Fix SSLClientSocketOpenSSL error-handling for Channel ID.

net/base/net_error_list.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file intentionally does not have header guards, it's included
 // inside a macro to generate enum values.
 
 // This file contains the list of network errors.
 
 //
@@ skipping 714 matching lines @@
 
 // Failure to export private key.
 NET_ERROR(PRIVATE_KEY_EXPORT_FAILED, -712)
 
 // Self-signed certificate generation failed.
 NET_ERROR(SELF_SIGNED_CERT_GENERATION_FAILED, -713)
 
 // The certificate database changed in some way.
 NET_ERROR(CERT_DATABASE_CHANGED, -714)
 
+// Failure to import Channel ID.
+NET_ERROR(CHANNEL_ID_IMPORT_FAILED, -715)

[wtc, 2014/06/19 22:00:11]

Should we change ssl_client_socket_nss.cc to use this error code? Right now it
is mapping the NSS error code:

  SECItem cert_item;
  cert_item.data = (unsigned char*) domain_bound_cert_.data();
  cert_item.len = domain_bound_cert_.size();
  ScopedCERTCertificate cert(CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
                                                     &cert_item,
                                                     NULL,
                                                     PR_FALSE,
                                                     PR_TRUE));
  if (cert == NULL)
    return MapNSSError(PORT_GetError());

and

  crypto::ScopedPK11Slot slot(PK11_GetInternalSlot());
  // Set the private key.
  if (!crypto::ECPrivateKey::ImportFromEncryptedPrivateKeyInfo(
          slot.get(),
          ServerBoundCertService::kEPKIPassword,
          reinterpret_cast<const unsigned char*>(
              domain_bound_private_key_.data()),
          domain_bound_private_key_.size(),
          &cert->subjectPublicKeyInfo,
          false,
          false,
          key,
          public_key)) {
    int error = MapNSSError(PORT_GetError());
    return error;
  }

[davidben, 2014/06/19 22:36:38]

We could. Although, unlike the function OpenSSL is using, the NSS one preserves
the NSS error code. In theory it could get a more detailed error if we mapped
the error code. I don't have preferences as to whether we should switch to this
one.

[wtc, 2014/06/20 00:21:54]

OK, let's leave ssl_client_socket_nss.cc unchanged. I will use this new error
code in my QUIC Channel ID code.

+
 // DNS error codes.
 
 // DNS resolver received a malformed response.
 NET_ERROR(DNS_MALFORMED_RESPONSE, -800)
 
 // DNS server requires TCP
 NET_ERROR(DNS_SERVER_REQUIRES_TCP, -801)
 
 // DNS server failed.  This error is returned for all of the following
 // error conditions:
@@ skipping 10 matching lines @@
 NET_ERROR(DNS_TIMED_OUT, -803)
 
 // The entry was not found in cache, for cache-only lookups.
 NET_ERROR(DNS_CACHE_MISS, -804)
 
 // Suffix search list rules prevent resolution of the given host name.
 NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)