oauth: Move the builtin flow into a separate module The additional packaging footprint of the OAuth Curl dependency, as well as the existence of libcurl in the address space even if OAuth isn't ever used by a client, has raised some concerns. Split off this dependency into a separate loadable module called libpq-oauth.
When configured using --with-libcurl, libpq.so searches for this new module via dlopen(). End users may choose not to install the libpq-oauth module, in which case the default flow is disabled. For static applications using libpq.a, the libpq-oauth staticlib is a mandatory link-time dependency for --with-libcurl builds. libpq.pc has been updated accordingly. The default flow relies on some libpq internals. Some of these can be safely duplicated (such as the SIGPIPE handlers), but others need to be shared between libpq and libpq-oauth for thread-safety. To avoid exporting these internals to all libpq clients forever, these dependencies are instead injected from the libpq side via an initialization function. This also lets libpq communicate the offsets of PGconn struct members to libpq-oauth, so that we can function without crashing if the module on the search path came from a different build of Postgres. (A minor-version upgrade could swap the libpq-oauth module out from under a long-running libpq client before it does its first load of the OAuth flow.) This ABI is considered "private". The module has no SONAME or version symlinks, and it's named libpq-oauth-<major>.so to avoid mixing and matching across Postgres versions. (Future improvements may promote this "OAuth flow plugin" to a first-class concept, at which point we would need a public API to replace this anyway.) Additionally, NLS support for error messages in b3f0be788a was incomplete, because the new error macros weren't being scanned by xgettext. Fix that now. Per request from Tom Lane and Bruce Momjian. Based on an initial patch by Daniel Gustafsson, who also contributed docs changes. The "bare" dlopen() concept came from Thomas Munro. Many people reviewed the design and implementation; thank you! Co-authored-by: Daniel Gustafsson <dan...@yesql.se> Reviewed-by: Andres Freund <and...@anarazel.de> Reviewed-by: Christoph Berg <m...@debian.org> Reviewed-by: Daniel Gustafsson <dan...@yesql.se> Reviewed-by: Jelte Fennema-Nio <postg...@jeltef.nl> Reviewed-by: Peter Eisentraut <pe...@eisentraut.org> Reviewed-by: Wolfgang Walther <walt...@technowledgy.de> Discussion: https://postgr.es/m/641687.1742360249%40sss.pgh.pa.us Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/b0635bfda0535a7fc36cd11d10eecec4e2a96330 Modified Files -------------- config/programs.m4 | 17 +- configure | 50 ++++- configure.ac | 26 ++- doc/src/sgml/installation.sgml | 8 + doc/src/sgml/libpq.sgml | 30 ++- meson.build | 32 ++- src/Makefile.global.in | 3 + src/interfaces/Makefile | 12 ++ src/interfaces/libpq-oauth/Makefile | 83 ++++++++ src/interfaces/libpq-oauth/README | 57 +++++ src/interfaces/libpq-oauth/exports.txt | 4 + src/interfaces/libpq-oauth/meson.build | 45 ++++ .../oauth-curl.c} | 180 +++++++++------- src/interfaces/libpq-oauth/oauth-curl.h | 24 +++ src/interfaces/libpq-oauth/oauth-utils.c | 233 +++++++++++++++++++++ src/interfaces/libpq-oauth/oauth-utils.h | 94 +++++++++ src/interfaces/libpq/Makefile | 36 +++- src/interfaces/libpq/exports.txt | 1 + src/interfaces/libpq/fe-auth-oauth.c | 229 +++++++++++++++++++- src/interfaces/libpq/fe-auth-oauth.h | 12 +- src/interfaces/libpq/meson.build | 25 ++- src/interfaces/libpq/nls.mk | 12 +- src/makefiles/meson.build | 2 + src/test/modules/oauth_validator/meson.build | 2 +- src/test/modules/oauth_validator/t/002_client.pl | 2 +- 25 files changed, 1079 insertions(+), 140 deletions(-)
