doc,test: account for OpenSSL 4.1 behaviours

doc/api/crypto.md

@@ -3034,8 +3034,7 @@ changes:
 Checks whether the certificate matches the given email address.
 
 If the `'subject'` option is undefined or set to `'default'`, the certificate
-subject is only considered if the subject alternative name extension either does
-not exist or does not contain any email addresses.
+subject is considered according to OpenSSL's default behavior.
 
 If the `'subject'` option is set to `'always'` and if the subject alternative
 name extension either does not exist or does not contain a matching email
@@ -3079,9 +3078,7 @@ comparisons are case-insensitive, the returned subject name might also differ
 from the given `name` in capitalization.
 
 If the `'subject'` option is undefined or set to `'default'`, the certificate
-subject is only considered if the subject alternative name extension either does
-not exist or does not contain any DNS names. This behavior is consistent with
-[RFC 2818][] ("HTTP Over TLS").
+subject is considered according to OpenSSL's default behavior.
 
 If the `'subject'` option is set to `'always'` and if the subject alternative
 name extension either does not exist or does not contain a matching DNS name,
@@ -7607,7 +7604,6 @@ See the [list of SSL OP Flags][] for details.
 [Permission Model]: permissions.md#permission-model
 [RFC 1421]: https://www.rfc-editor.org/rfc/rfc1421.txt
 [RFC 2409]: https://www.rfc-editor.org/rfc/rfc2409.txt
-[RFC 2818]: https://www.rfc-editor.org/rfc/rfc2818.txt
 [RFC 3526]: https://www.rfc-editor.org/rfc/rfc3526.txt
 [RFC 3610]: https://www.rfc-editor.org/rfc/rfc3610.txt
 [RFC 4055]: https://www.rfc-editor.org/rfc/rfc4055.txt

test/parallel/test-crypto-authenticated.js

@@ -44,6 +44,10 @@ const TEST_CASES = require(fixtures.path('aead-vectors.js'));
 
 const errMessages = {
   auth: / auth/,
+  // OpenSSL 4.1 adds a provider error for AEAD tag mismatches.
+  // https://github.com/openssl/openssl/pull/32587
+  badDecrypt: hasOpenSSL(4, 1) ?
+    { code: 'ERR_OSSL_BAD_DECRYPT' } : /Unsupported state or unable to authenticate data/,
   state: / state/,
   FIPS: /not supported in FIPS mode/,
   length: /Invalid initialization vector/,
@@ -128,7 +132,8 @@ for (const test of TEST_CASES) {
         assert.strictEqual(msg, test.plain);
       } else {
         // Assert that final throws if input data could not be verified!
-        assert.throws(function() { decrypt.final('hex'); }, errMessages.auth);
+        assert.throws(function() { decrypt.final('hex'); },
+                      isCCM || isSIV ? errMessages.auth : errMessages.badDecrypt);
       }
     }
   }
@@ -358,7 +363,8 @@ for (const test of TEST_CASES) {
       decipher.update(ciphertext);
       assert.throws(() => {
         decipher.final();
-      }, /Unsupported state or unable to authenticate data/);
+      }, algo === 'aes-128-siv' ?
+        /Unsupported state or unable to authenticate data/ : errMessages.badDecrypt);
     }
   }
 }
@@ -969,7 +975,7 @@ if (!fips3 && !isBoringSSL) {
 
   assert.throws(() => {
     decipher.final();
-  }, /Unsupported state or unable to authenticate data/);
+  }, errMessages.badDecrypt);
 } else {
   common.printSkipMessage('Skipping unsupported chacha20-poly1305 test');
 }

test/parallel/test-crypto-x509.js

@@ -175,9 +175,21 @@ const der = Buffer.from(
 
   assert.strictEqual(x509.checkIP('127.0.0.1'), undefined);
   assert.strictEqual(x509.checkIP('::'), undefined);
-  assert.strictEqual(x509.checkHost('agent1'), 'agent1');
+  // OpenSSL 4.1 no longer checks the subject DN by default.
+  // https://github.com/openssl/openssl/pull/31982
+  for (const options of [undefined, { subject: 'default' }]) {
+    assert.strictEqual(x509.checkHost('agent1', options),
+                       hasOpenSSL(4, 1) ? undefined : 'agent1');
+    assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', options),
+                       hasOpenSSL(4, 1) ? undefined : 'ry@tinyclouds.org');
+  }
+  assert.strictEqual(x509.checkHost('agent1', { subject: 'always' }), 'agent1');
+  assert.strictEqual(x509.checkHost('agent1', { subject: 'never' }), undefined);
   assert.strictEqual(x509.checkHost('agent2'), undefined);
-  assert.strictEqual(x509.checkEmail('ry@tinyclouds.org'), 'ry@tinyclouds.org');
+  assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', { subject: 'always' }),
+                     'ry@tinyclouds.org');
+  assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', { subject: 'never' }),
+                     undefined);
   assert.strictEqual(x509.checkEmail('sally@example.com'), undefined);
   assert.throws(() => x509.checkHost('agent\x001'), {
     code: 'ERR_INVALID_ARG_VALUE'

test/parallel/test-tls-psk-circuit.js

@@ -70,9 +70,12 @@ test({ psk: USERS.UserA, identity: 'UserA' }, { minVersion: 'TLSv1.3' });
 test({ psk: USERS.UserB, identity: 'UserB' });
 test({ psk: USERS.UserB, identity: 'UserB' }, { minVersion: 'TLSv1.3' });
 // Unrecognized user should fail handshake
-const expectedHandshakeErr = hasOpenSSL(4, 0) ?
-  'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
-    'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
+// OpenSSL 4.1 uses the same alert as for an invalid binder when no certificate
+// is available: https://github.com/openssl/openssl/pull/31026
+const expectedHandshakeErr = hasOpenSSL(4, 1) ?
+  'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' : hasOpenSSL(4, 0) ?
+    'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
+      'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
 test({ psk: USERS.UserB, identity: 'UserC' }, {}, expectedHandshakeErr);
 // Recognized user but incorrect secret should fail handshake
 const expectedIllegalParameterErr = hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :