Mac: implement <keygen> support, including adding generated cert to the Keychain.

net/base/net_error_list.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains the list of network errors.
 
 //
 // Ranges:
 //     0- 99 System related errors
 //   100-199 Connection related errors
@@ skipping 173 matching lines @@
 // 3. The server is presenting a self-signed certificate, providing no
 //    defense against active attackers (but foiling passive attackers).
 //
 NET_ERROR(CERT_AUTHORITY_INVALID, -202)
 
 // The server responded with a certificate that contains errors.
 // This error is not recoverable.
 //
 // MSDN describes this error as follows:
 //   "The SSL certificate contains errors."
+// NOTE: It's unclear how this differs from CERT_INVALID. For consistency,

[wtc, 2010/03/01 23:05:40]

Nit: CERT_INVALID => ERR_CERT_INVALID

+// use that code instead of this one from now on.
 //
 NET_ERROR(CERT_CONTAINS_ERRORS, -203)
 
 // The certificate has no mechanism for determining if it is revoked.  In
 // effect, this certificate cannot be revoked.
 NET_ERROR(CERT_NO_REVOCATION_MECHANISM, -204)
 
 // Revocation information for the security certificate for this site is not
 // available.  This could mean:
 //
@@ skipping 15 matching lines @@
 //
 // MSDN describes this error as follows:
 //   "The SSL certificate is invalid."
 //
 NET_ERROR(CERT_INVALID, -207)
 
 // The server responded with a certificate that is signed using a weak
 // signature algorithm.
 NET_ERROR(CERT_WEAK_SIGNATURE_ALGORITHM, -208)
 
+// The server responded to a <keygen> with a generated client cert that we
+// don't have the matching private key for.
+NET_ERROR(CERT_NO_PRIVATE_KEY, -209)

[wtc, 2010/03/01 23:05:40]

This is not a certificate error (the certificate itself is
good).  So we need to add this error code elsewhere.
(The error code ranges are documented at line 8.)

Let's add it to the -5xx range, and name it
NO_PRIVATE_KEY_FOR_CERT.

Please remember to change CERT_END back to -209.

+
 // Add new certificate error codes here.
 //
 // Update the value of CERT_END whenever you add a new certificate error
 // code.
 
 // The value immediately past the last certificate error code.
-NET_ERROR(CERT_END, -209)
+NET_ERROR(CERT_END, -210)
 
 // The URL is invalid.
 NET_ERROR(INVALID_URL, -300)
 
 // The scheme of the URL is disallowed.
 NET_ERROR(DISALLOWED_URL_SCHEME, -301)
 
 // The scheme of the URL is unknown.
 NET_ERROR(UNKNOWN_URL_SCHEME, -302)
 
@@ skipping 95 matching lines @@
 // internal error returned from the HttpCache to the HttpCacheTransaction that
 // tells the transaction to restart the entry-creation logic because the state
 // of the cache has changed.
 NET_ERROR(CACHE_RACE, -406)
 
 // The server's response was insecure (e.g. there was a cert error).
 NET_ERROR(INSECURE_RESPONSE, -501)
 //
 // The FTP PASV command failed.
 NET_ERROR(FTP_PASV_COMMAND_FAILED, -600)