test: account for varied OpenSSL CCM final behaviours

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Origin: backport, 28b571c38af5631b95e993258764caa3604c3fca

Gbp-Pq: Topic build
Gbp-Pq: Name openssl-fix-ccm.patch

diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index d358f6b63c0e9f5761157dc200daa484d9c5ead6..4c9b6593b34e3566b2c4179bb8a5a13b4dd69ada 100644 (file)
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -70,7 +70,6 @@ const expectedWarnings = common.hasFipsCrypto ?
     ['Use Cipheriv for counter mode of aes-256-ccm'],
     ['Use Cipheriv for counter mode of aes-256-ccm'],
     ['Use Cipheriv for counter mode of aes-256-ccm'],
-    ['Use Cipheriv for counter mode of aes-128-ccm'],
   ];
 
 const expectedDeprecationWarnings = [
@@ -672,17 +671,31 @@ for (const test of TEST_CASES) {
   const iv = Buffer.alloc(12);
   const opts = { authTagLength: 10 };
 
+  const control = crypto.createCipheriv(algo, key, iv, opts);
+  control.update(Buffer.alloc(0));
+  control.final();
+  const expectedTag = control.getAuthTag();
+
   for (const cipher of [
-    crypto.createCipher(algo, 'foo', opts),
     crypto.createCipheriv(algo, key, iv, opts),
   ]) {
-    assert.throws(() => {
-      cipher.final();
-    }, common.hasOpenSSL3 ? {
-      code: 'ERR_OSSL_TAG_NOT_SET'
-    } : {
-      message: /Unsupported state/
-    });
+    let output;
+    try {
+      output = cipher.final();
+    } catch (err) {
+      // OpenSSL without https://github.com/openssl/openssl/pull/32427
+      // cannot finalize an empty CCM message unless update() was called.
+      if (common.hasOpenSSL3) {
+        assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
+      } else {
+        assert.match(err.message, /Unsupported state/);
+      }
+    }
+
+    if (output !== undefined) {
+      assert.deepStrictEqual(output, Buffer.alloc(0));
+      assert.deepStrictEqual(cipher.getAuthTag(), expectedTag);
+    }
   }
 }