Skip to content

[v24.x backport] test: account for varied OpenSSL CCM final behaviours - #65710

Open
everett1992 wants to merge 1 commit into
nodejs:v24.x-stagingfrom
everett1992:backport-65542-to-v24.x
Open

[v24.x backport] test: account for varied OpenSSL CCM final behaviours#65710
everett1992 wants to merge 1 commit into
nodejs:v24.x-stagingfrom
everett1992:backport-65542-to-v24.x

Conversation

@everett1992

@everett1992 everett1992 commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Backport of test: account for varied OpenSSL CCM final behaviours
(28b571c) from #65542, which landed via commit-queue-rebase, so the
test fix is one commit inside the OpenSSL 3.5.8 update rather than its own
PR.

It does not cherry-pick cleanly: main has hasOpenSSL(3) where this
branch still has hasOpenSSL3. That rename is the only change from the
original commit.

Why now

We build our Node distribution against our own OpenSSL rather than the
bundled copy, and we run the upstream test suite. We have just updated to
OpenSSL 3.0.22 (for v20.x/v22.x) and 3.5.8 (for v24.x/v26.x), so
parallel/test-crypto-authenticated is already failing on our v22.x and
v24.x builds. The same backport will be needed here if and when these
branches update the bundled OpenSSL.

OpenSSL 3.0.22 and 3.5.8 include openssl/openssl#32427. Before it,
ossl_ccm_stream_final() returned early when the payload update() was
skipped, so encryption produced no tag and decryption could report
success without verifying the supplied tag. With the fix, final() on an
empty CCM message succeeds and produces a real tag instead of failing
with ERR_OSSL_TAG_NOT_SET — which is what the test asserted
unconditionally.

Verification

Ran parallel/test-crypto-authenticated before and after this change on
Node 20.20.2 and 22.23.2 built against shared OpenSSL 3.0.22, and Node
26.7.0 against shared OpenSSL 3.5.8: fails before, passes after. 24.20.0
carries a byte-identical copy of this test block to 26.7.0.

AI disclosure

The conflict resolution and this description were drafted with an
agentic coding CLI. I ran the test before and after on the builds above
and read the OpenSSL change to confirm the behaviour it describes.

Companion backport for v22.x: #65711

@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. test Issues and PRs related to Node.js core tests and test infrastructure. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Sep 1, 2026
@everett1992
everett1992 force-pushed the backport-65542-to-v24.x branch from f46b725 to 91ffcd9 Compare September 1, 2026 16:36
everett1992 pushed a commit to everett1992/node that referenced this pull request Sep 1, 2026
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
(cherry picked from commit 28b571c)

Refs: openssl/openssl#32427
Refs: nodejs#65710
Refs: nodejs#65711
everett1992 pushed a commit to everett1992/node that referenced this pull request Sep 1, 2026
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
(cherry picked from commit 28b571c)

Refs: openssl/openssl#32427
Refs: nodejs#65711
Refs: nodejs#65710
Backport of the test-only commit from nodejs#65542. Distributions that build
Node against their own newer OpenSSL and run the upstream test suite
already see this test fail on v22.x and v24.x. The same backport is
needed if and when these lines update the bundled OpenSSL.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Caleb ツ Everett <calebev@amazon.com>
PR-URL: nodejs#65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
(cherry picked from commit 28b571c)
Refs: openssl/openssl#32427
Refs: nodejs#65710
Refs: nodejs#65711
Assisted-by: a closed-source coding agent
@everett1992
everett1992 force-pushed the backport-65542-to-v24.x branch from 91ffcd9 to da1893b Compare September 1, 2026 17:00
everett1992 pushed a commit to everett1992/node that referenced this pull request Sep 1, 2026
Backport of the test-only commit from nodejs#65542. Distributions that build
Node against their own newer OpenSSL and run the upstream test suite
already see this test fail on v22.x and v24.x. The same backport is
needed if and when these lines update the bundled OpenSSL.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Caleb ツ Everett <calebev@amazon.com>
PR-URL: nodejs#65542
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
(cherry picked from commit 28b571c)
Refs: openssl/openssl#32427
Refs: nodejs#65710
Refs: nodejs#65711
Assisted-by: a closed-source coding agent
@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.32%. Comparing base (9e39360) to head (da1893b).
⚠️ Report is 245 commits behind head on v24.x-staging.

Additional details and impacted files
@@                Coverage Diff                @@
##           v24.x-staging   #65710      +/-   ##
=================================================
+ Coverage          90.31%   90.32%   +0.01%     
=================================================
  Files                711      714       +3     
  Lines             228425   231840    +3415     
  Branches           43160    43952     +792     
=================================================
+ Hits              206293   209404    +3111     
- Misses             14090    14196     +106     
- Partials            8042     8240     +198     

see 97 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@trivikr trivikr added the request-ci Add this label to start a Jenkins CI on a PR. label Sep 1, 2026
@trivikr
trivikr requested a review from panva September 1, 2026 23:28
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Sep 1, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ci PRs that need a full CI run. test Issues and PRs related to Node.js core tests and test infrastructure. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants