[openssl/openssl] 5578e4: Remove the F5 ClientHello-padding workaround

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 5578e426ccd22135301379557683130d8bc30afe
      https://github.com/openssl/openssl/commit/5578e426ccd22135301379557683130d8bc30afe
  Author: Bob Beck <[email protected]>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M CHANGES.md
    M doc/designs/quic-design/quic-api-ssl-funcs.md
    M doc/man3/SSL_CTX_set_options.pod
    M doc/man7/ossl-guide-migration.pod
    M include/openssl/ssl.h.in
    M ssl/ssl_local.h
    M ssl/statem/extensions.c
    M ssl/statem/extensions_clnt.c
    M ssl/statem/extensions_cust.c
    M ssl/statem/statem_local.h
    M test/clienthellotest.c
    M test/ext_internal_test.c
    M test/recipes/70-test_clienthello.t

  Log Message:
  -----------
  Remove the F5 ClientHello-padding workaround

And remove the support for the padding extension (RFC7685).

With this change our client will cease sending the padding extension.
It was only ever sent, via SSL_OP_TLSEXT_PADDING, to work around a
very old bug in F5 middleboxes that choked on ClientHellos between 256
and 511 bytes.

The fix shipped long ago from F5, and the affected hardware is long out of
support, so nothing should still be running the problematic version.

SSL_OP_TLSEXT_PADDING is now a no-op retained for compatibility and
is no longer part of SSL_OP_ALL.

In case anyone wants to actually still use the padding extension
for some reason, as we no longer have a handler for this extension,
they can register a custom extension handler to do whatever they like
with it.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Merge-date: Tue Aug 18 08:39:12 2026
Merged-from: https://github.com/openssl/openssl/pull/32389



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/b7cae5-5578e4%40github.com.