[libvirt] [PATCH] security: fix DH key generation when FIPS mode is on
When FIPS mode is on, gnutls_dh_params_generate2 will fail if 1024 is
specified as the prime's number of bits, a bigger value works in both
cases.
Signed-off-by: Giuseppe Scrivano <gscrivan(a)redhat.com>
---
with the development version of GNU TLS is possible to test FIPS mode
setting the env variable GNUTLS_FORCE_FIPS_MODE=2
src/rpc/virnettlscontext.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c
index 31aac9d..947038d 100644
--- a/src/rpc/virnettlscontext.c
+++ b/src/rpc/virnettlscontext.c
@@ -43,7 +43,7 @@
#include "virthread.h"
#include "configmake.h"
-#define DH_BITS 1024
+#define DH_BITS 2048
#define LIBVIRT_PKI_DIR SYSCONFDIR "/pki"
#define LIBVIRT_CACERT LIBVIRT_PKI_DIR "/CA/cacert.pem"
--
1.9.3