net: a weak DH key is not a certificate error.

net/base/net_errors.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_NET_ERRORS_H__
 #define NET_BASE_NET_ERRORS_H__
 
 #include <vector>
 
 #include "base/basictypes.h"
@@ skipping 17 matching lines @@
   // The value of the first certificate error code.
   ERR_CERT_BEGIN = ERR_CERT_COMMON_NAME_INVALID,
 };
 
 // Returns a textual representation of the error code for logging purposes.
 NET_EXPORT const char* ErrorToString(int error);
 
 // Returns true if |error| is a certificate error code.
 inline bool IsCertificateError(int error) {
   // Certificate errors are negative integers from net::ERR_CERT_BEGIN
   // (inclusive) to net::ERR_CERT_END (exclusive) in *decreasing* order.

[wtc, 2014/03/04 20:13:30]

This comment should be updated to note ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN as
an exception to this rule.

The rule is that all certificate errors should be within this range, and have a
corresponding certificate error status bit defined in cert_status_flags.h.

There is another related problem (also coming from
https://codereview.chromium.org/23908005/): ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY
has a corresponding CERT_STATUS_WEAK_DH_KEY bit. That certificate error status
bit should be removed.

As for ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN, we usually don't change the numeric
value of an error code. We can, however, replace it with a new error code
ERR_CERT_PINNED_KEY_MISSING within the certificate error range.

[agl, 2014/03/04 22:54:38]

Done.
Yea. The problem stems from the fact that I didn't intend for pinning to be a
certificate error. I planned on it being a simple, fatal error like a connection
failure.
Since this is a crash fix and will probably be merged, I'll keep it simple.
Again, I'll avoid doing this in this change. I'd like to talk to felt about the
treatment of pinning errors first.

   return (error <= ERR_CERT_BEGIN && error > ERR_CERT_END) ||
-         (error == ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY) ||
          (error == ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN);
 }
 
 // Map system error code to Error.
 NET_EXPORT Error MapSystemError(int os_error);
 
 // Returns a list of all the possible net error codes (not counting OK). This
 // is intended for use with UMA histograms that are reporting the result of
 // an action that is represented as a net error code.
 //
 // Note that the error codes are all positive (since histograms expect positive
 // sample values). Also note that a guard bucket is created after any valid
 // error code that is not followed immediately by a valid error code.
 NET_EXPORT std::vector<int> GetAllErrorCodesForUma();
 
 // A convenient function to translate file error to net error code.
 NET_EXPORT Error FileErrorToNetError(base::File::Error file_error);
 
 }  // namespace net
 
 #endif  // NET_BASE_NET_ERRORS_H__