Add a histogram to measure the frequency of OCSP stapling support by servers

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index d2c9959c389cf09a5bd8e5acdbff874c934fdf0d..0e5bda9d13fda5db60f0c94a718204d268ad1d11 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -2395,7 +2395,12 @@ void SSLClientSocketNSS::Core::UpdateSignedCertTimestamps() {
 void SSLClientSocketNSS::Core::UpdateStapledOCSPResponse() {
   const SECItemArray* ocsp_responses =
       SSL_PeerStapledOCSPResponses(nss_fd_);
-  if (!ocsp_responses || !ocsp_responses->len)
+  bool ocsp_requested =
+      IsOCSPStaplingSupported() || ssl_config_.signed_cert_timestamps_enabled;
+  bool ocsp_responses_present = ocsp_responses && ocsp_responses->len;
+  UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled",

[jar (doing other things), 2014/02/19 22:29:16]

This looks fine... but considering how little space you're using for a
boolean... you *could* break out the 4 cases into an UMA_HISTOGRAM_ENUMERATION,
rather than aggregating them via the && on the next line.  YMMV... your choice.

+      ocsp_requested && ocsp_responses_present);

[wtc, 2014/02/19 21:09:19]

It should be unnecessary to test ocsp_requested. NSS doesn't allow a server to
send us an unsolicited extension, so if OCSP responses are present, we must have
requested OCSP stapling.

[wtc, 2014/02/19 22:00:30]

1. I guess what you have in mind is this:

  if (ocsp_requested)
    UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_responses_present);

That is, the histogram is only updated when we requested OCSP stapling.

2. We can call SSL_OptionGet(nss_fd_, SSL_ENABLE_OCSP_STAPLING) to get
the value of ocsp_requested. We will need to declare ocsp_requested as
a PRBool.

[Ryan Sleevi, 2014/02/19 23:12:18]

Thanks for pointing this out. I've instead chosen to only record this histogram
when we've actually *requested* OCSP stapling. With CT, this is effectively
becoming "always", but at least it keeps the histogram clean.

+  if (!ocsp_responses_present)
     return;
 
   nss_handshake_state_.stapled_ocsp_response = std::string(