libmongocrypt-helper 1.11.0.0.1001 → 1.13.2.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-opts-private.h

@@ -118,10 +118,6 @@ typedef struct {
     bool use_need_mongo_collinfo_with_db_state;
     bool bypass_query_analysis;
 
-    // When creating new encrypted payloads,
-    // use V2 variants of the FLE2 datatypes.
-    bool use_fle2_v2;
-
     // Use the Queryable Encryption Range V2 protocol.
     bool use_range_v2;
 } _mongocrypt_opts_t;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-opts.c

@@ -990,7 +990,7 @@ bool _mongocrypt_parse_kms_providers(mongocrypt_binary_t *kms_providers_definiti
     }
 
     if (log && log->trace_enabled) {
-        char *as_str = bson_as_json(&as_bson, NULL);
+        char *as_str = bson_as_relaxed_extended_json(&as_bson, NULL);
         _mongocrypt_log(log, MONGOCRYPT_LOG_LEVEL_TRACE, "%s (%s=\"%s\")", BSON_FUNC, "kms_providers", as_str);
         bson_free(as_str);
     }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-private.h

@@ -49,6 +49,10 @@
 
 #define MONGOCRYPT_DATA_AND_LEN(x) ((uint8_t *)x), (sizeof(x) / sizeof((x)[0]) - 1)
 
+#define LATEST_STR_ENCODE_VERSION 1
+
+#define MIN_STR_ENCODE_VERSION 1
+
 /* TODO: Move these to mongocrypt-log-private.h? */
 const char *tmp_json(const bson_t *bson);
 
@@ -125,6 +129,8 @@ struct _mongocrypt_t {
     _mongo_crypt_v1_vtable csfle;
     /// Pointer to the global csfle_lib object. Should not be freed directly.
     mongo_crypt_v1_lib *csfle_lib;
+    bool retry_enabled;
+    bool multiple_collinfo_enabled;
 };
 
 typedef enum {
@@ -141,7 +147,8 @@ typedef enum {
 typedef enum {
     MONGOCRYPT_FLE2_ALGORITHM_UNINDEXED = 1,
     MONGOCRYPT_FLE2_ALGORITHM_EQUALITY = 2,
-    MONGOCRYPT_FLE2_ALGORITHM_RANGE = 3
+    MONGOCRYPT_FLE2_ALGORITHM_RANGE = 3,
+    MONGOCRYPT_FLE2_ALGORITHM_TEXT_SEARCH = 4
 } mongocrypt_fle2_encryption_algorithm_t;
 
 bool _mongocrypt_validate_and_copy_string(const char *in, int32_t in_len, char **out) MONGOCRYPT_WARN_UNUSED_RESULT;
@@ -160,15 +167,4 @@ bool _mongocrypt_needs_credentials_for_provider(mongocrypt_t *crypt,
                                                 _mongocrypt_kms_provider_t provider,
                                                 const char *name);
 
-/**
- * Enable/disable the use of FLE2v2 payload types for write.
- *
- * @param[in] crypt The @ref mongocrypt_t object.
- * @param[in] enable Whether to enable use of FLE2v2 payloads.
- *
- * @returns A boolean indicating success. If false, an error status is set.
- * Retrieve it with @ref mongocrypt_status
- */
-bool mongocrypt_setopt_fle2v2(mongocrypt_t *crypt, bool enable);
-
 #endif /* MONGOCRYPT_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-traverse-util.c

@@ -45,7 +45,7 @@ static bool _check_first_byte(uint8_t byte, traversal_match_t match) {
             || byte == MC_SUBTYPE_FLE2InsertUpdatePayload || byte == MC_SUBTYPE_FLE2IndexedRangeEncryptedValue
             || byte == MC_SUBTYPE_FLE2InsertUpdatePayloadV2 || byte == MC_SUBTYPE_FLE2UnindexedEncryptedValueV2
             || byte == MC_SUBTYPE_FLE2IndexedEqualityEncryptedValueV2
-            || byte == MC_SUBTYPE_FLE2IndexedRangeEncryptedValueV2;
+            || byte == MC_SUBTYPE_FLE2IndexedRangeEncryptedValueV2 || byte == MC_SUBTYPE_FLE2IndexedTextEncryptedValue;
     case TRAVERSE_MATCH_SUBTYPE6: return true;
     default: break;
     }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-util.c

@@ -18,13 +18,15 @@
 #if defined(__has_include) && !(defined(_GNU_SOURCE) || defined(_DARWIN_C_SOURCE))
 #if __has_include(<features.h>)
 // We're using a glibc-compatible library
+#if !defined(_GNU_SOURCE)
 #define _GNU_SOURCE
+#endif
 #elif __has_include(<Availability.h>)
 // We're on Apple/Darwin
 #define _DARWIN_C_SOURCE
 #endif
 #else // No __has_include
-#if __GNUC__ < 5
+#if __GNUC__ < 5 && !defined(_GNU_SOURCE)
 // Best guess on older GCC is that we are using glibc
 #define _GNU_SOURCE
 #endif

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt.c

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include "mongocrypt.h"
 #include "mlib/error.h"
 #include "mlib/path.h"
 #include "mlib/thread.h"
@@ -24,6 +25,7 @@
 #include "mongocrypt-binary-private.h"
 #include "mongocrypt-cache-collinfo-private.h"
 #include "mongocrypt-cache-key-private.h"
+#include "mongocrypt-cache-private.h"
 #include "mongocrypt-config.h"
 #include "mongocrypt-crypto-private.h"
 #include "mongocrypt-log-private.h"
@@ -116,8 +118,6 @@ mongocrypt_t *mongocrypt_new(void) {
     crypt->status = mongocrypt_status_new();
     _mongocrypt_opts_init(&crypt->opts);
     _mongocrypt_log_init(&crypt->log);
-    // Default to using FLEv2 (aka QEv2)
-    crypt->opts.use_fle2_v2 = true;
     crypt->ctx_counter = 1;
     crypt->cache_oauth = mc_mapof_kmsid_to_token_new();
     crypt->csfle = (_mongo_crypt_v1_vtable){.okay = false};
@@ -146,13 +146,6 @@ mongocrypt_t *mongocrypt_new(void) {
         }                                                                                                              \
     }
 
-bool mongocrypt_setopt_fle2v2(mongocrypt_t *crypt, bool enable) {
-    ASSERT_MONGOCRYPT_PARAM_UNINIT(crypt);
-
-    crypt->opts.use_fle2_v2 = enable;
-    return true;
-}
-
 bool mongocrypt_setopt_use_range_v2(mongocrypt_t *crypt) {
     ASSERT_MONGOCRYPT_PARAM_UNINIT(crypt);
 
@@ -167,6 +160,18 @@ bool mongocrypt_setopt_log_handler(mongocrypt_t *crypt, mongocrypt_log_fn_t log_
     return true;
 }
 
+bool mongocrypt_setopt_retry_kms(mongocrypt_t *crypt, bool enable) {
+    ASSERT_MONGOCRYPT_PARAM_UNINIT(crypt);
+    crypt->retry_enabled = enable;
+    return true;
+}
+
+bool mongocrypt_setopt_enable_multiple_collinfo(mongocrypt_t *crypt) {
+    ASSERT_MONGOCRYPT_PARAM_UNINIT(crypt);
+    crypt->multiple_collinfo_enabled = true;
+    return true;
+}
+
 bool mongocrypt_setopt_kms_provider_aws(mongocrypt_t *crypt,
                                         const char *aws_access_key_id,
                                         int32_t aws_access_key_id_len,
@@ -214,6 +219,17 @@ bool mongocrypt_setopt_kms_provider_aws(mongocrypt_t *crypt,
     return true;
 }
 
+bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expiration_ms) {
+    ASSERT_MONGOCRYPT_PARAM_UNINIT(crypt);
+    if (cache_expiration_ms > INT64_MAX) {
+        mongocrypt_status_t *status = crypt->status;
+        CLIENT_ERR("expiration time must be less than %" PRId64 ", but got %" PRIu64, INT64_MAX, cache_expiration_ms);
+        return false;
+    }
+    crypt->cache_key.expiration = cache_expiration_ms;
+    return true;
+}
+
 char *_mongocrypt_new_string_from_bytes(const void *in, int len) {
     const int max_bytes = 100;
     const int chars_per_byte = 2;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt.h

@@ -310,6 +310,29 @@ mongocrypt_t *mongocrypt_new(void);
 MONGOCRYPT_EXPORT
 bool mongocrypt_setopt_log_handler(mongocrypt_t *crypt, mongocrypt_log_fn_t log_fn, void *log_ctx);
 
+/**
+ * Enable or disable KMS retry behavior.
+ *
+ * @param[in] crypt The @ref mongocrypt_t object.
+ * @param[in] enable A boolean indicating whether to retry operations.
+ * @pre @ref mongocrypt_init has not been called on @p crypt.
+ * @returns A boolean indicating success. If false, an error status is set.
+ * Retrieve it with @ref mongocrypt_ctx_status
+ */
+MONGOCRYPT_EXPORT
+bool mongocrypt_setopt_retry_kms(mongocrypt_t *crypt, bool enable);
+
+/**
+ * Enable support for multiple collection schemas. Required to support $lookup.
+ *
+ * @param[in] crypt The @ref mongocrypt_t object.
+ * @pre @ref mongocrypt_init has not been called on @p crypt.
+ * @returns A boolean indicating success. If false, an error status is set.
+ * Retrieve it with @ref mongocrypt_ctx_status
+ */
+MONGOCRYPT_EXPORT
+bool mongocrypt_setopt_enable_multiple_collinfo(mongocrypt_t *crypt);
+
 /**
  * Configure an AWS KMS provider on the @ref mongocrypt_t object.
  *
@@ -546,7 +569,7 @@ const char *mongocrypt_crypt_shared_lib_version_string(const mongocrypt_t *crypt
  * @brief Obtain a 64-bit constant encoding the version of the loaded
  * crypt_shared library, if available.
  *
- * @param[in] crypt The mongocrypt_t object after a successul call to
+ * @param[in] crypt The mongocrypt_t object after a successful call to
  * mongocrypt_init.
  *
  * @return A 64-bit encoded version number, with the version encoded as four
@@ -1082,6 +1105,8 @@ typedef struct _mongocrypt_kms_ctx_t mongocrypt_kms_ctx_t;
  * If KMS handles are being handled synchronously, the driver can reuse the same
  * TLS socket to send HTTP requests and receive responses.
  *
+ * The returned KMS handle does not outlive `ctx`.
+ *
  * @param[in] ctx A @ref mongocrypt_ctx_t.
  * @returns a new @ref mongocrypt_kms_ctx_t or NULL.
  */
@@ -1130,6 +1155,15 @@ bool mongocrypt_kms_ctx_endpoint(mongocrypt_kms_ctx_t *kms, const char **endpoin
 MONGOCRYPT_EXPORT
 uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
 
+/**
+ * Indicates how long to sleep before sending this request.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @returns How long to sleep in microseconds.
+ */
+MONGOCRYPT_EXPORT
+int64_t mongocrypt_kms_ctx_usleep(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Feed bytes from the HTTP response.
  *
@@ -1145,6 +1179,15 @@ uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
 MONGOCRYPT_EXPORT
 bool mongocrypt_kms_ctx_feed(mongocrypt_kms_ctx_t *kms, mongocrypt_binary_t *bytes);
 
+/**
+ * Indicate a network-level failure.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @return A boolean indicating whether the failed request may be retried.
+ */
+MONGOCRYPT_EXPORT
+bool mongocrypt_kms_ctx_fail(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Get the status associated with a @ref mongocrypt_kms_ctx_t object.
  *
@@ -1264,7 +1307,7 @@ void mongocrypt_ctx_destroy(mongocrypt_ctx_t *ctx);
  * @param[out] status An optional status to pass error messages. See @ref
  * mongocrypt_status_set.
  * @returns A boolean indicating success. If returning false, set @p status
- * with a message indiciating the error using @ref mongocrypt_status_set.
+ * with a message indicating the error using @ref mongocrypt_status_set.
  */
 typedef bool (*mongocrypt_crypto_fn)(void *ctx,
                                      mongocrypt_binary_t *key,
@@ -1289,7 +1332,7 @@ typedef bool (*mongocrypt_crypto_fn)(void *ctx,
  * @param[out] status An optional status to pass error messages. See @ref
  * mongocrypt_status_set.
  * @returns A boolean indicating success. If returning false, set @p status
- * with a message indiciating the error using @ref mongocrypt_status_set.
+ * with a message indicating the error using @ref mongocrypt_status_set.
  */
 typedef bool (*mongocrypt_hmac_fn)(void *ctx,
                                    mongocrypt_binary_t *key,
@@ -1308,7 +1351,7 @@ typedef bool (*mongocrypt_hmac_fn)(void *ctx,
  * @param[out] status An optional status to pass error messages. See @ref
  * mongocrypt_status_set.
  * @returns A boolean indicating success. If returning false, set @p status
- * with a message indiciating the error using @ref mongocrypt_status_set.
+ * with a message indicating the error using @ref mongocrypt_status_set.
  */
 typedef bool (*mongocrypt_hash_fn)(void *ctx,
                                    mongocrypt_binary_t *in,
@@ -1326,7 +1369,7 @@ typedef bool (*mongocrypt_hash_fn)(void *ctx,
  * @param[out] status An optional status to pass error messages. See @ref
  * mongocrypt_status_set.
  * @returns A boolean indicating success. If returning false, set @p status
- * with a message indiciating the error using @ref mongocrypt_status_set.
+ * with a message indicating the error using @ref mongocrypt_status_set.
  */
 typedef bool (*mongocrypt_random_fn)(void *ctx, mongocrypt_binary_t *out, uint32_t count, mongocrypt_status_t *status);
 
@@ -1473,7 +1516,7 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
  * {
  *    "min": Optional<BSON value>,
  *    "max": Optional<BSON value>,
- *    "sparsity": Int64,
+ *    "sparsity": Optional<Int64>,
  *    "precision": Optional<Int32>,
  *    "trimFactor": Optional<Int32>
  * }
@@ -1487,10 +1530,26 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
 MONGOCRYPT_EXPORT
 bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts);
 
+/**
+ * Set the expiration time for the data encryption key cache. Defaults to 60 seconds if not set.
+ *
+ * @param[in] ctx The @ref mongocrypt_ctx_t object.
+ * @param[in] cache_expiration_ms The cache expiration time in milliseconds. If zero, the cache
+ * never expires.
+ */
+MONGOCRYPT_EXPORT
+bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expiration_ms);
+
 /// String constants for setopt_query_type
 #define MONGOCRYPT_QUERY_TYPE_EQUALITY_STR "equality"
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
 #define MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR "rangePreview"
 #define MONGOCRYPT_QUERY_TYPE_RANGE_STR "range"
+/// NOTE: "substringPreview" is experimental and may be removed in a future non-major release.
+#define MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR "substringPreview"
+/// NOTE: "suffixPreview" is experimental and may be removed in a future non-major release.
+#define MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_STR "suffixPreview"
+/// NOTE: "prefixPreview" is experimental and may be removed in a future non-major release.
+#define MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_STR "prefixPreview"
 
 #endif /* MONGOCRYPT_H */

data/ext/libmongocrypt/libmongocrypt/src/os_posix/os_dll.c

@@ -2,13 +2,15 @@
 #if defined(__has_include) && !(defined(_GNU_SOURCE) || defined(_DARWIN_C_SOURCE))
 #if __has_include(<features.h>)
 // We're using a glibc-compatible library
+#if !defined(_GNU_SOURCE)
 #define _GNU_SOURCE
+#endif
 #elif __has_include(<Availability.h>)
 // We're on Apple/Darwin
 #define _DARWIN_C_SOURCE
 #endif
 #else // No __has_include
-#if __GNUC__ < 5
+#if __GNUC__ < 5 && !defined(_GNU_SOURCE)
 // Best guess on older GCC is that we are using glibc
 #define _GNU_SOURCE
 #endif