test: account for varied OpenSSL CCM final behaviours

Backport of the test-only commit from #65542. Distributions that build
Node against their own newer OpenSSL and run the upstream test suite
already see this test fail on v22.x and v24.x. The same backport is
needed if and when these lines update the bundled OpenSSL.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Caleb ツ Everett <calebev@amazon.com>
PR-URL: #65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
(cherry picked from commit 28b571c)
Refs: openssl/openssl#32427
Refs: #65710
Refs: #65711
Assisted-by: a closed-source coding agent

Author: panva

test/parallel/test-crypto-authenticated.js

@@ -631,14 +631,29 @@ for (const test of TEST_CASES) {
   const iv = Buffer.alloc(12);
   const opts = { authTagLength: 10 };
 
+  const control = crypto.createCipheriv(algo, key, iv, opts);
+  control.update(Buffer.alloc(0));
+  control.final();
+  const expectedTag = control.getAuthTag();
+
   const cipher = crypto.createCipheriv(algo, key, iv, opts);
-  assert.throws(() => {
-    cipher.final();
-  }, hasOpenSSL3 ? {
-    code: 'ERR_OSSL_TAG_NOT_SET'
-  } : {
-    message: /Unsupported state/
-  });
+  let output;
+  try {
+    output = cipher.final();
+  } catch (err) {
+    // OpenSSL without https://github.com/openssl/openssl/pull/32427
+    // cannot finalize an empty CCM message unless update() was called.
+    if (hasOpenSSL3) {
+      assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
+    } else {
+      assert.match(err.message, /Unsupported state/);
+    }
+  }
+
+  if (output !== undefined) {
+    assert.deepStrictEqual(output, Buffer.alloc(0));
+    assert.deepStrictEqual(cipher.getAuthTag(), expectedTag);
+  }
 }
 
 {