Fix SSLClientSocketOpenSSL error-handling for Channel ID.

net/base/net_error_list.h

Index: net/base/net_error_list.h
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h
index 65d3a45d19824b5e7e12a78e8abad652e11d49e1..e2686bd090da73c0410aec644bdbdacc48c94fee 100644
--- a/net/base/net_error_list.h
+++ b/net/base/net_error_list.h
@@ -732,6 +732,9 @@ NET_ERROR(SELF_SIGNED_CERT_GENERATION_FAILED, -713)
 // The certificate database changed in some way.
 NET_ERROR(CERT_DATABASE_CHANGED, -714)
 
+// Failure to import Channel ID.
+NET_ERROR(CHANNEL_ID_IMPORT_FAILED, -715)

[wtc, 2014/06/19 22:00:11]

Should we change ssl_client_socket_nss.cc to use this error code? Right now it
is mapping the NSS error code:

  SECItem cert_item;
  cert_item.data = (unsigned char*) domain_bound_cert_.data();
  cert_item.len = domain_bound_cert_.size();
  ScopedCERTCertificate cert(CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
                                                     &cert_item,
                                                     NULL,
                                                     PR_FALSE,
                                                     PR_TRUE));
  if (cert == NULL)
    return MapNSSError(PORT_GetError());

and

  crypto::ScopedPK11Slot slot(PK11_GetInternalSlot());
  // Set the private key.
  if (!crypto::ECPrivateKey::ImportFromEncryptedPrivateKeyInfo(
          slot.get(),
          ServerBoundCertService::kEPKIPassword,
          reinterpret_cast<const unsigned char*>(
              domain_bound_private_key_.data()),
          domain_bound_private_key_.size(),
          &cert->subjectPublicKeyInfo,
          false,
          false,
          key,
          public_key)) {
    int error = MapNSSError(PORT_GetError());
    return error;
  }

[davidben, 2014/06/19 22:36:38]

We could. Although, unlike the function OpenSSL is using, the NSS one preserves
the NSS error code. In theory it could get a more detailed error if we mapped
the error code. I don't have preferences as to whether we should switch to this
one.

[wtc, 2014/06/20 00:21:54]

OK, let's leave ssl_client_socket_nss.cc unchanged. I will use this new error
code in my QUIC Channel ID code.

+
 // DNS error codes.
 
 // DNS resolver received a malformed response.