From e0f435f93580c84a93cc083a7fc23a5751ca8424 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 25 Sep 2022 07:33:52 +0900 Subject: [PATCH 1/2] meson: libfido2 requires openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes compile error with -Dopenssl=false. ``` In file included from ../../home/watanabe/git/systemd/src/shared/pkcs11-util.h:12, from ../../home/watanabe/git/systemd/src/cryptenroll/cryptenroll.c:24: ../../home/watanabe/git/systemd/src/shared/openssl-util.h:56:21: error: conflicting types for ‘X509’; have ‘struct X509’ 56 | typedef struct X509 X509; | ^~~~ In file included from /usr/include/openssl/crypto.h:25, from /usr/include/openssl/bio.h:20, from /usr/include/openssl/asn1.h:16, from /usr/include/openssl/ec.h:17, from /usr/include/fido.h:10, from ../../home/watanabe/git/systemd/src/shared/libfido2-util.h:18, from ../../home/watanabe/git/systemd/src/cryptenroll/cryptenroll-fido2.h:7, from ../../home/watanabe/git/systemd/src/cryptenroll/cryptenroll.c:6: /usr/include/openssl/ossl_typ.h:123:24: note: previous declaration of ‘X509’ with type ‘X509’ {aka ‘struct x509_st’} 123 | typedef struct x509_st X509; | ^~~~ ``` --- meson.build | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/meson.build b/meson.build index a20e94c55a5..4f193ce17b5 100644 --- a/meson.build +++ b/meson.build @@ -1440,9 +1440,16 @@ conf.set10('HAVE_P11KIT', have) want_libfido2 = get_option('libfido2') if want_libfido2 != 'false' and not skip_deps - libfido2 = dependency('libfido2', - required : want_libfido2 == 'true') - have = libfido2.found() + if conf.get('HAVE_OPENSSL') == 1 + libfido2 = dependency('libfido2', + required : want_libfido2 == 'true') + have = libfido2.found() + elif want_libfido2 == 'true' + error('libfido2=true requires openssl') + else + have = false + libfido2 = [] + endif else have = false libfido2 = [] From 395c1d9a85dbae198dc29313151b7934727a4cbc Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 25 Sep 2022 07:41:07 +0900 Subject: [PATCH 2/2] tpm2-util: fix build with -Dopenssl=false Fixes #24800. --- src/shared/tpm2-util.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index d4b0ff51173..16c907587c0 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -802,6 +802,7 @@ static int tpm2_make_encryption_session( return 0; } +#if HAVE_OPENSSL static int openssl_pubkey_to_tpm2_pubkey(EVP_PKEY *input, TPM2B_PUBLIC *output) { #if OPENSSL_VERSION_MAJOR >= 3 _cleanup_(BN_freep) BIGNUM *n = NULL, *e = NULL; @@ -981,6 +982,7 @@ static int find_signature( return log_error_errno(SYNTHETIC_ERRNO(ENXIO), "Couldn't find signature for this PCR bank, PCR index and public key."); } +#endif static int tpm2_make_policy_session( ESYS_CONTEXT *c, @@ -1005,7 +1007,6 @@ static int tpm2_make_policy_session( }; _cleanup_(Esys_Freep) TPM2B_DIGEST *policy_digest = NULL; ESYS_TR session = ESYS_TR_NONE, pubkey_handle = ESYS_TR_NONE; - _cleanup_(EVP_PKEY_freep) EVP_PKEY *pk = NULL; TSS2_RC rc; int r; @@ -1045,6 +1046,8 @@ static int tpm2_make_policy_session( } } +#if HAVE_OPENSSL + _cleanup_(EVP_PKEY_freep) EVP_PKEY *pk = NULL; if (pubkey_size > 0) { /* If a pubkey is specified, load it to validate it, even if the PCR mask for this is actually zero, and we are thus not going to use it. */ _cleanup_fclose_ FILE *f = fmemopen((void*) pubkey, pubkey_size, "r"); @@ -1055,6 +1058,7 @@ static int tpm2_make_policy_session( if (!pk) return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to parse PEM public key."); } +#endif rc = sym_Esys_StartAuthSession( c, @@ -1073,6 +1077,7 @@ static int tpm2_make_policy_session( "Failed to open session in TPM: %s", sym_Tss2_RC_Decode(rc)); if (pubkey_pcr_mask != 0) { +#if HAVE_OPENSSL log_debug("Configuring public key based PCR policy."); /* First: load public key into the TPM */ @@ -1221,6 +1226,9 @@ static int tpm2_make_policy_session( "Failed to push Authorize policy into TPM: %s", sym_Tss2_RC_Decode(rc)); goto finish; } +#else + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled."); +#endif } if (hash_pcr_mask != 0) {