Introduce the ability to require CT for specific hosts

net/base/net_error_list.h

Index: net/base/net_error_list.h
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h
index 39b48c660f1040e53066c11fb938d099424d4d31..08afef3532dde7cb8b2185c48072c59d17d800e6 100644
--- a/net/base/net_error_list.h
+++ b/net/base/net_error_list.h
@@ -356,8 +356,10 @@ NET_ERROR(ICANN_NAME_COLLISION, -166)
 // not a certificate error code as no X509Certificate object is available. This
 // error is fatal.
 NET_ERROR(SSL_SERVER_CERT_BAD_FORMAT, -167)
+
 // Certificate Transparency: Received a signed tree head that failed to parse.
 NET_ERROR(CT_STH_PARSING_FAILED, -168)
+
 // Certificate Transparency: Received a signed tree head whose JSON parsing was
 // OK but was missing some of the fields.
 NET_ERROR(CT_STH_INCOMPLETE, -169)
@@ -371,6 +373,10 @@ NET_ERROR(UNABLE_TO_REUSE_CONNECTION_FOR_PROXY_AUTH, -170)
 // Certificate Transparency: Failed to parse the received consistency proof.
 NET_ERROR(CT_CONSISTENCY_PROOF_PARSING_FAILED, -171)
 
+// Certificate Transparency was required for this connection, but the server
+// did not provide CT information that complied with the policy.
+NET_ERROR(SSL_CERTIFICATE_TRANSPARENCY_REQUIRED, -172)

[mmenke, 2016/06/18 00:59:28]

Should there be error page text for this, reusing the text from one of the other
cert errors maybe, rather than showing a generic ERR_FAILED page?

+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.