libmongocrypt-helper 1.6.1.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/etc/calc_release_version.py

@@ -0,0 +1,265 @@
+#!/usr/bin/env python
+
+#
+# Copyright 2018-present MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+"""
+A script that calculates the release version number (based on the current Git
+branch and/or recent tags in history) to assign to a tarball generated from the
+current Git commit.
+"""
+
+import datetime
+import re
+import subprocess
+import sys
+from distutils.version import LooseVersion
+
+DEBUG = len(sys.argv) > 1 and '-d' in sys.argv
+if DEBUG:
+    print('Debugging output enabled.')
+
+# This options indicates to output the next minor release version
+NEXT_MINOR = len(sys.argv) > 1 and '--next-minor' in sys.argv
+
+RELEASE_TAG_RE = re.compile('(?P<ver>(?P<vermaj>[0-9]+)\\.(?P<vermin>[0-9]+)'
+                            '\\.(?P<verpatch>[0-9]+)(?:-(?P<verpre>.*))?)')
+RELEASE_BRANCH_RE = re.compile('(?:(?:refs/remotes/)?origin/)?(?P<brname>r'
+                               '(?P<vermaj>[0-9]+)\\.(?P<vermin>[0-9]+))')
+
+def check_output(args):
+    """
+    Delegates to subprocess.check_output() if it is available, otherwise
+    provides a reasonable facsimile.
+    """
+    if 'check_output' in dir(subprocess):
+        out = subprocess.check_output(args)
+    else:
+        proc = subprocess.Popen(args, stdout=subprocess.PIPE)
+        out, err = proc.communicate()
+        ret = proc.poll()
+        if ret:
+            raise subprocess.CalledProcessError(ret, args[0], output=out)
+
+    if type(out) is bytes:
+        # git isn't guaranteed to always return UTF-8, but for our purposes
+        # this should be fine as tags and hashes should be ASCII only.
+        out = out.decode('utf-8')
+
+    return out
+
+
+def check_head_tag():
+    """
+    Checks the current HEAD to see if it has been tagged with a tag that matches
+    the pattern for a release tag.  Returns release version calculated from the
+    tag, or None if there is no matching tag associated with HEAD.
+    """
+
+    found_tag = False
+    version_loose = LooseVersion('0.0.0')
+
+    # have git tell us if any tags that look like release tags point at HEAD;
+    # based on our policy, a commit should never have more than one release tag
+    tags = check_output(['git', 'tag', '--points-at', 'HEAD', '--list', '1.*']).split()
+    tag = ''
+    if len(tags) == 1:
+        tag = tags[0]
+    elif len(tags) > 1:
+        raise Exception('Expected 1 or 0 tags on HEAD, got: {}'.format(tags))
+
+    release_tag_match = RELEASE_TAG_RE.match(tag)
+    if release_tag_match:
+        new_version_loose = LooseVersion(release_tag_match.group('ver'))
+        if new_version_loose > version_loose:
+            if DEBUG:
+                print('HEAD release tag: ' + release_tag_match.group('ver'))
+            version_loose = new_version_loose
+            found_tag = True
+
+    if found_tag:
+        if DEBUG:
+            print('Calculated version: ' + str(version_loose))
+        return str(version_loose)
+
+    return None
+
+def get_next_minor(prerelease_marker):
+    """
+    get_next_minor does the following:
+        - Inspect the branches that fit the convention for a release branch.
+        - Choose the latest and increment the minor version.
+        - Append .0 to form the new version (e.g., r1.21 becomes 1.22.0)
+        - Append a pre-release marker. (e.g. 1.22.0 becomes 1.22.0-20220201+gitf6e6a7025d)
+    """
+
+    version_loose = LooseVersion('0.0.0')
+
+    version_new = {}
+    # Use refs (not branches) to get local branches plus remote branches
+    refs = check_output(['git', 'show-ref']).splitlines()
+    for ref in refs:
+        release_branch_match = RELEASE_BRANCH_RE.match(ref.split()[1])
+        if release_branch_match:
+            # Construct a candidate version from this branch name
+            version_new['major'] = int(release_branch_match.group('vermaj'))
+            version_new['minor'] = int(release_branch_match.group('vermin')) + 1
+            version_new['patch'] = 0
+            version_new['prerelease'] = prerelease_marker
+            new_version_loose = LooseVersion(str(version_new['major']) + '.' +
+                                             str(version_new['minor']) + '.' +
+                                             str(version_new['patch']) + '-' +
+                                             version_new['prerelease'])
+            if new_version_loose > version_loose:
+                version_loose = new_version_loose
+                if DEBUG:
+                    print('Found new best version "' + str(version_loose) \
+                            + '" based on branch "' \
+                            + release_branch_match.group('brname') + '"')
+    return str(version_loose)
+
+def get_branch_tags(active_branch_name):
+    """
+    Returns the tag or tags (as a single string with newlines between tags)
+    corresponding to the current branch, which must not be master.  If the
+    specified branch is a release branch then return all tags based on the
+    major/minor X.Y release version.  If the specified branch is neither master
+    nor a release branch, then walk backwards in history until the first tag
+    matching the glob '1.*' and return that tag.
+    """
+
+    if active_branch_name == 'master':
+        raise Exception('this method is not meant to be called while on "master"')
+    tags = ''
+    release_branch_match = RELEASE_BRANCH_RE.match(active_branch_name)
+    if release_branch_match:
+        # This is a release branch, so look for tags only on this branch
+        tag_glob = release_branch_match.group('vermaj') + '.' \
+                + release_branch_match.group('vermin') + '.*'
+        tags = check_output(['git', 'tag', '--list', tag_glob])
+    else:
+        # Not a release branch, so look for the most recent tag in history
+        commits = check_output(['git', 'log', '--pretty=format:%H',
+                                '--no-merges'])
+        if len(commits) > 0:
+            for commit in commits.splitlines():
+                tags = check_output(['git', 'tag', '--points-at',
+                                     commit, '--list', '1.*'])
+                if len(tags) > 0:
+                    # found a tag, we should be done
+                    break
+
+    return tags
+
+def process_and_sort_tags(tags):
+    """
+    Given a string (as returned from get_branch_tags), return a sorted list of
+    zero or more tags (sorted based on the LooseVersion comparison) which meet
+    the following criteria:
+        - a final release tag (i.e., 1.x.y without any pre-release suffix)
+        - a pre-release tag which is not superseded by a release tag (i.e.,
+          1.x.y-preX iff 1.x.y does not already exist)
+    """
+
+    processed_and_sorted_tags = []
+    if not tags or len(tags) == 0:
+        return processed_and_sorted_tags
+
+    raw_tags = tags.splitlines()
+    # find all the final release tags
+    for tag in raw_tags:
+        release_tag_match = RELEASE_TAG_RE.match(tag)
+        if release_tag_match and not release_tag_match.group('verpre'):
+            processed_and_sorted_tags.append(tag)
+    # collect together final release tags and pre-release tags for
+    # versions that have not yet had a final release
+    for tag in raw_tags:
+        tag_parts = tag.split('-')
+        if len(tag_parts) >= 2 and tag_parts[0] not in processed_and_sorted_tags:
+            processed_and_sorted_tags.append(tag)
+    processed_and_sorted_tags.sort(key=LooseVersion)
+
+    return processed_and_sorted_tags
+
+def main():
+    """
+    The algorithm is roughly:
+
+        - Is the --next-minor flag passed? If "yes", then return the next minor
+           release with a pre-release marker.
+        - Is the current HEAD associated with a tag that looks like a release
+           version?
+        - If "yes" then use that as the version
+        - If "no" then is the current branch master?
+        - If "yes" the current branch is master, then return the next minor
+           release with a pre-release marker.
+        - If "no" the current branch is not master, then determine the most
+           recent tag in history; strip any pre-release marker, increment the
+           patch version, and append a new pre-release marker
+    """
+
+    version_loose = LooseVersion('0.0.0')
+    head_commit_short = check_output(['git', 'rev-parse', '--revs-only',
+                                      '--short=10', 'HEAD^{commit}']).strip()
+    prerelease_marker = datetime.date.today().strftime('%Y%m%d') \
+            + '+git' + head_commit_short
+
+    if NEXT_MINOR:
+        if DEBUG:
+            print('Calculating next minor release')
+        return get_next_minor(prerelease_marker)
+
+    head_tag_ver = check_head_tag()
+    if head_tag_ver:
+        return head_tag_ver
+
+    active_branch_name = check_output(['git', 'rev-parse',
+                                       '--abbrev-ref', 'HEAD']).strip()
+    if DEBUG:
+        print('Calculating release version for branch: ' + active_branch_name)
+    if active_branch_name == 'master':
+        return get_next_minor(prerelease_marker)
+
+    branch_tags = get_branch_tags(active_branch_name)
+    tags = process_and_sort_tags(branch_tags)
+
+    tag = tags[-1] if len(tags) > 0 else ''
+    # at this point the RE match is redundant, but convenient for accessing
+    # the components of the version string
+    release_tag_match = RELEASE_TAG_RE.match(tag)
+    if release_tag_match:
+        version_new = {}
+        version_new['major'] = int(release_tag_match.group('vermaj'))
+        version_new['minor'] = int(release_tag_match.group('vermin'))
+        version_new['patch'] = int(release_tag_match.group('verpatch')) + 1
+        version_new['prerelease'] = prerelease_marker
+        new_version_loose = LooseVersion(str(version_new['major']) + '.' +
+                                         str(version_new['minor']) + '.' +
+                                         str(version_new['patch']) + '-' +
+                                         version_new['prerelease'])
+        if new_version_loose > version_loose:
+            version_loose = new_version_loose
+            if DEBUG:
+                print('Found new best version "' + str(version_loose) \
+                        + '" from tag "' + release_tag_match.group('ver') + '"')
+
+    return str(version_loose)
+
+RELEASE_VER = main()
+
+if DEBUG:
+    print('Final calculated release version:')
+print(RELEASE_VER)

data/ext/libmongocrypt/libmongocrypt/etc/debian/control

@@ -0,0 +1,33 @@
+Source: libmongocrypt
+Priority: optional
+Maintainer: Mongo C Driver Team <mongo-c-driver-debian@googlegroups.com>
+Uploaders: Kevin Albertson <kevin.albertson@mongodb.com>,
+           Clyde Bazile <clyde.bazile@mongodb.com>,
+           Samantha Ritter <samantha.ritter@mongodb.com>,
+           Roberto C. Sanchez <roberto@connexer.com>
+Standards-Version: 4.5.0
+Section: libs
+Homepage: https://github.com/mongodb/libmongocrypt
+
+Package: libmongocrypt-dev
+Section: libdevel
+Architecture: any
+Multi-Arch: same
+Depends: libmongocrypt0 (= ${binary:Version}), ${misc:Depends}
+Description: client-side field level encryption library - dev files
+ libmongocrypt facilitates the client-side encryption and decryption,
+ at the field level, of data stored in MongoDB.
+ .
+ This package contains the libmongocrypt and libkms_message development
+ headers and libraries.
+
+Package: libmongocrypt0
+Architecture: any
+Multi-Arch: same
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: client-side field level encryption library - runtime files
+ libmongocrypt facilitates the client-side encryption and decryption,
+ at the field level, of data stored in MongoDB.
+ .
+ This package contains the libmongocrypt and libkms_message runtime
+ libraries.

data/ext/libmongocrypt/libmongocrypt/etc/debian/rules

@@ -0,0 +1,41 @@
+#!/usr/bin/make -f
+# See debhelper(7) (uncomment to enable)
+# output every command that modifies files on the build system.
+export DH_VERBOSE = 1
+
+
+# see FEATURE AREAS in dpkg-buildflags(1)
+#export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+
+# see ENVIRONMENT in dpkg-buildflags(1)
+# package maintainers to append CFLAGS
+#export DEB_CFLAGS_MAINT_APPEND  = -Wall -pedantic
+# package maintainers to append LDFLAGS
+#export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
+
+
+%:
+	dh $@
+
+override_dh_auto_configure:
+	# nothing to configure
+
+override_dh_auto_build:
+	# nothing to build
+
+override_dh_auto_install:
+	mkdir -p $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)
+	mkdir -p $(CURDIR)/debian/tmp/usr/include
+	cp -dv $(CURDIR)/lib/*.so.* $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)
+	cp -dv $(CURDIR)/lib/*.so $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)
+	cp -v $(CURDIR)/lib/*.a $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)
+	cp -rv $(CURDIR)/lib/cmake $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)
+	cp -rv $(CURDIR)/lib/pkgconfig $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)
+	sed -i -e 's|{prefix}/lib|{prefix}/lib/$(DEB_HOST_MULTIARCH)|g' \
+		-e 's|^prefix=.*|prefix=/usr|' \
+		$(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig/*.pc
+	sed -i -r -e 's/get_filename_component\(_IMPORT_PREFIX "\$$\{CMAKE_CURRENT_LIST_FILE\}" PATH\)/&\nget_filename_component\(_IMPORT_PREFIX "\$$\{_IMPORT_PREFIX\}" PATH\)/' \
+		-e "s+lib/lib(mongocrypt|kms_message)+lib/$(DEB_HOST_MULTIARCH)/lib\1+" \
+		$(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)/cmake/*/*.cmake
+	cp -rv $(CURDIR)/include/* $(CURDIR)/debian/tmp/usr/include
+

data/ext/libmongocrypt/libmongocrypt/etc/debian/source/format

@@ -0,0 +1 @@
+1.0

data/ext/libmongocrypt/libmongocrypt/etc/fle2_aead_generate_tests.py

@@ -0,0 +1,41 @@
+# fle2_aead_generate_tests.py is used to generate the test file: ./test/data/fle2-aead.cstructs
+import os
+import itertools
+import fle2_crypto
+
+# Generate test cases by taking the cross-product of AD (associated data) and plaintext (M) lengths.
+AD_lens = [5, 10, 20]
+M_lens = [1, 16, 64, 100]
+
+tmpl = """{{
+    .testname = "{testname}",
+    .iv = "{iv}",
+    .associated_data = "{associated_data}",
+    .key = "{key}",
+    .plaintext = "{plaintext}",
+    .ciphertext = "{ciphertext}",
+    .bytes_written_expected = {bytes_written_expected}
+}},"""
+
+print("/* This file is generated by ./etc/fle2_aead_generate_tests.py. */")
+for (AD_len, M_len) in itertools.product(AD_lens, M_lens):
+    M = os.urandom(M_len)
+    AD = os.urandom(AD_len)
+    IV = os.urandom(16)
+    Ke = os.urandom(32)
+    Km = os.urandom(32)
+    C = fle2_crypto.fle2aead_encrypt(M=M, Ke=Ke, IV=IV, Km=Km, AD=AD)
+
+    # Create the 96 byte data encryption key. The last 32 are unused.
+    key = Ke + Km + (b"\x00" * 32)
+    args = {
+        "testname": "generated test. AD length={}, M length={}".format(AD_len, M_len),
+        "iv": IV.hex(),
+        "associated_data": AD.hex(),
+        "key": key.hex(),
+        "plaintext": M.hex(),
+        "ciphertext": C.hex(),
+        "bytes_written_expected": len(C)
+    }
+    testcase = tmpl.format(**args)
+    print(testcase)

data/ext/libmongocrypt/libmongocrypt/etc/fle2_crypto.py

@@ -0,0 +1,105 @@
+from cryptography.hazmat.primitives import hashes, hmac
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+import struct
+
+ENCRYPTION_KEY_LENGTH = 32
+MAC_KEY_LENGTH = 32
+HMAC_SHA256_TAG_LENGTH = 32
+IV_LENGTH = 16
+DEK_LENGTH = 96
+
+def _hmacsha256 (Km, input):
+    assert (len(Km) == MAC_KEY_LENGTH)
+    hm = hmac.HMAC(Km, hashes.SHA256())
+    hm.update (input)
+    return hm.finalize()
+
+class DEK ():
+    """
+    Class representing a Data Encryption Key (DEK)
+    """
+    def __init__ (self, bytesIn):
+        assert (len(bytesIn) == DEK_LENGTH)
+        self.Ke = bytesIn[0:32]
+        self.Km = bytesIn[32:64]
+        self.TokenKey = bytesIn[64:96]
+
+def fle2_encrypt (M, Ke, IV):
+    """
+    Compute 
+    S = AES-CTR.Enc(Ke, IV, M)
+
+    Output 
+    C = IV || S
+    """
+    assert (len(Ke) == ENCRYPTION_KEY_LENGTH)
+    assert (len(IV) == IV_LENGTH)
+
+    # S = AES-CTR.Enc(Ke, IV, M)
+    cipher = Cipher(algorithms.AES(Ke), modes.CTR(IV))
+    encryptor = cipher.encryptor()
+    S = encryptor.update(M) + encryptor.finalize()
+
+    C = IV + S
+    return C
+
+def fle2_decrypt (C, Ke):
+    assert (len(Ke) == ENCRYPTION_KEY_LENGTH)
+    assert (len(C) > IV_LENGTH)
+
+    IV = C[0:IV_LENGTH]
+    # S = AES-CTR.Enc(Ke, IV, M)
+    cipher = Cipher(algorithms.AES(Ke), modes.CTR(IV))
+    encryptor = cipher.decryptor()
+    M = encryptor.update(C[IV_LENGTH:]) + encryptor.finalize()
+    return M
+
+def fle2aead_encrypt(M, Ke, IV, Km, AD):
+    """
+    Do FLE 2 AEAD encryption.
+    See [AEAD with CTR](https://docs.google.com/document/d/1eCU7R8Kjr-mdyz6eKvhNIDVmhyYQcAaLtTfHeK7a_vE/edit#heading=h.35kjadvlcbty)
+    See [aead_encryption_fle2_test_vectors.sh](https://github.com/mongodb/mongo/blob/ecc66915ac757cbeaa7c40eb443d7ec7bffcb80a/src/mongo/crypto/scripts/aead_encryption_fle2_test_vectors.sh#L15) for how server team is generating this.
+    """
+    assert (len(Ke) == ENCRYPTION_KEY_LENGTH)
+    assert (len(IV) == IV_LENGTH)
+    assert (len(Km) == MAC_KEY_LENGTH)
+
+    # S = AES-CTR.Enc(Ke, IV, M)
+    cipher = Cipher(algorithms.AES(Ke), modes.CTR(IV))
+    encryptor = cipher.encryptor()
+    S = encryptor.update(M) + encryptor.finalize()
+
+    # T = HMAC-SHA256(Km, AD || IV || S)
+    T = _hmacsha256 (Km, AD + IV + S)
+
+    # C = IV || S || T
+    C = IV + S + T
+    return C
+
+
+def fle2aead_decrypt(C, Km, AD, Ke):
+    assert (len(Ke) == ENCRYPTION_KEY_LENGTH)
+    assert (len(C) > HMAC_SHA256_TAG_LENGTH + IV_LENGTH)
+    assert (len(Km) == MAC_KEY_LENGTH)
+
+    # Parse C as IV || S || T
+    IV = C[0:IV_LENGTH]
+    S = C[IV_LENGTH:-HMAC_SHA256_TAG_LENGTH]
+    T = C[-HMAC_SHA256_TAG_LENGTH:]
+
+    # Compute T' = HMAC-SHA256(Km, AD || IV || S)
+    Tp = _hmacsha256 (Km, AD + IV + S)
+    if Tp != T:
+        raise Exception("decryption error")
+
+    # Else compute and output M = AES-CTR.Dec(Ke, S)
+    cipher = Cipher(algorithms.AES(Ke), modes.CTR(IV))
+    decryptor = cipher.decryptor()
+    M = decryptor.update(S) + decryptor.finalize()
+
+    return M
+
+
+def ServerDataEncryptionLevel1Token (rootKey):
+    return _hmacsha256 (rootKey, struct.pack("<Q", 3))

data/ext/libmongocrypt/libmongocrypt/etc/fle2_crypto_selftest.py

@@ -0,0 +1,52 @@
+import unittest
+import fle2_crypto
+
+class TestCrypto (unittest.TestCase):
+    def test_ServerDataEncryptionLevel1Token (self):
+        rootKey = bytes.fromhex("6eda88c8496ec990f5d5518dd2ad6f3d9c33b6055904b120f12de82911fbd933")
+        expect = bytes.fromhex("d915ccc1eb81687fb5fc5b799f48c99fbe17e7a011a46a48901b9ae3d790656b")
+        self.assertEqual (fle2_crypto.ServerDataEncryptionLevel1Token (rootKey), expect)
+
+    def test_fle2_encrypt_decrypt (self):
+        IV = bytes.fromhex("918ab83c8966995dfb528a0020d9bb10")
+        Ke = bytes.fromhex(
+            "c0b091fd93dfbb2422e53553f971d8127f3731058ba67f32b1549c53fce4120e")
+        got_C = fle2_crypto.fle2_encrypt (b"foobar", Ke, IV)
+        got_M = fle2_crypto.fle2_decrypt (got_C, Ke)
+        self.assertEqual (got_M, b"foobar")
+
+
+    def test_fle2_aead_encrypt(self):
+        AD = bytes.fromhex("99f05406f40d1af74cc737a96c1932fdec90")
+        IV = bytes.fromhex("918ab83c8966995dfb528a0020d9bb10")
+        Ke = bytes.fromhex(
+            "c0b091fd93dfbb2422e53553f971d8127f3731058ba67f32b1549c53fce4120e")
+        Km = bytes.fromhex(
+            "50ecc9c6c1a6277ad951f729b3cc6446e21b4024345088a0edda82231a46ca9a")
+        M = bytes.fromhex("74657374310a")
+        expect_C = bytes.fromhex(
+            "918ab83c8966995dfb528a0020d9bb1070cead40b081ee0cbfe7265dd57a84f6c331421b7fe6a9c8375748b46acbed1ec7a1b998387c")
+        got_C = fle2_crypto.fle2aead_encrypt(M=M, Ke=Ke, IV=IV, Km=Km, AD=AD)
+        self.assertEqual(expect_C, got_C)
+
+    def test_fle2_aead_decrypt(self):
+        AD = bytes.fromhex("99f05406f40d1af74cc737a96c1932fdec90")
+        Ke = bytes.fromhex(
+            "c0b091fd93dfbb2422e53553f971d8127f3731058ba67f32b1549c53fce4120e")
+        Km = bytes.fromhex(
+            "50ecc9c6c1a6277ad951f729b3cc6446e21b4024345088a0edda82231a46ca9a")
+        expect_M = bytes.fromhex("74657374310a")
+        C = bytes.fromhex(
+            "918ab83c8966995dfb528a0020d9bb1070cead40b081ee0cbfe7265dd57a84f6c331421b7fe6a9c8375748b46acbed1ec7a1b998387c")
+        got_M = fle2_crypto.fle2aead_decrypt(C=C, Km=Km, AD=AD, Ke=Ke)
+        self.assertEqual(expect_M, got_M)
+
+        # Test an incorrect HMAC tag.
+        C = bytes.fromhex(
+            "918ab83c8966995dfb528a0020d9bb1070cead40b081ee0cbfe7265dd57a84f6c331421b7fe6a9c8375748b46acbed1ec7a1b9983800")
+        with self.assertRaises(Exception, msg="decryption error"):
+            fle2_crypto.fle2aead_decrypt(C=C, Km=Km, AD=AD, Ke=Ke)
+
+
+if __name__ == "__main__":
+    unittest.main()

data/ext/libmongocrypt/libmongocrypt/etc/fle2_generate_tests.py

@@ -0,0 +1,34 @@
+# fle2_generate_tests.py is used to generate the test file: ./test/data/fle2.cstructs
+import os
+import fle2_crypto
+
+# Generate test cases of various and plaintext (M) lengths.
+M_lens = [1, 16, 64, 100]
+
+tmpl = """{{
+    .testname = "{testname}",
+    .iv = "{iv}",
+    .key = "{key}",
+    .plaintext = "{plaintext}",
+    .ciphertext = "{ciphertext}",
+    .bytes_written_expected = {bytes_written_expected}
+}},"""
+
+print("/* This file is generated by ./etc/fle2_generate_tests.py. */")
+for M_len in M_lens:
+    M = os.urandom(M_len)
+    IV = os.urandom(16)
+    Ke = os.urandom(32)
+    C = fle2_crypto.fle2_encrypt(M=M, Ke=Ke, IV=IV)
+
+    key = Ke
+    args = {
+        "testname": "generated test. M length={}".format (M_len),
+        "iv": IV.hex(),
+        "key": key.hex(),
+        "plaintext": M.hex(),
+        "ciphertext": C.hex(),
+        "bytes_written_expected": len(C)
+    }
+    testcase = tmpl.format(**args)
+    print(testcase)

data/ext/libmongocrypt/libmongocrypt/etc/generate-kek-tests.py

@@ -0,0 +1,69 @@
+import json
+keks = {
+    "aws": {
+        "template": {
+            "provider": "aws",
+            "key": "example arn",
+            "region": "example region",
+            "endpoint": "example.com"
+        },
+        "optional": [ "endpoint" ],
+        "endpoints": [ "endpoint" ]
+    },
+    "local": {
+        "template": {
+            "provider": "local"
+        }
+    },
+    "azure": {
+        "template": {
+            "provider": "azure",
+            "keyVaultEndpoint": "keyvault.example.com",
+            "keyName": "example keyName",
+            "keyVersion": "example keyVersion"
+        },
+        "optional": [ "keyVersion" ],
+        "endpoints": [ "keyVaultEndpoint" ]
+    },
+    "gcp": {
+        "template": {
+            "provider": "gcp",
+            "projectId": "example projectId",
+            "location": "example location",
+            "keyRing": "example keyRing",
+            "keyName": "example keyName",
+            "keyVersion": "example keyVersion",
+            "endpoint": "example.com"
+        },
+        "optional": [ "endpoint", "keyVersion" ],
+        "endpoints": [ "endpoint" ]
+    }
+}
+
+testcases = []
+def add_testcase (input, expect):
+    testcases.append ({
+        "input": input,
+        "expect": expect
+    })
+
+for name, kek in keks.items():
+    # Add successful case.
+    add_testcase (kek["template"], "ok")
+
+    # Test that endpoints are validated.
+    if "endpoints" in kek:
+        testcase = kek["template"].copy()
+        for endpoint in kek["endpoints"]:
+            testcase[endpoint] = "invalid endpoint"
+            add_testcase (testcase, "invalid endpoint")
+
+    # Test with all optional fields removed.
+    if "optional" in kek:
+        testcase = {}
+        for k,v in kek["template"].items():
+            if k not in kek["optional"]:
+                testcase[k] = v
+        add_testcase (testcase, "ok")
+
+print (json.dumps(testcases, indent=4))