mongo 2.20.1 → 2.21.1

data/lib/mongo/crypt/context.rb

@@ -49,7 +49,6 @@ module Mongo
           Binding.mongocrypt_ctx_new(@mongocrypt_handle.ref),
           Binding.method(:mongocrypt_ctx_destroy)
         )
-
         @encryption_io = io
         @cached_azure_token = nil
       end
@@ -64,7 +63,10 @@ module Mongo
       end
 
       # Runs the mongocrypt_ctx_t state machine and handles
-      # all I/O on behalf of libmongocrypt
+      # all I/O on behalf of
+      #
+      # @param [ CsotTimeoutHolder ] timeout_holder CSOT timeouts for the
+      #   operation the state.
       #
       # @return [ BSON::Document ] A BSON document representing the outcome
       #   of the state machine. Contents can differ depending on how the
@@ -75,8 +77,9 @@ module Mongo
       #
       # This method is not currently unit tested. It is integration tested
       # in spec/integration/explicit_encryption_spec.rb
-      def run_state_machine
+      def run_state_machine(timeout_holder)
         while true
+          timeout_ms = timeout_holder.remaining_timeout_ms!
           case state
           when :error
             Binding.check_ctx_status(self)
@@ -86,39 +89,17 @@ module Mongo
           when :done
             return nil
           when :need_mongo_keys
-            filter = Binding.ctx_mongo_op(self)
-
-            @encryption_io.find_keys(filter).each do |key|
-              mongocrypt_feed(key) if key
-            end
-
-            mongocrypt_done
+            provide_keys(timeout_ms)
           when :need_mongo_collinfo
-            filter = Binding.ctx_mongo_op(self)
-
-            result = @encryption_io.collection_info(@db_name, filter)
-            mongocrypt_feed(result) if result
-
-            mongocrypt_done
+            provide_collection_info(timeout_ms)
           when :need_mongo_markings
-            cmd = Binding.ctx_mongo_op(self)
-
-            result = @encryption_io.mark_command(cmd)
-            mongocrypt_feed(result)
-
-            mongocrypt_done
+            provide_markings(timeout_ms)
           when :need_kms
-            while kms_context = Binding.ctx_next_kms_ctx(self) do
-              provider = Binding.kms_ctx_get_kms_provider(kms_context)
-              tls_options = @mongocrypt_handle.kms_tls_options(provider)
-              @encryption_io.feed_kms(kms_context, tls_options)
-            end
-
-            Binding.ctx_kms_done(self)
+            feed_kms
           when :need_kms_credentials
             Binding.ctx_provide_kms_providers(
               self,
-              retrieve_kms_credentials.to_document
+              retrieve_kms_credentials(timeout_holder).to_document
             )
           else
             raise Error::CryptError.new(
@@ -130,6 +111,57 @@ module Mongo
 
       private
 
+      def provide_markings(timeout_ms)
+        cmd = Binding.ctx_mongo_op(self)
+
+        result = @encryption_io.mark_command(cmd, timeout_ms: timeout_ms)
+        mongocrypt_feed(result)
+
+        mongocrypt_done
+      end
+
+      def provide_collection_info(timeout_ms)
+        filter = Binding.ctx_mongo_op(self)
+
+        result = @encryption_io.collection_info(@db_name, filter, timeout_ms: timeout_ms)
+        mongocrypt_feed(result) if result
+
+        mongocrypt_done
+      end
+
+      def provide_keys(timeout_ms)
+        filter = Binding.ctx_mongo_op(self)
+
+        @encryption_io.find_keys(filter, timeout_ms: timeout_ms).each do |key|
+          mongocrypt_feed(key) if key
+        end
+
+        mongocrypt_done
+      end
+
+      def feed_kms
+        while (kms_context = Binding.ctx_next_kms_ctx(self)) do
+          begin
+            delay = Binding.kms_ctx_usleep(kms_context)
+            sleep(delay / 1_000_000.0) unless delay.nil?
+            provider = Binding.kms_ctx_get_kms_provider(kms_context)
+            tls_options = @mongocrypt_handle.kms_tls_options(provider)
+            @encryption_io.feed_kms(kms_context, tls_options)
+          rescue Error::KmsError => e
+            if e.network_error?
+              if Binding.kms_ctx_fail(kms_context)
+                next
+              else
+                raise
+              end
+            else
+              raise
+            end
+          end
+        end
+        Binding.ctx_kms_done(self)
+      end
+
       # Indicate that state machine is done feeding I/O responses back to libmongocrypt
       def mongocrypt_done
         Binding.mongocrypt_ctx_mongo_done(ctx_p)
@@ -147,13 +179,15 @@ module Mongo
       # Retrieves KMS credentials for providers that are configured
       # for automatic credentials retrieval.
       #
+      # @param [ CsotTimeoutHolder ] timeout_holder CSOT timeout.
+      #
       # @return [ Crypt::KMS::Credentials ] Credentials for the configured
       #   KMS providers.
-      def retrieve_kms_credentials
+      def retrieve_kms_credentials(timeout_holder)
         providers = {}
         if kms_providers.aws&.empty?
           begin
-            aws_credentials = Mongo::Auth::Aws::CredentialsRetriever.new.credentials
+            aws_credentials = Mongo::Auth::Aws::CredentialsRetriever.new.credentials(timeout_holder)
           rescue Auth::Aws::CredentialsNotFound
             raise Error::CryptError.new(
               "Could not locate AWS credentials (checked environment variables, ECS and EC2 metadata)"
@@ -162,10 +196,10 @@ module Mongo
           providers[:aws] = aws_credentials.to_h
         end
         if kms_providers.gcp&.empty?
-          providers[:gcp] = { access_token: gcp_access_token }
+          providers[:gcp] = { access_token: gcp_access_token(timeout_holder) }
         end
         if kms_providers.azure&.empty?
-          providers[:azure] = { access_token: azure_access_token }
+          providers[:azure] = { access_token: azure_access_token(timeout_holder) }
         end
         KMS::Credentials.new(providers)
       end
@@ -175,8 +209,8 @@ module Mongo
       # @return [ String ] A GCP access token.
       #
       # @raise [ Error::CryptError ] If the GCP access token could not be
-      def gcp_access_token
-        KMS::GCP::CredentialsRetriever.fetch_access_token
+      def gcp_access_token(timeout_holder)
+        KMS::GCP::CredentialsRetriever.fetch_access_token(timeout_holder)
       rescue KMS::CredentialsNotFound => e
         raise Error::CryptError.new(
           "Could not locate GCP credentials: #{e.class}: #{e.message}"
@@ -189,9 +223,9 @@ module Mongo
       #
       # @raise [ Error::CryptError ] If the Azure access token could not be
       #   retrieved.
-      def azure_access_token
+      def azure_access_token(timeout_holder)
         if @cached_azure_token.nil? || @cached_azure_token.expired?
-          @cached_azure_token = KMS::Azure::CredentialsRetriever.fetch_access_token
+          @cached_azure_token = KMS::Azure::CredentialsRetriever.fetch_access_token(timeout_holder: timeout_holder)
         end
         @cached_azure_token.access_token
       rescue KMS::CredentialsNotFound => e

data/lib/mongo/crypt/encryption_io.rb

@@ -73,47 +73,66 @@ module Mongo
       # filter
       #
       # @param [ Hash ] filter
+      # @param [ Integer ] :timeout_ms The operation timeout in milliseconds.
+      #    Must be a non-negative integer. An explicit value of 0 means infinite.
+      #    The default value is unset which means the feature is not enabled.
       #
       # @return [ Array<BSON::Document> ] The query results
-      def find_keys(filter)
-        key_vault_collection.find(filter).to_a
+      def find_keys(filter, timeout_ms: nil)
+        key_vault_collection.find(filter, timeout_ms: timeout_ms).to_a
       end
 
       # Insert a document into the key vault collection
       #
       # @param [ Hash ] document
+      # @param [ Integer ] :timeout_ms The operation timeout in milliseconds.
+      #    Must be a non-negative integer. An explicit value of 0 means infinite.
+      #    The default value is unset which means the feature is not enabled.
       #
       # @return [ Mongo::Operation::Insert::Result ] The insertion result
-      def insert_data_key(document)
-        key_vault_collection.insert_one(document)
+      def insert_data_key(document, timeout_ms: nil)
+        key_vault_collection.insert_one(document, timeout_ms: timeout_ms)
       end
 
       # Get collection info for a collection matching the provided filter
       #
       # @param [ Hash ] filter
+      # @param [ Integer ] :timeout_ms The operation timeout in milliseconds.
+      #    Must be a non-negative integer. An explicit value of 0 means infinite.
+      #    The default value is unset which means the feature is not enabled.
       #
       # @return [ Hash ] The collection information
-      def collection_info(db_name, filter)
+      def collection_info(db_name, filter, timeout_ms: nil)
         unless @metadata_client
           raise ArgumentError, 'collection_info requires metadata_client to have been passed to the constructor, but it was not'
         end
 
-        @metadata_client.use(db_name).database.list_collections(filter: filter, deserialize_as_bson: true).first
+        @metadata_client
+          .use(db_name)
+          .database
+          .list_collections(filter: filter, deserialize_as_bson: true, timeout_ms: timeout_ms)
+          .first
       end
 
       # Send the command to mongocryptd to be marked with intent-to-encrypt markings
       #
       # @param [ Hash ] cmd
+      # @param [ Integer ] :timeout_ms The operation timeout in milliseconds.
+      #    Must be a non-negative integer. An explicit value of 0 means infinite.
+      #    The default value is unset which means the feature is not enabled.
       #
       # @return [ Hash ] The marked command
-      def mark_command(cmd)
+      def mark_command(cmd, timeout_ms: nil)
         unless @mongocryptd_client
           raise ArgumentError, 'mark_command requires mongocryptd_client to have been passed to the constructor, but it was not'
         end
 
         # Ensure the response from mongocryptd is deserialized with { mode: :bson }
         # to prevent losing type information in commands
-        options = { execution_options: { deserialize_as_bson: true } }
+        options = {
+          execution_options: { deserialize_as_bson: true },
+          timeout_ms: timeout_ms
+        }
 
         begin
           response = @mongocryptd_client.database.command(cmd, options)
@@ -136,9 +155,12 @@ module Mongo
       #   to send on that connection.
       # @param [ Hash ] tls_options. TLS options to connect to KMS provider.
       #   The options are same as for Mongo::Client.
-      def feed_kms(kms_context, tls_options)
+      # @param [ Integer ] :timeout_ms The operation timeout in milliseconds.
+      #    Must be a non-negative integer. An explicit value of 0 means infinite.
+      #    The default value is unset which means the feature is not enabled.
+      def feed_kms(kms_context, tls_options, timeout_ms: nil)
         with_ssl_socket(kms_context.endpoint, tls_options) do |ssl_socket|
-          Timeout.timeout(SOCKET_TIMEOUT, Error::SocketTimeoutError,
+          Timeout.timeout(timeout_ms || SOCKET_TIMEOUT, Error::SocketTimeoutError,
             'Socket write operation timed out'
           ) do
             ssl_socket.syswrite(kms_context.message)
@@ -146,7 +168,7 @@ module Mongo
 
           bytes_needed = kms_context.bytes_needed
           while bytes_needed > 0 do
-            bytes = Timeout.timeout(SOCKET_TIMEOUT, Error::SocketTimeoutError,
+            bytes = Timeout.timeout(timeout_ms || SOCKET_TIMEOUT, Error::SocketTimeoutError,
               'Socket read operation timed out'
             ) do
               ssl_socket.sysread(bytes_needed)
@@ -160,38 +182,39 @@ module Mongo
 
       # Adds a key_alt_name to the key_alt_names array of the key document
       # in the key vault collection with the given id.
-      def add_key_alt_name(id, key_alt_name)
+      def add_key_alt_name(id, key_alt_name, timeout_ms: nil)
         key_vault_collection.find_one_and_update(
           { _id: id },
           { '$addToSet' => { keyAltNames: key_alt_name } },
+          timeout_ms: timeout_ms
         )
       end
 
       # Removes the key document with the given id
       # from the key vault collection.
-      def delete_key(id)
-        key_vault_collection.delete_one(_id: id)
+      def delete_key(id, timeout_ms: nil)
+        key_vault_collection.delete_one(_id: id, timeout_ms: timeout_ms)
       end
 
       # Finds a single key document with the given id.
-      def get_key(id)
-        key_vault_collection.find(_id: id).first
+      def get_key(id, timeout_ms: nil)
+        key_vault_collection.find(_id: id, timeout_ms: timeout_ms).first
       end
 
       # Returns a key document in the key vault collection with
       # the given key_alt_name.
-      def get_key_by_alt_name(key_alt_name)
-        key_vault_collection.find(keyAltNames: key_alt_name).first
+      def get_key_by_alt_name(key_alt_name, timeout_ms: nil)
+        key_vault_collection.find(keyAltNames: key_alt_name, timeout_ms: timeout_ms).first
       end
 
       # Finds all documents in the key vault collection.
-      def get_keys
-        key_vault_collection.find
+      def get_keys(timeout_ms: nil)
+        key_vault_collection.find(nil, timeout_ms: timeout_ms)
       end
 
       # Removes a key_alt_name from the key_alt_names array of the key document
       # in the key vault collection with the given id.
-      def remove_key_alt_name(id, key_alt_name)
+      def remove_key_alt_name(id, key_alt_name, timeout_ms: nil)
         key_vault_collection.find_one_and_update(
           { _id: id },
           [
@@ -211,7 +234,8 @@ module Mongo
                 }
               }
             }
-          ]
+          ],
+          timeout_ms: timeout_ms
         )
       end
 
@@ -220,8 +244,8 @@ module Mongo
       # @param [ Array<Hash> ] requests The bulk write requests.
       #
       # @return [ BulkWrite::Result ] The result of the operation.
-      def update_data_keys(updates)
-        key_vault_collection.bulk_write(updates)
+      def update_data_keys(updates, timeout_ms: nil)
+        key_vault_collection.bulk_write(updates, timeout_ms: timeout_ms)
       end
 
       private
@@ -322,19 +346,27 @@ module Mongo
       #
       # @note The socket is always closed when the provided block has finished
       #   executing
-      def with_ssl_socket(endpoint, tls_options)
+      def with_ssl_socket(endpoint, tls_options, timeout_ms: nil)
+        csot = !timeout_ms.nil?
         address = begin
           host, port = endpoint.split(':')
           port ||= 443 # All supported KMS APIs use this port by default.
           Address.new([host, port].join(':'))
         end
+        socket_options = { ssl: true, csot: csot }.tap do |opts|
+          if csot
+            opts[:connect_timeout] = (timeout_ms / 1_000.0)
+          end
+        end
         mongo_socket = address.socket(
           SOCKET_TIMEOUT,
-          tls_options.merge(ssl: true)
+          tls_options.merge(socket_options)
         )
         yield(mongo_socket.socket)
-      rescue => e
-        raise Error::KmsError, "Error when connecting to KMS provider: #{e.class}: #{e.message}"
+      rescue Error::KmsError
+        raise
+      rescue StandardError => e
+        raise Error::KmsError.new("Error when connecting to KMS provider: #{e.class}: #{e.message}", network_error: true)
       ensure
         mongo_socket&.close
       end

data/lib/mongo/crypt/explicit_encrypter.rb

@@ -35,7 +35,9 @@ module Mongo
       #   providers. Keys of the hash should be KSM provider names; values
       #   should be hashes of TLS connection options. The options are equivalent
       #   to TLS connection options of Mongo::Client.
-      def initialize(key_vault_client, key_vault_namespace, kms_providers, kms_tls_options)
+      # @param [ Integer | nil ] timeout_ms Timeout for every operation executed
+      #   on this object.
+      def initialize(key_vault_client, key_vault_namespace, kms_providers, kms_tls_options, timeout_ms = nil)
         Crypt.validate_ffi!
         @crypt_handle = Handle.new(
           kms_providers,
@@ -47,6 +49,7 @@ module Mongo
           metadata_client: nil,
           key_vault_namespace: key_vault_namespace
         )
+        @timeout_ms = timeout_ms
       end
 
       # Generates a data key used for encryption/decryption and stores
@@ -71,9 +74,11 @@ module Mongo
           master_key_document,
           key_alt_names,
           key_material
-        ).run_state_machine
+        ).run_state_machine(timeout_holder)
 
-        @encryption_io.insert_data_key(data_key_document).inserted_id
+        @encryption_io.insert_data_key(
+          data_key_document, timeout_ms: timeout_holder.remaining_timeout_ms!
+        ).inserted_id
       end
 
       # Encrypts a value using the specified encryption key and algorithm
@@ -111,7 +116,7 @@ module Mongo
           @encryption_io,
           { v: value },
           options
-        ).run_state_machine['v']
+        ).run_state_machine(timeout_holder)['v']
       end
 
       # Encrypts a Match Expression or Aggregate Expression to query a range index.
@@ -125,7 +130,7 @@ module Mongo
       #     {'$and' =>  [{'$gt' => ['$field', 10]}, {'$lt' => ['$field', 20]}}
       #   )
       #   {$and: [{$gt: [<fieldpath>, <value1>]}, {$lt: [<fieldpath>, <value2>]}]
-      # Only supported when queryType is "rangePreview" and algorithm is "RangePreview".
+      # Only supported when queryType is "range" and algorithm is "Range".
       # @note: The Range algorithm is experimental only. It is not intended
       #   for public use. It is subject to breaking changes.
       #
@@ -137,24 +142,25 @@ module Mongo
       # @option options [ String ] :key_alt_name The alternate name for the
       #   encryption key.
       # @option options [ String ] :algorithm The algorithm used to encrypt the
-      #   expression. The only allowed value is "RangePreview"
+      #   expression. The only allowed value is "Range"
       # @option options [ Integer | nil ] :contention_factor Contention factor
       #   to be applied If not  provided, it defaults to a value of 0.
       # @option options [ String | nil ] query_type Query type to be applied.
-      #   The only allowed value is "rangePreview".
+      #   The only allowed value is "range".
       # @option options [ Hash | nil ] :range_opts Specifies index options for
-      #   a Queryable Encryption field supporting "rangePreview" queries.
+      #   a Queryable Encryption field supporting "range" queries.
       #   Allowed options are:
       #   - :min
       #   - :max
+      #   - :trim_factor
       #   - :sparsity
       #   - :precision
-      #   min, max, sparsity, and range must match the values set in
+      #   min, max, trim_factor, sparsity, and precision must match the values set in
       #   the encryptedFields of the destination collection.
       #   For double and decimal128, min/max/precision must all be set,
       #   or all be unset.
       #
-      # @note The RangePreview algorithm is experimental only. It is not
+      # @note The Range algorithm is experimental only. It is not
       # intended for public use.
       #
       # @note The :key_id and :key_alt_name options are mutually exclusive. Only
@@ -170,7 +176,7 @@ module Mongo
           @encryption_io,
           { v: expression },
           options
-        ).run_state_machine['v']
+        ).run_state_machine(timeout_holder)['v']
       end
 
       # Decrypts a value that has already been encrypted
@@ -184,7 +190,7 @@ module Mongo
           @crypt_handle,
           @encryption_io,
           { v: value }
-        ).run_state_machine['v']
+        ).run_state_machine(timeout_holder)['v']
       end
 
       # Adds a key_alt_name for the key in the key vault collection with the given id.
@@ -195,7 +201,7 @@ module Mongo
       # @return [ BSON::Document | nil ] Document describing the identified key
       #   before adding the key alt name, or nil if no such key.
       def add_key_alt_name(id, key_alt_name)
-        @encryption_io.add_key_alt_name(id, key_alt_name)
+        @encryption_io.add_key_alt_name(id, key_alt_name, timeout_ms: @timeout_ms)
       end
 
       # Removes the key with the given id from the key vault collection.
@@ -204,7 +210,9 @@ module Mongo
       #
       # @return [ Operation::Result ] The response from the database for the delete_one
       #   operation that deletes the key.
-      def_delegators :@encryption_io, :delete_key
+      def delete_key(id)
+        @encryption_io.delete_key(id, timeout_ms: @timeout_ms)
+      end
 
       # Finds a single key with the given id.
       #
@@ -212,7 +220,9 @@ module Mongo
       #
       # @return [ BSON::Document | nil ] The found key document or nil
       #   if not found.
-      def_delegators :@encryption_io, :get_key
+      def get_key(id)
+        @encryption_io.get_key(id, timeout_ms: @timeout_ms)
+      end
 
       # Returns a key in the key vault collection with the given key_alt_name.
       #
@@ -220,12 +230,19 @@ module Mongo
       #
       # @return [ BSON::Document | nil ] The found key document or nil
       #   if not found.
-      def_delegators :@encryption_io, :get_key_by_alt_name
+      def get_key_by_alt_name(key_alt_name)
+        @encryption_io.get_key_by_alt_name(key_alt_name, timeout_ms: @timeout_ms)
+      end
 
       # Returns all keys in the key vault collection.
       #
       # @return [ Collection::View ] Keys in the key vault collection.
-      def_delegators :@encryption_io, :get_keys
+      # rubocop:disable Naming/AccessorMethodName
+      # Name of this method is defined in the FLE spec
+      def get_keys
+        @encryption_io.get_keys(timeout_ms: @timeout_ms)
+      end
+      # rubocop:enable Naming/AccessorMethodName
 
       # Removes a key_alt_name from a key in the key vault collection with the given id.
       #
@@ -234,7 +251,9 @@ module Mongo
       #
       # @return [ BSON::Document | nil ] Document describing the identified key
       #   before removing the key alt name, or nil if no such key.
-      def_delegators :@encryption_io, :remove_key_alt_name
+      def remove_key_alt_name(id, key_alt_name)
+        @encryption_io.remove_key_alt_name(id, key_alt_name, timeout_ms: @timeout_ms)
+      end
 
       # Decrypts multiple data keys and (re-)encrypts them with a new master_key,
       #   or with their current master_key if a new one is not given.
@@ -257,12 +276,14 @@ module Mongo
           @encryption_io,
           filter,
           master_key_document
-        ).run_state_machine
+        ).run_state_machine(timeout_holder)
 
         return RewrapManyDataKeyResult.new(nil) if rewrap_result.nil?
 
         updates = updates_from_data_key_documents(rewrap_result.fetch('v'))
-        RewrapManyDataKeyResult.new(@encryption_io.update_data_keys(updates))
+        RewrapManyDataKeyResult.new(
+          @encryption_io.update_data_keys(updates, timeout_ms: @timeout_ms)
+        )
       end
 
       private
@@ -318,6 +339,14 @@ module Mongo
           }
         end
       end
+
+      def timeout_holder
+        CsotTimeoutHolder.new(
+          operation_timeouts: {
+            operation_timeout_ms: @timeout_ms
+          }
+        )
+      end
     end
   end
 end

data/lib/mongo/crypt/explicit_encryption_context.rb

@@ -39,27 +39,28 @@ module Mongo
       #   that will be used to encrypt the value.
       # @option options [ String ] :algorithm The algorithm used to encrypt the
       #   value. Valid algorithms are "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic",
-      #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed", "RangePreview".
+      #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed", "Range".
       # @option options [ Integer | nil ] :contention_factor Contention factor
       #   to be applied if encryption algorithm is set to "Indexed". If not
       #   provided, it defaults to a value of 0. Contention factor should be set
       #   only if encryption algorithm is set to "Indexed".
       # @option options [ String | nil ] query_type Query type to be applied
-      #   if encryption algorithm is set to "Indexed" or "RangePreview".
-      #   Allowed values are "equality" and "rangePreview".
+      #   if encryption algorithm is set to "Indexed" or "Range".
+      #   Allowed values are "equality" and "range".
       # @option options [ Hash | nil ] :range_opts Specifies index options for
-      #   a Queryable Encryption field supporting "rangePreview" queries.
+      #   a Queryable Encryption field supporting "range" queries.
       #   Allowed options are:
       #   - :min
       #   - :max
+      #   - :trim_factor
       #   - :sparsity
       #   - :precision
-      #   min, max, sparsity, and range must match the values set in
+      #   min, max, trim_factor, sparsity, and precision must match the values set in
       #   the encryptedFields of the destination collection.
       #   For double and decimal128, min/max/precision must all be set,
       #   or all be unset.
       #
-      # @note The RangePreview algorithm is experimental only. It is not intended for
+      # @note The Range algorithm is experimental only. It is not intended for
       # public use.
       #
       # @raise [ ArgumentError|Mongo::Error::CryptError ] If invalid options are provided
@@ -116,7 +117,7 @@ module Mongo
 
       def set_algorithm_opts(options)
         Binding.ctx_setopt_algorithm(self, options[:algorithm])
-        if %w(Indexed RangePreview).include?(options[:algorithm])
+        if %w(Indexed Range).include?(options[:algorithm])
           if options[:contention_factor]
             Binding.ctx_setopt_contention_factor(self, options[:contention_factor])
           end
@@ -125,20 +126,25 @@ module Mongo
           end
         else
           if options[:contention_factor]
-            raise ArgumentError.new(':contention_factor is allowed only for "Indexed" or "RangePreview" algorithms')
+            raise ArgumentError.new(':contention_factor is allowed only for "Indexed" or "Range" algorithms')
           end
           if options[:query_type]
-            raise ArgumentError.new(':query_type is allowed only for "Indexed" or "RangePreview" algorithms')
+            raise ArgumentError.new(':query_type is allowed only for "Indexed" or "Range" algorithms')
           end
         end
-        if options[:algorithm] == 'RangePreview'
+        if options[:algorithm] == 'Range'
           Binding.ctx_setopt_algorithm_range(self, convert_range_opts(options[:range_opts]))
         end
       end
 
       def convert_range_opts(range_opts)
         range_opts.dup.tap do |opts|
-          opts[:sparsity] = BSON::Int64.new(opts[:sparsity]) unless opts[:sparsity].is_a?(BSON::Int64)
+          if opts[:sparsity] && !opts[:sparsity].is_a?(BSON::Int64)
+            opts[:sparsity] = BSON::Int64.new(opts[:sparsity])
+          end
+          if opts[:trim_factor]
+            opts[:trimFactor] = opts.delete(:trim_factor)
+          end
         end
       end
     end

data/lib/mongo/crypt/handle.rb

@@ -71,7 +71,7 @@ module Mongo
           Binding.mongocrypt_new,
           Binding.method(:mongocrypt_destroy)
         )
-
+        Binding.kms_ctx_setopt_retry_kms(self, true)
         @kms_providers = kms_providers
         @kms_tls_options =  kms_tls_options