libmongocrypt-helper 1.7.4.0.1002 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mc-reader-private.h

@@ -50,81 +50,46 @@
  *  }
  */
 struct _mc_reader_t {
-   const uint8_t *ptr;
-   uint64_t pos;
-   uint64_t len;
+    const uint8_t *ptr;
+    uint64_t pos;
+    uint64_t len;
 
-   const char *parser_name;
+    const char *parser_name;
 };
 
 typedef struct _mc_reader_t mc_reader_t;
 
-void
-mc_reader_init (mc_reader_t *reader,
-                const uint8_t *ptr,
-                uint64_t len,
-                const char *parser_name);
-
-void
-mc_reader_init_from_buffer (mc_reader_t *reader,
-                            const _mongocrypt_buffer_t *buf,
-                            const char *parser_name);
-
-mc_reader_t *
-mc_reader_new (const uint8_t *ptr, uint64_t len, const char *parser_name);
-
-void
-mc_reader_destroy (mc_reader_t *reader);
-
-bool
-mc_reader_has_data (const mc_reader_t *reader);
-
-uint64_t
-mc_reader_get_remaining_length (const mc_reader_t *reader);
-
-uint64_t
-mc_reader_get_consumed_length (const mc_reader_t *reader);
-
-bool
-mc_reader_read_u8 (mc_reader_t *reader,
-                   uint8_t *value,
-                   mongocrypt_status_t *status);
-
-bool
-mc_reader_read_u32 (mc_reader_t *reader,
-                    uint32_t *value,
-                    mongocrypt_status_t *status);
-
-bool
-mc_reader_read_u64 (mc_reader_t *reader,
-                    uint64_t *value,
-                    mongocrypt_status_t *status);
-
-bool
-mc_reader_read_bytes (mc_reader_t *reader,
-                      const uint8_t **ptr,
-                      uint64_t length,
-                      mongocrypt_status_t *status);
-
-bool
-mc_reader_read_buffer (mc_reader_t *reader,
-                       _mongocrypt_buffer_t *buf,
-                       uint64_t length,
-                       mongocrypt_status_t *status);
-
-bool
-mc_reader_read_uuid_buffer (mc_reader_t *reader,
-                            _mongocrypt_buffer_t *buf,
-                            mongocrypt_status_t *status);
-
-bool
-mc_reader_read_prfblock_buffer (mc_reader_t *reader,
-                                _mongocrypt_buffer_t *buf,
-                                mongocrypt_status_t *status);
-
-bool
-mc_reader_read_buffer_to_end (mc_reader_t *reader,
-                              _mongocrypt_buffer_t *buf,
-                              mongocrypt_status_t *status);
+void mc_reader_init(mc_reader_t *reader, const uint8_t *ptr, uint64_t len, const char *parser_name);
+
+void mc_reader_init_from_buffer(mc_reader_t *reader, const _mongocrypt_buffer_t *buf, const char *parser_name);
+
+mc_reader_t *mc_reader_new(const uint8_t *ptr, uint64_t len, const char *parser_name);
+
+void mc_reader_destroy(mc_reader_t *reader);
+
+bool mc_reader_has_data(const mc_reader_t *reader);
+
+uint64_t mc_reader_get_remaining_length(const mc_reader_t *reader);
+
+uint64_t mc_reader_get_consumed_length(const mc_reader_t *reader);
+
+bool mc_reader_read_u8(mc_reader_t *reader, uint8_t *value, mongocrypt_status_t *status);
+
+bool mc_reader_read_u32(mc_reader_t *reader, uint32_t *value, mongocrypt_status_t *status);
+
+bool mc_reader_read_u64(mc_reader_t *reader, uint64_t *value, mongocrypt_status_t *status);
+
+bool mc_reader_read_bytes(mc_reader_t *reader, const uint8_t **ptr, uint64_t length, mongocrypt_status_t *status);
+
+bool mc_reader_read_buffer(mc_reader_t *reader,
+                           _mongocrypt_buffer_t *buf,
+                           uint64_t length,
+                           mongocrypt_status_t *status);
+
+bool mc_reader_read_uuid_buffer(mc_reader_t *reader, _mongocrypt_buffer_t *buf, mongocrypt_status_t *status);
+
+bool mc_reader_read_prfblock_buffer(mc_reader_t *reader, _mongocrypt_buffer_t *buf, mongocrypt_status_t *status);
+
+bool mc_reader_read_buffer_to_end(mc_reader_t *reader, _mongocrypt_buffer_t *buf, mongocrypt_status_t *status);
 
 #endif /* MONGOCRYPT_READER_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-reader.c

@@ -18,218 +18,165 @@
 
 #include "mc-reader-private.h"
 
-#define CHECK_AND_RETURN(x) \
-   if (!(x)) {              \
-      return false;         \
-   }
-
-#define CHECK_REMAINING_BUFFER_AND_RET(read_size)        \
-   if ((reader->pos + (read_size)) > reader->len) {      \
-      CLIENT_ERR ("%s expected byte "                    \
-                  "length >= %" PRIu64 " got: %" PRIu64, \
-                  reader->parser_name,                   \
-                  reader->pos + (read_size),             \
-                  reader->len);                          \
-      return false;                                      \
-   }
-
-void
-mc_reader_init (mc_reader_t *reader,
-                const uint8_t *ptr,
-                uint64_t len,
-                const char *parser_name)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (ptr);
-   BSON_ASSERT_PARAM (parser_name);
-
-   *reader = (mc_reader_t){
-      .pos = 0u, .ptr = ptr, .len = len, .parser_name = parser_name};
+#define CHECK_AND_RETURN(x)                                                                                            \
+    if (!(x)) {                                                                                                        \
+        return false;                                                                                                  \
+    }
+
+#define CHECK_REMAINING_BUFFER_AND_RET(read_size)                                                                      \
+    if ((reader->pos + (read_size)) > reader->len) {                                                                   \
+        CLIENT_ERR("%s expected byte "                                                                                 \
+                   "length >= %" PRIu64 " got: %" PRIu64,                                                              \
+                   reader->parser_name,                                                                                \
+                   reader->pos + (read_size),                                                                          \
+                   reader->len);                                                                                       \
+        return false;                                                                                                  \
+    }
+
+void mc_reader_init(mc_reader_t *reader, const uint8_t *ptr, uint64_t len, const char *parser_name) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(ptr);
+    BSON_ASSERT_PARAM(parser_name);
+
+    *reader = (mc_reader_t){.pos = 0u, .ptr = ptr, .len = len, .parser_name = parser_name};
 }
 
-void
-mc_reader_init_from_buffer (mc_reader_t *reader,
-                            const _mongocrypt_buffer_t *buf,
-                            const char *parser_name)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (buf);
-   BSON_ASSERT_PARAM (parser_name);
+void mc_reader_init_from_buffer(mc_reader_t *reader, const _mongocrypt_buffer_t *buf, const char *parser_name) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(buf);
+    BSON_ASSERT_PARAM(parser_name);
 
-   mc_reader_init (reader, buf->data, buf->len, parser_name);
+    mc_reader_init(reader, buf->data, buf->len, parser_name);
 }
 
-mc_reader_t *
-mc_reader_new (const uint8_t *ptr, uint64_t len, const char *parser_name)
-{
-   BSON_ASSERT_PARAM (ptr);
-   BSON_ASSERT_PARAM (parser_name);
+mc_reader_t *mc_reader_new(const uint8_t *ptr, uint64_t len, const char *parser_name) {
+    BSON_ASSERT_PARAM(ptr);
+    BSON_ASSERT_PARAM(parser_name);
 
-   mc_reader_t *reader = bson_malloc (sizeof (mc_reader_t));
-   mc_reader_init (reader, ptr, len, parser_name);
-   return reader;
+    mc_reader_t *reader = bson_malloc(sizeof(mc_reader_t));
+    mc_reader_init(reader, ptr, len, parser_name);
+    return reader;
 }
 
-void
-mc_reader_destroy (mc_reader_t *reader)
-{
-   bson_free (reader);
+void mc_reader_destroy(mc_reader_t *reader) {
+    bson_free(reader);
 }
 
-bool
-mc_reader_has_data (const mc_reader_t *reader)
-{
-   BSON_ASSERT_PARAM (reader);
+bool mc_reader_has_data(const mc_reader_t *reader) {
+    BSON_ASSERT_PARAM(reader);
 
-   return reader->pos < reader->len;
+    return reader->pos < reader->len;
 }
 
-uint64_t
-mc_reader_get_remaining_length (const mc_reader_t *reader)
-{
-   BSON_ASSERT_PARAM (reader);
+uint64_t mc_reader_get_remaining_length(const mc_reader_t *reader) {
+    BSON_ASSERT_PARAM(reader);
 
-   return reader->len - reader->pos;
+    return reader->len - reader->pos;
 }
 
-uint64_t
-mc_reader_get_consumed_length (const mc_reader_t *reader)
-{
-   BSON_ASSERT_PARAM (reader);
+uint64_t mc_reader_get_consumed_length(const mc_reader_t *reader) {
+    BSON_ASSERT_PARAM(reader);
 
-   return reader->pos;
+    return reader->pos;
 }
 
-bool
-mc_reader_read_u8 (mc_reader_t *reader,
-                   uint8_t *value,
-                   mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (value);
+bool mc_reader_read_u8(mc_reader_t *reader, uint8_t *value, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(value);
 
-   CHECK_REMAINING_BUFFER_AND_RET (sizeof (uint8_t));
+    CHECK_REMAINING_BUFFER_AND_RET(sizeof(uint8_t));
 
-   *value = *(reader->ptr + reader->pos);
-   reader->pos += sizeof (uint8_t);
+    *value = *(reader->ptr + reader->pos);
+    reader->pos += sizeof(uint8_t);
 
-   return true;
+    return true;
 }
 
-bool
-mc_reader_read_u32 (mc_reader_t *reader,
-                    uint32_t *value,
-                    mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (value);
+bool mc_reader_read_u32(mc_reader_t *reader, uint32_t *value, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(value);
 
-   CHECK_REMAINING_BUFFER_AND_RET (sizeof (uint32_t));
+    CHECK_REMAINING_BUFFER_AND_RET(sizeof(uint32_t));
 
-   uint32_t temp;
-   memcpy (&temp, reader->ptr + reader->pos, sizeof (uint32_t));
-   *value = BSON_UINT32_FROM_LE (temp);
-   reader->pos += sizeof (uint32_t);
+    uint32_t temp;
+    memcpy(&temp, reader->ptr + reader->pos, sizeof(uint32_t));
+    *value = BSON_UINT32_FROM_LE(temp);
+    reader->pos += sizeof(uint32_t);
 
-   return true;
+    return true;
 }
 
-bool
-mc_reader_read_u64 (mc_reader_t *reader,
-                    uint64_t *value,
-                    mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (value);
+bool mc_reader_read_u64(mc_reader_t *reader, uint64_t *value, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(value);
 
-   CHECK_REMAINING_BUFFER_AND_RET (sizeof (uint64_t));
+    CHECK_REMAINING_BUFFER_AND_RET(sizeof(uint64_t));
 
-   uint64_t temp;
-   memcpy (&temp, reader->ptr + reader->pos, sizeof (uint64_t));
-   *value = BSON_UINT64_FROM_LE (temp);
-   reader->pos += sizeof (uint64_t);
+    uint64_t temp;
+    memcpy(&temp, reader->ptr + reader->pos, sizeof(uint64_t));
+    *value = BSON_UINT64_FROM_LE(temp);
+    reader->pos += sizeof(uint64_t);
 
-   return true;
+    return true;
 }
 
-bool
-mc_reader_read_bytes (mc_reader_t *reader,
-                      const uint8_t **ptr,
-                      uint64_t length,
-                      mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (ptr);
+bool mc_reader_read_bytes(mc_reader_t *reader, const uint8_t **ptr, uint64_t length, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(ptr);
 
-   CHECK_REMAINING_BUFFER_AND_RET (length);
+    CHECK_REMAINING_BUFFER_AND_RET(length);
 
-   *ptr = reader->ptr + reader->pos;
-   reader->pos += length;
+    *ptr = reader->ptr + reader->pos;
+    reader->pos += length;
 
-   return true;
+    return true;
 }
 
-bool
-mc_reader_read_buffer (mc_reader_t *reader,
-                       _mongocrypt_buffer_t *buf,
-                       uint64_t length,
-                       mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (buf);
-
-   const uint8_t *ptr;
-   CHECK_AND_RETURN (mc_reader_read_bytes (reader, &ptr, length, status));
-
-   if (length > SIZE_MAX || !_mongocrypt_buffer_copy_from_data_and_size (
-                               buf, ptr, (size_t) length)) {
-      CLIENT_ERR ("%s failed to copy "
-                  "data of length %" PRIu64,
-                  reader->parser_name,
-                  length);
-      return false;
-   }
-
-   return true;
+bool mc_reader_read_buffer(mc_reader_t *reader,
+                           _mongocrypt_buffer_t *buf,
+                           uint64_t length,
+                           mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(buf);
+
+    const uint8_t *ptr;
+    CHECK_AND_RETURN(mc_reader_read_bytes(reader, &ptr, length, status));
+
+    if (length > SIZE_MAX || !_mongocrypt_buffer_copy_from_data_and_size(buf, ptr, (size_t)length)) {
+        CLIENT_ERR("%s failed to copy "
+                   "data of length %" PRIu64,
+                   reader->parser_name,
+                   length);
+        return false;
+    }
+
+    return true;
 }
 
+bool mc_reader_read_uuid_buffer(mc_reader_t *reader, _mongocrypt_buffer_t *buf, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(buf);
 
-bool
-mc_reader_read_uuid_buffer (mc_reader_t *reader,
-                            _mongocrypt_buffer_t *buf,
-                            mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (buf);
+    CHECK_AND_RETURN(mc_reader_read_buffer(reader, buf, 16, status));
+    buf->subtype = BSON_SUBTYPE_UUID;
 
-   CHECK_AND_RETURN (mc_reader_read_buffer (reader, buf, 16, status));
-   buf->subtype = BSON_SUBTYPE_UUID;
-
-   return true;
+    return true;
 }
 
-bool
-mc_reader_read_prfblock_buffer (mc_reader_t *reader,
-                                _mongocrypt_buffer_t *buf,
-                                mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (buf);
+bool mc_reader_read_prfblock_buffer(mc_reader_t *reader, _mongocrypt_buffer_t *buf, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(buf);
 
-   CHECK_AND_RETURN (mc_reader_read_buffer (reader, buf, 32, status));
-   buf->subtype = BSON_SUBTYPE_ENCRYPTED;
+    CHECK_AND_RETURN(mc_reader_read_buffer(reader, buf, 32, status));
+    buf->subtype = BSON_SUBTYPE_ENCRYPTED;
 
-   return true;
+    return true;
 }
 
-bool
-mc_reader_read_buffer_to_end (mc_reader_t *reader,
-                              _mongocrypt_buffer_t *buf,
-                              mongocrypt_status_t *status)
-{
-   BSON_ASSERT_PARAM (reader);
-   BSON_ASSERT_PARAM (buf);
+bool mc_reader_read_buffer_to_end(mc_reader_t *reader, _mongocrypt_buffer_t *buf, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(reader);
+    BSON_ASSERT_PARAM(buf);
 
-   uint64_t length = reader->len - reader->pos;
-   return mc_reader_read_buffer (reader, buf, length, status);
+    uint64_t length = reader->len - reader->pos;
+    return mc_reader_read_buffer(reader, buf, length, status);
 }

data/ext/libmongocrypt/libmongocrypt/src/mc-tokens-private.h

@@ -24,7 +24,7 @@
  *
  * v is a BSON value. It is the bytes after "e_name" in "element" in
  * https://bsonspec.org/spec.html.
- * u is a "contention factor" counter. It is a uint64_t.
+ * u is a "contention factor". It is a uint64_t.
  * HMAC is the HMAC-SHA-256 function.
  * Integers are represented as uint64_t in little-endian.
  *
@@ -40,77 +40,99 @@
  * ESCDerivedFromDataToken = HMAC(ESCToken, v)
  * ECCDerivedFromDataToken = HMAC(ECCToken, v)
  *
- * EDCDerivedFromDataTokenAndCounter = HMAC(EDCDerivedFromDataToken, u)
- * ESCDerivedFromDataTokenAndCounter = HMAC(ESCDerivedFromDataToken, u)
- * ECCDerivedFromDataTokenAndCounter = HMAC(ECCDerivedFromDataToken, u)
+ * EDCDerivedFromDataTokenAndContentionFactor = HMAC(EDCDerivedFromDataToken, u)
+ * ESCDerivedFromDataTokenAndContentionFactor = HMAC(ESCDerivedFromDataToken, u)
+ * ECCDerivedFromDataTokenAndContentionFactor = HMAC(ECCDerivedFromDataToken, u)
+ *
+ * EDCTwiceDerivedToken      = HMAC(EDCDerivedFromDataTokenAndContentionFactor, 1)
+
+ * ESCTwiceDerivedTagToken   = HMAC(ESCDerivedFromDataTokenAndContentionFactor, 1)
+ * ESCTwiceDerivedValueToken = HMAC(ESCDerivedFromDataTokenAndContentionFactor, 2)
+
+ * ECCTwiceDerivedTagToken   = HMAC(ECCDerivedFromDataTokenAndContentionFactor, 1)
+ * ECCTwiceDerivedValueToken = HMAC(ECCDerivedFromDataTokenAndContentionFactor, 2)
+ *
+ * Note: ECC related tokens are used in FLE2v1 only.
+ *       Further, ECCTwiceDerivedValue(Tag|Token) have been omitted entirely.
+ *       The above comment describing derivation is for doc purposes only.
+ * ----------------------------------------------------------------------------
+ * Added in FLE2v2:
+ *
+ * ServerTokenDerivationLevel1Token = HMAC(RootKey, 2)
+ * ServerDerivedFromDataToken = HMAC(ServerTokenDerivationLevel1Token, v)
+ *
+ * ServerCountAndContentionFactorEncryptionToken =
+ *    HMAC(ServerDerivedFromDataToken, 1)
+ * ServerZerosEncryptionToken = HMAC(ServerDerivedFromDataToken, 2)
+ * ----------------------------------------------------------------------------
+ * Added in Range V2:
+ *
+ * d is a 17-byte blob of zeros.
+ *
+ * AnchorPaddingTokenRoot   = HMAC(ESCToken, d)
+ * Server-side:
+ *      AnchorPaddingTokenKey    = HMAC(AnchorPaddingTokenRoot, 1)
+ *      AnchorPaddingTokenValue  = HMAC(AnchorPaddingTokenRoot, 2)
  * ======================== End: FLE 2 Token Reference ========================
  */
 
-// TODO: replace `CONCAT` with `BSON_CONCAT` after libbson dependency is
-// upgraded to 1.20.0 or higher.
-#ifndef CONCAT
-#define CONCAT_1(a, b) a##b
-#define CONCAT(a, b) CONCAT_1 (a, b)
-#endif
-// TODO: replace `CONCAT3` with `BSON_CONCAT3` after libbson dependency is
-// upgraded to 1.20.0 or higher.
-#ifndef CONCAT3
-#define CONCAT3(a, b, c) CONCAT (a, CONCAT (b, c))
-#endif
-
 /// Declare a token type named 'Name', with constructor parameters given by the
 /// remaining arguments. Each constructor will also have the implicit first
 /// argument '_mongocrypt_crypto_t* crypto' and a final argument
 /// 'mongocrypt_status_t* status'
-#define DECL_TOKEN_TYPE(Name, ...) \
-   DECL_TOKEN_TYPE_1 (Name, CONCAT (Name, _t), __VA_ARGS__)
-
-#define DECL_TOKEN_TYPE_1(Prefix, T, ...)                                    \
-   /* Opaque typedef the struct */                                           \
-   typedef struct T T;                                                       \
-   /* Data-getter */                                                         \
-   extern const _mongocrypt_buffer_t *CONCAT (Prefix, _get) (const T *t);    \
-   /* Destructor */                                                          \
-   extern void CONCAT (Prefix, _destroy) (T * t);                            \
-   /* Constructor for server to create tokens from raw buffer */             \
-   extern T *CONCAT (Prefix, _new_from_buffer) (_mongocrypt_buffer_t * buf); \
-   /* Constructor. Parameter list given as variadic args */                  \
-   extern T *CONCAT (Prefix, _new) (_mongocrypt_crypto_t * crypto,           \
-                                    __VA_ARGS__,                             \
-                                    mongocrypt_status_t * status)
-
-DECL_TOKEN_TYPE (mc_CollectionsLevel1Token, const _mongocrypt_buffer_t *);
-DECL_TOKEN_TYPE (mc_ServerDataEncryptionLevel1Token,
-                 const _mongocrypt_buffer_t *);
-DECL_TOKEN_TYPE (mc_EDCToken,
-                 const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
-DECL_TOKEN_TYPE (mc_ESCToken,
-                 const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
-DECL_TOKEN_TYPE (mc_ECCToken,
-                 const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
-DECL_TOKEN_TYPE (mc_ECOCToken,
-                 const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
-DECL_TOKEN_TYPE (mc_EDCDerivedFromDataToken,
-                 const mc_EDCToken_t *EDCToken,
-                 const _mongocrypt_buffer_t *v);
-DECL_TOKEN_TYPE (mc_ECCDerivedFromDatatoken,
-                 const mc_ECCToken_t *ECCToken,
-                 const _mongocrypt_buffer_t *v);
-DECL_TOKEN_TYPE (mc_ESCDerivedFromDataToken,
-                 const mc_ESCToken_t *ESCToken,
-                 const _mongocrypt_buffer_t *v);
-DECL_TOKEN_TYPE (mc_ECCDerivedFromDataToken,
-                 const mc_ECCToken_t *ECCToken,
-                 const _mongocrypt_buffer_t *v);
-DECL_TOKEN_TYPE (mc_EDCDerivedFromDataTokenAndCounter,
-                 const mc_EDCDerivedFromDataToken_t *EDCDerivedFromDataToken,
-                 uint64_t u);
-DECL_TOKEN_TYPE (mc_ESCDerivedFromDataTokenAndCounter,
-                 const mc_ESCDerivedFromDataToken_t *ESCDerivedFromDataToken,
-                 uint64_t u);
-DECL_TOKEN_TYPE (mc_ECCDerivedFromDataTokenAndCounter,
-                 const mc_ECCDerivedFromDataToken_t *ECCDerivedFromDataToken,
-                 uint64_t u);
+#define DECL_TOKEN_TYPE(Name, ...) DECL_TOKEN_TYPE_1(Name, BSON_CONCAT(Name, _t), __VA_ARGS__)
+
+#define DECL_TOKEN_TYPE_1(Prefix, T, ...)                                                                              \
+    /* Opaque typedef the struct */                                                                                    \
+    typedef struct T T;                                                                                                \
+    /* Data-getter */                                                                                                  \
+    extern const _mongocrypt_buffer_t *BSON_CONCAT(Prefix, _get)(const T *t);                                          \
+    /* Destructor */                                                                                                   \
+    extern void BSON_CONCAT(Prefix, _destroy)(T * t);                                                                  \
+    /* Constructor for server to create tokens from raw buffer */                                                      \
+    extern T *BSON_CONCAT(Prefix, _new_from_buffer)(_mongocrypt_buffer_t * buf);                                       \
+    /* Constructor. Parameter list given as variadic args */                                                           \
+    extern T *BSON_CONCAT(Prefix, _new)(_mongocrypt_crypto_t * crypto, __VA_ARGS__, mongocrypt_status_t * status)
+
+DECL_TOKEN_TYPE(mc_CollectionsLevel1Token, const _mongocrypt_buffer_t *);
+DECL_TOKEN_TYPE(mc_ServerTokenDerivationLevel1Token, const _mongocrypt_buffer_t *);
+DECL_TOKEN_TYPE(mc_ServerDataEncryptionLevel1Token, const _mongocrypt_buffer_t *);
+
+DECL_TOKEN_TYPE(mc_EDCToken, const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
+DECL_TOKEN_TYPE(mc_ESCToken, const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
+DECL_TOKEN_TYPE(mc_ECCToken, const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
+DECL_TOKEN_TYPE(mc_ECOCToken, const mc_CollectionsLevel1Token_t *CollectionsLevel1Token);
+
+DECL_TOKEN_TYPE(mc_EDCDerivedFromDataToken, const mc_EDCToken_t *EDCToken, const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_ECCDerivedFromDataToken, const mc_ECCToken_t *ECCToken, const _mongocrypt_buffer_t *v);
+DECL_TOKEN_TYPE(mc_ESCDerivedFromDataToken, const mc_ESCToken_t *ESCToken, const _mongocrypt_buffer_t *v);
+
+DECL_TOKEN_TYPE(mc_EDCDerivedFromDataTokenAndContentionFactor,
+                const mc_EDCDerivedFromDataToken_t *EDCDerivedFromDataToken,
+                uint64_t u);
+DECL_TOKEN_TYPE(mc_ESCDerivedFromDataTokenAndContentionFactor,
+                const mc_ESCDerivedFromDataToken_t *ESCDerivedFromDataToken,
+                uint64_t u);
+DECL_TOKEN_TYPE(mc_ECCDerivedFromDataTokenAndContentionFactor,
+                const mc_ECCDerivedFromDataToken_t *ECCDerivedFromDataToken,
+                uint64_t u);
+
+DECL_TOKEN_TYPE(mc_EDCTwiceDerivedToken,
+                const mc_EDCDerivedFromDataTokenAndContentionFactor_t *EDCDerivedFromDataTokenAndContentionFactor);
+DECL_TOKEN_TYPE(mc_ESCTwiceDerivedTagToken,
+                const mc_ESCDerivedFromDataTokenAndContentionFactor_t *ESCDerivedFromDataTokenAndContentionFactor);
+DECL_TOKEN_TYPE(mc_ESCTwiceDerivedValueToken,
+                const mc_ESCDerivedFromDataTokenAndContentionFactor_t *ESCDerivedFromDataTokenAndContentionFactor);
+
+DECL_TOKEN_TYPE(mc_ServerDerivedFromDataToken,
+                const mc_ServerTokenDerivationLevel1Token_t *ServerTokenDerivationToken,
+                const _mongocrypt_buffer_t *v);
+
+DECL_TOKEN_TYPE(mc_ServerCountAndContentionFactorEncryptionToken,
+                const mc_ServerDerivedFromDataToken_t *serverDerivedFromDataToken);
+DECL_TOKEN_TYPE(mc_ServerZerosEncryptionToken, const mc_ServerDerivedFromDataToken_t *serverDerivedFromDataToken);
+
+DECL_TOKEN_TYPE(mc_AnchorPaddingTokenRoot, const mc_ESCToken_t *ESCToken);
 
 #undef DECL_TOKEN_TYPE
 #undef DECL_TOKEN_TYPE_1