From: Pauli <ppzgs1@gmail.com>
Date: Fri, 29 Aug 2025 02:42:17 +0000 (+1000)
Subject: dh: convert to transient error state on import failure in FIPS provider
X-Git-Tag: openssl-3.6.0-alpha1~19
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c2ebeeeff67948cd4f44fc5e4a777cf9ea293f17;p=thirdparty%2Fopenssl.git

dh: convert to transient error state on import failure in FIPS provider

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)
---

diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c
index 09d089c24de..aa123f37d9f 100644
--- a/providers/implementations/keymgmt/dh_kmgmt.c
+++ b/providers/implementations/keymgmt/dh_kmgmt.c
@@ -218,7 +218,7 @@ static int dh_import(void *keydata, int selection, const OSSL_PARAM params[])
         if (ok > 0 && !ossl_fips_self_testing()) {
             ok = ossl_dh_check_pairwise(dh, 1);
             if (ok <= 0)
-                ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
+                ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT_IMPORT);
         }
 #endif  /* FIPS_MODULE */
     }