Session attribute for password session to return ContinueSession

[salrashid123]

The fwtpm_server is returning ContinueSession=false when a password session while it looks like it should unilaterally return true always according to my read of the specs here Trusted-Platform-Module-2.0-Library-Part-1-Architecture_Version-185_pub

16.4 Password Authorizations    pg 113

TPMA_SESSION sessionAttributes copy of the flags from the password authorization in the command, continueSession will be SET

I came across this wile running the sample code below against fwtpm_server where the code snippet didnt' work and then against swtpm where it did.

go-tpm checks for the response attrribute here https://github.com/google/go-tpm/blob/main/tpm2/sessions.go#L119-L124

i'm not sure if go-tpm is doing it right or not but i think a tpm is always supposed to return that value unilaterally...

---

Anyway, here are the request and response values for

note that the requests don't include the continuesession attribute but for the swtpm, it return 1 but fwtpm returns 0

fwtpm_server

request

response

swtpm

request

response

---

to repro, either run the swtpm or fwtpm_server

fwtpm_server --clear

## or

m -rf /tmp/myvtpm && mkdir /tmp/myvtpm && swtpm_setup --tpmstate /tmp/myvtpm --tpm2 --create-ek-cert && swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --server type=tcp,port=2321 --ctrl type=tcp,port=2322 --flags not-need-init,startup-clear --log level=5

package main

import (
	"flag"
	"io"
	"log"
	"net"
	"slices"

	"github.com/google/go-tpm/tpm2"
	"github.com/google/go-tpm/tpm2/transport"
	"github.com/google/go-tpm/tpmutil"
)

var (
	tpmPath = flag.String("tpm-path", "127.0.0.1:2321", "Path to the TPM device (character device or a Unix socket).")
)

var TPMDEVICES = []string{"/dev/tpm0", "/dev/tpmrm0"}

func OpenTPM(path string) (io.ReadWriteCloser, error) {
	if slices.Contains(TPMDEVICES, path) {
		return tpmutil.OpenTPM(path)
	} else {
		return net.Dial("tcp", path)
	}
}

func main() {
	flag.Parse()

	log.Println("======= Init  ========")

	rwc, err := OpenTPM(*tpmPath)
	if err != nil {
		log.Fatalf("can't open TPM %q: %v", *tpmPath, err)
	}
	defer func() {
		rwc.Close()
	}()

	rwr := transport.FromReadWriter(rwc)

	// first create a primary
	log.Printf("======= createPrimary ========")

	cmdPrimary := tpm2.CreatePrimary{
		PrimaryHandle: tpm2.TPMRHOwner,
		InPublic:      tpm2.New2B(tpm2.RSASRKTemplate),
	}
	primaryKey, err := cmdPrimary.Execute(rwr)
	if err != nil {
		log.Fatalf("can't create primary %v", err)
	}

	defer func() {
		flushContextCmd := tpm2.FlushContext{
			FlushHandle: primaryKey.ObjectHandle,
		}
		_, _ = flushContextCmd.Execute(rwr)
	}()

}

[aidangarske]

Hi @salrashid123,

Thank you for reporting this. I will try to take a look at this when I get the chance.

Thanks,
Aidan - wolfSSL

[aidangarske]

Hi @salrashid123,

You are right thanks for the catch. This is fixed in upstream now here:

#530

You can try it out if you want again and let me know if that works.

Thanks,
Aidan – wolfSSL

[salrashid123]

thanks for the quick turnaround @aidangarske !

the fix worked great.

fwiw, i used worlftpm and the go-tpm client to test out the pqc algorithms.

https://github.com/salrashid123/pqc_scratchpad/tree/main/tpm

[aidangarske]

Oh wow awesome. Glad everything worked out!