libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-compact.c

@@ -17,49 +17,128 @@
 #include "test-mongocrypt.h"
 
 static void _test_compact_success(_mongocrypt_tester_t *tester) {
-    mongocrypt_t *crypt;
-    mongocrypt_ctx_t *ctx;
-
-    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
-    ctx = mongocrypt_ctx_new(crypt);
-
-    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/compact/success/cmd.json")), ctx);
-
-    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
-    {
-        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/compact/success/collinfo.json")), ctx);
-        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
-    }
-
-    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
-    {
-        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
-                                            TEST_FILE("./test/data/keys/"
-                                                      "12345678123498761234123456789012-local-document.json")),
-                  ctx);
-        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
-                                            TEST_FILE("./test/data/keys/"
-                                                      "ABCDEFAB123498761234123456789012-local-document.json")),
-                  ctx);
-        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
-                                            TEST_FILE("./test/data/keys/"
-                                                      "12345678123498761234123456789013-local-document.json")),
-                  ctx);
-        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    const char basepath[] = "./test/data/compact/";
+    char datapath[1000];
+    char cmdfile[1000];
+    char collfile[1000];
+    char payloadfile[1000];
+    strcpy(datapath, basepath);
+    size_t nullb = strlen(basepath);
+    for (int use_anchor_pad = 0; use_anchor_pad <= 1; use_anchor_pad++) {
+        for (int use_range_v2 = 0; use_range_v2 <= 1; use_range_v2++) {
+            datapath[nullb] = 0;
+            strcat(datapath, use_anchor_pad ? "anchor-pad/" : "success/");
+            strcpy(cmdfile, datapath);
+            strcat(cmdfile, "cmd.json");
+            strcpy(collfile, datapath);
+            strcat(collfile, "collinfo.json");
+            strcpy(payloadfile, datapath);
+            strcat(payloadfile, use_range_v2 ? "encrypted-payload-range-v2.json" : "encrypted-payload.json");
+
+            mongocrypt_t *crypt;
+            mongocrypt_ctx_t *ctx;
+
+            crypt = _mongocrypt_tester_mongocrypt(use_range_v2 ? TESTER_MONGOCRYPT_WITH_RANGE_V2
+                                                               : TESTER_MONGOCRYPT_DEFAULT);
+            ctx = mongocrypt_ctx_new(crypt);
+
+            ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE(cmdfile)), ctx);
+
+            ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+            {
+                ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE(collfile)), ctx);
+                ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+            }
+
+            ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+            {
+                ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                    TEST_FILE("./test/data/keys/"
+                                                              "12345678123498761234123456789012-local-document.json")),
+                          ctx);
+                ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                    TEST_FILE("./test/data/keys/"
+                                                              "ABCDEFAB123498761234123456789012-local-document.json")),
+                          ctx);
+                ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                    TEST_FILE("./test/data/keys/"
+                                                              "12345678123498761234123456789013-local-document.json")),
+                          ctx);
+                ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+            }
+
+            ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+            {
+                mongocrypt_binary_t *out = mongocrypt_binary_new();
+                ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+                ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE(payloadfile), out);
+                mongocrypt_binary_destroy(out);
+            }
+
+            ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+            mongocrypt_ctx_destroy(ctx);
+            mongocrypt_destroy(crypt);
+        }
     }
 
-    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
-    {
-        mongocrypt_binary_t *out = mongocrypt_binary_new();
-        ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
-        ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE("./test/data/compact/success/encrypted-payload.json"), out);
-        mongocrypt_binary_destroy(out);
+    // Test `compactStructuredEncryptionData` without range fields omits encryptionInformation.
+    // This is a regression test for MONGOCRYPT-699.
+    for (int use_range_v2 = 0; use_range_v2 <= 1; use_range_v2++) {
+        datapath[nullb] = 0;
+        strcat(datapath, "no-range/");
+        strcpy(cmdfile, datapath);
+        strcat(cmdfile, "cmd.json");
+        strcpy(collfile, datapath);
+        strcat(collfile, "collinfo.json");
+        strcpy(payloadfile, datapath);
+        strcat(payloadfile, "encrypted-payload.json"); // Expect same result regardless of range v2.
+
+        mongocrypt_t *crypt;
+        mongocrypt_ctx_t *ctx;
+
+        crypt =
+            _mongocrypt_tester_mongocrypt(use_range_v2 ? TESTER_MONGOCRYPT_WITH_RANGE_V2 : TESTER_MONGOCRYPT_DEFAULT);
+        ctx = mongocrypt_ctx_new(crypt);
+
+        ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE(cmdfile)), ctx);
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+        {
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE(collfile)), ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+        }
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+        {
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                TEST_FILE("./test/data/keys/"
+                                                          "12345678123498761234123456789012-local-document.json")),
+                      ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                TEST_FILE("./test/data/keys/"
+                                                          "ABCDEFAB123498761234123456789012-local-document.json")),
+                      ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                TEST_FILE("./test/data/keys/"
+                                                          "12345678123498761234123456789013-local-document.json")),
+                      ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+        }
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+        {
+            mongocrypt_binary_t *out = mongocrypt_binary_new();
+            ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+            ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE(payloadfile), out);
+            mongocrypt_binary_destroy(out);
+        }
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_destroy(crypt);
     }
-
-    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
-
-    mongocrypt_ctx_destroy(ctx);
-    mongocrypt_destroy(crypt);
 }
 
 static void _test_compact_nonlocal_kms(_mongocrypt_tester_t *tester) {
@@ -191,7 +270,7 @@ static void _test_compact_need_kms_credentials(_mongocrypt_tester_t *tester) {
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
     ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'aws': {}}")), crypt);
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
 
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/compact/success/cmd.json")), ctx);
@@ -316,7 +395,7 @@ static void _test_compact_from_encrypted_field_config_map(_mongocrypt_tester_t *
                       crypt,
                       TEST_FILE("./test/data/compact/success/encrypted-field-config-map.json")),
                   crypt);
-        ASSERT_OK(mongocrypt_init(crypt), crypt);
+        ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     }
     ctx = mongocrypt_ctx_new(crypt);
 

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-crypto-hooks.c

@@ -17,6 +17,7 @@
 #include "mongocrypt-config.h"
 #include "mongocrypt-crypto-private.h"
 #include "mongocrypt-private.h"
+#include "test-mongocrypt-crypto-std-hooks.h"
 
 #include "test-mongocrypt.h"
 
@@ -67,7 +68,8 @@ static bool _mock_aes_256_xxx_encrypt(void *ctx,
     }
     _append_bin("in", in);
     /* append it directly, don't encrypt. */
-    memcpy(out->data + *bytes_written, in->data, in->len);
+    uint8_t *out_u8 = out->data;
+    memcpy(out_u8 + *bytes_written, in->data, in->len);
     *bytes_written += in->len;
     bson_string_append_printf(call_history, "ret:%s\n", BSON_FUNC);
     if (0 == strcmp((char *)ctx, "error_on:aes_256_cbc_encrypt")
@@ -92,7 +94,8 @@ static bool _mock_aes_256_xxx_decrypt(void *ctx,
     _append_bin("iv", iv);
     _append_bin("in", in);
     /* append it directly, don't decrypt. */
-    memcpy(out->data + *bytes_written, in->data, in->len);
+    uint8_t *out_u8 = out->data;
+    memcpy(out_u8 + *bytes_written, in->data, in->len);
     *bytes_written += in->len;
     bson_string_append_printf(call_history, "ret:%s\n", BSON_FUNC);
     if (0 == strcmp((char *)ctx, "error_on:aes_256_cbc_decrypt")
@@ -245,7 +248,7 @@ _create_mongocrypt_and_hooks(_mongocrypt_tester_t *tester, const char *error_on,
         ret = mongocrypt_setopt_aes_256_ecb(crypt, _mock_aes_256_xxx_encrypt, (void *)error_on);
         ASSERT_OK(ret, crypt);
     }
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     return crypt;
 }
 
@@ -550,7 +553,7 @@ static void _test_crypto_hooks_unset(_mongocrypt_tester_t *tester) {
 
     crypt = mongocrypt_new();
     mongocrypt_setopt_kms_provider_aws(crypt, "example", -1, "example", -1);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     mongocrypt_destroy(crypt);
 }
 
@@ -757,6 +760,130 @@ void _test_fle2_crypto_via_ecb_hook(_mongocrypt_tester_t *tester) {
 }
 #endif
 
+static void test_is_crypto_available_with_crypto_required(_mongocrypt_tester_t *tester) {
+    // libmongocrypt is built with native crypto.
+    ASSERT(mongocrypt_is_crypto_available());
+}
+
+static void test_is_crypto_available_with_crypto_prohibited(_mongocrypt_tester_t *tester) {
+    // libmongocrypt is not built with native crypto.
+    ASSERT(!mongocrypt_is_crypto_available());
+}
+
+static int ctr_encrypt_count;
+
+static bool _aes_256_ctr_encrypt_and_count(void *ctx,
+                                           mongocrypt_binary_t *key,
+                                           mongocrypt_binary_t *iv,
+                                           mongocrypt_binary_t *in,
+                                           mongocrypt_binary_t *out,
+                                           uint32_t *bytes_written,
+                                           mongocrypt_status_t *status) {
+    ctr_encrypt_count++;
+    return _std_hook_native_crypto_aes_256_ctr_encrypt(ctx, key, iv, in, out, bytes_written, status);
+}
+
+static int ctr_decrypt_count;
+
+static bool _aes_256_ctr_decrypt_and_count(void *ctx,
+                                           mongocrypt_binary_t *key,
+                                           mongocrypt_binary_t *iv,
+                                           mongocrypt_binary_t *in,
+                                           mongocrypt_binary_t *out,
+                                           uint32_t *bytes_written,
+                                           mongocrypt_status_t *status) {
+    ctr_decrypt_count++;
+    return _std_hook_native_crypto_aes_256_ctr_decrypt(ctx, key, iv, in, out, bytes_written, status);
+}
+
+static void test_setting_only_ctr_hook(_mongocrypt_tester_t *tester) {
+    // Test that the CTR hook can be set without setting other crypto hooks.
+    // This enables supporting macOS <= 10.14 in bindings using libmongocrypt with native crypto.
+    // macOS <= 10.14 does not support native CTR encryption.
+
+    if (!_aes_ctr_is_supported_by_os) {
+        printf("Common Crypto with no CTR support detected. Skipping.");
+        return;
+    }
+
+    // Configure KMS providers with local KEK used to encrypt key documents.
+    mongocrypt_binary_t *kms_providers =
+        TEST_BSON("{'local' : { 'key': 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+                  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}}");
+    _mongocrypt_buffer_t key_id1, key_id2;
+    _mongocrypt_buffer_copy_from_hex(&key_id1, "12345678123498761234123456789012");
+    _mongocrypt_buffer_copy_from_hex(&key_id2, "ABCDEFAB123498761234123456789012");
+
+    mongocrypt_t *crypt = mongocrypt_new();
+    ASSERT_OK(
+        mongocrypt_setopt_aes_256_ctr(crypt, _aes_256_ctr_encrypt_and_count, _aes_256_ctr_decrypt_and_count, NULL),
+        crypt);
+    ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, kms_providers), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
+
+    // Encrypt with an algorithm using the CTR hook.
+    ctr_encrypt_count = 0;
+    {
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(mongocrypt_ctx_setopt_key_id(ctx, _mongocrypt_buffer_as_binary(&key_id1)), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 1), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_INDEXED_STR, -1), ctx);
+        ASSERT_OK(mongocrypt_ctx_explicit_encrypt_init(ctx, TEST_BSON("{'v' : 123}")), ctx);
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789012-local-"
+                                                      "document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+        mongocrypt_binary_t *ciphertext = mongocrypt_binary_new();
+        ASSERT_OK(mongocrypt_ctx_finalize(ctx, ciphertext), ctx);
+        mongocrypt_binary_destroy(ciphertext);
+        mongocrypt_ctx_destroy(ctx);
+    }
+    // CTR encrypt hook is called.
+    ASSERT_CMPINT(ctr_encrypt_count, ==, 1);
+
+    // Decrypt with an algorithm using the CTR hook.
+    ctr_decrypt_count = 0;
+    {
+        // `ieev_payload_base64` is an IEEV payload, which uses the CTR hook to decrypt.
+        const char *ieev_payload_base64 = "BxI0VngSNJh2EjQSNFZ4kBICQ7uhTd9C2oI8M1afRon0ZaYG0s6oTmt0aBZ9kO4S4mm5vId01"
+                                          "BsW7tBHytA8pDJ2IiWBCmah3OGH2M4ET7PSqekQD4gkUCo4JeEttx4yj05Ou4D6yZUmYfVKmE"
+                                          "ljge16NCxKm7Ir9gvmQsp8x1wqGBzpndA6gkqFxsxfvQ/"
+                                          "cIqOwMW9dGTTWsfKge+jYkCUIFMfms+XyC/8evQhjjA+qR6eEmV+N/"
+                                          "kwpR7Q7TJe0lwU5kw2kSe3/KiPKRZZTbn8znadvycfJ0cCWGad9SQ==";
+
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(mongocrypt_ctx_explicit_decrypt_init(
+                      ctx,
+                      TEST_BSON("{'v':{'$binary':{'base64': '%s','subType':'6'}}}", ieev_payload_base64)),
+                  ctx);
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "ABCDEFAB123498761234123456789012-local-"
+                                                      "document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+        mongocrypt_binary_t *decrypted = mongocrypt_binary_new();
+        ASSERT_OK(mongocrypt_ctx_finalize(ctx, decrypted), ctx);
+        ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(decrypted, TEST_BSON("{'v': 'value123'}"));
+        mongocrypt_binary_destroy(decrypted);
+        mongocrypt_ctx_destroy(ctx);
+    }
+    // CTR decrypt hook is called repeatedly.
+    ASSERT_CMPINT(ctr_decrypt_count, ==, 4);
+
+    _mongocrypt_buffer_cleanup(&key_id2);
+    _mongocrypt_buffer_cleanup(&key_id1);
+    mongocrypt_destroy(crypt);
+}
+
 void _mongocrypt_tester_install_crypto_hooks(_mongocrypt_tester_t *tester) {
     INSTALL_TEST_CRYPTO(_test_crypto_hooks_encryption, CRYPTO_OPTIONAL);
     INSTALL_TEST_CRYPTO(_test_crypto_hooks_decryption, CRYPTO_OPTIONAL);
@@ -767,6 +894,9 @@ void _mongocrypt_tester_install_crypto_hooks(_mongocrypt_tester_t *tester) {
     INSTALL_TEST_CRYPTO(_test_crypto_hooks_explicit_err, CRYPTO_OPTIONAL);
     INSTALL_TEST_CRYPTO(_test_crypto_hooks_explicit_sha256_err, CRYPTO_OPTIONAL);
     INSTALL_TEST_CRYPTO(_test_crypto_hook_sign_rsaes_pkcs1_v1_5, CRYPTO_OPTIONAL);
+    INSTALL_TEST_CRYPTO(test_is_crypto_available_with_crypto_required, CRYPTO_REQUIRED);
+    INSTALL_TEST_CRYPTO(test_is_crypto_available_with_crypto_prohibited, CRYPTO_PROHIBITED);
+    INSTALL_TEST_CRYPTO(test_setting_only_ctr_hook, CRYPTO_REQUIRED);
 #ifdef MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO
     INSTALL_TEST(_test_fle2_crypto_via_ecb_hook);
 #endif

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-crypto-std-hooks.c

@@ -54,6 +54,46 @@ bool _std_hook_native_crypto_aes_256_cbc_decrypt(void *ctx,
     return _native_crypto_aes_256_cbc_decrypt(args);
 }
 
+bool _std_hook_native_crypto_aes_256_ctr_encrypt(void *ctx,
+                                                 mongocrypt_binary_t *key,
+                                                 mongocrypt_binary_t *iv,
+                                                 mongocrypt_binary_t *in,
+                                                 mongocrypt_binary_t *out,
+                                                 uint32_t *bytes_written,
+                                                 mongocrypt_status_t *status) {
+    _mongocrypt_buffer_t key_buf;
+    _mongocrypt_buffer_from_binary(&key_buf, key);
+    _mongocrypt_buffer_t iv_buf;
+    _mongocrypt_buffer_from_binary(&iv_buf, iv);
+    _mongocrypt_buffer_t in_buf;
+    _mongocrypt_buffer_from_binary(&in_buf, in);
+    _mongocrypt_buffer_t out_buf;
+    _mongocrypt_buffer_from_binary(&out_buf, out);
+
+    aes_256_args_t args = {&key_buf, &iv_buf, &in_buf, &out_buf, bytes_written, status};
+    return _native_crypto_aes_256_ctr_encrypt(args);
+}
+
+bool _std_hook_native_crypto_aes_256_ctr_decrypt(void *ctx,
+                                                 mongocrypt_binary_t *key,
+                                                 mongocrypt_binary_t *iv,
+                                                 mongocrypt_binary_t *in,
+                                                 mongocrypt_binary_t *out,
+                                                 uint32_t *bytes_written,
+                                                 mongocrypt_status_t *status) {
+    _mongocrypt_buffer_t key_buf;
+    _mongocrypt_buffer_from_binary(&key_buf, key);
+    _mongocrypt_buffer_t iv_buf;
+    _mongocrypt_buffer_from_binary(&iv_buf, iv);
+    _mongocrypt_buffer_t in_buf;
+    _mongocrypt_buffer_from_binary(&in_buf, in);
+    _mongocrypt_buffer_t out_buf;
+    _mongocrypt_buffer_from_binary(&out_buf, out);
+
+    aes_256_args_t args = {&key_buf, &iv_buf, &in_buf, &out_buf, bytes_written, status};
+    return _native_crypto_aes_256_ctr_decrypt(args);
+}
+
 bool _std_hook_native_crypto_random(void *ctx, mongocrypt_binary_t *out, uint32_t count, mongocrypt_status_t *status) {
     _mongocrypt_buffer_t outbuf;
     _mongocrypt_buffer_from_binary(&outbuf, out);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-crypto-std-hooks.h

@@ -40,6 +40,22 @@ bool _std_hook_native_crypto_aes_256_cbc_decrypt(void *ctx,
                                                  uint32_t *bytes_written,
                                                  mongocrypt_status_t *status);
 
+bool _std_hook_native_crypto_aes_256_ctr_encrypt(void *ctx,
+                                                 mongocrypt_binary_t *key,
+                                                 mongocrypt_binary_t *iv,
+                                                 mongocrypt_binary_t *in,
+                                                 mongocrypt_binary_t *out,
+                                                 uint32_t *bytes_written,
+                                                 mongocrypt_status_t *status);
+
+bool _std_hook_native_crypto_aes_256_ctr_decrypt(void *ctx,
+                                                 mongocrypt_binary_t *key,
+                                                 mongocrypt_binary_t *iv,
+                                                 mongocrypt_binary_t *in,
+                                                 mongocrypt_binary_t *out,
+                                                 uint32_t *bytes_written,
+                                                 mongocrypt_status_t *status);
+
 bool _std_hook_native_crypto_random(void *ctx, mongocrypt_binary_t *out, uint32_t count, mongocrypt_status_t *status);
 
 bool _std_hook_native_hmac_sha512(void *ctx,

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-csfle-lib.c

@@ -15,7 +15,7 @@ static mongocrypt_t *get_test_mongocrypt(_mongocrypt_tester_t *tester) {
 static void _test_csfle_no_paths(_mongocrypt_tester_t *tester) {
     /// Test that mongocrypt_init succeeds if we have no search path
     mongocrypt_t *const crypt = get_test_mongocrypt(tester);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     // No csfle was loaded:
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) == NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) == 0);
@@ -27,7 +27,7 @@ static void _test_csfle_not_found(_mongocrypt_tester_t *tester) {
     /// found but a search path was specified
     mongocrypt_t *const crypt = get_test_mongocrypt(tester);
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt, "/no-such-directory");
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     // No csfle was loaded:
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) == NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) == 0);
@@ -39,7 +39,7 @@ static void _test_csfle_load(_mongocrypt_tester_t *tester) {
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt, "no-such-directory");
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt, "$ORIGIN");
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt, "another-no-such-dir");
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     // csfle WAS loaded:
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) != NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) != 0);
@@ -55,14 +55,14 @@ static void _test_csfle_load(_mongocrypt_tester_t *tester) {
 static void _test_csfle_load_twice(_mongocrypt_tester_t *tester) {
     mongocrypt_t *const crypt1 = get_test_mongocrypt(tester);
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt1, "$ORIGIN");
-    ASSERT_OK(mongocrypt_init(crypt1), crypt1);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt1), crypt1);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt1, NULL) != NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt1) != 0);
 
     // Make another one:
     mongocrypt_t *const crypt2 = get_test_mongocrypt(tester);
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt2, "$ORIGIN");
-    ASSERT_OK(mongocrypt_init(crypt2), crypt2);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt2), crypt2);
     // csfle was loaded again:
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt2, NULL) != NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt2) != 0);
@@ -88,7 +88,7 @@ static void _test_csfle_load_twice(_mongocrypt_tester_t *tester) {
 static void _test_csfle_load_twice_fail(_mongocrypt_tester_t *tester) {
     mongocrypt_t *const crypt1 = get_test_mongocrypt(tester);
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt1, "$ORIGIN");
-    ASSERT_OK(mongocrypt_init(crypt1), crypt1);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt1), crypt1);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt1, NULL) != NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt1) != 0);
 
@@ -96,7 +96,7 @@ static void _test_csfle_load_twice_fail(_mongocrypt_tester_t *tester) {
     mongocrypt_t *const crypt2 = get_test_mongocrypt(tester);
     mongocrypt_setopt_set_crypt_shared_lib_path_override(crypt2, "$ORIGIN/stubbed-crypt_shared-2.dll");
     // Loading a second different library is an error:
-    ASSERT_FAILS(mongocrypt_init(crypt2), crypt2, "attempted to load a second CSFLE library");
+    ASSERT_FAILS(_mongocrypt_init_for_test(crypt2), crypt2, "attempted to load a second CSFLE library");
 
     mstr_view version = mstrv_view_cstr(mongocrypt_crypt_shared_lib_version_string(crypt1, NULL));
     if (TEST_MONGOCRYPT_HAVE_REAL_CRYPT_SHARED_LIB) {
@@ -113,7 +113,7 @@ static void _test_csfle_path_override_okay(_mongocrypt_tester_t *tester) {
     mongocrypt_t *const crypt = get_test_mongocrypt(tester);
     // Set to the absolute path to the DLL we use for testing:
     mongocrypt_setopt_set_crypt_shared_lib_path_override(crypt, "$ORIGIN/mongo_crypt_v1" MCR_DLL_SUFFIX);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     // csfle WAS loaded:
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) != NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) != 0);
@@ -134,7 +134,7 @@ static void _test_csfle_path_override_fail(_mongocrypt_tester_t *tester) {
     // This *would* succeed, but we don't use the search paths if an absolute
     // override was specified:
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt, "$ORIGIN");
-    ASSERT_FAILS(mongocrypt_init(crypt), crypt, "but we failed to open a dynamic library at that location");
+    ASSERT_FAILS(_mongocrypt_init_for_test(crypt), crypt, "but we failed to open a dynamic library at that location");
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) == NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) == 0);
     mongocrypt_destroy(crypt);
@@ -151,7 +151,7 @@ static void _test_csfle_not_loaded_with_bypassqueryanalysis(_mongocrypt_tester_t
     mongocrypt_t *const crypt = get_test_mongocrypt(tester);
     mongocrypt_setopt_append_crypt_shared_lib_search_path(crypt, "$ORIGIN");
     mongocrypt_setopt_bypass_query_analysis(crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) == NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) == 0);
 
@@ -164,7 +164,7 @@ static void _test_override_error_includes_reason(_mongocrypt_tester_t *tester) {
     mongocrypt_t *crypt = get_test_mongocrypt(tester);
     // Set an incorrect override path.
     mongocrypt_setopt_set_crypt_shared_lib_path_override(crypt, "invalid_path_to_crypt_shared.so");
-    ASSERT_FAILS(mongocrypt_init(crypt), crypt, "Error while opening candidate");
+    ASSERT_FAILS(_mongocrypt_init_for_test(crypt), crypt, "Error while opening candidate");
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version_string(crypt, NULL) == NULL);
     BSON_ASSERT(mongocrypt_crypt_shared_lib_version(crypt) == 0);
     mongocrypt_destroy(crypt);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-decrypt.c

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include "kms_message/kms_b64.h" // kms_message_raw_to_b64
 #include "mongocrypt-ctx-private.h"
 #include "mongocrypt.h"
 #include "test-mongocrypt-assert-match-bson.h"
@@ -128,7 +129,7 @@ void _test_decrypt_empty_aws(_mongocrypt_tester_t *tester) {
 
     crypt = mongocrypt_new();
     ASSERT_OK(mongocrypt_setopt_kms_provider_aws(crypt, "", -1, "", -1), crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
 
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(mongocrypt_ctx_decrypt_init(ctx, TEST_FILE("./test/data/encrypted-cmd.json")), ctx);
@@ -183,7 +184,7 @@ static void _test_decrypt_per_ctx_credentials(_mongocrypt_tester_t *tester) {
     crypt = mongocrypt_new();
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
     mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'aws': {}}"));
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
 
     /* Encrypt an empty binary value. */
@@ -220,8 +221,9 @@ static void _test_decrypt_per_ctx_credentials_local(_mongocrypt_tester_t *tester
     _mongocrypt_buffer_t encrypted;
     /* local_kek is the KEK used to encrypt the keyMaterial in
      * ./test/data/key-document-local.json */
-    const char *local_kek = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-                            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    uint8_t local_kek_raw[MONGOCRYPT_KEY_LEN] = {0};
+    char *local_kek = kms_message_raw_to_b64(local_kek_raw, sizeof(local_kek_raw));
+
     /* local_uuid is the hex of the UUID of the key in
      * ./test/data/key-document-local.json */
     const char *local_uuid = "61616161616161616161616161616161";
@@ -231,7 +233,7 @@ static void _test_decrypt_per_ctx_credentials_local(_mongocrypt_tester_t *tester
     crypt = mongocrypt_new();
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
     mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'local': {}}"));
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
 
     /* Encrypt an empty binary value. */
@@ -265,6 +267,7 @@ static void _test_decrypt_per_ctx_credentials_local(_mongocrypt_tester_t *tester
     mongocrypt_ctx_destroy(ctx);
     _mongocrypt_buffer_cleanup(&encrypted);
     mongocrypt_destroy(crypt);
+    bson_free(local_kek);
 }
 
 static void _test_decrypt_fle2(_mongocrypt_tester_t *tester) {