libmongocrypt-helper 1.11.0.0.1001 → 1.13.2.0.1001

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-rewrap-many-datakey.c

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include "mongocrypt-kms-ctx-private.h"
 #include "test-mongocrypt.h"
 
 #define TEST_REWRAP_MASTER_KEY_ID_OLD                                                                                  \
@@ -496,6 +497,83 @@ static void _test_rewrap_many_datakey_need_kms_decrypt(_mongocrypt_tester_t *tes
     mongocrypt_destroy(crypt);
 }
 
+static void _test_rewrap_many_datakey_need_kms_retry(_mongocrypt_tester_t *tester) {
+    mongocrypt_binary_t *const filter = TEST_BSON("{'keyAltName': {'$in': ['keyDocumentA', 'keyDocumentB']}}");
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    mongocrypt_ctx_t *ctx = NULL;
+    mongocrypt_kms_ctx_t *kms = NULL;
+
+    /* Ensure KMS decrypt requests retry for HTTP errors */
+    ctx = mongocrypt_ctx_new(crypt);
+    ASSERT_OK(mongocrypt_ctx_rewrap_many_datakey_init(ctx, filter), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/rmd/key-document-a.json")), ctx);
+    ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS); // To decrypt.
+    ASSERT((kms = mongocrypt_ctx_next_kms_ctx(ctx)));
+    for (int i = 0; i < kms_max_attempts; i++) {
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/rmd/kms-decrypt-reply-429.txt")), kms);
+        ASSERT(mongocrypt_kms_ctx_bytes_needed(kms) == 0);
+        ASSERT((kms = mongocrypt_ctx_next_kms_ctx(ctx)));
+        ASSERT(mongocrypt_kms_ctx_usleep(kms) > 0);
+    }
+    ASSERT_OK(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/rmd/kms-decrypt-reply-a.txt")), kms);
+    ASSERT(mongocrypt_kms_ctx_bytes_needed(kms) == 0);
+    ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS); // To encrypt.
+    mongocrypt_ctx_destroy(ctx);
+
+    /* Clear key cache. */
+    mongocrypt_destroy(crypt);
+    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+
+    /* Ensure KMS decrypt requests retried for HTTP errors fail after max attempts */
+    ctx = mongocrypt_ctx_new(crypt);
+    ASSERT_OK(mongocrypt_ctx_rewrap_many_datakey_init(ctx, filter), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/rmd/key-document-a.json")), ctx);
+    ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+    ASSERT((kms = mongocrypt_ctx_next_kms_ctx(ctx)));
+    for (int i = 0; i <= kms_max_attempts; i++) {
+        if (i == kms_max_attempts) {
+            ASSERT_FAILS(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/rmd/kms-decrypt-reply-429.txt")),
+                         kms,
+                         "retries");
+            break;
+        }
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/rmd/kms-decrypt-reply-429.txt")), kms);
+        ASSERT(mongocrypt_kms_ctx_bytes_needed(kms) == 0);
+        ASSERT((kms = mongocrypt_ctx_next_kms_ctx(ctx)));
+        ASSERT(mongocrypt_kms_ctx_usleep(kms) > 0);
+    }
+    ASSERT_FAILS(mongocrypt_ctx_kms_done(ctx), ctx, "retries");
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_ERROR);
+    mongocrypt_ctx_destroy(ctx);
+
+    /* Clear key cache. */
+    mongocrypt_destroy(crypt);
+    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+
+    /* Ensure KMS decrypt requests retry for network errors */
+    ctx = mongocrypt_ctx_new(crypt);
+    ASSERT_OK(mongocrypt_ctx_rewrap_many_datakey_init(ctx, filter), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/rmd/key-document-a.json")), ctx);
+    ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+    ASSERT((kms = mongocrypt_ctx_next_kms_ctx(ctx)));
+    ASSERT(mongocrypt_kms_ctx_fail(kms)); //  Simulate driver-side network failure
+    ASSERT((kms = mongocrypt_ctx_next_kms_ctx(ctx)));
+    ASSERT(mongocrypt_kms_ctx_usleep(kms) > 0);
+    ASSERT_OK(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/rmd/kms-decrypt-reply-a.txt")), kms);
+    ASSERT(mongocrypt_kms_ctx_bytes_needed(kms) == 0);
+    ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS); // To encrypt.
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
 static void _test_rewrap_many_datakey_need_kms_encrypt(_mongocrypt_tester_t *tester) {
     mongocrypt_binary_t *const filter = TEST_BSON("{'keyAltName': {'$in': ['keyDocumentA', 'keyDocumentB']}}");
 
@@ -841,6 +919,7 @@ void _mongocrypt_tester_install_ctx_rewrap_many_datakey(_mongocrypt_tester_t *te
     INSTALL_TEST(_test_rewrap_many_datakey_init);
     INSTALL_TEST(_test_rewrap_many_datakey_need_mongo_keys);
     INSTALL_TEST(_test_rewrap_many_datakey_need_kms_decrypt);
+    INSTALL_TEST(_test_rewrap_many_datakey_need_kms_retry);
     INSTALL_TEST(_test_rewrap_many_datakey_need_kms_encrypt);
     INSTALL_TEST(_test_rewrap_many_datakey_finalize);
     INSTALL_TEST(_test_rewrap_many_datakey_kms_credentials);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-datakey.c

@@ -399,6 +399,165 @@ static void _test_datakey_custom_key_material(_mongocrypt_tester_t *tester) {
     mongocrypt_destroy(crypt);
 }
 
+static void _test_create_datakey_with_retry(_mongocrypt_tester_t *tester) {
+    // Test that an HTTP error is retried.
+    {
+        mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(
+            mongocrypt_ctx_setopt_key_encryption_key(ctx,
+                                                     TEST_BSON("{'provider': 'aws', 'key': 'foo', 'region': 'bar'}")),
+            ctx);
+        ASSERT_OK(mongocrypt_ctx_datakey_init(ctx), ctx);
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+        mongocrypt_kms_ctx_t *kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Expect no sleep is requested before any error.
+        ASSERT_CMPINT64(mongocrypt_kms_ctx_usleep(kms_ctx), ==, 0);
+        // Feed a retryable HTTP error.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/rmd/kms-decrypt-reply-429.txt")), kms_ctx);
+        // Expect KMS request is returned again for a retry.
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Feed a successful response.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-aws/encrypt-response.txt")), kms_ctx);
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+        _mongocrypt_tester_run_ctx_to(tester, ctx, MONGOCRYPT_CTX_DONE);
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_destroy(crypt);
+    }
+
+    // Test that a network error is retried.
+    {
+        mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(
+            mongocrypt_ctx_setopt_key_encryption_key(ctx,
+                                                     TEST_BSON("{'provider': 'aws', 'key': 'foo', 'region': 'bar'}")),
+            ctx);
+        ASSERT_OK(mongocrypt_ctx_datakey_init(ctx), ctx);
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+        mongocrypt_kms_ctx_t *kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Expect no sleep is requested before any error.
+        ASSERT_CMPINT64(mongocrypt_kms_ctx_usleep(kms_ctx), ==, 0);
+        // Mark a network error.
+        ASSERT_OK(mongocrypt_kms_ctx_fail(kms_ctx), kms_ctx);
+        // Expect KMS request is returned again for a retry.
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Feed a successful response.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-aws/encrypt-response.txt")), kms_ctx);
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+        _mongocrypt_tester_run_ctx_to(tester, ctx, MONGOCRYPT_CTX_DONE);
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_destroy(crypt);
+    }
+
+    // Test that an oauth request is retried for a network error.
+    {
+        mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(mongocrypt_ctx_setopt_key_encryption_key(
+                      ctx,
+                      TEST_BSON("{'provider': 'azure', 'keyVaultEndpoint': 'example.com', 'keyName': 'foo' }")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_datakey_init(ctx), ctx);
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+        mongocrypt_kms_ctx_t *kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Expect an oauth request.
+        {
+            mongocrypt_binary_t *bin = mongocrypt_binary_new();
+            ASSERT_OK(mongocrypt_kms_ctx_message(kms_ctx, bin), kms_ctx);
+            const char *str = (const char *)mongocrypt_binary_data(bin);
+            ASSERT_STRCONTAINS(str, "oauth2");
+            mongocrypt_binary_destroy(bin);
+        }
+        // Expect no sleep is requested before any error.
+        ASSERT_CMPINT64(mongocrypt_kms_ctx_usleep(kms_ctx), ==, 0);
+        // Mark a network error.
+        ASSERT_OK(mongocrypt_kms_ctx_fail(kms_ctx), kms_ctx);
+        // Expect KMS request is returned again for a retry.
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Expect an oauth request.
+        {
+            mongocrypt_binary_t *bin = mongocrypt_binary_new();
+            ASSERT_OK(mongocrypt_kms_ctx_message(kms_ctx, bin), kms_ctx);
+            const char *str = (const char *)mongocrypt_binary_data(bin);
+            ASSERT_STRCONTAINS(str, "oauth2");
+            mongocrypt_binary_destroy(bin);
+        }
+        // Feed a successful response.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-azure/oauth-response.txt")), kms_ctx);
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+
+        // Expect KMS request for encrypt.
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Feed a successful response.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-azure/encrypt-response.txt")), kms_ctx);
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+        _mongocrypt_tester_run_ctx_to(tester, ctx, MONGOCRYPT_CTX_DONE);
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_destroy(crypt);
+    }
+
+    // Test that an oauth request is retried for an HTTP error.
+    {
+        mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(mongocrypt_ctx_setopt_key_encryption_key(
+                      ctx,
+                      TEST_BSON("{'provider': 'azure', 'keyVaultEndpoint': 'example.com', 'keyName': 'foo' }")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_datakey_init(ctx), ctx);
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+        mongocrypt_kms_ctx_t *kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Expect an oauth request.
+        {
+            mongocrypt_binary_t *bin = mongocrypt_binary_new();
+            ASSERT_OK(mongocrypt_kms_ctx_message(kms_ctx, bin), kms_ctx);
+            const char *str = (const char *)mongocrypt_binary_data(bin);
+            ASSERT_STRCONTAINS(str, "oauth2");
+            mongocrypt_binary_destroy(bin);
+        }
+        // Expect no sleep is requested before any error.
+        ASSERT_CMPINT64(mongocrypt_kms_ctx_usleep(kms_ctx), ==, 0);
+        // Feed a retryable HTTP error.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/rmd/kms-decrypt-reply-429.txt")), kms_ctx);
+        // Expect KMS request is returned again for a retry.
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Expect an oauth request.
+        {
+            mongocrypt_binary_t *bin = mongocrypt_binary_new();
+            ASSERT_OK(mongocrypt_kms_ctx_message(kms_ctx, bin), kms_ctx);
+            const char *str = (const char *)mongocrypt_binary_data(bin);
+            ASSERT_STRCONTAINS(str, "oauth2");
+            mongocrypt_binary_destroy(bin);
+        };
+
+        // Feed a successful response.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-azure/oauth-response.txt")), kms_ctx);
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+
+        // Expect KMS request for encrypt.
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT_OK(kms_ctx, ctx);
+        // Feed a successful response.
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-azure/encrypt-response.txt")), kms_ctx);
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+        _mongocrypt_tester_run_ctx_to(tester, ctx, MONGOCRYPT_CTX_DONE);
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_destroy(crypt);
+    }
+}
+
 static void _test_create_data_key(_mongocrypt_tester_t *tester) {
     _test_create_data_key_with_provider(tester, MONGOCRYPT_KMS_PROVIDER_AWS, false /* with_alt_name */);
     _test_create_data_key_with_provider(tester, MONGOCRYPT_KMS_PROVIDER_LOCAL, false /* with_alt_name */);
@@ -414,4 +573,5 @@ void _mongocrypt_tester_install_data_key(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_datakey_kms_per_ctx_credentials);
     INSTALL_TEST(_test_datakey_kms_per_ctx_credentials_not_requested);
     INSTALL_TEST(_test_datakey_kms_per_ctx_credentials_local);
+    INSTALL_TEST(_test_create_datakey_with_retry);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-kek.c

@@ -45,8 +45,8 @@ static void _run_one_test(_mongocrypt_tester_t *tester, bson_t *test) {
         expect_append = expect;
     }
 
-    input_str = bson_as_json(&input, NULL);
-    printf("- testcase: %s\n", input_str);
+    input_str = bson_as_relaxed_extended_json(&input, NULL);
+    TEST_PRINTF("- testcase: %s\n", input_str);
     bson_free(input_str);
 
     ret = _mongocrypt_kek_parse_owned(&input, &kek, status);
@@ -98,4 +98,4 @@ void test_mongocrypt_kek_parsing(_mongocrypt_tester_t *tester) {
 
 void _mongocrypt_tester_install_kek(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(test_mongocrypt_kek_parsing);
-}
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-key-cache.c

@@ -236,7 +236,7 @@ static bool _match_one_cache_entry(_mongocrypt_cache_pair_t *pair, bson_t *expec
     }
 
     if (!_mongocrypt_key_alt_name_unique_list_equal(key_alt_names, attr->alt_names)) {
-        printf("failed to match key alt names\n");
+        TEST_PRINTF("failed to match key alt names\n");
         goto done;
     }
 
@@ -268,7 +268,7 @@ static void _match_cache_entry(_mongocrypt_tester_t *tester, mongocrypt_ctx_t *c
     while (pair) {
         if (_match_one_cache_entry(pair, expected_entry)) {
             if (matched) {
-                printf("double matched entry: %s\n", bson_as_json(expected_entry, NULL));
+                TEST_PRINTF("double matched entry: %s\n", bson_as_relaxed_extended_json(expected_entry, NULL));
                 BSON_ASSERT(false);
             }
             matched = true;
@@ -278,7 +278,7 @@ static void _match_cache_entry(_mongocrypt_tester_t *tester, mongocrypt_ctx_t *c
     }
 
     if (!matched) {
-        printf("could not match entry: %s\n", bson_as_json(expected_entry, NULL));
+        TEST_PRINTF("could not match entry: %s\n", bson_as_relaxed_extended_json(expected_entry, NULL));
         BSON_ASSERT(false);
     }
 }
@@ -291,11 +291,11 @@ static void _run_one_test(_mongocrypt_tester_t *tester, mongocrypt_ctx_t *ctx, b
     mongocrypt_status_t *status;
 
     if (bson_iter_init_find(&iter, test, "description")) {
-        printf("- %s\n", bson_iter_utf8(&iter, NULL));
+        TEST_PRINTF("- %s\n", bson_iter_utf8(&iter, NULL));
     }
 
     if (bson_iter_init_find(&iter, test, "skipReason")) {
-        printf("  - skipping: %s\n", bson_iter_utf8(&iter, NULL));
+        TEST_PRINTF("  - skipping: %s\n", bson_iter_utf8(&iter, NULL));
         return;
     }
 
@@ -407,7 +407,7 @@ static void _test_key_cache(_mongocrypt_tester_t *tester) {
 
         bson_iter_bson(&iter, &test);
 
-        BSON_ASSERT(mongocrypt_ctx_encrypt_init(ctx, "test", -1, TEST_BSON("{'insert': 'coll'}")));
+        BSON_ASSERT(mongocrypt_ctx_encrypt_init(ctx, "test", -1, TEST_BSON("{'insert': 'test'}")));
         _run_one_test(tester, ctx, &test);
         bson_destroy(&test);
 
@@ -419,4 +419,4 @@ static void _test_key_cache(_mongocrypt_tester_t *tester) {
 
 void _mongocrypt_tester_install_key_cache(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_key_cache);
-}
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-kms-responses.c

@@ -51,7 +51,7 @@ static void _test_one_kms_response(_mongocrypt_tester_t *tester, bson_t *test) {
     bson_iter_t ctx_iter;
 
     BSON_ASSERT(bson_iter_init_find(&iter, test, "description"));
-    printf("- %s\n", bson_iter_utf8(&iter, NULL));
+    TEST_PRINTF("- %s\n", bson_iter_utf8(&iter, NULL));
     BSON_ASSERT(bson_iter_init_find(&ctx_iter, test, "ctx"));
     BSON_ASSERT(bson_iter_recurse(&ctx_iter, &ctx_iter));
     while (bson_iter_next(&ctx_iter)) {
@@ -94,7 +94,7 @@ static void _test_one_kms_response(_mongocrypt_tester_t *tester, bson_t *test) {
             tester->paths.key_file = "./test/data/key-document-gcp.json";
             ASSERT_OK(mongocrypt_ctx_decrypt_init(ctx, bin), ctx);
         } else {
-            fprintf(stderr, "unsupported ctx type: %s\n", ctx_type);
+            TEST_STDERR_PRINTF("unsupported ctx type: %s\n", ctx_type);
             abort();
         }
 
@@ -142,13 +142,14 @@ static void _test_one_kms_response(_mongocrypt_tester_t *tester, bson_t *test) {
         BSON_ASSERT(bson_iter_init_find(&iter, test, "expect"));
         if (BSON_ITER_HOLDS_ARRAY(&iter)) {
             // Concatenate array into one string.
-            bson_string_t *builder = bson_string_new(NULL);
+            expect = bson_strdup("");
             bson_iter_recurse(&iter, &iter);
             while (bson_iter_next(&iter)) {
                 ASSERT(BSON_ITER_HOLDS_UTF8(&iter));
-                bson_string_append(builder, bson_iter_utf8(&iter, NULL));
+                char *previous = expect;
+                expect = bson_strdup_printf("%s%s", expect, bson_iter_utf8(&iter, NULL));
+                bson_free(previous);
             }
-            expect = bson_string_free(builder, false /* free segment */);
         } else {
             expect = bson_strdup(bson_iter_utf8(&iter, NULL));
         }