test: account for varied OpenSSL CCM final behaviours

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
(cherry picked from commit 28b571c)

Refs: openssl/openssl#32427
Refs: #65711
Refs: #65710

Author: panva

test/parallel/test-crypto-authenticated.js

@@ -631,14 +631,29 @@ for (const test of TEST_CASES) {
   const iv = Buffer.alloc(12);
   const opts = { authTagLength: 10 };
 
+  const control = crypto.createCipheriv(algo, key, iv, opts);
+  control.update(Buffer.alloc(0));
+  control.final();
+  const expectedTag = control.getAuthTag();
+
   const cipher = crypto.createCipheriv(algo, key, iv, opts);
-  assert.throws(() => {
-    cipher.final();
-  }, hasOpenSSL3 ? {
-    code: 'ERR_OSSL_TAG_NOT_SET'
-  } : {
-    message: /Unsupported state/
-  });
+  let output;
+  try {
+    output = cipher.final();
+  } catch (err) {
+    // OpenSSL without https://github.com/openssl/openssl/pull/32427
+    // cannot finalize an empty CCM message unless update() was called.
+    if (hasOpenSSL3) {
+      assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
+    } else {
+      assert.match(err.message, /Unsupported state/);
+    }
+  }
+
+  if (output !== undefined) {
+    assert.deepStrictEqual(output, Buffer.alloc(0));
+    assert.deepStrictEqual(cipher.getAuthTag(), expectedTag);
+  }
 }
 
 {