From 557875b2573de3cea36539f23a20fedb58605fc0 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Wed, 26 Aug 2026 12:32:07 +0200 Subject: [PATCH] test: account for varied OpenSSL CCM final behaviours MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of the test-only commit from #65542. Distributions that build Node against their own newer OpenSSL and run the upstream test suite already see this test fail on v22.x and v24.x. The same backport is needed if and when these lines update the bundled OpenSSL. Signed-off-by: Filip Skokan Signed-off-by: Caleb ツ Everett PR-URL: https://github.com/nodejs/node/pull/65542 Reviewed-By: Colin Ihrig Reviewed-By: Filip Skokan Reviewed-By: Marco Ippolito (cherry picked from commit 28b571c38af5631b95e993258764caa3604c3fca) Refs: https://github.com/openssl/openssl/pull/32427 Refs: https://github.com/nodejs/node/pull/65710 Refs: https://github.com/nodejs/node/pull/65711 Assisted-by: a closed-source coding agent --- test/parallel/test-crypto-authenticated.js | 29 ++++++++++++++++------ 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js index e8fedf2d5d50..40f9d64ee245 100644 --- a/test/parallel/test-crypto-authenticated.js +++ b/test/parallel/test-crypto-authenticated.js @@ -631,14 +631,29 @@ for (const test of TEST_CASES) { const iv = Buffer.alloc(12); const opts = { authTagLength: 10 }; + const control = crypto.createCipheriv(algo, key, iv, opts); + control.update(Buffer.alloc(0)); + control.final(); + const expectedTag = control.getAuthTag(); + const cipher = crypto.createCipheriv(algo, key, iv, opts); - assert.throws(() => { - cipher.final(); - }, hasOpenSSL3 ? { - code: 'ERR_OSSL_TAG_NOT_SET' - } : { - message: /Unsupported state/ - }); + let output; + try { + output = cipher.final(); + } catch (err) { + // OpenSSL without https://github.com/openssl/openssl/pull/32427 + // cannot finalize an empty CCM message unless update() was called. + if (hasOpenSSL3) { + assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET'); + } else { + assert.match(err.message, /Unsupported state/); + } + } + + if (output !== undefined) { + assert.deepStrictEqual(output, Buffer.alloc(0)); + assert.deepStrictEqual(cipher.getAuthTag(), expectedTag); + } } {