* [Buildroot] [PATCH 1/1] package/tpm2-openssl: Fix build with OpenSSL 4.1
@ 2026-10-25 19:31 Bernd Kuhls
2026-10-25 20:39 ` Thomas Petazzoni via buildroot
0 siblings, 1 reply; 2+ messages in thread
From: Bernd Kuhls @ 2026-10-25 19:31 UTC (permalink / raw)
To: buildroot; +Cc: Romain Naour
Patch 0003 fixes the build error and needs patch 0002 to be applied
cleanly.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/5f1418b2096b88dc0340d0478eb677b84e16d90c
...g-of-parent-handles-in-TPM-TSS2-keys.patch | 118 ++++++++++++++++++
...key-fix-compilation-with-OpenSSL-4.1.patch | 88 +++++++++++++
2 files changed, 206 insertions(+)
create mode 100644 package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch
create mode 100644 package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch
diff --git a/package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch b/package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch
new file mode 100644
index 0000000000..4997fecc9e
--- /dev/null
+++ b/package/tpm2-openssl/0002-fix-loading-of-parent-handles-in-TPM-TSS2-keys.patch
@@ -0,0 +1,118 @@
+From ec1d2d1380521e9718552c2d0191d6aa26481ed5 Mon Sep 17 00:00:00 2001
+From: Petr Gotthard <petr.gotthard@advantech.cz>
+Date: Sat, 25 Apr 2026 20:06:16 +0200
+Subject: [PATCH] fix loading of parent handles in TPM TSS2 keys
+
+Fixes: #152
+
+Upstream: https://github.com/tpm2-software/tpm2-openssl/commit/ec1d2d1380521e9718552c2d0191d6aa26481ed5
+
+[backported without new tests]
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ Makefile.am | 2 ++
+ src/tpm2-provider-pkey.c | 38 ++++++++++++++++++---------
+ test/rsa_encodeobject_check.sh | 27 +++++++++++++++++++
+ test/rsa_encodeobject_check_parent.sh | 29 ++++++++++++++++++++
+ 4 files changed, 84 insertions(+), 12 deletions(-)
+ create mode 100755 test/rsa_encodeobject_check.sh
+ create mode 100755 test/rsa_encodeobject_check_parent.sh
+
+diff --git a/src/tpm2-provider-pkey.c b/src/tpm2-provider-pkey.c
+index f739c17..97fb4dd 100644
+--- a/src/tpm2-provider-pkey.c
++++ b/src/tpm2-provider-pkey.c
+@@ -53,6 +53,8 @@ int
+ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT format)
+ {
+ TSSPRIVKEY *tpk = NULL;
++ BIGNUM *bn_parent = NULL;
++ int res = 0;
+
+ uint8_t privbuf[sizeof(keydata->priv)];
+ uint8_t pubbuf[sizeof(keydata->pub)];
+@@ -74,13 +76,18 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
+ if (!tpk->type)
+ goto error;
+
+- // note the ASN1_INTEGER_set is not reliable for uin32_t on 32-bit machines
+ tpk->emptyAuth = ! !keydata->emptyAuth;
++
++ // note the ASN1_INTEGER_set is not reliable for uin32_t on 32-bit machines
++ if (!(bn_parent = BN_new()))
++ goto error;
++
+ if (keydata->parent != 0)
+- ASN1_INTEGER_set_uint64(tpk->parent, keydata->parent);
++ BN_set_word(bn_parent, keydata->parent);
+ else
+- ASN1_INTEGER_set_uint64(tpk->parent, TPM2_RH_OWNER);
++ BN_set_word(bn_parent, TPM2_RH_OWNER);
+
++ BN_to_ASN1_INTEGER(bn_parent, tpk->parent);
+ ASN1_STRING_set(tpk->privkey, &privbuf[0], privbuf_len);
+ ASN1_STRING_set(tpk->pubkey, &pubbuf[0], pubbuf_len);
+
+@@ -95,11 +102,11 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
+ goto error;
+ }
+
+- TSSPRIVKEY_free(tpk);
+- return 1;
++ res = 1;
+ error:
++ BN_free(bn_parent);
+ TSSPRIVKEY_free(tpk);
+- return 0;
++ return res;
+ }
+
+ /** Deserialize TPM2_KEYDATA from disk
+@@ -114,9 +121,11 @@ error:
+ int
+ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+ {
+- uint64_t parent;
++ BIGNUM *bn_parent = NULL;
++ TPM2_HANDLE parent;
+ TSSPRIVKEY *tpk = NULL;
+ char type_oid[64];
++ int res = 0;
+
+ switch (format) {
+ case KEY_FORMAT_PEM:
+@@ -135,9 +144,14 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+ keydata->emptyAuth = (tpk->emptyAuth != V_ASN1_UNDEF && tpk->emptyAuth);
+
+ // the ASN1_INTEGER_get on a 32-bit machine will fail for numbers of UINT32_MAX
+- if (!ASN1_INTEGER_get_uint64(&parent, tpk->parent))
++ if (!(bn_parent = ASN1_INTEGER_to_BN(tpk->parent, NULL)))
+ goto error;
+
++ if (BN_is_negative(bn_parent))
++ parent = ASN1_INTEGER_get(tpk->parent);
++ else
++ parent = BN_get_word(bn_parent);
++
+ if (parent == 0)
+ keydata->parent = TPM2_RH_OWNER;
+ else if (parent <= UINT32_MAX)
+@@ -159,11 +173,11 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+ &keydata->pub))
+ goto error;
+
++ res = 1;
++error:
++ BN_free(bn_parent);
+ TSSPRIVKEY_free(tpk);
+- return 1;
+- error:
+- TSSPRIVKEY_free(tpk);
+- return 0;
++ return res;
+ }
+
+ static const TPM2B_PUBLIC primaryRsaTemplate = {
+--
+2.47.3
+
diff --git a/package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch b/package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch
new file mode 100644
index 0000000000..5fb34ddfac
--- /dev/null
+++ b/package/tpm2-openssl/0003-pkey-fix-compilation-with-OpenSSL-4.1.patch
@@ -0,0 +1,88 @@
+From 9cc4cbe25702fc95c536dfb6723ae454e0039faf Mon Sep 17 00:00:00 2001
+From: Moritz Buhl <moritz.buhl@infineon.com>
+Date: Tue, 1 Sep 2026 09:58:28 +0200
+Subject: [PATCH] pkey: fix compilation with OpenSSL 4.1
+
+Avoid deprecated OpenSSL functions, add fallback defines for older
+versions:
+src/tpm2-provider-pkey.c:91:5: error: 'ASN1_STRING_set' is deprecated:
+Since OpenSSL 4.1; use ASN1_STRING_set1_data() or ASN1_STRING_set1_string()
+[-Werror,-Wdeprecated-declarations]
+src/tpm2-provider-pkey.c:165:41: error: 'ASN1_STRING_length' is deprecated:
+Since OpenSSL 4.1; use ASN1_STRING_get_length()
+[-Werror,-Wdeprecated-declarations]
+
+Add missing header:
+src/tpm2-provider-pkey.c:32:1: error: call to undeclared function 'ERR_raise';
+ISO C99 and later do not support implicit function declarations
+[-Wimplicit-function-declaration]
+
+Signed-off-by: Moritz Buhl <moritz.buhl@infineon.com>
+
+Upstream: https://github.com/tpm2-software/tpm2-openssl/commit/9cc4cbe25702fc95c536dfb6723ae454e0039faf
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ src/tpm2-provider-pkey.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/src/tpm2-provider-pkey.c b/src/tpm2-provider-pkey.c
+index 84a5532..0d1d3f9 100644
+--- a/src/tpm2-provider-pkey.c
++++ b/src/tpm2-provider-pkey.c
+@@ -2,6 +2,8 @@
+
+ #include <string.h>
+
++#include <openssl/err.h>
++#include <openssl/opensslv.h>
+ #include <openssl/pem.h>
+ #include <openssl/rand.h>
+
+@@ -9,6 +11,14 @@
+
+ #include "tpm2-provider-pkey.h"
+
++#if OPENSSL_VERSION_NUMBER >= 0x40100000
++#define TPM2_ASN1_STRING_get_length(x) ASN1_STRING_get_length(x)
++#define TPM2_ASN1_STRING_set1_data(s, d, l) ASN1_STRING_set1_data(s, d, l)
++#else
++#define TPM2_ASN1_STRING_get_length(x) ASN1_STRING_length(x)
++#define TPM2_ASN1_STRING_set1_data(s, d, l) ASN1_STRING_set(s, d, l)
++#endif
++
+ typedef struct {
+ ASN1_OBJECT *type;
+ ASN1_BOOLEAN emptyAuth;
+@@ -88,8 +98,8 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
+ BN_set_word(bn_parent, TPM2_RH_OWNER);
+
+ BN_to_ASN1_INTEGER(bn_parent, tpk->parent);
+- ASN1_STRING_set(tpk->privkey, &privbuf[0], privbuf_len);
+- ASN1_STRING_set(tpk->pubkey, &pubbuf[0], pubbuf_len);
++ TPM2_ASN1_STRING_set1_data(tpk->privkey, &privbuf[0], privbuf_len);
++ TPM2_ASN1_STRING_set1_data(tpk->pubkey, &pubbuf[0], pubbuf_len);
+
+ switch (format) {
+ case KEY_FORMAT_PEM:
+@@ -162,13 +172,13 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
+ goto error;
+
+ if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(ASN1_STRING_get0_data(tpk->privkey),
+- ASN1_STRING_length(tpk->privkey), NULL,
+- &keydata->priv))
++ TPM2_ASN1_STRING_get_length(tpk->privkey),
++ NULL, &keydata->priv))
+ goto error;
+
+ if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(ASN1_STRING_get0_data(tpk->pubkey),
+- ASN1_STRING_length(tpk->pubkey), NULL,
+- &keydata->pub))
++ TPM2_ASN1_STRING_get_length(tpk->pubkey),
++ NULL, &keydata->pub))
+ goto error;
+
+ res = 1;
+--
+2.47.3
+
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-25 20:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-25 19:31 [Buildroot] [PATCH 1/1] package/tpm2-openssl: Fix build with OpenSSL 4.1 Bernd Kuhls
2026-10-25 20:39 ` Thomas Petazzoni via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox