Add UNIX socket TPM connection support #273
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maraino
previously approved these changes
Jun 26, 2023
|
|
||
| var ( | ||
| ErrNotAvailable = errors.New("socket not available") | ||
| ErrNotSupported = errors.New("connecting to a TPM using a UNIX socket is not supported on Windows") |
There was a problem hiding this comment.
Sounds good.
There is limited support for UNIX sockets on Windows, but the proper solution are named pipes using https://github.com/microsoft/go-winio, for example, step connects to the agent using:
conn, err := winio.DialPipeContext(context.Background(), `\\.\\pipe\\openssh-ssh-agent`)The same library can create a listener on a pipe using:
lis, err := winio.ListenPipe(`\\.\\pipe\\step-agent`, nil) If the simulator in windows can use those, they will not be difficult to implement in a future PR.
Comment on lines
+276
to
+285
| defer func() { t.attestTPM = nil }() | ||
| if err := closer.AttestTPM(t.attestTPM, t.attestConfig); err != nil { | ||
| return fmt.Errorf("failed closing attest.TPM: %w", err) | ||
| } | ||
| } | ||
|
|
||
| // clean up the go-tpm rwc | ||
| if t.rwc != nil { | ||
| err := t.rwc.Close() | ||
| t.rwc = nil | ||
| if err != nil { | ||
| defer func() { t.rwc = nil }() | ||
| if err := closer.RWC(t.rwc); err != nil { |
There was a problem hiding this comment.
It might be ok, but it might be weird to set those to nil even if the close fails.
There was a problem hiding this comment.
Yea, I kind of agree. But I think it's OK in this case, because no matter what happens, I want to have a new, clean io.RWC on the next open, and never start with an old one in a weird state.
Co-authored-by: Mariano Cano <mariano.cano@gmail.com>
maraino
approved these changes
Jun 26, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On Linux and macOS a connection can now be made to a TPM that's exposed on a UNIX socket. This shouldn't be used for production purposes, but can be useful for development and testing with a TPM simulator. The tpmutil.EmulatorReadWriteCloser is used to create the connection with the simulated TPM.
A UNIX socket TPM will only be used when the TPM is initialized with a device name that contains the path to a UNIX socket. If the TPM instance is initialized with a
tpm.CommandChannelorsimulator.Simulatordirectly, these will take precedence over the UNIX socket path.Connecting to a TPM using a UNIX socket is not supported on Windows.