Certificate Transparency TLS extension patch for NSS

net/third_party/nss/ssl/sslt.h

Index: net/third_party/nss/ssl/sslt.h
diff --git a/net/third_party/nss/ssl/sslt.h b/net/third_party/nss/ssl/sslt.h
index a8007d8b4cf5e73cf5509e0ecb04f994ae40b403..ef77f210969387db6b46688da72763dbe21bd52c 100644
--- a/net/third_party/nss/ssl/sslt.h
+++ b/net/third_party/nss/ssl/sslt.h
@@ -205,9 +205,10 @@ typedef enum {
     ssl_session_ticket_xtn           = 35,
     ssl_next_proto_nego_xtn          = 13172,
     ssl_channel_id_xtn               = 30031,
-    ssl_renegotiation_info_xtn       = 0xff01	/* experimental number */
+    ssl_renegotiation_info_xtn       = 0xff01,	/* experimental number */
+    ssl_signed_certificate_timestamp_xtn = 18   /* RFC 6962 */

[wtc, 2013/11/08 19:51:31]

Please list this extension after ssl_app_layer_protocol_xtn (= 16).

Nit: it is tempting to shorten this enum name a bit. Perhaps we can abbreviate
"certificate" to "cert".

[ekasper, 2013/11/18 17:47:18]

Done.
If you don't feel too strongly about it, I would keep the official enum name.
Makes it easier to match to RFC.

[wtc, 2013/11/19 23:52:28]

Yes, this is fine. I suggested ssl_signed_cert_timestamp_xtn partly because it
messed up the alignment of the equal signs, and partly because I saw you use
"ssl_signed_cert_timestamps" in the test script ssl.sh.

 } SSLExtensionType;
 
-#define SSL_MAX_EXTENSIONS             11
+#define SSL_MAX_EXTENSIONS             12
 
 #endif /* __sslt_h_ */