diff options
author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-03-01 14:31:30 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-03-01 14:40:56 +0100 |
commit | 88aea98f451bd5a6e1090b696c948674a79d2045 (patch) | |
tree | b6a1682a1ba5d9d9babdc30d39f45b47b8c57587 | |
parent | fa08b3e38fb2ae4f745d8e518b1d4df7892b2022 (diff) | |
download | gnutls-88aea98f451bd5a6e1090b696c948674a79d2045.tar.gz |
gnutls_session_ticket_key_generate: fixed operation under FIPS140-2 mode
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
-rw-r--r-- | lib/ext/session_ticket.c | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c index feb650706f..9747177b54 100644 --- a/lib/ext/session_ticket.c +++ b/lib/ext/session_ticket.c @@ -506,7 +506,27 @@ session_ticket_unpack(gnutls_buffer_st * ps, extension_priv_data_t * _priv) **/ int gnutls_session_ticket_key_generate(gnutls_datum_t * key) { - return gnutls_key_generate(key, SESSION_KEY_SIZE); + if (_gnutls_fips_mode_enabled()) { + int ret; + /* in FIPS140-2 mode gnutls_key_generate imposes + * some limits on allowed key size, thus it is not + * used. These limits do not affect this function as + * it does not generate a "key" but rather key material + * that includes nonces and other stuff. */ + key->data = gnutls_malloc(SESSION_KEY_SIZE); + if (key->data == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + key->size = SESSION_KEY_SIZE; + ret = gnutls_rnd(GNUTLS_RND_RANDOM, key->data, key->size); + if (ret < 0) { + gnutls_free(key->data); + return ret; + } + return 0; + } else { + return gnutls_key_generate(key, SESSION_KEY_SIZE); + } } /** |