[tpm2] Re: [SPAM] Re: TPM2 provider stuck during handshake
Remi Tricot-Le Breton <rlebreton at haproxy.com> Thu, 09 Jun 2022 11:43:59 +0200
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hi Petr,
On 08/06/2022 16:47, Petr Gotthard wrote:
>
> Hi Rémi,
>
> I can't think of any simple reason why you getting that error.
>
> Do you use a TPM simulator (which?) or a real TPM chip?
>
I'm using a real chip.
> And do you use it with the abrmd manager, or not?
>
> (In general, the abrmd is recommended for complex operations like PKI.)
>
I actually don't know. I had to install the abrmd when I first tried
using a simulator (before realizing that I actually had an integrated
TPM chip) but I don't know if it is still used or not.
I'm not that familiar with the TPM ecosystem. I mainly tried this
provider because it's one of the few already available "external"
providers (as in not made by openssl).
> Petr
>
> ______________________________________________________________
> > Od: "Remi Tricot-Le Breton" <rlebreton(a)haproxy.com>
> > Komu: tpm2(a)lists.01.org
> > Datum: 08.06.2022 16:16
> > Předmět: [tpm2] TPM2 provider stuck during handshake
> >
>
> Hello,
>
> I've been trying to make the TPM2 provider work in my environment
> (Ubuntu 20.04) for quite some time and I did not succeed yet.
>
> I tried using the commands suggested in docs/certificates.md to create a
> self signed certificate which I then used in an "openssl s_server"
> instance but when I try to connect to this SSL server, the handshake
> fails to complete.
> The three commands I used are the following:
> openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout
> testkey.pem -out testcert.pem
> openssl s_server -provider tpm2 -provider default -propquery
> ?provider=tpm2 -accept 4443 -www -key testkey.pem -cert testcert.pem
> curl --cacert testcert.pem https://localhost:4443/
>
> The curl command ends in a timeout and the server remains stuck (without
> raising errors).
>
> I rebuilt the tpm2 provider with the enable-debug=yes option added in
> order to understand what was happening and I noticed that the server was
> stuck when trying to duplicate a context ("DIGEST DUP" was dumped on the
> server's standard output), and more specifically in the
> Tss2_Sys_ExecuteFinish function which in turn calls tctildr_receive with
> a -1 timeout (out of which we apparently never get out).
>
> Do any of you know if I missed something or if it is a bug ?
> I could provide the full standard output log or a complete backtrace of
> the stuck server if needed but they might end up being unnecessary noise
> if the bug comes from my wrong use of the provider.
>
> Thanks
>
> Rémi LB
> _______________________________________________
> tpm2 mailing list -- tpm2(a)lists.01.org
> To unsubscribe send an email to tpm2-leave(a)lists.01.org
> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
>
> _______________________________________________
> tpm2 mailing list --tpm2(a)lists.01.org
> To unsubscribe send an email totpm2-leave(a)lists.01.org
> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
@Petr sorry for the duplicated mail, I forgot to add the ML when
answering and I figured it would be better to have the full history there.
Rémi LB
attachment.htm
(text/html, 5.4 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Hi Petr,<br>
<br>
<div class="moz-cite-prefix">On 08/06/2022 16:47, Petr Gotthard
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p style="padding:0 0 0 0; margin:0 0 0 0;">Hi Rémi,</p>
<p style="padding:0 0 0 0; margin:0 0 0 0;">I can't think of any
simple reason why you getting that error.</p>
<p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
<p style="padding:0 0 0 0; margin:0 0 0 0;">Do you use a TPM
simulator (which?) or a real TPM chip? </p>
</blockquote>
<br>
I'm using a real chip.<br>
<br>
<blockquote type="cite"
cite="mid:[email protected]">
<p style="padding:0 0 0 0; margin:0 0 0 0;">And do you use it with
the abrmd manager, or not?</p>
<p style="padding:0 0 0 0; margin:0 0 0 0;">(In general, the abrmd
is recommended for complex operations like PKI.)</p>
</blockquote>
<br>
I actually don't know. I had to install the abrmd when I first tried
using a simulator (before realizing that I actually had an
integrated TPM chip) but I don't know if it is still used or not.<br>
I'm not that familiar with the TPM ecosystem. I mainly tried this
provider because it's one of the few already available "external"
providers (as in not made by openssl).<br>
<br>
<blockquote type="cite"
cite="mid:[email protected]">
<p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
<p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
<p style="padding:0 0 0 0; margin:0 0 0 0;">Petr</p>
<p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
<p style="padding:0 0 0 0; margin:0 0 0 0;">______________________________________________________________<br>
> Od: "Remi Tricot-Le Breton" <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a><br>
> Komu: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br>
> Datum: 08.06.2022 16:16<br>
> Předmět: [tpm2] TPM2 provider stuck during handshake<br>
></p>
Hello,<br>
<br>
I've been trying to make the TPM2 provider work in my environment
<br>
(Ubuntu 20.04) for quite some time and I did not succeed yet.<br>
<br>
I tried using the commands suggested in docs/certificates.md to
create a <br>
self signed certificate which I then used in an "openssl s_server"
<br>
instance but when I try to connect to this SSL server, the
handshake <br>
fails to complete.<br>
The three commands I used are the following:<br>
openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout
<br>
testkey.pem -out testcert.pem<br>
openssl s_server -provider tpm2 -provider default -propquery <br>
?provider=tpm2 -accept 4443 -www -key testkey.pem -cert
testcert.pem<br>
curl --cacert testcert.pem <a href="https://localhost:4443/"
moz-do-not-send="true" class="moz-txt-link-freetext">https://localhost:4443/</a><br>
<br>
The curl command ends in a timeout and the server remains stuck
(without <br>
raising errors).<br>
<br>
I rebuilt the tpm2 provider with the enable-debug=yes option added
in <br>
order to understand what was happening and I noticed that the
server was <br>
stuck when trying to duplicate a context ("DIGEST DUP" was dumped
on the <br>
server's standard output), and more specifically in the <br>
Tss2_Sys_ExecuteFinish function which in turn calls
tctildr_receive with <br>
a -1 timeout (out of which we apparently never get out).<br>
<br>
Do any of you know if I missed something or if it is a bug ?<br>
I could provide the full standard output log or a complete
backtrace of <br>
the stuck server if needed but they might end up being unnecessary
noise <br>
if the bug comes from my wrong use of the provider.<br>
<br>
Thanks<br>
<br>
Rémi LB<br>
_______________________________________________<br>
tpm2 mailing list -- <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br>
To unsubscribe send an email to <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
tpm2 mailing list -- <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
To unsubscribe send an email to <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</pre>
</blockquote>
<br>
@Petr sorry for the duplicated mail, I forgot to add the ML when
answering and I figured it would be better to have the full history
there.<br>
<br>
Rémi LB<br>
<br>
<br>
</body>
</html>