Name: openssl URL: http://openssl.org/source/ Version: 1.0.1e License: BSDish License File: openssl/NOTICE License Android Compatible: yes Security Critical: yes Description: This is OpenSSL, the standard SSL/TLS library, which is used *only* in the following cases: - For Chrome/Chromium, only on Android to implement SSL/TLS support (while certificate validation is performed through the platform APIs), instead of using NSS as on other Linux-based operating systems. Note that there is no plans to support OpenSSL in Chromium on other platforms. For more context, please read: https://groups.google.com/a/chromium.org/d/msg/chromium-dev/gmO3U9HLY3Y/RPGNiQ-NL-YJ - To implement net/tools/flip_server, a host-side tool. Read more about it at the following page: http://dev.chromium.org/spdy/running_flipinmemserver This means that the library must be built for these systems: Android/ARM Android/x86 Linux/x86 Linux/x86_64 Darwin/x86 Darwin/x86_64 Whenever you change it, try to rebuild Chromium for all these systems. ************************************************************************** Automatic generation of source tree. Most of the sources in this directory are auto-generated and come from the Android version of the OpenSSL sources, with a few Chromium-specific patches applied. Said Android sources are themselves a patched subset of the official OpenSSL release sources, generated by a special import script. To update the sources for Chromium, one has to modify openssl-chromium.config or the content of patches.chromium/ then run: ./import_from_android.sh Before doing that, you should understand how everything works: 1) Android-specific files are taken from a given commit from the AOSP git servers. See how 'openssl-chromium.config' defines the following variables: ANDROID_OPENSSL_GIT_SOURCE -> point to source git server. ANDROID_OPENSSL_GIT_COMMIT -> point to git commit 2) All downloaded Android-specific files are placed under the openssl/ sub-directory. The most important files are the following: openssl/openssl.version Configuration file telling which upstream version of OpenSSL sources to use. openssl/patches/ Directory containing several Android-specific patches to apply to the official OpenSSL sources to create the Android ones. See openssl/patches/README for a description of what each of these patches do. openssl/openssl.config Configuration file describing which build-time options to enable, what patches to apply, which source files to compile (including CPU architecture-specific variants), and which sources to keep in the final source directory. openssl/import_openssl.sh Import script used to regenerate all other Android-specific source files, based on the configuration files above and a tarball of the official OpenSSL source release. For example, to rebuild the full Android source tree (without any Chromium patches), one would do something like: cd openssl/ ./import_openssl.sh import /path/to/openssl-.tar.gz where matches the definition found in 'openssl.version'. 3) Chromium adds a few of its own files: openssl-chromium.config Configuration file which indicates: - The reference Android OpenSSL git repository and commit. - The download location of official OpenSSL source tarballs. - The corresponding SHA-1 sum, for sanity checking. patches.chromium/ A set of additional patches to apply to the openssl/ tree after it has been downloaded from the Android git repository. These patches are applied _before_ import_openssl.sh is run to re-generate the final set of sources. This allows modifying the content of any Android configuration file easily. openssl.gyp A gyp build file for the library. Manually maintained, this file includes openssl.gypi below. openssl.gypi An *auto-generated* gyp include file that contains the required definitions used to describe the library's sources to the Chromium build system. Its content mirrors openssl/openssl.config in a gyp-compatible way. config/x64/openssl/opensslconf.h Another *auto-generated* file used for 64-bit builds of the library only. This is required for correctness because the Android sources only come with a single generic header which is tailored for 32-bit builds. Using the latter results either in a broken build, or even worse, in a library that doesn't work correctly. The content of this file is a simple copy of openssl/include/openssl/opensslconf.h, with a few lines altered to reflect that the target has 64-bit types. import_from_android.sh The top-level script that will automatically perform the full Chromium download + patching + import + auto-generation process. More specifically, calling 'import_from_android.sh' will do the following: 1) Download a specific Android commit from AOSP git servers to openssl/ 2) Download the corresponding official OpenSSL release tarball. 3) Sainty check its SHA-1 against a hard-coded value. 4) Apply chromium-specific patches. 5) Re-run the Android 'import_openssl.sh' script. 6) Auto-generate config/x64/openssl/opensslconf.h 7) Auto-generate openssl.gypi Once the script is done, all you need to do is launch gyp again, rebuild and run unit tests. Use the --verbose option to see what the script does, or --help to see a detailed scription and a list of valid options. ************************************************************************** Chromium-specific patches: The list of Chromium-specific patches to apply to the Android tree is located in patches.chromium/. Currently this consists of: x509_hash_name_algorithm_change.patch Ensure the library can find the right files under /etc/ssl/certs when running on older systems. There are many symbolic links under /etc/ssl/certs created by using hash of the PEM certificates in order for OpenSSL to find those certificates. Openssl has a tool to help you create hash symbolic links (tools/c_rehash). However newer versions of the library changed the hash algorithm, which makes it unable to run properly on systems that use the old /etc/ssl/certs layout (e.g. Ubuntu Lucid). This patch gives a way to find a certificate according to its hash by using both the old and new algorithms. http://crbug.com/111045 is used to track this issue. enable-dtls1.patch: Enable DTLSv1, which is disabled by default in the Android platform configuration. x86_64_source_excludes.patch Exclude the source files bn_asm.c and rc4_skey.c for x86_64 because they are replaced by x86_64-gcc.c and rc4-x86_64.S. z_reduce_client_hello_size.patch Advertise support of only the NIST curves P-521, P-384, and P-256, as well as only uncompressed points, to keep ClientHello small. channelid.patch Add API so that channel ID private key can be set only after verifying the remote server supports channel IDs. fix_lhash_iteration.patch Fix a crash that happens when OpenSSL tries to delete items from a lhash table that is being iterated over. This happens in certain rare cases when SSL_CTX_flush_sessions() is called. See http://crbug.com/298606 chacha.patch Add support for ChaCha20+Poly1305 cipher suites. ************************************************************************** Adding new Chromium patches: In the event you need to add a new Chromium-specific patch, follow this procedure: 1) Use the --temp-dir option to download everything to a known directory (by default, import_from_android.sh downloads everything into a temporary directory that is erased when the script exits, even in case of error). ./import_from_android.sh --temp-dir=/tmp/aaa 2) Save the "original" Android sources: cp -rp /tmp/aaa/build/android-openssl /tmp/aaa/build/android-openssl.orig 3) Modify the content of /tmp/aaa/build/android-openssl appropriately. You do *not* have to run 'import_openssl.sh' 4) Create new patch: (cd /tmp/aaa/build && diff -burN android-openssl.orig android-openssl) > patches.chromium/my-new-change.patch 5) Re-run the script: ./import_from_android.sh Generally speaking, consider sending your patch directly to the Android open-source review servers too. Once submitted there, you can update the git commit in openssl-chromium.org and remove your local patch in one new CL.