libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-private.h

@@ -39,12 +39,17 @@ typedef enum {
 typedef enum {
     MONGOCRYPT_INDEX_TYPE_NONE = 1,
     MONGOCRYPT_INDEX_TYPE_EQUALITY = 2,
-    MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW = 3
+    MONGOCRYPT_INDEX_TYPE_RANGE = 3,
+    MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW_DEPRECATED = 4
 } mongocrypt_index_type_t;
 
 const char *_mongocrypt_index_type_to_string(mongocrypt_index_type_t val);
 
-typedef enum { MONGOCRYPT_QUERY_TYPE_EQUALITY = 1, MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW = 2 } mongocrypt_query_type_t;
+typedef enum {
+    MONGOCRYPT_QUERY_TYPE_EQUALITY = 1,
+    MONGOCRYPT_QUERY_TYPE_RANGE = 2,
+    MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED = 3
+} mongocrypt_query_type_t;
 
 const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val);
 
@@ -84,6 +89,7 @@ typedef struct __mongocrypt_ctx_opts_t {
 
 /* All derived contexts may override these methods. */
 typedef struct {
+    const char *(*mongo_db_collinfo)(mongocrypt_ctx_t *ctx);
     bool (*mongo_op_collinfo)(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out);
     bool (*mongo_feed_collinfo)(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *in);
     bool (*mongo_done_collinfo)(mongocrypt_ctx_t *ctx);
@@ -129,9 +135,22 @@ bool _mongocrypt_ctx_fail_w_msg(mongocrypt_ctx_t *ctx, const char *msg);
 typedef struct {
     mongocrypt_ctx_t parent;
     bool explicit;
-    char *coll_name;
-    char *db_name;
-    char *ns;
+
+    // `cmd_db` is the command database (appended as `$db`).
+    char *cmd_db;
+
+    // `target_ns` is the target namespace "<target_db>.<target_coll>" for the operation. May be associated with
+    // jsonSchema (CSFLE) or encryptedFields (QE). For `bulkWrite`, the target namespace database may differ from
+    // `cmd_db`.
+    char *target_ns;
+
+    // `target_db` is the target database for the operation. For `bulkWrite`, the target namespace database may differ
+    // from `cmd_db`. If `target_db` is NULL, the target namespace database is the same as `cmd_db`.
+    char *target_db;
+
+    // `target_coll` is the target namespace collection name.
+    char *target_coll;
+
     _mongocrypt_buffer_t list_collections_filter;
     _mongocrypt_buffer_t schema;
     /* TODO CDRIVER-3150: audit + rename these buffers.
@@ -156,13 +175,19 @@ typedef struct {
      * schema, and there were siblings. */
     bool collinfo_has_siblings;
     /* encrypted_field_config is set when:
-     * 1. <db_name>.<coll_name> is present in an encrypted_field_config_map.
+     * 1. `target_ns` is present in an encrypted_field_config_map.
      * 2. (TODO MONGOCRYPT-414) The collection has encryptedFields in the
      * response to listCollections. encrypted_field_config is true if and only if
      * encryption is using FLE 2.0.
+     * 3. The `bulkWrite` command is processed and needs an empty encryptedFields to be processed by query analysis.
+     * (`bulkWrite` does not support empty JSON schema).
      */
     _mongocrypt_buffer_t encrypted_field_config;
     mc_EncryptedFieldConfig_t efc;
+    // `used_empty_encryptedFields` is true if the collection has no JSON schema or encryptedFields,
+    // yet an empty encryptedFields was constructed to support query analysis.
+    // When true, an empty encryptedFields is sent to query analysis, but not appended to the final command.
+    bool used_empty_encryptedFields;
     /* bypass_query_analysis is set to true to skip the
      * MONGOCRYPT_CTX_NEED_MONGO_MARKINGS state. */
     bool bypass_query_analysis;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx.c

@@ -258,8 +258,15 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
     } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_UNINDEXED_STR))) {
         ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_NONE;
         ctx->opts.index_type.set = true;
-    } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_STR))) {
-        ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW;
+    } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_RANGE_STR))) {
+        ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_RANGE;
+        ctx->opts.index_type.set = true;
+    } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_DEPRECATED_STR))) {
+        if (ctx->crypt->opts.use_range_v2) {
+            _mongocrypt_ctx_fail_w_msg(ctx, "Algorithm 'rangePreview' is deprecated, please use 'range'");
+            return false;
+        }
+        ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW_DEPRECATED;
         ctx->opts.index_type.set = true;
     } else {
         char *error = bson_strdup_printf("unsupported algorithm string \"%.*s\"",
@@ -379,6 +386,7 @@ bool mongocrypt_ctx_mongo_op(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out) {
     }
 
     switch (ctx->state) {
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB:
     case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO: CHECK_AND_CALL(mongo_op_collinfo, ctx, out);
     case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS: CHECK_AND_CALL(mongo_op_markings, ctx, out);
     case MONGOCRYPT_CTX_NEED_MONGO_KEYS: CHECK_AND_CALL(mongo_op_keys, ctx, out);
@@ -391,6 +399,38 @@ bool mongocrypt_ctx_mongo_op(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out) {
     }
 }
 
+const char *mongocrypt_ctx_mongo_db(mongocrypt_ctx_t *ctx) {
+    if (!ctx) {
+        return NULL;
+    }
+    if (!ctx->initialized) {
+        _mongocrypt_ctx_fail_w_msg(ctx, "ctx NULL or uninitialized");
+        return NULL;
+    }
+
+    switch (ctx->state) {
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB: {
+        if (!ctx->vtable.mongo_db_collinfo) {
+            _mongocrypt_ctx_fail_w_msg(ctx, "not applicable to context");
+            return NULL;
+        }
+        return ctx->vtable.mongo_db_collinfo(ctx);
+    }
+    case MONGOCRYPT_CTX_ERROR: return false;
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO:
+    case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
+    case MONGOCRYPT_CTX_NEED_MONGO_KEYS:
+    case MONGOCRYPT_CTX_DONE:
+    case MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS:
+    case MONGOCRYPT_CTX_NEED_KMS:
+    case MONGOCRYPT_CTX_READY:
+    default: {
+        _mongocrypt_ctx_fail_w_msg(ctx, "wrong state");
+        return NULL;
+    }
+    }
+}
+
 bool mongocrypt_ctx_mongo_feed(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *in) {
     if (!ctx) {
         return false;
@@ -412,6 +452,7 @@ bool mongocrypt_ctx_mongo_feed(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *in) {
     }
 
     switch (ctx->state) {
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB:
     case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO: CHECK_AND_CALL(mongo_feed_collinfo, ctx, in);
     case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS: CHECK_AND_CALL(mongo_feed_markings, ctx, in);
     case MONGOCRYPT_CTX_NEED_MONGO_KEYS: CHECK_AND_CALL(mongo_feed_keys, ctx, in);
@@ -433,6 +474,7 @@ bool mongocrypt_ctx_mongo_done(mongocrypt_ctx_t *ctx) {
     }
 
     switch (ctx->state) {
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB:
     case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO: CHECK_AND_CALL(mongo_done_collinfo, ctx);
     case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS: CHECK_AND_CALL(mongo_done_markings, ctx);
     case MONGOCRYPT_CTX_NEED_MONGO_KEYS: CHECK_AND_CALL(mongo_done_keys, ctx);
@@ -476,6 +518,7 @@ mongocrypt_kms_ctx_t *mongocrypt_ctx_next_kms_ctx(mongocrypt_ctx_t *ctx) {
     case MONGOCRYPT_CTX_ERROR: return NULL;
     case MONGOCRYPT_CTX_DONE:
     case MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS:
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB:
     case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO:
     case MONGOCRYPT_CTX_NEED_MONGO_KEYS:
     case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
@@ -504,6 +547,8 @@ bool mongocrypt_ctx_provide_kms_providers(mongocrypt_ctx_t *ctx, mongocrypt_bina
         return false;
     }
 
+    _mongocrypt_opts_kms_providers_init(&ctx->per_ctx_kms_providers);
+
     if (!_mongocrypt_parse_kms_providers(kms_providers_definition,
                                          &ctx->per_ctx_kms_providers,
                                          ctx->status,
@@ -545,6 +590,7 @@ bool mongocrypt_ctx_kms_done(mongocrypt_ctx_t *ctx) {
     case MONGOCRYPT_CTX_ERROR: return false;
     case MONGOCRYPT_CTX_DONE:
     case MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS:
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB:
     case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO:
     case MONGOCRYPT_CTX_NEED_MONGO_KEYS:
     case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
@@ -575,6 +621,7 @@ bool mongocrypt_ctx_finalize(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out) {
     case MONGOCRYPT_CTX_DONE:
     case MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS:
     case MONGOCRYPT_CTX_NEED_KMS:
+    case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB:
     case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO:
     case MONGOCRYPT_CTX_NEED_MONGO_KEYS:
     case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
@@ -711,6 +758,7 @@ bool mongocrypt_ctx_setopt_masterkey_local(mongocrypt_ctx_t *ctx) {
     }
 
     ctx->opts.kek.kms_provider = MONGOCRYPT_KMS_PROVIDER_LOCAL;
+    ctx->opts.kek.kmsid = bson_strdup("local");
     return true;
 }
 
@@ -747,9 +795,13 @@ bool _mongocrypt_ctx_init(mongocrypt_ctx_t *ctx, _mongocrypt_ctx_opts_spec_t *op
         if (!ctx->opts.kek.kms_provider) {
             return _mongocrypt_ctx_fail_w_msg(ctx, "master key required");
         }
-        if (!ctx->crypt->opts.use_need_kms_credentials_state
-            && !((int)ctx->opts.kek.kms_provider & _mongocrypt_ctx_kms_providers(ctx)->configured_providers)) {
-            return _mongocrypt_ctx_fail_w_msg(ctx, "requested kms provider not configured");
+        mc_kms_creds_t unused;
+        bool is_configured =
+            _mongocrypt_opts_kms_providers_lookup(_mongocrypt_ctx_kms_providers(ctx), ctx->opts.kek.kmsid, &unused);
+        if (!ctx->crypt->opts.use_need_kms_credentials_state && !is_configured) {
+            mongocrypt_status_t *status = ctx->status;
+            CLIENT_ERR("requested kms provider not configured: `%s`", ctx->opts.kek.kmsid);
+            return _mongocrypt_ctx_fail(ctx);
         }
     }
 
@@ -759,9 +811,16 @@ bool _mongocrypt_ctx_init(mongocrypt_ctx_t *ctx, _mongocrypt_ctx_opts_spec_t *op
 
     /* Check that the kms provider required by the datakey is configured.  */
     if (ctx->opts.kek.kms_provider) {
-        if (!((ctx->crypt->opts.kms_providers.need_credentials | ctx->crypt->opts.kms_providers.configured_providers)
-              & (int)ctx->opts.kek.kms_provider)) {
-            return _mongocrypt_ctx_fail_w_msg(ctx, "kms provider required by datakey is not configured");
+        mc_kms_creds_t unused;
+        bool is_configured =
+            _mongocrypt_opts_kms_providers_lookup(_mongocrypt_ctx_kms_providers(ctx), ctx->opts.kek.kmsid, &unused);
+        bool needs = _mongocrypt_needs_credentials_for_provider(ctx->crypt,
+                                                                ctx->opts.kek.kms_provider,
+                                                                ctx->opts.kek.kmsid_name);
+        if (!is_configured && !needs) {
+            mongocrypt_status_t *status = ctx->status;
+            CLIENT_ERR("requested kms provider required by datakey is not configured: `%s`", ctx->opts.kek.kmsid);
+            return _mongocrypt_ctx_fail(ctx);
         }
     }
 
@@ -1002,8 +1061,15 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
     if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_EQUALITY_STR))) {
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_EQUALITY;
         ctx->opts.query_type.set = true;
-    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_STR))) {
-        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGE_STR))) {
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_RANGE;
+        ctx->opts.query_type.set = true;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR))) {
+        if (ctx->crypt->opts.use_range_v2) {
+            _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'rangePreview' is deprecated, please use 'range'");
+            return false;
+        }
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED;
         ctx->opts.query_type.set = true;
     } else {
         /* don't check if qt_str.len fits in int; we want the diagnostic output */
@@ -1021,7 +1087,8 @@ const char *_mongocrypt_index_type_to_string(mongocrypt_index_type_t val) {
     switch (val) {
     case MONGOCRYPT_INDEX_TYPE_NONE: return "None";
     case MONGOCRYPT_INDEX_TYPE_EQUALITY: return "Equality";
-    case MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW: return "RangePreview";
+    case MONGOCRYPT_INDEX_TYPE_RANGE: return "Range";
+    case MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW_DEPRECATED: return "RangePreview";
     default: return "Unknown";
     }
 }
@@ -1029,7 +1096,8 @@ const char *_mongocrypt_index_type_to_string(mongocrypt_index_type_t val) {
 const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val) {
     switch (val) {
     case MONGOCRYPT_QUERY_TYPE_EQUALITY: return "Equality";
-    case MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW: return "RangePreview";
+    case MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED: return "RangePreview";
+    case MONGOCRYPT_QUERY_TYPE_RANGE: return "Range";
     default: return "Unknown";
     }
 }
@@ -1057,7 +1125,7 @@ bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_bin
         return _mongocrypt_ctx_fail_w_msg(ctx, "invalid BSON");
     }
 
-    if (!mc_RangeOpts_parse(&ctx->opts.rangeopts.value, &as_bson, ctx->status)) {
+    if (!mc_RangeOpts_parse(&ctx->opts.rangeopts.value, &as_bson, ctx->crypt->opts.use_range_v2, ctx->status)) {
         return _mongocrypt_ctx_fail(ctx);
     }
 

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-dll-private.h

@@ -83,7 +83,14 @@ typedef struct mcr_dll_path_result {
  * library, or an error string.
  *
  * @note Caller must free both `retval.path` and `retval.error_string`.
+ * @note Returns an error if not supported on this platform. Use
+ * `mcr_dll_path_supported` to check before calling.
  */
 mcr_dll_path_result mcr_dll_path(mcr_dll dll);
 
+/**
+ * @brief Return true if `mcr_dll_path` is supported on this platform.
+ */
+bool mcr_dll_path_supported(void);
+
 #endif // MONGOCRYPT_DLL_PRIVATE_H

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-kek-private.h

@@ -69,6 +69,7 @@ typedef struct {
 typedef struct {
     char *key_id;                     /* optional on parsing, required on appending. */
     _mongocrypt_endpoint_t *endpoint; /* optional. */
+    bool delegated;
 } _mongocrypt_kmip_kek_t;
 
 typedef struct {
@@ -80,6 +81,9 @@ typedef struct {
         _mongocrypt_aws_kek_t aws;
         _mongocrypt_kmip_kek_t kmip;
     } provider;
+
+    char *kmsid;
+    const char *kmsid_name;
 } _mongocrypt_kek_t;
 
 /* Parse a document describing a key encryption key.
@@ -100,4 +104,4 @@ void _mongocrypt_kek_copy_to(const _mongocrypt_kek_t *src, _mongocrypt_kek_t *ds
 
 void _mongocrypt_kek_cleanup(_mongocrypt_kek_t *kek);
 
-#endif /* MONGOCRYPT_KEK_PRIVATE_H */
+#endif /* MONGOCRYPT_KEK_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-kek.c

@@ -18,6 +18,126 @@
 #include "mongocrypt-opts-private.h"
 #include "mongocrypt-private.h"
 
+static bool _mongocrypt_azure_kek_parse(_mongocrypt_azure_kek_t *azure,
+                                        const char *kmsid,
+                                        const bson_t *def,
+                                        mongocrypt_status_t *status) {
+    if (!_mongocrypt_parse_required_endpoint(def,
+                                             "keyVaultEndpoint",
+                                             &azure->key_vault_endpoint,
+                                             NULL /* opts */,
+                                             status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_required_utf8(def, "keyName", &azure->key_name, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_optional_utf8(def, "keyVersion", &azure->key_version, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_check_allowed_fields(def,
+                                          NULL /* root */,
+                                          status,
+                                          "provider",
+                                          "keyVaultEndpoint",
+                                          "keyName",
+                                          "keyVersion")) {
+        return false;
+    }
+    return true;
+}
+
+static bool _mongocrypt_gcp_kek_parse(_mongocrypt_gcp_kek_t *gcp,
+                                      const char *kmsid,
+                                      const bson_t *def,
+                                      mongocrypt_status_t *status) {
+    if (!_mongocrypt_parse_optional_endpoint(def, "endpoint", &gcp->endpoint, NULL /* opts */, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_required_utf8(def, "projectId", &gcp->project_id, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_required_utf8(def, "location", &gcp->location, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_required_utf8(def, "keyRing", &gcp->key_ring, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_required_utf8(def, "keyName", &gcp->key_name, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_optional_utf8(def, "keyVersion", &gcp->key_version, status)) {
+        return false;
+    }
+    if (!_mongocrypt_check_allowed_fields(def,
+                                          NULL,
+                                          status,
+                                          "provider",
+                                          "endpoint",
+                                          "projectId",
+                                          "location",
+                                          "keyRing",
+                                          "keyName",
+                                          "keyVersion")) {
+        return false;
+    }
+    return true;
+}
+
+static bool _mongocrypt_aws_kek_parse(_mongocrypt_aws_kek_t *aws,
+                                      const char *kmsid,
+                                      const bson_t *def,
+                                      mongocrypt_status_t *status) {
+    if (!_mongocrypt_parse_required_utf8(def, "key", &aws->cmk, status)) {
+        return false;
+    }
+    if (!_mongocrypt_parse_required_utf8(def, "region", &aws->region, status)) {
+        return false;
+    }
+    if (!_mongocrypt_parse_optional_endpoint(def, "endpoint", &aws->endpoint, NULL /* opts */, status)) {
+        return false;
+    }
+    if (!_mongocrypt_check_allowed_fields(def, NULL, status, "provider", "key", "region", "endpoint")) {
+        return false;
+    }
+
+    return true;
+}
+
+static bool _mongocrypt_kmip_kek_parse(_mongocrypt_kmip_kek_t *kmip,
+                                       const char *kmsid,
+                                       const bson_t *def,
+                                       mongocrypt_status_t *status) {
+    _mongocrypt_endpoint_parse_opts_t opts = {0};
+
+    opts.allow_empty_subdomain = true;
+    if (!_mongocrypt_parse_optional_endpoint(def, "endpoint", &kmip->endpoint, &opts, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_parse_optional_utf8(def, "keyId", &kmip->key_id, status)) {
+        return false;
+    }
+
+    kmip->delegated = false;
+    if (!_mongocrypt_parse_optional_bool(def, "delegated", &kmip->delegated, status)) {
+        return false;
+    }
+
+    if (!_mongocrypt_check_allowed_fields(def, NULL, status, "provider", "endpoint", "keyId", "delegated")) {
+        return false;
+    }
+    return true;
+}
+
 /* Possible documents to parse:
  * AWS
  *    provider: "aws"
@@ -55,116 +175,50 @@ bool _mongocrypt_kek_parse_owned(const bson_t *bson, _mongocrypt_kek_t *kek, mon
         goto done;
     }
 
-    if (0 == strcmp(kms_provider, "aws")) {
-        kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_AWS;
-        if (!_mongocrypt_parse_required_utf8(bson, "key", &kek->provider.aws.cmk, status)) {
-            goto done;
-        }
-        if (!_mongocrypt_parse_required_utf8(bson, "region", &kek->provider.aws.region, status)) {
-            goto done;
-        }
-        if (!_mongocrypt_parse_optional_endpoint(bson,
-                                                 "endpoint",
-                                                 &kek->provider.aws.endpoint,
-                                                 NULL /* opts */,
-                                                 status)) {
-            goto done;
-        }
-        if (!_mongocrypt_check_allowed_fields(bson, NULL, status, "provider", "key", "region", "endpoint")) {
-            goto done;
-        }
-    } else if (0 == strcmp(kms_provider, "local")) {
-        kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_LOCAL;
-        if (!_mongocrypt_check_allowed_fields(bson, NULL, status, "provider")) {
-            goto done;
-        }
-    } else if (0 == strcmp(kms_provider, "azure")) {
-        kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_AZURE;
-        if (!_mongocrypt_parse_required_endpoint(bson,
-                                                 "keyVaultEndpoint",
-                                                 &kek->provider.azure.key_vault_endpoint,
-                                                 NULL /* opts */,
-                                                 status)) {
-            goto done;
-        }
-
-        if (!_mongocrypt_parse_required_utf8(bson, "keyName", &kek->provider.azure.key_name, status)) {
-            goto done;
-        }
-
-        if (!_mongocrypt_parse_optional_utf8(bson, "keyVersion", &kek->provider.azure.key_version, status)) {
-            goto done;
-        }
-
-        if (!_mongocrypt_check_allowed_fields(bson,
-                                              NULL,
-                                              status,
-                                              "provider",
-                                              "keyVaultEndpoint",
-                                              "keyName",
-                                              "keyVersion")) {
-            goto done;
-        }
-    } else if (0 == strcmp(kms_provider, "gcp")) {
-        kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_GCP;
-        if (!_mongocrypt_parse_optional_endpoint(bson,
-                                                 "endpoint",
-                                                 &kek->provider.gcp.endpoint,
-                                                 NULL /* opts */,
-                                                 status)) {
-            goto done;
-        }
-
-        if (!_mongocrypt_parse_required_utf8(bson, "projectId", &kek->provider.gcp.project_id, status)) {
-            goto done;
-        }
-
-        if (!_mongocrypt_parse_required_utf8(bson, "location", &kek->provider.gcp.location, status)) {
-            goto done;
-        }
-
-        if (!_mongocrypt_parse_required_utf8(bson, "keyRing", &kek->provider.gcp.key_ring, status)) {
-            goto done;
-        }
+    kek->kmsid = bson_strdup(kms_provider);
 
-        if (!_mongocrypt_parse_required_utf8(bson, "keyName", &kek->provider.gcp.key_name, status)) {
-            goto done;
-        }
+    _mongocrypt_kms_provider_t type;
+    if (!mc_kmsid_parse(kek->kmsid, &type, &kek->kmsid_name, status)) {
+        goto done;
+    }
 
-        if (!_mongocrypt_parse_optional_utf8(bson, "keyVersion", &kek->provider.gcp.key_version, status)) {
+    kek->kms_provider = type;
+    switch (type) {
+    default:
+    case MONGOCRYPT_KMS_PROVIDER_NONE: {
+        CLIENT_ERR("Unexpected parsing KMS type: none");
+        goto done;
+    }
+    case MONGOCRYPT_KMS_PROVIDER_AWS: {
+        if (!_mongocrypt_aws_kek_parse(&kek->provider.aws, kek->kmsid, bson, status)) {
             goto done;
         }
-        if (!_mongocrypt_check_allowed_fields(bson,
-                                              NULL,
-                                              status,
-                                              "provider",
-                                              "endpoint",
-                                              "projectId",
-                                              "location",
-                                              "keyRing",
-                                              "keyName",
-                                              "keyVersion")) {
+        break;
+    }
+    case MONGOCRYPT_KMS_PROVIDER_LOCAL: {
+        if (!_mongocrypt_check_allowed_fields(bson, NULL, status, "provider")) {
             goto done;
         }
-    } else if (0 == strcmp(kms_provider, "kmip")) {
-        kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_KMIP;
-        _mongocrypt_endpoint_parse_opts_t opts = {0};
-
-        opts.allow_empty_subdomain = true;
-        if (!_mongocrypt_parse_optional_endpoint(bson, "endpoint", &kek->provider.kmip.endpoint, &opts, status)) {
+        break;
+    }
+    case MONGOCRYPT_KMS_PROVIDER_AZURE: {
+        if (!_mongocrypt_azure_kek_parse(&kek->provider.azure, kek->kmsid, bson, status)) {
             goto done;
         }
-
-        if (!_mongocrypt_parse_optional_utf8(bson, "keyId", &kek->provider.kmip.key_id, status)) {
+        break;
+    }
+    case MONGOCRYPT_KMS_PROVIDER_GCP: {
+        if (!_mongocrypt_gcp_kek_parse(&kek->provider.gcp, kek->kmsid, bson, status)) {
             goto done;
         }
-
-        if (!_mongocrypt_check_allowed_fields(bson, NULL, status, "provider", "endpoint", "keyId")) {
+        break;
+    }
+    case MONGOCRYPT_KMS_PROVIDER_KMIP: {
+        if (!_mongocrypt_kmip_kek_parse(&kek->provider.kmip, kek->kmsid, bson, status)) {
             goto done;
         }
-    } else {
-        CLIENT_ERR("unrecognized KMS provider: %s", kms_provider);
-        goto done;
+        break;
+    }
     }
 
     ret = true;
@@ -177,24 +231,22 @@ bool _mongocrypt_kek_append(const _mongocrypt_kek_t *kek, bson_t *bson, mongocry
     BSON_ASSERT_PARAM(kek);
     BSON_ASSERT_PARAM(bson);
 
+    BSON_APPEND_UTF8(bson, "provider", kek->kmsid);
     if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_AWS) {
-        BSON_APPEND_UTF8(bson, "provider", "aws");
         BSON_APPEND_UTF8(bson, "region", kek->provider.aws.region);
         BSON_APPEND_UTF8(bson, "key", kek->provider.aws.cmk);
         if (kek->provider.aws.endpoint) {
             BSON_APPEND_UTF8(bson, "endpoint", kek->provider.aws.endpoint->host_and_port);
         }
     } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_LOCAL) {
-        BSON_APPEND_UTF8(bson, "provider", "local");
+        // Only `provider` is needed.
     } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_AZURE) {
-        BSON_APPEND_UTF8(bson, "provider", "azure");
         BSON_APPEND_UTF8(bson, "keyVaultEndpoint", kek->provider.azure.key_vault_endpoint->host_and_port);
         BSON_APPEND_UTF8(bson, "keyName", kek->provider.azure.key_name);
         if (kek->provider.azure.key_version) {
             BSON_APPEND_UTF8(bson, "keyVersion", kek->provider.azure.key_version);
         }
     } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_GCP) {
-        BSON_APPEND_UTF8(bson, "provider", "gcp");
         BSON_APPEND_UTF8(bson, "projectId", kek->provider.gcp.project_id);
         BSON_APPEND_UTF8(bson, "location", kek->provider.gcp.location);
         BSON_APPEND_UTF8(bson, "keyRing", kek->provider.gcp.key_ring);
@@ -206,11 +258,14 @@ bool _mongocrypt_kek_append(const _mongocrypt_kek_t *kek, bson_t *bson, mongocry
             BSON_APPEND_UTF8(bson, "endpoint", kek->provider.gcp.endpoint->host_and_port);
         }
     } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_KMIP) {
-        BSON_APPEND_UTF8(bson, "provider", "kmip");
         if (kek->provider.kmip.endpoint) {
             BSON_APPEND_UTF8(bson, "endpoint", kek->provider.kmip.endpoint->host_and_port);
         }
 
+        if (kek->provider.kmip.delegated) {
+            BSON_APPEND_BOOL(bson, "delegated", kek->provider.kmip.delegated);
+        }
+
         /* "keyId" is required in the final data key document for the "kmip" KMS
          * provider. It may be set from the "kmip.keyId" in the BSON document set
          * in mongocrypt_ctx_setopt_key_encryption_key, Otherwise, libmongocrypt
@@ -249,11 +304,13 @@ void _mongocrypt_kek_copy_to(const _mongocrypt_kek_t *src, _mongocrypt_kek_t *ds
     } else if (src->kms_provider == MONGOCRYPT_KMS_PROVIDER_KMIP) {
         dst->provider.kmip.endpoint = _mongocrypt_endpoint_copy(src->provider.kmip.endpoint);
         dst->provider.kmip.key_id = bson_strdup(src->provider.kmip.key_id);
+        dst->provider.kmip.delegated = src->provider.kmip.delegated;
     } else {
         BSON_ASSERT(src->kms_provider == MONGOCRYPT_KMS_PROVIDER_NONE
                     || src->kms_provider == MONGOCRYPT_KMS_PROVIDER_LOCAL);
     }
     dst->kms_provider = src->kms_provider;
+    dst->kmsid = bson_strdup(src->kmsid);
 }
 
 void _mongocrypt_kek_cleanup(_mongocrypt_kek_t *kek) {
@@ -283,5 +340,6 @@ void _mongocrypt_kek_cleanup(_mongocrypt_kek_t *kek) {
         BSON_ASSERT(kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_NONE
                     || kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_LOCAL);
     }
+    bson_free(kek->kmsid);
     return;
 }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-key-broker-private.h

@@ -87,11 +87,7 @@ typedef struct _key_returned_t {
     struct _key_returned_t *next;
 } key_returned_t;
 
-typedef struct _auth_request_t {
-    mongocrypt_kms_ctx_t kms;
-    bool returned;
-    bool initialized;
-} auth_request_t;
+typedef struct _mc_mapof_kmsid_to_authrequest_t mc_mapof_kmsid_to_authrequest_t;
 
 typedef struct {
     key_broker_state_t state;
@@ -109,8 +105,7 @@ typedef struct {
     mongocrypt_t *crypt;
 
     key_returned_t *decryptor_iter;
-    auth_request_t auth_request_azure;
-    auth_request_t auth_request_gcp;
+    mc_mapof_kmsid_to_authrequest_t *auth_requests;
 } _mongocrypt_key_broker_t;
 
 void _mongocrypt_key_broker_init(_mongocrypt_key_broker_t *kb, mongocrypt_t *crypt);