OpenSSL for Android support

[Unix One]

I'm trying to follow the directions for compiling OpenSSL for Android for armv7, things seem to work fine up until the following error after running the make command per instructions:

~/Applications/qt-openssl-android/openssl-1.1.0h> make CALC_VERSIONS="SHLIB_COMPAT=; SHLIB_SOVER=" build_libs                                                  /usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" \
    "-oMakefile" crypto/include/internal/bn_conf.h.in > crypto/include/internal/bn_conf.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" \
    "-oMakefile" crypto/include/internal/dso_conf.h.in > crypto/include/internal/dso_conf.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" \
    "-oMakefile" include/openssl/opensslconf.h.in > include/openssl/opensslconf.h
make depend && make _build_libs
make[1]: Entering directory '/home/qwer/Applications/qt-openssl-android/openssl-1.1.0h'
make[1]: Leaving directory '/home/qwer/Applications/qt-openssl-android/openssl-1.1.0h'
make[1]: Entering directory '/home/qwer/Applications/qt-openssl-android/openssl-1.1.0h'
arm-linux-androideabi-gcc  -I. -Icrypto/include -Iinclude -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\"" -Wall -O3 -pthread -mandroid -fPIC --sysroot=/home/qwer/Applications/android/ndk-bundle/platforms/android-26/arch-arm -Wa,--noexecstack  -fPIC -DOPENSSL_USE_NODELETE -MMD -MF crypto/aes/aes_cbc.d.tmp -MT crypto/aes/aes_cbc.o -c -o crypto/aes/aes_cbc.o crypto/aes/aes_cbc.c
arm-linux-androideabi-gcc  -I. -Icrypto/include -Iinclude -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\"" -Wall -O3 -pthread -mandroid -fPIC --sysroot=/home/qwer/Applications/android/ndk-bundle/platforms/android-26/arch-arm -Wa,--noexecstack  -fPIC -DOPENSSL_USE_NODELETE -MMD -MF crypto/aes/aes_cfb.d.tmp -MT crypto/aes/aes_cfb.o -c -o crypto/aes/aes_cfb.o crypto/aes/aes_cfb.c
arm-linux-androideabi-gcc  -I. -Icrypto/include -Iinclude -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\"" -Wall -O3 -pthread -mandroid -fPIC --sysroot=/home/qwer/Applications/android/ndk-bundle/platforms/android-26/arch-arm -Wa,--noexecstack  -fPIC -DOPENSSL_USE_NODELETE -MMD -MF crypto/aes/aes_core.d.tmp -MT crypto/aes/aes_core.o -c -o crypto/aes/aes_core.o crypto/aes/aes_core.c
crypto/aes/aes_core.c:39:20: fatal error: assert.h: No such file or directory
 #include <assert.h>
                    ^
compilation terminated.
make[1]: *** [Makefile:676: crypto/aes/aes_core.o] Error 1
make[1]: Leaving directory '/home/qwer/Applications/qt-openssl-android/openssl-1.1.0h'
make: *** [Makefile:132: build_libs] Error 2

I've tried various suggestions found online, including:

• setting sysroot to ndk-bundle/sysroot: got a similar fatal error about not finding asm/types.h
• playing with various env vars like CROSS_COMPILE, PATH, etc.

I thought I'd check here before I give up, or try following a significantly different set of steps altogether. So has anyone seen this? Solved it?
For reference, I'm running this on OpenSUSE Tumbleweed. I have QtCreator (4.6.1) Qt 5.10.1, Android SDK/NDK, emulator, physical devices, etc. all working great, except the OpenSSL issue above.
Thank you in advance for your help.

[sierdzio]

Most probably you need to bump $_ANDROID_API to something higher like android-23. The instructions are for older OpenSSL releases.

[Unix One]

@sierdzio The $_ANDROID_API is currently set at android-26. And I think that is correctly reflected in the sysroot path in the make output above.

[sierdzio]

Ah, right. OK, and assert.h is still present in NDK in API 26, so that part seems fine. I'd still recommend checking some other API levels just to be sure.

I've checked my scripts, the sysroot you provide is correct.

[SGaist]

Hi and welcome to devnet,

@ekkescorner scripts might be of interest.

Hope it helps

[evergreen4life]

@Unix-One
Brutal method :
Copy include directory from an older version of android ndk into your new one (for me it was "cp -rf ./android-ndk-r10e/platforms/android-21/arch-arm64/usr/include/ ./android-ndk-r17b/platforms/android-24/arch-arm64/usr/"). And then you can compile the normal way without error at first sight. I have to test this in real situation now.

[mateczek]

my script to compile openssl android NDK
a_api = number android api

#!/bin/bash

# Based on http://qt-project.org/wiki/Build_Qt5_mysql_plugin_for_Android
export ANDROID_NDK="$HOME/Android/Sdk/ndk-bundle"
export PATH="$ANDROID_NDK/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/":$PATH
a_api="27"
SR="$ANDROID_NDK/platforms/android-$a_api/arch-arm"
BR="$ANDROID_NDK/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-"

git clone git://git.openssl.org/openssl.git
mkdir "$SR"/temp
pushd openssl
        ./Configure android-arm -D__ANDROID_API__=$a_api --prefix=$SR/temp
        ANDROID_DEV=$SR/usr 
        make clean
        make || exit 1
        make install_sw || exit 1
popd

[Eddie]

This works on macOS building Android arm, arm7, and x86 OpenSSL libs.

• I had to I revert to using Android NDK r10e to get it to work.
• I never could NOT get it to build on Ubuntu 18.04 even with NDK r10e

See: https://github.com/esutton/android-openssl

Android build environment for OpenSSL

• Supports build for multiple architectures - ARM, ARMv7, X86
• Uses OpenSSL source codes
• Integrated with Android.mk build
• Output directories for libcrypto and libssl are set in Android.mk
  • arch-armeabi/lib/
  • arch-armeabi-v7a/lib/
  • arch-x86/lib/

Advice: Do NOT use OpenSSL binaries you find laying about the Internet.

How to compile

cd jni/openssl
./build.sh

Optionally, set variables on the beginning of the build.sh according to your Android NDK.

In the global JNI Android.mk you can then simply include Android.mk from openssl directory so the
static or dynamic libraries are linked to the rest of your project.

include jni/openssl/Android.mk

Include paths for header files are not set, headers will be after compilation present at

jni/openssl/sources/include

Notes

Advice: Do not use pre-built OpenSSL libs you find laying around the Internet

macOS Using Android NDK r10e

On macOS, building OpenSSL fails when using NDK 11 or greater.

Work-around is to download and use r10e to build OpenSSL.

1. Please download Android NDK r10e and update ANDROID_NDK

• https://developer.android.com/ndk/downloads/older_releases
• https://dl.google.com/android/repository/android-ndk-r10e-windows-x86_64.zip

2. Copy the extracted downloaded ndk folder to your $ANDROID_SDK folder and rename to ndk-r10e
3. Set ANDROID_NDK environment variable:

ANDROID_NDK=$ANDROID_SDK/ndk-r10e

[Unix One]

@SGaist that build-all-arch.sh script still fails with a couple of errors:

• Makefile.org doesn't exist (but proceeds anyway)
• target android-armv7 doesn't exist!

If I change the target to android-armeabi in the script, then it proceeds further but fails with

In file included from /usr/include/stdlib.h:55:0,
                 from crypto/aes/aes_core.c:41:
/usr/include/bits/floatn.h:74:1: error: unknown machine mode '__TC__'
 typedef _Complex float __cfloat128 __attribute__ ((__mode__ (__TC__)));
 ^
/usr/include/bits/floatn.h:86:9: error: unknown type name '__float128'
 typedef __float128 _Float128;
         ^
In file included from /usr/include/stdlib.h:55:0,
                 from crypto/aes/aes_locl.h:15,
                 from crypto/aes/aes_ecb.c:13:
/usr/include/bits/floatn.h:74:1: error: unknown machine mode '__TC__'
 typedef _Complex float __cfloat128 __attribute__ ((__mode__ (__TC__)));
 ^
/usr/include/bits/floatn.h:86:9: error: unknown type name '__float128'
 typedef __float128 _Float128;

I think I'm on the wrong path.

[Unix One]

@evergreen4life Thank you but that sounds like a major hack I'd like to avoid if possible.

[Unix One]

@mateczek Thank your for this. Your script succeeds in producing the libcrypto.so and libssl.so. However, when I deploy them along with my app to the phone, I get

W libmyapp.so: (null):0 ((null)): qt.network.ssl: QSslSocket: cannot call unresolved function SSLv23_client_method
W libmyapp.so: (null):0 ((null)): qt.network.ssl: QSslSocket: cannot call unresolved function SSL_CTX_new
W libmyapp.so: (null):0 ((null)): qt.network.ssl: QSslSocket: cannot call unresolved function SSL_library_init
W libmyapp.so: (null):0 ((null)): qt.network.ssl: QSslSocket: cannot call unresolved function ERR_get_error
W libmyapp.so: (null):0 ((null)): qt.network.ssl: QSslSocket: cannot call unresolved function ERR_get_error

The network calls do not succeed and I'm guessing those errors are the reason. What am I missing?

[Unix One]

@Eddie It looks like per the readme you pasted in the comment, that won't work with any recent NDK versions (r10e is over 3 years old, and the oldest one Google still provides). I was trying to get it to work a reasonably recent version.

[Unix One]

A couple of updates:

• I tried compiling openssl-1.1.0h (current stable version) against the old android ndk (r10e) because people seem to have reported that working. Well, it compiled, but it didn't work in the app. The errors were similar to the ones I got with @mateczek's script. I also noticed
  qt.network.ssl: Incompatible version of OpenSSL
  error, but that could have been present with @mateczek's result too, and I could have just missed it. So, it resulted in a similar output.
• Then I decided to give openssl-1.0.2o (current stable LTS version) a try. To my astonishment, it compiled, and it worked in the app!

So, the conclusion is:

• use openssl-1.0.x LTS version, until it's supported
• use android-ndk-r10e, until it's supported
• use these instructions

The remaining question: is this a known issue? Is there a bug to update openssl support to more recent openssl and android ndk versions?

For reference, I run OpenSUSE Tumbleweed and keep it updated. Qt Creator 4.7.0. Qt 5.11.1. I'm happy to test and provide additional information if anyone has any ideas.

[Pablo J. Rogina]

@Unix-One said in OpenSSL for Android support:

The remaining question: is this a known issue? Is there a bug to update openssl support to more recent openssl and android ndk versions?

Checking Qt's source code, you'll find that OpenSSL 1.1.x is not yet supported...

...
if (!_q_SSLeay || q_SSLeay() >= 0x10100000L) {
        // OpenSSL 1.1 has deprecated and removed SSLeay. We consider a failure to
        // resolve this symbol as a failure to resolve symbols.
        // The right operand of '||' above is ... a bit of paranoia.
        delete libs.first;
        delete libs.second;
        qCWarning(lcSsl, "Incompatible version of OpenSSL");
        return false;
    }
...

[SGaist]

OpenSSL 1.1 has a backend in Qt since Qt 5.10 but you have to build Qt by hand in order to use it currently.

[Unix One]

@Pablo-J-Rogina @SGaist that is good to know - would have been useful information on the instructions page that would potentially save developers a lot of time. I might update the wiki with the basic steps for minimum android packaging and deployment (given I find enough time of course).

Thank you all for your help.

[AlfredoC]

Hi,
I had a lot of trouble with openssl and qt with android too.
So I wrote a post how to solve the problems.
Hope this helps.

[Knox]

@AlfredoC concerning your guide, i have setup a VM so that i could build the apk in ubuntu (i have given up doing it in windows) ubuntu 10.10 runs openssl v 1.1.1. as in your guide says that that wont do, how actually do i use 1.0.2p? can i install it directly? or do i just extract it? im sorry very noob question here.

[AlfredoC]

you have to download the openssl source, compile it for Android as described and copy the 2 libraries to your project.
If you trust me, you can download the precompiled libs here ;-)

[ekkescorner]

@AlfredoC hint to your blog post: Qt 5.12 now uses NDK r18b