[openssl-commits] [openssl] OpenSSL_1_1_1-stable update

[Matt Caswell]

The branch OpenSSL_1_1_1-stable has been updated
       via  952d813eeaa6baf01bf25b057f760a6f21147c7e (commit)
      from  980f7419cb3d7343d4f76ff648f5785b75a2efc4 (commit)


- Log -----------------------------------------------------------------
commit 952d813eeaa6baf01bf25b057f760a6f21147c7e
Author: Dmitry Belyavskiy <beldmit at gmail.com>
Date:   Fri Jan 4 20:38:29 2019 +0300

    Restore compatibility with GOST2001 implementations.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/7985)
    
    (cherry picked from commit 673e0bbbe4b9cbd19a247c0b18c171bb0421915a)

-----------------------------------------------------------------------

Summary of changes:
 ssl/statem/extensions.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c
index 716d6d2..11feae5 100644
--- a/ssl/statem/extensions.c
+++ b/ssl/statem/extensions.c
@@ -623,7 +623,12 @@ int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
                 && type != TLSEXT_TYPE_cookie
                 && type != TLSEXT_TYPE_renegotiate
                 && type != TLSEXT_TYPE_signed_certificate_timestamp
-                && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0) {
+                && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0
+#ifndef OPENSSL_NO_GOST
+                && !((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0
+                     && type == TLSEXT_TYPE_cryptopro_bug)
+#endif
+								) {
             SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION,
                      SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_UNSOLICITED_EXTENSION);
             goto err;