Detect Kaspersky SSL MITM and give a helpful error message.

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index 9657026f73ebe1bd42236e684391cc4855f2f17e..76c270cb05ced4b97c6b656a54378c5cfefc5d4e 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -451,6 +451,7 @@ SSLClientSocketNSS::SSLClientSocketNSS(ClientSocketHandle* transport_socket,
       handshake_callback_called_(false),
       completed_handshake_(false),
       eset_mitm_detected_(false),
+      kaspersky_mitm_detected_(false),
       predicted_cert_chain_correct_(false),
       next_handshake_state_(STATE_NONE),
       nss_fd_(NULL),
@@ -633,6 +634,7 @@ void SSLClientSocketNSS::Disconnect() {
   ssl_connection_status_ = 0;
   completed_handshake_   = false;
   eset_mitm_detected_    = false;
+  kaspersky_mitm_detected_ = false;
   start_cert_verification_time_ = base::TimeTicks();
   predicted_cert_chain_correct_ = false;
   nss_bufs_              = NULL;
@@ -1380,6 +1382,8 @@ int SSLClientSocketNSS::DoHandshake() {
     if (handshake_callback_called_) {
       if (eset_mitm_detected_) {
         net_error = ERR_ESET_ANTI_VIRUS_SSL_INTERCEPTION;
+      } else if (kaspersky_mitm_detected_) {
+        net_error = ERR_KASPERSKY_ANTI_VIRUS_SSL_INTERCEPTION;
       } else {
         // We need to see if the predicted certificate chain (in
         // |ssl_host_info_->state().certs) matches the actual certificate chain
@@ -1877,6 +1881,10 @@ SECStatus SSLClientSocketNSS::OwnAuthCertHandler(void* arg,
         if (strcmp(common_name, "ESET_RootSslCert") == 0)
           that->eset_mitm_detected_ = true;
         if (strcmp(common_name,
+                   "Kaspersky Anti-Virus personal root certificate") == 0) {
+          that->kaspersky_mitm_detected_ = true;
+        }

[wtc, 2011/06/30 14:26:25]

Nit: since disabling False Start doesn't help, it seems that
we should detect Kaspersky products outside the if (false_start)
block.

Since Chrome enables False Start by default, this makes
little difference in practice.

[agl, 2011/07/01 14:34:42]

Done. It's still within an #ifdef SSL_ENABLE_FALSE_START, but that'll always be
true on Windows.

+        if (strcmp(common_name,
                    "ContentWatch Root Certificate Authority") == 0) {
           // This is NetNanny. NetNanny are updating their product so we
           // silently disable False Start for now.