Fix test_pkey_dh.rb in FIPS.

Add dh2048_fips.pem file (DH 2048 bits) in FIPS case, because a logic to
generate the pem file in FIPS module is different from the logic in non-FIPS
default behavior.

Created the DH file with 2048 bits, because the following command failed to generate
the DH 1024 bits pem file in FIPS.

```
$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \
  /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl dhparam -out dh1024_fips.pem 1024
Generating DH parameters, 1024 bit long safe prime
dhparam: Generating DH key parameters failed
```

The dh2048_fips.pem file was created by the following command.

```
$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \
  /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl dhparam -out dh2048_fips.pem 2048
```

Rakefile

@@ -29,6 +29,7 @@ Rake::TestTask.new(:test_fips_internal) do |t|
  t.test_files = FileList[
  'test/openssl/test_fips.rb',
  'test/openssl/test_pkey.rb',
+ 'test/openssl/test_pkey_dh.rb',
  'test/openssl/test_pkey_ec.rb',
  ]
  t.warning = true

test/openssl/fixtures/pkey/dh2048_fips.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----

test/openssl/test_pkey_dh.rb

@@ -5,6 +5,7 @@
 
 class OpenSSL::TestPKeyDH < OpenSSL::PKeyTestCase
  NEW_KEYLEN = 2048
+ KEY_NAME = (OpenSSL.fips_mode) ? "dh2048_fips" : "dh1024"
 
  def test_new_empty
  dh = OpenSSL::PKey::DH.new
@@ -18,15 +19,25 @@ def test_new_generate
  assert_key(dh)
  end if ENV["OSSL_TEST_ALL"]
 
- def test_new_break
+ def test_new_break_on_non_fips
+ omit_on_fips
+
  assert_nil(OpenSSL::PKey::DH.new(NEW_KEYLEN) { break })
  assert_raise(RuntimeError) do
  OpenSSL::PKey::DH.new(NEW_KEYLEN) { raise }
  end
  end
 
+ def test_new_break_on_fips
+ omit_on_non_fips
+
+ # The block argument is not executed in FIPS case.
+ assert(OpenSSL::PKey::DH.new(NEW_KEYLEN) { break })
+ assert(OpenSSL::PKey::DH.new(NEW_KEYLEN) { raise })
+ end
+
  def test_derive_key
- params = Fixtures.pkey("dh1024")
+ params = Fixtures.pkey(KEY_NAME)
  dh1 = OpenSSL::PKey.generate_key(params)
  dh2 = OpenSSL::PKey.generate_key(params)
  dh1_pub = OpenSSL::PKey.read(dh1.public_to_der)
@@ -44,34 +55,28 @@ def test_derive_key
  end
 
  def test_DHparams
- dh1024 = Fixtures.pkey("dh1024")
- dh1024params = dh1024.public_key
+ dh = Fixtures.pkey(KEY_NAME)
+ dh_params = dh.public_key
 
  asn1 = OpenSSL::ASN1::Sequence([
- OpenSSL::ASN1::Integer(dh1024.p),
- OpenSSL::ASN1::Integer(dh1024.g)
+ OpenSSL::ASN1::Integer(dh.p),
+ OpenSSL::ASN1::Integer(dh.g)
  ])
  key = OpenSSL::PKey::DH.new(asn1.to_der)
- assert_same_dh dh1024params, key
-
- pem = <<~EOF
- -----BEGIN DH PARAMETERS-----
- MIGHAoGBAKnKQ8MNK6nYZzLrrcuTsLxuiJGXoOO5gT+tljOTbHBuiktdMTITzIY0
- pFxIvjG05D7HoBZQfrR0c92NGWPkAiCkhQKB8JCbPVzwNLDy6DZ0pmofDKrEsYHG
- AQjjxMXhwULlmuR/K+WwlaZPiLIBYalLAZQ7ZbOPeVkJ8ePao0eLAgEC
- -----END DH PARAMETERS-----
- EOF
+ assert_same_dh dh_params, key
+
+ pem = Fixtures.pkey_str(KEY_NAME)
  key = OpenSSL::PKey::DH.new(pem)
- assert_same_dh dh1024params, key
+ assert_same_dh dh_params, key
  key = OpenSSL::PKey.read(pem)
- assert_same_dh dh1024params, key
+ assert_same_dh dh_params, key
 
- assert_equal asn1.to_der, dh1024.to_der
- assert_equal pem, dh1024.export
+ assert_equal asn1.to_der, dh.to_der
+ assert_equal pem, dh.export
  end
 
  def test_public_key
- dh = Fixtures.pkey("dh1024")
+ dh = Fixtures.pkey(KEY_NAME)
  public_key = dh.public_key
  assert_no_key(public_key) #implies public_key.public? is false!
  assert_equal(dh.to_der, public_key.to_der)
@@ -80,7 +85,7 @@ def test_public_key
 
  def test_generate_key
  # Deprecated in v3.0.0; incompatible with OpenSSL 3.0
- dh = Fixtures.pkey("dh1024").public_key # creates a copy with params only
+ dh = Fixtures.pkey(KEY_NAME).public_key # creates a copy with params only
  assert_no_key(dh)
  dh.generate_key!
  assert_key(dh)
@@ -91,7 +96,7 @@ def test_generate_key
  end if !openssl?(3, 0, 0)
 
  def test_params_ok?
- dh0 = Fixtures.pkey("dh1024")
+ dh0 = Fixtures.pkey(KEY_NAME)
 
  dh1 = OpenSSL::PKey::DH.new(OpenSSL::ASN1::Sequence([
  OpenSSL::ASN1::Integer(dh0.p),
@@ -108,7 +113,7 @@ def test_params_ok?
 
  def test_dup
  # Parameters only
- dh1 = Fixtures.pkey("dh1024")
+ dh1 = Fixtures.pkey(KEY_NAME)
  dh2 = dh1.dup
  assert_equal dh1.to_der, dh2.to_der
  assert_not_equal nil, dh1.p
@@ -125,7 +130,7 @@ def test_dup
  end
 
  # With a key pair
- dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey("dh1024"))
+ dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey(KEY_NAME))
  dh4 = dh3.dup
  assert_equal dh3.to_der, dh4.to_der
  assert_equal dh1.to_der, dh4.to_der # encodes parameters only
@@ -136,7 +141,7 @@ def test_dup
  end
 
  def test_marshal
- dh = Fixtures.pkey("dh1024")
+ dh = Fixtures.pkey(KEY_NAME)
  deserialized = Marshal.load(Marshal.dump(dh))
 
  assert_equal dh.to_der, deserialized.to_der

test/openssl/utils.rb

@@ -16,7 +16,11 @@ module Fixtures
  module_function
 
  def pkey(name)
- OpenSSL::PKey.read(read_file("pkey", name))
+ OpenSSL::PKey.read(pkey_str(name))
+ end
+
+ def pkey_str(name)
+ read_file("pkey", name)
  end
 
  def read_file(category, name)
@@ -151,7 +155,11 @@ def teardown
  def omit_on_fips
  return unless OpenSSL.fips_mode
 
- omit 'An encryption used in the test is not FIPS-approved'
+ omit <<~MESSAGE
+ Only for OpenSSL non-FIPS with the following possible reasons:
+ * A testing logic is non-FIPS specific.
+ * An encryption used in the test is not FIPS-approved.
+ MESSAGE
  end
 
  def omit_on_non_fips