proposal: crypto/tls: RFC 7685 support (ClientHello "padding(21)")

[MarkOtzen]

Unfortunately, there are TLS servers that refuse (and hang upon) ClientHello messages of sizes in the range 256-512 bytes, causing TLS handshake timeouts. RFC 7685 lets clients mitigate this by adding padding bytes to the ClientHello messages, so clients can adjust the ClientHello sizes at will as a workaround.

https://tools.ietf.org/html/rfc7685#section-1 reads:

Successive TLS [RFC5246] versions have added support for more cipher
suites and, over time, more TLS extensions have been defined. This
has caused the size of the TLS ClientHello to grow, and the
additional size has caused some implementation bugs to come to light.
At least one of these implementation bugs can be ameliorated by
making the ClientHello even larger. This is desirable given that
fully comprehensive patching of affected implementations is difficult
to achieve.
This memo describes a TLS extension that can be used to pad a
ClientHello to a desired size in order to avoid implementation bugs
caused by certain ClientHello sizes.

And here's a description of a buggy server implementation:
https://mailarchive.ietf.org/arch/msg/tls/8wXwhM1d5WSmROHFSgrTyFmWN2o/

Adding support for this extension would let users workaround these buggy server implementations.

[andybons]

@FiloSottile @katiehockman