libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/kms-message/test/test_kmip_reader_writer.c

@@ -88,7 +88,13 @@ kms_kmip_writer_test (void)
       "An Enumeration with value 255");
    kmip_writer_destroy (writer);
 
-   /* Boolean is not implemented. */
+   writer = kmip_writer_new ();
+   kmip_writer_write_bool (writer, KMIP_TAG_CompromiseDate, true);
+   kms_kmip_writer_test_evaluate (
+      writer,
+      "42 00 20 | 06 | 00 00 00 08 | 00 00 00 00 00 00 00 01",
+      "An boolean containing the value true");
+   kmip_writer_destroy (writer);
 
    writer = kmip_writer_new ();
    kmip_writer_write_string (
@@ -147,6 +153,7 @@ kms_kmip_reader_test (void)
    int64_t i64;
    uint32_t u32;
    uint8_t *ptr;
+   bool b;
 
    /* The following test cases come from section 9.1.2 of
     * http://docs.oasis-open.org/kmip/spec/v1.4/os/kmip-spec-v1.4-os.html */
@@ -200,7 +207,21 @@ kms_kmip_reader_test (void)
    kmip_reader_destroy (reader);
    free (data);
 
-   /* Boolean is not implemented */
+   /* A boolean with value true */
+   data = hex_to_data ("42 00 20 | 06 | 00 00 00 08 | 00 00 00 00 00 00 00 01",
+                       &datalen);
+   reader = kmip_reader_new (data, datalen);
+   ASSERT (kmip_reader_read_tag (reader, &tag));
+   ASSERT (tag == KMIP_TAG_CompromiseDate);
+   ASSERT (kmip_reader_read_type (reader, &type));
+   ASSERT (type == KMIP_ITEM_TYPE_Boolean);
+   ASSERT (kmip_reader_read_length (reader, &length));
+   ASSERT (length == 8);
+   ASSERT (kmip_reader_read_bool (reader, &b));
+   ASSERT (b);
+   ASSERT (!kmip_reader_has_data (reader));
+   kmip_reader_destroy (reader);
+   free (data);
 
    /* A Text String with the value 'Hello World' */
    data = hex_to_data ("42 00 20 | 07 | 00 00 00 0B | 48 65 6C "

data/ext/libmongocrypt/libmongocrypt/src/crypto/libcrypto.c

@@ -61,7 +61,7 @@ void _native_crypto_init(void) {
 static bool _encrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args) {
     EVP_CIPHER_CTX *ctx;
     bool ret = false;
-    int intermediate_bytes_written;
+    int intermediate_bytes_written = 0;
     mongocrypt_status_t *status = args.status;
 
     ctx = EVP_CIPHER_CTX_new();
@@ -71,8 +71,8 @@ static bool _encrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args)
     BSON_ASSERT(args.out);
     BSON_ASSERT(ctx);
     BSON_ASSERT(cipher);
-    BSON_ASSERT(NULL == args.iv || EVP_CIPHER_iv_length(cipher) == args.iv->len);
-    BSON_ASSERT(EVP_CIPHER_key_length(cipher) == args.key->len);
+    BSON_ASSERT(NULL == args.iv || (uint32_t)EVP_CIPHER_iv_length(cipher) == args.iv->len);
+    BSON_ASSERT((uint32_t)EVP_CIPHER_key_length(cipher) == args.key->len);
     BSON_ASSERT(args.in->len <= INT_MAX);
 
     if (!EVP_EncryptInit_ex(ctx, cipher, NULL /* engine */, args.key->data, NULL == args.iv ? NULL : args.iv->data)) {
@@ -89,6 +89,7 @@ static bool _encrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args)
         goto done;
     }
 
+    BSON_ASSERT(intermediate_bytes_written >= 0 && (uint64_t)intermediate_bytes_written <= UINT32_MAX);
     /* intermediate_bytes_written cannot be negative, so int -> uint32_t is OK */
     *args.bytes_written = (uint32_t)intermediate_bytes_written;
 
@@ -97,7 +98,7 @@ static bool _encrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args)
         goto done;
     }
 
-    BSON_ASSERT(UINT32_MAX - *args.bytes_written >= intermediate_bytes_written);
+    BSON_ASSERT(UINT32_MAX - *args.bytes_written >= (uint32_t)intermediate_bytes_written);
     *args.bytes_written += (uint32_t)intermediate_bytes_written;
 
     ret = true;
@@ -116,18 +117,19 @@ done:
 static bool _decrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args) {
     EVP_CIPHER_CTX *ctx;
     bool ret = false;
-    int intermediate_bytes_written;
+    int intermediate_bytes_written = 0;
     mongocrypt_status_t *status = args.status;
 
     ctx = EVP_CIPHER_CTX_new();
+    BSON_ASSERT(ctx);
 
     BSON_ASSERT_PARAM(cipher);
     BSON_ASSERT(args.iv);
     BSON_ASSERT(args.key);
     BSON_ASSERT(args.in);
     BSON_ASSERT(args.out);
-    BSON_ASSERT(EVP_CIPHER_iv_length(cipher) == args.iv->len);
-    BSON_ASSERT(EVP_CIPHER_key_length(cipher) == args.key->len);
+    BSON_ASSERT((uint32_t)EVP_CIPHER_iv_length(cipher) == args.iv->len);
+    BSON_ASSERT((uint32_t)EVP_CIPHER_key_length(cipher) == args.key->len);
     BSON_ASSERT(args.in->len <= INT_MAX);
 
     if (!EVP_DecryptInit_ex(ctx, cipher, NULL /* engine */, args.key->data, args.iv->data)) {
@@ -145,6 +147,7 @@ static bool _decrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args)
         goto done;
     }
 
+    BSON_ASSERT(intermediate_bytes_written >= 0 && (uint64_t)intermediate_bytes_written <= UINT32_MAX);
     /* intermediate_bytes_written cannot be negative, so int -> uint32_t is OK */
     *args.bytes_written = (uint32_t)intermediate_bytes_written;
 
@@ -153,7 +156,7 @@ static bool _decrypt_with_cipher(const EVP_CIPHER *cipher, aes_256_args_t args)
         goto done;
     }
 
-    BSON_ASSERT(UINT32_MAX - *args.bytes_written >= intermediate_bytes_written);
+    BSON_ASSERT(UINT32_MAX - *args.bytes_written >= (uint32_t)intermediate_bytes_written);
     *args.bytes_written += (uint32_t)intermediate_bytes_written;
 
     ret = true;
@@ -203,9 +206,9 @@ static bool _hmac_with_hash(const EVP_MD *hash,
 
     ctx = HMAC_CTX_new();
 
-    if (out->len != EVP_MD_size(hash)) {
+    if (out->len != (uint32_t)EVP_MD_size(hash)) {
         CLIENT_ERR("out does not contain %d bytes", EVP_MD_size(hash));
-        return false;
+        goto done;
     }
 
     if (!HMAC_Init_ex(ctx, key->data, (int)key->len, hash, NULL /* engine */)) {

data/ext/libmongocrypt/libmongocrypt/src/mc-dec128.h

@@ -607,7 +607,7 @@ static inline char *mc_dec128_to_new_decimal_string(mc_dec128 d) {
     }
 }
 
-static inline mc_dec128 mc_dec128_from_bson_iter(bson_iter_t *it) {
+static inline mc_dec128 mc_dec128_from_bson_iter(const bson_iter_t *it) {
     bson_decimal128_t b;
     if (!bson_iter_decimal128(it, &b)) {
         mc_dec128 nan = MC_DEC128_POSITIVE_NAN;

data/ext/libmongocrypt/libmongocrypt/src/mc-efc-private.h

@@ -19,8 +19,19 @@
 #include "mongocrypt-buffer-private.h"
 #include <bson/bson.h>
 
+typedef enum _supported_query_type_flags {
+    // No queries supported
+    SUPPORTS_NO_QUERIES = 0,
+    // Equality query supported
+    SUPPORTS_EQUALITY_QUERIES = 1 << 0,
+    // Range query supported
+    SUPPORTS_RANGE_QUERIES = 1 << 1,
+    // Range preview query supported
+    SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES = 1 << 2,
+} supported_query_type_flags;
+
 typedef struct _mc_EncryptedField_t {
-    bool has_queries;
+    supported_query_type_flags supported_queries;
     _mongocrypt_buffer_t keyId;
     const char *path;
     struct _mc_EncryptedField_t *next;
@@ -37,7 +48,10 @@ typedef struct {
  * into @efc. Fields are copied from @efc_bson. It is OK to free efc_bson after
  * this call. Fields are appended in reverse order to @efc->fields. Extra
  * unrecognized fields are not considered an error for forward compatibility. */
-bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc, const bson_t *efc_bson, mongocrypt_status_t *status);
+bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc,
+                                   const bson_t *efc_bson,
+                                   mongocrypt_status_t *status,
+                                   bool use_range_v2);
 
 void mc_EncryptedFieldConfig_cleanup(mc_EncryptedFieldConfig_t *efc);
 

data/ext/libmongocrypt/libmongocrypt/src/mc-efc.c

@@ -16,12 +16,64 @@
 
 #include "mc-efc-private.h"
 
+#include "mlib/str.h"
 #include "mongocrypt-private.h"
 #include "mongocrypt-util-private.h" // mc_iter_document_as_bson
 
+static bool _parse_query_type_string(const char *queryType, supported_query_type_flags *out) {
+    BSON_ASSERT_PARAM(queryType);
+    BSON_ASSERT_PARAM(out);
+
+    mstr_view qtv = mstrv_view_cstr(queryType);
+
+    if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_EQUALITY_STR), qtv)) {
+        *out = SUPPORTS_EQUALITY_QUERIES;
+    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGE_STR), qtv)) {
+        *out = SUPPORTS_RANGE_QUERIES;
+    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR), qtv)) {
+        *out = SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES;
+    } else {
+        return false;
+    }
+
+    return true;
+}
+
+static bool
+_parse_supported_query_types(bson_iter_t *iter, supported_query_type_flags *out, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(iter);
+    BSON_ASSERT_PARAM(out);
+    if (!BSON_ITER_HOLDS_DOCUMENT(iter)) {
+        CLIENT_ERR("When parsing supported query types: Expected type document, got: %d", bson_iter_type(iter));
+        return false;
+    }
+
+    bson_t query_doc;
+    if (!mc_iter_document_as_bson(iter, &query_doc, status)) {
+        return false;
+    }
+    bson_iter_t query_type_iter;
+    if (!bson_iter_init_find(&query_type_iter, &query_doc, "queryType")) {
+        CLIENT_ERR("When parsing supported query types: Unable to find 'queryType' in query document");
+        return false;
+    }
+    if (!BSON_ITER_HOLDS_UTF8(&query_type_iter)) {
+        CLIENT_ERR("When parsing supported query types: Expected 'queryType' to be type UTF-8, got: %d",
+                   bson_iter_type(&query_type_iter));
+        return false;
+    }
+    const char *queryType = bson_iter_utf8(&query_type_iter, NULL /* length */);
+    if (!_parse_query_type_string(queryType, out)) {
+        CLIENT_ERR("When parsing supported query types: Did not recognize query type '%s'", queryType);
+        return false;
+    }
+    return true;
+}
+
 /* _parse_field parses and prepends one field document to efc->fields. */
-static bool _parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocrypt_status_t *status) {
-    bool has_queries = false;
+static bool
+_parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocrypt_status_t *status, bool use_range_v2) {
+    supported_query_type_flags query_types = SUPPORTS_NO_QUERIES;
     bson_iter_t field_iter;
 
     BSON_ASSERT_PARAM(efc);
@@ -53,7 +105,42 @@ static bool _parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocry
     field_path = bson_iter_utf8(&field_iter, NULL /* length */);
 
     if (bson_iter_init_find(&field_iter, field, "queries")) {
-        has_queries = true;
+        if (BSON_ITER_HOLDS_ARRAY(&field_iter)) {
+            // Multiple queries, iterate through and grab all query types.
+            uint32_t queries_buf_len;
+            const uint8_t *queries_buf;
+            bson_t queries_arr;
+            bson_iter_array(&field_iter, &queries_buf_len, &queries_buf);
+            if (!bson_init_static(&queries_arr, queries_buf, queries_buf_len)) {
+                CLIENT_ERR("Failed to parse 'queries' field");
+                return false;
+            }
+
+            bson_iter_t queries_iter;
+            bson_iter_init(&queries_iter, &queries_arr);
+            while (bson_iter_next(&queries_iter)) {
+                supported_query_type_flags flag;
+                if (!_parse_supported_query_types(&queries_iter, &flag, status)) {
+                    return false;
+                }
+                query_types |= flag;
+            }
+        } else {
+            supported_query_type_flags flag;
+            if (!_parse_supported_query_types(&field_iter, &flag, status)) {
+                return false;
+            }
+            query_types |= flag;
+        }
+    }
+
+    if (query_types & SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES && use_range_v2) {
+        // When rangev2 is enabled ("range") error if "rangePreview" is included.
+        // This check is intended to give an easier-to-understand earlier error.
+        CLIENT_ERR("Cannot use field '%s' with 'rangePreview' queries. 'rangePreview' is unsupported. Use 'range' "
+                   "instead. 'range' is not compatible with 'rangePreview' and requires recreating the collection.",
+                   field_path);
+        return false;
     }
 
     /* Prepend a new mc_EncryptedField_t */
@@ -61,7 +148,7 @@ static bool _parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocry
     _mongocrypt_buffer_copy_to(&field_keyid, &ef->keyId);
     ef->path = bson_strdup(field_path);
     ef->next = efc->fields;
-    ef->has_queries = has_queries;
+    ef->supported_queries = query_types;
     efc->fields = ef;
 
     return true;
@@ -69,7 +156,8 @@ static bool _parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocry
 
 bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc,
                                    const bson_t *efc_bson,
-                                   mongocrypt_status_t *status) {
+                                   mongocrypt_status_t *status,
+                                   bool use_range_v2) {
     bson_iter_t iter;
 
     BSON_ASSERT_PARAM(efc);
@@ -93,7 +181,7 @@ bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc,
         if (!mc_iter_document_as_bson(&iter, &field, status)) {
             return false;
         }
-        if (!_parse_field(efc, &field, status)) {
+        if (!_parse_field(efc, &field, status, use_range_v2)) {
             return false;
         }
     }

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-encryption-placeholder-private.h

@@ -49,7 +49,9 @@ typedef struct {
     bson_iter_t indexMax;
     // precision determines the number of digits after the decimal point for
     // floating point values.
-    mc_optional_uint32_t precision;
+    mc_optional_int32_t precision;
+    // trimFactor determines how many root levels of the hypergraph to trim.
+    mc_optional_int32_t trimFactor;
 } mc_FLE2RangeFindSpecEdgesInfo_t;
 
 /** FLE2RangeFindSpec represents the range find specification that is encoded
@@ -74,7 +76,10 @@ typedef struct {
     mc_FLE2RangeOperator_t secondOperator;
 } mc_FLE2RangeFindSpec_t;
 
-bool mc_FLE2RangeFindSpec_parse(mc_FLE2RangeFindSpec_t *out, const bson_iter_t *in, mongocrypt_status_t *status);
+bool mc_FLE2RangeFindSpec_parse(mc_FLE2RangeFindSpec_t *out,
+                                const bson_iter_t *in,
+                                bool use_range_v2,
+                                mongocrypt_status_t *status);
 
 /** mc_FLE2RangeInsertSpec_t represents the range insert specification that is
  * encoded inside of a FLE2EncryptionPlaceholder. See
@@ -89,10 +94,15 @@ typedef struct {
     bson_iter_t max;
     // precision determines the number of digits after the decimal point for
     // floating point values.
-    mc_optional_uint32_t precision;
+    mc_optional_int32_t precision;
+    // trimFactor determines how many root levels of the hypergraph to trim.
+    mc_optional_int32_t trimFactor;
 } mc_FLE2RangeInsertSpec_t;
 
-bool mc_FLE2RangeInsertSpec_parse(mc_FLE2RangeInsertSpec_t *out, const bson_iter_t *in, mongocrypt_status_t *status);
+bool mc_FLE2RangeInsertSpec_parse(mc_FLE2RangeInsertSpec_t *out,
+                                  const bson_iter_t *in,
+                                  bool use_range_v2,
+                                  mongocrypt_status_t *status);
 
 /** FLE2EncryptionPlaceholder implements Encryption BinData (subtype 6)
  * sub-subtype 0, the intent-to-encrypt mapping. Contains a value to encrypt and
@@ -116,7 +126,7 @@ typedef struct {
     bson_iter_t v_iter;
     _mongocrypt_buffer_t index_key_id;
     _mongocrypt_buffer_t user_key_id;
-    int64_t maxContentionCounter;
+    int64_t maxContentionFactor;
     // sparsity is the Queryable Encryption range hypergraph sparsity factor
     int64_t sparsity;
 } mc_FLE2EncryptionPlaceholder_t;