[tpm2] TPM2 provider stuck during handshake
Remi Tricot-Le Breton <rlebreton at haproxy.com> Wed, 08 Jun 2022 16:16:22 +0200
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hello,
I've been trying to make the TPM2 provider work in my environment
(Ubuntu 20.04) for quite some time and I did not succeed yet.
I tried using the commands suggested in docs/certificates.md to create a
self signed certificate which I then used in an "openssl s_server"
instance but when I try to connect to this SSL server, the handshake
fails to complete.
The three commands I used are the following:
openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout
testkey.pem -out testcert.pem
openssl s_server -provider tpm2 -provider default -propquery
?provider=tpm2 -accept 4443 -www -key testkey.pem -cert testcert.pem
curl --cacert testcert.pem https://localhost:4443/
The curl command ends in a timeout and the server remains stuck (without
raising errors).
I rebuilt the tpm2 provider with the enable-debug=yes option added in
order to understand what was happening and I noticed that the server was
stuck when trying to duplicate a context ("DIGEST DUP" was dumped on the
server's standard output), and more specifically in the
Tss2_Sys_ExecuteFinish function which in turn calls tctildr_receive with
a -1 timeout (out of which we apparently never get out).
Do any of you know if I missed something or if it is a bug ?
I could provide the full standard output log or a complete backtrace of
the stuck server if needed but they might end up being unnecessary noise
if the bug comes from my wrong use of the provider.
Thanks
Rémi LB