Android - Revision history

Jwalton: Add info on sourcing.

2019-12-03T07:22:45Z

Add info on sourcing.

Matt: Add note about this page being out of date for 1.1.1

2018-11-08T09:59:22Z

Add note about this page being out of date for 1.1.1

Rsalz: /* Build the OpenSSL Library */

2017-04-20T20:06:07Z

Build the OpenSSL Library

Jwalton: Improved flow.

2016-10-03T20:40:10Z

Improved flow.

Jwalton: Improved flow.

2016-10-03T20:37:57Z

Improved flow.

Jwalton: Updated to match text in "FIPS and Android"

2016-10-03T19:35:00Z

Updated to match text in "FIPS and Android"

Jwalton: Updated section with some code examples.

2016-10-03T19:19:53Z

Updated section with some code examples.

Jwalton: Tweaked instructions.

2016-09-23T14:34:12Z

Tweaked instructions.

Jwalton: Tweaked instructions.

2016-09-23T14:32:12Z

Tweaked instructions.

Jwalton: Tweaked instructions.

2016-09-23T14:31:23Z

Tweaked instructions.

@@ Line 1: / Line 1: @@
 This document will provide instructions for building the OpenSSL library for Android devices. If you need the FIPS Validated Object Module and the FIPS Capable Library, see [[FIPS Library and Android]].
-NOTE: The instructions on this page are for older versions of OpenSSL (they should work for OpenSSL 1.0.2). For OpenSSL 1.1.1 see the INSTALL and NOTES.ANDROID files in the source distribution.
+The script <tt>setenv-android.sh</tt> is sourced. Sourcing ensures the variables set in the script are available to other scripts that are run later in the process. If you shell does not provide the source command, then use <tt>. ./setenv-android.sh</tt> (note the leading dot).
 ==Executive Summary==
@@ Line 17: / Line 19: @@
 <pre># From the 'root' directory
-$ . ./setenv-android.sh
+$ source ./setenv-android.sh
 $ cd openssl-1.0.1g/
@@ Line 102: / Line 104: @@
 Begin building the OpenSSL library by setting the cross-compilation environment. Note the leading '.' when running the <tt>setenv-android.sh</tt> script. If you have any errors from the script, then you should fix them before proceeding.
-<pre>$ . ./setenv-android.sh
+<pre>$ source ./setenv-android.sh
 $ cd openssl-1.0.1g/</pre>

← Older revision		Revision as of 09:59, 8 November 2018
Line 1:		Line 1:
	This document will provide instructions for building the OpenSSL library for Android devices. If you need the FIPS Validated Object Module and the FIPS Capable Library, see [[FIPS Library and Android]].		This document will provide instructions for building the OpenSSL library for Android devices. If you need the FIPS Validated Object Module and the FIPS Capable Library, see [[FIPS Library and Android]].
		+
		+	NOTE: The instructions on this page are for older versions of OpenSSL (they should work for OpenSSL 1.0.2). For OpenSSL 1.1.1 see the INSTALL and NOTES.ANDROID files in the source distribution.

	==Executive Summary==		==Executive Summary==

@@ Line 22: / Line 22: @@
 # Tune to suit your taste, visit http://wiki.openssl.org/index.php/Compilation_and_Installation
-$ ./config shared no-ssl2 no-ssl3 no-comp no-hw no-engine --openssldir=/usr/local/ssl/$ANDROID_API
+$ ./config shared no-ssl2 no-ssl3 no-comp no-hw no-engine \
 $ make depend

@@ Line 181: / Line 181: @@
 == Miscellaneous ==
 The NDK supplies headers for each major platform - for example, API 18, API 14, API 9, API 8, and API 5. If you are building for Android 4.2 (API 17), Android 4.1 (API 16) and Android 4.0 (API 14), then you would use the NDK's API 14 (android-14 platform).
@@ Line 194: / Line 198: @@
 When building the OpenSSL library for Android, take care to specify <tt>-mfloat-abi=softfp</tt>. If you specify <tt>-mfloat-abi=hard</tt> or <tt>-mhard-float</tt> (even if the hardware support a floating point unit), then the entropy estimate passed through the Java VM to <tt>RAND_add</tt> will always be 0.0f. See [https://groups.google.com/d/msg/android-ndk/NbUq9FDDZOo/TJJsAS6nM7wJ Hard-float and JNI] for details.
 == Downloads ==
 [[Media:setenv-android.sh|setenv-android.sh]] - script to set Android cross-compile environment.

@@ Line 142: / Line 142: @@
 == Wrapper Shared Objects ==
-Using OpenSSL on Android often involves JNI. The platform likely loaded the system's version of OpenSSL or BoringSSL's <tt>libssl.so</tt> and <tt>libcrypto.so</tt> at boot during Zygote initialization. Due to issues with the loader and symbol resolution, the LD_LIBRARY_PATH trick doesn't work for normal applications. And changing the build to output different library names to avoid clashes does not work, either.
+Using OpenSSL on Android often involves JNI and the platform's version of OpenSSL or BoringSSL. The platform likely loaded the system's version of <tt>libssl.so</tt> and <tt>libcrypto.so</tt> at boot during Zygote initialization. Due to issues with the loader and symbol resolution, customary <tt>LD_LIBRARY_PATH</tt> tricks do not work for most applications. And changing the build to output different library names, like <tt>libmyssl.so</tt> and <tt>libmycrypto.so</tt>, to avoid clashes does not work either.
-The solution to the namespace and symbol prolems is to wrap the '''''static''''' library in a separate '''''dynamic''''' library or shared object. To do so, write a short C wrapper library with references to functions you need from the OpenSSL library. You don't need to wrap all the functions.
+The solution to the namespace and symbol resolution problems is to wrap the '''''static''''' version of the OpenSSL library in a separate '''''dynamic''''' library or shared object provided by you. To do so, write a small C wrapper library with references to functions you need from the OpenSSL library. You don't need to wrap all the functions.
 Your <tt>wrapper.c</tt> might look as follows (also see GCC's [http://gcc.gnu.org/wiki/Visibility Visibility page]):
@@ Line 168: / Line 168: @@
 ...</pre>
-Then, compile with both <tt>-fvisibility=hidden</tt> and <tt>-Wl,--exclude-libs,ALL</tt> flags and link against <tt>libcrypto.a</tt> and <tt>libssl.a</tt>.
+Then, compile the source file into a shared object. A typical command line might look as follows.
 <pre>$ export OPENSSL_ANDROID = /usr/local/ssl/android-14
@@ Line 174: / Line 174: @@
 -Wl,-Bstatic -lcrypto -lssl -L$(OPENSSL_ANDROID)/lib -o wrapper.so -Wl,-Bdynamic</pre>
-<tt>-fvisibility=hidden</tt> works as you expect, and  <tt>-Wl,--exclude-libs,ALL</tt> means your library does not re-export other linked library symbols. Only the functions marked with <tt>DLL_PUBLIC</tt> will be exported and callable through JNI.
+<tt>-fvisibility=hidden</tt> works as you expect, and <tt>-Wl,--exclude-libs,ALL</tt> means your library does not re-export other linked library symbols. Only the functions marked with <tt>DLL_PUBLIC</tt> will be exported and callable through JNI.
 The <tt>-Wl,-Bstatic</tt> tells the linker to use the static version of the OpenSSL library for the Library. After it and the <tt>-Wl,-Bdynamic</tt> tells the linker to use dynamic linking for anything else it might need, like <tt>libc</tt>.
-Using <tt>-Bstatic</tt> and <tt>-Bshared</tt> can cause link problems on occasion. For example, see [http://stackoverflow.com/questions/22667953/error-when-trying-to-compile-wrapper-for-openssl-library-libcrypto-a Android: error when trying to compile wrapper for openssl library libcrypto.a]. To avoid the problem with the linker, specify the full path to the static archive (for example, <tt>/usr/local/ssl/android-14/lib/libcrypto.a</tt>). If you suspect the wrong OpenSSL library is being linked, then use the fully qualified archive path.
+Then use your shared object in place of OpenSSL.
 == Miscellaneous ==

@@ Line 140: / Line 140: @@
 Testing the installation consists of building a sample program, installing it with adb, and then running the program using a remote shell. Both the static and dynamic version of the OpenSSL library can be tested. Instructions for testing the OpenSSL library are given at [[FIPS Library and Android]]. The same basic steps apply.
-== Using OpenSSL in an Application ==
+== Wrapper Shared Objects ==
-In the real world, you probably aren't using C and therefore still need a dynamic library, but Android probably already has non-FIPS Library called libssl.so and libcrypto.so loaded into memory.  Due to issues with the Android loader, the LD_LIBRARY_PATH trick doesn't work for normal applications.  Because we can't change the build to output different names to avoid the namespace clash, the solution to getting the code into a differently-named shared library is to wrap up the static Library into a separate dynamic library.  To do this, write a short c wrapper library with references to functions in both the Library (so the linker doesn't discard them as unnecessary) and link the static Library as above.  You don't need to wrap all the functions, as the Library themselves become part of the interface. For these instructions, I'll assume your c file is called wrapper.c
+In the real world, you probably aren't using C and therefore still need a dynamic library, but Android probably already has OpenSSL or BoringSSL's <tt>libssl.so</tt> and <tt>libcrypto.so</tt> loaded into memory.  Due to issues with the Android Zygote and the loader, the LD_LIBRARY_PATH trick doesn't work for normal applications. Changing the build to output different names to avoid the namespace clash does not work.
 <pre>$ export OPENSSL_ANDROID = /usr/local/ssl/android-14
-$ $(CC) wrapper.c -fPIC -shared -I$(OPENSSL_ANDROID)/include -Wl,-Bstatic -lcrypto -lssl -L$(OPENSSL_ANDROID)/lib -o wrapper.so -Wl,-Bdynamic</pre>
+$ $(CC) wrapper.c -fPIC -shared -I$(OPENSSL_ANDROID)/include -fvisibility=hidden -Wl,-Bstatic -lcrypto -lssl -L$(OPENSSL_ANDROID)/lib -o wrapper.so -Wl,-Bdynamic</pre>
 The <tt>-Wl,-Bstatic</tt> tells the linker to use the static version of the OpenSSL library for the Library. After it and the <tt>-Wl,-Bdynamic</tt> tells the linker to use dynamic linking for anything else it might need, like <tt>libc</tt>.
 Using <tt>-Bstatic</tt> and <tt>-Bshared</tt> can cause link problems on occasion. For example, see [http://stackoverflow.com/questions/22667953/error-when-trying-to-compile-wrapper-for-openssl-library-libcrypto-a Android: error when trying to compile wrapper for openssl library libcrypto.a]. To avoid the problem with the linker, specify the full path to the static archive (for example, <tt>/usr/local/ssl/android-14/lib/libcrypto.a</tt>). If you suspect the wrong OpenSSL library is being linked, then use the fully qualified archive path.
 You can then use wrapper.so as per normal.

@@ Line 104: / Line 104: @@
 If you receive a meesage "<tt>Error: FIPS_SIG does not specify incore module, please edit this script</tt>, then its safe to ignore it. <tt>setenv-android.sh</tt> is used to build both the FIPS Capable OpenSSL library and the non-FIPS version of the library. <tt>FIPS_SIG</tt> is '''not''' needed in this configuration.
-Next, fix the makefile and run configure.
+Next, fix the makefile and run configure. A user on Stack Overflow reports this [http://stackoverflow.com/q/39640180/608639 fails under OpenSSL 1.1.0]. If so skip it because its not essential to the cross-compile.
 <pre>$ perl -pi -e 's/install: all install_docs install_sw/install: install_docs install_sw/g' Makefile.org

@@ Line 29: / Line 29: @@
 === Install the OpenSSL Library ===
-<pre>$ sudo -E make install CC=$ANDROID_TOOLCHAIN/arm-linux-androideabi-gcc RANLIB=$ANDROID_TOOLCHAIN/arm-linux-androideabi-ranlib</pre>
+<pre># The -E is important. Root needs some of the user's environment
 === Compile and Link against the Library ===