Commit bcf6c886dd for openssl.org

commit bcf6c886dd5336d972444c9c2820cf4d293a0886
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Wed Aug 5 16:04:54 2026 +0200

    statem: fail ClientHello construction on ECH GREASE failure

    tls_construct_ctos_ech() called SSLfatal() on an ECH GREASE
    construction failure but returned EXT_RETURN_NOT_SENT, so extension
    construction reported success while the connection was already in the
    fatal error state. The ClientHello would still be sent together with
    the fatal alert and the state machine kept running until it tripped
    over the error state later. Return EXT_RETURN_FAIL to fail the
    construction immediately.

    Assisted-by: Claude:claude-fable-5
    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Wed Sep 16 09:31:48 2026
    Merged-from: https://github.com/openssl/openssl/pull/32201

diff --git a/ssl/statem/extensions_clnt.c b/ssl/statem/extensions_clnt.c
index cca40b06d0..c9a37512a5 100644
--- a/ssl/statem/extensions_clnt.c
+++ b/ssl/statem/extensions_clnt.c
@@ -2650,7 +2650,7 @@ EXT_RETURN tls_construct_ctos_ech(SSL_CONNECTION *s, WPACKET *pkt,
             s->ext.ech.attempted_type = TLSEXT_TYPE_ech;
         if (ossl_ech_send_grease(s, pkt) != 1) {
             SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-            return EXT_RETURN_NOT_SENT;
+            return EXT_RETURN_FAIL;
         }
         return EXT_RETURN_SENT;
     }