Certificate Transparency: Add the high-level interface for verifying SCTs over multiple logs

net/base/net_error_list.h

Index: net/base/net_error_list.h
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h
index 559c5a317cf2dfda7029c6f3f8397aff58f04beb..76fa7ae88e31754473bfc85d8e0b4aac16acb299 100644
--- a/net/base/net_error_list.h
+++ b/net/base/net_error_list.h
@@ -708,3 +708,23 @@ NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)
+
+// Certificate Transparency-related errors
+
+// No Signed Certificate Timestamps present for
+// a certificate.
+NET_ERROR(NO_SCTS_PRESENT, -900)
+
+// Serialization of the Precertificate LogEntry or X.509 LogEntry failed
+// That means that there were no embedded SCTs *and* the DER encoding of the
+// certificate could not be created, which is surprising - as CT checks are
+// only performed after SCTs have been validated.
+// not be created.
+NET_ERROR(CT_LOG_ENTRY_CREATION_FAILED, -901)
+
+// All SCTs are from unknown logs
+NET_ERROR(NO_SCTS_FROM_KNOWN_LOGS, -902)
+
+// SCT(s) were present but failed to verify - this could indicate an attack
+// or corrupted SCTs.
+NET_ERROR(NO_SCTS_VERIFIED_OK, -903)

[wtc, 2013/11/21 23:26:34]

I think CT-related errors seem to belong in the "200-299 Certificate errors"
block.

Please remove this file from this CL. Let's deal with this in your CL that adds
new bits to cert_status_flags.h.

[Eran M. (Google), 2013/11/23 21:02:07]

Done - reverted changes to this file.
As for including CT-related errors in the mentioned range, the errors included
in this range up to ERR_CERT_END are all included in the checks for
IsCertificateError, which affects the behaviour of error handling in the code in
many places.

Seems safe to include this error at the end of the range, e.g. -299 (since the
common error would be that no SCTs are present).