libmongocrypt-helper 1.13.2.0.1001 → 1.14.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mc-reader-private.h

@@ -25,7 +25,7 @@
  * A non-owning forward-only cursor api to read a buffer.
  *
  * Tracks length of buffer and current position of buffer. parser_name is
- * typically __FUNCTION__ to provide useful error messages automatically.
+ * typically __func__ to provide useful error messages automatically.
  *
  * All numbers are read as little endian.
  *
@@ -37,7 +37,7 @@
  *  mongocrypt_status_t *status
  *
  *  mc_reader_t reader;
- *  mc_reader_init_from_buffer (&reader, buf, __FUNCTION__);
+ *  mc_reader_init_from_buffer (&reader, buf, __func__);
  *
  *  _mongocrypt_buffer_t in;
  *  if (!mc_reader_read_uuid_buffer (&reader, &in, status)) {

data/ext/libmongocrypt/libmongocrypt/src/mc-reader.c

@@ -21,7 +21,8 @@
 #define CHECK_AND_RETURN(x)                                                                                            \
     if (!(x)) {                                                                                                        \
         return false;                                                                                                  \
-    }
+    } else                                                                                                             \
+        ((void)0)
 
 #define CHECK_REMAINING_BUFFER_AND_RET(read_size)                                                                      \
     if ((reader->pos + (read_size)) > reader->len) {                                                                   \
@@ -31,7 +32,8 @@
                    reader->pos + (read_size),                                                                          \
                    reader->len);                                                                                       \
         return false;                                                                                                  \
-    }
+    } else                                                                                                             \
+        ((void)0)
 
 void mc_reader_init(mc_reader_t *reader, const uint8_t *ptr, uint64_t len, const char *parser_name) {
     BSON_ASSERT_PARAM(reader);

data/ext/libmongocrypt/libmongocrypt/src/mc-schema-broker-private.h

@@ -34,9 +34,6 @@ mc_schema_broker_t *mc_schema_broker_new(void);
 
 void mc_schema_broker_destroy(mc_schema_broker_t *sb);
 
-// mc_schema_broker_use_rangev2 enables rangev2 behavior. TODO(MONGOCRYPT-711) remove once rangev1 code is removed.
-void mc_schema_broker_use_rangev2(mc_schema_broker_t *sb);
-
 // mc_schema_broker_request requests a schema for a collection. Ignores duplicates.
 // Returns error if two requests have different databases (not-yet supported).
 bool mc_schema_broker_request(mc_schema_broker_t *sb, const char *db, const char *coll, mongocrypt_status_t *status);

data/ext/libmongocrypt/libmongocrypt/src/mc-schema-broker.c

@@ -50,18 +50,12 @@ struct mc_schema_broker_t {
     char *db; // Database shared by all schemas.
     mc_schema_entry_t *ll;
     size_t ll_len;
-    bool use_range_v2;
 };
 
 mc_schema_broker_t *mc_schema_broker_new(void) {
     return bson_malloc0(sizeof(mc_schema_broker_t));
 }
 
-void mc_schema_broker_use_rangev2(mc_schema_broker_t *sb) {
-    BSON_ASSERT_PARAM(sb);
-    sb->use_range_v2 = true;
-}
-
 bool mc_schema_broker_request(mc_schema_broker_t *sb, const char *db, const char *coll, mongocrypt_status_t *status) {
     BSON_ASSERT_PARAM(sb);
     BSON_ASSERT_PARAM(db);
@@ -208,7 +202,6 @@ static inline bool mc_schema_entry_satisfy_from_collinfo(mc_schema_entry_t *se,
                                                          const bson_t *collinfo,
                                                          const char *coll,
                                                          const char *db,
-                                                         bool use_range_v2,
                                                          mongocrypt_status_t *status) {
     BSON_ASSERT_PARAM(se);
     BSON_ASSERT_PARAM(collinfo);
@@ -255,7 +248,7 @@ static inline bool mc_schema_entry_satisfy_from_collinfo(mc_schema_entry_t *se,
             return false;
         }
 
-        if (!mc_EncryptedFieldConfig_parse(&se->encryptedFields.efc, &se->encryptedFields.bson, status, use_range_v2)) {
+        if (!mc_EncryptedFieldConfig_parse(&se->encryptedFields.efc, &se->encryptedFields.bson, status)) {
             return false;
         }
         se->encryptedFields.set = true;
@@ -351,7 +344,7 @@ bool mc_schema_broker_satisfy_from_collinfo(mc_schema_broker_t *sb,
         }
     }
 
-    if (!mc_schema_entry_satisfy_from_collinfo(se, collinfo, coll, sb->db, sb->use_range_v2, status)) {
+    if (!mc_schema_entry_satisfy_from_collinfo(se, collinfo, coll, sb->db, status)) {
         return false;
     }
 
@@ -426,10 +419,7 @@ bool mc_schema_broker_satisfy_from_encryptedFieldsMap(mc_schema_broker_t *sb,
                 goto loop_fail;
             }
 
-            if (!mc_EncryptedFieldConfig_parse(&it->encryptedFields.efc,
-                                               &it->encryptedFields.bson,
-                                               status,
-                                               sb->use_range_v2)) {
+            if (!mc_EncryptedFieldConfig_parse(&it->encryptedFields.efc, &it->encryptedFields.bson, status)) {
                 goto loop_fail;
             }
 
@@ -473,7 +463,7 @@ bool mc_schema_broker_satisfy_from_cache(mc_schema_broker_t *sb,
             goto loop_skip;
         }
 
-        if (!mc_schema_entry_satisfy_from_collinfo(it, collinfo, sb->db, it->coll, sb->use_range_v2, status)) {
+        if (!mc_schema_entry_satisfy_from_collinfo(it, collinfo, sb->db, it->coll, status)) {
             goto loop_fail;
         }
 

data/ext/libmongocrypt/libmongocrypt/src/mc-str-encode-string-sets-private.h

@@ -92,4 +92,4 @@ void mc_substring_set_iter_init(mc_substring_set_iter_t *it, mc_substring_set_t
 // true otherwise.
 bool mc_substring_set_iter_next(mc_substring_set_iter_t *it, const char **str, uint32_t *byte_len, uint32_t *count);
 
-#endif
+#endif

data/ext/libmongocrypt/libmongocrypt/src/mc-str-encode-string-sets.c

@@ -166,8 +166,8 @@ static void mc_substring_set_node_destroy(mc_substring_set_node_t *node) {
 }
 
 // FNV-1a hash function
-const uint32_t FNV1APRIME = 16777619;
-const uint32_t FNV1ABASIS = 2166136261;
+static const uint32_t FNV1APRIME = 16777619;
+static const uint32_t FNV1ABASIS = 2166136261;
 
 static uint32_t fnv1a(const uint8_t *data, uint32_t len) {
     BSON_ASSERT_PARAM(data);
@@ -301,4 +301,4 @@ bool mc_substring_set_iter_next(mc_substring_set_iter_t *it, const char **str, u
     }
     it->cur_node = (void *)cur->next;
     return true;
-}
+}

data/ext/libmongocrypt/libmongocrypt/src/mc-text-search-str-encode-private.h

@@ -42,4 +42,11 @@ mc_str_encode_sets_t *mc_text_search_str_encode(const mc_FLE2TextSearchInsertSpe
 
 void mc_str_encode_sets_destroy(mc_str_encode_sets_t *sets);
 
-#endif /* MONGOCRYPT_TEXT_SEARCH_STR_ENCODE_PRIVATE_H */
+// Applies case/diacritic folding to the string value in spec (if applicable), and returns
+// the resulting string as a BSON string element in *out. Returns false and an error if the string
+// is not valid UTF-8 or is unsuitable per the query parameters in the spec.
+bool mc_text_search_str_query(const mc_FLE2TextSearchInsertSpec_t *spec,
+                              _mongocrypt_buffer_t *out,
+                              mongocrypt_status_t *status);
+
+#endif /* MONGOCRYPT_TEXT_SEARCH_STR_ENCODE_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-text-search-str-encode.c

@@ -14,9 +14,11 @@
  * limitations under the License.
  */
 
+#include "mc-fle2-encryption-placeholder-private.h"
 #include "mc-str-encode-string-sets-private.h"
 #include "mc-text-search-str-encode-private.h"
 #include "mongocrypt-buffer-private.h"
+#include "mongocrypt-crypto-private.h"
 #include "mongocrypt.h"
 #include "unicode/fold.h"
 #include <bson/bson.h>
@@ -181,7 +183,7 @@ mc_str_encode_sets_t *mc_text_search_str_encode(const mc_FLE2TextSearchInsertSpe
                                                 mongocrypt_status_t *status) {
     BSON_ASSERT_PARAM(spec);
     if (spec->len > MAX_ENCODE_BYTE_LEN) {
-        CLIENT_ERR("StrEncode: String passed in was too long: String was %u bytes, but max is %u bytes",
+        CLIENT_ERR("StrEncode: String passed in was too long: String was %" PRIu32 " bytes, but max is %d bytes",
                    spec->len,
                    MAX_ENCODE_BYTE_LEN);
         return NULL;
@@ -245,4 +247,78 @@ void mc_str_encode_sets_destroy(mc_str_encode_sets_t *sets) {
     mc_affix_set_destroy(sets->prefix_set);
     mc_substring_set_destroy(sets->substring_set);
     bson_free(sets);
-}
+}
+
+bool mc_text_search_str_query(const mc_FLE2TextSearchInsertSpec_t *spec,
+                              _mongocrypt_buffer_t *out,
+                              mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(spec);
+    BSON_ASSERT_PARAM(out);
+
+    if (spec->len > MAX_ENCODE_BYTE_LEN) {
+        CLIENT_ERR("StrQuery: String passed in was too long: String was %" PRIu32 " bytes, but max is %d bytes",
+                   spec->len,
+                   MAX_ENCODE_BYTE_LEN);
+        return false;
+    }
+
+    _mongocrypt_buffer_init(out);
+    if (!bson_utf8_validate(spec->v, spec->len, false /* allow_null */)) {
+        CLIENT_ERR("StrQuery: String passed in was not valid UTF-8");
+        return false;
+    }
+
+    uint32_t folded_codepoint_len = 0;
+
+    if (spec->casef || spec->diacf) {
+        char *folded_str;
+        size_t folded_str_bytes_len;
+        if (!unicode_fold(spec->v,
+                          spec->len,
+                          (spec->casef * kUnicodeFoldToLower) | (spec->diacf * kUnicodeFoldRemoveDiacritics),
+                          &folded_str,
+                          &folded_str_bytes_len,
+                          status)) {
+            return false;
+        }
+        _mongocrypt_buffer_copy_from_string_as_bson_value(out, folded_str, (int)folded_str_bytes_len);
+        folded_codepoint_len = mc_get_utf8_codepoint_length(folded_str, (uint32_t)folded_str_bytes_len);
+        bson_free(folded_str);
+    } else {
+        _mongocrypt_buffer_copy_from_string_as_bson_value(out, spec->v, (int)spec->len);
+        folded_codepoint_len = mc_get_utf8_codepoint_length(spec->v, spec->len);
+    }
+
+    if (spec->substr.set || spec->suffix.set || spec->prefix.set) {
+        uint32_t min = 0, max = 0;
+        if (spec->substr.set) {
+            min = spec->substr.value.lb;
+            max = spec->substr.value.ub;
+        } else if (spec->suffix.set) {
+            min = spec->suffix.value.lb;
+            max = spec->suffix.value.ub;
+        } else {
+            min = spec->prefix.value.lb;
+            max = spec->prefix.value.ub;
+        }
+        if (folded_codepoint_len == 0) {
+            CLIENT_ERR("StrQuery: string value cannot be empty for substring, suffix, or prefix queries");
+            return false;
+        }
+        if (folded_codepoint_len > max) {
+            CLIENT_ERR("StrQuery: string value was longer than the maximum query length "
+                       "for this field after folding -- folded codepoint len: %u, max query len: %u",
+                       folded_codepoint_len,
+                       max);
+            return false;
+        }
+        if (folded_codepoint_len < min) {
+            CLIENT_ERR("StrQuery: string value was shorter than the minimum query length "
+                       "for this field after folding -- folded codepoint len: %u, min query len: %u",
+                       folded_codepoint_len,
+                       min);
+            return false;
+        }
+    }
+    return true;
+}

data/ext/libmongocrypt/libmongocrypt/src/mc-tokens-private.h

@@ -197,38 +197,56 @@ DECL_TOKEN_TYPE(mc_ServerTextSuffixToken,
 DECL_TOKEN_TYPE(mc_ServerTextPrefixToken,
                 const mc_ServerTokenDerivationLevel1Token_t *serverTokenDerivationLevel1Token);
 
-DECL_TOKEN_TYPE(mc_EDCTextExactDerivedFromDataTokenAndContentionFactorToken,
+DECL_TOKEN_TYPE(mc_EDCTextExactDerivedFromDataToken,
                 const mc_EDCTextExactToken_t *edcTextExactToken,
-                const _mongocrypt_buffer_t *v,
+                const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_EDCTextSubstringDerivedFromDataToken,
+                const mc_EDCTextSubstringToken_t *edcTextSubstringToken,
+                const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_EDCTextSuffixDerivedFromDataToken,
+                const mc_EDCTextSuffixToken_t *edcTextSuffixToken,
+                const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_EDCTextPrefixDerivedFromDataToken,
+                const mc_EDCTextPrefixToken_t *edcTextPrefixToken,
+                const _mongocrypt_buffer_t *v);
+
+DECL_TOKEN_TYPE(mc_EDCTextExactDerivedFromDataTokenAndContentionFactorToken,
+                const mc_EDCTextExactDerivedFromDataToken_t *edcTextExactToken,
                 uint64_t u);
 DECL_TOKEN_TYPE(mc_EDCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
-                const mc_EDCTextSubstringToken_t *edcTextSubstringToken,
-                const _mongocrypt_buffer_t *v,
+                const mc_EDCTextSubstringDerivedFromDataToken_t *edcTextSubstringToken,
                 uint64_t u);
 DECL_TOKEN_TYPE(mc_EDCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
-                const mc_EDCTextSuffixToken_t *edcTextSuffixToken,
-                const _mongocrypt_buffer_t *v,
+                const mc_EDCTextSuffixDerivedFromDataToken_t *edcTextSuffixToken,
                 uint64_t u);
 DECL_TOKEN_TYPE(mc_EDCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
-                const mc_EDCTextPrefixToken_t *edcTextPrefixToken,
-                const _mongocrypt_buffer_t *v,
+                const mc_EDCTextPrefixDerivedFromDataToken_t *edcTextPrefixToken,
                 uint64_t u);
 
-DECL_TOKEN_TYPE(mc_ESCTextExactDerivedFromDataTokenAndContentionFactorToken,
+DECL_TOKEN_TYPE(mc_ESCTextExactDerivedFromDataToken,
                 const mc_ESCTextExactToken_t *escTextExactToken,
-                const _mongocrypt_buffer_t *v,
+                const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_ESCTextSubstringDerivedFromDataToken,
+                const mc_ESCTextSubstringToken_t *escTextSubstringToken,
+                const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_ESCTextSuffixDerivedFromDataToken,
+                const mc_ESCTextSuffixToken_t *escTextSuffixToken,
+                const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_ESCTextPrefixDerivedFromDataToken,
+                const mc_ESCTextPrefixToken_t *escTextPrefixToken,
+                const _mongocrypt_buffer_t *v);
+
+DECL_TOKEN_TYPE(mc_ESCTextExactDerivedFromDataTokenAndContentionFactorToken,
+                const mc_ESCTextExactDerivedFromDataToken_t *escTextExactToken,
                 uint64_t u);
 DECL_TOKEN_TYPE(mc_ESCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
-                const mc_ESCTextSubstringToken_t *escTextSubstringToken,
-                const _mongocrypt_buffer_t *v,
+                const mc_ESCTextSubstringDerivedFromDataToken_t *escTextSubstringToken,
                 uint64_t u);
 DECL_TOKEN_TYPE(mc_ESCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
-                const mc_ESCTextSuffixToken_t *escTextSuffixToken,
-                const _mongocrypt_buffer_t *v,
+                const mc_ESCTextSuffixDerivedFromDataToken_t *escTextSuffixToken,
                 uint64_t u);
 DECL_TOKEN_TYPE(mc_ESCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
-                const mc_ESCTextPrefixToken_t *escTextPrefixToken,
-                const _mongocrypt_buffer_t *v,
+                const mc_ESCTextPrefixDerivedFromDataToken_t *escTextPrefixToken,
                 uint64_t u);
 
 DECL_TOKEN_TYPE(mc_ServerTextExactDerivedFromDataToken,

data/ext/libmongocrypt/libmongocrypt/src/mc-tokens.c

@@ -168,7 +168,7 @@ IMPL_TOKEN_NEW_CONST(mc_ServerZerosEncryptionToken, mc_ServerDerivedFromDataToke
 
 // d = 17 bytes of 0, AnchorPaddingTokenRoot = HMAC(ESCToken, d)
 #define ANCHOR_PADDING_TOKEN_D_LENGTH 17
-const uint8_t mc_AnchorPaddingTokenDValue[ANCHOR_PADDING_TOKEN_D_LENGTH] =
+static const uint8_t mc_AnchorPaddingTokenDValue[ANCHOR_PADDING_TOKEN_D_LENGTH] =
     {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 
 DEF_TOKEN_TYPE(mc_AnchorPaddingTokenRoot, const mc_ESCToken_t *ESCToken) {
@@ -233,97 +233,89 @@ IMPL_TOKEN_NEW_CONST(mc_ServerTextPrefixToken,
                      mc_ServerTokenDerivationLevel1Token_get(serverTokenDerivationLevel1Token),
                      TEXT_PREFIX_ID)
 
-#define IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(Name, Key, BufferArg, UintArg)                                         \
-    {                                                                                                                  \
-        BSON_CONCAT(Name, _t) *t = bson_malloc(sizeof(BSON_CONCAT(Name, _t)));                                         \
-        _mongocrypt_buffer_t tmp;                                                                                      \
-        _mongocrypt_buffer_init(&tmp);                                                                                 \
-        _mongocrypt_buffer_resize(&tmp, MONGOCRYPT_HMAC_SHA256_LEN);                                                   \
-        _mongocrypt_buffer_init(&t->data);                                                                             \
-        _mongocrypt_buffer_resize(&t->data, MONGOCRYPT_HMAC_SHA256_LEN);                                               \
-        if (!_mongocrypt_hmac_sha_256(crypto, Key, BufferArg, &tmp, status)) {                                         \
-            BSON_CONCAT(Name, _destroy)(t);                                                                            \
-            _mongocrypt_buffer_cleanup(&tmp);                                                                          \
-            return NULL;                                                                                               \
-        }                                                                                                              \
-        _mongocrypt_buffer_t uint_arg;                                                                                 \
-        _mongocrypt_buffer_copy_from_uint64_le(&uint_arg, UintArg);                                                    \
-        if (!_mongocrypt_hmac_sha_256(crypto, &tmp, &uint_arg, &t->data, status)) {                                    \
-            BSON_CONCAT(Name, _destroy)(t);                                                                            \
-            _mongocrypt_buffer_cleanup(&tmp);                                                                          \
-            _mongocrypt_buffer_cleanup(&uint_arg);                                                                     \
-            return NULL;                                                                                               \
-        }                                                                                                              \
-        _mongocrypt_buffer_cleanup(&tmp);                                                                              \
-        _mongocrypt_buffer_cleanup(&uint_arg);                                                                         \
-        return t;                                                                                                      \
-    }
+DEF_TOKEN_TYPE(mc_EDCTextExactDerivedFromDataToken,
+               const mc_EDCTextExactToken_t *edcTextExactToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_EDCTextExactDerivedFromDataToken, mc_EDCTextExactToken_get(edcTextExactToken), v)
+DEF_TOKEN_TYPE(mc_EDCTextSubstringDerivedFromDataToken,
+               const mc_EDCTextSubstringToken_t *edcTextSubstringToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_EDCTextSubstringDerivedFromDataToken, mc_EDCTextSubstringToken_get(edcTextSubstringToken), v)
+DEF_TOKEN_TYPE(mc_EDCTextSuffixDerivedFromDataToken,
+               const mc_EDCTextSuffixToken_t *edcTextSuffixToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_EDCTextSuffixDerivedFromDataToken, mc_EDCTextSuffixToken_get(edcTextSuffixToken), v)
+DEF_TOKEN_TYPE(mc_EDCTextPrefixDerivedFromDataToken,
+               const mc_EDCTextPrefixToken_t *edcTextPrefixToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_EDCTextPrefixDerivedFromDataToken, mc_EDCTextPrefixToken_get(edcTextPrefixToken), v)
 
 DEF_TOKEN_TYPE(mc_EDCTextExactDerivedFromDataTokenAndContentionFactorToken,
-               const mc_EDCTextExactToken_t *edcTextExactToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_EDCTextExactDerivedFromDataToken_t *edcTextExactToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_EDCTextExactDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_EDCTextExactToken_get(edcTextExactToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_EDCTextExactDerivedFromDataTokenAndContentionFactorToken,
+                     mc_EDCTextExactDerivedFromDataToken_get(edcTextExactToken),
+                     u)
 DEF_TOKEN_TYPE(mc_EDCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
-               const mc_EDCTextSubstringToken_t *edcTextSubstringToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_EDCTextSubstringDerivedFromDataToken_t *edcTextSubstringToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_EDCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_EDCTextSubstringToken_get(edcTextSubstringToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_EDCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
+                     mc_EDCTextSubstringDerivedFromDataToken_get(edcTextSubstringToken),
+                     u)
 DEF_TOKEN_TYPE(mc_EDCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
-               const mc_EDCTextSuffixToken_t *edcTextSuffixToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_EDCTextSuffixDerivedFromDataToken_t *edcTextSuffixToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_EDCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_EDCTextSuffixToken_get(edcTextSuffixToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_EDCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
+                     mc_EDCTextSuffixDerivedFromDataToken_get(edcTextSuffixToken),
+                     u)
 DEF_TOKEN_TYPE(mc_EDCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
-               const mc_EDCTextPrefixToken_t *edcTextPrefixToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_EDCTextPrefixDerivedFromDataToken_t *edcTextPrefixToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_EDCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_EDCTextPrefixToken_get(edcTextPrefixToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_EDCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
+                     mc_EDCTextPrefixDerivedFromDataToken_get(edcTextPrefixToken),
+                     u)
 
-DEF_TOKEN_TYPE(mc_ESCTextExactDerivedFromDataTokenAndContentionFactorToken,
+DEF_TOKEN_TYPE(mc_ESCTextExactDerivedFromDataToken,
                const mc_ESCTextExactToken_t *escTextExactToken,
-               const _mongocrypt_buffer_t *v,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_ESCTextExactDerivedFromDataToken, mc_ESCTextExactToken_get(escTextExactToken), v)
+DEF_TOKEN_TYPE(mc_ESCTextSubstringDerivedFromDataToken,
+               const mc_ESCTextSubstringToken_t *escTextSubstringToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_ESCTextSubstringDerivedFromDataToken, mc_ESCTextSubstringToken_get(escTextSubstringToken), v)
+DEF_TOKEN_TYPE(mc_ESCTextSuffixDerivedFromDataToken,
+               const mc_ESCTextSuffixToken_t *escTextSuffixToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_ESCTextSuffixDerivedFromDataToken, mc_ESCTextSuffixToken_get(escTextSuffixToken), v)
+DEF_TOKEN_TYPE(mc_ESCTextPrefixDerivedFromDataToken,
+               const mc_ESCTextPrefixToken_t *escTextPrefixToken,
+               const _mongocrypt_buffer_t *v)
+IMPL_TOKEN_NEW(mc_ESCTextPrefixDerivedFromDataToken, mc_ESCTextPrefixToken_get(escTextPrefixToken), v)
+
+DEF_TOKEN_TYPE(mc_ESCTextExactDerivedFromDataTokenAndContentionFactorToken,
+               const mc_ESCTextExactDerivedFromDataToken_t *escTextExactToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_ESCTextExactDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_ESCTextExactToken_get(escTextExactToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_ESCTextExactDerivedFromDataTokenAndContentionFactorToken,
+                     mc_ESCTextExactDerivedFromDataToken_get(escTextExactToken),
+                     u)
 DEF_TOKEN_TYPE(mc_ESCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
-               const mc_ESCTextSubstringToken_t *escTextSubstringToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_ESCTextSubstringDerivedFromDataToken_t *escTextSubstringToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_ESCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_ESCTextSubstringToken_get(escTextSubstringToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_ESCTextSubstringDerivedFromDataTokenAndContentionFactorToken,
+                     mc_ESCTextSubstringDerivedFromDataToken_get(escTextSubstringToken),
+                     u)
 DEF_TOKEN_TYPE(mc_ESCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
-               const mc_ESCTextSuffixToken_t *escTextSuffixToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_ESCTextSuffixDerivedFromDataToken_t *escTextSuffixToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_ESCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_ESCTextSuffixToken_get(escTextSuffixToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_ESCTextSuffixDerivedFromDataTokenAndContentionFactorToken,
+                     mc_ESCTextSuffixDerivedFromDataToken_get(escTextSuffixToken),
+                     u)
 DEF_TOKEN_TYPE(mc_ESCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
-               const mc_ESCTextPrefixToken_t *escTextPrefixToken,
-               const _mongocrypt_buffer_t *v,
+               const mc_ESCTextPrefixDerivedFromDataToken_t *escTextPrefixToken,
                uint64_t u)
-IMPL_TOKEN_NEW_FROM_DATA_AND_CONTENTION(mc_ESCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
-                                        mc_ESCTextPrefixToken_get(escTextPrefixToken),
-                                        v,
-                                        u)
+IMPL_TOKEN_NEW_CONST(mc_ESCTextPrefixDerivedFromDataTokenAndContentionFactorToken,
+                     mc_ESCTextPrefixDerivedFromDataToken_get(escTextPrefixToken),
+                     u)
 
 DEF_TOKEN_TYPE(mc_ServerTextExactDerivedFromDataToken,
                const mc_ServerTextExactToken_t *serverTextExactToken,

data/ext/libmongocrypt/libmongocrypt/src/mc-writer-private.h

@@ -25,7 +25,7 @@
  * A non-owning forward-only cursor api to write to a buffer.
  *
  * Tracks length of buffer and current position of buffer. parser_name is
- * typically __FUNCTION__ to provide useful error messages automatically.
+ * typically __func__ to provide useful error messages automatically.
  *
  * All numbers are written as little endian.
  */

data/ext/libmongocrypt/libmongocrypt/src/mc-writer.c

@@ -21,7 +21,8 @@
 #define CHECK_AND_RETURN(x)                                                                                            \
     if (!(x)) {                                                                                                        \
         return false;                                                                                                  \
-    }
+    } else                                                                                                             \
+        ((void)0)
 
 #define CHECK_REMAINING_BUFFER_AND_RET(write_size)                                                                     \
     if ((write_size) > writer->len - writer->pos) {                                                                    \
@@ -30,7 +31,8 @@
                    (writer->len - writer->pos),                                                                        \
                    (uint64_t)(write_size));                                                                            \
         return false;                                                                                                  \
-    }
+    } else                                                                                                             \
+        ((void)0)
 
 void mc_writer_init(mc_writer_t *writer, uint8_t *ptr, uint64_t len, const char *parser_name) {
     BSON_ASSERT_PARAM(writer);

data/ext/libmongocrypt/libmongocrypt/src/mlib/error.h

@@ -51,4 +51,4 @@ static inline mstr merror_system_error_string(int errn) {
 #endif
 }
 
-#endif // MLIB_ERROR_PRIVATE_H
+#endif // MLIB_ERROR_PRIVATE_H

data/ext/libmongocrypt/libmongocrypt/src/mlib/int128.h

@@ -9,6 +9,12 @@
 #include <stdlib.h>
 #include <string.h>
 
+// Deliberately using old-style casts for C and C++ compatibility.
+#if defined(__cplusplus) && defined(__clang__)
+_Pragma("clang diagnostic push");
+_Pragma("clang diagnostic ignored \"-Wold-style-cast\"");
+#endif
+
 MLIB_C_LINKAGE_BEGIN
 
 /**
@@ -496,7 +502,7 @@ static mlib_constexpr_fn mlib_int128_divmod_result mlib_int128_divmod(mlib_int12
             u[2] |= (uint32_t)(numer.r.lo >> (64 - d));
             u[4] |= (uint32_t)(numer.r.hi >> (64 - d));
             v[2] |= (uint32_t)(denom.r.lo >> (64 - d));
-        };
+        }
 
         uint32_t q[2] = {0};
         if (has_three) {
@@ -644,4 +650,9 @@ static mlib_constexpr_fn mlib_int128_charbuf mlib_int128_format(mlib_int128 i) {
 
 MLIB_C_LINKAGE_END
 
+// Deliberately using old-style casts for C and C++ compatibility.
+#if defined(__cplusplus) && defined(__clang__)
+_Pragma("clang diagnostic pop");
+#endif
+
 #endif // MLIB_INT128_H_INCLUDED

data/ext/libmongocrypt/libmongocrypt/src/mlib/int128.test.cpp

@@ -10,6 +10,11 @@
 #include <thread>
 #include <vector>
 
+// Deliberately using old-style casts for C and C++ compatibility.
+#if defined(__clang__)
+_Pragma("clang diagnostic ignored \"-Wold-style-cast\"");
+#endif
+
 #if (defined(__GNUC__) && __GNUC__ < 7 && !defined(__clang__)) || (defined(_MSC_VER) && _MSC_VER < 1920)
 // Old GCC and old MSVC have partially-broken constexpr that prevents us from
 // properly using static_assert with from_string()

data/ext/libmongocrypt/libmongocrypt/src/mlib/path.h

@@ -60,7 +60,7 @@ static inline char mpath_preferred_sep(mpath_format f) {
  * @return mstr A new string which must be freed with mstr_free()
  */
 static inline mstr mpath_current_path(void) {
-#if _WIN32
+#if defined(_WIN32)
     while (1) {
         DWORD len = GetCurrentDirectoryW(0, NULL);
         wchar_t *wstr = calloc(sizeof(wchar_t), len);
@@ -76,12 +76,12 @@ static inline mstr mpath_current_path(void) {
     }
 #else
     mstr_mut mut = mstr_new(8096);
-    char *p = getcwd(mut.data, mut.len);
+    char *p = getcwd(mut.raw.data, mut.raw.len);
     if (p == NULL) {
         mstr_free(mut.mstr);
         return MSTR_NULL;
     }
-    mstr ret = mstr_copy_cstr(mut.data);
+    mstr ret = mstr_copy_cstr(mut.raw.data);
     mstr_free(mut.mstr);
     return ret;
 #endif
@@ -167,7 +167,7 @@ static inline mstr mpath_join(mstr_view base, mstr_view suffix, mpath_format f)
     // We must insert a path separator between the two strings
     assert(base.len <= SIZE_MAX - suffix.len - 1u);
     mstr_mut r = mstr_new(base.len + suffix.len + 1);
-    char *p = r.data;
+    char *p = r.raw.data;
     memcpy(p, base.data, base.len);
     p += base.len;
     *p++ = mpath_preferred_sep(f);
@@ -255,7 +255,7 @@ static inline mstr_view mpath_relative_path(mstr_view path, mpath_format f) {
 static inline mstr mpath_to_format(mpath_format from, mstr_view path, mpath_format to) {
     mstr_mut ret = mstr_new(path.len);
     const char *p = path.data;
-    char *out = ret.data;
+    char *out = ret.raw.data;
     const char *stop = path.data + path.len;
     for (; p != stop; ++p, ++out) {
         if (mpath_is_sep(*p, from)) {