Certificate Transparency: Threading the CT verifier into the SSL client socket.

net/base/net_error_list.h

Index: net/base/net_error_list.h
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h
index 559c5a317cf2dfda7029c6f3f8397aff58f04beb..76fa7ae88e31754473bfc85d8e0b4aac16acb299 100644
--- a/net/base/net_error_list.h
+++ b/net/base/net_error_list.h
@@ -708,3 +708,23 @@ NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)
+
+// Certificate Transparency-related errors
+
+// No Signed Certificate Timestamps present for
+// a certificate.

[wtc, 2013/11/26 01:47:23]

This should fit on the previous line.

[Eran M. (Google), 2013/11/26 14:45:53]

Removed entirely.

+NET_ERROR(NO_SCTS_PRESENT, -900)
+
+// Serialization of the Precertificate LogEntry or X.509 LogEntry failed

[wtc, 2013/11/26 01:47:23]

A period (.) is missing at the end of this sentence. Also on line 725.

[Eran M. (Google), 2013/11/26 14:45:53]

Done.

+// That means that there were no embedded SCTs *and* the DER encoding of the
+// certificate could not be created, which is surprising - as CT checks are
+// only performed after SCTs have been validated.
+// not be created.

[wtc, 2013/11/26 01:47:23]

Delete this line?

[Eran M. (Google), 2013/11/26 14:45:53]

Done.

+NET_ERROR(CT_LOG_ENTRY_CREATION_FAILED, -901)
+
+// All SCTs are from unknown logs
+NET_ERROR(NO_SCTS_FROM_KNOWN_LOGS, -902)
+
+// SCT(s) were present but failed to verify - this could indicate an attack
+// or corrupted SCTs.
+NET_ERROR(NO_SCTS_VERIFIED_OK, -903)