Do not do Expect-Staple when OCSPVerifyResult has not been populated

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <algorithm>
@@ skipping 1301 matching lines @@
         break;
     }
     if (result != ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN && ct_result != OK)
       result = ct_result;
   }
 
   if (result == OK) {
     DCHECK(!certificate_verified_);
     certificate_verified_ = true;
     MaybeCacheSession();
-    SSLInfo ssl_info;
-    bool ok = GetSSLInfo(&ssl_info);
-    DCHECK(ok);
-    transport_security_state_->CheckExpectStaple(host_and_port_, ssl_info,
-                                                 ocsp_response_);
   }
 
+  SSLInfo ssl_info;

[Ryan Sleevi, 2016/12/21 01:35:29]

Might by worth including a comment here in the code explaining the intentional
subtlety here (about sending reports on bad certificates)

[estark, 2016/12/21 17:53:12]

Ack, no longer applicable (reverted this change)

+  bool ok = GetSSLInfo(&ssl_info);
+  DCHECK(ok);
+  transport_security_state_->CheckExpectStaple(host_and_port_, ssl_info,
+                                               ocsp_response_);
+
   completed_connect_ = true;
   // Exit DoHandshakeLoop and return the result to the caller to Connect.
   DCHECK_EQ(STATE_NONE, next_handshake_state_);
   return result;
 }
 
 void SSLClientSocketImpl::DoConnectCallback(int rv) {
   if (!user_connect_callback_.is_null()) {
     CompletionCallback c = user_connect_callback_;
     user_connect_callback_.Reset();
@@ skipping 709 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net