Certificate Transparency TLS extension patch for NSS

net/third_party/nss/ssl/sslt.h

 /*
  * This file contains prototypes for the public SSL functions.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef __sslt_h_
 #define __sslt_h_
 
@@ skipping 187 matching lines @@
 #ifdef NSS_ENABLE_ECC
     ssl_elliptic_curves_xtn          = 10,
     ssl_ec_point_formats_xtn         = 11,
 #endif
     ssl_signature_algorithms_xtn     = 13,
     ssl_use_srtp_xtn                 = 14,
     ssl_app_layer_protocol_xtn       = 16,
     ssl_session_ticket_xtn           = 35,
     ssl_next_proto_nego_xtn          = 13172,
     ssl_channel_id_xtn               = 30031,
-    ssl_renegotiation_info_xtn       = 0xff01   /* experimental number */
+    ssl_renegotiation_info_xtn       = 0xff01,  /* experimental number */
+    ssl_signed_certificate_timestamp_xtn = 18   /* RFC 6962 */

[wtc, 2013/11/08 19:51:31]

Please list this extension after ssl_app_layer_protocol_xtn (= 16).

Nit: it is tempting to shorten this enum name a bit. Perhaps we can abbreviate
"certificate" to "cert".

[ekasper, 2013/11/18 17:47:18]

Done.
If you don't feel too strongly about it, I would keep the official enum name.
Makes it easier to match to RFC.

[wtc, 2013/11/19 23:52:28]

Yes, this is fine. I suggested ssl_signed_cert_timestamp_xtn partly because it
messed up the alignment of the equal signs, and partly because I saw you use
"ssl_signed_cert_timestamps" in the test script ssl.sh.

 } SSLExtensionType;
 
-#define SSL_MAX_EXTENSIONS             11
+#define SSL_MAX_EXTENSIONS             12
 
 #endif /* __sslt_h_ */