test: account for varied OpenSSL CCM final behaviours

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

Author: panva

test/parallel/test-crypto-authenticated.js

@@ -633,14 +633,29 @@ for (const test of TEST_CASES) {
     const iv = Buffer.alloc(12);
     const opts = { authTagLength: 10 };
 
+    const control = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
+    control.update(Buffer.alloc(0));
+    control.final();
+    const expectedTag = control.getAuthTag();
+
     const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
-    assert.throws(() => {
-      cipher.final();
-    }, hasOpenSSL3 ? {
-      code: 'ERR_OSSL_TAG_NOT_SET'
-    } : {
-      message: /Unsupported state/
-    });
+    let output;
+    try {
+      output = cipher.final();
+    } catch (err) {
+      // OpenSSL without https://github.com/openssl/openssl/pull/32427
+      // cannot finalize an empty CCM message unless update() was called.
+      if (hasOpenSSL3) {
+        assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
+      } else {
+        assert.match(err.message, /Unsupported state/);
+      }
+    }
+
+    if (output !== undefined) {
+      assert.deepStrictEqual(output, Buffer.alloc(0));
+      assert.deepStrictEqual(cipher.getAuthTag(), expectedTag);
+    }
   }
 }