Remove the old F5 padding workaround

Many, many, many eons ago, SSL 2.0 was born.

Many, many eons ago, SSL 3.0 was born. SSL 3.0 was a completely
different record layer from SSL 3.0. Since then, all versions of TLS
kept continuity with SSL 3.0 in the record layer and ClientHello.

Many eons ago, F5 shipped a TLS load balancer that supported SSL 2.0 and
SSL 3.0. As part of that, they had to detect SSL 2.0 and SSL 3.0.

Eons ago, ClientHellos started hanging when talking to F5 servers. It
turned out that, once we made the TLS ClientHello exceed 256 bytes for
ALPN, F5 misinterpeted it as an incomplete SSL 2.0 CLIENT-HELLO and
hung.
https://mailarchive.ietf.org/arch/msg/tls/8wXwhM1d5WSmROHFSgrTyFmWN2o/
https://www.imperialviolet.org/2013/10/07/f5update.html

It turned out bumping the size up to 512 bytes would dodge the bug, so
the padding extension was born:
https://www.rfc-editor.org/info/rfc7685/

It has now been almost 10 years. In that time, ClientHellos have gotten
larger. With X25519MLKEM768 enabled by default, every ClientHello over
well over 1 KiB and the padding is a no-op. Also the F5s have hopefully
gotten updated.

Remove the padding, which requires some somewhat subtle bookkeeping. In
particular, we usually qualify changes with Chromium but as Chromium has
long enabled ML-KEM, we have gotten all the signal we ever will get
about F5.

Update-Note: If there are still unupdated F5s out there, a TLS client
application may hang when connecting to them. This would only happen if
your application:

1. Bypasses BoringSSL's default of enabling TLS 1.3, or
2. Bypasses BoringSSL's default of enabling X25519MLKEM768

Impacted applications should enable TLS 1.3 and X25519MLKEM768 for
better compatibility and security. Applications using BoringSSLs
defaults are not impacted by this change.

Fixed: 532111493
Change-Id: I78fd1d65d9fa7c25347fb56803acd6137f038eae
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101007
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Lily Chen <chlily@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
3 files changed
tree: b7dda43aae5448010bb8930c9017837b96a24a10
  1. .agents/
  2. .bcr/
  3. .github/
  4. agents/
  5. bench/
  6. cmake/
  7. crypto/
  8. decrepit/
  9. docs/
  10. fuzz/
  11. gen/
  12. include/
  13. infra/
  14. pki/
  15. rust/
  16. ssl/
  17. third_party/
  18. tool/
  19. util/
  20. .bazelignore
  21. .bazelrc
  22. .bazelversion
  23. .clang-format
  24. .clang-format-ignore
  25. .clangd
  26. .gitattributes
  27. .gitignore
  28. API-CONVENTIONS.md
  29. AUTHORS
  30. BREAKING-CHANGES.md
  31. BUILD.bazel
  32. build.json
  33. BUILDING.md
  34. CMakeLists.txt
  35. codereview.settings
  36. CONTRIBUTING.md
  37. FUZZING.md
  38. go.mod
  39. go.sum
  40. INCORPORATING.md
  41. LICENSE
  42. MODULE.bazel
  43. MODULE.bazel.lock
  44. PORTING.md
  45. PRESUBMIT.py
  46. PrivacyInfo.xcprivacy
  47. README.md
  48. SANDBOXING.md
  49. SECURITY.md
  50. STYLE.md
README.md

BoringSSL

BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.

Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.

Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.

BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.

Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.

Project links:

To file a security issue, use the Chromium process and mention in the report this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.

There are other files in this directory which might be helpful: