Blame SOURCES/Make-syslog-of-call-status-configurable.patch

4a6754
From 1948864cc8ace15d2e0bbb527091cca6a025676e Mon Sep 17 00:00:00 2001
4a6754
From: Robbie Harwood <rharwood@redhat.com>
4a6754
Date: Mon, 30 Sep 2019 15:00:56 -0400
4a6754
Subject: [PATCH] Make syslog of call status configurable
4a6754
4a6754
Add a parameter (syslog_status) to configuration and
4a6754
CLI (--syslog-status).  This logs the results of GSSAPI calls at
4a6754
LOG_DEBUG.  Typically these calls resemble:
4a6754
4a6754
    gssproxy[28914]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS
4a6754
    failure.  Minor code may provide more information, No credentials
4a6754
    cache found
4a6754
4a6754
Since these messages worry some admins, turn them off by default.
4a6754
4a6754
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
4a6754
(cherry picked from commit 116618e1523038691fcb481107ba15ffd42942ac)
4a6754
(cherry picked from commit cc61409b7b20974332549dd028d889b87dbff98d)
4a6754
(cherry picked from commit 07b32184ee337ec06a405724b4b88cad22829c6d)
4a6754
[conflict: gssproxy.conf.5.xml over program being added]
4a6754
---
4a6754
 proxy/man/gssproxy.8.xml      |  8 ++++++++
4a6754
 proxy/man/gssproxy.conf.5.xml | 10 ++++++++++
4a6754
 proxy/src/gp_config.c         |  6 ++++++
4a6754
 proxy/src/gp_log.c            |  9 +++++++--
4a6754
 proxy/src/gp_log.h            |  3 +++
4a6754
 proxy/src/gssproxy.c          |  6 ++++++
4a6754
 6 files changed, 40 insertions(+), 2 deletions(-)
4a6754
4a6754
diff --git a/proxy/man/gssproxy.8.xml b/proxy/man/gssproxy.8.xml
4a6754
index 21f7e6a..4019135 100644
4a6754
--- a/proxy/man/gssproxy.8.xml
4a6754
+++ b/proxy/man/gssproxy.8.xml
4a6754
@@ -151,6 +151,14 @@
4a6754
                 </listitem>
4a6754
             </varlistentry>
4a6754
 
4a6754
+            <varlistentry>
4a6754
+                <term>
4a6754
+                    <option>--syslog-status</option>
4a6754
+                </term>
4a6754
+                <listitem>
4a6754
+                    <para>Enable additional logging to syslog.</para>
4a6754
+                </listitem>
4a6754
+            </varlistentry>
4a6754
             <varlistentry>
4a6754
                 <term>
4a6754
                     <option>--version</option>
4a6754
diff --git a/proxy/man/gssproxy.conf.5.xml b/proxy/man/gssproxy.conf.5.xml
4a6754
index 7874c6e..79f64e7 100644
4a6754
--- a/proxy/man/gssproxy.conf.5.xml
4a6754
+++ b/proxy/man/gssproxy.conf.5.xml
4a6754
@@ -361,6 +361,16 @@
4a6754
                     </listitem>
4a6754
                     </varlistentry>
4a6754
 
4a6754
+                <varlistentry>
4a6754
+                    <term>syslog_status (boolean)</term>
4a6754
+                    <listitem>
4a6754
+                        <para>Enable per-call debugging output to the syslog.
4a6754
+                        This may be useful for investigating problems in
4a6754
+                        applications using gssproxy.</para>
4a6754
+                        <para>Default: syslog_status = false</para>
4a6754
+                    </listitem>
4a6754
+                </varlistentry>
4a6754
+
4a6754
                 <varlistentry>
4a6754
                     <term>trusted (boolean)</term>
4a6754
                         <listitem><para>Defines whether this service is considered trusted. Use with caution, this enables impersonation.</para>
4a6754
diff --git a/proxy/src/gp_config.c b/proxy/src/gp_config.c
4a6754
index cd057a0..57dcfc6 100644
4a6754
--- a/proxy/src/gp_config.c
4a6754
+++ b/proxy/src/gp_config.c
4a6754
@@ -586,6 +586,12 @@ int load_config(struct gp_config *cfg)
4a6754
         goto done;
4a6754
     }
4a6754
 
4a6754
+    ret = gp_config_get_string(ctx, "gssproxy", "syslog_status", &tmpstr);
4a6754
+    if (ret == 0)
4a6754
+        gp_syslog_status = gp_boolean_is_true(tmpstr);
4a6754
+    else if (ret != ENOENT)
4a6754
+        goto done;
4a6754
+
4a6754
     ret = gp_config_get_string(ctx, "gssproxy", "run_as_user", &tmpstr);
4a6754
     if (ret == 0) {
4a6754
         cfg->proxy_user = strdup(tmpstr);
4a6754
diff --git a/proxy/src/gp_log.c b/proxy/src/gp_log.c
4a6754
index b6eb161..e67e8d3 100644
4a6754
--- a/proxy/src/gp_log.c
4a6754
+++ b/proxy/src/gp_log.c
4a6754
@@ -5,6 +5,9 @@
4a6754
 #include <stdio.h>
4a6754
 #include <stdarg.h>
4a6754
 
4a6754
+/* global logging switch */
4a6754
+bool gp_syslog_status = false;
4a6754
+
4a6754
 void gp_logging_init(void)
4a6754
 {
4a6754
     openlog("gssproxy",
4a6754
@@ -55,7 +58,9 @@ void gp_log_status(gss_OID mech, uint32_t maj, uint32_t min)
4a6754
 {
4a6754
     char buf[MAX_LOG_LINE];
4a6754
 
4a6754
-    gp_fmt_status(mech, maj, min, buf, MAX_LOG_LINE);
4a6754
+    if (!gp_syslog_status)
4a6754
+        return;
4a6754
 
4a6754
-    GPERROR("%s\n", buf);
4a6754
+    gp_fmt_status(mech, maj, min, buf, MAX_LOG_LINE);
4a6754
+    syslog(LOG_DEBUG, "%s\n", buf);
4a6754
 }
4a6754
diff --git a/proxy/src/gp_log.h b/proxy/src/gp_log.h
4a6754
index fc8cbdb..31ad648 100644
4a6754
--- a/proxy/src/gp_log.h
4a6754
+++ b/proxy/src/gp_log.h
4a6754
@@ -3,9 +3,12 @@
4a6754
 #ifndef _GP_LOG_H_
4a6754
 #define _GP_LOG_H_
4a6754
 
4a6754
+#include <stdbool.h>
4a6754
 #include <syslog.h>
4a6754
 #include <gssapi/gssapi.h>
4a6754
 
4a6754
+extern bool gp_syslog_status;
4a6754
+
4a6754
 #define MAX_LOG_LINE 1024
4a6754
 #define GPERROR(...) syslog(LOG_ERR, __VA_ARGS__);
4a6754
 #define GPAUDIT(...) syslog(LOG_INFO, __VA_ARGS__);
4a6754
diff --git a/proxy/src/gssproxy.c b/proxy/src/gssproxy.c
4a6754
index 3221615..5112ebf 100644
4a6754
--- a/proxy/src/gssproxy.c
4a6754
+++ b/proxy/src/gssproxy.c
4a6754
@@ -157,6 +157,7 @@ int main(int argc, const char *argv[])
4a6754
     int opt_version = 0;
4a6754
     int opt_debug = 0;
4a6754
     int opt_debug_level = 0;
4a6754
+    int opt_syslog_status = 0;
4a6754
     verto_ctx *vctx;
4a6754
     verto_ev *ev;
4a6754
     int wait_fd;
4a6754
@@ -182,6 +183,8 @@ int main(int argc, const char *argv[])
4a6754
          _("Enable debugging"), NULL}, \
4a6754
         {"debug-level", '\0', POPT_ARG_INT, &opt_debug_level, 0, \
4a6754
          _("Set debugging level"), NULL}, \
4a6754
+        {"syslog-status", '\0', POPT_ARG_NONE, &opt_syslog_status, 0, \
4a6754
+         _("Enable GSSAPI status logging to syslog"), NULL}, \
4a6754
         {"version", '\0', POPT_ARG_NONE, &opt_version, 0, \
4a6754
          _("Print version number and exit"), NULL }, \
4a6754
         POPT_TABLEEND
4a6754
@@ -211,6 +214,9 @@ int main(int argc, const char *argv[])
4a6754
         gp_debug_toggle(opt_debug_level);
4a6754
     }
4a6754
 
4a6754
+    if (opt_syslog_status)
4a6754
+        gp_syslog_status = true;
4a6754
+
4a6754
     if (opt_daemon && opt_interactive) {
4a6754
         fprintf(stderr, "Option -i|--interactive is not allowed together with -D|--daemon\n");
4a6754
         poptPrintUsage(pc, stderr, 0);