libmongocrypt-helper 1.19.0.0.1001 → 1.20.1.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b049e3785ef7124bc0172a97aca5a01ac2c883998bf066bd399b23aaa6f7ab29
-  data.tar.gz: b993577d300b0aafe7bd074774829edbe4a54425a1bbe631cdfa6424d73abba7
+  metadata.gz: 5f3bd46869436cf55ec31236a73965ec1f198f75809d53e084aebb6c056bead0
+  data.tar.gz: 4868779b572f103a7f7f6ae88ea15032dd829e31c5a85e1f41364bd0d7f17d60
 SHA512:
-  metadata.gz: 7effe0b13cb6bdea52e7ae92e8ae7fb3ca8230936d95e128d5e11ee35964ec848e46691fd8342e594918915f268ff3b6fa9a924f65d3015c1c25b17e22fc6e6b
-  data.tar.gz: 4ee52e78b00238026409e733f629ab1067179909d20605c981cd7ce4229ed976ece08fd7f8b4db68645d33cbb571c3a04054e604d9ffbe7e7c5752a8bd98b23b
+  metadata.gz: 57f84ed485336784bd0dd5008a4d2f893146f3cb4128c121d5e91dc5bb8c80c07f8d7a6e44edd869327876c1b0410b1790b84a0548bb0459b6e7bc53a7151a83
+  data.tar.gz: 27917b4a2c97d98db62661d48f0c3dace264f84f83ba9fd1f9de351dc11a20bb0f29445c51ffa94b82b51716adb1bf925bf18804358d5bac1b701651bc735846

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,5 +1,26 @@
 # ChangeLog
 
+## 1.20.1
+
+## Changed
+- Bump downloaded libbson version from 2.3.0 to 2.3.3 to address configuration error with CMake 4.4.0.
+
+## 1.20.0
+
+### Added
+- Stable support for substring queries.
+
+## 1.19.2
+
+### Added
+- Add static library files to GitHub releases.
+
+## 1.19.1
+
+### Added
+- Restore support for the experimental `prefixPreview` and `suffixPreview` query types.
+
+
 ## 1.19.0
 
 ### Added
@@ -11,6 +32,13 @@
 ### Removed
 - Support for the experimental `prefixPreview` and `suffixPreview` query types.
 
+
+## 1.18.2
+
+### Fixed
+- Add musl arm64 release to GitHub release. This was an omission in 1.18.0.
+- Reject large KMS replies.
+
 ## 1.18.1
 
 ### Fixed

data/ext/libmongocrypt/libmongocrypt/README.md

@@ -78,6 +78,9 @@ A Windows DLL for x86_64 is available on the Github Releases page. See the [late
 
 Use `gpg` to verify the signature. The public key for `libmongocrypt` is available on https://pgp.mongodb.com/.
 
+## Python Releases ##
+Python releases and tags are signed using the MongoDB Python driver PGP key. Use `gpg` to verify the signature. The public key is available at https://pgp.mongodb.com/python-driver.pub.
+
 
 ### Testing ###
 `test-mongocrypt` mocks all I/O with files stored in the `test/data` and `test/example` directories. Run `test-mongocrypt` from the source directory:

data/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake

@@ -2,7 +2,7 @@ include (FetchContent)
 
 # Set the tag that we will fetch.
 # When updating the version of libbson, also update the version in etc/purls.txt and .evergreen/prep_c_driver_source.sh
-set (MONGOC_FETCH_TAG_FOR_LIBBSON "2.3.0" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
+set (MONGOC_FETCH_TAG_FOR_LIBBSON "2.3.3" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
 
 # Add an option to disable patching if a patch command is unavailable.
 option (LIBBSON_PATCH_ENABLED "Whether to apply patches to the libbson library" ON)

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -1,16 +1,16 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v2.3.0#src/libbson",
+      "bom-ref": "pkg:github/mongodb/mongo-c-driver@2.3.3#src/libbson",
       "copyright": "Copyright 2009-present MongoDB, Inc.",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/mongo-c-driver/archive/v2.3.0.tar.gz"
+          "url": "https://github.com/mongodb/mongo-c-driver/archive/2.3.3.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/mongo-c-driver/tree/v2.3.0"
+          "url": "https://github.com/mongodb/mongo-c-driver/tree/2.3.3"
         }
       ],
       "group": "mongodb",
@@ -22,9 +22,9 @@
         }
       ],
       "name": "mongo-c-driver",
-      "purl": "pkg:github/mongodb/mongo-c-driver@v2.3.0#src/libbson",
+      "purl": "pkg:github/mongodb/mongo-c-driver@2.3.3#src/libbson",
       "type": "library",
-      "version": "v2.3.0"
+      "version": "2.3.3"
     },
     {
       "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
@@ -53,11 +53,11 @@
       "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
     },
     {
-      "ref": "pkg:github/mongodb/mongo-c-driver@v2.3.0#src/libbson"
+      "ref": "pkg:github/mongodb/mongo-c-driver@2.3.3#src/libbson"
     }
   ],
   "metadata": {
-    "timestamp": "2026-05-01T14:49:06.464175+00:00",
+    "timestamp": "2026-07-14T13:56:19.068748+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,7 +100,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:5c89265b-cc3d-4649-878b-17b482325b56",
+  "serialNumber": "urn:uuid:870a42e2-38df-4271-afee-8ffa5c28bcf7",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/etc/purls.txt

@@ -8,7 +8,7 @@
 # `copyright` property. This information can be manually added.
 
 # libbson is obtained via `cmake/FetchMongoC.cmake`.
-pkg:github/mongodb/mongo-c-driver@v2.3.0?#src/libbson
+pkg:github/mongodb/mongo-c-driver@2.3.3?#src/libbson
 
 # IntelDFP is obtained via `cmake/IntelDFP.cmake`
 pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_kmip_response_parser.c

@@ -111,6 +111,10 @@ kms_kmip_response_parser_feed (kms_kmip_response_parser_t *parser,
       uint32_t temp;
       memcpy (&temp, parser->buf->str + FIRST_LENGTH_OFFSET, sizeof (uint32_t));
       parser->first_len = KMS_UINT32_FROM_BE (temp);
+      if (parser->first_len > KMS_PARSER_MAX_RESPONSE_LEN) {
+         KMS_ERROR (parser, "KMS KMIP response too large");
+         return false;
+      }
    }
    return true;
 }

data/ext/libmongocrypt/libmongocrypt/src/mc-efc-private.h

@@ -28,13 +28,15 @@ typedef enum _supported_query_type_flags {
     SUPPORTS_RANGE_QUERIES = 1 << 1,
     // Range preview query supported
     SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES = 1 << 2,
-    // Text search preview query supported
-    SUPPORTS_SUBSTRING_PREVIEW_QUERIES = 1 << 3,
+    // Text search query supported
+    SUPPORTS_SUBSTRING_QUERIES = 1 << 3,
     SUPPORTS_SUFFIX_QUERIES = 1 << 4,
     SUPPORTS_PREFIX_QUERIES = 1 << 5,
-    // prefixPreview and suffixPreview are dropped. Setting this results in an error.
+    // suffixPreview and prefixPreview are deprecated aliases for suffix and prefix, respectively.
     SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES = 1 << 6,
     SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES = 1 << 7,
+    // substring preview query supported
+    SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES = 1 << 8,
 } supported_query_type_flags;
 
 typedef struct _mc_EncryptedField_t {

data/ext/libmongocrypt/libmongocrypt/src/mc-efc.c

@@ -33,8 +33,9 @@ static bool _parse_query_type_string(const char *queryType, supported_query_type
         *out = SUPPORTS_RANGE_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR), qtv)) {
         *out = SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES;
-    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR), qtv)) {
-        *out = SUPPORTS_SUBSTRING_PREVIEW_QUERIES;
+    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR), qtv)
+               || mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR), qtv)) {
+        *out = SUPPORTS_SUBSTRING_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIX_STR), qtv)) {
         *out = SUPPORTS_SUFFIX_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_PREFIX_STR), qtv)) {
@@ -178,20 +179,6 @@ static bool _parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocry
         return false;
     }
 
-    if (query_types & SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES) {
-        CLIENT_ERR("Cannot use field '%s' with 'prefixPreview' queries. 'prefixPreview' is unsupported. Use 'prefix' "
-                   "instead.",
-                   field_path);
-        return false;
-    }
-
-    if (query_types & SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES) {
-        CLIENT_ERR("Cannot use field '%s' with 'suffixPreview' queries. 'suffixPreview' is unsupported. Use 'suffix' "
-                   "instead.",
-                   field_path);
-        return false;
-    }
-
     /* Prepend a new mc_EncryptedField_t */
     mc_EncryptedField_t *ef = bson_malloc0(sizeof(mc_EncryptedField_t));
     if (has_keyid) {
@@ -258,7 +245,9 @@ bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc,
 
     if (!bson_iter_init_find(&iter, efc_bson, "strEncodeVersion")) {
         if (all_supported_queries
-            & (SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES)) {
+            & (SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_SUFFIX_QUERIES
+               | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
+               | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
             // Has at least one text search query type, set to latest by default.
             efc->str_encode_version = LATEST_STR_ENCODE_VERSION;
         } else {

data/ext/libmongocrypt/libmongocrypt/src/mc-textopts.c

@@ -368,15 +368,18 @@ bool mc_TextOpts_to_FLE2TextSearchInsertSpec_for_query(const mc_TextOpts_t *txo,
         CLIENT_ERR("Unexpected query type: %s\n", _mongocrypt_query_type_to_string(query_type));
         return false;
     }
-    case MONGOCRYPT_QUERY_TYPE_PREFIX: {
+    case MONGOCRYPT_QUERY_TYPE_PREFIX:
+    case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED: {
         include_prefix = true;
         break;
     }
-    case MONGOCRYPT_QUERY_TYPE_SUFFIX: {
+    case MONGOCRYPT_QUERY_TYPE_SUFFIX:
+    case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED: {
         include_suffix = true;
         break;
     }
-    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: {
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: {
         include_substring = true;
         break;
     }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-encrypt.c

@@ -890,8 +890,9 @@ static moe_result must_omit_encryptionInformation(const char *command_name,
         bool has_fields_requiring_ei = false;
         for (const mc_EncryptedField_t *ef = efc->fields; ef != NULL; ef = ef->next) {
             if (ef->supported_queries
-                & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES
-                   | SUPPORTS_PREFIX_QUERIES)) {
+                & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUFFIX_QUERIES
+                   | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES
+                   | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
                 has_fields_requiring_ei = true;
                 break;
             }
@@ -1011,8 +1012,9 @@ static bool _fle2_append_compactionTokens(mongocrypt_t *crypt,
         const _mongocrypt_buffer_t *ecoct_buf = mc_ECOCToken_get(ecoct);
 
         if (ptr->supported_queries
-            & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES
-               | SUPPORTS_PREFIX_QUERIES)) {
+            & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES
+               | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
+               | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
             // Append the document {ecoc: <ECOCToken>, anchorPaddingToken: <AnchorPaddingTokenRoot>}
             esct = mc_ESCToken_new(crypto, cl1t, status);
             if (!esct) {
@@ -1522,7 +1524,10 @@ static bool _fle2_finalize_explicit(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_SUFFIX:
         case MONGOCRYPT_QUERY_TYPE_PREFIX:
-        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+        case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED:
         case MONGOCRYPT_QUERY_TYPE_RANGE:
         case MONGOCRYPT_QUERY_TYPE_EQUALITY: marking.u.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_FIND; break;
         default: _mongocrypt_ctx_fail_w_msg(ctx, "Invalid value for EncryptOpts.queryType"); goto fail;
@@ -2087,19 +2092,19 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
 
     if (ctx->opts.query_type.set) {
         const mongocrypt_query_type_t qt = ctx->opts.query_type.value;
-        if (qt == MONGOCRYPT_QUERY_TYPE_PREFIX) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_PREFIX || qt == MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
                 return _mongocrypt_ctx_fail_w_msg(ctx, "prefix query type requires string index type");
             }
         }
-        if (qt == MONGOCRYPT_QUERY_TYPE_SUFFIX) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_SUFFIX || qt == MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
                 return _mongocrypt_ctx_fail_w_msg(ctx, "suffix query type requires string index type");
             }
         }
-        if (qt == MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_SUBSTRING || qt == MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
-                return _mongocrypt_ctx_fail_w_msg(ctx, "substringPreview query type requires string index type");
+                return _mongocrypt_ctx_fail_w_msg(ctx, "substring query type requires string index type");
             }
         }
     }
@@ -2182,7 +2187,10 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_PREFIX:
         case MONGOCRYPT_QUERY_TYPE_SUFFIX:
-        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+        case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED:
             matches = (ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING);
             break;
         default:

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-private.h

@@ -46,7 +46,12 @@ typedef enum _mongocrypt_query_type_t {
     MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED = 3,
     MONGOCRYPT_QUERY_TYPE_PREFIX = 4,
     MONGOCRYPT_QUERY_TYPE_SUFFIX = 5,
-    MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW = 6,
+    MONGOCRYPT_QUERY_TYPE_SUBSTRING = 6,
+    // prefixPreview and suffixPreview are deprecated aliases for prefix and suffix, respectively. They behave
+    // identically; the distinct values exist for consistency (cf. rangePreview) and to ease eventual removal.
+    MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED = 7,
+    MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED = 8,
+    MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED = 9,
 } mongocrypt_query_type_t;
 
 const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val);

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx.c

@@ -248,6 +248,9 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
     } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_STRING_STR))) {
         ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_STRING;
         ctx->opts.index_type.set = true;
+    } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_TEXTPREVIEW_DEPRECATED_STR))) {
+        _mongocrypt_ctx_fail_w_msg(ctx, "Algorithm 'textPreview' is deprecated, please use 'string'");
+        return false;
     } else {
         char *error = bson_strdup_printf("unsupported algorithm string \"%.*s\"",
                                          algo_str.len <= (size_t)INT_MAX ? (int)algo_str.len : INT_MAX,
@@ -1027,14 +1030,21 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIX_STR))) {
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUFFIX;
         ctx->opts.query_type.set = true;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR))) {
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRING;
+        ctx->opts.query_type.set = true;
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR))) {
-        _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'prefixPreview' is deprecated, please use 'prefix'");
-        return false;
+        // 'prefixPreview' is a deprecated alias for 'prefix'.
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED;
+        ctx->opts.query_type.set = true;
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR))) {
-        _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'suffixPreview' is deprecated, please use 'suffix'");
-        return false;
-    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR))) {
-        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW;
+        // 'suffixPreview' is a deprecated alias for 'suffix'.
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED;
+        ctx->opts.query_type.set = true;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR))) {
+        // TODO: MONGOCRYPT-938 disallow substringPreview
+        // _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'substringPreview' is deprecated, please use 'substring'");
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED;
         ctx->opts.query_type.set = true;
     } else {
         /* don't check if qt_str.len fits in int; we want the diagnostic output */
@@ -1066,7 +1076,10 @@ const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val) {
     case MONGOCRYPT_QUERY_TYPE_RANGE: return "Range";
     case MONGOCRYPT_QUERY_TYPE_PREFIX: return "Prefix";
     case MONGOCRYPT_QUERY_TYPE_SUFFIX: return "Suffix";
-    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: return "SubstringPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRING: return "Substring";
+    case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED: return "PrefixPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED: return "SuffixPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: return "SubstringPreview";
     default: return "Unknown";
     }
 }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-opts.c

@@ -984,6 +984,10 @@ bool _mongocrypt_parse_kms_providers(mongocrypt_binary_t *kms_providers_definiti
         } else if (0 == strcmp(field_name, "kmip") && bson_empty(&field_bson)) {
             kms_providers->need_credentials |= MONGOCRYPT_KMS_PROVIDER_KMIP;
         } else if (0 == strcmp(field_name, "kmip")) {
+            if (0 != (kms_providers->configured_providers & MONGOCRYPT_KMS_PROVIDER_KMIP)) {
+                CLIENT_ERR("kmip KMS provider already set");
+                return false;
+            }
             if (!_mongocrypt_opts_kms_provider_kmip_parse(&kms_providers->kmip_mut, field_name, &field_bson, status)) {
                 return false;
             }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt.h

@@ -1559,7 +1559,6 @@ bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_bin
 /**
  * Set options for explicit encryption with the "string" algorithm.
  *
- * NOTE: Use of the "substringPreview" query type is experimental only and may be removed in a future non-major release.
  * @p opts is a BSON document of the form:
  * {
  *   "caseSensitive": bool,
@@ -1601,8 +1600,9 @@ bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expira
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
 #define MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR "rangePreview"
 #define MONGOCRYPT_QUERY_TYPE_RANGE_STR "range"
-/// NOTE: "substringPreview" is experimental and may be removed in a future non-major release.
-#define MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR "substringPreview"
+/// DEPRECATED: Support for "substringPreview" has been removed in favor of "substring"
+#define MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR "substringPreview"
+#define MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR "substring"
 /// DEPRECATED: Support for "suffixPreview" has been removed in favor of "suffix"
 #define MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR "suffixPreview"
 #define MONGOCRYPT_QUERY_TYPE_SUFFIX_STR "suffix"

data/ext/libmongocrypt/libmongocrypt/test/data/efc/efc-textSearchFields.json

@@ -66,6 +66,22 @@
                     }
                 }
             ]
-        }
+        },
+        {
+            "keyId": {
+                "$binary": {
+                    "base64": "q83vqxI0mHYSNBI0VniQEg==",
+                    "subType": "04"
+                }
+            },
+            "path": "preferredName",
+            "bsonType": "string",
+            "queries": {
+                "queryType": "substring",
+                "contention": {
+                    "$numberLong": "0"
+                }
+            }
+         }
     ]
-}
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mc-efc.c

@@ -31,10 +31,12 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
     _mongocrypt_buffer_t expect_keyId1;
     _mongocrypt_buffer_t expect_keyId2;
     _mongocrypt_buffer_t expect_keyId3;
+    _mongocrypt_buffer_t expect_keyId4;
 
     _mongocrypt_buffer_copy_from_hex(&expect_keyId1, "12345678123498761234123456789012");
     _mongocrypt_buffer_copy_from_hex(&expect_keyId2, "abcdefab123498761234123456789012");
     _mongocrypt_buffer_copy_from_hex(&expect_keyId3, "12345678123498761234123456abcdef");
+    _mongocrypt_buffer_copy_from_hex(&expect_keyId4, "abcdefab123498761234123456789012");
 
     {
         _load_test_file(tester, "./test/data/efc/efc-oneField.json", &efc_bson);
@@ -112,6 +114,11 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         ASSERT_CMPUINT8(efc.str_encode_version, ==, LATEST_STR_ENCODE_VERSION);
         ptr = efc.fields;
         ASSERT(ptr);
+        ASSERT_STREQUAL(ptr->path, "preferredName");
+        ASSERT_CMPBUF(expect_keyId4, ptr->keyId);
+        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_QUERIES);
+        ASSERT(ptr->next != NULL);
+        ptr = ptr->next;
         ASSERT_STREQUAL(ptr->path, "middleName");
         ASSERT_CMPBUF(expect_keyId3, ptr->keyId);
         ASSERT(ptr->supported_queries == (SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES));
@@ -124,7 +131,7 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         ptr = ptr->next;
         ASSERT_STREQUAL(ptr->path, "firstName");
         ASSERT_CMPBUF(expect_keyId1, ptr->keyId);
-        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_PREVIEW_QUERIES);
+        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_QUERIES);
         ASSERT(ptr->next == NULL);
         mc_EncryptedFieldConfig_cleanup(&efc);
     }
@@ -142,7 +149,7 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         ptr = ptr->next;
         ASSERT_STREQUAL(ptr->path, "firstName");
         ASSERT_CMPBUF(expect_keyId1, ptr->keyId);
-        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_PREVIEW_QUERIES);
+        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_QUERIES);
         ASSERT(ptr->next == NULL);
         mc_EncryptedFieldConfig_cleanup(&efc);
     }
@@ -165,6 +172,7 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         _mongocrypt_status_reset(status);
     }
 
+    _mongocrypt_buffer_cleanup(&expect_keyId4);
     _mongocrypt_buffer_cleanup(&expect_keyId3);
     _mongocrypt_buffer_cleanup(&expect_keyId2);
     _mongocrypt_buffer_cleanup(&expect_keyId1);

data/ext/libmongocrypt/libmongocrypt/test/test-mc-textopts.c

@@ -245,7 +245,7 @@ static void test_mc_TextOpts_to_FLE2TextSearchInsertSpec_for_query(_mongocrypt_t
              "substring" : {"strMaxLength" : 10, "strMinQueryLength" : 3, "strMaxQueryLength" : 8}
          }),
          .v = RAW_STRING({"v" : "test"}),
-         .qt = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW,
+         .qt = MONGOCRYPT_QUERY_TYPE_SUBSTRING,
          .expect = RAW_STRING(
              {"v" : {"v" : "test", "casef" : false, "diacf" : true, "substr" : {"mlen" : 10, "ub" : 8, "lb" : 3}}})},
         {.desc = "Works with prefix",

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-encrypt.c

@@ -2511,10 +2511,11 @@ static void _test_encrypt_fle2_explicit(_mongocrypt_tester_t *tester) {
     }
 
     {
+        // "suffixPreview" is a deprecated alias for "suffix" and must produce identical output.
         ee_testcase tc = {0};
-        tc.desc = "find suffix";
+        tc.desc = "find suffixPreview";
         tc.algorithm = MONGOCRYPT_ALGORITHM_STRING_STR;
-        tc.query_type = MONGOCRYPT_QUERY_TYPE_SUFFIX_STR;
+        tc.query_type = MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR;
         tc.contention_factor = OPT_I64(1);
         tc.msg = TEST_BSON("{'v': 'abc'}");
         tc.user_key_id = &keyABC_id;
@@ -2529,10 +2530,11 @@ static void _test_encrypt_fle2_explicit(_mongocrypt_tester_t *tester) {
     }
 
     {
+        // "prefixPreview" is a deprecated alias for "prefix" and must produce identical output.
         ee_testcase tc = {0};
-        tc.desc = "find prefix";
+        tc.desc = "find prefixPreview";
         tc.algorithm = MONGOCRYPT_ALGORITHM_STRING_STR;
-        tc.query_type = MONGOCRYPT_QUERY_TYPE_PREFIX_STR;
+        tc.query_type = MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR;
         tc.contention_factor = OPT_I64(1);
         tc.msg = TEST_BSON("{'v': 'abc'}");
         tc.user_key_id = &keyABC_id;
@@ -2548,9 +2550,27 @@ static void _test_encrypt_fle2_explicit(_mongocrypt_tester_t *tester) {
 
     {
         ee_testcase tc = {0};
-        tc.desc = "insert substring";
+        tc.desc = "find substring";
         tc.algorithm = MONGOCRYPT_ALGORITHM_STRING_STR;
-        tc.query_type = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR;
+        tc.query_type = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR;
+        tc.contention_factor = OPT_I64(1);
+        tc.msg = TEST_BSON("{'v': 'abc'}");
+        tc.user_key_id = &keyABC_id;
+        tc.keys_to_feed[0] = keyABC;
+        tc.text_opts = TEST_BSON(RAW_STRING({
+            "caseSensitive" : true,
+            "diacriticSensitive" : true,
+            "substring" : {"strMaxLength" : 100, "strMinQueryLength" : 1, "strMaxQueryLength" : 100}
+        }));
+        tc.expect = TEST_FILE("./test/data/fle2-explicit/find-substring.json");
+        ee_testcase_run(&tc);
+    }
+
+    {
+        ee_testcase tc = {0};
+        tc.desc = "find substring";
+        tc.algorithm = MONGOCRYPT_ALGORITHM_STRING_STR;
+        tc.query_type = MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR;
         tc.contention_factor = OPT_I64(1);
         tc.msg = TEST_BSON("{'v': 'abc'}");
         tc.user_key_id = &keyABC_id;
@@ -4410,8 +4430,9 @@ static void _test_rangePreview_fails(_mongocrypt_tester_t *tester) {
     bson_free(local_kek);
 }
 
-// `_test_prefixPreview_suffixPreview_fails` tests that use of "prefixPreview" or "suffixPreview" errors.
-static void _test_prefixPreview_suffixPreview_fails(_mongocrypt_tester_t *tester) {
+// `_test_prefixPreview_suffixPreview_succeeds` tests that "prefixPreview" and "suffixPreview" are accepted as
+// deprecated aliases for "prefix" and "suffix".
+static void _test_prefixPreview_suffixPreview_succeeds(_mongocrypt_tester_t *tester) {
 #define TF(suffix) TEST_FILE("./test/data/fle2-insert-text-search-preview/" suffix)
 
     // local_kek is the KEK used to encrypt the keyMaterial in ./test/data/key-document-local.json
@@ -4420,35 +4441,31 @@ static void _test_prefixPreview_suffixPreview_fails(_mongocrypt_tester_t *tester
     mongocrypt_binary_t *kms_providers =
         TEST_BSON(BSON_STR({"local" : {"key" : {"$binary" : {"base64" : "%s", "subType" : "00"}}}}), local_kek);
 
-    // Test setting 'prefixPreview' as an explicit encryption queryType results in error.
+    // Test setting 'prefixPreview' as an explicit encryption queryType succeeds.
     {
         mongocrypt_t *crypt = mongocrypt_new();
         mongocrypt_setopt_kms_providers(crypt, kms_providers);
         ASSERT_OK(mongocrypt_init(crypt), crypt);
         mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
         ASSERT_OK(ctx, crypt);
-        ASSERT_FAILS(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR, -1),
-                     ctx,
-                     "Query type 'prefixPreview' is deprecated");
+        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR, -1), ctx);
         mongocrypt_ctx_destroy(ctx);
         mongocrypt_destroy(crypt);
     }
 
-    // Test setting 'suffixPreview' as an explicit encryption queryType results in error.
+    // Test setting 'suffixPreview' as an explicit encryption queryType succeeds.
     {
         mongocrypt_t *crypt = mongocrypt_new();
         mongocrypt_setopt_kms_providers(crypt, kms_providers);
         ASSERT_OK(mongocrypt_init(crypt), crypt);
         mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
         ASSERT_OK(ctx, crypt);
-        ASSERT_FAILS(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR, -1),
-                     ctx,
-                     "Query type 'suffixPreview' is deprecated");
+        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR, -1), ctx);
         mongocrypt_ctx_destroy(ctx);
         mongocrypt_destroy(crypt);
     }
 
-    // Test setting 'prefixPreview' from encryptedFields results in error.
+    // Test setting 'prefixPreview' from encryptedFields succeeds.
     {
         mongocrypt_t *crypt = mongocrypt_new();
         mongocrypt_setopt_kms_providers(crypt, kms_providers);
@@ -4457,14 +4474,12 @@ static void _test_prefixPreview_suffixPreview_fails(_mongocrypt_tester_t *tester
         ASSERT_OK(mongocrypt_init(crypt), crypt);
         mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
         ASSERT_OK(ctx, crypt);
-        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TF("cmd.json")),
-                     ctx,
-                     "Cannot use field 'encrypted' with 'prefixPreview' queries");
+        ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TF("cmd.json")), ctx);
         mongocrypt_ctx_destroy(ctx);
         mongocrypt_destroy(crypt);
     }
 
-    // Test setting 'suffixPreview' from encryptedFields results in error.
+    // Test setting 'suffixPreview' from encryptedFields succeeds.
     {
         mongocrypt_t *crypt = mongocrypt_new();
         mongocrypt_setopt_kms_providers(crypt, kms_providers);
@@ -4473,9 +4488,7 @@ static void _test_prefixPreview_suffixPreview_fails(_mongocrypt_tester_t *tester
         ASSERT_OK(mongocrypt_init(crypt), crypt);
         mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
         ASSERT_OK(ctx, crypt);
-        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TF("cmd.json")),
-                     ctx,
-                     "Cannot use field 'encrypted' with 'suffixPreview' queries");
+        ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TF("cmd.json")), ctx);
         mongocrypt_ctx_destroy(ctx);
         mongocrypt_destroy(crypt);
     }
@@ -4490,7 +4503,7 @@ static void _test_textPreview_fails(_mongocrypt_tester_t *tester) {
     mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
     ASSERT_FAILS(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_TEXTPREVIEW_DEPRECATED_STR, -1),
                  ctx,
-                 "unsupported algorithm");
+                 "please use 'string'");
     mongocrypt_ctx_destroy(ctx);
     mongocrypt_destroy(crypt);
 }
@@ -6904,7 +6917,7 @@ void _mongocrypt_tester_install_ctx_encrypt(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_encrypt_fle2_insert_text_search_payload_with_str_encode_version);
     INSTALL_TEST(_test_bulkWrite);
     INSTALL_TEST(_test_rangePreview_fails);
-    INSTALL_TEST(_test_prefixPreview_suffixPreview_fails);
+    INSTALL_TEST(_test_prefixPreview_suffixPreview_succeeds);
     INSTALL_TEST(_test_textPreview_fails);
     INSTALL_TEST(_test_no_trimFactor);
     INSTALL_TEST(_test_range_sends_cryptoParams);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-setopt.c

@@ -1004,9 +1004,18 @@ static void _test_setopt_for_explicit_encrypt(_mongocrypt_tester_t *tester) {
         /* Set key ID to get past the 'either key id or key alt name required'
          * error */
         ASSERT_KEY_ID_OK(uuid);
-        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR, -1), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR, -1),
+                  ctx);
         ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGE_STR, -1), ctx);
-        ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "substringPreview query type requires string index type");
+        ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "substring query type requires string index type");
+
+        REFRESH;
+        /* Set key ID to get past the 'either key id or key alt name required'
+         * error */
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR, -1), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGE_STR, -1), ctx);
+        ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "substring query type requires string index type");
 
         REFRESH;
         /* Set key ID to get past the 'either key id or key alt name required'
@@ -1041,23 +1050,19 @@ static void _test_setopt_for_explicit_encrypt(_mongocrypt_tester_t *tester) {
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "suffix query type requires string index type");
     }
 
-    // Can't use "prefixPreview" or "suffixPreview".
+    // "prefixPreview" and "suffixPreview" are accepted as deprecated aliases for "prefix" and "suffix".
     {
         mongocrypt_destroy(crypt);
         crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
         REFRESH_CTX;
         ASSERT_KEY_ID_OK(uuid);
-        ASSERT_FAILS(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR, -1),
-                     ctx,
-                     "'prefixPreview' is deprecated");
+        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR, -1), ctx);
 
         mongocrypt_destroy(crypt);
         crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
         REFRESH_CTX;
         ASSERT_KEY_ID_OK(uuid);
-        ASSERT_FAILS(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR, -1),
-                     ctx,
-                     "'suffixPreview' is deprecated");
+        ASSERT_OK(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR, -1), ctx);
     }
 
     /* It is an error to set a string algorithm without setting text options */

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-kms-ctx.c

@@ -20,6 +20,7 @@
 #include "mongocrypt-key-private.h"
 #include "mongocrypt-kms-ctx-private.h"
 #include "mongocrypt-private.h"
+#include "test-mongocrypt-assert.h"
 #include "test-mongocrypt-util.h"
 #include "test-mongocrypt.h"
 
@@ -885,6 +886,100 @@ static void _test_mongocrypt_kms_ctx_feed_empty_bytes(_mongocrypt_tester_t *test
     mongocrypt_status_destroy(status);
 }
 
+// _test_mongocrypt_kms_ctx_kmip_response_bad_length tests KMIP responses that report bad lengths.
+static void _test_mongocrypt_kms_ctx_kmip_response_bad_length(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    bool ok;
+    uint8_t secretdata[KMS_KMIP_REQUEST_SECRETDATA_LENGTH] = {0};
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    _mongocrypt_endpoint_t *endpoint = _mongocrypt_endpoint_new("example.com", -1, NULL /* opts */, status);
+    ASSERT_OK_STATUS(endpoint != NULL, status);
+
+    // Regression test for MONGOCRYPT-909: test UINT32_MAX
+    {
+        mongocrypt_kms_ctx_t kms_ctx = {0};
+        static const char *kmip_header = "\x42\x00\x7b\x01"  // Tag=ResponseMessage, Type=Structure
+                                         "\xff\xff\xff\xff"; // Length = UINT32_MAX
+
+        ok = _mongocrypt_kms_ctx_init_kmip_register(&kms_ctx,
+                                                    endpoint,
+                                                    secretdata,
+                                                    KMS_KMIP_REQUEST_SECRETDATA_LENGTH,
+                                                    "kmip",
+                                                    &crypt->log);
+        ASSERT_OK_STATUS(ok, kms_ctx.status);
+
+        // Parser requests 8 bytes for initial header:
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 8u);
+
+        mongocrypt_binary_t *bytes = mongocrypt_binary_new_from_data((uint8_t *)kmip_header, 8u);
+
+        // Expect error (not abort):
+        ASSERT_FAILS(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx, "KMS KMIP response too large");
+
+        mongocrypt_binary_destroy(bytes);
+        _mongocrypt_kms_ctx_cleanup(&kms_ctx);
+    }
+
+    // Length reported is less than data fed.
+    {
+        mongocrypt_kms_ctx_t kms_ctx = {0};
+        static const char *kmip_header = "\x42\x00\x7b\x01"  // Tag=ResponseMessage, Type=Structure
+                                         "\x00\x00\x00\x01"; // Length = 1
+        ASSERT_OK_STATUS(endpoint != NULL, status);
+
+        ok = _mongocrypt_kms_ctx_init_kmip_register(&kms_ctx,
+                                                    endpoint,
+                                                    secretdata,
+                                                    KMS_KMIP_REQUEST_SECRETDATA_LENGTH,
+                                                    "kmip",
+                                                    &crypt->log);
+        ASSERT_OK_STATUS(ok, kms_ctx.status);
+
+        // Parser requests 8 bytes for initial header:
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 8u);
+
+        mongocrypt_binary_t *bytes = mongocrypt_binary_new_from_data((uint8_t *)kmip_header, 8u);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx);
+
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 1u);
+        // Attempting to feed more data errors.
+        ASSERT_FAILS(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx, "KMS response fed too much data");
+
+        mongocrypt_binary_destroy(bytes);
+        _mongocrypt_kms_ctx_cleanup(&kms_ctx);
+    }
+
+    // Length reported is zero.
+    {
+        mongocrypt_kms_ctx_t kms_ctx = {0};
+        static const char *kmip_header = "\x42\x00\x7b\x01"  // Tag=ResponseMessage, Type=Structure
+                                         "\x00\x00\x00\x00"; // Length = 0
+        ASSERT_OK_STATUS(endpoint != NULL, status);
+
+        ok = _mongocrypt_kms_ctx_init_kmip_register(&kms_ctx,
+                                                    endpoint,
+                                                    secretdata,
+                                                    KMS_KMIP_REQUEST_SECRETDATA_LENGTH,
+                                                    "kmip",
+                                                    &crypt->log);
+        ASSERT_OK_STATUS(ok, kms_ctx.status);
+
+        // Parser requests 8 bytes for initial header:
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 8u);
+
+        mongocrypt_binary_t *bytes = mongocrypt_binary_new_from_data((uint8_t *)kmip_header, 8u);
+        ASSERT_FAILS(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx, "Error getting UniqueIdentifer");
+
+        mongocrypt_binary_destroy(bytes);
+        _mongocrypt_kms_ctx_cleanup(&kms_ctx);
+    }
+
+    _mongocrypt_endpoint_destroy(endpoint);
+    mongocrypt_status_destroy(status);
+    mongocrypt_destroy(crypt);
+}
+
 void _mongocrypt_tester_install_kms_ctx(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_mongocrypt_kms_ctx_kmip_register);
     INSTALL_TEST(_test_mongocrypt_kms_ctx_kmip_activate);
@@ -895,4 +990,5 @@ void _mongocrypt_tester_install_kms_ctx(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_mongocrypt_kms_ctx_get_kms_provider);
     INSTALL_TEST(_test_mongocrypt_kms_ctx_default_port);
     INSTALL_TEST(_test_mongocrypt_kms_ctx_feed_empty_bytes);
+    INSTALL_TEST(_test_mongocrypt_kms_ctx_kmip_response_bad_length);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt.c

@@ -906,6 +906,16 @@ static void _test_setopt_kms_providers(_mongocrypt_tester_t *tester) {
         ASSERT_FAILS(mongocrypt_setopt_kms_providers(crypt, more), crypt, "already set");
         mongocrypt_destroy(crypt);
     }
+
+    // Errors if followed by call to `mongocrypt_setopt_kms_providers` configuring "kmip".
+    // This is a regression test for: MONGOCRYPT-956
+    {
+        mongocrypt_binary_t *kms_providers = TEST_BSON("{'kmip' : {'endpoint' : 'localhost'}}");
+        mongocrypt_t *crypt = mongocrypt_new();
+        ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, kms_providers), crypt);
+        ASSERT_FAILS(mongocrypt_setopt_kms_providers(crypt, kms_providers), crypt, "already set");
+        mongocrypt_destroy(crypt);
+    }
 }
 
 static void test_tmp_bsonf(_mongocrypt_tester_t *tester) {

data/lib/libmongocrypt_helper/version.rb

@@ -1,5 +1,5 @@
 module LibmongocryptHelper
-  VERSION = '1.19.0.0.1001'
+  VERSION = '1.20.1.0.1001'
 
-  LIBMONGOCRYPT_VERSION = '1.19.0'
+  LIBMONGOCRYPT_VERSION = '1.20.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: libmongocrypt-helper
 version: !ruby/object:Gem::Version
-  version: 1.19.0.0.1001
+  version: 1.20.1.0.1001
 platform: ruby
 authors:
 - The MongoDB Ruby Team
@@ -1250,7 +1250,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.13
+rubygems_version: 4.0.17
 specification_version: 4
 summary: libmongocrypt convenience package
 test_files: []