From b5495bfce63158cceba69727eb6b4d8e5ea643fe Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Wed, 26 Aug 2026 12:32:07 +0200 Subject: [PATCH] test: account for varied OpenSSL CCM final behaviours Signed-off-by: Filip Skokan PR-URL: https://github.com/nodejs/node/pull/65542 Reviewed-By: Colin Ihrig Reviewed-By: Filip Skokan Reviewed-By: Marco Ippolito Origin: backport, 28b571c38af5631b95e993258764caa3604c3fca Gbp-Pq: Topic build Gbp-Pq: Name openssl-fix-ccm.patch --- test/parallel/test-crypto-authenticated.js | 31 +++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js index d358f6b63..4c9b6593b 100644 --- a/test/parallel/test-crypto-authenticated.js +++ b/test/parallel/test-crypto-authenticated.js @@ -70,7 +70,6 @@ const expectedWarnings = common.hasFipsCrypto ? ['Use Cipheriv for counter mode of aes-256-ccm'], ['Use Cipheriv for counter mode of aes-256-ccm'], ['Use Cipheriv for counter mode of aes-256-ccm'], - ['Use Cipheriv for counter mode of aes-128-ccm'], ]; const expectedDeprecationWarnings = [ @@ -672,17 +671,31 @@ for (const test of TEST_CASES) { const iv = Buffer.alloc(12); const opts = { authTagLength: 10 }; + const control = crypto.createCipheriv(algo, key, iv, opts); + control.update(Buffer.alloc(0)); + control.final(); + const expectedTag = control.getAuthTag(); + for (const cipher of [ - crypto.createCipher(algo, 'foo', opts), crypto.createCipheriv(algo, key, iv, opts), ]) { - assert.throws(() => { - cipher.final(); - }, common.hasOpenSSL3 ? { - code: 'ERR_OSSL_TAG_NOT_SET' - } : { - message: /Unsupported state/ - }); + let output; + try { + output = cipher.final(); + } catch (err) { + // OpenSSL without https://github.com/openssl/openssl/pull/32427 + // cannot finalize an empty CCM message unless update() was called. + if (common.hasOpenSSL3) { + assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET'); + } else { + assert.match(err.message, /Unsupported state/); + } + } + + if (output !== undefined) { + assert.deepStrictEqual(output, Buffer.alloc(0)); + assert.deepStrictEqual(cipher.getAuthTag(), expectedTag); + } } } -- 2.39.5