-From 3cf1b730eae6021c1eac535a1f38e71ceb9bf7d1 Mon Sep 17 00:00:00 2001
+From f8f73238eb1a45dcd5400f4f921ffa9f204ac1cf Mon Sep 17 00:00:00 2001
 From: Dmitrii Pichulin <deem@deem.ru>
 Date: Wed, 7 Oct 2020 18:35:41 +0300
 Subject: [PATCH] chromium GOSTSSL

 ClientCertIdentityList GetClientCertsOnBackgroundThread(
     const SSLCertRequestInfo& request) {
   std::string server_domain = request.host_and_port.host();
@@ -385,6 +391,82 @@ ClientCertIdentityList GetClientCertsOnBackgroundThread(
   GetClientCertsImpl(std::move(preferred_identity),
                      std::move(regular_identities), request, true,
                      &selected_identities);
+
+#ifndef NO_GOSTSSL
+    {
+        {
+            char ** certs;
+            int * lens;
+            wchar_t ** names;
+            int count;
+            int is_gost;
+
+            gostssl_clientcertshook( &certs, &lens, &names, &count, &is_gost );
+
+            if( is_gost )
+                selected_identities.clear();
+
+            if( count )
+            {
+                CFMutableArrayRef certsValues = CFArrayCreateMutable( NULL, 0, &kCFTypeArrayCallBacks);
+
+                for( int i = 0; i < count; i++ )
+                {
+                    CFStringEncoding encoding = ( CFByteOrderLittleEndian == CFByteOrderGetCurrent() ) ? kCFStringEncodingUTF32LE : kCFStringEncodingUTF32BE;
+                    CFStringRef string = CFStringCreateWithBytes( NULL, (uint8_t *)names[i], wcslen( names[i] ) * sizeof( wchar_t ), encoding, false );
+                    CFArrayAppendValue( certsValues, string );
+                    CFRelease( string );
+                }
+
+                std::string authhost = request.host_and_port.host();
+                CFStringRef choose;
+                if( !authhost.empty() )
+                    choose = base::SysUTF8ToCFStringRef( "Выберите сертификат для аутентификации на https://" + authhost );
+                else
+                    choose = CFSTR( "Выберите сертификат для аутентификации" );
+
+                const void * keys[] = {
+                    kCFUserNotificationAlertHeaderKey,
+                    kCFUserNotificationAlertMessageKey,
+                    kCFUserNotificationDefaultButtonTitleKey,
+                    kCFUserNotificationAlternateButtonTitleKey,
+                    kCFUserNotificationCheckBoxTitlesKey
+                };
+                const void * values[] = {
+                    CFSTR( "Выбор сертификата" ),
+                    choose,
+                    CFSTR( "ОК" ),
+                    CFSTR( "Отмена" ),
+                    certsValues
+                };
+                CFDictionaryRef parameters = CFDictionaryCreate( NULL, keys, values, 5, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks );
+
+                SInt32 err = 0;
+                CFUserNotificationRef dialog = CFUserNotificationCreate( NULL, 0, kCFUserNotificationUseRadioButtonsFlag | kCFUserNotificationNoteAlertLevel | CFUserNotificationCheckBoxChecked( 0 ), &err, parameters );
+                CFOptionFlags responseFlags = 0;
+                CFUserNotificationReceiveResponse( dialog, 0, &responseFlags );
+                CFRelease( choose );
+                CFRelease( certsValues );
+                CFRelease( parameters );
+                CFRelease( dialog );
+                if( !( responseFlags & kCFUserNotificationCancelResponse ) )
+                {
+                    for( int i = 0; i < count; i++ )
+                        if( responseFlags & CFUserNotificationCheckBoxChecked( i ) )
+                        {
+                            scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromBytes( certs[i], lens[i] );
+                            if( !cert.get() )
+                                continue;
+                            ScopedCFTypeRef<SecIdentityRef> sec_identity;
+                            selected_identities.push_back( std::make_unique<ClientCertIdentityMac>( cert, std::move( sec_identity ) ) );
+                            break;
+                        }
+                }
+            }
+        }
+    }
+#endif // GOSTSSL
+
   return selected_identities;
 }
 
diff --git a/net/ssl/client_cert_store_nss.cc b/net/ssl/client_cert_store_nss.cc
index 0e5d02c625cb..ed9b20c357b3 100644
--- a/net/ssl/client_cert_store_nss.cc
+++ b/net/ssl/client_cert_store_nss.cc
@@ -145,6 +145,12 @@ void ClientCertStoreNSS::FilterCertsOnWorkerThread(

 sandbox/policy/mac/common.sb                  |  15 +++
 sandbox/win/src/process_mitigations.cc        |   4 +
 third_party/boringssl/BUILD.generated.gni     |   2 +
 29 files changed, 393 insertions(+), 9 deletions(-)

diff --git a/chrome/app/app-entitlements.plist b/chrome/app/app-entitlements.plist
index 1a37d509bfce..310d9aab7d47 100644
