From 1ec73cff69bb80be23c388a01cb92da22720502c Mon Sep 17 00:00:00 2001
Message-Id: <1ec73cff69bb80be23c388a01cb92da22720502c@dist-git>
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Thu, 4 Sep 2014 12:43:58 +0200
Subject: [PATCH] security: fix DH key generation when FIPS mode is on

When FIPS mode is on, gnutls_dh_params_generate2 will fail if 1024 is
specified as the prime's number of bits, a bigger value works in both
cases.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1128497

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit ab22096710edb505d38d34fb3575427b0ea3b151)
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
---
 src/rpc/virnettlscontext.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c
index 31aac9d..947038d 100644
--- a/src/rpc/virnettlscontext.c
+++ b/src/rpc/virnettlscontext.c
@@ -43,7 +43,7 @@
 #include "virthread.h"
 #include "configmake.h"
 
-#define DH_BITS 1024
+#define DH_BITS 2048
 
 #define LIBVIRT_PKI_DIR SYSCONFDIR "/pki"
 #define LIBVIRT_CACERT LIBVIRT_PKI_DIR "/CA/cacert.pem"
-- 
2.1.0