From fcc6ce3d212ab88e0b028ead64c866c0828108ef Mon Sep 17 00:00:00 2001 From: Kevin Albertson Date: Thu, 16 Jul 2026 16:13:15 -0400 Subject: [PATCH 1/3] add regression test --- test/test-mongocrypt.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/test/test-mongocrypt.c b/test/test-mongocrypt.c index 4aaf6881c..db492be8a 100644 --- a/test/test-mongocrypt.c +++ b/test/test-mongocrypt.c @@ -906,6 +906,16 @@ static void _test_setopt_kms_providers(_mongocrypt_tester_t *tester) { ASSERT_FAILS(mongocrypt_setopt_kms_providers(crypt, more), crypt, "already set"); mongocrypt_destroy(crypt); } + + // Errors if followed by call to `mongocrypt_setopt_kms_providers` configuring "kmip". + // This is a regression test for: MONGOCRYPT-956 + { + mongocrypt_binary_t *kms_providers = TEST_BSON("{'kmip' : {'endpoint' : 'localhost'}}"); + mongocrypt_t *crypt = mongocrypt_new(); + ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, kms_providers), crypt); + ASSERT_FAILS(mongocrypt_setopt_kms_providers(crypt, kms_providers), crypt, "already set"); + mongocrypt_destroy(crypt); + } } static void test_tmp_bsonf(_mongocrypt_tester_t *tester) { @@ -1044,7 +1054,7 @@ int main(int argc, char **argv) { continue; // No match found. } - found_match : {} + found_match: {} TEST_PRINTF(" begin %s\n", tester.test_names[i]); tester.test_fns[i](&tester); From f9f4fb4747eb2ed34b59c97e750eb55fb9a79fcb Mon Sep 17 00:00:00 2001 From: Kevin Albertson Date: Thu, 16 Jul 2026 16:13:33 -0400 Subject: [PATCH 2/3] MONGOCRYPT-956 reject repeated configuration of KMIP KMS provider --- src/mongocrypt-opts.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/mongocrypt-opts.c b/src/mongocrypt-opts.c index c5b7b5833..7b9da7415 100644 --- a/src/mongocrypt-opts.c +++ b/src/mongocrypt-opts.c @@ -984,6 +984,10 @@ bool _mongocrypt_parse_kms_providers(mongocrypt_binary_t *kms_providers_definiti } else if (0 == strcmp(field_name, "kmip") && bson_empty(&field_bson)) { kms_providers->need_credentials |= MONGOCRYPT_KMS_PROVIDER_KMIP; } else if (0 == strcmp(field_name, "kmip")) { + if (0 != (kms_providers->configured_providers & MONGOCRYPT_KMS_PROVIDER_KMIP)) { + CLIENT_ERR("kmip KMS provider already set"); + return false; + } if (!_mongocrypt_opts_kms_provider_kmip_parse(&kms_providers->kmip_mut, field_name, &field_bson, status)) { return false; } From 6154a583942128e96ac91d3b5f0677196e37e9b6 Mon Sep 17 00:00:00 2001 From: Kevin Albertson Date: Fri, 17 Jul 2026 10:49:26 -0400 Subject: [PATCH 3/3] fix format --- test/test-mongocrypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test-mongocrypt.c b/test/test-mongocrypt.c index db492be8a..3e09bd45e 100644 --- a/test/test-mongocrypt.c +++ b/test/test-mongocrypt.c @@ -1054,7 +1054,7 @@ int main(int argc, char **argv) { continue; // No match found. } - found_match: {} + found_match : {} TEST_PRINTF(" begin %s\n", tester.test_names[i]); tester.test_fns[i](&tester);