[tpm2] TPM2 provider stuck during handshake

Remi Tricot-Le Breton <rlebreton at haproxy.com> Wed, 08 Jun 2022 16:16:22 +0200
Newsgroups dev.linux.lists.tpm2
Message-ID <[email protected]>
Hello,

I've been trying to make the TPM2 provider work in my environment 
(Ubuntu 20.04) for quite some time and I did not succeed yet.

I tried using the commands suggested in docs/certificates.md to create a 
self signed certificate which I then used in an "openssl s_server" 
instance but when I try to connect to this SSL server, the handshake 
fails to complete.
The three commands I used are the following:
     openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout 
testkey.pem -out testcert.pem
     openssl s_server -provider tpm2 -provider default -propquery 
?provider=tpm2 -accept 4443 -www -key testkey.pem -cert testcert.pem
     curl --cacert testcert.pem https://localhost:4443/

The curl command ends in a timeout and the server remains stuck (without 
raising errors).

I rebuilt the tpm2 provider with the enable-debug=yes option added in 
order to understand what was happening and I noticed that the server was 
stuck when trying to duplicate a context ("DIGEST DUP" was dumped on the 
server's standard output), and more specifically in the 
Tss2_Sys_ExecuteFinish function which in turn calls tctildr_receive with 
a -1 timeout (out of which we apparently never get out).

Do any of you know if I missed something or if it is a bug ?
I could provide the full standard output log or a complete backtrace of 
the stuck server if needed but they might end up being unnecessary noise 
if the bug comes from my wrong use of the provider.

Thanks

Rémi LB