Remove the old F5 padding workaround Many, many, many eons ago, SSL 2.0 was born. Many, many eons ago, SSL 3.0 was born. SSL 3.0 was a completely different record layer from SSL 3.0. Since then, all versions of TLS kept continuity with SSL 3.0 in the record layer and ClientHello. Many eons ago, F5 shipped a TLS load balancer that supported SSL 2.0 and SSL 3.0. As part of that, they had to detect SSL 2.0 and SSL 3.0. Eons ago, ClientHellos started hanging when talking to F5 servers. It turned out that, once we made the TLS ClientHello exceed 256 bytes for ALPN, F5 misinterpeted it as an incomplete SSL 2.0 CLIENT-HELLO and hung. https://mailarchive.ietf.org/arch/msg/tls/8wXwhM1d5WSmROHFSgrTyFmWN2o/ https://www.imperialviolet.org/2013/10/07/f5update.html It turned out bumping the size up to 512 bytes would dodge the bug, so the padding extension was born: https://www.rfc-editor.org/info/rfc7685/ It has now been almost 10 years. In that time, ClientHellos have gotten larger. With X25519MLKEM768 enabled by default, every ClientHello over well over 1 KiB and the padding is a no-op. Also the F5s have hopefully gotten updated. Remove the padding, which requires some somewhat subtle bookkeeping. In particular, we usually qualify changes with Chromium but as Chromium has long enabled ML-KEM, we have gotten all the signal we ever will get about F5. Update-Note: If there are still unupdated F5s out there, a TLS client application may hang when connecting to them. This would only happen if your application: 1. Bypasses BoringSSL's default of enabling TLS 1.3, or 2. Bypasses BoringSSL's default of enabling X25519MLKEM768 Impacted applications should enable TLS 1.3 and X25519MLKEM768 for better compatibility and security. Applications using BoringSSLs defaults are not impacted by this change. Fixed: 532111493 Change-Id: I78fd1d65d9fa7c25347fb56803acd6137f038eae Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101007 Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Lily Chen <chlily@google.com> Commit-Queue: David Benjamin <davidben@google.com> Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
To file a security issue, use the Chromium process and mention in the report this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.
There are other files in this directory which might be helpful: