From ec1318b9d169418c195f6e1625820921fde099a7 Mon Sep 17 00:00:00 2001 From: Jacob Champion Date: Wed, 1 Apr 2026 11:17:36 -0700 Subject: [PATCH v3.1 5/6] squash! Split PGOAUTHDEBUG=UNSAFE into multiple options - Move the implementation into its own header; revert the build system changes that were needed for the .c approach. - et al are included in "c.h" and do not need to be explicitly pulled in. --- src/interfaces/libpq-oauth/meson.build | 6 +-- src/interfaces/libpq/meson.build | 1 - src/interfaces/libpq-oauth/Makefile | 11 +---- src/interfaces/libpq/Makefile | 3 +- src/interfaces/libpq-oauth/oauth-utils.h | 2 - src/interfaces/libpq/fe-auth-oauth.h | 30 ------------ .../{fe-auth-oauth-debug.c => oauth-debug.h} | 49 ++++++++++++++----- src/interfaces/libpq-oauth/oauth-curl.c | 1 + src/interfaces/libpq/fe-auth-oauth.c | 1 + 9 files changed, 43 insertions(+), 61 deletions(-) rename src/interfaces/libpq/{fe-auth-oauth-debug.c => oauth-debug.h} (62%) diff --git a/src/interfaces/libpq-oauth/meson.build b/src/interfaces/libpq-oauth/meson.build index d8cc92e0c2c..ea3a900f4f1 100644 --- a/src/interfaces/libpq-oauth/meson.build +++ b/src/interfaces/libpq-oauth/meson.build @@ -6,7 +6,6 @@ endif libpq_oauth_sources = files( 'oauth-curl.c', - '../libpq/fe-auth-oauth-debug.c', ) # The shared library needs additional glue symbols. @@ -63,10 +62,7 @@ endif libpq_oauth_test_deps = [] -oauth_test_sources = files( - 'test-oauth-curl.c', - '../libpq/fe-auth-oauth-debug.c', -) + libpq_oauth_so_sources +oauth_test_sources = files('test-oauth-curl.c') + libpq_oauth_so_sources if host_system == 'windows' oauth_test_sources += rc_bin_gen.process(win32ver_rc, extra_args: [ diff --git a/src/interfaces/libpq/meson.build b/src/interfaces/libpq/meson.build index d031f4962e5..b0ae72167a1 100644 --- a/src/interfaces/libpq/meson.build +++ b/src/interfaces/libpq/meson.build @@ -2,7 +2,6 @@ libpq_sources = files( 'fe-auth-oauth.c', - 'fe-auth-oauth-debug.c', 'fe-auth-scram.c', 'fe-auth.c', 'fe-cancel.c', diff --git a/src/interfaces/libpq-oauth/Makefile b/src/interfaces/libpq-oauth/Makefile index c6097dda531..11e1a3cf528 100644 --- a/src/interfaces/libpq-oauth/Makefile +++ b/src/interfaces/libpq-oauth/Makefile @@ -36,24 +36,15 @@ override CPPFLAGS_SHLIB += -DUSE_PRIVATE_ENCODING_FUNCS OBJS = \ $(WIN32RES) -OBJS_STATIC = \ - oauth-curl.o \ - fe-auth-oauth-debug.o +OBJS_STATIC = oauth-curl.o # The shared library needs additional glue symbols. OBJS_SHLIB = \ oauth-curl_shlib.o \ oauth-utils.o \ - fe-auth-oauth-debug_shlib.o oauth-utils.o: override CPPFLAGS += $(CPPFLAGS_SHLIB) -fe-auth-oauth-debug.o: $(libpq_srcdir)/fe-auth-oauth-debug.c - $(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@ - -fe-auth-oauth-debug_shlib.o: $(libpq_srcdir)/fe-auth-oauth-debug.c fe-auth-oauth-debug.o - $(CC) $(CFLAGS) $(CFLAGS_SL) $(CPPFLAGS) $(CPPFLAGS_SHLIB) -c $< -o $@ - # Add shlib-/stlib-specific objects. $(shlib): override OBJS += $(OBJS_SHLIB) $(shlib): $(OBJS_SHLIB) diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefile index 099c6557e77..0963995eed4 100644 --- a/src/interfaces/libpq/Makefile +++ b/src/interfaces/libpq/Makefile @@ -44,8 +44,7 @@ OBJS = \ legacy-pqsignal.o \ libpq-events.o \ pqexpbuffer.o \ - fe-auth.o \ - fe-auth-oauth-debug.o + fe-auth.o # File shared across all SSL implementations supported. ifneq ($(with_ssl),no) diff --git a/src/interfaces/libpq-oauth/oauth-utils.h b/src/interfaces/libpq-oauth/oauth-utils.h index 64a9235ee85..dacd2dbacfe 100644 --- a/src/interfaces/libpq-oauth/oauth-utils.h +++ b/src/interfaces/libpq-oauth/oauth-utils.h @@ -15,7 +15,6 @@ #ifndef OAUTH_UTILS_H #define OAUTH_UTILS_H -#include "fe-auth-oauth.h" #include "libpq-fe.h" #include "pqexpbuffer.h" @@ -36,7 +35,6 @@ typedef enum PG_BOOL_NO /* No (false) */ } PGTernaryBool; -extern uint32 oauth_get_debug_flags(void); extern int pq_block_sigpipe(sigset_t *osigset, bool *sigpipe_pending); extern void pq_reset_sigpipe(sigset_t *osigset, bool sigpipe_pending, bool got_epipe); diff --git a/src/interfaces/libpq/fe-auth-oauth.h b/src/interfaces/libpq/fe-auth-oauth.h index a952fea09cf..a50d7b03408 100644 --- a/src/interfaces/libpq/fe-auth-oauth.h +++ b/src/interfaces/libpq/fe-auth-oauth.h @@ -39,37 +39,7 @@ typedef struct void *flow_module; } fe_oauth_state; -/* - * Debug flags for the PGOAUTHDEBUG environment variable. Each flag controls a - * specific debug feature. OAUTHDEBUG_UNSAFE_* flags require the envvar to have - * a literal "UNSAFE:" prefix. - */ - -/* allow HTTP (unencrypted) connections */ -#define OAUTHDEBUG_UNSAFE_HTTP (1<<0) -/* log HTTP traffic (exposes secrets) */ -#define OAUTHDEBUG_UNSAFE_TRACE (1<<1) -/* allow zero-second retry intervals */ -#define OAUTHDEBUG_UNSAFE_DOS_ENDPOINT (1<<2) - -/* mind the gap in values; see OAUTHDEBUG_UNSAFE_MASK below */ - -/* print PQconnectPoll statistics */ -#define OAUTHDEBUG_CALL_COUNT (1<<16) -/* print plugin loading errors */ -#define OAUTHDEBUG_PLUGIN_ERRORS (1<<17) - -/* all safe and unsafe flags, for the legacy UNSAFE behavior */ -#define OAUTHDEBUG_UNSAFE_ALL ((uint32) ~0) - -/* Flags are divided into "safe" and "unsafe" based on bit position. */ -#define OAUTHDEBUG_UNSAFE_MASK ((uint32) 0x0000FFFF) - -static_assert(OAUTHDEBUG_CALL_COUNT == OAUTHDEBUG_UNSAFE_MASK + 1, - "the first safe OAUTHDEBUG flag should be above OAUTHDEBUG_UNSAFE_MASK"); - extern void pqClearOAuthToken(PGconn *conn); -extern uint32 oauth_get_debug_flags(void); /* Mechanisms in fe-auth-oauth.c */ extern const pg_fe_sasl_mech pg_oauth_mech; diff --git a/src/interfaces/libpq/fe-auth-oauth-debug.c b/src/interfaces/libpq/oauth-debug.h similarity index 62% rename from src/interfaces/libpq/fe-auth-oauth-debug.c rename to src/interfaces/libpq/oauth-debug.h index 8bf710ce46a..ad5246a8402 100644 --- a/src/interfaces/libpq/fe-auth-oauth-debug.c +++ b/src/interfaces/libpq/oauth-debug.h @@ -1,28 +1,53 @@ /*------------------------------------------------------------------------- * - * fe-auth-oauth-debug.c + * oauth-debug.h * Parsing logic for PGOAUTHDEBUG environment variable * - * This file contains pure string parsing logic with no dependencies on - * libpq or libpq-oauth implementation details. It's compiled into both - * libraries to avoid code duplication. + * Both libpq and libpq-oauth need this logic, so it's packaged in a small + * header for convenience. * - * Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group + * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group * Portions Copyright (c) 1994, Regents of the University of California * * IDENTIFICATION - * src/interfaces/libpq/fe-auth-oauth-debug.c + * src/interfaces/libpq/oauth-debug.h * *------------------------------------------------------------------------- */ +#ifndef OAUTH_DEBUG_H +#define OAUTH_DEBUG_H + #include "postgres_fe.h" -#include -#include -#include +/* + * Debug flags for the PGOAUTHDEBUG environment variable. Each flag controls a + * specific debug feature. OAUTHDEBUG_UNSAFE_* flags require the envvar to have + * a literal "UNSAFE:" prefix. + */ + +/* allow HTTP (unencrypted) connections */ +#define OAUTHDEBUG_UNSAFE_HTTP (1<<0) +/* log HTTP traffic (exposes secrets) */ +#define OAUTHDEBUG_UNSAFE_TRACE (1<<1) +/* allow zero-second retry intervals */ +#define OAUTHDEBUG_UNSAFE_DOS_ENDPOINT (1<<2) + +/* mind the gap in values; see OAUTHDEBUG_UNSAFE_MASK below */ -#include "fe-auth-oauth.h" +/* print PQconnectPoll statistics */ +#define OAUTHDEBUG_CALL_COUNT (1<<16) +/* print plugin loading errors */ +#define OAUTHDEBUG_PLUGIN_ERRORS (1<<17) + +/* all safe and unsafe flags, for the legacy UNSAFE behavior */ +#define OAUTHDEBUG_UNSAFE_ALL ((uint32) ~0) + +/* Flags are divided into "safe" and "unsafe" based on bit position. */ +#define OAUTHDEBUG_UNSAFE_MASK ((uint32) 0x0000FFFF) + +static_assert(OAUTHDEBUG_CALL_COUNT == OAUTHDEBUG_UNSAFE_MASK + 1, + "the first safe OAUTHDEBUG flag should be above OAUTHDEBUG_UNSAFE_MASK"); /* * Parses the PGOAUTHDEBUG environment variable and returns debug flags. @@ -36,7 +61,7 @@ * - An unrecognized option is specified * - An unsafe option is specified without the UNSAFE: prefix */ -uint32 +static uint32 oauth_get_debug_flags(void) { uint32 flags = 0; @@ -102,3 +127,5 @@ oauth_get_debug_flags(void) return flags; } + +#endif /* OAUTH_DEBUG_H */ diff --git a/src/interfaces/libpq-oauth/oauth-curl.c b/src/interfaces/libpq-oauth/oauth-curl.c index 7100824c560..5ee630dd9f7 100644 --- a/src/interfaces/libpq-oauth/oauth-curl.c +++ b/src/interfaces/libpq-oauth/oauth-curl.c @@ -31,6 +31,7 @@ #include "common/jsonapi.h" #include "mb/pg_wchar.h" #include "oauth-curl.h" +#include "oauth-debug.h" #ifdef USE_DYNAMIC_OAUTH diff --git a/src/interfaces/libpq/fe-auth-oauth.c b/src/interfaces/libpq/fe-auth-oauth.c index 6f7ec3a129e..c150f27df00 100644 --- a/src/interfaces/libpq/fe-auth-oauth.c +++ b/src/interfaces/libpq/fe-auth-oauth.c @@ -26,6 +26,7 @@ #include "fe-auth.h" #include "fe-auth-oauth.h" #include "mb/pg_wchar.h" +#include "oauth-debug.h" #include "pg_config_paths.h" #include "utils/memdebug.h" -- 2.34.1