[tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts
Petr Gotthard <petr.gotthard at centrum.cz>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hi Chris, that's great to hear. Thanks for all the testing! In general I am interested in feedback (both bugs and improvement suggestions) from testing of real-life scenarios, so if you did test all you need and everything worked as you want it to work then I am happy and don't need anything else. Thanks again, Petr ______________________________________________________________ > Od: "Chris Newman" <chris(a)mode51.software> > Komu: "Petr Gotthard" <petr.gotthard(a)centrum.cz>, tpm2(a)lists.01.org > Datum: 06.10.2021 01:08 > Předmět: [tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts > Hi Petr, I've tried abrmd and it works fine for the ir: openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2 -cmd ir -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 <https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8 Also works with the cr: /opt/sdk/openssl/current/bin/openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2 -cmd cr -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 <https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234> -ref 1234 -key handle:0x81010002 -certout ./cl_cert2.pem -cert ./cl_cert.pem -tls_used -verbosity 8 -trusted ./capubs.pem -unprotected_errors Is there anything you want me to test with the DigiCert CMPv2 responder? Many thanks for the really great software. On 04/10/2021 09:18, Chris Newman wrote:Thanks Petr, I'm using in-kernel. I'll try abrmd and report back. On 04/10/2021 08:31, Petr Gotthard wrote:Hello, this sounds like a known limitation of the openssl provider: https://github.com/tpm2-software/tpm2-openssl/issues/4 <https://github.com/tpm2-software/tpm2-openssl/issues/4> Some applications (like CMP) are too greedy and consume more resources than the TPM has. The resource managers (to my best knowledge) cannot swap resources from the same user. Are you using the tpm2-abrmd resource manager, or the in-kernel manager? The tpm2-abrmd behaves much better. Petr ______________________________________________________________ > Od: "Chris Newman" <chris(a)mode51.software> <chris(a)mode51.software> > Komu: tpm2(a)lists.01.org <tpm2(a)lists.01.org> > Datum: 04.10.2021 01:41 > Předmět: [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts > Hi, I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server: openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 <https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8 I get the following error: DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST DUP DIGEST FINAL DIGEST FREE DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST DUP WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902) DIGEST FREE DIGEST FREE DIGEST FREE CMP DEBUG: disconnected from CMP server CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts CMP error: not able to copy ctx CMP error: internal error CMP error: error sending CMP error: shutdown while in init CMP error: transfer error:request sent: IR, expected response: IP RSA FREE RAND FREE RAND FREE RAND FREE PROVIDER TEARDOWN I've tried tpm2_flushcontext -t. I recompiled tpm2-openssl with the following option and that appears to have worked around the issue: --disable-op-digest Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do? -- Chris Newman https://mode51.software <https://mode51.software> @mode51software <https://twitter.com/mode51software>
attachment.htm
(text/html, 7.2 KB)
<p style="padding:0 0 0 0; margin:0 0 0 0;">Hi Chris,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">that's great to hear. Thanks for all the testing!</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">In general I am interested in feedback (both bugs and improvement suggestions) from testing of real-life scenarios, so if you did test all you need and everything worked as you want it to work then I am happy and don't need anything else.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Thanks again,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Petr</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">______________________________________________________________<br /> > Od: "Chris Newman" <[email protected]><br /> > Komu: "Petr Gotthard" <[email protected]>, [email protected]<br /> > Datum: 06.10.2021 01:08<br /> > Předmět: [tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts<br /> ></p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Hi Petr,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I've tried abrmd and it works fine for the ir:</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2 -cmd ir -server <a href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Also works with the cr:</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">/opt/sdk/openssl/current/bin/openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2 -cmd cr -server <a href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234 -key handle:0x81010002 -certout ./cl_cert2.pem -cert ./cl_cert.pem -tls_used -verbosity 8 -trusted ./capubs.pem -unprotected_errors</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Is there anything you want me to test with the DigiCert CMPv2 responder?</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Many thanks for the really great software.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <div class="moz-cite-prefix">On 04/10/2021 09:18, Chris Newman wrote:</div> <blockquote cite="mid:[email protected]"> <p style="padding:0 0 0 0; margin:0 0 0 0;">Thanks Petr,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I'm using in-kernel. I'll try abrmd and report back.</p> <br /> <div class="moz-cite-prefix">On 04/10/2021 08:31, Petr Gotthard wrote:</div> <blockquote cite="mid:[email protected]"> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">Hello,</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">this sounds like a known limitation of the openssl provider: <a href="https://github.com/tpm2-software/tpm2-openssl/issues/4">https://github.com/tpm2-software/tpm2-openssl/issues/4</a></p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">Some applications (like CMP) are too greedy and consume more resources than the TPM has. The resource managers (to my best knowledge) cannot swap resources from the same user.</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">Are you using the tpm2-abrmd resource manager, or the in-kernel manager? The tpm2-abrmd behaves much better.</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">Petr</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">______________________________________________________________<br /> > Od: "Chris Newman" <a href="mailto:[email protected]"><[email protected]></a><br /> > Komu: <a href="mailto:[email protected]">[email protected]</a><br /> > Datum: 04.10.2021 01:41<br /> > Předmět: [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts<br /> ></p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">Hi,</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server:</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server <a href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">I get the following error:</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">DIGEST NEW<br /> DIGEST INIT<br /> DIGEST UPDATE<br /> DIGEST DUP<br /> DIGEST FINAL<br /> DIGEST FREE<br /> DIGEST NEW<br /> DIGEST INIT<br /> DIGEST UPDATE<br /> DIGEST NEW<br /> DIGEST INIT<br /> DIGEST UPDATE<br /> DIGEST DUP<br /> WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error<br /> ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902)<br /> DIGEST FREE<br /> DIGEST FREE<br /> DIGEST FREE<br /> CMP DEBUG: disconnected from CMP server<br /> <strong>CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts</strong><br /> CMP error: not able to copy ctx<br /> CMP error: internal error<br /> CMP error: error sending<br /> CMP error: shutdown while in init<br /> CMP error: transfer error:request sent: IR, expected response: IP<br /> RSA FREE<br /> RAND FREE<br /> RAND FREE<br /> RAND FREE<br /> PROVIDER TEARDOWN</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">I've tried tpm2_flushcontext -t.</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">I recompiled tpm2-openssl with the following option and that appears to have worked around the issue:</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">--disable-op-digest</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;">Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?</p> <p style="padding: 0 0 0 0; margin: 0 0 0 0;"> </p> <div class="moz-signature">-- <br /> <br /> Chris Newman <br /> <a href="https://mode51.software">https://mode51.software</a> <br /> <a href="https://twitter.com/mode51software">@mode51software</a> </div> </blockquote> </blockquote>