[tpm2] Re: tpm2-pytss connect to dockerized swtpm
Roberts, William C <william.c.roberts at intel.com> Mon, 01 Aug 2022 15:36:35 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB3437043AEE691CF71E2D6765B89A9@SN6PR11MB3437.namprd11.prod.outlook.com> |
From: Roberts, William C <william.c.roberts(a)intel.com>
Sent: Monday, August 1, 2022 10:31 AM
To: henry.gadacz(a)stud.h-da.de <henry.gadacz(a)stud.h-da.de>; tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: Re: [tpm2] tpm2-pytss connect to dockerized swtpm
My guess is, that since containers are used to isolate things, that the port from container needs to be exposed somehow.
Premature send, sorry, look at these links:
- https://www.mend.io/free-developer-tools/blog/docker-expose-port/
- https://docs.docker.com/config/containers/container-networking/#:~:text=To%20make%20a%20port%20available,host%20to%20the%20outside%20world.
- https://docs.docker.com/network/network-tutorial-standalone/
*
I think somewhere in there is your answer.
Bill
________________________________
From: henry.gadacz(a)stud.h-da.de <henry.gadacz(a)stud.h-da.de>
Sent: Wednesday, July 27, 2022 3:29 AM
To: tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: [tpm2] tpm2-pytss connect to dockerized swtpm
Hello everyone,
I am trying to accomplish the following, but did not succeed and I hope someone can help me.
I want to have a docker compose with two containers. In the first container I want to run the swtpm (https://github.com/stefanberger/swtpm) and in the other a python script that uses tpm2-pytss to connect to the swtpm in the first container.
When I run swtpm and the python script in the same container it works.
In order to run them in separate containers I just duplicated the Dockerfile (I know this has some overhead, but to make sure don’t miss any dependencies), changed the docker CMD command to either run the python script or the swtpm and renamed them to Dockerfile_app_test and Dockerfile_tpm_test.
My docker compose file is looking like this:
version: '3.7'
services:
app:
container_name: app
build:
context: .
dockerfile: Dockerfile_app_test
restart: unless-stopped
tpm:
container_name: tpm
build:
context: .
dockerfile: Dockerfile_tpm_test
ports:
- "2321:2321"
- "2322:2322"
restart: unless-stopped
My python script is:
from tpm2_pytss import *
if __name__ == '__main__':
print("TPM test application")
tpm = ESAPI(tcti="swtpm:host=tpm,port=2321")
tpm.startup(TPM2_SU.CLEAR)
r = tpm.get_random(8)
print("type is ", type(r))
print("r is ", str(r))
print("as int ", int(str(r), 16))
When I run it in one Dockerfile I used
tpm = ESAPI(tcti="swtpm:host=localhost,port=2321")
so I thought changing the host name to the docker container name should do it but I always get the following errors:
app | WARNING:tcti:src/util/io.c:262:socket_connect() Failed to connect to host 172.21.0.2, port 2321: errno 111: Connection refused
app | ERROR:tcti:src/tss2-tcti/tcti-swtpm.c:614:Tss2_Tcti_Swtpm_Init() Cannot connect to swtpm TPM socket
app | ERROR:tcti:src/tss2-tcti/tctildr-dl.c:170:tcti_from_file() Could not initialize TCTI file: swtpm
app | ERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI
app | Traceback (most recent call last):
app | File "/app/main.py", line 70, in <module>
app | tpm = ESAPI(tcti="swtpm:host=tpm,port=2321")
app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/ESAPI.py", line 123, in __init__
app | tcti = TCTILdr.parse(tcti)
app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/TCTILdr.py", line 54, in parse
app | return cls(name, conf)
app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/TCTILdr.py", line 29, in __init__
app | _chkrc(lib.Tss2_TctiLdr_Initialize_Ex(name, conf, self._ctx_pp))
app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/internal/utils.py", line 32, in _chkr
app | raise TSS2_Exception(rc)
app | tpm2_pytss.TSS2_Exception.TSS2_Exception: tcti:IO failure
app exited with code 1
I know it’s not a plain tpm2-tss question, but does anyone has experience with that and can help me?
Kind regards,
Henry
attachment.htm
(text/html, 18.3 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
</div>
<div id="divRplyFwdMsg" dir="ltr" class="elementToProof"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Roberts, William C <[email protected]><br>
</font></div>
<div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Sent:</b> Monday, August 1, 2022 10:31 AM<br>
<b>To:</b> [email protected] <[email protected]>; [email protected] <[email protected]><br>
<b>Subject:</b> Re: [tpm2] tpm2-pytss connect to dockerized swtpm</font>
<div> </div>
</div>
<div dir="ltr" class="elementToProof">
<div class="x_elementToProof elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
My guess is, that since containers are used to isolate things, that the port from container needs to be exposed somehow.</div>
<div class="x_elementToProof elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
</div>
<div dir="ltr" class="elementToProof"><span class="x_elementToProof" style="font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif;margin:0px;background-color:rgb(255, 255, 255)">Premature send, sorry, look at these links:</span></div>
<div dir="ltr" class="elementToProof"><span class="x_elementToProof" style="font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif;margin:0px;background-color:rgb(255, 255, 255)"> - <a href="https://www.mend.io/free-developer-tools/blog/docker-expose-port/" style="margin:0px">https://www.mend.io/free-developer-tools/blog/docker-expose-port/</a><br>
</span></div>
<div dir="ltr" class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
- <a href="https://docs.docker.com/config/containers/container-networking/#:~:text=To%20make%20a%20port%20available,host%20to%20the%20outside%20world." id="LPNoLPOWALinkPreview_1">https://docs.docker.com/config/containers/container-networking/#:~:text=To%20make%20a%20port%20available,host%20to%20the%20outside%20world.</a></div>
<div dir="ltr" class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div><span> - <a href="https://docs.docker.com/network/network-tutorial-standalone/" id="LPlnkOWALinkPreview_1">https://docs.docker.com/network/network-tutorial-standalone/</a><br>
</span></div>
<ul>
<li style="display:block">
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview_1 _EReadonly_1"></div>
</li></ul>
<div><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div>I think somewhere in there is your answer.</div>
<div><br>
</div>
<div>Bill</div>
</div>
<div dir="ltr" class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
<br>
</div>
<div dir="ltr" class="elementToProof">
<div class="x_elementToProof" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> [email protected] <[email protected]><br>
<b>Sent:</b> Wednesday, July 27, 2022 3:29 AM<br>
<b>To:</b> [email protected] <[email protected]><br>
<b>Subject:</b> [tpm2] tpm2-pytss connect to dockerized swtpm</font>
<div> </div>
</div>
<div lang="EN-US" style="word-wrap:break-word">
<div class="x_x_WordSection1">
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Hello everyone,</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
I am trying to accomplish the following, but did not succeed and I hope someone can help me.</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
I want to have a docker compose with two containers. In the first container I want to run the swtpm (<a href="https://github.com/stefanberger/swtpm" data-auth="NotApplicable">https://github.com/stefanberger/swtpm</a><span style="color:black">)</span> and in
the other a python script that uses tpm2-pytss to connect to the swtpm in the first container.
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
When I run swtpm and the python script in the same container it works.</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
In order to run them in separate containers I just duplicated the Dockerfile (I know this has some overhead, but to make sure dont miss any dependencies), changed the docker CMD command to either run the python script or the swtpm and renamed them to Dockerfile_app_test
and Dockerfile_tpm_test.</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
My docker compose file is looking like this:</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;background:white">
<span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">version</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#067D17">'3.7'<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">services</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:<br>
<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">app</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">container_name</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: app<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">build</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">context</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: .<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">dockerfile</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: Dockerfile_app_test<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">restart</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: unless-stopped<br>
<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">tpm</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">container_name</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: tpm<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">build</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">context</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: .<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">dockerfile</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: Dockerfile_tpm_test<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">ports</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">:<br>
- </span><span style="font-size:10.0pt; font-family:"Courier New"; color:#067D17">"2321:2321"<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">-
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#067D17">"2322:2322"<br>
</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#0033B3">restart</span><span style="font-size:10.0pt; font-family:"Courier New"; color:#080808">: unless-stopped</span></p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
My python script is:</p>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#0033B3">from </span><span style="color:#080808">tpm2_pytss </span><span style="color:#0033B3">import </span><span style="color:#080808">*</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#0033B3">if </span><span style="color:#080808">__name__ == </span><span style="color:#067D17">'__main__'</span><span style="color:#080808">:<br> </span><span style="color:navy">print</span><span style="color:#080808">(</span><span style="color:#067D17">"TPM test application"</span><span style="color:#080808">)<br> tpm = ESAPI(</span><span style="color:#660099">tcti</span><span style="color:#080808">=</span><span style="color:#067D17">"swtpm:host=tpm,port=2321"</span><span style="color:#080808">)<br> tpm.startup(TPM2_SU.CLEAR)<br> <br> r = tpm.get_random(</span><span style="color:#1750EB">8</span><span style="color:#080808">)<br> </span><span style="color:navy">print</span><span style="color:#080808">(</span><span style="color:#067D17">"type is "</span><span style="color:#080808">, </span><span style="color:navy">type</span><span style="color:#080808">(r))<br> </span><span style="color:navy">print</span><span style="color:#080808">(</span><span style="color:#067D17">"r is "</span><span style="color:#080808">, </span><span style="color:navy">str</span><span style="color:#080808">(r))<br> </span><span style="color:navy">print</span><span style="color:#080808">(</span><span style="color:#067D17">"as int "</span><span style="color:#080808">, </span><span style="color:navy">int</span><span style="color:#080808">(</span><span style="color:navy">str</span><span style="color:#080808">(r), </span><span style="color:#1750EB">16</span><span style="color:#080808">))</span></pre>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
When I run it in one Dockerfile I used </p>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">tpm = ESAPI(</span><span style="color:#660099">tcti</span><span style="color:#080808">=</span><span style="color:#067D17">"swtpm:host=localhost,port=2321"</span><span style="color:#080808">)</span></pre>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
so I thought changing the host name to the docker container name should do it but I always get the following errors:</p>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | WARNING:tcti:src/util/io.c:262:socket_connect() Failed to connect to host 172.21.0.2, port 2321: errno 111: Connection refused </span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | ERROR:tcti:src/tss2-tcti/tcti-swtpm.c:614:Tss2_Tcti_Swtpm_Init() Cannot connect to swtpm TPM socket </span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | ERROR:tcti:src/tss2-tcti/tctildr-dl.c:170:tcti_from_file() Could not initialize TCTI file: swtpm </span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | ERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI </span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | Traceback (most recent call last):</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | File "/app/main.py", line 70, in <module></span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | tpm = ESAPI(tcti="swtpm:host=tpm,port=2321")</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/ESAPI.py", line 123, in __init__</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | tcti = TCTILdr.parse(tcti)</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/TCTILdr.py", line 54, in parse</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | return cls(name, conf)</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/TCTILdr.py", line 29, in __init__</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | _chkrc(lib.Tss2_TctiLdr_Initialize_Ex(name, conf, self._ctx_pp))</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | File "/usr/local/lib/python3.10/dist-packages/tpm2_pytss/internal/utils.py", line 32, in _chkr</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | raise TSS2_Exception(rc)</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app | tpm2_pytss.TSS2_Exception.TSS2_Exception: tcti:IO failure</span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: "Courier New";background:white"><span style="color:#080808">app exited with code 1</span></pre>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
I know its not a plain tpm2-tss question, but does anyone has experience with that and can help me?
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Kind regards, <br>
Henry</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
</div>
</div>
</body>
</html>