libmongocrypt-helper 1.12.0.0.1001 → 1.13.2.0.1001

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-find-equality-payload-v2.c

@@ -73,6 +73,25 @@ static void _test_FLE2FindEqualityPayloadV2_roundtrip(_mongocrypt_tester_t *test
 
 #undef TEST_FIND_EQ_PAYLOAD_HEX_V2
 
+static void _test_FLE2FindEqualityPayloadV2_errors(_mongocrypt_tester_t *tester) {
+    bson_t *input_bson = TMP_BSON(BSON_STR({
+        "d" : {"$binary" : {"base64" : "AAAA", "subType" : "00"}},
+        "s" : {"$binary" : {"base64" : "AAAA", "subType" : "00"}},
+        "l" : {"$binary" : {"base64" : "AAAA", "subType" : "00"}},
+        "cm" : "wrong type!"
+    }));
+
+    mc_FLE2FindEqualityPayloadV2_t payload;
+    mc_FLE2FindEqualityPayloadV2_init(&payload);
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    ASSERT_FAILS_STATUS(mc_FLE2FindEqualityPayloadV2_parse(&payload, input_bson, status),
+                        status,
+                        "Field 'cm' expected to hold an int64");
+    mc_FLE2FindEqualityPayloadV2_cleanup(&payload);
+    mongocrypt_status_destroy(status);
+}
+
 void _mongocrypt_tester_install_fle2_payload_find_equality_v2(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_FLE2FindEqualityPayloadV2_roundtrip);
-}
+    INSTALL_TEST(_test_FLE2FindEqualityPayloadV2_errors);
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-iev-v2.c

@@ -14,14 +14,13 @@
  * limitations under the License.
  */
 
+#include "mc-fle-blob-subtype-private.h"
 #include "mc-fle2-payload-iev-private-v2.h"
 #include "test-mongocrypt-assert-match-bson.h"
+#include "test-mongocrypt-assert.h"
 #include "test-mongocrypt.h"
 
-typedef enum {
-    kTypeEquality,
-    kTypeRange,
-} _mc_fle2_iev_type;
+typedef enum { kTypeEquality, kTypeRange, kTypeText } _mc_fle2_iev_type;
 
 typedef struct {
     _mc_fle2_iev_type type;
@@ -32,11 +31,15 @@ typedef struct {
     _mongocrypt_buffer_t K_Key;
     uint8_t bson_value_type;
     _mongocrypt_buffer_t bson_value;
-    uint8_t edge_count;
+    uint32_t edge_count;
+    uint32_t substr_tag_count;
+    uint32_t suffix_tag_count;
     mc_FLE2TagAndEncryptedMetadataBlock_t *metadata;
 } _mc_fle2_iev_v2_test;
 
 #define kMetadataLen 96U
+#define kMetadataFieldLen 32U
+#define kMinServerEncryptedValueLen 17U // IV(16) + EncryptCTR(1byte)
 
 static void _mc_fle2_iev_v2_test_destroy(_mc_fle2_iev_v2_test *test) {
     _mongocrypt_buffer_cleanup(&test->payload);
@@ -45,13 +48,122 @@ static void _mc_fle2_iev_v2_test_destroy(_mc_fle2_iev_v2_test *test) {
     _mongocrypt_buffer_cleanup(&test->K_KeyId);
     _mongocrypt_buffer_cleanup(&test->K_Key);
     _mongocrypt_buffer_cleanup(&test->bson_value);
-    for (int i = 0; i < test->edge_count; ++i) {
+    for (uint32_t i = 0; i < test->edge_count; ++i) {
         mc_FLE2TagAndEncryptedMetadataBlock_cleanup(&test->metadata[i]);
     }
 
     bson_free(test->metadata);
 }
 
+static _mongocrypt_buffer_t copy_buf(_mongocrypt_buffer_t *src) {
+    _mongocrypt_buffer_t dst;
+    _mongocrypt_buffer_init(&dst);
+    _mongocrypt_buffer_copy_to(src, &dst);
+    return dst;
+}
+
+// Fill out the fields manually with no checks, then serialize.
+static void
+_mc_fle2_iev_v2_test_serialize_payload(mongocrypt_t *crypt, _mc_fle2_iev_v2_test *test, _mongocrypt_buffer_t *payload) {
+    mc_FLE2IndexedEncryptedValueV2_t *iev = mc_FLE2IndexedEncryptedValueV2_new();
+    iev->type = test->type == kTypeEquality ? kFLE2IEVTypeEqualityV2
+              : test->type == kTypeRange    ? kFLE2IEVTypeRangeV2
+                                            : kFLE2IEVTypeText;
+    iev->fle_blob_subtype = test->type == kTypeEquality ? MC_SUBTYPE_FLE2IndexedEqualityEncryptedValueV2
+                          : test->type == kTypeRange    ? MC_SUBTYPE_FLE2IndexedRangeEncryptedValueV2
+                                                        : MC_SUBTYPE_FLE2IndexedTextEncryptedValue;
+    iev->bson_value_type = test->bson_value_type;
+    iev->edge_count = test->edge_count;
+    iev->substr_tag_count = test->substr_tag_count;
+    iev->suffix_tag_count = test->suffix_tag_count;
+    iev->S_KeyId = copy_buf(&test->S_KeyId);
+    _mongocrypt_buffer_init(&iev->ServerEncryptedValue);
+
+    // Encrypt the client value (bson_value) into the SEV
+    // First, encrypt with K_Key -> CEV
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    const _mongocrypt_value_encryption_algorithm_t *fle2v2aead = _mcFLE2v2AEADAlgorithm();
+    const uint32_t ClientEncryptedValueLen = fle2v2aead->get_ciphertext_len(test->bson_value.len, status);
+    ASSERT_OK_STATUS(ClientEncryptedValueLen, status);
+
+    _mongocrypt_buffer_t clientEncryptedValue;
+    _mongocrypt_buffer_init_size(&clientEncryptedValue, ClientEncryptedValueLen);
+
+    _mongocrypt_buffer_t iv;
+    _mongocrypt_buffer_init_size(&iv, MONGOCRYPT_IV_LEN);
+    ASSERT_OK_STATUS(_mongocrypt_random(crypt->crypto, &iv, MONGOCRYPT_IV_LEN, status), status);
+
+    uint32_t bytes_written = 0;
+    ASSERT_OK_STATUS(fle2v2aead->do_encrypt(crypt->crypto,
+                                            &iv,
+                                            &test->K_KeyId,
+                                            &test->K_Key,
+                                            &test->bson_value,
+                                            &clientEncryptedValue,
+                                            &bytes_written,
+                                            status),
+                     status);
+    ASSERT(bytes_written == ClientEncryptedValueLen);
+
+    // Then, add K_Key_Id + CEV -> DSEV
+    _mongocrypt_buffer_t decryptedServerEncryptedValue;
+    _mongocrypt_buffer_init_size(&decryptedServerEncryptedValue, clientEncryptedValue.len + UUID_LEN);
+    memcpy(decryptedServerEncryptedValue.data, test->K_KeyId.data, UUID_LEN);
+    memcpy(decryptedServerEncryptedValue.data + UUID_LEN, clientEncryptedValue.data, clientEncryptedValue.len);
+    // Finally, encrypt DSEV -> SEV
+    /* Get the TokenKey from the last 32 bytes of S_Key */
+    _mongocrypt_buffer_t TokenKey;
+    ASSERT(_mongocrypt_buffer_from_subrange(&TokenKey,
+                                            &test->S_Key,
+                                            test->S_Key.len - MONGOCRYPT_TOKEN_KEY_LEN,
+                                            MONGOCRYPT_TOKEN_KEY_LEN));
+
+    /* Use TokenKey to create ServerDataEncryptionLevel1Token and encrypt
+     * DSEV into ServerEncryptedValue */
+    mc_ServerDataEncryptionLevel1Token_t *token =
+        mc_ServerDataEncryptionLevel1Token_new(crypt->crypto, &TokenKey, status);
+    ASSERT_OK_STATUS(token, status);
+
+    const _mongocrypt_value_encryption_algorithm_t *fle2alg = _mcFLE2Algorithm();
+    const uint32_t ServerEncryptedValueLen = fle2alg->get_ciphertext_len(decryptedServerEncryptedValue.len, status);
+    ASSERT_OK_STATUS(ServerEncryptedValueLen, status);
+
+    _mongocrypt_buffer_resize(&iev->ServerEncryptedValue, ServerEncryptedValueLen);
+    bytes_written = 0;
+    ASSERT_OK_STATUS(fle2alg->do_encrypt(crypt->crypto,
+                                         &iv,
+                                         NULL /* aad */,
+                                         mc_ServerDataEncryptionLevel1Token_get(token),
+                                         &decryptedServerEncryptedValue,
+                                         &iev->ServerEncryptedValue,
+                                         &bytes_written,
+                                         status),
+                     status);
+    ASSERT(bytes_written == ServerEncryptedValueLen);
+
+    // Finally, add metadata, and we have a complete IEV.
+    iev->metadata = bson_malloc0(test->edge_count * sizeof(mc_FLE2TagAndEncryptedMetadataBlock_t));
+    for (uint32_t i = 0; i < test->edge_count; i++) {
+        _mongocrypt_buffer_t tmp_buf;
+        _mongocrypt_buffer_init_size(&tmp_buf, kMetadataLen);
+        memcpy(tmp_buf.data, test->metadata[i].encryptedCount.data, kMetadataFieldLen);
+        memcpy(tmp_buf.data + kMetadataFieldLen, test->metadata[i].tag.data, kMetadataFieldLen);
+        memcpy(tmp_buf.data + kMetadataFieldLen * 2, test->metadata[i].encryptedZeros.data, kMetadataFieldLen);
+
+        ASSERT_OK_STATUS(mc_FLE2TagAndEncryptedMetadataBlock_parse(&iev->metadata[i], &tmp_buf, status), status);
+        _mongocrypt_buffer_cleanup(&tmp_buf);
+    }
+
+    // Now serialize our IEV to the payload.
+    ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_serialize(iev, payload, status), status);
+    mongocrypt_status_destroy(status);
+    _mongocrypt_buffer_cleanup(&clientEncryptedValue);
+    _mongocrypt_buffer_cleanup(&iv);
+    _mongocrypt_buffer_cleanup(&decryptedServerEncryptedValue);
+    mc_ServerDataEncryptionLevel1Token_destroy(token);
+    mc_FLE2IndexedEncryptedValueV2_destroy(iev);
+}
+
 static bool _mc_fle2_iev_v2_test_parse(_mc_fle2_iev_v2_test *test, bson_iter_t *iter) {
     bool hasType = false;
 
@@ -80,6 +192,18 @@ static bool _mc_fle2_iev_v2_test_parse(_mc_fle2_iev_v2_test *test, bson_iter_t *
             int64_t value = bson_iter_as_int64(iter);
             ASSERT_OR_PRINT_MSG((value > 0) && (value < 128), "Field 'bson_value_type' must be 1..127");
             test->bson_value_type = (uint8_t)value;
+        } else if (!strcmp(field, "substr_tag_count")) {
+            ASSERT_OR_PRINT_MSG(!test->substr_tag_count, "Duplicate field 'substr_tag_count'");
+            ASSERT(BSON_ITER_HOLDS_INT32(iter) || BSON_ITER_HOLDS_INT64(iter));
+            int64_t value = bson_iter_as_int64(iter);
+            ASSERT_OR_PRINT_MSG((value >= 0) && (value < UINT32_MAX), "Field 'substr_tag_count' must be 0..2^32-1");
+            test->substr_tag_count = (uint32_t)value;
+        } else if (!strcmp(field, "suffix_tag_count")) {
+            ASSERT_OR_PRINT_MSG(!test->suffix_tag_count, "Duplicate field 'suffix_tag_count'");
+            ASSERT(BSON_ITER_HOLDS_INT32(iter) || BSON_ITER_HOLDS_INT64(iter));
+            int64_t value = bson_iter_as_int64(iter);
+            ASSERT_OR_PRINT_MSG((value >= 0) && (value < UINT32_MAX), "Field 'suffix_tag_count' must be 0..2^32-1");
+            test->suffix_tag_count = (uint32_t)value;
         } else if (!strcmp(field, "type")) {
             ASSERT_OR_PRINT_MSG(!hasType, "Duplicate field 'type'");
             ASSERT(BSON_ITER_HOLDS_UTF8(iter));
@@ -88,6 +212,8 @@ static bool _mc_fle2_iev_v2_test_parse(_mc_fle2_iev_v2_test *test, bson_iter_t *
                 test->type = kTypeEquality;
             } else if (!strcmp(value, "range")) {
                 test->type = kTypeRange;
+            } else if (!strcmp(value, "text")) {
+                test->type = kTypeText;
             } else {
                 TEST_ERROR("Unknown type '%s'", value);
             }
@@ -126,7 +252,7 @@ static bool _mc_fle2_iev_v2_test_parse(_mc_fle2_iev_v2_test *test, bson_iter_t *
 
             // Reinitialize iter and parse each metadata block
             bson_iter_init(&metadata_array_iter, &metadata_array);
-            int i = 0;
+            uint32_t i = 0;
             while (bson_iter_next(&metadata_array_iter)) {
                 ASSERT(BSON_ITER_HOLDS_UTF8(&metadata_array_iter));
 
@@ -165,12 +291,16 @@ static bool _mc_fle2_iev_v2_test_parse(_mc_fle2_iev_v2_test *test, bson_iter_t *
     return true;
 }
 
-static void _mc_fle2_iev_v2_test_run(_mongocrypt_tester_t *tester, _mc_fle2_iev_v2_test *test) {
+static void _mc_fle2_iev_v2_test_run(mongocrypt_t *crypt, _mongocrypt_tester_t *tester, _mc_fle2_iev_v2_test *test) {
     mongocrypt_status_t *status = mongocrypt_status_new();
-    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
 
     mc_FLE2IndexedEncryptedValueV2_t *iev = mc_FLE2IndexedEncryptedValueV2_new();
 
+    if (!test->payload.data) {
+        // This is a self-test; i.e. we serialize the payload from the given fields, parse, and assert sameness.
+        _mc_fle2_iev_v2_test_serialize_payload(crypt, test, &test->payload);
+    }
+
     // Parse payload.
     ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_parse(iev, &test->payload, status), status);
 
@@ -207,18 +337,45 @@ static void _mc_fle2_iev_v2_test_run(_mongocrypt_tester_t *tester, _mc_fle2_iev_
     ASSERT_OK_STATUS(bson_value, status);
     ASSERT_CMPBUF(*bson_value, test->bson_value);
 
-    uint8_t edge_count = 1;
-    if (test->type == kTypeRange) {
+    uint32_t edge_count = 1;
+    if (test->type == kTypeRange || test->type == kTypeText) {
         // Validate edge count
         edge_count = mc_FLE2IndexedEncryptedValueV2_get_edge_count(iev, status);
         ASSERT_OK_STATUS(edge_count, status);
-        ASSERT_CMPINT(edge_count, ==, test->edge_count);
+        ASSERT_CMPUINT32(edge_count, ==, test->edge_count);
+    }
+
+    uint32_t substr_tag_count = 0, suffix_tag_count = 0, prefix_tag_count = 0;
+    if (test->type == kTypeText) {
+        // Validate substr/suffix/prefix tag counts
+        ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_get_substr_tag_count(iev, &substr_tag_count, status), status);
+        ASSERT_CMPUINT32(substr_tag_count, ==, test->substr_tag_count);
+        ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_get_suffix_tag_count(iev, &suffix_tag_count, status), status);
+        ASSERT_CMPUINT32(suffix_tag_count, ==, test->suffix_tag_count);
+        ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_get_prefix_tag_count(iev, &prefix_tag_count, status), status);
+        ASSERT_CMPUINT32(prefix_tag_count, ==, test->edge_count - test->substr_tag_count - test->suffix_tag_count - 1);
     }
 
     // Validate edges/metadata
     mc_FLE2TagAndEncryptedMetadataBlock_t metadata;
-    for (int i = 0; i < edge_count; ++i) {
-        if (test->type == kTypeRange) {
+    for (uint32_t i = 0; i < edge_count; ++i) {
+        if (test->type == kTypeText) {
+            if (i == 0) {
+                ASSERT(mc_FLE2IndexedEncryptedValueV2_get_exact_metadata(iev, &metadata, status));
+            } else if (i < substr_tag_count + 1) {
+                ASSERT(mc_FLE2IndexedEncryptedValueV2_get_substr_metadata(iev, &metadata, i - 1, status));
+            } else if (i < suffix_tag_count + substr_tag_count + 1) {
+                ASSERT(mc_FLE2IndexedEncryptedValueV2_get_suffix_metadata(iev,
+                                                                          &metadata,
+                                                                          i - substr_tag_count - 1,
+                                                                          status));
+            } else {
+                ASSERT(mc_FLE2IndexedEncryptedValueV2_get_prefix_metadata(iev,
+                                                                          &metadata,
+                                                                          i - substr_tag_count - suffix_tag_count - 1,
+                                                                          status));
+            }
+        } else if (test->type == kTypeRange) {
             ASSERT(mc_FLE2IndexedEncryptedValueV2_get_edge(iev, &metadata, i, status));
         } else {
             ASSERT(mc_FLE2IndexedEncryptedValueV2_get_metadata(iev, &metadata, status));
@@ -230,7 +387,6 @@ static void _mc_fle2_iev_v2_test_run(_mongocrypt_tester_t *tester, _mc_fle2_iev_
 
     // All done!
     mc_FLE2IndexedEncryptedValueV2_destroy(iev);
-    mongocrypt_destroy(crypt);
     mongocrypt_status_destroy(status);
 }
 
@@ -293,8 +449,101 @@ static void _mc_fle2_iev_v2_test_explicit_ctx(_mongocrypt_tester_t *tester, _mc_
     mongocrypt_status_destroy(status);
 }
 
-static void test_fle2_iev_v2_test(_mongocrypt_tester_t *tester, const char *path) {
-    printf("Loading test from %s...\n", path);
+static void _mc_fle2_iev_v2_validate(_mongocrypt_tester_t *tester, _mc_fle2_iev_v2_test *test) {
+    mongocrypt_status_t *status = mongocrypt_status_new();
+
+    mc_FLE2IndexedEncryptedValueV2_t *iev = mc_FLE2IndexedEncryptedValueV2_new();
+
+    // Parse payload.
+    ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_parse(iev, &test->payload, status), status);
+
+    // Assert valid IEV.
+    ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_validate(iev, status), status);
+
+    // Modify each value on the IEV to be invalid and assert failure, then change back to valid value.
+    mc_fle_blob_subtype_t temp_fle_blob_subtype = iev->fle_blob_subtype;
+    iev->fle_blob_subtype = MC_SUBTYPE_FLE2UnindexedEncryptedValueV2;
+    ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+    iev->fle_blob_subtype = temp_fle_blob_subtype;
+
+    uint8_t temp_bson_value_type = iev->bson_value_type;
+    iev->bson_value_type = BSON_TYPE_ARRAY;
+    ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+    iev->bson_value_type = temp_bson_value_type;
+
+    uint32_t temp_edge_count = iev->edge_count;
+    iev->edge_count = 0;
+    ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+    iev->edge_count = temp_edge_count;
+    if (test->type == kTypeEquality) {
+        iev->edge_count = 5;
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        iev->edge_count = temp_edge_count;
+    } else if (test->type == kTypeText) {
+        uint32_t temp_substr_count = iev->substr_tag_count;
+        uint32_t temp_suffix_count = iev->suffix_tag_count;
+
+        iev->substr_tag_count = iev->edge_count;
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        iev->substr_tag_count = temp_substr_count;
+
+        iev->suffix_tag_count = iev->edge_count;
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        iev->suffix_tag_count = temp_suffix_count;
+    }
+
+    _mongocrypt_buffer_resize(&iev->ServerEncryptedValue, kMinServerEncryptedValueLen - 1);
+    ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+    _mongocrypt_buffer_resize(&iev->ServerEncryptedValue, kMinServerEncryptedValueLen);
+
+    _mongocrypt_buffer_resize(&iev->S_KeyId, UUID_LEN - 1);
+    ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+    _mongocrypt_buffer_resize(&iev->S_KeyId, UUID_LEN);
+
+    bool temp_CVD = iev->ClientValueDecoded;
+    bool temp_CEVD = iev->ClientEncryptedValueDecoded;
+    iev->ClientValueDecoded = true;
+    iev->ClientEncryptedValueDecoded = false;
+    ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+    iev->ClientValueDecoded = false;
+    _mongocrypt_status_reset(status);
+    ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_validate(iev, status), status);
+    iev->ClientValueDecoded = temp_CVD;
+    iev->ClientEncryptedValueDecoded = temp_CEVD;
+
+    if (iev->ClientEncryptedValueDecoded) {
+        uint32_t temp_DSEV_len = iev->DecryptedServerEncryptedValue.len;
+        _mongocrypt_buffer_resize(&iev->DecryptedServerEncryptedValue, temp_DSEV_len - 1);
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        _mongocrypt_buffer_resize(&iev->DecryptedServerEncryptedValue, temp_DSEV_len);
+
+        uint32_t temp_CEV_len = iev->ClientEncryptedValue.len;
+        _mongocrypt_buffer_resize(&iev->ClientEncryptedValue, temp_CEV_len - 1);
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        _mongocrypt_buffer_resize(&iev->ClientEncryptedValue, temp_CEV_len);
+
+        _mongocrypt_buffer_resize(&iev->K_KeyId, UUID_LEN - 1);
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        _mongocrypt_buffer_resize(&iev->K_KeyId, UUID_LEN);
+    }
+
+    if (iev->ClientValueDecoded) {
+        uint32_t temp_CV_len = iev->ClientValue.len;
+        _mongocrypt_buffer_resize(&iev->ClientValue, temp_CV_len - 1);
+        ASSERT(!mc_FLE2IndexedEncryptedValueV2_validate(iev, status));
+        _mongocrypt_buffer_resize(&iev->ClientValue, temp_CV_len);
+    }
+
+    // IEV should still be valid.
+    _mongocrypt_status_reset(status);
+    ASSERT_OK_STATUS(mc_FLE2IndexedEncryptedValueV2_validate(iev, status), status);
+
+    mc_FLE2IndexedEncryptedValueV2_destroy(iev);
+    mongocrypt_status_destroy(status);
+}
+
+static void test_fle2_iev_v2_test(mongocrypt_t *crypt, _mongocrypt_tester_t *tester, const char *path) {
+    TEST_PRINTF("Loading test from %s...\n", path);
 
     mongocrypt_binary_t *test_bin = TEST_FILE(path);
     if (!test_bin) {
@@ -312,21 +561,34 @@ static void test_fle2_iev_v2_test(_mongocrypt_tester_t *tester, const char *path
     bson_iter_t iter;
     ASSERT(bson_iter_init(&iter, &test_bson));
     ASSERT(_mc_fle2_iev_v2_test_parse(&test, &iter));
-    _mc_fle2_iev_v2_test_run(tester, &test);
+    // Run once with given payload, then run with empty payload (self-test).
+    _mc_fle2_iev_v2_test_run(crypt, tester, &test);
+    _mongocrypt_buffer_cleanup(&test.payload);
+    test.payload.data = NULL;
+    _mc_fle2_iev_v2_test_run(crypt, tester, &test);
+
     _mc_fle2_iev_v2_test_explicit_ctx(tester, &test);
+    _mc_fle2_iev_v2_validate(tester, &test);
     _mc_fle2_iev_v2_test_destroy(&test);
 }
 
 static void test_fle2_iev_v2(_mongocrypt_tester_t *tester) {
     if (!_aes_ctr_is_supported_by_os) {
-        printf("Common Crypto with no CTR support detected. Skipping.");
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
         return;
     }
-
-    // Producted by Server test: (FLECrudTest, insertOneV2)
-    test_fle2_iev_v2_test(tester, "test/data/iev-v2/FLECrudTest-insertOneV2.json");
-    // Producted by Server test: (FLECrudTest, insertOneRangeV2)
-    test_fle2_iev_v2_test(tester, "test/data/iev-v2/FLECrudTest-insertOneRangeV2.json");
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    // Produced by Server test: (FLECrudTest, insertOneV2)
+    test_fle2_iev_v2_test(crypt, tester, "test/data/iev-v2/FLECrudTest-insertOneV2.json");
+    // Produced by Server test: (FLECrudTest, insertOneRangeV2)
+    test_fle2_iev_v2_test(crypt, tester, "test/data/iev-v2/FLECrudTest-insertOneRangeV2.json");
+    // Fields are modified from insertOneRangeV2.json, payload was produced by _mc_fle2_iev_v2_test_serialize_payload in
+    // this test
+    test_fle2_iev_v2_test(crypt, tester, "test/data/iev-v2/FLECrudTest-insertOneText.json");
+    // Fields are modified from insertOneText.json, payload was produced by _mc_fle2_iev_v2_test_serialize_payload in
+    // this test
+    test_fle2_iev_v2_test(crypt, tester, "test/data/iev-v2/FLECrudTest-insertOneTextLarge.json");
+    mongocrypt_destroy(crypt);
 }
 
 void _mongocrypt_tester_install_fle2_iev_v2_payloads(_mongocrypt_tester_t *tester) {

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-iev.c

@@ -171,7 +171,7 @@ static void test_FLE2IndexedEqualityEncryptedValue_decrypt(_mongocrypt_tester_t
     mongocrypt_t *crypt;
 
     if (!_aes_ctr_is_supported_by_os) {
-        printf("Common Crypto with no CTR support detected. Skipping.");
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
         return;
     }
 

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-iup-v2.c

@@ -107,7 +107,7 @@ static void _test_mc_FLE2InsertUpdatePayloadV2_decrypt(_mongocrypt_tester_t *tes
     mongocrypt_t *crypt;
 
     if (!_aes_ctr_is_supported_by_os) {
-        printf("Common Crypto with no CTR support detected. Skipping.");
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
         return;
     }
 
@@ -242,9 +242,31 @@ static void _test_mc_FLE2InsertUpdatePayloadV2_parses_crypto_params(_mongocrypt_
     mc_FLE2InsertUpdatePayloadV2_cleanup(&got);
 }
 
+static void _test_mc_FLE2InsertUpdatePayloadV2_parse_errors(_mongocrypt_tester_t *tester) {
+    bson_t *input_bson = TMP_BSON(BSON_STR({
+        "d" : {"$binary" : {"base64" : "AAAA", "subType" : "00"}}, //
+        "t" : "wrong type!"
+    }));
+    _mongocrypt_buffer_t input_buf;
+    _mongocrypt_buffer_init_size(&input_buf, 1 + input_bson->len);
+    input_buf.data[0] = (uint8_t)MC_SUBTYPE_FLE2InsertUpdatePayloadV2;
+    memcpy(input_buf.data + 1, bson_get_data(input_bson), input_bson->len);
+
+    mc_FLE2InsertUpdatePayloadV2_t payload;
+    mc_FLE2InsertUpdatePayloadV2_init(&payload);
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    ASSERT_FAILS_STATUS(mc_FLE2InsertUpdatePayloadV2_parse(&payload, &input_buf, status),
+                        status,
+                        "Field 't' expected to hold an int32");
+    mc_FLE2InsertUpdatePayloadV2_cleanup(&payload);
+    mongocrypt_status_destroy(status);
+    _mongocrypt_buffer_cleanup(&input_buf);
+}
+
 void _mongocrypt_tester_install_fle2_payload_iup_v2(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_FLE2InsertUpdatePayloadV2_parse);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_decrypt);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_includes_crypto_params);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_parses_crypto_params);
+    INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_parse_errors);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-iup.c

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include "mc-fle-blob-subtype-private.h"
 #include "mc-fle2-insert-update-payload-private.h"
 #include "test-mongocrypt.h"
 
@@ -100,7 +101,7 @@ static void test_FLE2InsertUpdatePayload_decrypt(_mongocrypt_tester_t *tester) {
     mongocrypt_t *crypt;
 
     if (!_aes_ctr_is_supported_by_os) {
-        printf("Common Crypto with no CTR support detected. Skipping.");
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
         return;
     }
 
@@ -160,7 +161,29 @@ static void test_FLE2InsertUpdatePayload_decrypt(_mongocrypt_tester_t *tester) {
 
 #undef TEST_IUP_HEX
 
+static void test_FLE2InsertUpdatePayload_parse_errors(_mongocrypt_tester_t *tester) {
+    bson_t *input_bson = TMP_BSON(BSON_STR({
+        "d" : {"$binary" : {"base64" : "AAAA", "subType" : "00"}}, //
+        "t" : "wrong type!"
+    }));
+    _mongocrypt_buffer_t input_buf;
+    _mongocrypt_buffer_init_size(&input_buf, 1 + input_bson->len);
+    input_buf.data[0] = (uint8_t)MC_SUBTYPE_FLE2InsertUpdatePayload;
+    memcpy(input_buf.data + 1, bson_get_data(input_bson), input_bson->len);
+
+    mc_FLE2InsertUpdatePayload_t payload;
+    mc_FLE2InsertUpdatePayload_init(&payload);
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    ASSERT_FAILS_STATUS(mc_FLE2InsertUpdatePayload_parse(&payload, &input_buf, status),
+                        status,
+                        "Field 't' expected to hold an int32");
+    mc_FLE2InsertUpdatePayload_cleanup(&payload);
+    mongocrypt_status_destroy(status);
+    _mongocrypt_buffer_cleanup(&input_buf);
+}
+
 void _mongocrypt_tester_install_fle2_payload_iup(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(test_FLE2InsertUpdatePayload_parse);
     INSTALL_TEST(test_FLE2InsertUpdatePayload_decrypt);
+    INSTALL_TEST(test_FLE2InsertUpdatePayload_parse_errors);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-uev.c

@@ -125,7 +125,7 @@ static void test_FLE2UnindexedEncryptedValue_decrypt(_mongocrypt_tester_t *teste
     mongocrypt_t *crypt;
 
     if (!_aes_ctr_is_supported_by_os) {
-        printf("Common Crypto with no CTR support detected. Skipping.");
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
         return;
     }
 
@@ -201,7 +201,7 @@ static void test_FLE2UnindexedEncryptedValue_decrypt(_mongocrypt_tester_t *teste
 
 static void test_FLE2UnindexedEncryptedValue_encrypt(_mongocrypt_tester_t *tester) {
     if (!_aes_ctr_is_supported_by_os) {
-        printf("Common Crypto with no CTR support detected. Skipping.");
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
         return;
     }
 

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-rfds.c

@@ -92,7 +92,7 @@ static void test_mc_FLE2RangeFindDriverSpec_parse(_mongocrypt_tester_t *tester)
         testcase *test = tests + i;
         mongocrypt_status_t *status = mongocrypt_status_new();
         mc_FLE2RangeFindDriverSpec_t rfds;
-        printf("running subtest: %s\n", test->desc);
+        TEST_PRINTF("running subtest: %s\n", test->desc);
         bool ret = mc_FLE2RangeFindDriverSpec_parse(&rfds, TMP_BSON(test->in), status);
         if (!test->expectError) {
             ASSERT_OK_STATUS(ret, status);
@@ -329,7 +329,7 @@ static void test_mc_FLE2RangeFindDriverSpec_to_placeholders(_mongocrypt_tester_t
 
     for (size_t i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
         testcase_t *test = tests + i;
-        printf("running subtest: %s : %s\n", test->desc, test->in);
+        TEST_PRINTF("running subtest: %s : %s\n", test->desc, test->in);
         ASSERT_OK_STATUS(mc_FLE2RangeFindDriverSpec_parse(&spec, TMP_BSON(test->in), status), status);
 
         // Create the expected document.

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-tag-and-encrypted-metadata-block.c

@@ -49,8 +49,43 @@ static void _test_mc_FLE2TagAndEncryptedMetadataBlock_roundtrip(_mongocrypt_test
     _mongocrypt_buffer_cleanup(&output);
 }
 
+static void _test_mc_FLE2TagAndEncryptedMetadataBlock_validate(_mongocrypt_tester_t *tester) {
+    _mongocrypt_buffer_t input;
+    _mongocrypt_buffer_copy_from_hex(&input, TEST_TAG_AND_ENCRYPTED_METADATA_BLOCK);
+
+    mongocrypt_status_t *status = mongocrypt_status_new();
+
+    mc_FLE2TagAndEncryptedMetadataBlock_t metadata;
+    mc_FLE2TagAndEncryptedMetadataBlock_init(&metadata);
+
+    // Parse into metadata struct.
+    ASSERT_OK_STATUS(mc_FLE2TagAndEncryptedMetadataBlock_parse(&metadata, &input, status), status);
+
+    ASSERT_OK_STATUS(mc_FLE2TagAndEncryptedMetadataBlock_validate(&metadata, status), status);
+
+    // Modify each value on the metadata block to be invalid and assert failure, then change back to valid value.
+    _mongocrypt_buffer_resize(&metadata.encryptedCount, kFieldLen - 1);
+    ASSERT(!mc_FLE2TagAndEncryptedMetadataBlock_validate(&metadata, status));
+    _mongocrypt_buffer_resize(&metadata.encryptedCount, kFieldLen);
+
+    _mongocrypt_buffer_resize(&metadata.tag, kFieldLen - 1);
+    ASSERT(!mc_FLE2TagAndEncryptedMetadataBlock_validate(&metadata, status));
+    _mongocrypt_buffer_resize(&metadata.tag, kFieldLen);
+
+    _mongocrypt_buffer_resize(&metadata.encryptedZeros, kFieldLen - 1);
+    ASSERT(!mc_FLE2TagAndEncryptedMetadataBlock_validate(&metadata, status));
+    _mongocrypt_buffer_resize(&metadata.encryptedZeros, kFieldLen);
+
+    // Metadata block should be valid.
+    ASSERT(mc_FLE2TagAndEncryptedMetadataBlock_validate(&metadata, status));
+    _mongocrypt_buffer_cleanup(&input);
+    mc_FLE2TagAndEncryptedMetadataBlock_cleanup(&metadata);
+    mongocrypt_status_destroy(status);
+}
+
 #undef TEST_TAG_AND_ENCRYPTED_METADATA_BLOCK
 
 void _mongocrypt_tester_install_fle2_tag_and_encrypted_metadata_block(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_mc_FLE2TagAndEncryptedMetadataBlock_roundtrip);
-}
+    INSTALL_TEST(_test_mc_FLE2TagAndEncryptedMetadataBlock_validate);
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mc-range-edge-generation.c

@@ -38,20 +38,19 @@ typedef struct {
 #undef MAX_INT32_EDGES
 
 static void print_edges_compared(mc_edges_t *edgesGot, const char *const *edgesExpected) {
-    fflush(stdout); // Avoid incomplete stdout output from prior tests on error
-    fprintf(stderr, "edges got ... begin\n");
+    TEST_STDERR_PRINTF("edges got ... begin\n");
     for (size_t i = 0; i < mc_edges_len(edgesGot); i++) {
-        fprintf(stderr, "  %s\n", mc_edges_get(edgesGot, i));
+        TEST_STDERR_PRINTF("  %s\n", mc_edges_get(edgesGot, i));
     }
-    fprintf(stderr, "edges got ... end\n");
+    TEST_STDERR_PRINTF("edges got ... end\n");
 
-    fprintf(stderr, "edges expected ... begin\n");
+    TEST_STDERR_PRINTF("edges expected ... begin\n");
     const char *const *iter = edgesExpected;
     while (*iter != NULL) {
-        fprintf(stderr, "  %s\n", *iter);
+        TEST_STDERR_PRINTF("  %s\n", *iter);
         iter++;
     }
-    fprintf(stderr, "edges expected ... end\n");
+    TEST_STDERR_PRINTF("edges expected ... end\n");
 }
 
 static void _test_getEdgesInt32(_mongocrypt_tester_t *tester) {