request includes one of these request headers, then avoid caching
@@ skipping 2005 matching lines @@
   if (!partial_.get()) {
     // Need to customize the request, so this forces us to allocate :(
     custom_request_.reset(new HttpRequestInfo(*request_));
     request_ = custom_request_.get();
   }
   DCHECK(custom_request_.get());
 
   bool use_if_range = partial_.get() && !partial_->IsCurrentRangeCached() &&
                       !invalid_range_;
 
+  if (!use_if_range && request_->privacy_mode != PRIVACY_MODE_ENABLED) {
+    // stale-while-revalidate is not useful when we only have a partial response
+    // cached, so don't set the header in that case.
+    // Also don't send the header when privacy mode is enabled, to avoid
+    // accidentally fingerprinting the user.
+    base::TimeDelta stale_while_revalidate;
+    if (GetStaleWhileRevalidateValue(*response_.headers,
+                                     &stale_while_revalidate)) {
+      base::TimeDelta max_age =
+          response_.headers->GetFreshnessLifetime(response_.response_time);
+      base::TimeDelta current_age = response_.headers->GetCurrentAge(
+          response_.request_time, response_.response_time, Time::Now());
+
+      custom_request_->extra_headers.SetHeader(

[rvargas (doing something else), 2014/07/24 00:54:06]

We should probably send the header only when stale_while_revalidate is > max_age
(and > 0, which allows better code reuse).

[Adam Rice, 2014/07/28 11:11:13]

I think this would probably make analysis too difficult. There are lots of
reasons why the request might not include the Freshness header, including:

* A proxy stripped it
* A proxy stripped stale-while-revalidate from the original response
* The browser isn't really Chrome
* This revalidation is coming from a cache in the middle, and not from Chrome
itself
* This browser isn't in the experiment group we're sending
stale-while-revalidate too

I could be mistaken, but I think the only way to do a sound analysis is is to
exclude all responses that don't have the Freshness header.

+          kFreshnessHeader,
+          base::StringPrintf("max-age=%" PRId64
+                             ",stale-while-revalidate=%" PRId64 ",age=%" PRId64,
+                             max_age.InSeconds(),
+                             stale_while_revalidate.InSeconds(),
+                             current_age.InSeconds()));
+    }
+  }
+
   if (!etag_value.empty()) {
     if (use_if_range) {
       // We don't want to switch to WRITE mode if we don't have this block of a
       // byte-range request because we may have other parts cached.
       custom_request_->extra_headers.SetHeader(
           HttpRequestHeaders::kIfRange, etag_value);
     } else {
       custom_request_->extra_headers.SetHeader(
           HttpRequestHeaders::kIfNoneMatch, etag_value);
     }
@@ skipping 476 matching lines @@
     default:
       NOTREACHED();
   }
 }
 
 void HttpCache::Transaction::OnIOComplete(int result) {
   DoLoop(result);
 }
 
 }  // namespace net