mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-09-27 11:30:08 +00:00
Code Issues Projects Releases Wiki Activity

tpm2-openssl: Fix build with OpenSSL 4.x

Browse Source 
OpenSSL 4.0 completes the opaquing of struct asn1_string_st, so reaching
into ASN1_OCTET_STRING directly no longer compiles:

  src/tpm2-provider-pkey.c:152:53: error: incomplete definition of type
      'ASN1_OCTET_STRING' (aka 'struct asn1_string_st')
    152 |     if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(tpk->privkey->data,
        |                                         ~~~~~~~~~~~~~^

Backport upstream commit 6dcc3b2 which switches tpm2_keydata_read() to
the ASN1_STRING_get0_data()/ASN1_STRING_length() accessors. 1.3.0 is
still the newest release, so there is no upgrade to take instead.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
This commit is contained in:
Khem Raj
2026-09-14 20:53:36 +03:00
committed by Scott Murray
parent f3d7d2e6d4
commit 91c22ab48e
2 changed files with 98 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-tpm/recipes-tpm2/tpm2-openssl/tpm2-openssl/0001-Fix-ASN1_OCTET_STRING-and-X509_NAME-access-for-OpenS.patch
+95
View File
@@ -0,0 +1,95 @@
From 6dcc3b2984e3f4dc1849c79d89c6ce736a8435b3 Mon Sep 17 00:00:00 2001
From: Petr Gotthard <petr.gotthard@advantech.cz>
Date: Sat, 7 Mar 2026 15:51:12 +0100
Subject: [PATCH] Fix ASN1_OCTET_STRING and X509_NAME access for OpenSSL 4.0
compatibility
Fixes: #166
OpenSSL 4.0 completes the opaquing of struct asn1_string_st, so reaching
into ASN1_OCTET_STRING directly no longer compiles:
src/tpm2-provider-pkey.c:152:53: error: incomplete definition of type
'ASN1_OCTET_STRING' (aka 'struct asn1_string_st')
152 | if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(tpk->privkey->data,
| ~~~~~~~~~~~~~^
Upstream-Status: Backport [https://github.com/tpm2-software/tpm2-openssl/commit/6dcc3b2984e3f4dc1849c79d89c6ce736a8435b3]
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
---
src/tpm2-provider-pkey.c | 8 ++++----
test/ec_genpkey_x509_csr.c | 10 ++++++----
test/rsa_pki/etc/email.conf | 2 +-
3 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/src/tpm2-provider-pkey.c b/src/tpm2-provider-pkey.c
index 38f748e..80213af 100644
--- a/src/tpm2-provider-pkey.c
+++ b/src/tpm2-provider-pkey.c
@@ -149,13 +149,13 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
strcmp(type_oid, OID_loadableKey))
goto error;
- if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(tpk->privkey->data,
- tpk->privkey->length, NULL,
+ if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(ASN1_STRING_get0_data(tpk->privkey),
+ ASN1_STRING_length(tpk->privkey), NULL,
&keydata->priv))
goto error;
- if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(tpk->pubkey->data,
- tpk->pubkey->length, NULL,
+ if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(ASN1_STRING_get0_data(tpk->pubkey),
+ ASN1_STRING_length(tpk->pubkey), NULL,
&keydata->pub))
goto error;
diff --git a/test/ec_genpkey_x509_csr.c b/test/ec_genpkey_x509_csr.c
index e3523ec..5c9790a 100644
--- a/test/ec_genpkey_x509_csr.c
+++ b/test/ec_genpkey_x509_csr.c
@@ -15,7 +15,7 @@ int generate_csr(const char *password, const char *filename)
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY *pkey = NULL;
X509_REQ *x509 = NULL;
- X509_NAME *name;
+ X509_NAME *name = NULL;
STACK_OF(X509_EXTENSION) *exts = NULL;
X509_EXTENSION *ex;
FILE *csr_file = NULL;
@@ -40,9 +40,10 @@ int generate_csr(const char *password, const char *filename)
|| X509_REQ_set_pubkey(x509, pkey) != 1)
goto error1;
- name = X509_REQ_get_subject_name(x509);
- if (!X509_NAME_add_entry_by_NID(name, NID_countryName, MBSTRING_ASC, (unsigned char *)"CZ", -1, -1, 0)
- || !X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, (const unsigned char *)"www.example.com", -1, -1, 0))
+ if (!(name = X509_NAME_new())
+ || !X509_NAME_add_entry_by_NID(name, NID_countryName, MBSTRING_ASC, (unsigned char *)"CZ", -1, -1, 0)
+ || !X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, (const unsigned char *)"www.example.com", -1, -1, 0)
+ || X509_REQ_set_subject_name(x509, name) != 1)
goto error1;
// set requested extensions
@@ -75,6 +76,7 @@ int generate_csr(const char *password, const char *filename)
fclose(csr_file);
error1:
sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+ X509_NAME_free(name);
X509_REQ_free(x509);
EVP_PKEY_free(pkey);
EVP_PKEY_CTX_free(pctx);
diff --git a/test/rsa_pki/etc/email.conf b/test/rsa_pki/etc/email.conf
index 7606c38..73c06d2 100644
--- a/test/rsa_pki/etc/email.conf
+++ b/test/rsa_pki/etc/email.conf
@@ -24,4 +24,4 @@ emailAddress = "fred@simple.org"
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = emailProtection,clientAuth
subjectKeyIdentifier = hash
-subjectAltName = email:move
+subjectAltName = email:copy
--
2.51.0
meta-tpm/recipes-tpm2/tpm2-openssl/tpm2-openssl_1.3.0.bb
+3 -1
View File
@@ -5,7 +5,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3f4b4cb00f4d0d6807a0dc79759a57ac"
DEPENDS = "autoconf-archive-native tpm2-tss openssl"
SRC_URI = "https://github.com/tpm2-software/${BPN}/releases/download/${PV}/${BPN}-${PV}.tar.gz"
SRC_URI = "https://github.com/tpm2-software/${BPN}/releases/download/${PV}/${BPN}-${PV}.tar.gz \
file://0001-Fix-ASN1_OCTET_STRING-and-X509_NAME-access-for-OpenS.patch \
"
SRC_URI[sha256sum] = "9a9aca55d4265ec501bcf9c56d21d6ca18dba902553f21c888fe725b42ea9964"