Consider an update to PolicyCommand or a new interface for working with policy sessions

[friedrichsenm]

The PolicyCommand interface is really useful for calculating the correct policy digest to attach to an object but it's a bit harder to use for creating actual policy sessions and writing generic code to work with policies.

Would it be possible to add a method like SetPolicySession(Session) so it would be easier to write more generic code for extending policy sessions?

[chrisfenner]

Thanks for the suggestion!

Could you write out some example code that you'd like to be able to write?

[friedrichsenm]

I was trying to write a generic policy extender since I'm try to demo different uses for TPM functionality. The extender I was imagining in my head looks something like:

func makeExtendedPolicy(tpm transport.TPM, hash tpm2.TPMIAlgHash, nonceSize int, policies []tpm2.PolicyCommand, options ... tpm2.AuthOptions) (tpm2.Session, func() error, error) {
    session, sessionCloser, err := tpm2.PolicySession(tpm, hash, nonceSize, options...)
    if err != nil {
        return nil, nil, err
    }

    for _, policy := range policies {
        policy.SetSession(session)
        // I know a few policy commands have responses that need handling,
        // but I'm not dealing with that for this example
        _, err = policy.Execute(tpm)
       if err != nil {
           return nil, nil, err
       }
    }

    return session, sessionCloser, nil
}

[chrisfenner]

Ahhh, got it. Let me replay my understanding to make sure I've got it.

Every implementation of PolicyCommand in go-tpm happens to also implement Command. So the obvious thing to try would be to embed Command into PolicyCommand:

// PolicyCommand is a TPM command that can be part of a TPM policy.
type PolicyCommand interface {
+       Command
	// Update updates the given policy hash according to the command
	// parameters.
	Update(policy *PolicyCalculator) error
}

Which (aside from the problem of the generics) doesn't solve your problem because you'd like to specifically invoke the command in some policy session (Execute passes extra sessions, not "use this session for the policy command")

Would something like this work for you?

// PolicyCommand is a TPM command that can be part of a TPM policy.
type PolicyCommand interface {
	// Update updates the given policy hash according to the command
	// parameters.
	Update(policy *PolicyCalculator) error
+       // ExecutePolicyInSession executes the given policy command, using the given session as PolicySession.
+       ExecutePolicyInSession(t transport.TPM, s Session) error

}

[friedrichsenm]

I think that would do it! That might be limited to only the policy commands that don't have any returns (like the ones that return a timeout). Given the way Go's generics work, I'm not sure how doable that is in an interface though the tpm2 package does quite a good job having usable generics.

FYI, thank you for all the work on this package! I just noticed the new functions for having a third-party perform the MakeCredential steps without a TPM and that is a huge time saver for looking at any attestation scenarios.

[chrisfenner]

In your particular case, would ignoring the return from the policy commands break you? It might just be an inherent limitation of the abstraction.

[friedrichsenm]

No. I'm using simple enough policy assertions at the moment that it wouldn't be a problem. Complicated policies probably couldn't easily be abstracted away anyways.

[chrisfenner]

Sounds good. Yeah, I agree that complex policies that need to do something with the output will likely need to do something different (e.g., write a regular Callback)

If you wanted to send a PR that suggests something similar to #401 (comment), I could review and approve it. I may have some time to make such a PR myself in the coming weeks, but it's a busy time so I can't commit to any particular timeline.

[friedrichsenm]

I'll see if I have the time to take a crack at it then.