Fix test_pkey_dh.rb in FIPS.

Add dh2048_fips.pem file (DH 2048 bits) in FIPS case, because a logic to
generate the pem file in FIPS module is different from the logic in non-FIPS
default behavior.

Created the DH file with 2048 bits, because the following command failed to generate
the DH 1024 bits pem file in FIPS.

```
$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \
  /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl dhparam -out dh1024_fips.pem 1024
Generating DH parameters, 1024 bit long safe prime
dhparam: Generating DH key parameters failed
```

The dh2048_fips.pem file was created by the following command.

```
$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \
  /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl dhparam -out dh2048_fips.pem 2048
```

Rakefile

@@ -29,6 +29,7 @@ Rake::TestTask.new(:test_fips_internal) do |t|
   t.test_files = FileList[
     'test/openssl/test_fips.rb',
     'test/openssl/test_pkey.rb',
+    'test/openssl/test_pkey_dh.rb',
     'test/openssl/test_pkey_ec.rb',
   ]
   t.warning = true

test/openssl/fixtures/pkey/dh2048_fips.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----

test/openssl/test_pkey_dh.rb

@@ -5,6 +5,7 @@
 
 class OpenSSL::TestPKeyDH < OpenSSL::PKeyTestCase
   NEW_KEYLEN = 2048
+  KEY_NAME = (OpenSSL.fips_mode) ? "dh2048_fips" : "dh1024"
 
   def test_new_empty
     dh = OpenSSL::PKey::DH.new
@@ -18,15 +19,26 @@ def test_new_generate
     assert_key(dh)
   end if ENV["OSSL_TEST_ALL"]
 
-  def test_new_break
+  def test_new_break_on_non_fips
+    omit_on_fips
+
     assert_nil(OpenSSL::PKey::DH.new(NEW_KEYLEN) { break })
     assert_raise(RuntimeError) do
       OpenSSL::PKey::DH.new(NEW_KEYLEN) { raise }
     end
   end
 
+  def test_new_break_on_fips
+    omit_on_non_fips
+
+    # The block argument is not executed in FIPS case.
+    # See https://github.com/ruby/openssl/issues/692 for details.
+    assert(OpenSSL::PKey::DH.new(NEW_KEYLEN) { break })
+    assert(OpenSSL::PKey::DH.new(NEW_KEYLEN) { raise })
+  end
+
   def test_derive_key
-    params = Fixtures.pkey("dh1024")
+    params = Fixtures.pkey(KEY_NAME)
     dh1 = OpenSSL::PKey.generate_key(params)
     dh2 = OpenSSL::PKey.generate_key(params)
     dh1_pub = OpenSSL::PKey.read(dh1.public_to_der)
@@ -44,34 +56,28 @@ def test_derive_key
   end
 
   def test_DHparams
-    dh1024 = Fixtures.pkey("dh1024")
-    dh1024params = dh1024.public_key
+    dh = Fixtures.pkey(KEY_NAME)
+    dh_params = dh.public_key
 
     asn1 = OpenSSL::ASN1::Sequence([
-      OpenSSL::ASN1::Integer(dh1024.p),
-      OpenSSL::ASN1::Integer(dh1024.g)
+      OpenSSL::ASN1::Integer(dh.p),
+      OpenSSL::ASN1::Integer(dh.g)
     ])
     key = OpenSSL::PKey::DH.new(asn1.to_der)
-    assert_same_dh dh1024params, key
-
-    pem = <<~EOF
-    -----BEGIN DH PARAMETERS-----
-    MIGHAoGBAKnKQ8MNK6nYZzLrrcuTsLxuiJGXoOO5gT+tljOTbHBuiktdMTITzIY0
-    pFxIvjG05D7HoBZQfrR0c92NGWPkAiCkhQKB8JCbPVzwNLDy6DZ0pmofDKrEsYHG
-    AQjjxMXhwULlmuR/K+WwlaZPiLIBYalLAZQ7ZbOPeVkJ8ePao0eLAgEC
-    -----END DH PARAMETERS-----
-    EOF
+    assert_same_dh dh_params, key
+
+    pem = Fixtures.pkey_str(KEY_NAME)
     key = OpenSSL::PKey::DH.new(pem)
-    assert_same_dh dh1024params, key
+    assert_same_dh dh_params, key
     key = OpenSSL::PKey.read(pem)
-    assert_same_dh dh1024params, key
+    assert_same_dh dh_params, key
 
-    assert_equal asn1.to_der, dh1024.to_der
-    assert_equal pem, dh1024.export
+    assert_equal asn1.to_der, dh.to_der
+    assert_equal pem, dh.export
   end
 
   def test_public_key
-    dh = Fixtures.pkey("dh1024")
+    dh = Fixtures.pkey(KEY_NAME)
     public_key = dh.public_key
     assert_no_key(public_key) #implies public_key.public? is false!
     assert_equal(dh.to_der, public_key.to_der)
@@ -80,7 +86,7 @@ def test_public_key
 
   def test_generate_key
     # Deprecated in v3.0.0; incompatible with OpenSSL 3.0
-    dh = Fixtures.pkey("dh1024").public_key # creates a copy with params only
+    dh = Fixtures.pkey(KEY_NAME).public_key # creates a copy with params only
     assert_no_key(dh)
     dh.generate_key!
     assert_key(dh)
@@ -91,7 +97,7 @@ def test_generate_key
   end if !openssl?(3, 0, 0)
 
   def test_params_ok?
-    dh0 = Fixtures.pkey("dh1024")
+    dh0 = Fixtures.pkey(KEY_NAME)
 
     dh1 = OpenSSL::PKey::DH.new(OpenSSL::ASN1::Sequence([
       OpenSSL::ASN1::Integer(dh0.p),
@@ -108,7 +114,7 @@ def test_params_ok?
 
   def test_dup
     # Parameters only
-    dh1 = Fixtures.pkey("dh1024")
+    dh1 = Fixtures.pkey(KEY_NAME)
     dh2 = dh1.dup
     assert_equal dh1.to_der, dh2.to_der
     assert_not_equal nil, dh1.p
@@ -125,7 +131,7 @@ def test_dup
     end
 
     # With a key pair
-    dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey("dh1024"))
+    dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey(KEY_NAME))
     dh4 = dh3.dup
     assert_equal dh3.to_der, dh4.to_der
     assert_equal dh1.to_der, dh4.to_der # encodes parameters only
@@ -136,7 +142,7 @@ def test_dup
   end
 
   def test_marshal
-    dh = Fixtures.pkey("dh1024")
+    dh = Fixtures.pkey(KEY_NAME)
     deserialized = Marshal.load(Marshal.dump(dh))
 
     assert_equal dh.to_der, deserialized.to_der

test/openssl/utils.rb

@@ -16,7 +16,11 @@ module Fixtures
     module_function
 
     def pkey(name)
-      OpenSSL::PKey.read(read_file("pkey", name))
+      OpenSSL::PKey.read(pkey_str(name))
+    end
+
+    def pkey_str(name)
+      read_file("pkey", name)
     end
 
     def read_file(category, name)
@@ -151,7 +155,11 @@ def teardown
   def omit_on_fips
     return unless OpenSSL.fips_mode
 
-    omit 'An encryption used in the test is not FIPS-approved'
+    omit <<~MESSAGE
+      Only for OpenSSL non-FIPS with the following possible reasons:
+      * A testing logic is non-FIPS specific.
+      * An encryption used in the test is not FIPS-approved.
+    MESSAGE
   end
 
   def omit_on_non_fips