libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-rewrap-many-datakey.c

@@ -753,7 +753,7 @@ static void _test_rewrap_many_datakey_kms_credentials(_mongocrypt_tester_t *test
         crypt = mongocrypt_new();
         mongocrypt_setopt_use_need_kms_credentials_state(crypt);
         ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'aws': {}}")), crypt);
-        ASSERT_OK(mongocrypt_init(crypt), crypt);
+        ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
         ctx = mongocrypt_ctx_new(crypt);
 
         ASSERT_OK(ctx, crypt);
@@ -828,7 +828,7 @@ static void _test_rewrap_many_datakey_kms_credentials(_mongocrypt_tester_t *test
                                                         "   'accessKeyId': 'example',"
                                                         "   'secretAccessKey': 'example'}}")),
               crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(ctx, crypt);
     ASSERT_OK(mongocrypt_ctx_rewrap_many_datakey_init(ctx, TEST_BSON("{}")), ctx);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-setopt.c

@@ -18,7 +18,9 @@
 
 #include <stdarg.h>
 
+#include "mc-range-encoding-private.h"
 #include "mongocrypt-binary-private.h"
+#include "mongocrypt.h"
 #include "test-mongocrypt.h"
 
 /* An orphaned UTF-8 continuation byte (10xxxxxx) is malformed UTF-8. */
@@ -83,6 +85,13 @@ static char invalid_utf8[] = {(char)0x80, (char)0x00};
 #define ASSERT_EX_DECRYPT_INIT_FAILS(bin, msg) ASSERT_FAILS(mongocrypt_ctx_explicit_decrypt_init(ctx, bin), ctx, msg);
 
 #define REFRESH                                                                                                        \
+    do {                                                                                                               \
+        mongocrypt_destroy(crypt);                                                                                     \
+        crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);                                              \
+        REFRESH_CTX;                                                                                                   \
+    } while (0)
+
+#define REFRESH_CTX                                                                                                    \
     do {                                                                                                               \
         mongocrypt_ctx_destroy(ctx);                                                                                   \
         ctx = mongocrypt_ctx_new(crypt);                                                                               \
@@ -808,28 +817,45 @@ static void _test_setopt_for_explicit_encrypt(_mongocrypt_tester_t *tester) {
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "contention factor is required");
     }
 
-    /* Contention factor is required for "rangePreview" algorithm. */
+    /* Contention factor is required for "range" algorithm. */
     {
         REFRESH;
         /* Set key ID to get past the 'either key id or key alt name required'
          * error */
         ASSERT_KEY_ID_OK(uuid);
         ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, rangeopts), ctx);
-        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGEPREVIEW_STR, -1), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGE_STR, -1), ctx);
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "contention factor is required");
     }
 
-    /* Range opts is required for "rangePreview" algorithm. */
+    /* Range opts is required for "range" algorithm. */
     {
         REFRESH;
         /* Set key ID to get past the 'either key id or key alt name required'
          * error */
         ASSERT_KEY_ID_OK(uuid);
         ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
-        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGEPREVIEW_STR, -1), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGE_STR, -1), ctx);
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "range opts are required");
     }
 
+    /* Sparsity is optional for rangeV2. */
+    {
+        // Create a crypt with rangeV2 enabled.
+        mongocrypt_destroy(crypt);
+        crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT | TESTER_MONGOCRYPT_WITH_RANGE_V2);
+        REFRESH_CTX;
+        /* Set key ID to get past the 'either key id or key alt name required'
+         * error */
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, TEST_BSON("{'min': 0, 'max': 1}")), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGE_STR, -1), ctx);
+        ASSERT(ctx->opts.rangeopts.set);
+        ASSERT_CMPINT64(ctx->opts.rangeopts.value.sparsity, ==, mc_FLERangeSparsityDefault);
+        ASSERT_EX_ENCRYPT_INIT_OK(bson);
+    }
+
     /* Negative sparsity is prohibited. */
     {
         REFRESH;
@@ -841,27 +867,27 @@ static void _test_setopt_for_explicit_encrypt(_mongocrypt_tester_t *tester) {
                       TEST_BSON("{'min': 0, 'max': 1, 'sparsity': { '$numberLong': '-1'}}")),
                   ctx);
         ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
-        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGEPREVIEW_STR, -1), ctx);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGE_STR, -1), ctx);
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "sparsity must be non-negative");
     }
 
-    /* Error if query_type == "rangePreview" and algorithm != "rangePreview". */
+    /* Error if query_type == "range" and algorithm != "range". */
     {
         REFRESH;
         ASSERT_KEY_ID_OK(uuid);
         ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_INDEXED_STR, -1);
-        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGE_STR, -1);
         ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "must match index_type");
     }
 
-    /* Error if query_type == "rangePreview" for
+    /* Error if query_type == "range" for
      * mongocrypt_ctx_explicit_encrypt_init. */
     {
         REFRESH;
         ASSERT_KEY_ID_OK(uuid);
-        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_STR, -1);
-        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_STR, -1);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGE_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGE_STR, -1);
         ASSERT_OK(
             mongocrypt_ctx_setopt_algorithm_range(ctx,
                                                   TEST_BSON("{'min': 0, 'max': 1, 'sparsity': {'$numberLong': '1'}}")),
@@ -870,12 +896,88 @@ static void _test_setopt_for_explicit_encrypt(_mongocrypt_tester_t *tester) {
         ASSERT_EX_ENCRYPT_INIT_FAILS(bson, "Encrypt may not be used for range queries. Use EncryptExpression.");
     }
 
+    // Can't use "rangePreview" algorithm or query type with range V2.
+    {
+        mongocrypt_destroy(crypt);
+        crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_WITH_RANGE_V2);
+        REFRESH_CTX;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_FAILS(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_RANGEPREVIEW_DEPRECATED_STR, -1),
+                     ctx,
+                     "'rangePreview' is deprecated");
+
+        mongocrypt_destroy(crypt);
+        crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_WITH_RANGE_V2);
+        REFRESH_CTX;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_FAILS(mongocrypt_ctx_setopt_query_type(ctx, MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR, -1),
+                     ctx,
+                     "'rangePreview' is deprecated");
+    }
+
+    /* Error if query type == "rangePreview" and algorithm == "range" for range V1. */
+    // Explanation: Algorithm "rangePreview" accepts both query type "rangePreview" (for compatibility) and "range" (new
+    // behavior), but algorithm "range" only accepts query type "range". This is because if we are using the new
+    // algorithm type, we don't need to support the deprecated name for compatibility.
+    {
+        REFRESH;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, rangeopts), ctx);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGE_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR, -1);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
+        ASSERT_EX_ENCRYPT_EXPRESSION_INIT_FAILS(bson, "must match index_type");
+    }
+
+    /* If query type == "range" and algorithm == "rangePreview", succeeds for range V1 */
+    {
+        REFRESH;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, rangeopts), ctx);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_DEPRECATED_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGE_STR, -1);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
+        ASSERT_EX_ENCRYPT_EXPRESSION_INIT_OK(bson);
+    }
+
+    /* If query type == algorithm == "rangePreview", succeeds for range V1. */
+    {
+        REFRESH;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, rangeopts), ctx);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_DEPRECATED_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR, -1);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
+        ASSERT_EX_ENCRYPT_EXPRESSION_INIT_OK(bson);
+    }
+
+    /* If query type == algorithm == "range", succeeds for both V2 and V1. */
+    {
+        REFRESH;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, rangeopts), ctx);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGE_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGE_STR, -1);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
+        ASSERT_EX_ENCRYPT_EXPRESSION_INIT_OK(bson);
+
+        mongocrypt_destroy(crypt);
+        crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_WITH_RANGE_V2);
+        REFRESH_CTX;
+        ASSERT_KEY_ID_OK(uuid);
+        ASSERT_OK(mongocrypt_ctx_setopt_algorithm_range(ctx, rangeopts), ctx);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGE_STR, -1);
+        ASSERT_QUERY_TYPE_OK(MONGOCRYPT_QUERY_TYPE_RANGE_STR, -1);
+        ASSERT_OK(mongocrypt_ctx_setopt_contention_factor(ctx, 0), ctx);
+        ASSERT_EX_ENCRYPT_EXPRESSION_INIT_OK(bson);
+    }
+
     /* Error if query_type is unset for
      * mongocrypt_ctx_explicit_encrypt_expression_init. */
     {
         REFRESH;
         ASSERT_KEY_ID_OK(uuid);
-        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGEPREVIEW_STR, -1);
+        ASSERT_ALGORITHM_OK(MONGOCRYPT_ALGORITHM_RANGE_STR, -1);
         ASSERT_OK(
             mongocrypt_ctx_setopt_algorithm_range(ctx,
                                                   TEST_BSON("{'min': 0, 'max': 1, 'sparsity': {'$numberLong': '1'}}")),
@@ -1065,7 +1167,7 @@ static void _test_createdatakey_with_wrong_kms_provider_helper(_mongocrypt_teste
     crypt = mongocrypt_new();
     ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, kms_provider), crypt);
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(mongocrypt_ctx_setopt_key_encryption_key(ctx, TEST_BSON(kek)), ctx);
     ASSERT_FAILS(mongocrypt_ctx_datakey_init(ctx), ctx, "kms provider required by datakey is not configured");

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-datakey.c

@@ -16,6 +16,7 @@
 
 #include <mongocrypt.h>
 
+#include "kms_message/kms_b64.h"
 #include "mongocrypt-crypto-private.h"
 #include "mongocrypt-private.h"
 #include "test-mongocrypt.h"
@@ -94,7 +95,7 @@ static void _test_create_data_key_with_provider(_mongocrypt_tester_t *tester,
         BSON_ASSERT(mongocrypt_ctx_state(ctx) == MONGOCRYPT_CTX_NEED_KMS);
         kms = mongocrypt_ctx_next_kms_ctx(ctx);
         BSON_ASSERT(kms);
-        ASSERT_OK(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/kms-encrypt-reply.txt")), kms);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms, TEST_FILE("./test/data/kms-aws/encrypt-response.txt")), kms);
         BSON_ASSERT(0 == mongocrypt_kms_ctx_bytes_needed(kms));
         ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
     }
@@ -180,7 +181,7 @@ static void _test_datakey_custom_endpoint(_mongocrypt_tester_t *tester) {
     bin = mongocrypt_binary_new();
     ASSERT_OK(mongocrypt_kms_ctx_message(kms_ctx, bin), ctx);
     BSON_ASSERT(NULL != strstr((char *)bin->data, "Host:example.com"));
-    ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-encrypt-reply.txt")), kms_ctx);
+    ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-aws/encrypt-response.txt")), kms_ctx);
     BSON_ASSERT(0 == mongocrypt_kms_ctx_bytes_needed(kms_ctx));
     ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
 
@@ -210,7 +211,7 @@ static void _test_datakey_kms_per_ctx_credentials(_mongocrypt_tester_t *tester)
     crypt = mongocrypt_new();
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
     ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'aws': {}}")), crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(mongocrypt_ctx_setopt_masterkey_aws(ctx, "region", -1, "cmk", -1), ctx);
     ASSERT_OK(mongocrypt_ctx_setopt_masterkey_aws_endpoint(ctx, "example.com", -1), ctx);
@@ -228,7 +229,7 @@ static void _test_datakey_kms_per_ctx_credentials(_mongocrypt_tester_t *tester)
     bin = mongocrypt_binary_new();
     ASSERT_OK(mongocrypt_kms_ctx_message(kms_ctx, bin), ctx);
     BSON_ASSERT(NULL != strstr((char *)bin->data, "Host:example.com"));
-    ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-encrypt-reply.txt")), kms_ctx);
+    ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx, TEST_FILE("./test/data/kms-aws/encrypt-response.txt")), kms_ctx);
     BSON_ASSERT(0 == mongocrypt_kms_ctx_bytes_needed(kms_ctx));
     ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
 
@@ -258,7 +259,7 @@ static void _test_datakey_kms_per_ctx_credentials_not_requested(_mongocrypt_test
                                               TEST_BSON("{'aws': {}, 'azure': {'tenantId': '', 'clientId': "
                                                         "'', 'clientSecret': '' }}")),
               crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(mongocrypt_ctx_setopt_key_encryption_key(ctx,
                                                        TEST_BSON("{'provider': 'azure', 'keyVaultEndpoint': "
@@ -280,13 +281,13 @@ static void _test_datakey_kms_per_ctx_credentials_local(_mongocrypt_tester_t *te
     mongocrypt_binary_t *bin;
     bson_t key_bson;
     bson_iter_t iter;
-    const char *local_kek = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-                            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    uint8_t local_kek_raw[MONGOCRYPT_KEY_LEN] = {0};
+    char *local_kek = kms_message_raw_to_b64(local_kek_raw, sizeof(local_kek_raw));
 
     crypt = mongocrypt_new();
     mongocrypt_setopt_use_need_kms_credentials_state(crypt);
     ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'local': {}}")), crypt);
-    ASSERT_OK(mongocrypt_init(crypt), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
     ctx = mongocrypt_ctx_new(crypt);
     ASSERT_OK(mongocrypt_ctx_setopt_key_encryption_key(ctx, TEST_BSON("{'provider': 'local' }")), ctx);
     ASSERT_OK(mongocrypt_ctx_datakey_init(ctx), ctx);
@@ -310,6 +311,7 @@ static void _test_datakey_kms_per_ctx_credentials_local(_mongocrypt_tester_t *te
     mongocrypt_binary_destroy(bin);
     mongocrypt_ctx_destroy(ctx);
     mongocrypt_destroy(crypt);
+    bson_free(local_kek);
 }
 
 static void _test_datakey_custom_key_material(_mongocrypt_tester_t *tester) {
@@ -377,8 +379,11 @@ static void _test_datakey_custom_key_material(_mongocrypt_tester_t *tester) {
         _mongocrypt_buffer_t decrypted_dek_buf;
         mongocrypt_binary_t decrypted_dek;
 
+        mc_kms_creds_t kc;
+        ASSERT(_mongocrypt_opts_kms_providers_lookup(&crypt->opts.kms_providers, "local", &kc));
+
         ASSERT(_mongocrypt_unwrap_key(crypt->crypto,
-                                      &crypt->opts.kms_providers.local.key,
+                                      &kc.value.local.key,
                                       &encrypted_dek_buf,
                                       &decrypted_dek_buf,
                                       crypt->status));