Don't record post-quantum stats if MITM.

net/socket/ssl_client_socket_pool.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_pool.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 414 matching lines @@
         UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Google_"
                                        "Full_Handshake",
                                    connect_duration,
                                    base::TimeDelta::FromMilliseconds(1),
                                    base::TimeDelta::FromMinutes(1),
                                    100);
 
         // These are hosts that we expect to always offer CECPQ1.  Connections
         // to them, whether or not this browser is in the experiment group, form
         // the basis of our comparisons.
-        bool cecpq1_supported =
+        bool cecpq1_expected_to_be_offered =
+            ssl_info.is_issued_by_known_root &&
             (host == "play.google.com" || host == "checkout.google.com" ||
              host == "wallet.google.com");
-        if (cecpq1_supported) {
+        if (cecpq1_expected_to_be_offered) {
           UMA_HISTOGRAM_CUSTOM_TIMES(
               "Net.SSL_Connection_Latency_PostQuantumSupported_Full_Handshake",
               connect_duration, base::TimeDelta::FromMilliseconds(1),
               base::TimeDelta::FromMinutes(1), 100);
           if (SSLClientSocket::IsPostQuantumExperimentEnabled()) {
             // But don't trust that these hosts offer CECPQ1: make sure.  If
             // we're doing everything right on the server side, |is_cecpq1|
             // should always be true if we get here, modulo MITM.
             UMA_HISTOGRAM_BOOLEAN("Net.SSL_Connection_PostQuantum_Negotiated",
                                   is_cecpq1);
@@ skipping 242 matching lines @@
   if (base_.CloseOneIdleSocket())
     return true;
   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 }
 
 void SSLClientSocketPool::OnSSLConfigChanged() {
   FlushWithError(ERR_NETWORK_CHANGED);
 }
 
 }  // namespace net