Certificate Transparency: Threading the CT verifier into the SSL client socket.

net/base/net_error_list.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file intentionally does not have header guards, it's included
 // inside a macro to generate enum values.
 
 // This file contains the list of network errors.
 
 //
 // Ranges:
 //     0- 99 System related errors
 //   100-199 Connection related errors
 //   200-299 Certificate errors
 //   300-399 HTTP errors
 //   400-499 Cache errors
 //   500-599 ?
 //   600-699 FTP errors
 //   700-799 Certificate manager errors
 //   800-899 DNS resolver errors

[wtc, 2013/11/26 01:47:23]

Please document the new error code range here.

Are you sure you can't use the "200-299 Certificate errors" range?

[Eran M. (Google), 2013/11/26 14:45:53]

As suggested, added it to the 200-299 certificate error range (at the end of the
range).

 
 // An asynchronous IO operation is not yet complete.  This usually does not
 // indicate a fatal error.  Typically this error will be generated as a
 // notification to wait for some external notification that the IO operation
 // finally completed.
 NET_ERROR(IO_PENDING, -1)
 
 // A generic failure occurred.
 NET_ERROR(FAILED, -2)
 
@@ skipping 670 matching lines @@
 NET_ERROR(DNS_TIMED_OUT, -803)
 
 // The entry was not found in cache, for cache-only lookups.
 NET_ERROR(DNS_CACHE_MISS, -804)
 
 // Suffix search list rules prevent resolution of the given host name.
 NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)
+
+// Certificate Transparency-related errors
+
+// No Signed Certificate Timestamps present for
+// a certificate.

[wtc, 2013/11/26 01:47:23]

This should fit on the previous line.

[Eran M. (Google), 2013/11/26 14:45:53]

Removed entirely.

+NET_ERROR(NO_SCTS_PRESENT, -900)
+
+// Serialization of the Precertificate LogEntry or X.509 LogEntry failed

[wtc, 2013/11/26 01:47:23]

A period (.) is missing at the end of this sentence. Also on line 725.

[Eran M. (Google), 2013/11/26 14:45:53]

Done.

+// That means that there were no embedded SCTs *and* the DER encoding of the
+// certificate could not be created, which is surprising - as CT checks are
+// only performed after SCTs have been validated.
+// not be created.

[wtc, 2013/11/26 01:47:23]

Delete this line?

[Eran M. (Google), 2013/11/26 14:45:53]

Done.

+NET_ERROR(CT_LOG_ENTRY_CREATION_FAILED, -901)
+
+// All SCTs are from unknown logs
+NET_ERROR(NO_SCTS_FROM_KNOWN_LOGS, -902)
+
+// SCT(s) were present but failed to verify - this could indicate an attack
+// or corrupted SCTs.
+NET_ERROR(NO_SCTS_VERIFIED_OK, -903)