From: Pauli <ppzgs1@gmail.com>
Date: Fri, 29 Aug 2025 02:42:17 +0000 (+1000)
Subject: dh: convert to transient error state on import failure in FIPS provider
X-Git-Tag: openssl-3.5.3~39
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d923468e4757118147d1af37d67934de9b27ab5e;p=thirdparty%2Fopenssl.git

dh: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)

(cherry picked from commit c2ebeeeff67948cd4f44fc5e4a777cf9ea293f17)
---

diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c
index 3c2043eb6ee..66cbd817b48 100644
--- a/providers/implementations/keymgmt/dh_kmgmt.c
+++ b/providers/implementations/keymgmt/dh_kmgmt.c
@@ -218,7 +218,7 @@ static int dh_import(void *keydata, int selection, const OSSL_PARAM params[])
         if (ok > 0 && !ossl_fips_self_testing()) {
             ok = ossl_dh_check_pairwise(dh, 1);
             if (ok <= 0)
-                ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
+                ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT_IMPORT);
         }
 #endif  /* FIPS_MODULE */
     }