libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-marking.c

@@ -17,8 +17,15 @@
 /* For each field, check a valid value, invalid value, missing value */
 
 #include "bson/bson.h"
+#include "mc-fle-blob-subtype-private.h"
+#include "mc-tokens-private.h"
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt-ciphertext-private.h"
 #include "mongocrypt-marking-private.h"
+#include "mongocrypt.h"
+#include "test-mongocrypt-assert.h"
 #include "test-mongocrypt.h"
+#include <stdbool.h>
 
 /* Create a basis marking buffer with valid values for the given fields. */
 static void _make_marking(bson_t *bson, _mongocrypt_buffer_t *buf) {
@@ -187,10 +194,24 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
         const char *expectedMinCover;
         mc_optional_int64_t sparsity;
         const char *expectedError;
+        const char *expectedErrorAtParseTime;
+        bool disableRangeV2;
     } testcase_t;
 
     testcase_t tests[] = {
-        {.description = "Int32 Bounds included",
+        {.description = "Range V2 disabled w/ trim factor fails",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberInt" : "7"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberInt" : "32"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
+         }),
+         .disableRangeV2 = true,
+         .expectedErrorAtParseTime = "'trimFactor' is not supported for QE range v1"},
+        {.description = "Range V2 disabled w/ no trim factor succeeds",
          .findSpecJSON = RAW_STRING({
              "lowerBound" : {"$numberInt" : "7"},
              "lbIncluded" : true,
@@ -199,6 +220,21 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "indexMin" : {"$numberInt" : "0"},
              "indexMax" : {"$numberInt" : "32"}
          }),
+         .disableRangeV2 = true,
+         .expectedMinCover = "000111\n"
+                             "001\n"
+                             "01\n"
+                             "100000\n"},
+        {.description = "Int32 Bounds included",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberInt" : "7"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberInt" : "32"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
+         }),
          .expectedMinCover = "000111\n"
                              "001\n"
                              "01\n"
@@ -211,7 +247,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "32"},
              "ubIncluded" : false,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "001\n"
                              "01\n"},
@@ -222,7 +259,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "32"},
              "ubIncluded" : false,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000111\n"
                              "001\n"
@@ -234,7 +272,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "32"},
              "ubIncluded" : true,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "001\n"
                              "01\n"
@@ -246,7 +285,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "Infinity"},
              "ubIncluded" : true,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000111\n"
                              "001\n"
@@ -259,7 +299,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "8"},
              "ubIncluded" : true,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000\n"
                              "001000\n"},
@@ -270,10 +311,150 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "Infinity"},
              "ubIncluded" : true,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
+         }),
+         .expectedMinCover = "0\n"
+                             "100000\n"},
+        {.description = "Int32 mincover=root no trimming",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "31"},
+             "trimFactor" : 0
+         }),
+         .expectedMinCover = "root\n"},
+        {.description = "Int32 mincover=root TF=1",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "31"},
+             "trimFactor" : 1
          }),
          .expectedMinCover = "0\n"
+                             "1\n"},
+        {.description = "Int32 mincover=root TF=3",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "31"},
+             "trimFactor" : 3
+         }),
+         .expectedMinCover = "000\n"
+                             "001\n"
+                             "010\n"
+                             "011\n"
+                             "100\n"
+                             "101\n"
+                             "110\n"
+                             "111\n"},
+        {.description = "Int32 infinite both bounds SP=2",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
+         }),
+         .sparsity = OPT_I64(2),
+         .expectedMinCover = "00\n"
+                             "01\n"
                              "100000\n"},
+        {.description = "Int32 infinite both bounds TF=1",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 1
+         }),
+         .expectedMinCover = "0\n"
+                             "100000\n"},
+        {.description = "Int32 infinite both bounds TF=2",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 2
+         }),
+         .expectedMinCover = "00\n"
+                             "01\n"
+                             "100000\n"},
+
+        {.description = "Int32 infinite both bounds TF=3",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 3
+         }),
+         .expectedMinCover = "000\n"
+                             "001\n"
+                             "010\n"
+                             "011\n"
+                             "100000\n"},
+        {.description = "Int32 infinite both bounds SP=2 TF=3",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 3
+         }),
+         .sparsity = OPT_I64(2),
+         .expectedMinCover = "0000\n"
+                             "0001\n"
+                             "0010\n"
+                             "0011\n"
+                             "0100\n"
+                             "0101\n"
+                             "0110\n"
+                             "0111\n"
+                             "100000\n"},
+        {.description = "Too large trim factor fails",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 6
+         }),
+         .expectedError =
+             "Trim factor must be less than the number of bits (6) used to represent an element of the domain"},
+        {.description = "Negative trim factor fails",
+         .findSpecJSON = RAW_STRING({
+             "lowerBound" : {"$numberDouble" : "-Infinity"},
+             "lbIncluded" : true,
+             "upperBound" : {"$numberDouble" : "Infinity"},
+             "ubIncluded" : true,
+             "indexMin" : {"$numberInt" : "0"},
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : -1
+         }),
+         .expectedErrorAtParseTime = "'trimFactor' must be non-negative"},
         {.description = "Int64 Bounds included",
          .findSpecJSON = RAW_STRING({
              "lowerBound" : {"$numberLong" : "0"},
@@ -281,7 +462,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "823"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "-1000000000000000"},
-             "indexMax" : {"$numberLong" : "8070450532247928832"}
+             "indexMax" : {"$numberLong" : "8070450532247928832"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000000000000011100011010111111010100100110001101000000\n"
                              "00000000000001110001101011111101010010011000110100000100\n"
@@ -299,7 +481,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "823"},
              "ubIncluded" : false,
              "indexMin" : {"$numberLong" : "-1000000000000000"},
-             "indexMax" : {"$numberLong" : "8070450532247928832"}
+             "indexMax" : {"$numberLong" : "8070450532247928832"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000000000000011100011010111111010100100110001101000000000000001\n"
                              "00000000000001110001101011111101010010011000110100000000000001\n"
@@ -332,7 +515,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "823"},
              "ubIncluded" : false,
              "indexMin" : {"$numberLong" : "-1000000000000000"},
-             "indexMax" : {"$numberLong" : "8070450532247928832"}
+             "indexMax" : {"$numberLong" : "8070450532247928832"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000000000000011100011010111111010100100110001101000000\n"
                              "00000000000001110001101011111101010010011000110100000100\n"
@@ -353,7 +537,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "823"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "-1000000000000000"},
-             "indexMax" : {"$numberLong" : "8070450532247928832"}
+             "indexMax" : {"$numberLong" : "8070450532247928832"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "000000000000011100011010111111010100100110001101000000000000001\n"
                              "00000000000001110001101011111101010010011000110100000000000001\n"
@@ -382,7 +567,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "Infinity"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "7"}
+             "indexMax" : {"$numberLong" : "7"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "001\n"
                              "01\n"
@@ -394,7 +580,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "5"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "7"}
+             "indexMax" : {"$numberLong" : "7"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "0\n"
                              "10\n"},
@@ -405,7 +592,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "Infinity"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "7"}
+             "indexMax" : {"$numberLong" : "7"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "root\n"},
         {.description = "Mismatched types",
@@ -415,7 +603,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "2"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "7"}
+             "indexMax" : {"$numberLong" : "7"},
+             "trimFactor" : 0
          }),
          .expectedError = "expected lowerBound to match index type"},
         {.description = "Int32 exclusive lower bound > upper bound",
@@ -425,7 +614,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "7"},
              "ubIncluded" : true,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be less than or equal to range max"},
         {.description = "Int64 exclusive lower bound > upper bound",
@@ -435,7 +625,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "7"},
              "ubIncluded" : true,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "32"}
+             "indexMax" : {"$numberLong" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be less than or equal to range max"},
         {.description = "Int32 exclusive upper bound < lower bound",
@@ -445,7 +636,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "7"},
              "ubIncluded" : false,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be less than or equal to range max"},
         {.description = "Int64 exclusive upper bound < lower bound",
@@ -455,7 +647,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "7"},
              "ubIncluded" : false,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "32"}
+             "indexMax" : {"$numberLong" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be less than or equal to range max"},
         {.description = "Int32 exclusive bounds cross",
@@ -465,7 +658,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "7"},
              "ubIncluded" : false,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be less than or equal to range max"},
         {.description = "Int64 exclusive bounds cross",
@@ -475,7 +669,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberLong" : "7"},
              "ubIncluded" : false,
              "indexMin" : {"$numberLong" : "0"},
-             "indexMax" : {"$numberLong" : "32"}
+             "indexMax" : {"$numberLong" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be less than or equal to range max"},
         {.description = "Int32 exclusive upper bound is 0",
@@ -485,7 +680,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberInt" : "0"},
              "ubIncluded" : false,
              "indexMin" : {"$numberInt" : "0"},
-             "indexMax" : {"$numberInt" : "32"}
+             "indexMax" : {"$numberInt" : "32"},
+             "trimFactor" : 0
          }),
          .expectedError = "must be greater than the range minimum"},
         {.description = "Double inclusive bounds",
@@ -495,7 +691,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "35.25"},
              "ubIncluded" : true,
              "indexMin" : {"$numberDouble" : "0"},
-             "indexMax" : {"$numberDouble" : "1000"}
+             "indexMax" : {"$numberDouble" : "1000"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "11000000001101111\n"
                              "1100000000111\n"
@@ -511,7 +708,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "35.25"},
              "ubIncluded" : false,
              "indexMin" : {"$numberDouble" : "0"},
-             "indexMax" : {"$numberDouble" : "1000"}
+             "indexMax" : {"$numberDouble" : "1000"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "1100000000110111100000000000000000000000000000000000000000000001\n"
                              "110000000011011110000000000000000000000000000000000000000000001\n"
@@ -571,7 +769,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "35.25"},
              "ubIncluded" : false,
              "indexMin" : {"$numberDouble" : "0"},
-             "indexMax" : {"$numberDouble" : "1000"}
+             "indexMax" : {"$numberDouble" : "1000"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "11000000001101111\n"
                              "1100000000111\n"
@@ -585,7 +784,8 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
              "upperBound" : {"$numberDouble" : "35.25"},
              "ubIncluded" : true,
              "indexMin" : {"$numberDouble" : "0"},
-             "indexMax" : {"$numberDouble" : "1000"}
+             "indexMax" : {"$numberDouble" : "1000"},
+             "trimFactor" : 0
          }),
          .expectedMinCover = "1100000000110111100000000000000000000000000000000000000000000001\n"
                              "110000000011011110000000000000000000000000000000000000000000001\n"
@@ -672,14 +872,22 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
         ASSERT(bson_iter_init_find(&findSpecIter, findSpecDoc, "findSpec"));
 
         mc_FLE2RangeFindSpec_t findSpec;
-        ASSERT_OK_STATUS(mc_FLE2RangeFindSpec_parse(&findSpec, &findSpecIter, status), status);
+        bool res = mc_FLE2RangeFindSpec_parse(&findSpec, &findSpecIter, !test->disableRangeV2, status);
+        if (test->expectedErrorAtParseTime) {
+            ASSERT(!res);
+            ASSERT_STATUS_CONTAINS(status, test->expectedErrorAtParseTime);
+            goto cleanup;
+        } else {
+            ASSERT_OK_STATUS(res, status);
+        }
 
         size_t sparsity = 1;
         if (test->sparsity.set) {
             sparsity = (size_t)test->sparsity.value;
         }
 
-        mc_mincover_t *mc = mc_get_mincover_from_FLE2RangeFindSpec(&findSpec, sparsity, status);
+        const bool use_range_v2 = !test->disableRangeV2;
+        mc_mincover_t *mc = mc_get_mincover_from_FLE2RangeFindSpec(&findSpec, sparsity, status, use_range_v2);
 
         if (test->expectedError) {
             ASSERT(NULL == mc);
@@ -690,13 +898,224 @@ static void test_mc_get_mincover_from_FLE2RangeFindSpec(_mongocrypt_tester_t *te
         }
         mc_mincover_destroy(mc);
 
+    cleanup:
         bson_destroy(findSpecDoc);
         bson_destroy(findSpecVal);
         mongocrypt_status_destroy(status);
     }
 }
 
+// Runs _mongocrypt_marking_to_ciphertext to compute the ciphertext for the given marking.
+static void get_ciphertext_from_marking_json(_mongocrypt_tester_t *tester,
+                                             mongocrypt_t *crypt,
+                                             const char *markingJSON,
+                                             _mongocrypt_ciphertext_t *out) {
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+    // Set up encryption environment
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "test", -1, TEST_FILE("./test/example/cmd.json")), ctx);
+    // Add a test key
+    _mongocrypt_buffer_t keyId;
+    _mongocrypt_buffer_from_binary(&keyId, TEST_BIN(16));
+    keyId.subtype = BSON_SUBTYPE_UUID;
+    _mongocrypt_key_broker_add_test_key(&ctx->kb, &keyId);
+
+    _mongocrypt_buffer_t marking_buf;
+    _mongocrypt_marking_t marking;
+    bson_t *marking_bson = TMP_BSON(markingJSON);
+    // Add key identifier info to the marking
+    BSON_APPEND_BINARY(marking_bson, "ki", BSON_SUBTYPE_UUID, (TEST_BIN(16))->data, 16);
+    BSON_APPEND_BINARY(marking_bson, "ku", BSON_SUBTYPE_UUID, (TEST_BIN(16))->data, 16);
+    _make_marking(marking_bson, &marking_buf);
+    // Use FLE2 as the subtype (default is FLE1)
+    marking_buf.data[0] = MC_SUBTYPE_FLE2EncryptionPlaceholder;
+    _parse_ok(&marking_buf, &marking);
+
+    ASSERT_OK_STATUS(_mongocrypt_marking_to_ciphertext((void *)&ctx->kb, &marking, out, status), status);
+
+    mongocrypt_status_destroy(status);
+    _mongocrypt_buffer_cleanup(&marking_buf);
+    _mongocrypt_marking_cleanup(&marking);
+    mongocrypt_ctx_destroy(ctx);
+}
+
+// Assert that the encryptedTokens fields in V2 insert/update ciphertext matches our expectations. Specifically, checks
+// that the length of these fields are what we expect, and that the "isLeaf" token is appended when using range V2.
+static void assert_correctness_of_ciphertext(_mongocrypt_ciphertext_t *ciphertext,
+                                             mongocrypt_t *crypt,
+                                             mc_ECOCToken_t *ecocToken,
+                                             bool useRangeV2,
+                                             uint32_t expectedEdges) {
+    uint32_t expectedPLength = useRangeV2 ? 33 : 32;
+    const _mongocrypt_value_encryption_algorithm_t *fle2alg = _mcFLE2Algorithm();
+    mongocrypt_status_t *status = mongocrypt_status_new();
+
+    bson_t ciphertextBSON;
+    bson_iter_t iter;
+    ASSERT(_mongocrypt_buffer_to_bson(&ciphertext->data, &ciphertextBSON));
+
+    // 'p' field should be available, length should be 16 bytes of IV + expected bytes
+    bson_iter_init_find(&iter, &ciphertextBSON, "p");
+    ASSERT(BSON_ITER_HOLDS_BINARY(&iter));
+    uint32_t p_len;
+    const uint8_t *p_data;
+    bson_iter_binary(&iter, NULL, &p_len, &p_data);
+    ASSERT_CMPUINT32(p_len, ==, 16 + expectedPLength);
+
+    if (useRangeV2) {
+        _mongocrypt_buffer_t p_buf, decrypted_buf;
+        ASSERT(_mongocrypt_buffer_copy_from_data_and_size(&p_buf, p_data, p_len));
+        _mongocrypt_buffer_init_size(&decrypted_buf, expectedPLength);
+        uint32_t decryptedBytes;
+        // Decrypt p. When using range V2, last byte should be 0.
+        ASSERT_OK_STATUS(fle2alg->do_decrypt(crypt->crypto,
+                                             NULL,
+                                             mc_ECOCToken_get(ecocToken),
+                                             &p_buf,
+                                             &decrypted_buf,
+                                             &decryptedBytes,
+                                             status),
+                         status);
+        ASSERT_CMPUINT32(decryptedBytes, ==, expectedPLength);
+        ASSERT_CMPUINT8(decrypted_buf.data[decrypted_buf.len - 1], ==, 0);
+        _mongocrypt_buffer_cleanup(&decrypted_buf);
+        _mongocrypt_buffer_cleanup(&p_buf);
+    }
+
+    // 'g' field should be available
+    bson_iter_init_find(&iter, &ciphertextBSON, "g");
+    ASSERT(BSON_ITER_HOLDS_ARRAY(&iter));
+    uint32_t g_buf_len;
+    const uint8_t *g_buf;
+    bson_t g_arr;
+    bson_iter_array(&iter, &g_buf_len, &g_buf);
+    ASSERT(bson_init_static(&g_arr, g_buf, g_buf_len));
+
+    bson_iter_t g_iter;
+    bson_iter_init(&g_iter, &g_arr);
+    size_t g_count = 0, leaf_count = 0;
+    // Iterate through each edge token set and check p for each
+    while (bson_iter_next(&g_iter)) {
+        g_count++;
+        ASSERT(BSON_ITER_HOLDS_DOCUMENT(&g_iter));
+        uint32_t subdoc_len;
+        const uint8_t *subdoc_buf;
+        bson_t subdoc;
+        bson_iter_document(&g_iter, &subdoc_len, &subdoc_buf);
+        ASSERT(bson_init_static(&subdoc, subdoc_buf, subdoc_len));
+
+        bson_iter_t sub_iter;
+        bson_iter_init_find(&sub_iter, &subdoc, "p");
+        ASSERT(BSON_ITER_HOLDS_BINARY(&sub_iter));
+        bson_iter_binary(&sub_iter, NULL, &p_len, &p_data);
+        ASSERT_CMPUINT32(p_len, ==, 16 + expectedPLength);
+
+        if (useRangeV2) {
+            _mongocrypt_buffer_t p_buf, decrypted_buf;
+            ASSERT(_mongocrypt_buffer_copy_from_data_and_size(&p_buf, p_data, p_len));
+            _mongocrypt_buffer_init_size(&decrypted_buf, expectedPLength);
+
+            // Decrypt p. If useRangeV2, the last byte should be 0 or 1, depending on whether isLeaf.
+            uint32_t decrypted_bytes;
+            ASSERT_OK_STATUS(fle2alg->do_decrypt(crypt->crypto,
+                                                 NULL,
+                                                 mc_ECOCToken_get(ecocToken),
+                                                 &p_buf,
+                                                 &decrypted_buf,
+                                                 &decrypted_bytes,
+                                                 status),
+                             status);
+            ASSERT_CMPUINT32(decrypted_bytes, ==, expectedPLength);
+            if (decrypted_buf.data[decrypted_buf.len - 1] == 1) {
+                leaf_count++;
+            } else {
+                ASSERT_CMPUINT8(decrypted_buf.data[decrypted_buf.len - 1], ==, 0)
+            }
+
+            _mongocrypt_buffer_cleanup(&decrypted_buf);
+            _mongocrypt_buffer_cleanup(&p_buf);
+        }
+    }
+    ASSERT_CMPSIZE_T(g_count, ==, expectedEdges);
+    if (useRangeV2) {
+        // There should be exactly one leaf in any insert call.
+        ASSERT_CMPSIZE_T(leaf_count, ==, 1);
+    }
+    bson_destroy(&ciphertextBSON);
+    mongocrypt_status_destroy(status);
+}
+
+// Get the ECOC token to use in decryption.
+static mc_ECOCToken_t *getECOCToken(mongocrypt_t *crypt) {
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    // Test token key that we added earlier is all zeros.
+    _mongocrypt_buffer_t tokenKey;
+    _mongocrypt_buffer_init_size(&tokenKey, MONGOCRYPT_TOKEN_KEY_LEN);
+    memset(tokenKey.data, 0, MONGOCRYPT_TOKEN_KEY_LEN);
+
+    mc_CollectionsLevel1Token_t *collectionsLevel1Token =
+        mc_CollectionsLevel1Token_new(crypt->crypto, &tokenKey, status);
+    mc_ECOCToken_t *ecocToken = mc_ECOCToken_new(crypt->crypto, collectionsLevel1Token, status);
+    ASSERT(mongocrypt_status_ok(status));
+
+    mc_CollectionsLevel1Token_destroy(collectionsLevel1Token);
+    _mongocrypt_buffer_cleanup(&tokenKey);
+    mongocrypt_status_destroy(status);
+    return ecocToken;
+}
+
+static void test_mc_marking_to_ciphertext(_mongocrypt_tester_t *tester) {
+    if (!_aes_ctr_is_supported_by_os) {
+        printf("Common Crypto with no CTR support detected. Skipping.");
+        return;
+    }
+
+    // Test that whether range V2 is enabled or disabled, the ciphertext matches our expectations.
+    {
+        const char markingJSON[] = RAW_STRING({
+            't' : 1,
+            'a' : 3,
+            'v' : {'min' : 0, 'max' : 7, 'v' : 5},
+            's' : {'$numberLong' : '1'},
+            'cm' : {'$numberLong' : '1'}
+        });
+        _mongocrypt_ciphertext_t ciphertext;
+        _mongocrypt_ciphertext_init(&ciphertext);
+        mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+
+        get_ciphertext_from_marking_json(tester, crypt, markingJSON, &ciphertext);
+
+        mc_ECOCToken_t *ecocToken = getECOCToken(crypt);
+        assert_correctness_of_ciphertext(&ciphertext, crypt, ecocToken, false, 4);
+        _mongocrypt_ciphertext_cleanup(&ciphertext);
+        mc_ECOCToken_destroy(ecocToken);
+        mongocrypt_destroy(crypt);
+    }
+    {
+        const char markingJSON[] = RAW_STRING({
+            't' : 1,
+            'a' : 3,
+            'v' : {'min' : 0, 'max' : 7, 'v' : 5, 'trimFactor' : 0},
+            's' : {'$numberLong' : '1'},
+            'cm' : {'$numberLong' : '1'}
+        });
+        _mongocrypt_ciphertext_t ciphertext;
+        _mongocrypt_ciphertext_init(&ciphertext);
+        mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_WITH_RANGE_V2);
+
+        get_ciphertext_from_marking_json(tester, crypt, markingJSON, &ciphertext);
+
+        mc_ECOCToken_t *ecocToken = getECOCToken(crypt);
+        assert_correctness_of_ciphertext(&ciphertext, crypt, ecocToken, true, 4);
+        _mongocrypt_ciphertext_cleanup(&ciphertext);
+        mc_ECOCToken_destroy(ecocToken);
+
+        mongocrypt_destroy(crypt);
+    }
+}
+
 void _mongocrypt_tester_install_marking(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(test_mongocrypt_marking_parse);
     INSTALL_TEST(test_mc_get_mincover_from_FLE2RangeFindSpec);
+    INSTALL_TEST(test_mc_marking_to_ciphertext);
 }