libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/test/test-mc-rangeopts.c

@@ -0,0 +1,174 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "test-mongocrypt.h"
+#include "mc-rangeopts-private.h"
+
+#define RAW_STRING(...) #__VA_ARGS__
+
+static void
+test_mc_RangeOpts_parse (_mongocrypt_tester_t *tester)
+{
+   typedef struct {
+      const char *desc;
+      const char *in;
+      const char *expectError;
+      mc_optional_int32_t expectMin;
+      mc_optional_int32_t expectMax;
+      int64_t expectSparsity;
+      mc_optional_uint32_t expectPrecision;
+   } testcase;
+
+   testcase tests[] = {
+      {.desc = "Works",
+       .in = RAW_STRING (
+          {"min" : 123, "max" : 456, "sparsity" : {"$numberLong" : "1"}}),
+       .expectSparsity = 1,
+       .expectMin = OPT_I32_C (123),
+       .expectMax = OPT_I32_C (456)},
+      {.desc = "Errors if precision is set with int min/max",
+       .in = RAW_STRING ({
+          "min" : 123,
+          "max" : 456,
+          "precision" : 2,
+          "sparsity" : {"$numberLong" : "1"}
+       }),
+       .expectError =
+          "expected 'precision' to be set with double or decimal128 index"},
+      {.desc = "Errors on missing fields",
+       .in = RAW_STRING ({"min" : 123, "max" : 456}),
+       .expectError = "Missing field 'sparsity'"},
+      {.desc = "Errors on extra fields",
+       .in = RAW_STRING ({
+          "min" : 123,
+          "max" : 456,
+          "sparsity" : {"$numberLong" : "1"},
+          "foo" : 1
+       }),
+       .expectError = "Unrecognized field: 'foo'"},
+      {.desc = "Errors if min/max types mismatch",
+       .in = RAW_STRING (
+          {"min" : 123, "max" : 456.0, "sparsity" : {"$numberLong" : "1"}}),
+       .expectError = "expected 'min' and 'max' to be same type"},
+      {
+         .desc = "Does not require min/max",
+         .in = RAW_STRING ({"sparsity" : {"$numberLong" : "1"}}),
+         .expectSparsity = 1,
+      },
+      {.desc = "Requires precision for double when min/max is set",
+       .in = RAW_STRING (
+          {"min" : 0.0, "max" : 1.0, "sparsity" : {"$numberLong" : "1"}}),
+       .expectError = "expected 'precision'"},
+      {.desc = "Requires min/max for double when precision is set",
+       .in = RAW_STRING ({"precision" : 1, "sparsity" : {"$numberLong" : "1"}}),
+       .expectError = "setting precision requires min"},
+      {.desc = "Requires precision for double when only min is set",
+       .in = RAW_STRING ({"min" : 0.0, "sparsity" : {"$numberLong" : "1"}}),
+       .expectError = "expected 'precision'"},
+   };
+
+   for (size_t i = 0; i < sizeof (tests) / sizeof (tests[0]); i++) {
+      testcase *test = tests + i;
+      mongocrypt_status_t *status = mongocrypt_status_new ();
+      mc_RangeOpts_t ro;
+      printf ("running test_mc_RangeOpts_parse subtest: %s\n", test->desc);
+      bool ret = mc_RangeOpts_parse (&ro, TMP_BSON (test->in), status);
+      if (!test->expectError) {
+         ASSERT_OK_STATUS (ret, status);
+         ASSERT_CMPINT (test->expectMin.set, ==, ro.min.set);
+         if (test->expectMin.set) {
+            ASSERT_CMPINT32 (
+               test->expectMin.value, ==, bson_iter_int32 (&ro.min.value));
+         }
+         ASSERT_CMPINT (test->expectMax.set, ==, ro.max.set);
+         if (test->expectMax.set) {
+            ASSERT_CMPINT32 (
+               test->expectMax.value, ==, bson_iter_int32 (&ro.max.value));
+         }
+         ASSERT_CMPINT64 (test->expectSparsity, ==, ro.sparsity);
+         ASSERT_CMPINT (test->expectPrecision.set, ==, ro.precision.set);
+         ASSERT_CMPINT (test->expectPrecision.value, ==, ro.precision.value);
+      } else {
+         ASSERT_FAILS_STATUS (ret, status, test->expectError);
+      }
+      mc_RangeOpts_cleanup (&ro);
+      mongocrypt_status_destroy (status);
+   }
+}
+
+static void
+test_mc_RangeOpts_to_FLE2RangeInsertSpec (_mongocrypt_tester_t *tester)
+{
+   typedef struct {
+      const char *desc;
+      const char *in;
+      const char *v;
+      const char *expectError;
+      const char *expect;
+   } testcase;
+
+   testcase tests[] = {
+      {.desc = "Works",
+       .in = RAW_STRING (
+          {"min" : 123, "max" : 456, "sparsity" : {"$numberLong" : "1"}}),
+       .v = RAW_STRING ({"v" : 789}),
+       .expect = RAW_STRING ({"v" : {"v" : 789, "min" : 123, "max" : 456}})},
+      {.desc = "Works with precision",
+       .in = RAW_STRING ({
+          "min" : 123.0,
+          "max" : 456.0,
+          "precision" : 2,
+          "sparsity" : {"$numberLong" : "1"}
+       }),
+       .v = RAW_STRING ({"v" : 789.0}),
+       .expect = RAW_STRING ({
+          "v" : {"v" : 789.0, "min" : 123.0, "max" : 456.0, "precision" : 2}
+       })},
+      {.desc = "Errors with missing 'v'",
+       .in = RAW_STRING (
+          {"min" : 123, "max" : 456, "sparsity" : {"$numberLong" : "1"}}),
+       .v = RAW_STRING ({"foo" : "bar"}),
+       .expectError = "Unable to find 'v'"}};
+
+   for (size_t i = 0; i < sizeof (tests) / sizeof (tests[0]); i++) {
+      testcase *test = tests + i;
+      mongocrypt_status_t *status = mongocrypt_status_new ();
+      mc_RangeOpts_t ro;
+      printf ("running test_mc_RangeOpts_to_FLE2RangeInsertSpec subtest: %s\n",
+              test->desc);
+      ASSERT_OK_STATUS (mc_RangeOpts_parse (&ro, TMP_BSON (test->in), status),
+                        status);
+      bson_t out = BSON_INITIALIZER;
+      bool ret = mc_RangeOpts_to_FLE2RangeInsertSpec (
+         &ro, TMP_BSON (test->v), &out, status);
+      if (!test->expectError) {
+         ASSERT_OK_STATUS (ret, status);
+         ASSERT_EQUAL_BSON (TMP_BSON (test->expect), &out);
+      } else {
+         ASSERT_FAILS_STATUS (ret, status, test->expectError);
+      }
+      bson_destroy (&out);
+      mc_RangeOpts_cleanup (&ro);
+      mongocrypt_status_destroy (status);
+   }
+}
+
+void
+_mongocrypt_tester_install_mc_RangeOpts (_mongocrypt_tester_t *tester)
+{
+   INSTALL_TEST (test_mc_RangeOpts_parse);
+   INSTALL_TEST (test_mc_RangeOpts_to_FLE2RangeInsertSpec);
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mc-reader.c

@@ -0,0 +1,251 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mc-reader-private.h"
+#include "test-mongocrypt-assert.h"
+#include "test-mongocrypt.h"
+
+static void
+_test_mc_reader (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t input_buf;
+   _mongocrypt_buffer_copy_from_hex (&input_buf, "ABCD");
+
+   mongocrypt_status_t *status;
+   status = mongocrypt_status_new ();
+
+   mc_reader_t reader;
+   mc_reader_init_from_buffer (&reader, &input_buf, __FUNCTION__);
+
+   uint8_t value;
+   ASSERT_OK_STATUS (mc_reader_read_u8 (&reader, &value, status), status);
+   ASSERT_CMPUINT (value, ==, 0xAB);
+   ASSERT_CMPUINT64 (mc_reader_get_consumed_length (&reader), ==, 1);
+   ASSERT_CMPUINT64 (mc_reader_get_remaining_length (&reader), ==, 1);
+
+   ASSERT_OK_STATUS (mc_reader_read_u8 (&reader, &value, status), status);
+   ASSERT_CMPUINT (value, ==, 0xCD);
+   ASSERT_CMPUINT64 (mc_reader_get_consumed_length (&reader), ==, 2);
+   ASSERT_CMPUINT64 (mc_reader_get_remaining_length (&reader), ==, 0);
+
+   ASSERT_FAILS_STATUS (mc_reader_read_u8 (&reader, &value, status),
+                        status,
+                        "expected byte length >= 3 got: 2");
+
+   _mongocrypt_buffer_cleanup (&input_buf);
+   mongocrypt_status_destroy (status);
+}
+
+static void
+_test_mc_reader_uuid (_mongocrypt_tester_t *tester)
+{
+   const uint8_t expected_bytes[] = {0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x90,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x90,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x90,
+                                     0x12};
+   uint64_t expected_len = sizeof (expected_bytes);
+
+   _mongocrypt_buffer_t input_buf;
+   _mongocrypt_buffer_copy_from_hex (&input_buf,
+                                     "12345678901234567890123456789012");
+
+   mongocrypt_status_t *status;
+   status = mongocrypt_status_new ();
+
+   mc_reader_t reader;
+   mc_reader_init_from_buffer (&reader, &input_buf, __FUNCTION__);
+
+   _mongocrypt_buffer_t value;
+   ASSERT_OK_STATUS (mc_reader_read_uuid_buffer (&reader, &value, status),
+                     status);
+   ASSERT (value.subtype == BSON_SUBTYPE_UUID);
+
+   ASSERT_CMPBYTES (
+      expected_bytes, (size_t) expected_len, value.data, value.len);
+
+
+   uint8_t ui;
+   ASSERT_FAILS_STATUS (mc_reader_read_u8 (&reader, &ui, status),
+                        status,
+                        "expected byte length >= 17 got: 16");
+
+   _mongocrypt_buffer_cleanup (&input_buf);
+   _mongocrypt_buffer_cleanup (&value);
+   mongocrypt_status_destroy (status);
+}
+
+static void
+_test_mc_reader_prfblock (_mongocrypt_tester_t *tester)
+{
+   const uint8_t expected_bytes[] = {0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78, // 4
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78, // 8
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78, // 16
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78};
+   uint64_t expected_len = sizeof (expected_bytes);
+
+   _mongocrypt_buffer_t input_buf;
+   _mongocrypt_buffer_copy_from_hex (&input_buf,
+                                     "12345678123456781234567812345678"
+                                     "12345678123456781234567812345678");
+
+   mongocrypt_status_t *status;
+   status = mongocrypt_status_new ();
+
+   mc_reader_t reader;
+   mc_reader_init_from_buffer (&reader, &input_buf, __FUNCTION__);
+
+   _mongocrypt_buffer_t value;
+   ASSERT_OK_STATUS (mc_reader_read_prfblock_buffer (&reader, &value, status),
+                     status);
+   ASSERT (value.subtype == BSON_SUBTYPE_ENCRYPTED);
+
+   ASSERT_CMPBYTES (
+      expected_bytes, (size_t) expected_len, value.data, value.len);
+
+
+   uint8_t ui;
+   ASSERT_FAILS_STATUS (mc_reader_read_u8 (&reader, &ui, status),
+                        status,
+                        "expected byte length >= 33 got: 32");
+
+   _mongocrypt_buffer_cleanup (&input_buf);
+   _mongocrypt_buffer_cleanup (&value);
+   mongocrypt_status_destroy (status);
+}
+
+
+static void
+_test_mc_reader_ints (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t input_buf;
+   _mongocrypt_buffer_copy_from_hex (&input_buf, "001122330011223344556677");
+
+   mongocrypt_status_t *status;
+   status = mongocrypt_status_new ();
+
+   mc_reader_t reader;
+   mc_reader_init_from_buffer (&reader, &input_buf, __FUNCTION__);
+
+   uint32_t u32;
+   ASSERT_OK_STATUS (mc_reader_read_u32 (&reader, &u32, status), status);
+   ASSERT_CMPUINT32 (u32, ==, 0x33221100);
+
+   uint64_t u64;
+   ASSERT_OK_STATUS (mc_reader_read_u64 (&reader, &u64, status), status);
+   ASSERT_CMPUINT64 (u64, ==, 0x7766554433221100ULL);
+
+   _mongocrypt_buffer_cleanup (&input_buf);
+   mongocrypt_status_destroy (status);
+}
+
+static void
+_test_mc_reader_bytes (_mongocrypt_tester_t *tester)
+{
+   const uint8_t expected_bytes[] = {0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x90,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x90,
+                                     0x12,
+                                     0x34,
+                                     0x56,
+                                     0x78,
+                                     0x90,
+                                     0x12};
+   uint64_t expected_len = sizeof (expected_bytes);
+
+   _mongocrypt_buffer_t input_buf;
+   _mongocrypt_buffer_copy_from_hex (&input_buf,
+                                     "12345678901234567890123456789012");
+
+   mongocrypt_status_t *status;
+   status = mongocrypt_status_new ();
+
+   mc_reader_t reader;
+   mc_reader_init_from_buffer (&reader, &input_buf, __FUNCTION__);
+
+   const uint8_t *ptr;
+   const uint64_t len = 4;
+   ASSERT_OK_STATUS (
+      mc_reader_read_bytes (&reader, (const uint8_t **) &ptr, len, status),
+      status);
+   ASSERT_CMPBYTES (expected_bytes, 4, ptr, (size_t) len);
+
+   _mongocrypt_buffer_t value_buf;
+   ASSERT_OK_STATUS (mc_reader_read_buffer_to_end (&reader, &value_buf, status),
+                     status);
+   ASSERT_CMPBYTES (
+      expected_bytes + 4u, (size_t)expected_len - 4u, value_buf.data, value_buf.len);
+
+   _mongocrypt_buffer_cleanup (&input_buf);
+   _mongocrypt_buffer_cleanup (&value_buf);
+   mongocrypt_status_destroy (status);
+}
+
+void
+_mongocrypt_tester_install_mc_reader (_mongocrypt_tester_t *tester)
+{
+   INSTALL_TEST (_test_mc_reader);
+   INSTALL_TEST (_test_mc_reader_uuid);
+   INSTALL_TEST (_test_mc_reader_prfblock);
+   INSTALL_TEST (_test_mc_reader_ints);
+   INSTALL_TEST (_test_mc_reader_bytes);
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mc-tokens.c

@@ -0,0 +1,245 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "mc-tokens-private.h"
+#include "test-mongocrypt.h"
+
+static void
+_test_mc_tokens (_mongocrypt_tester_t *tester)
+{
+   mongocrypt_status_t *status;
+   mongocrypt_t *crypt;
+   _mongocrypt_buffer_t RootKey;
+   _mongocrypt_buffer_t expected;
+   _mongocrypt_buffer_t v;
+   uint64_t u = 1234567890;
+
+   status = mongocrypt_status_new ();
+   crypt = _mongocrypt_tester_mongocrypt (TESTER_MONGOCRYPT_DEFAULT);
+   _mongocrypt_buffer_copy_from_hex (
+      &RootKey,
+      "6eda88c8496ec990f5d5518dd2ad6f3d9c33b6055904b120f12de82911fbd933");
+   _mongocrypt_buffer_copy_from_hex (
+      &v, "c07c0df51257948e1a0fc70dd4568e3af99b23b3434c9858237ca7db62db9766");
+
+   mc_CollectionsLevel1Token_t *CollectionsLevel1Token =
+      mc_CollectionsLevel1Token_new (crypt->crypto, &RootKey, status);
+   ASSERT_OR_PRINT (CollectionsLevel1Token, status);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "ff2103ff205a36f39704f643c270c129919f008c391d9589a6d2c86a7429d0d3");
+   ASSERT_CMPBUF (*mc_CollectionsLevel1Token_get (CollectionsLevel1Token),
+                  expected);
+
+   mc_ServerDataEncryptionLevel1Token_t *ServerDataEncryptionLevel1Token =
+      mc_ServerDataEncryptionLevel1Token_new (crypt->crypto, &RootKey, status);
+   ASSERT_OR_PRINT (ServerDataEncryptionLevel1Token, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "d915ccc1eb81687fb5fc5b799f48c99fbe17e7a011a46a48901b9ae3d790656b");
+   ASSERT_CMPBUF (
+      *mc_ServerDataEncryptionLevel1Token_get (ServerDataEncryptionLevel1Token),
+      expected);
+
+   mc_EDCToken_t *EDCToken =
+      mc_EDCToken_new (crypt->crypto, CollectionsLevel1Token, status);
+   ASSERT_OR_PRINT (EDCToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "167d2d2ff8e4144df37ff759db593fde0ecc7d9636f96d62dacad672eccad349");
+   ASSERT_CMPBUF (*mc_EDCToken_get (EDCToken), expected);
+
+   mc_ESCToken_t *ESCToken =
+      mc_ESCToken_new (crypt->crypto, CollectionsLevel1Token, status);
+   ASSERT_OR_PRINT (ESCToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "bfd480f1658f49f48985734737bc07d0bc36b88210277605c55ff3c9c3ef50b0");
+   ASSERT_CMPBUF (*mc_ESCToken_get (ESCToken), expected);
+
+   mc_ECCToken_t *ECCToken =
+      mc_ECCToken_new (crypt->crypto, CollectionsLevel1Token, status);
+   ASSERT_OR_PRINT (ECCToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "9d34f9c182d75a5a3347c2f903e3e647105c651d52cf9555c9420ba07ddd3aa2");
+   ASSERT_CMPBUF (*mc_ECCToken_get (ECCToken), expected);
+
+   mc_ECOCToken_t *ECOCToken =
+      mc_ECOCToken_new (crypt->crypto, CollectionsLevel1Token, status);
+   ASSERT_OR_PRINT (ECOCToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "e354e3b05e81e08b970ca061cb365163fd33dec2f982ddf9440e742ed288a8f8");
+   ASSERT_CMPBUF (*mc_ECOCToken_get (ECOCToken), expected);
+
+   mc_EDCDerivedFromDataToken_t *EDCDerivedFromDataToken =
+      mc_EDCDerivedFromDataToken_new (crypt->crypto, EDCToken, &v, status);
+   ASSERT_OR_PRINT (EDCDerivedFromDataToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "53eaa4c23a3ff65e6b7c7dbc4b1389cf0a6151b1ede5383a0673ff9c67855ff9");
+   ASSERT_CMPBUF (*mc_EDCDerivedFromDataToken_get (EDCDerivedFromDataToken),
+                  expected);
+
+   mc_ESCDerivedFromDataToken_t *ESCDerivedFromDataToken =
+      mc_ESCDerivedFromDataToken_new (crypt->crypto, ESCToken, &v, status);
+   ASSERT_OR_PRINT (ESCDerivedFromDataToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "acb3fab332131bbeaf112814f29ae0f2b10e97dc94b62db56c594661248e7467");
+   ASSERT_CMPBUF (*mc_ESCDerivedFromDataToken_get (ESCDerivedFromDataToken),
+                  expected);
+
+   mc_ECCDerivedFromDataToken_t *ECCDerivedFromDataToken =
+      mc_ECCDerivedFromDataToken_new (crypt->crypto, ECCToken, &v, status);
+   ASSERT_OR_PRINT (ECCDerivedFromDataToken, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "826cfd35c35dcc7d4fbe13f33a3520749853bd1ea4c47919482252fba3a70cec");
+   ASSERT_CMPBUF (*mc_ECCDerivedFromDataToken_get (ECCDerivedFromDataToken),
+                  expected);
+
+   mc_EDCDerivedFromDataTokenAndCounter_t *EDCDerivedFromDataTokenAndCounter =
+      mc_EDCDerivedFromDataTokenAndCounter_new (
+         crypt->crypto, EDCDerivedFromDataToken, u, status);
+   ASSERT_OR_PRINT (EDCDerivedFromDataTokenAndCounter, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "70fb9a3f760996f2f1438c5bf2a4d52bcba01b0badc3596276f49ffb2f0b136e");
+   ASSERT_CMPBUF (*mc_EDCDerivedFromDataTokenAndCounter_get (
+                     EDCDerivedFromDataTokenAndCounter),
+                  expected);
+
+   mc_ESCDerivedFromDataTokenAndCounter_t *ESCDerivedFromDataTokenAndCounter =
+      mc_ESCDerivedFromDataTokenAndCounter_new (
+         crypt->crypto, ESCDerivedFromDataToken, u, status);
+   ASSERT_OR_PRINT (ESCDerivedFromDataTokenAndCounter, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "7076c7b05fb4be4fe585eed930b852a6d088a0c55f3c96b50069e8a26ebfb347");
+   ASSERT_CMPBUF (*mc_ESCDerivedFromDataTokenAndCounter_get (
+                     ESCDerivedFromDataTokenAndCounter),
+                  expected);
+
+   mc_ECCDerivedFromDataTokenAndCounter_t *ECCDerivedFromDataTokenAndCounter =
+      mc_ECCDerivedFromDataTokenAndCounter_new (
+         crypt->crypto, ECCDerivedFromDataToken, u, status);
+   ASSERT_OR_PRINT (ECCDerivedFromDataTokenAndCounter, status);
+   _mongocrypt_buffer_cleanup (&expected);
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "6c6a349956c19f9c5e638e612011a71fbb71921edb540310c17cd0208b7f548b");
+   ASSERT_CMPBUF (*mc_ECCDerivedFromDataTokenAndCounter_get (
+                     ECCDerivedFromDataTokenAndCounter),
+                  expected);
+
+   _mongocrypt_buffer_cleanup (&expected);
+   mc_ECCDerivedFromDataTokenAndCounter_destroy (
+      ECCDerivedFromDataTokenAndCounter);
+   mc_ESCDerivedFromDataTokenAndCounter_destroy (
+      ESCDerivedFromDataTokenAndCounter);
+   mc_EDCDerivedFromDataTokenAndCounter_destroy (
+      EDCDerivedFromDataTokenAndCounter);
+   mc_ECCDerivedFromDataToken_destroy (ECCDerivedFromDataToken);
+   mc_ESCDerivedFromDataToken_destroy (ESCDerivedFromDataToken);
+   mc_EDCDerivedFromDataToken_destroy (EDCDerivedFromDataToken);
+   mc_ECOCToken_destroy (ECOCToken);
+   mc_ECCToken_destroy (ECCToken);
+   mc_ESCToken_destroy (ESCToken);
+   mc_EDCToken_destroy (EDCToken);
+   mc_ServerDataEncryptionLevel1Token_destroy (ServerDataEncryptionLevel1Token);
+   mc_CollectionsLevel1Token_destroy (CollectionsLevel1Token);
+   _mongocrypt_buffer_cleanup (&v);
+   _mongocrypt_buffer_cleanup (&RootKey);
+   mongocrypt_destroy (crypt);
+   mongocrypt_status_destroy (status);
+}
+
+static void
+_test_mc_tokens_error (_mongocrypt_tester_t *tester)
+{
+   mongocrypt_status_t *status;
+   mongocrypt_t *crypt;
+   _mongocrypt_buffer_t RootKey;
+
+   status = mongocrypt_status_new ();
+   crypt = _mongocrypt_tester_mongocrypt (TESTER_MONGOCRYPT_DEFAULT);
+   /* RootKey is incorrect length. */
+   _mongocrypt_buffer_copy_from_hex (&RootKey, "AAAA");
+
+   mc_CollectionsLevel1Token_t *CollectionsLevel1Token =
+      mc_CollectionsLevel1Token_new (crypt->crypto, &RootKey, status);
+   ASSERT_FAILS_STATUS (CollectionsLevel1Token != NULL,
+                        status,
+                        "invalid hmac_sha_256 key length");
+
+   mc_CollectionsLevel1Token_destroy (CollectionsLevel1Token);
+   _mongocrypt_buffer_cleanup (&RootKey);
+   mongocrypt_destroy (crypt);
+   mongocrypt_status_destroy (status);
+}
+
+static void
+_test_mc_tokens_raw_buffer (_mongocrypt_tester_t *tester)
+{
+   mc_ServerDataEncryptionLevel1Token_t *token;
+   _mongocrypt_buffer_t test_input;
+   _mongocrypt_buffer_t expected;
+
+   _mongocrypt_buffer_copy_from_hex (
+      &test_input,
+      "6c6a349956c19f9c5e638e612011a71fbb71921edb540310c17cd0208b7f548b");
+
+   /* Make a token from a raw buffer */
+   token = mc_ServerDataEncryptionLevel1Token_new_from_buffer (&test_input);
+
+   /* Assert new_from_buffer did not steal ownership. */
+   ASSERT (test_input.owned);
+   ASSERT (test_input.len == MONGOCRYPT_HMAC_SHA256_LEN);
+
+   _mongocrypt_buffer_copy_from_hex (
+      &expected,
+      "6c6a349956c19f9c5e638e612011a71fbb71921edb540310c17cd0208b7f548b");
+
+   ASSERT_CMPBUF (*mc_ServerDataEncryptionLevel1Token_get (token), expected);
+
+   /* Assert new_from_buffer references original buffer instead of a copy. */
+   test_input.data[0] = '0';
+   expected.data[0] = '0';
+   ASSERT_CMPBUF (*mc_ServerDataEncryptionLevel1Token_get (token), expected);
+
+   _mongocrypt_buffer_cleanup (&test_input);
+   _mongocrypt_buffer_cleanup (&expected);
+   mc_ServerDataEncryptionLevel1Token_destroy (token);
+}
+
+void
+_mongocrypt_tester_install_mc_tokens (_mongocrypt_tester_t *tester)
+{
+   INSTALL_TEST (_test_mc_tokens);
+   INSTALL_TEST (_test_mc_tokens_error);
+   INSTALL_TEST (_test_mc_tokens_raw_buffer);
+}