Implement Expect-Staple

net/socket/ssl_client_socket_impl.cc

Index: net/socket/ssl_client_socket_impl.cc
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
index bcd66037690e803e7ded9f276660fcd24d328cea..61f23487196c13d4efce580741d33db55baf1580 100644
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -85,6 +85,9 @@ const uint8_t kTbProtocolVersionMinor = 5;
 const uint8_t kTbMinProtocolVersionMajor = 0;
 const uint8_t kTbMinProtocolVersionMinor = 3;
 
+// Max age for OCSP responses
+const base::TimeDelta kAgeOneWeek = base::TimeDelta::FromDays(7);
+
 bool EVP_MDToPrivateKeyHash(const EVP_MD* md, SSLPrivateKey::Hash* hash) {
   switch (EVP_MD_type(md)) {
     case NID_md5_sha1:
@@ -1349,6 +1352,9 @@ int SSLClientSocketImpl::DoVerifyCertComplete(int result) {
     // the connection.
     VerifyCT();
 
+    CheckOCSP(*server_cert_verify_result_.verified_cert, *server_cert_,
+              server_cert_verify_result_.is_issued_by_known_root);
+
     DCHECK(!certificate_verified_);
     certificate_verified_ = true;
     MaybeCacheSession();
@@ -1435,6 +1441,16 @@ void SSLClientSocketImpl::VerifyCT() {
   }
 }
 
+void SSLClientSocketImpl::CheckOCSP(
+    const X509Certificate& verified_certificate,
+    const X509Certificate& unverified_certificate,
+    bool is_issued_by_known_root) {
+  base::Time verify_time = base::Time::Now();
+  transport_security_state_->CheckExpectStaple(
+      host_and_port_, verified_certificate, unverified_certificate,
+      is_issued_by_known_root, verify_time, kAgeOneWeek, ocsp_response_);
+}
+
 void SSLClientSocketImpl::OnHandshakeIOComplete(int result) {
   int rv = DoHandshakeLoop(result);
   if (rv != ERR_IO_PENDING) {