Add a dedicated error code for TLS 1.3 interference.

net/base/net_error_list.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file intentionally does not have header guards, it's included
 // inside a macro to generate enum values.
 
 // This file contains the list of network errors.
 
 //
@@ skipping 372 matching lines @@
 NET_ERROR(SSL_OBSOLETE_CIPHER, -172)
 
 // When a WebSocket handshake is done successfully and the connection has been
 // upgraded, the URLRequest is cancelled with this error code.
 NET_ERROR(WS_UPGRADE, -173)
 
 // Socket ReadIfReady support is not implemented. This error should not be user
 // visible, because the normal Read() method is used as a fallback.
 NET_ERROR(READ_IF_READY_NOT_IMPLEMENTED, -174)
 
+// This error is emitted if TLS 1.3 is enabled, connecting with it failed, but
+// retrying at a downgraded maximum version succeeded. This could mean:
+//

[svaldez, 2017/04/10 20:40:02]

Maybe reorder this in expected order:

1) Middlebox
2) Endpoint
3) Network Error

[davidben, 2017/04/10 21:07:36]

Expected order isn't really meaningful. It also is very important that consumers
realize this is a flaky check, so I want it to be first. Switched the bottom two
though.

+// 1. This is a transient network error that will be resolved when the user
+//    reloads.
+//
+// 2. The server is buggy and does not implement TLS version negotiation
+//    correctly. TLS 1.3 was tweaked to avoid a common server bug here, so this
+//    is unlikely.
+//
+// 3. The user is behind a buggy network middlebox, firewall, or proxy which is
+//    interfering with TLS 1.3.
+NET_ERROR(SSL_VERSION_INTERFERENCE, -175)
+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.
 
 // The server responded with a certificate whose common name did not match
 // the host name.  This could mean:
 //
 // 1. An attacker has redirected our traffic to their server and is
 //    presenting a certificate for which they know the private key.
 //
@@ skipping 456 matching lines @@
 NET_ERROR(DNS_TIMED_OUT, -803)
 
 // The entry was not found in cache, for cache-only lookups.
 NET_ERROR(DNS_CACHE_MISS, -804)
 
 // Suffix search list rules prevent resolution of the given host name.
 NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)