[Buildroot] [PATCH 1/1] package/tpm2-openssl: Fix build with OpenSSL 4.1

* [Buildroot] [PATCH 1/1] package/tpm2-openssl: Fix build with OpenSSL 4.1
@ 2026-10-25 19:31 Bernd Kuhls
  2026-10-25 20:39 ` Thomas Petazzoni via buildroot
  0 siblings, 1 reply; 2+ messages in thread
From: Bernd Kuhls @ 2026-10-25 19:31 UTC (permalink / raw)
  To: buildroot; +Cc: Romain Naour

Patch 0003 fixes the build error and needs patch 0002 to be applied
cleanly.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/5f1418b2096b88dc0340d0478eb677b84e16d90c

 ...g-of-parent-handles-in-TPM-TSS2-keys.patch | 118 ++++++++++++++++++
 ...key-fix-compilation-with-OpenSSL-4.1.patch |  88 +++++++++++++
 2 files changed, 206 insertions(+)
 create mode 100644 package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch
 create mode 100644 package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch

diff --git a/package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch b/package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch
new file mode 100644
index 0000000000..4997fecc9e
--- /dev/null
+++ b/package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch
@@ -0,0 +1,118 @@
+From ec1d2d1380521e9718552c2d0191d6aa26481ed5 Mon Sep 17 00:00:00 2001
+From: Petr Gotthard <petr.gotthard@advantech.cz>
+Date: Sat, 25 Apr 2026 20:06:16 +0200
+Subject: [PATCH] fix loading of parent handles in TPM TSS2 keys
+
+Fixes: #152
+
+Upstream: https://github.com/tpm2-software/tpm2-openssl/commit/ec1d2d1380521e9718552c2d0191d6aa26481ed5
+
+[backported without new tests]
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ Makefile.am                           |  2 ++
+ src/tpm2-provider-pkey.c              | 38 ++++++++++++++++++---------
+ test/rsa_encodeobject_check.sh        | 27 +++++++++++++++++++
+ test/rsa_encodeobject_check_parent.sh | 29 ++++++++++++++++++++
+ 4 files changed, 84 insertions(+), 12 deletions(-)
+ create mode 100755 test/rsa_encodeobject_check.sh
+ create mode 100755 test/rsa_encodeobject_check_parent.sh
+
+diff --git a/src/tpm2-provider-pkey.c b/src/tpm2-provider-pkey.c
+index f739c17..97fb4dd 100644
+--- a/src/tpm2-provider-pkey.c
++++ b/src/tpm2-provider-pkey.c
+@@ -53,6 +53,8 @@ int
+ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT format)
+ {
+     TSSPRIVKEY *tpk = NULL;
++    BIGNUM *bn_parent = NULL;
++    int res = 0;
+ 
+     uint8_t privbuf[sizeof(keydata->priv)];
+     uint8_t pubbuf[sizeof(keydata->pub)];
+@@ -74,13 +76,18 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
+     if (!tpk->type)
+         goto error;
+ 
+-    // note the ASN1_INTEGER_set is not reliable for uin32_t on 32-bit machines
+     tpk->emptyAuth = ! !keydata->emptyAuth;
++
++    // note the ASN1_INTEGER_set is not reliable for uin32_t on 32-bit machines
++    if (!(bn_parent = BN_new()))
++        goto error;
++
+     if (keydata->parent != 0)
+-        ASN1_INTEGER_set_uint64(tpk->parent, keydata->parent);
++        BN_set_word(bn_parent, keydata->parent);
+     else
+-        ASN1_INTEGER_set_uint64(tpk->parent, TPM2_RH_OWNER);
++        BN_set_word(bn_parent, TPM2_RH_OWNER);
+ 
++    BN_to_ASN1_INTEGER(bn_parent, tpk->parent);
+     ASN1_STRING_set(tpk->privkey, &privbuf[0], privbuf_len);
+     ASN1_STRING_set(tpk->pubkey, &pubbuf[0], pubbuf_len);
+ 
+@@ -95,11 +102,11 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
+         goto error;
+     }
+ 
+-    TSSPRIVKEY_free(tpk);
+-    return 1;
++    res = 1;
+ error:
++    BN_free(bn_parent);
+     TSSPRIVKEY_free(tpk);
+-    return 0;
++    return res;
+ }
+ 
+ /** Deserialize TPM2_KEYDATA from disk
+@@ -114,9 +121,11 @@ error:
+ int
+ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+ {
+-    uint64_t parent;
++    BIGNUM *bn_parent = NULL;
++    TPM2_HANDLE parent;
+     TSSPRIVKEY *tpk = NULL;
+     char type_oid[64];
++    int res = 0;
+ 
+     switch (format) {
+     case KEY_FORMAT_PEM:
+@@ -135,9 +144,14 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+     keydata->emptyAuth = (tpk->emptyAuth != V_ASN1_UNDEF && tpk->emptyAuth);
+ 
+     // the ASN1_INTEGER_get on a 32-bit machine will fail for numbers of UINT32_MAX
+-    if (!ASN1_INTEGER_get_uint64(&parent, tpk->parent))
++    if (!(bn_parent = ASN1_INTEGER_to_BN(tpk->parent, NULL)))
+         goto error;
+ 
++    if (BN_is_negative(bn_parent))
++        parent = ASN1_INTEGER_get(tpk->parent);
++    else
++        parent = BN_get_word(bn_parent);
++
+     if (parent == 0)
+         keydata->parent = TPM2_RH_OWNER;
+     else if (parent <= UINT32_MAX)
+@@ -159,11 +173,11 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+                                        &keydata->pub))
+         goto error;
+ 
++    res = 1;
++error:
++    BN_free(bn_parent);
+     TSSPRIVKEY_free(tpk);
+-    return 1;
+- error:
+-    TSSPRIVKEY_free(tpk);
+-    return 0;
++    return res;
+ }
+ 
+ static const TPM2B_PUBLIC primaryRsaTemplate = {
+-- 
+2.47.3
+
diff --git a/package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch b/package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch
new file mode 100644
index 0000000000..5fb34ddfac
--- /dev/null
+++ b/package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch
@@ -0,0 +1,88 @@
+From 9cc4cbe25702fc95c536dfb6723ae454e0039faf Mon Sep 17 00:00:00 2001
+From: Moritz Buhl <moritz.buhl@infineon.com>
+Date: Tue, 1 Sep 2026 09:58:28 +0200
+Subject: [PATCH] pkey: fix compilation with OpenSSL 4.1
+
+Avoid deprecated OpenSSL functions, add fallback defines for older
+versions:
+src/tpm2-provider-pkey.c:91:5: error: 'ASN1_STRING_set' is deprecated:
+Since OpenSSL 4.1; use ASN1_STRING_set1_data() or ASN1_STRING_set1_string()
+[-Werror,-Wdeprecated-declarations]
+src/tpm2-provider-pkey.c:165:41: error: 'ASN1_STRING_length' is deprecated:
+Since OpenSSL 4.1; use ASN1_STRING_get_length()
+[-Werror,-Wdeprecated-declarations]
+
+Add missing header:
+src/tpm2-provider-pkey.c:32:1: error: call to undeclared function 'ERR_raise';
+ISO C99 and later do not support implicit function declarations
+[-Wimplicit-function-declaration]
+
+Signed-off-by: Moritz Buhl <moritz.buhl@infineon.com>
+
+Upstream: https://github.com/tpm2-software/tpm2-openssl/commit/9cc4cbe25702fc95c536dfb6723ae454e0039faf
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ src/tpm2-provider-pkey.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/src/tpm2-provider-pkey.c b/src/tpm2-provider-pkey.c
+index 84a5532..0d1d3f9 100644
+--- a/src/tpm2-provider-pkey.c
++++ b/src/tpm2-provider-pkey.c
+@@ -2,6 +2,8 @@
+ 
+ #include <string.h>
+ 
++#include <openssl/err.h>
++#include <openssl/opensslv.h>
+ #include <openssl/pem.h>
+ #include <openssl/rand.h>
+ 
+@@ -9,6 +11,14 @@
+ 
+ #include "tpm2-provider-pkey.h"
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x40100000
++#define TPM2_ASN1_STRING_get_length(x)		ASN1_STRING_get_length(x)
++#define TPM2_ASN1_STRING_set1_data(s, d, l)	ASN1_STRING_set1_data(s, d, l)
++#else
++#define TPM2_ASN1_STRING_get_length(x)		ASN1_STRING_length(x)
++#define TPM2_ASN1_STRING_set1_data(s, d, l)	ASN1_STRING_set(s, d, l)
++#endif
++
+ typedef struct {
+     ASN1_OBJECT *type;
+     ASN1_BOOLEAN emptyAuth;
+@@ -88,8 +98,8 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
+         BN_set_word(bn_parent, TPM2_RH_OWNER);
+ 
+     BN_to_ASN1_INTEGER(bn_parent, tpk->parent);
+-    ASN1_STRING_set(tpk->privkey, &privbuf[0], privbuf_len);
+-    ASN1_STRING_set(tpk->pubkey, &pubbuf[0], pubbuf_len);
++    TPM2_ASN1_STRING_set1_data(tpk->privkey, &privbuf[0], privbuf_len);
++    TPM2_ASN1_STRING_set1_data(tpk->pubkey, &pubbuf[0], pubbuf_len);
+ 
+     switch (format) {
+     case KEY_FORMAT_PEM:
+@@ -162,13 +172,13 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+         goto error;
+ 
+     if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(ASN1_STRING_get0_data(tpk->privkey),
+-                                        ASN1_STRING_length(tpk->privkey), NULL,
+-                                        &keydata->priv))
++                                        TPM2_ASN1_STRING_get_length(tpk->privkey),
++                                        NULL, &keydata->priv))
+         goto error;
+ 
+     if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(ASN1_STRING_get0_data(tpk->pubkey),
+-                                       ASN1_STRING_length(tpk->pubkey), NULL,
+-                                       &keydata->pub))
++                                       TPM2_ASN1_STRING_get_length(tpk->pubkey),
++                                       NULL, &keydata->pub))
+         goto error;
+ 
+     res = 1;
+-- 
+2.47.3
+
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread