From da1893b320c68b9d81025115ed27f4a60a9fc2d1 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Wed, 26 Aug 2026 12:32:07 +0200 Subject: [PATCH] test: account for varied OpenSSL CCM final behaviours MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport of the test-only commit from #65542. Distributions that build Node against their own newer OpenSSL and run the upstream test suite already see this test fail on v22.x and v24.x. The same backport is needed if and when these lines update the bundled OpenSSL. Signed-off-by: Filip Skokan Signed-off-by: Caleb ツ Everett PR-URL: https://github.com/nodejs/node/pull/65542 Reviewed-By: Colin Ihrig Reviewed-By: Filip Skokan Reviewed-By: Marco Ippolito (cherry picked from commit 28b571c38af5631b95e993258764caa3604c3fca) Refs: https://github.com/openssl/openssl/pull/32427 Refs: https://github.com/nodejs/node/pull/65710 Refs: https://github.com/nodejs/node/pull/65711 Assisted-by: a closed-source coding agent --- test/parallel/test-crypto-authenticated.js | 29 ++++++++++++++++------ 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js index 2a4e2a1520a3..082e86a669b0 100644 --- a/test/parallel/test-crypto-authenticated.js +++ b/test/parallel/test-crypto-authenticated.js @@ -633,14 +633,29 @@ for (const test of TEST_CASES) { const iv = Buffer.alloc(12); const opts = { authTagLength: 10 }; + const control = crypto.createCipheriv('aes-128-ccm', key, iv, opts); + control.update(Buffer.alloc(0)); + control.final(); + const expectedTag = control.getAuthTag(); + const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts); - assert.throws(() => { - cipher.final(); - }, hasOpenSSL3 ? { - code: 'ERR_OSSL_TAG_NOT_SET' - } : { - message: /Unsupported state/ - }); + let output; + try { + output = cipher.final(); + } catch (err) { + // OpenSSL without https://github.com/openssl/openssl/pull/32427 + // cannot finalize an empty CCM message unless update() was called. + if (hasOpenSSL3) { + assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET'); + } else { + assert.match(err.message, /Unsupported state/); + } + } + + if (output !== undefined) { + assert.deepStrictEqual(output, Buffer.alloc(0)); + assert.deepStrictEqual(cipher.getAuthTag(), expectedTag); + } } }