On Mon, Nov 29, 2021 at 07:26:12PM -0500, Stefan Berger wrote:
On 11/29/21 18:43, Jarkko Sakkinen wrote:
On Sat, Nov 27, 2021 at 11:10:52PM -0500, Stefan Berger wrote:The problem is this particular test case I am patching here causes the above
From: Stefan Berger <stefanb@xxxxxxxxxxxxx>I don't agree with this as a DA lock has legit use. This would be adequate
Reset the dictionary attack lock to avoid the following types of test
failures after running the test 2 times:
======================================================================
ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2_tests.py", line 105, in test_unseal_with_wrong_policy
blob = self.client.seal(self.root_key, data, auth, policy_dig)
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 620, in seal
rsp = self.send_cmd(cmd)
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 397, in send_cmd
raise ProtocolError(cc, rc)
tpm2.ProtocolError: TPM_RC_LOCKOUT: cc=0x00000153, rc=0x00000921
Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
---
tools/testing/selftests/tpm2/tpm2_tests.py | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index e63a37819978..ad6f54c01adf 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -139,6 +139,8 @@ class SmokeTest(unittest.TestCase):
except:
self.client.flush_context(handle)
raise
+ finally:
+ self.client.reset_da_lock()
self.assertEqual(rc, tpm2.TPM2_RC_POLICY_FAIL)
--
2.31.1
for systems dedicated for kernel testing only.
test failures upon rerun. We are testing the driver here presumably and not
the TPM2, so I think we should leave the TPM2 as cleaned up as possible,
thus my suggestion is to reset the DA lock and we won't hear any complaints
after that.
The tss packages also have command line tools to reset the DA lock, but itIf you speak about TSS, please alway say which one :-)
shouldn't be necessary to use them after running a **driver** test case.
Adding non-volatile state changes explicitly is to a test case is both
intrusive and wrong. These type of choices are not to be done in the
test case implementation for sure.
An improvement that does not add extra side-effect, would be to read the
TPM_PT_LOCKOUT_COUNTER and roll back with a proper error message for the
lockout condition.
You can also configure the maximum number of tries up to (2 << 31) - 1
= 4294967295 with TPM2_DictionaryAttackParameters...
/Jarkko