[tpm2] Re: TPM2 provider stuck during handshake
Petr Gotthard <petr.gotthard at centrum.cz> Wed, 08 Jun 2022 16:47:06 +0200
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hi Rémi,
I can't think of any simple reason why you getting that error.
Do you use a TPM simulator (which?) or a real TPM chip? And do you use it with the abrmd manager, or not?
(In general, the abrmd is recommended for complex operations like PKI.)
Petr
______________________________________________________________
> Od: "Remi Tricot-Le Breton" <rlebreton(a)haproxy.com>
> Komu: tpm2(a)lists.01.org
> Datum: 08.06.2022 16:16
> Předmět: [tpm2] TPM2 provider stuck during handshake
>
Hello,
I've been trying to make the TPM2 provider work in my environment
(Ubuntu 20.04) for quite some time and I did not succeed yet.
I tried using the commands suggested in docs/certificates.md to create a
self signed certificate which I then used in an "openssl s_server"
instance but when I try to connect to this SSL server, the handshake
fails to complete.
The three commands I used are the following:
openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout
testkey.pem -out testcert.pem
openssl s_server -provider tpm2 -provider default -propquery
?provider=tpm2 -accept 4443 -www -key testkey.pem -cert testcert.pem
curl --cacert testcert.pem https://localhost:4443/ <https://localhost:4443/>
The curl command ends in a timeout and the server remains stuck (without
raising errors).
I rebuilt the tpm2 provider with the enable-debug=yes option added in
order to understand what was happening and I noticed that the server was
stuck when trying to duplicate a context ("DIGEST DUP" was dumped on the
server's standard output), and more specifically in the
Tss2_Sys_ExecuteFinish function which in turn calls tctildr_receive with
a -1 timeout (out of which we apparently never get out).
Do any of you know if I missed something or if it is a bug ?
I could provide the full standard output log or a complete backtrace of
the stuck server if needed but they might end up being unnecessary noise
if the bug comes from my wrong use of the provider.
Thanks
Rémi LB
_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org
To unsubscribe send an email to tpm2-leave(a)lists.01.org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 3 KB)
<p style="padding:0 0 0 0; margin:0 0 0 0;">Hi Rémi,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I can't think of any simple reason why you getting that error.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Do you use a TPM simulator (which?) or a real TPM chip? And do you use it with the abrmd manager, or not?</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">(In general, the abrmd is recommended for complex operations like PKI.)</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Petr</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">______________________________________________________________<br /> > Od: "Remi Tricot-Le Breton" <[email protected]><br /> > Komu: [email protected]<br /> > Datum: 08.06.2022 16:16<br /> > Předmět: [tpm2] TPM2 provider stuck during handshake<br /> ></p> Hello,<br /> <br /> I've been trying to make the TPM2 provider work in my environment <br /> (Ubuntu 20.04) for quite some time and I did not succeed yet.<br /> <br /> I tried using the commands suggested in docs/certificates.md to create a <br /> self signed certificate which I then used in an "openssl s_server" <br /> instance but when I try to connect to this SSL server, the handshake <br /> fails to complete.<br /> The three commands I used are the following:<br /> openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout <br /> testkey.pem -out testcert.pem<br /> openssl s_server -provider tpm2 -provider default -propquery <br /> ?provider=tpm2 -accept 4443 -www -key testkey.pem -cert testcert.pem<br /> curl --cacert testcert.pem <a href="https://localhost:4443/">https://localhost:4443/</a><br /> <br /> The curl command ends in a timeout and the server remains stuck (without <br /> raising errors).<br /> <br /> I rebuilt the tpm2 provider with the enable-debug=yes option added in <br /> order to understand what was happening and I noticed that the server was <br /> stuck when trying to duplicate a context ("DIGEST DUP" was dumped on the <br /> server's standard output), and more specifically in the <br /> Tss2_Sys_ExecuteFinish function which in turn calls tctildr_receive with <br /> a -1 timeout (out of which we apparently never get out).<br /> <br /> Do any of you know if I missed something or if it is a bug ?<br /> I could provide the full standard output log or a complete backtrace of <br /> the stuck server if needed but they might end up being unnecessary noise <br /> if the bug comes from my wrong use of the provider.<br /> <br /> Thanks<br /> <br /> Rémi LB<br /> _______________________________________________<br /> tpm2 mailing list -- [email protected]<br /> To unsubscribe send an email to [email protected]<br /> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s