tls: allow empty ALPNProtocols and keep C++ CHECK_EQ

Empty ALPN buffer/array means skip ALPN (same as historical
behavior for []). Zero-length protocol entries and malformed
wire buffers still throw from convertALPNProtocols.

Revert the C++ THROW_ERR_INVALID_ARG_VALUE back to CHECK_EQ:
after JS validation, a non-zero SSL_set_alpn_protos return is
an internal invariant failure, not user-facing input.

Refs: #65076

Author: sankalpsthakur

lib/tls.js

@@ -276,11 +276,8 @@ function convertProtocols(protocols) {
 function validateALPNBuffer(buffer) {
   // Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
   // exactly len bytes follow, no trailing bytes, no zero-length entries.
+  // Empty buffer is allowed and means skip ALPN (same as []).
   let offset = 0;
-  if (buffer.length === 0) {
-    throw new ERR_INVALID_ARG_VALUE('ALPNProtocols', buffer,
-                                    'must not be empty');
-  }
   while (offset < buffer.length) {
     const len = buffer[offset];
     if (len === 0) {

src/crypto/crypto_tls.cc

@@ -1699,9 +1699,7 @@ void TLSWrap::SetALPNProtocols(const FunctionCallbackInfo<Value>& args) {
   ArrayBufferViewContents<uint8_t> protos(args[0].As<ArrayBufferView>());
   SSL* ssl = w->ssl_.get();
   if (w->is_client()) {
-    if (SSL_set_alpn_protos(ssl, protos.data(), protos.length()) != 0) {
-      return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ALPNProtocols value");
-    }
+    CHECK_EQ(0, SSL_set_alpn_protos(ssl, protos.data(), protos.length()));
   } else {
     w->alpn_protos_ = std::vector<unsigned char>(
         protos.data(), protos.data() + protos.length());

test/parallel/test-tls-alpn-protocols-validation.js

@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const tls = require('tls');
 
-// Array with empty string should throw (client and server paths via convertALPNProtocols)
+// Array with empty string should throw (zero-length protocol entry)
 assert.throws(() => {
   const out = {};
   tls.convertALPNProtocols([''], out);
@@ -46,22 +46,40 @@ assert.throws(() => {
   code: 'ERR_INVALID_ARG_VALUE',
 });
 
-// Empty buffer should throw
-assert.throws(() => {
+// Empty array means skip ALPN (allowed)
+{
+  const out = {};
+  tls.convertALPNProtocols([], out);
+  assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+  assert.strictEqual(out.ALPNProtocols.length, 0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
   const out = {};
   tls.convertALPNProtocols(Buffer.alloc(0), out);
-}, {
-  code: 'ERR_INVALID_ARG_VALUE',
-});
+  assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+  assert.strictEqual(out.ALPNProtocols.length, 0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+  const out = {};
+  tls.convertALPNProtocols(new Uint8Array(0), out);
+  assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+  assert.strictEqual(out.ALPNProtocols.length, 0);
+}
 
 // Valid inputs should not throw
 {
   const out = {};
   tls.convertALPNProtocols(['h2', 'http/1.1'], out);
+  assert.ok(out.ALPNProtocols.length > 0);
 }
 {
   const out = {};
   tls.convertALPNProtocols(Buffer.from([
     2, 0x61, 0x62, 8, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31,
   ]), out);
+  assert.strictEqual(out.ALPNProtocols.length, 12);
 }