diff options
| author | Martin Robinson <mrobinson@igalia.com> | 2023-08-08 16:00:10 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-08 14:00:10 +0000 |
| commit | bce7622cde4cd10f6b3edf852d97ae9a540a0076 (patch) | |
| tree | e8c09178e875b63e64b32a290840c6ff80d2c4e0 /support/android/openssl.makefile | |
| parent | ab0f48f8e8a72542269c9e563fad4fa03273d2f3 (diff) | |
| download | servo-bce7622cde4cd10f6b3edf852d97ae9a540a0076.tar.gz servo-bce7622cde4cd10f6b3edf852d97ae9a540a0076.zip | |
Switch to rustls and webpki-roots (#30025)
This change replaces OpenSSL with rustls and also the manually curated
CA certs file with webpki-roots (effectively the same thing, but as a
crate).
Generally speaking the design of the network stack is the same. Changes:
- Code around certificate overrides needed to be refactored to work with
rustls so the various thread-safe list of certificates is refactored
into `CertificateErrorOverrideManager`
- hyper-rustls takes care of setting ALPN protocols for HTTP requests,
so for WebSockets this is moved to the WebSocket code.
- The safe set of cypher suites is chosen, which seem to correspond to
the "Modern" configuration from [1]. This can be adjusted later.
- Instead of passing a string of PEM CA certificates around, an enum is
used that includes parsed Certificates (or the default which reads
them from webpki-roots).
- Code for starting up an SSL server for testing is cleaned up a little,
due to the fact that the certificates need to be overriden explicitly
now. This is due to the fact that the `webpki` crate is more stringent
with self-signed certificates than SSL (CA certificates cannot used as
end-entity certificates). [2]
1. https://wiki.mozilla.org/Security/Server_Side_TLS
2. https://github.com/briansmith/webpki/issues/114
Fixes #7888.
Fixes #13749.
Fixes #26835.
Fixes #29291.
Diffstat (limited to 'support/android/openssl.makefile')
| -rw-r--r-- | support/android/openssl.makefile | 14 |
1 files changed, 0 insertions, 14 deletions
diff --git a/support/android/openssl.makefile b/support/android/openssl.makefile deleted file mode 100644 index 5bc93e1433d..00000000000 --- a/support/android/openssl.makefile +++ /dev/null @@ -1,14 +0,0 @@ -.PHONY: all -all: openssl - @: # No-op to silence the "make: Nothing to be done for 'all'." message. - -# From https://wiki.openssl.org/index.php/Android -.PHONY: openssl -openssl: openssl-${OPENSSL_VERSION}/libssl.so - -openssl-${OPENSSL_VERSION}/libssl.so: openssl-${OPENSSL_VERSION}/Configure - ./openssl.sh ${ANDROID_NDK} ${OPENSSL_VERSION} - -openssl-${OPENSSL_VERSION}/Configure: - URL=https://servo-deps-2.s3.amazonaws.com/android-deps/openssl-${OPENSSL_VERSION}.tar.gz; \ - curl $$URL | tar xzf - |