crypto: ensure auth tag set for chacha20-poly1305

Because OpenSSL v1.x doesn't do that by itself (OpenSSL v3.x does.)
Fixes: #45874
PR-URL: #46185
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: bnoordhuis

src/crypto/crypto_cipher.cc

@@ -901,6 +901,14 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
 if (kind_ == kDecipher && IsSupportedAuthenticatedMode(ctx_.get()))
 MaybePassAuthTagToOpenSSL();
 
+// OpenSSL v1.x doesn't verify the presence of the auth tag so do
+// it ourselves, see https://github.com/nodejs/node/issues/45874.
+if (OPENSSL_VERSION_NUMBER < 0x30000000L && kind_ == kDecipher &&
+ NID_chacha20_poly1305 == EVP_CIPHER_CTX_nid(ctx_.get()) &&
+ auth_tag_state_ != kAuthTagPassedToOpenSSL) {
+returnfalse;
+ }
+
 // In CCM mode, final() only checks whether authentication failed in update().
 // EVP_CipherFinal_ex must not be called and will fail.
 bool ok;

test/parallel/test-crypto-authenticated.js

@@ -786,3 +786,34 @@ for (const test of TEST_CASES) {
 assert.strictEqual(plaintext.toString('hex'),testCase.plain);
 }
 }
+
+// https://github.com/nodejs/node/issues/45874
+{
+constrfcTestCases=TEST_CASES.filter(({ algo, tampered })=>{
+returnalgo==='chacha20-poly1305'&&tampered===false;
+});
+assert.strictEqual(rfcTestCases.length,1);
+
+const[testCase]=rfcTestCases;
+constkey=Buffer.from(testCase.key,'hex');
+constiv=Buffer.from(testCase.iv,'hex');
+constaad=Buffer.from(testCase.aad,'hex');
+constopt={authTagLength: 16};
+
+constcipher=crypto.createCipheriv('chacha20-poly1305',key,iv,opt);
+constciphertext=Buffer.concat([
+cipher.setAAD(aad).update(testCase.plain,'hex'),
+cipher.final(),
+]);
+constauthTag=cipher.getAuthTag();
+
+assert.strictEqual(ciphertext.toString('hex'),testCase.ct);
+assert.strictEqual(authTag.toString('hex'),testCase.tag);
+
+constdecipher=crypto.createDecipheriv('chacha20-poly1305',key,iv,opt);
+decipher.setAAD(aad).update(ciphertext);
+
+assert.throws(()=>{
+decipher.final();
+},/Unsupportedstateorunabletoauthenticatedata/);
+}