libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-dll-private.h

@@ -0,0 +1,97 @@
+#ifndef MONGOCRYPT_DLL_PRIVATE_H
+#define MONGOCRYPT_DLL_PRIVATE_H
+
+#include <mlib/str.h>
+#include <mlib/error.h>
+
+#include <stdlib.h>
+
+#if _WIN32
+#define MCR_DLL_SUFFIX ".dll"
+#elif __APPLE__
+#define MCR_DLL_SUFFIX ".dylib"
+#else
+#define MCR_DLL_SUFFIX ".so"
+#endif
+
+#define MCR_DLL_NULL \
+   ((mcr_dll){._native_handle = NULL, .error_string = MSTR_NULL})
+
+/**
+ * @brief A dynamically-loaded library i.e. returned by LoadLibrary() or
+ * dlopen()
+ */
+typedef struct mcr_dll {
+   // (All supported platforms use a void* as the library handle type)
+   void *_native_handle;
+   mstr error_string;
+} mcr_dll;
+
+/**
+ * @brief Open and load a dynamic library
+ *
+ * @param lib A path or name of a library, suitable for encoding as a
+ * filepath on the host system.
+ *
+ * @return mcr_dll A newly opened dynamic library, which must be
+ * released using @ref mcr_dll_close()
+ *
+ * If the given `lib` is a qualified path (either relative or absolute) and not
+ * just a filename, then the system will search for the library on the system's
+ * default library search paths. If `lib` is a qualified relative path (not just
+ * a filename), it will be resolved relative to the application's working
+ * directory.
+ */
+mcr_dll
+mcr_dll_open (const char *lib);
+
+/**
+ * @brief Close a dynamic library opened with @ref mcr_dll_open
+ *
+ * @param dll A dynamic library handle
+ */
+static inline void
+mcr_dll_close (mcr_dll dll)
+{
+   extern void mcr_dll_close_handle (mcr_dll);
+   mcr_dll_close_handle (dll);
+   mstr_free (dll.error_string);
+}
+
+/**
+ * @brief Obtain a pointer to an exported entity from the given dynamic library.
+ *
+ * @param dll A library opened with @ref mcr_dll_open
+ * @param symbol The name of a symbol to open
+ * @return void* A pointer to that symbol, or NULL if not found
+ */
+void *
+mcr_dll_sym (mcr_dll dll, const char *symbol);
+
+/**
+ * @brief Determine whether the given DLL is a handle to an open library
+ */
+static inline bool
+mcr_dll_is_open (mcr_dll dll)
+{
+   return dll._native_handle != NULL;
+}
+
+typedef struct mcr_dll_path_result {
+   mstr path;
+   mstr error_string;
+} mcr_dll_path_result;
+
+/**
+ * @brief Obtain a filepath to the given loaded DLL
+ *
+ * @param dll The library loaded to inspect
+ * @return mcr_dll_path_result A result containing the absolute path to a
+ * library, or an error string.
+ *
+ * @note Caller must free both `retval.path` and `retval.error_string`.
+ */
+mcr_dll_path_result
+mcr_dll_path (mcr_dll dll);
+
+#endif // MONGOCRYPT_DLL_PRIVATE_H

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-endian-private.h

@@ -0,0 +1,168 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* This file is copied and modified from kms_message kms_endian.h. */
+
+#ifndef MONGOCRYPT_ENDIAN_PRIVATE_H
+#define MONGOCRYPT_ENDIAN_PRIVATE_H
+
+#include <stdint.h>
+#include <string.h>
+
+/* Define a fallback for __has_builtin for compatibility with non-clang
+ * compilers. */
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+#if defined(__clang__) && __has_builtin(__builtin_bswap16) && \
+   __has_builtin(__builtin_bswap32) && __has_builtin(__builtin_bswap64)
+#define MONGOCRYPT_UINT16_SWAP_LE_BE(v) __builtin_bswap16 (v)
+#define MONGOCRYPT_UINT32_SWAP_LE_BE(v) __builtin_bswap32 (v)
+#define MONGOCRYPT_UINT64_SWAP_LE_BE(v) __builtin_bswap64 (v)
+#elif defined(__GNUC__) && (__GNUC__ >= 4)
+#if __GNUC__ > 4 || (defined(__GNUC_MINOR__) && __GNUC_MINOR__ >= 3)
+#define MONGOCRYPT_UINT32_SWAP_LE_BE(v) __builtin_bswap32 ((uint32_t) v)
+#define MONGOCRYPT_UINT64_SWAP_LE_BE(v) __builtin_bswap64 ((uint64_t) v)
+#endif
+#if __GNUC__ > 4 || (defined(__GNUC_MINOR__) && __GNUC_MINOR__ >= 8)
+#define MONGOCRYPT_UINT16_SWAP_LE_BE(v) __builtin_bswap16 ((uint32_t) v)
+#endif
+#endif
+
+#ifndef MONGOCRYPT_UINT16_SWAP_LE_BE
+#define MONGOCRYPT_UINT16_SWAP_LE_BE(v) \
+   __mongocrypt_uint16_swap_slow ((uint16_t) v)
+#endif
+
+#ifndef MONGOCRYPT_UINT32_SWAP_LE_BE
+#define MONGOCRYPT_UINT32_SWAP_LE_BE(v) \
+   __mongocrypt_uint32_swap_slow ((uint32_t) v)
+#endif
+
+#ifndef MONGOCRYPT_UINT64_SWAP_LE_BE
+#define MONGOCRYPT_UINT64_SWAP_LE_BE(v) \
+   __mongocrypt_uint64_swap_slow ((uint64_t) v)
+#endif
+
+#if defined(MONGOCRYPT_LITTLE_ENDIAN)
+#define MONGOCRYPT_UINT16_FROM_LE(v) ((uint16_t) v)
+#define MONGOCRYPT_UINT16_TO_LE(v) ((uint16_t) v)
+#define MONGOCRYPT_UINT16_FROM_BE(v) MONGOCRYPT_UINT16_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT16_TO_BE(v) MONGOCRYPT_UINT16_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT32_FROM_LE(v) ((uint32_t) v)
+#define MONGOCRYPT_UINT32_TO_LE(v) ((uint32_t) v)
+#define MONGOCRYPT_UINT32_FROM_BE(v) MONGOCRYPT_UINT32_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT32_TO_BE(v) MONGOCRYPT_UINT32_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT64_FROM_LE(v) ((uint64_t) v)
+#define MONGOCRYPT_UINT64_TO_LE(v) ((uint64_t) v)
+#define MONGOCRYPT_UINT64_FROM_BE(v) MONGOCRYPT_UINT64_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT64_TO_BE(v) MONGOCRYPT_UINT64_SWAP_LE_BE (v)
+#elif defined(MONGOCRYPT_BIG_ENDIAN)
+#define MONGOCRYPT_UINT16_FROM_LE(v) MONGOCRYPT_UINT16_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT16_TO_LE(v) MONGOCRYPT_UINT16_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT16_FROM_BE(v) ((uint16_t) v)
+#define MONGOCRYPT_UINT16_TO_BE(v) ((uint16_t) v)
+#define MONGOCRYPT_UINT32_FROM_LE(v) MONGOCRYPT_UINT32_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT32_TO_LE(v) MONGOCRYPT_UINT32_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT32_FROM_BE(v) ((uint32_t) v)
+#define MONGOCRYPT_UINT32_TO_BE(v) ((uint32_t) v)
+#define MONGOCRYPT_UINT64_FROM_LE(v) MONGOCRYPT_UINT64_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT64_TO_LE(v) MONGOCRYPT_UINT64_SWAP_LE_BE (v)
+#define MONGOCRYPT_UINT64_FROM_BE(v) ((uint64_t) v)
+#define MONGOCRYPT_UINT64_TO_BE(v) ((uint64_t) v)
+#else
+#error "The endianness of target architecture is unknown."
+#endif
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * __mongocrypt_uint16_swap_slow --
+ *
+ *       Fallback endianness conversion for 16-bit integers.
+ *
+ * Returns:
+ *       The endian swapped version.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+static inline uint16_t
+__mongocrypt_uint16_swap_slow (uint16_t v) /* IN */
+{
+   return (uint16_t) ((v & 0x00FF) << 8) | (uint16_t) ((v & 0xFF00) >> 8);
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * __mongocrypt_uint32_swap_slow --
+ *
+ *       Fallback endianness conversion for 32-bit integers.
+ *
+ * Returns:
+ *       The endian swapped version.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+static inline uint32_t
+__mongocrypt_uint32_swap_slow (uint32_t v) /* IN */
+{
+   return ((v & 0x000000FFU) << 24) | ((v & 0x0000FF00U) << 8) |
+          ((v & 0x00FF0000U) >> 8) | ((v & 0xFF000000U) >> 24);
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * __mongocrypt_uint64_swap_slow --
+ *
+ *       Fallback endianness conversion for 64-bit integers.
+ *
+ * Returns:
+ *       The endian swapped version.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+static inline uint64_t
+__mongocrypt_uint64_swap_slow (uint64_t v) /* IN */
+{
+   return ((v & 0x00000000000000FFULL) << 56) |
+          ((v & 0x000000000000FF00ULL) << 40) |
+          ((v & 0x0000000000FF0000ULL) << 24) |
+          ((v & 0x00000000FF000000ULL) << 8) |
+          ((v & 0x000000FF00000000ULL) >> 8) |
+          ((v & 0x0000FF0000000000ULL) >> 24) |
+          ((v & 0x00FF000000000000ULL) >> 40) |
+          ((v & 0xFF00000000000000ULL) >> 56);
+}
+
+
+#endif /* MONGOCRYPT_ENDIAN_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-endpoint-private.h

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2020-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_ENDPOINT_PRIVATE_H
+#define MONGOCRYPT_ENDPOINT_PRIVATE_H
+
+#include "mongocrypt-status-private.h"
+
+typedef struct {
+   /* e.g. https://kevin.keyvault.azure.net:443/path/path/?query=value */
+   char *original;
+   char *protocol;  /* e.g. https */
+   char *host;      /* e.g. kevin.keyvault.azure.net */
+   char *port;      /* e.g. 443 */
+   char *domain;    /* e.g. keyvault.azure.net */
+   char *subdomain; /* e.g. kevin */
+   char *path;      /* e.g. path/path */
+   char *query;     /* e.g. query=value */
+   /* host_and_port is the form that should be returned to drivers. */
+   char *host_and_port; /* e.g. kevin.keyvault.azure.net:443 */
+} _mongocrypt_endpoint_t;
+
+_mongocrypt_endpoint_t *
+_mongocrypt_endpoint_copy (_mongocrypt_endpoint_t *src);
+
+void
+_mongocrypt_endpoint_destroy (_mongocrypt_endpoint_t *endpoint);
+
+typedef struct {
+   /* allow_empty_subdomain does not require "host" to contain dot separators.
+    * If allow_empty_subdomain is true, then "localhost" is a valid endpoint. */
+   bool allow_empty_subdomain;
+} _mongocrypt_endpoint_parse_opts_t;
+
+/* Parses a subset of URIs of the form:
+ * [protocol://][host[:port]][path][?query]
+ */
+_mongocrypt_endpoint_t *
+_mongocrypt_endpoint_new (const char *endpoint_raw,
+                          int32_t len,
+                          _mongocrypt_endpoint_parse_opts_t *opts,
+                          mongocrypt_status_t *status);
+
+/* _mongocrypt_apply_default_port checks if the endpoint string *endpoint_raw
+ * contains a port. If *endpoint_raw does not contain a port, *endpoint_raw is
+ * freed and overwritten to a copy of *endpoint_raw with ":<port>" appended.
+ */
+void
+_mongocrypt_apply_default_port (char **endpoint_raw, char *port);
+
+#endif /* MONGOCRYPT_ENDPOINT_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-endpoint.c

@@ -0,0 +1,212 @@
+/*
+ * Copyright 2020-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mongocrypt-endpoint-private.h"
+
+#include "mongocrypt-private.h"
+
+void
+_mongocrypt_endpoint_destroy (_mongocrypt_endpoint_t *endpoint)
+{
+   if (!endpoint) {
+      return;
+   }
+   bson_free (endpoint->original);
+   bson_free (endpoint->protocol);
+   bson_free (endpoint->host);
+   bson_free (endpoint->port);
+   bson_free (endpoint->domain);
+   bson_free (endpoint->subdomain);
+   bson_free (endpoint->path);
+   bson_free (endpoint->query);
+   bson_free (endpoint->host_and_port);
+   bson_free (endpoint);
+}
+
+/* Parses a subset of URIs of the form:
+ * [protocol://][host[:port]][path][?query]
+ */
+_mongocrypt_endpoint_t *
+_mongocrypt_endpoint_new (const char *endpoint_raw,
+                          int32_t len,
+                          _mongocrypt_endpoint_parse_opts_t *opts,
+                          mongocrypt_status_t *status)
+{
+   _mongocrypt_endpoint_t *endpoint;
+   bool ok = false;
+   char *pos;
+   char *prev;
+   char *colon;
+   char *qmark;
+   char *slash;
+   char *host_start;
+   char *host_end;
+
+   /* opts is checked where it is used below, to allow a more precise error */
+
+   endpoint = bson_malloc0 (sizeof (_mongocrypt_endpoint_t));
+   _mongocrypt_status_reset (status);
+   BSON_ASSERT (endpoint);
+   if (!_mongocrypt_validate_and_copy_string (
+          endpoint_raw, len, &endpoint->original)) {
+      CLIENT_ERR ("Invalid endpoint");
+      goto fail;
+   }
+
+   /* Parse optional protocol. */
+   pos = strstr (endpoint->original, "://");
+   if (pos) {
+      endpoint->protocol =
+         bson_strndup (endpoint->original, (size_t) (pos - endpoint->original));
+      pos += 3;
+   } else {
+      pos = endpoint->original;
+   }
+   host_start = pos;
+
+   /* Parse subdomain. */
+   prev = pos;
+   pos = strstr (pos, ".");
+   if (pos) {
+      BSON_ASSERT (pos >= prev);
+      endpoint->subdomain = bson_strndup (prev, (size_t) (pos - prev));
+      pos += 1;
+   } else {
+      if (!opts || !opts->allow_empty_subdomain) {
+         CLIENT_ERR (
+            "Invalid endpoint, expected dot separator in host, but got: %s",
+            endpoint->original);
+         goto fail;
+      }
+      /* OK, reset pos to the start of the host. */
+      pos = prev;
+   }
+
+   /* Parse domain. */
+   prev = pos;
+   colon = strstr (pos, ":");
+   qmark = strstr (pos, "?");
+   slash = strstr (pos, "/");
+   if (colon) {
+      host_end = colon;
+   } else if (slash) {
+      host_end = slash;
+   } else if (qmark) {
+      host_end = qmark;
+   } else {
+      host_end = NULL;
+   }
+
+   if (host_end) {
+      BSON_ASSERT (host_end >= prev);
+      endpoint->domain = bson_strndup (prev, (size_t) (host_end - prev));
+      BSON_ASSERT (host_end >= host_start);
+      endpoint->host =
+         bson_strndup (host_start, (size_t) (host_end - host_start));
+   } else {
+      endpoint->domain = bson_strdup (prev);
+      endpoint->host = bson_strdup (host_start);
+   }
+
+   /* Parse optional port */
+   if (colon) {
+      prev = colon + 1;
+      qmark = strstr (pos, "?");
+      slash = strstr (pos, "/");
+      if (slash) {
+         endpoint->port = bson_strndup (prev, (size_t) (slash - prev));
+      } else if (qmark) {
+         BSON_ASSERT (qmark >= prev);
+         endpoint->port = bson_strndup (prev, (size_t) (qmark - prev));
+      } else {
+         endpoint->port = bson_strdup (prev);
+      }
+   }
+
+   /* Parse optional path */
+   if (slash) {
+      size_t path_len;
+
+      prev = slash + 1;
+      qmark = strstr (prev, "?");
+      if (qmark) {
+         endpoint->path = bson_strndup (prev, (size_t) (qmark - prev));
+      } else {
+         endpoint->path = bson_strdup (prev);
+      }
+
+      path_len = strlen (endpoint->path);
+      /* Clear a trailing slash if it exists. */
+      if (path_len > 0 && endpoint->path[path_len - 1] == '/') {
+         endpoint->path[path_len - 1] = '\0';
+      }
+   }
+
+   /* Parse optional query */
+   if (qmark) {
+      endpoint->query = bson_strdup (qmark + 1);
+   }
+
+   if (endpoint->port) {
+      endpoint->host_and_port =
+         bson_strdup_printf ("%s:%s", endpoint->host, endpoint->port);
+   } else {
+      endpoint->host_and_port = bson_strdup (endpoint->host);
+   }
+
+   ok = true;
+fail:
+   if (!ok) {
+      _mongocrypt_endpoint_destroy (endpoint);
+      return NULL;
+   }
+   return endpoint;
+}
+
+_mongocrypt_endpoint_t *
+_mongocrypt_endpoint_copy (_mongocrypt_endpoint_t *src)
+{
+   _mongocrypt_endpoint_t *endpoint;
+
+   if (!src) {
+      return NULL;
+   }
+   endpoint = bson_malloc0 (sizeof (_mongocrypt_endpoint_t));
+   endpoint->original = bson_strdup (src->original);
+   endpoint->protocol = bson_strdup (src->protocol);
+   endpoint->host = bson_strdup (src->host);
+   endpoint->port = bson_strdup (src->port);
+   endpoint->domain = bson_strdup (src->domain);
+   endpoint->subdomain = bson_strdup (src->subdomain);
+   endpoint->path = bson_strdup (src->path);
+   endpoint->query = bson_strdup (src->query);
+   endpoint->host_and_port = bson_strdup (src->host_and_port);
+   return endpoint;
+}
+
+void
+_mongocrypt_apply_default_port (char **endpoint_raw, char *port)
+{
+   BSON_ASSERT_PARAM (endpoint_raw);
+   BSON_ASSERT_PARAM (port);
+   BSON_ASSERT (*endpoint_raw);
+
+   if (strstr (*endpoint_raw, ":") == NULL) {
+      char *tmp = *endpoint_raw;
+      *endpoint_raw = bson_strdup_printf ("%s:%s", *endpoint_raw, port);
+      bson_free (tmp);
+   }
+}

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-kek-private.h

@@ -0,0 +1,109 @@
+/*
+ * Copyright 2020-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_KEK_PRIVATE_H
+#define MONGOCRYPT_KEK_PRIVATE_H
+
+#include <bson/bson.h>
+
+#include "mongocrypt.h"
+#include "mongocrypt-endpoint-private.h"
+
+/* Defines structs for Key Encryption Keys (KEKs)
+ * The KEK is used as part of envelope encryption. It encrypts a Data Encryption
+ * Key (DEK). A KEK is specified when creating a new data encryption key, or
+ * when parsing a key document from the key vault.
+ */
+
+/* KMS providers are used in a bit set.
+ *
+ * Check for set membership using bitwise and:
+ *   int kms_set = fn();
+ *   if (kms_set & MONGOCRYPT_KMS_PROVIDER_AWS)
+ * Add to a set using bitwise or:
+ *   kms_set |= MONGOCRYPT_KMS_PROVIDER_LOCAL
+ */
+typedef enum {
+   MONGOCRYPT_KMS_PROVIDER_NONE = 0,
+   MONGOCRYPT_KMS_PROVIDER_AWS = 1 << 0,
+   MONGOCRYPT_KMS_PROVIDER_LOCAL = 1 << 1,
+   MONGOCRYPT_KMS_PROVIDER_AZURE = 1 << 2,
+   MONGOCRYPT_KMS_PROVIDER_GCP = 1 << 3,
+   MONGOCRYPT_KMS_PROVIDER_KMIP = 1 << 4
+} _mongocrypt_kms_provider_t;
+
+typedef struct {
+   _mongocrypt_endpoint_t *key_vault_endpoint;
+   char *key_name;
+   char *key_version;
+} _mongocrypt_azure_kek_t;
+
+typedef struct {
+   char *project_id;
+   char *location;
+   char *key_ring;
+   char *key_name;
+   char *key_version;                /* optional */
+   _mongocrypt_endpoint_t *endpoint; /* optional. */
+} _mongocrypt_gcp_kek_t;
+
+typedef struct {
+   char *region;
+   char *cmk;
+   _mongocrypt_endpoint_t *endpoint; /* optional. */
+} _mongocrypt_aws_kek_t;
+
+typedef struct {
+   char *key_id; /* optional on parsing, required on appending. */
+   _mongocrypt_endpoint_t *endpoint; /* optional. */
+} _mongocrypt_kmip_kek_t;
+
+typedef struct {
+   _mongocrypt_kms_provider_t kms_provider;
+   union {
+      _mongocrypt_azure_kek_t azure;
+      _mongocrypt_gcp_kek_t gcp;
+      _mongocrypt_aws_kek_t aws;
+      _mongocrypt_kmip_kek_t kmip;
+   } provider;
+} _mongocrypt_kek_t;
+
+/* Parse a document describing a key encryption key.
+ * This may can come from two places:
+ * 1. The option passed for creating a data key via
+ * mongocrypt_ctx_setopt_key_encryption_key
+ * 2. The "masterKey" document from a data encryption key document.
+ */
+bool
+_mongocrypt_kek_parse_owned (const bson_t *bson,
+                             _mongocrypt_kek_t *out,
+                             mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_kek_append (const _mongocrypt_kek_t *kek,
+                        bson_t *out,
+                        mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+void
+_mongocrypt_kek_copy_to (const _mongocrypt_kek_t *src, _mongocrypt_kek_t *dst);
+
+void
+_mongocrypt_kek_cleanup (_mongocrypt_kek_t *kek);
+
+
+#endif /* MONGOCRYPT_KEK_PRIVATE_H */