| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
Change-Id: I66af794c840748f1ab69486fbf344aceab0f8202
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Includes changes to openssl.config not present in the original
commit.
Bug: 17750026
(cherry-picked from commit 9a68a8fb86e7440763286e3ea8578099abd598e7)
Change-Id: I89ed89b87b4f4eeeddb6de0c6ad1d48cb6d0ee7b
|
| |
| |
| |
| |
| |
| |
| | |
SSL/TLS MITM vulnerability (CVE-2014-0224)
Bug: 15442813
Change-Id: Ie52e8866fc9378d62f1d1fa6eb38b9423c138d64
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF
blessed version of NPN and we'll be supporting both ALPN and NPN for
some time yet.
[1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00
Patch from Adam Langley <agl@chromium.org>
Change-Id: I556b1ee877f398ae8b7f1d4abbaddc44611e5f51
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Fixes a bug with handling TLS 1.2 and digest functions for DSA and ECDSA
keys.
Patch from Adam Langley <agl@chromium.org>
Change-Id: I11b74472c0df16eca8de3aa36413686603814243
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This contains a new Android-specific patch to fix the Chromium
linux Clang builds.
This updates patches/channelid.patch independently since this
patch hasn't been submitted upstream yet.
Change-Id: I9d9a2ca3ad8446a54db5a023571fde1bc0d276c5
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This modifies import_openssl.sh to parse the configured Makefile
and extract the appropriate compiler flags that were currently
defined manually in android-config.mk
- Modifies openssl.config to add missing configure options to
ensure the final result is the same than before the patch.
This also updates crypto/opensslconf.h.
- The generated output is stored in build-config.mk which content
directly comes from the OpenSSL Makefile.
- android-config.mk is still used to define LOCAL_CFLAGS from
the definitions in build-config.mk, as well as perform minimal
extra filtering.
- Remove the section in README.android about manually changing
android-config.mk.
Change-Id: I5275de69a817aa7c9880ea48e5d6a8ac1652a1e4
|
| |
| |
| |
| | |
Change-Id: I4520a7e044b1c6a1b9d09b365bc18b178826131e
|
| |
| |
| |
| | |
Change-Id: Ie980c8834cf2c843858182d98d1f60c65a2a9b70
|
| |
| |
| |
| |
| |
| |
| |
| | |
(cherry-picked from 2c082d25fc3f0dd6e56c45407fe10638b904083c)
Bug: 8017911
Bug: 8095088
Change-Id: I57556e120fd1f585d38739d0d6aaf02bcbe45fbd
|
| |
| |
| |
| |
| |
| | |
Restored handshake_cutthrough.patch to upstream having removed traces of the small_records.patch
Change-Id: Iae8df5f24fe5fe566e81421e9db4c2f1ea5f1b53
|
| |
| |
| |
| |
| |
| | |
See http://tools.ietf.org/html/draft-balfanz-tls-channelid-00.
Change-Id: Id5b9799f96c0f7a1ef5ed8db9e40111a700d091f
|
|/
|
|
|
|
|
|
| |
12.04 LTS
modifications: doc directory is not in replicant, so remove this part from patch, one define in include/openssl/ssl.h was missing
Change-Id: I09f6df6fa56bf257af796c8af1e7df698f7f300a
|
|
|
|
|
| |
Bug: 6478397
Change-Id: If231aadbeb92eba4383adf91969361102cdfad69
|
|
|
|
| |
Change-Id: I4fe854007f774cf7f386cd405a9d21e6ca94e7b6
|
|
|
|
|
|
| |
Bug: 6366068
Change-Id: I0b6ec75b5c2a8f082b4b0fe6db2697d24f2f9b00
|
|
|
|
|
|
| |
Bug: 6168278
Change-Id: I648f9172828120df5d19a14425e9ceec92647921
|
|
|
|
| |
Change-Id: I0bc9b6b486bf10ebae34b994b63cf6011afdf5e1
|
|
|
|
| |
Change-Id: I568ac8da185ddbaab980757c7bf902bf829ecd03
|
|
|
|
|
| |
Bug: 5822335
Change-Id: Iadf81526a10b072ff323730db0e1897faea7a13f
|
|
|
|
|
| |
Bug: 5261862
Change-Id: I34d2d458aa85e61b1faacb8b5f386353be679d9b
|
|
|
|
|
| |
Bug: 3435285
Change-Id: Ied92c240f0a3ef9b2ce9b841089c03e0b29018b8
|
|
|
|
|
| |
Bug: 3249410
Change-Id: Iac938a7d2f17b73dcb82b031607dae96dbb35f34
|
|
|
|
| |
Change-Id: Ie076e26ab49f1addd7a918271e85d779f47167ac
|
|
|
|
|
| |
Bug: 3201137
Change-Id: I20cd6bed7717e5982abc3734e9a6522067f2908e
|
|
|
|
| |
Change-Id: I3cb6fb47f8294e5bc912e7ed073433925e9b120b
|
|
|
|
|
|
|
|
|
|
|
|
| |
Recent a bug was found that would have been much more obvious if not
for the confusion that "sha" means "SHA-0" in openssl and "SHA" means
"SHA-1" to Java programmers. Removing SHA-0 should be not be an
interoperability issue, it was never really used, was apparently
flawed, so like MD2 we will just remove it.
Bug: 2997009
Change-Id: I630c851fb2f5f344ef7a2c62c7092843cb40818c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Manual changes:
Changing build/config to remove OPENSSL_NO_BF and no-bf
openssl.config
android-config.mk
Add list of new files to build for blowfish
patches/crypto_Android.mk
Need to clean because we are changing build flags
CleanSpec.mk
Derived changes:
Changed by import_openssl.sh based on android-config.mk change
crypto/opensslconf.h
include/openssl/opensslconf.h
Derived from patches/crypto_Android.mk by import_openssl.sh
crypto/Android.mk
Newly imported files by import_openssl.sh with updated openssl.config
crypto/bf/COPYRIGHT
crypto/bf/asm/bf-586.pl
crypto/bf/asm/bf-686.pl
crypto/bf/bf_cfb64.c
crypto/bf/bf_ecb.c
crypto/bf/bf_enc.c
crypto/bf/bf_locl.h
crypto/bf/bf_ofb64.c
crypto/bf/bf_pi.h
crypto/bf/bf_skey.c
crypto/bf/blowfish.h
include/openssl/blowfish.h
Bug: 1856777
Change-Id: Id984df3834fa1d935feb9910c26a082242a9a8e1
|
|
|
|
|
|
|
|
|
| |
- Updated README.android
- Updated openssl.version
- Ran ./import_openssl.sh import .../openssl-1.0.0a.tar.gz
(which is responsible for the rest of the changes)
Change-Id: I3214fb8cb5297d68edc7632bbd9027952fec559b
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Summary:
- openssl: add openssl support for specifying per key certificate chains
- libcore: properly implement client certificate request call back
- libcore: properly implement sending certificate chain
- libcore: properly implement retreiving local certificate chain
- libcore: added an SSLContext for non-OpenSSL SSLSocket creation
Details:
external/openssl
Improve patch generate support by applying all other patches to
baseline to remove cross polluting other patch changes into target
patch. Move cleanup of ./Configure output to import script from
openssl.config.
import_openssl.sh
openssl.config
Adding SSL_use_certificate_chain and SSL_get_certificate_chain to
continue to finish most of remaining JSSE issues.
include/openssl/ssl.h
ssl/s3_both.c
ssl/ssl.h
ssl/ssl_locl.h
ssl/ssl_rsa.c
Updated patch (and list of input files to patch)
patches/jsse.patch
openssl.config
libcore
Restoring SSLContextImpl as provider of non-OpenSSL SSLSocketImpl
instances for interoperability testing. OpenSSLContextImpl is the
new subclass that provides OpenSSLSocketImpl. JSSEProvider
provides the old style SSLContexts, OpenSSLProvider provides the
OpenSSL SSLContext, which includes the "default" context. Changed
to register SSLContexts without aliases to match the RI.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/JSSEProvider.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLProvider.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/DefaultSSLContextImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLContextImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/SSLContextImpl.java
Native interface updates to support OpenSSLSocketImpl improvements
- KEY_TYPES now expanded based on what we are being provided by OpenSSL.
keyType function now maps key type values received from
clientCertificateRequested callback.
- Removed remaining uses of string PEM encoding, now using ASN1 DER consistently
Includes SSL_SESSION_get_peer_cert_chain, verifyCertificateChain
- Fixed clientCertificateRequested to properly include all key
types supported by server, not just the one from the cipher
suite. We also now properly include the list of supported CAs to
help the client select a certificate to use.
- Fixed NativeCrypto.SSL_use_certificate implementation to use new
SSL_use_certificate_chain function from openssl to pass chain to
OpenSSL.
- Added error handling of all uses of sk_*_push which can fail due to out of memory
- Fixed compile warning due to missing JNI_TRACE argument
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/native/NativeCrypto.cpp
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Pass this into chooseServerAlias call as well in significantly revamped choseClientAlias
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Minor code cleanup while reviewing diff between checkClientTrusted and checkServerTrusted
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java
Improvements to SSL test support to go along with client
certificate and certificate chain changes. TestSSLContext now has
separate contexts for the client and server (as well as seperate
key stores information). TestKeyStore now is more realistic by
default, creating a CA, intermediate CA, and separate client and
server certificates, as well as a client keystore that simply
contains the CA and no certificates.
support/src/test/java/javax/net/ssl/TestKeyStore.java
support/src/test/java/javax/net/ssl/TestSSLContext.java
Tests tracking API changes. Tests involving cert chains now now
updated to use TestKeyStore.assertChainLength to avoid hardwiring
expected chain length in tests. These tests also now use
TestSSLContext.assertClientCertificateChain to validate that the
chain is properly constructed and trusted by a trust manager.
luni/src/test/java/java/net/URLConnectionTest.java
luni/src/test/java/javax/net/ssl/SSLContextTest.java
luni/src/test/java/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/javax/net/ssl/SSLSessionContextTest.java
luni/src/test/java/javax/net/ssl/SSLSessionTest.java
luni/src/test/java/javax/net/ssl/SSLSocketTest.java
support/src/test/java/java/security/StandardNames.java
support/src/test/java/javax/net/ssl/TestSSLEnginePair.java
support/src/test/java/javax/net/ssl/TestSSLSocketPair.java
frameworks/base
Tracking change of SSLContextImpl to OpenSSLContextImpl
core/java/android/net/SSLCertificateSocketFactory.java
core/java/android/net/http/HttpsConnection.java
tests/CoreTests/android/core/SSLPerformanceTest.java
tests/CoreTests/android/core/SSLSocketTest.java
Tracking changes to TestSSLContext
core/tests/coretests/src/android/net/http/HttpsThroughHttpProxyTest.java
Change-Id: I792921617164a98467c500d7fe53dbd738adfa02
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Summary:
- adding SSL_set_cipher_lists for JSSE support
- enabling elliptic curve for new JSSE cipher suites
Details:
Adding SSL_set_cipher_lists that allows setting of SSL ciphers (and
indirectly ciphers_by_id). This allows us to explicitly set a desired
cipher suite lists with our own ordering for JSSE support.
patches/jsse.patch
Enabling EC, ECDH, and ECDSA which are needed for RI 6 elliptic curve cipher suites.
- EC = Elliptic Curve
- ECDH = Elliptic Curve Diffie-Hellman
- ECDSA = Elliptic Curve Digital Signature Algorithm
android-config.mk
patches/apps_Android.mk
patches/crypto_Android.mk
openssl.config
Remove warning from openssl output to remove testssl warnings
patches/progs.patch
openssl.config
Misc
Update clean, build, and test instructions
README.android
Fixing whitespace inconsistency noted when updating clean target
patches/ssl_Android.mk
Generated files
Copied from patches:
apps/Android.mk
crypto/Android.mk
ssl/Android.mk
Newly imported EC files from openssl-1.0.0.tar.gz
Interestingly most of the needed files were already present, if not compiled.
crypto/ec/ec_ameth.c
crypto/ec/ec_pmeth.c
crypto/ec/eck_prn.c
SSL_set_cipher_lists
include/openssl/ssl.h
ssl/ssl.h
ssl/ssl_lib.c
Disabled warning
apps/openssl.c
Change-Id: I9edc9da2ea65d7d8e55257300a5978638a3e472d
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSLSocket.setEnableSessionCreation(false) support
SSL_set_session_creation_enabled implementation
Add session_creation_enabled to ssl_st (aka SSL)
Add SSL_set_session_creation_enabled(SSL*, int) declaration
Add SSL_R_SESSION_MAY_NOT_BE_CREATED error reason
include/openssl/ssl.h
ssl/ssl.h
Before creating session, check if session_creation_enabled.
If not, error out, sending alert when possible in SSL3+ cases.
ssl/d1_clnt.c
ssl/s23_clnt.c
ssl/s3_clnt.c
ssl/s3_srvr.c
Add error message for SSL_R_SESSION_MAY_NOT_BE_CREATED
ssl/ssl_err.c
Initialize session_creation_enabled to 1 in SSL_new
ssl/ssl_lib.c
Definition of SSL_set_session_creation_enabled. Add lower level
check for session_creation_enabled in ssl_get_new_session in case
it is not caught by higher levels.
ssl/ssl_sess.c
Patch details
Added jsse.patch to list and add list of patched files.
Fix whitespace to be tabs for consistency.
openssl.config
Add description of jsse.patch
patches/README
The patch itself, containing the above described changes
patches/jsse.patch
Testing
Updated with note to run javax.net.ssl tests now that they are working reliably.
README.android
Change-Id: Ic46b257a459d21b013396d7a17321fb550f2c1b0
|
|
|
|
|
|
|
|
|
| |
It was pulled because of b/2586347 but it turns out to be a problem in
the tests. The tests were fixed in Change Id8472487, and the feature
is re-enabled here.
Bug id: 2614118
Change-Id: I09caeb80eceb5cc5e1677947f54ced8ccc1677cd
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
external/openssl
Updated version to 1.0.0
openssl.version
Updated small records patch for 1.0.0. This is probably the most significant change.
patches/small_records.patch
Removed bad_version.patch since fix is included in 0.9.8n and beyond
patches/README
patches/bad_version.patch
openssl.config
Changed import_openssl.sh to generate armv4 asm with the 1.0.0
scripts, not our backported 0.9.9-dev backported version in
patches/arm-asm.patch.
import_openssl.sh
openssl.config
patches/README
patches/arm-asm.patch
Added -DOPENSSL_NO_STORE to match ./Configure output
Added -DOPENSSL_NO_WHIRLPOOL (no-whrlpool) to skip new optional cipher
android-config.mk
openssl.config
Fixed import to remove include directory during import like other
imported directories (apps, ssl, crypto)
import_openssl.sh
Updated UNNEEDED_SOURCES. Pruned Makefiles which we don't use.
openssl.config
Updated to build newly required files
patches/apps_Android.mk
patches/crypto_Android.mk
Disable some new openssl tools
patches/progs.patch
Updated upgrade testing notes to include running BigInteger tests
README.android
Automatically imported
android.testssl/
apps/
crypto/
e_os.h
e_os2.h
include/
ssl/
dalvik
Change makeCipherList to skip SSLv2 ciphers that 1.0.0 now returns
so there are not duplicate ciphersuite names in getEnabledCipherSuites.
libcore/x-net/src/main/native/org_apache_harmony_xnet_provider_jsse_NativeCrypto.cpp
Updated OpenSSLSocketImpl_cipherauthenticationmethod for new
SSL_CIPHER algorithms -> algorithm_auth (and const-ness)
libcore/x-net/src/main/native/org_apache_harmony_xnet_provider_jsse_NativeCrypto.cpp
Update to const SSL_CIPHER in OpenSSLSessionImpl_getCipherSuite (and cipherauthenticationmethod)
libcore/x-net/src/main/native/org_apache_harmony_xnet_provider_jsse_NativeCrypto.cpp
test_EnabledCipherSuites on both SSLSocketTest and
SSLServerSocketTest caught the makeCipherList problem. However the
asserts where a bit out of sync and didn't give good messages
because they didn't actually show what was going on. As part of
debugging the issue they found, I tried to make align the asserts
and improve their output for the future.
libcore/x-net/src/test/java/tests/api/javax/net/ssl/SSLServerSocketTest.java
libcore/x-net/src/test/java/tests/api/javax/net/ssl/SSLSocketTest.java
vendor/google
Add const to X509V3_EXT_METHOD* for 1.0.0 compatibility
libraries/libjingle/talk/base/openssladapter.cc
Change-Id: I608dbb2ecf4b7a15e13b3f3dcea7c0443ff01e32
|
|
|
|
|
|
|
|
| |
CTS tests exposed compatability problems for SSLSocket applications
with handshake cutthrough enabled. Disabling until they can be
resolved. b/2586347
Change-Id: If2e43f50712780e1905c86b64ac2f89e95e7cc95
|
|
|
|
|
|
|
| |
This will save one RTT for SSL handshake.
b/2511073 explains the details.
Change-Id: I01cd02d2df375bc02eec12814308f0a6e63b8ae1
|
|
|
|
|
|
| |
Disabled handshake_cutthrough.patch in openssl.config
Change-Id: I4fe837876198dcf0593c5f5d32174d8af76f3f9f
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Testing Summary:
- Passed new android.testssl/testssl.sh
- General testing with BrowserActivity based program
Details:
Expanded detail in README.android about how to build and test openssl
upgrades based on my first experience.
modified: README.android
Significant rework of import_openssl.sh script that does most of
the work of the upgrade. Most of the existing code became the main
and import functions. The newly regenerate code helps regenerate
patch files, building on the fact that import now keeps and
original unmodified read-only source tree for use for patch
generation. Patch generation relies on additions to openssl.config
for defining which patches include which files. Note that
sometimes a file may be patched multiple times, in that case
manual review is still necessary to prune the patch after
auto-regeneration. Other enhancements to import_openssl.sh include
generating android.testssl and printing Makefile defines for
android-config.mk review.
modified: import_openssl.sh
Test support files for openssl/
Add support for building /system/bin/ssltest as test executible for
use by testssl script. Need confirmation that this is the right way
to define such a test binary.
modified: patches/ssl_Android.mk
Driver script that generates user and CA keys and certs on the
device with /system/bin/openssl before running testssl. Based on
openssl/test/testss for generation and openssl/test/Makefile
test_ssl for test execution.
new file: patches/testssl.sh
Note all following android.testssl files are automatically
imported from openssl, although possible with modifications by
import_openssl.sh
testssl script imported from openssl/test that does the bulk of
the testing. Includes new tests patched in for our additions.
new file: android.testssl/testssl
CA and user certificate configuration files from openssl.
Automatically imported from openssl/test/
new file: android.testssl/CAss.cnf
new file: android.testssl/Uss.cnf
certificate and key test file imported from openssl/apps
new file: android.testssl/server2.pem
Actual 0.9.8m upgrade specific bits
Trying to bring ngm's small records support into 0.9.8m. Needs
signoff by ngm although it does pass testing.
modified: patches/small_records.patch
Update openssl.config for 0.9.8m. Expanded lists of undeeded
directories and files for easier update and review, adding new
excludes. Also added new definitions to support "import_openssl.sh
regenerate" for patch updating.
modified: openssl.config
Updated OPENSSL_VERSION to 0.9.8m
modified: openssl.version
Automatically imported/patched files. Seems like it could be
further pruned in by openssl.config UNNEEDED_SOURCES, but extra
stuff doesn't end up impacting device.
modified: apps/...
modified: crypto/...
modified: include/...
modified: ssl/...
Other Android build stuff.
Note for these patches/... is source, .../Android.mk is derived.
Split LOCAL_CFLAGS additions into lines based on openssl/Makefile
source for easier comparison when upgrading. I knowingly left the
lines long and unwrapped for easy vdiff with openssl/Makefile
modified: android-config.mk
Removed local -DOPENSSL_NO_ECDH already in android-config.mk.
modified: patches/apps_Android.mk
Sync up with changes that had crept into derived crypto/Android.mk
modified: patches/crypto_Android.mk
Change-Id: I73204c56cdaccfc45d03a9c8088a6a93003d7ce6
|
|
|
|
| |
See patches/README for additional details.
|
|
|
|
|
|
| |
The source tree (and the size of the compiled library)
can be reduced further. This will be done in a future
commit.
|
| |
|
| |
|
| |
|
|
|