Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 98d58bb

Browse files
bdcgooglebdcgoogle
committed
Summary: upgrading to openssl-0.9.8m and adding new testssl.sh
Testing Summary: - Passed new android.testssl/testssl.sh - General testing with BrowserActivity based program Details: Expanded detail in README.android about how to build and test openssl upgrades based on my first experience. modified: README.android Significant rework of import_openssl.sh script that does most of the work of the upgrade. Most of the existing code became the main and import functions. The newly regenerate code helps regenerate patch files, building on the fact that import now keeps and original unmodified read-only source tree for use for patch generation. Patch generation relies on additions to openssl.config for defining which patches include which files. Note that sometimes a file may be patched multiple times, in that case manual review is still necessary to prune the patch after auto-regeneration. Other enhancements to import_openssl.sh include generating android.testssl and printing Makefile defines for android-config.mk review. modified: import_openssl.sh Test support files for openssl/ Add support for building /system/bin/ssltest as test executible for use by testssl script. Need confirmation that this is the right way to define such a test binary. modified: patches/ssl_Android.mk Driver script that generates user and CA keys and certs on the device with /system/bin/openssl before running testssl. Based on openssl/test/testss for generation and openssl/test/Makefile test_ssl for test execution. new file: patches/testssl.sh Note all following android.testssl files are automatically imported from openssl, although possible with modifications by import_openssl.sh testssl script imported from openssl/test that does the bulk of the testing. Includes new tests patched in for our additions. new file: android.testssl/testssl CA and user certificate configuration files from openssl. Automatically imported from openssl/test/ new file: android.testssl/CAss.cnf new file: android.testssl/Uss.cnf certificate and key test file imported from openssl/apps new file: android.testssl/server2.pem Actual 0.9.8m upgrade specific bits Trying to bring ngm's small records support into 0.9.8m. Needs signoff by ngm although it does pass testing. modified: patches/small_records.patch Update openssl.config for 0.9.8m. Expanded lists of undeeded directories and files for easier update and review, adding new excludes. Also added new definitions to support "import_openssl.sh regenerate" for patch updating. modified: openssl.config Updated OPENSSL_VERSION to 0.9.8m modified: openssl.version Automatically imported/patched files. Seems like it could be further pruned in by openssl.config UNNEEDED_SOURCES, but extra stuff doesn't end up impacting device. modified: apps/... modified: crypto/... modified: include/... modified: ssl/... Other Android build stuff. Note for these patches/... is source, .../Android.mk is derived. Split LOCAL_CFLAGS additions into lines based on openssl/Makefile source for easier comparison when upgrading. I knowingly left the lines long and unwrapped for easy vdiff with openssl/Makefile modified: android-config.mk Removed local -DOPENSSL_NO_ECDH already in android-config.mk. modified: patches/apps_Android.mk Sync up with changes that had crept into derived crypto/Android.mk modified: patches/crypto_Android.mk Change-Id: I73204c56cdaccfc45d03a9c8088a6a93003d7ce6
1 parent 1ddd788 commit 98d58bb

207 files changed

Lines changed: 5005 additions & 20012 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.android‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,48 @@ Porting New Versions of OpenSSL.
1010
The following steps are recommended for porting new OpenSSL versions.
1111

1212
1) Retrieve the appropriate version of the OpenSSL source from
13-
www.openssl.org/source (in tar.gz format)
13+
www.openssl.org/source (in openssl-*.tar.gz file). Check the PGP
14+
signature (found in matching openssl-*.tar.gz.asc file) with:
1415

15-
2) Update the variables in openssl.config as appropriate
16+
gpg openssl-*.tar.gz
1617

17-
3) Run ./import_openssl.sh openssl-*.tar.gz
18+
If the public key is not found, import the the one with the
19+
matching RSA key ID from http://www.openssl.org/about/, using:
20+
21+
gpg --import # paste PGP public key block on stdin
22+
23+
2) Update the variables in openssl.config and openssl.version as appropriate.
24+
At the very least you will need to update the openssl.version.
25+
26+
3) Run:
27+
28+
./import_openssl.sh import openssl-*.tar.gz
1829

1930
4) If there are any errors, then modify openssl.config, openssl.version
20-
and patches in patches/ as appropriate. Repeat step 3.
31+
and patches in patches/ as appropriate. You might want to use:
32+
33+
./import_openssl.sh regenerate patches/*.patch
34+
35+
Repeat step 3.
2136

22-
5) From the root of the android source tree, build openssl. For
23-
example, on the dream platform, run make
24-
out/target/product/dream/obj/EXECUTABLES/openssl_intermediates/LINKED/openssl
37+
5) Cleanup before building with:
38+
39+
m -j16 clean-openssl clean-libcrypto clean-libssl
40+
41+
6) Build openssl from the external/openssl directory with:
42+
43+
mm -j16
2544

2645
If there are build errors, then patches/*.mk, openssl.config, or
2746
android-config.mk may need updating.
2847

48+
7) Run tests to make sure things are working:
49+
50+
(cd android.testssl/ && ./testssl.sh)
51+
52+
8) Do a full build before checking in:
53+
54+
m clobber && m -j16
2955

3056
Optionally, check whether build flags (located in android-config.mk
3157
need to be updated. Doing this step will help ensure that the
@@ -39,3 +65,5 @@ d) ./Configure $CONFIGURE_ARGS
3965
e) examine Makefile and compare with ../android-config.mk
4066
f) modify ../openssl.config as appropriate and go to step 3) above.
4167

68+
Alternatively, ."/import_openssl.sh import" now prints the
69+
post-Configure Makefile for review before deleting in on import.

‎android-config.mk‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,11 @@
77
# in the openssl distribution directory
88
#
99

10-
LOCAL_CFLAGS += -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H \
11-
-DL_ENDIAN -DOPENSSL_NO_HW -DOPENSSL_NO_BF -DOPENSSL_NO_CAMELLIA \
12-
-DOPENSSL_NO_CAPIENG -DOPENSSL_NO_CAST -DOPENSSL_NO_CMS -DOPENSSL_NO_GMP \
13-
-DOPENSSL_NO_IDEA -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 \
14-
-DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED -DOPENSSL_NO_TLSEXT \
15-
-DOPENSSL_NO_MD2 -DOPENSSL_NO_ENGINE -DOPENSSL_NO_EC -DOPENSSL_NO_ECDH \
16-
-DOPENSSL_NO_ECDSA -DOPENSSL_NO_OCSP -DZLIB
10+
# From CLFAG=
11+
LOCAL_CFLAGS += -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN #-DTERMIO
12+
13+
# From DEPFLAG=
14+
LOCAL_CFLAGS += -DOPENSSL_NO_BF -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_CAST -DOPENSSL_NO_CMS -DOPENSSL_NO_GMP -DOPENSSL_NO_IDEA -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED
15+
16+
# Extra
17+
LOCAL_CFLAGS += -DOPENSSL_NO_HW -DOPENSSL_NO_TLSEXT -DOPENSSL_NO_ENGINE -DOPENSSL_NO_EC -DOPENSSL_NO_ECDH -DOPENSSL_NO_ECDSA -DOPENSSL_NO_OCSP -DZLIB

‎android.testssl/CAss.cnf‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#
2+
# SSLeay example configuration file.
3+
# This is mostly being used for generation of certificate requests.
4+
#
5+
6+
RANDFILE = /mnt/sdcard/android.testssl/.rnd
7+
8+
####################################################################
9+
[ req ]
10+
default_bits = 1024
11+
default_keyfile = keySS.pem
12+
distinguished_name = req_distinguished_name
13+
encrypt_rsa_key = no
14+
default_md = sha1
15+
16+
[ req_distinguished_name ]
17+
countryName = Country Name (2 letter code)
18+
countryName_default = AU
19+
countryName_value = AU
20+
21+
organizationName = Organization Name (eg, company)
22+
organizationName_value = Dodgy Brothers
23+
24+
commonName = Common Name (eg, YOUR name)
25+
commonName_value = Dodgy CA
26+
27+
####################################################################
28+
[ ca ]
29+
default_ca = CA_default # The default ca section
30+
31+
####################################################################
32+
[ CA_default ]
33+
34+
dir = ./demoCA # Where everything is kept
35+
certs = $dir/certs # Where the issued certs are kept
36+
crl_dir = $dir/crl # Where the issued crl are kept
37+
database = $dir/index.txt # database index file.
38+
#unique_subject = no # Set to 'no' to allow creation of
39+
# several ctificates with same subject.
40+
new_certs_dir = $dir/newcerts # default place for new certs.
41+
42+
certificate = $dir/cacert.pem # The CA certificate
43+
serial = $dir/serial # The current serial number
44+
crl = $dir/crl.pem # The current CRL
45+
private_key = $dir/private/cakey.pem# The private key
46+
RANDFILE = $dir/private/.rand # private random number file
47+
48+
x509_extensions = v3_ca # The extentions to add to the cert
49+
50+
name_opt = ca_default # Subject Name options
51+
cert_opt = ca_default # Certificate field options
52+
53+
default_days = 365 # how long to certify for
54+
default_crl_days= 30 # how long before next CRL
55+
default_md = md5 # which md to use.
56+
preserve = no # keep passed DN ordering
57+
58+
policy = policy_anything
59+
60+
[ policy_anything ]
61+
countryName = optional
62+
stateOrProvinceName = optional
63+
localityName = optional
64+
organizationName = optional
65+
organizationalUnitName = optional
66+
commonName = supplied
67+
emailAddress = optional
68+
69+
70+
71+
[ v3_ca ]
72+
subjectKeyIdentifier=hash
73+
authorityKeyIdentifier=keyid:always,issuer:always
74+
basicConstraints = CA:true,pathlen:1
75+
keyUsage = cRLSign, keyCertSign
76+
issuerAltName=issuer:copy

‎android.testssl/Uss.cnf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#
2+
# SSLeay example configuration file.
3+
# This is mostly being used for generation of certificate requests.
4+
#
5+
6+
RANDFILE = /mnt/sdcard/android.testssl/.rnd
7+
8+
####################################################################
9+
[ req ]
10+
default_bits = 1024
11+
default_keyfile = keySS.pem
12+
distinguished_name = req_distinguished_name
13+
encrypt_rsa_key = no
14+
default_md = md2
15+
16+
[ req_distinguished_name ]
17+
countryName = Country Name (2 letter code)
18+
countryName_default = AU
19+
countryName_value = AU
20+
21+
organizationName = Organization Name (eg, company)
22+
organizationName_value = Dodgy Brothers
23+
24+
0.commonName = Common Name (eg, YOUR name)
25+
0.commonName_value = Brother 1
26+
27+
1.commonName = Common Name (eg, YOUR name)
28+
1.commonName_value = Brother 2
29+
30+
[ v3_ee ]
31+
subjectKeyIdentifier=hash
32+
authorityKeyIdentifier=keyid,issuer:always
33+
basicConstraints = CA:false
34+
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
35+
issuerAltName=issuer:copy
36+

0 commit comments

Comments
 (0)