Do not do Expect-Staple when OCSPVerifyResult has not been populated

net/cert/ocsp_verify_result.h

Index: net/cert/ocsp_verify_result.h
diff --git a/net/cert/ocsp_verify_result.h b/net/cert/ocsp_verify_result.h
index a4dc71e80e2dda65e373efed02fc5b2675613df5..66ab4c2f494c214296e385a3367d101ad8601f90 100644
--- a/net/cert/ocsp_verify_result.h
+++ b/net/cert/ocsp_verify_result.h
@@ -27,6 +27,9 @@ struct NET_EXPORT OCSPVerifyResult {
   bool operator==(const OCSPVerifyResult& other) const;
 
   enum ResponseStatus {
+    // OCSP verification was not checked on this connection.
+    UNKNOWN,

[Ryan Sleevi, 2016/12/21 01:35:29]

The risk of "Unknown" here is that it might become more overloaded. Any reason
not to call this something like NOT_CHECKED ?

(I can see arguments both for & against, just noting the asymmetry between this
and the other response codes)

[estark, 2016/12/21 17:53:12]

NOT_CHECKED seems reasonable, done.

+
     // No OCSPResponse was stapled.
     MISSING,
 
@@ -56,7 +59,7 @@ struct NET_EXPORT OCSPVerifyResult {
 
   };
 
-  ResponseStatus response_status = MISSING;
+  ResponseStatus response_status = UNKNOWN;
 
   // The strictest CertStatus matching the certificate (REVOKED > UNKNOWN >
   // GOOD). Only valid if |response_status| = PROVIDED.