doc,test: account for OpenSSL 4.1 behaviours · nodejs/node@e7ed436 · GitHub
Skip to content

Commit e7ed436

Browse files
panvaaduh95
panva
authored and
aduh95
committed
doc,test: account for OpenSSL 4.1 behaviours
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65956 Backport-PR-URL: #66233 Refs: https://openssl-library.org/post/2026-09-09-openssl-4.1-alpha/ Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent cb93d40 commit e7ed436

4 files changed

Lines changed: 31 additions & 14 deletions

File tree

‎doc/api/crypto.md‎

Lines changed: 2 additions & 6 deletions

‎test/parallel/test-crypto-authenticated.js‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@ const TEST_CASES = require(fixtures.path('aead-vectors.js'));
4444

4545
const errMessages = {
4646
auth: / auth/,
47+
// OpenSSL 4.1 adds a provider error for AEAD tag mismatches.
48+
// https://github.com/openssl/openssl/pull/32587
49+
badDecrypt: hasOpenSSL(4, 1) ?
50+
{ code: 'ERR_OSSL_BAD_DECRYPT' } : /Unsupported state or unable to authenticate data/,
4751
state: / state/,
4852
FIPS: /not supported in FIPS mode/,
4953
length: /Invalid initialization vector/,
@@ -128,7 +132,8 @@ for (const test of TEST_CASES) {
128132
assert.strictEqual(msg, test.plain);
129133
} else {
130134
// Assert that final throws if input data could not be verified!
131-
assert.throws(function() { decrypt.final('hex'); }, errMessages.auth);
135+
assert.throws(function() { decrypt.final('hex'); },
136+
isCCM || isSIV ? errMessages.auth : errMessages.badDecrypt);
132137
}
133138
}
134139
}
@@ -358,7 +363,8 @@ for (const test of TEST_CASES) {
358363
decipher.update(ciphertext);
359364
assert.throws(() => {
360365
decipher.final();
361-
}, /Unsupported state or unable to authenticate data/);
366+
}, algo === 'aes-128-siv' ?
367+
/Unsupported state or unable to authenticate data/ : errMessages.badDecrypt);
362368
}
363369
}
364370
}
@@ -969,7 +975,7 @@ if (!fips3 && !isBoringSSL) {
969975

970976
assert.throws(() => {
971977
decipher.final();
972-
}, /Unsupported state or unable to authenticate data/);
978+
}, errMessages.badDecrypt);
973979
} else {
974980
common.printSkipMessage('Skipping unsupported chacha20-poly1305 test');
975981
}

‎test/parallel/test-crypto-x509.js‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,9 +175,21 @@ const der = Buffer.from(
175175

176176
assert.strictEqual(x509.checkIP('127.0.0.1'), undefined);
177177
assert.strictEqual(x509.checkIP('::'), undefined);
178-
assert.strictEqual(x509.checkHost('agent1'), 'agent1');
178+
// OpenSSL 4.1 no longer checks the subject DN by default.
179+
// https://github.com/openssl/openssl/pull/31982
180+
for (const options of [undefined, { subject: 'default' }]) {
181+
assert.strictEqual(x509.checkHost('agent1', options),
182+
hasOpenSSL(4, 1) ? undefined : 'agent1');
183+
assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', options),
184+
hasOpenSSL(4, 1) ? undefined : 'ry@tinyclouds.org');
185+
}
186+
assert.strictEqual(x509.checkHost('agent1', { subject: 'always' }), 'agent1');
187+
assert.strictEqual(x509.checkHost('agent1', { subject: 'never' }), undefined);
179188
assert.strictEqual(x509.checkHost('agent2'), undefined);
180-
assert.strictEqual(x509.checkEmail('ry@tinyclouds.org'), 'ry@tinyclouds.org');
189+
assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', { subject: 'always' }),
190+
'ry@tinyclouds.org');
191+
assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', { subject: 'never' }),
192+
undefined);
181193
assert.strictEqual(x509.checkEmail('sally@example.com'), undefined);
182194
assert.throws(() => x509.checkHost('agent\x001'), {
183195
code: 'ERR_INVALID_ARG_VALUE'

‎test/parallel/test-tls-psk-circuit.js‎

Lines changed: 6 additions & 3 deletions

0 commit comments

Comments
 (0)