libmongocrypt-helper 1.13.2.0.1001 → 1.14.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-encrypt.c

@@ -15,6 +15,7 @@
  */
 
 #include "mc-efc-private.h"
+#include "mc-fle-blob-subtype-private.h"
 #include "mc-fle2-rfds-private.h"
 #include "mc-tokens-private.h"
 #include "mongocrypt-ciphertext-private.h"
@@ -280,13 +281,13 @@ static bool _collect_key_from_marking(void *ctx, _mongocrypt_buffer_t *in, mongo
     }
 
     if (marking.type == MONGOCRYPT_MARKING_FLE1_BY_ID) {
-        res = _mongocrypt_key_broker_request_id(kb, &marking.key_id);
+        res = _mongocrypt_key_broker_request_id(kb, &marking.u.fle1.key_id);
     } else if (marking.type == MONGOCRYPT_MARKING_FLE1_BY_ALTNAME) {
-        res = _mongocrypt_key_broker_request_name(kb, &marking.key_alt_name);
+        res = _mongocrypt_key_broker_request_name(kb, &marking.u.fle1.key_alt_name);
     } else {
         BSON_ASSERT(marking.type == MONGOCRYPT_MARKING_FLE2_ENCRYPTION);
-        res = _mongocrypt_key_broker_request_id(kb, &marking.fle2.index_key_id)
-           && _mongocrypt_key_broker_request_id(kb, &marking.fle2.user_key_id);
+        res = _mongocrypt_key_broker_request_id(kb, &marking.u.fle2.index_key_id)
+           && _mongocrypt_key_broker_request_id(kb, &marking.u.fle2.user_key_id);
     }
 
     if (!res) {
@@ -574,7 +575,8 @@ fail_create_cmd:
 static bool _mongocrypt_fle2_insert_update_find(mc_fle_blob_subtype_t subtype) {
     return (subtype == MC_SUBTYPE_FLE2InsertUpdatePayload) || (subtype == MC_SUBTYPE_FLE2InsertUpdatePayloadV2)
         || (subtype == MC_SUBTYPE_FLE2FindEqualityPayload) || (subtype == MC_SUBTYPE_FLE2FindEqualityPayloadV2)
-        || (subtype == MC_SUBTYPE_FLE2FindRangePayload) || (subtype == MC_SUBTYPE_FLE2FindRangePayloadV2);
+        || (subtype == MC_SUBTYPE_FLE2FindRangePayload) || (subtype == MC_SUBTYPE_FLE2FindRangePayloadV2)
+        || (subtype == MC_SUBTYPE_FLE2FindTextPayload);
 }
 
 static bool
@@ -608,7 +610,7 @@ _marking_to_bson_value(void *ctx, _mongocrypt_marking_t *marking, bson_value_t *
     } else if (!_mongocrypt_serialize_ciphertext(&ciphertext, &serialized_ciphertext)) {
         CLIENT_ERR("malformed ciphertext");
         goto fail;
-    };
+    }
 
     /* ownership of serialized_ciphertext is transferred to caller. */
     out->value_type = BSON_TYPE_BINARY;
@@ -671,7 +673,6 @@ typedef struct {
 // must omit the "encryptionInformation" field when sent to mongod / mongos.
 static moe_result must_omit_encryptionInformation(const char *command_name,
                                                   const bson_t *command,
-                                                  bool use_range_v2,
                                                   const mc_EncryptedFieldConfig_t *efc,
                                                   mongocrypt_status_t *status) {
     // eligible_commands may omit encryptionInformation if the command does not
@@ -696,12 +697,10 @@ static moe_result must_omit_encryptionInformation(const char *command_name,
         // - Server 8.0 requires `encryptionInformation` if "range" fields are referenced. Otherwise ignores.
         // Only send `encryptionInformation` if "range" fields are present to support both server versions.
         bool uses_range_fields = false;
-        if (use_range_v2) {
-            for (const mc_EncryptedField_t *ef = efc->fields; ef != NULL; ef = ef->next) {
-                if (ef->supported_queries & SUPPORTS_RANGE_QUERIES) {
-                    uses_range_fields = true;
-                    break;
-                }
+        for (const mc_EncryptedField_t *ef = efc->fields; ef != NULL; ef = ef->next) {
+            if (ef->supported_queries & SUPPORTS_RANGE_QUERIES) {
+                uses_range_fields = true;
+                break;
             }
         }
         return (moe_result){.ok = true, .must_omit = !uses_range_fields};
@@ -818,7 +817,7 @@ static bool _fle2_append_compactionTokens(mongocrypt_t *crypt,
 
         const _mongocrypt_buffer_t *ecoct_buf = mc_ECOCToken_get(ecoct);
 
-        if (crypt->opts.use_range_v2 && (ptr->supported_queries & SUPPORTS_RANGE_QUERIES)) {
+        if ((ptr->supported_queries & SUPPORTS_RANGE_QUERIES)) {
             // Append the document {ecoc: <ECOCToken>, anchorPaddingToken: <AnchorPaddingTokenRoot>}
             esct = mc_ESCToken_new(crypto, cl1t, status);
             if (!esct) {
@@ -1061,7 +1060,7 @@ static bool _fle2_fixup_encryptedFields_strEncodeVersion(const char *cmd_name,
         } else {
             // Check strEncodeVersion for match against EFC
             if (!BSON_ITER_HOLDS_INT32(&sev_iter)) {
-                CLIENT_ERR("expected 'strEncodeVersion' to be type int32, got: %d", bson_iter_type(&sev_iter));
+                CLIENT_ERR("expected 'strEncodeVersion' to be type int32, got: %d", (int)bson_iter_type(&sev_iter));
                 return false;
             }
             int32_t version = bson_iter_int32(&sev_iter);
@@ -1139,11 +1138,7 @@ static bool _fle2_finalize(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out) {
     const mc_EncryptedFieldConfig_t *target_efc =
         mc_schema_broker_get_encryptedFields(ectx->sb, ectx->target_coll, NULL);
 
-    moe_result result = must_omit_encryptionInformation(command_name,
-                                                        &converted,
-                                                        ctx->crypt->opts.use_range_v2,
-                                                        target_efc,
-                                                        ctx->status);
+    moe_result result = must_omit_encryptionInformation(command_name, &converted, target_efc, ctx->status);
     if (!result.ok) {
         bson_destroy(&converted);
         return _mongocrypt_ctx_fail(ctx);
@@ -1311,29 +1306,25 @@ static bool _fle2_finalize_explicit(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *
     if (ctx->opts.query_type.set) {
         switch (ctx->opts.query_type.value) {
         case MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED:
-            if (ctx->crypt->opts.use_range_v2) {
-                _mongocrypt_ctx_fail_w_msg(ctx, "Cannot use rangePreview query type with Range V2");
-                goto fail;
-            }
+            _mongocrypt_ctx_fail_w_msg(ctx, "Cannot use rangePreview query type with Range V2");
+            goto fail;
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_RANGE:
-        case MONGOCRYPT_QUERY_TYPE_EQUALITY: marking.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_FIND; break;
+        case MONGOCRYPT_QUERY_TYPE_EQUALITY: marking.u.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_FIND; break;
         default: _mongocrypt_ctx_fail_w_msg(ctx, "Invalid value for EncryptOpts.queryType"); goto fail;
         }
     } else {
-        marking.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_INSERT;
+        marking.u.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_INSERT;
     }
 
     switch (ctx->opts.index_type.value) {
-    case MONGOCRYPT_INDEX_TYPE_EQUALITY: marking.fle2.algorithm = MONGOCRYPT_FLE2_ALGORITHM_EQUALITY; break;
-    case MONGOCRYPT_INDEX_TYPE_NONE: marking.fle2.algorithm = MONGOCRYPT_FLE2_ALGORITHM_UNINDEXED; break;
+    case MONGOCRYPT_INDEX_TYPE_EQUALITY: marking.u.fle2.algorithm = MONGOCRYPT_FLE2_ALGORITHM_EQUALITY; break;
+    case MONGOCRYPT_INDEX_TYPE_NONE: marking.u.fle2.algorithm = MONGOCRYPT_FLE2_ALGORITHM_UNINDEXED; break;
     case MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW_DEPRECATED:
-        if (ctx->crypt->opts.use_range_v2) {
-            _mongocrypt_ctx_fail_w_msg(ctx, "Cannot use rangePreview index type with Range V2");
-            goto fail;
-        }
+        _mongocrypt_ctx_fail_w_msg(ctx, "Cannot use rangePreview index type with Range V2");
+        goto fail;
         // fallthrough
-    case MONGOCRYPT_INDEX_TYPE_RANGE: marking.fle2.algorithm = MONGOCRYPT_FLE2_ALGORITHM_RANGE; break;
+    case MONGOCRYPT_INDEX_TYPE_RANGE: marking.u.fle2.algorithm = MONGOCRYPT_FLE2_ALGORITHM_RANGE; break;
     default:
         // This might be unreachable because of other validation. Better safe than
         // sorry.
@@ -1354,21 +1345,17 @@ static bool _fle2_finalize_explicit(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *
 
         // RangeOpts with query_type is handled above.
         BSON_ASSERT(!ctx->opts.query_type.set);
-        if (!mc_RangeOpts_to_FLE2RangeInsertSpec(&ctx->opts.rangeopts.value,
-                                                 &old_v,
-                                                 &new_v,
-                                                 ctx->crypt->opts.use_range_v2,
-                                                 ctx->status)) {
+        if (!mc_RangeOpts_to_FLE2RangeInsertSpec(&ctx->opts.rangeopts.value, &old_v, &new_v, ctx->status)) {
             _mongocrypt_ctx_fail(ctx);
             goto fail;
         }
 
-        if (!bson_iter_init_find(&marking.v_iter, &new_v, "v")) {
+        if (!bson_iter_init_find(&marking.u.fle1.v_iter, &new_v, "v")) {
             _mongocrypt_ctx_fail_w_msg(ctx, "invalid input BSON, must contain 'v'");
             goto fail;
         }
 
-        marking.fle2.sparsity = ctx->opts.rangeopts.value.sparsity;
+        marking.u.fle2.sparsity = ctx->opts.rangeopts.value.sparsity;
 
     } else {
         bson_t as_bson;
@@ -1379,21 +1366,21 @@ static bool _fle2_finalize_explicit(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *
             goto fail;
         }
 
-        if (!bson_iter_init_find(&marking.v_iter, &as_bson, "v")) {
+        if (!bson_iter_init_find(&marking.u.fle1.v_iter, &as_bson, "v")) {
             _mongocrypt_ctx_fail_w_msg(ctx, "invalid input BSON, must contain 'v'");
             goto fail;
         }
     }
 
-    _mongocrypt_buffer_copy_to(&ctx->opts.key_id, &marking.fle2.user_key_id);
+    _mongocrypt_buffer_copy_to(&ctx->opts.key_id, &marking.u.fle2.user_key_id);
     if (!_mongocrypt_buffer_empty(&ctx->opts.index_key_id)) {
-        _mongocrypt_buffer_copy_to(&ctx->opts.index_key_id, &marking.fle2.index_key_id);
+        _mongocrypt_buffer_copy_to(&ctx->opts.index_key_id, &marking.u.fle2.index_key_id);
     } else {
-        _mongocrypt_buffer_copy_to(&ctx->opts.key_id, &marking.fle2.index_key_id);
+        _mongocrypt_buffer_copy_to(&ctx->opts.key_id, &marking.u.fle2.index_key_id);
     }
 
     if (ctx->opts.contention_factor.set) {
-        marking.fle2.maxContentionFactor = ctx->opts.contention_factor.value;
+        marking.u.fle2.maxContentionFactor = ctx->opts.contention_factor.value;
     } else if (ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_EQUALITY) {
         _mongocrypt_ctx_fail_w_msg(ctx, "contention factor required for indexed algorithm");
         goto fail;
@@ -1494,11 +1481,11 @@ static bool _finalize(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out) {
             return _mongocrypt_ctx_fail_w_msg(ctx, "invalid msg, must contain 'v'");
         }
 
-        memcpy(&marking.v_iter, &iter, sizeof(bson_iter_t));
-        marking.algorithm = ctx->opts.algorithm;
-        _mongocrypt_buffer_set_to(&ctx->opts.key_id, &marking.key_id);
+        memcpy(&marking.u.fle1.v_iter, &iter, sizeof(bson_iter_t));
+        marking.u.fle1.algorithm = ctx->opts.algorithm;
+        _mongocrypt_buffer_set_to(&ctx->opts.key_id, &marking.u.fle1.key_id);
         if (ctx->opts.key_alt_names) {
-            bson_value_copy(&ctx->opts.key_alt_names->value, &marking.key_alt_name);
+            bson_value_copy(&ctx->opts.key_alt_names->value, &marking.u.fle1.key_alt_name);
             marking.type = MONGOCRYPT_MARKING_FLE1_BY_ALTNAME;
         }
 
@@ -1901,7 +1888,7 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
             matches = (ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_EQUALITY);
             break;
         default:
-            CLIENT_ERR("unsupported value for query_type: %d", ctx->opts.query_type.value);
+            CLIENT_ERR("unsupported value for query_type: %d", (int)ctx->opts.query_type.value);
             return _mongocrypt_ctx_fail(ctx);
         }
 
@@ -2238,10 +2225,16 @@ static bool needs_ismaster_check(mongocrypt_ctx_t *ctx) {
 
 // `find_collections_in_pipeline` finds other collection names in an aggregate pipeline that may need schemas.
 static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
-                                         bson_iter_t pipeline_iter,
+                                         bson_iter_t *pipeline_iter_ptr,
                                          const char *db,
                                          mstr_view path,
                                          mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(sb);
+    BSON_ASSERT_PARAM(pipeline_iter_ptr);
+    BSON_ASSERT_PARAM(db);
+
+    bson_iter_t pipeline_iter = *pipeline_iter_ptr; // Operate on a copy.
+
     bson_iter_t array_iter;
     if (!BSON_ITER_HOLDS_ARRAY(&pipeline_iter) || !bson_iter_recurse(&pipeline_iter, &array_iter)) {
         CLIENT_ERR("failed to recurse pipeline at path: %s", path.data);
@@ -2287,7 +2280,7 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                     mstr subpath = mstr_append(path, mstrv_lit("."));
                     mstr_inplace_append(&subpath, mstrv_view_cstr(stage_key));
                     mstr_inplace_append(&subpath, mstrv_lit(".$lookup.pipeline"));
-                    if (!find_collections_in_pipeline(sb, lookup_iter, db, subpath.view, status)) {
+                    if (!find_collections_in_pipeline(sb, &lookup_iter, db, subpath.view, status)) {
                         mstr_free(subpath);
                         return false;
                     }
@@ -2310,7 +2303,7 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                 mstr_inplace_append(&subpath, mstrv_view_cstr(stage_key));
                 mstr_inplace_append(&subpath, mstrv_lit(".$facet."));
                 mstr_inplace_append(&subpath, mstrv_view_cstr(field));
-                if (!find_collections_in_pipeline(sb, facet_iter, db, subpath.view, status)) {
+                if (!find_collections_in_pipeline(sb, &facet_iter, db, subpath.view, status)) {
                     mstr_free(subpath);
                     return false;
                 }
@@ -2346,7 +2339,7 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                     mstr subpath = mstr_append(path, mstrv_lit("."));
                     mstr_inplace_append(&subpath, mstrv_view_cstr(stage_key));
                     mstr_inplace_append(&subpath, mstrv_lit(".$unionWith.pipeline"));
-                    if (!find_collections_in_pipeline(sb, unionWith_iter, db, subpath.view, status)) {
+                    if (!find_collections_in_pipeline(sb, &unionWith_iter, db, subpath.view, status)) {
                         mstr_free(subpath);
                         return false;
                     }
@@ -2373,7 +2366,7 @@ find_collections_in_agg(mongocrypt_binary_t *cmd, mc_schema_broker_t *sb, const
         return true;
     }
 
-    return find_collections_in_pipeline(sb, iter, db, mstrv_lit("aggregate.pipeline"), status);
+    return find_collections_in_pipeline(sb, &iter, db, mstrv_lit("aggregate.pipeline"), status);
 }
 
 bool mongocrypt_ctx_encrypt_init(mongocrypt_ctx_t *ctx, const char *db, int32_t db_len, mongocrypt_binary_t *cmd) {
@@ -2409,9 +2402,6 @@ bool mongocrypt_ctx_encrypt_init(mongocrypt_ctx_t *ctx, const char *db, int32_t
     ctx->vtable.cleanup = _cleanup;
     ectx->bypass_query_analysis = ctx->crypt->opts.bypass_query_analysis;
     ectx->sb = mc_schema_broker_new();
-    if (ctx->crypt->opts.use_range_v2) {
-        mc_schema_broker_use_rangev2(ectx->sb);
-    }
 
     if (!cmd || !cmd->data) {
         return _mongocrypt_ctx_fail_w_msg(ctx, "invalid command");

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-rewrap-many-datakey.c

@@ -136,6 +136,18 @@ static mongocrypt_kms_ctx_t *_next_kms_ctx_encrypt(mongocrypt_ctx_t *ctx) {
     mongocrypt_ctx_t *dkctx = NULL;
 
     BSON_ASSERT_PARAM(ctx);
+    /* Check if any need retry */
+    {
+        _mongocrypt_ctx_rmd_datakey_t *it = rmdctx->datakeys;
+        while (it != NULL) {
+            _mongocrypt_ctx_datakey_t *dkctx = (_mongocrypt_ctx_datakey_t *)it->dkctx;
+            if (dkctx->kms.should_retry) {
+                dkctx->kms.should_retry = false; // Reset retry state.
+                return &dkctx->kms;
+            }
+            it = it->next;
+        }
+    }
 
     /* No more datakey contexts requiring KMS. */
     if (!rmdctx->datakeys_iter) {

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx.c

@@ -262,12 +262,8 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
         ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_RANGE;
         ctx->opts.index_type.set = true;
     } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_DEPRECATED_STR))) {
-        if (ctx->crypt->opts.use_range_v2) {
-            _mongocrypt_ctx_fail_w_msg(ctx, "Algorithm 'rangePreview' is deprecated, please use 'range'");
-            return false;
-        }
-        ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW_DEPRECATED;
-        ctx->opts.index_type.set = true;
+        _mongocrypt_ctx_fail_w_msg(ctx, "Algorithm 'rangePreview' is deprecated, please use 'range'");
+        return false;
     } else {
         char *error = bson_strdup_printf("unsupported algorithm string \"%.*s\"",
                                          algo_str.len <= (size_t)INT_MAX ? (int)algo_str.len : INT_MAX,
@@ -1068,12 +1064,8 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_RANGE;
         ctx->opts.query_type.set = true;
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR))) {
-        if (ctx->crypt->opts.use_range_v2) {
-            _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'rangePreview' is deprecated, please use 'range'");
-            return false;
-        }
-        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED;
-        ctx->opts.query_type.set = true;
+        _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'rangePreview' is deprecated, please use 'range'");
+        return false;
     } else {
         /* don't check if qt_str.len fits in int; we want the diagnostic output */
         char *error = bson_strdup_printf("Unsupported query_type \"%.*s\"",
@@ -1128,7 +1120,7 @@ bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_bin
         return _mongocrypt_ctx_fail_w_msg(ctx, "invalid BSON");
     }
 
-    if (!mc_RangeOpts_parse(&ctx->opts.rangeopts.value, &as_bson, ctx->crypt->opts.use_range_v2, ctx->status)) {
+    if (!mc_RangeOpts_parse(&ctx->opts.rangeopts.value, &as_bson, ctx->status)) {
         return _mongocrypt_ctx_fail(ctx);
     }
 

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-dll-private.h

@@ -6,9 +6,9 @@
 
 #include <stdlib.h>
 
-#if _WIN32
+#if defined(_WIN32)
 #define MCR_DLL_SUFFIX ".dll"
-#elif __APPLE__
+#elif defined(__APPLE__)
 #define MCR_DLL_SUFFIX ".dylib"
 #else
 #define MCR_DLL_SUFFIX ".so"
@@ -54,6 +54,23 @@ static inline void mcr_dll_close(mcr_dll dll) {
     mstr_free(dll.error_string);
 }
 
+// All currently supported platforms require casting to/from `void*` for dynamically loaded function symbols by
+// necessity despite being undefined behavior according to the C standard specification.
+#if defined(__GNUC__) && ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6))
+// GCC requires silencing `-Wpedantic` for this cast.
+#define MC_BEGIN_CAST_FUNCTION_TYPE_STRICT_IGNORE                                                                      \
+    _Pragma("GCC diagnostic push") _Pragma("GCC diagnostic ignored \"-Wpedantic\"")
+#define MC_END_CAST_FUNCTION_TYPE_STRICT_IGNORE _Pragma("GCC diagnostic pop")
+#elif defined(__clang__)
+#define MC_BEGIN_CAST_FUNCTION_TYPE_STRICT_IGNORE                                                                      \
+    _Pragma("clang diagnostic push") _Pragma("clang diagnostic ignored \"-Wunknown-warning-option\"")                  \
+        _Pragma("clang diagnostic ignored \"-Wcast-function-type-strict\"")
+#define MC_END_CAST_FUNCTION_TYPE_STRICT_IGNORE _Pragma("clang diagnostic pop")
+#else
+#define MC_BEGIN_CAST_FUNCTION_TYPE_STRICT_IGNORE
+#define MC_END_CAST_FUNCTION_TYPE_STRICT_IGNORE
+#endif
+
 /**
  * @brief Obtain a pointer to an exported entity from the given dynamic library.
  *

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-key-broker.c

@@ -24,11 +24,11 @@ typedef struct _auth_request_t {
     char *kmsid;
 } auth_request_t;
 
-auth_request_t *auth_request_new() {
+static auth_request_t *auth_request_new(void) {
     return bson_malloc0(sizeof(auth_request_t));
 }
 
-void auth_request_destroy(auth_request_t *ar) {
+static void auth_request_destroy(auth_request_t *ar) {
     if (!ar) {
         return;
     }
@@ -41,13 +41,13 @@ struct _mc_mapof_kmsid_to_authrequest_t {
     mc_array_t entries;
 };
 
-mc_mapof_kmsid_to_authrequest_t *mc_mapof_kmsid_to_authrequest_new(void) {
+static mc_mapof_kmsid_to_authrequest_t *mc_mapof_kmsid_to_authrequest_new(void) {
     mc_mapof_kmsid_to_authrequest_t *k2a = bson_malloc0(sizeof(mc_mapof_kmsid_to_authrequest_t));
     _mc_array_init(&k2a->entries, sizeof(auth_request_t *));
     return k2a;
 }
 
-void mc_mapof_kmsid_to_authrequest_destroy(mc_mapof_kmsid_to_authrequest_t *k2a) {
+static void mc_mapof_kmsid_to_authrequest_destroy(mc_mapof_kmsid_to_authrequest_t *k2a) {
     if (!k2a) {
         return;
     }
@@ -59,7 +59,7 @@ void mc_mapof_kmsid_to_authrequest_destroy(mc_mapof_kmsid_to_authrequest_t *k2a)
     bson_free(k2a);
 }
 
-bool mc_mapof_kmsid_to_authrequest_has(const mc_mapof_kmsid_to_authrequest_t *k2a, const char *kmsid) {
+static bool mc_mapof_kmsid_to_authrequest_has(const mc_mapof_kmsid_to_authrequest_t *k2a, const char *kmsid) {
     BSON_ASSERT_PARAM(k2a);
     BSON_ASSERT_PARAM(kmsid);
     for (size_t i = 0; i < k2a->entries.len; i++) {
@@ -71,25 +71,25 @@ bool mc_mapof_kmsid_to_authrequest_has(const mc_mapof_kmsid_to_authrequest_t *k2
     return false;
 }
 
-size_t mc_mapof_kmsid_to_authrequest_len(const mc_mapof_kmsid_to_authrequest_t *k2a) {
+static size_t mc_mapof_kmsid_to_authrequest_len(const mc_mapof_kmsid_to_authrequest_t *k2a) {
     BSON_ASSERT_PARAM(k2a);
     return k2a->entries.len;
 }
 
-bool mc_mapof_kmsid_to_authrequest_empty(const mc_mapof_kmsid_to_authrequest_t *k2a) {
+static bool mc_mapof_kmsid_to_authrequest_empty(const mc_mapof_kmsid_to_authrequest_t *k2a) {
     BSON_ASSERT_PARAM(k2a);
     return k2a->entries.len == 0;
 }
 
 // `mc_mapof_kmsid_to_authrequest_put` moves `to_put` into the map and takes ownership of `to_put`.
 // No checking is done to prohibit duplicate entries.
-void mc_mapof_kmsid_to_authrequest_put(mc_mapof_kmsid_to_authrequest_t *k2a, auth_request_t *to_put) {
+static void mc_mapof_kmsid_to_authrequest_put(mc_mapof_kmsid_to_authrequest_t *k2a, auth_request_t *to_put) {
     BSON_ASSERT_PARAM(k2a);
 
     _mc_array_append_val(&k2a->entries, to_put);
 }
 
-auth_request_t *mc_mapof_kmsid_to_authrequest_at(mc_mapof_kmsid_to_authrequest_t *k2a, size_t i) {
+static auth_request_t *mc_mapof_kmsid_to_authrequest_at(mc_mapof_kmsid_to_authrequest_t *k2a, size_t i) {
     BSON_ASSERT_PARAM(k2a);
 
     return _mc_array_index(&k2a->entries, auth_request_t *, i);

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-marking-private.h

@@ -39,10 +39,10 @@ typedef struct {
 
             _mongocrypt_buffer_t key_id;
             bson_value_t key_alt_name;
-        };
+        } fle1;
 
         mc_FLE2EncryptionPlaceholder_t fle2;
-    };
+    } u;
 } _mongocrypt_marking_t;
 
 // `_mongocrypt_marking_t` inherits extended alignment from libbson. To dynamically allocate, use aligned allocation
@@ -67,7 +67,6 @@ bool _mongocrypt_marking_to_ciphertext(void *ctx,
 
 mc_mincover_t *mc_get_mincover_from_FLE2RangeFindSpec(mc_FLE2RangeFindSpec_t *findSpec,
                                                       size_t sparsity,
-                                                      mongocrypt_status_t *status,
-                                                      bool use_range_v2) MONGOCRYPT_WARN_UNUSED_RESULT;
+                                                      mongocrypt_status_t *status) MONGOCRYPT_WARN_UNUSED_RESULT;
 
 #endif /* MONGOCRYPT_MARKING_PRIVATE_H */