  net/socket/ssl_client_socket.cc               |   9 ++
  net/socket/ssl_client_socket.h                |   4 +
  net/socket/ssl_client_socket_impl.cc          | 100 ++++++++++++++++++
- net/spdy/spdy_session.cc                      |  12 +++
+ net/spdy/spdy_session.cc                      |  15 +++
  net/ssl/client_cert_store_mac.cc              |  80 ++++++++++++++
  net/ssl/client_cert_store_nss.cc              |  31 ++++++
  net/ssl/openssl_ssl_util.cc                   |   4 +
- net/ssl/ssl_cipher_suite_names.cc             |  26 +++++
+ net/ssl/ssl_cipher_suite_names.cc             |  36 +++++++
  net/ssl/ssl_platform_key_util.cc              |  21 ++++
  net/ssl/ssl_platform_key_util.h               |   7 ++
  sandbox/win/src/process_mitigations.cc        |   4 +
  .../service_manager/sandbox/mac/common.sb     |  15 +++
  third_party/boringssl/BUILD.generated.gni     |   2 +
- 23 files changed, 397 insertions(+), 14 deletions(-)
+ 23 files changed, 410 insertions(+), 14 deletions(-)
 
 diff --git a/chrome/app/app-entitlements.plist b/chrome/app/app-entitlements.plist
 index 4a1d735cfe35..310d9aab7d47 100644

+  switch( cipher_suite )
+  {
+  case 0x0081: // GOST2001-GOST89-GOST89
+      *key_exchange_str = "GOSTR341001";
+      *cipher_str = "GOST28147CNT";
+      *mac_str = "GOST28147IMIT";
+      return;
+
+  case 0xff85: // GOST2012-GOST8912-GOST8912
+      *key_exchange_str = "GOSTR341012";
+      *cipher_str = "GOST28147CNT";
+      *mac_str = "GOST28147IMIT";
+      return;
+
+  default:
+      break;
+
+  }
+#endif // GOSTSSL
+
   const SSL_CIPHER* cipher = SSL_get_cipher_by_value(cipher_suite);
   if (!cipher)
     return;
@@ -179,6 +200,11 @@ int ObsoleteSSLStatus(int connection_status, uint16_t signature_algorithm) {
   obsolete_ssl |= ObsoleteSSLStatusForProtocol(ssl_version);
 
   uint16_t cipher_suite = SSLConnectionStatusToCipherSuite(connection_status);
+#ifndef NO_GOSTSSL
+  if( cipher_suite == 0x0081 /* GOST2001-GOST89-GOST89 */ || 
+      cipher_suite == 0xff85 /* GOST2012-GOST8912-GOST8912 */ )
+    return OBSOLETE_SSL_NONE;
+#endif // GOSTSSL

 ; This is read by CFPrefs calling getpwuid in a loop. libinfo then fails to
 ; contact any of the opendirectoryd mach services, and falls back to
diff --git a/third_party/boringssl/BUILD.generated.gni b/third_party/boringssl/BUILD.generated.gni
index e399985d965d..5f46548e3ca1 100644
--- a/third_party/boringssl/BUILD.generated.gni
+++ b/third_party/boringssl/BUILD.generated.gni
@@ -5,6 +5,8 @@
