diff options
author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-03-01 14:31:30 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-03-01 14:35:01 +0100 |
commit | b101eeec06a3e954486e607d8522e1df25eb5f5b (patch) | |
tree | 94fa64be982de218958e9b76baf1939f1ec3e5d4 /lib/ext/session_ticket.c | |
parent | c3ec3cbf313580a7c7c0fce5c8c5618979a5e957 (diff) | |
download | gnutls-b101eeec06a3e954486e607d8522e1df25eb5f5b.tar.gz |
gnutls_session_ticket_key_generate: fixed operation under FIPS140-2 mode
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
Diffstat (limited to 'lib/ext/session_ticket.c')
-rw-r--r-- | lib/ext/session_ticket.c | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c index feb650706f..9747177b54 100644 --- a/lib/ext/session_ticket.c +++ b/lib/ext/session_ticket.c @@ -506,7 +506,27 @@ session_ticket_unpack(gnutls_buffer_st * ps, extension_priv_data_t * _priv) **/ int gnutls_session_ticket_key_generate(gnutls_datum_t * key) { - return gnutls_key_generate(key, SESSION_KEY_SIZE); + if (_gnutls_fips_mode_enabled()) { + int ret; + /* in FIPS140-2 mode gnutls_key_generate imposes + * some limits on allowed key size, thus it is not + * used. These limits do not affect this function as + * it does not generate a "key" but rather key material + * that includes nonces and other stuff. */ + key->data = gnutls_malloc(SESSION_KEY_SIZE); + if (key->data == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + key->size = SESSION_KEY_SIZE; + ret = gnutls_rnd(GNUTLS_RND_RANDOM, key->data, key->size); + if (ret < 0) { + gnutls_free(key->data); + return ret; + } + return 0; + } else { + return gnutls_key_generate(key, SESSION_KEY_SIZE); + } } /** |