From a378fb3f80c8fadcf0045b185915d0d1305b581e Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Apr 11 2018 20:20:04 +0000
Subject: [PATCH 1/2] Clarify debug and debug_level in man pages


In particular, add debug_level to gssproxy(5) since it was previously
accepted but not documented.

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

---

diff --git a/man/gssproxy.8.xml b/man/gssproxy.8.xml
index 1df4b0d..21f7e6a 100644
--- a/man/gssproxy.8.xml
+++ b/man/gssproxy.8.xml
@@ -118,13 +118,35 @@
                     </para>
                 </listitem>
             </varlistentry>
+
             <varlistentry>
                 <term>
                     <option>-d</option>,<option>--debug</option>
                 </term>
                 <listitem>
                     <para>
-                        Turn on debugging.
+                        Turn on debugging.  This option is identical to
+                        --debug-level=1.
+                    </para>
+                </listitem>
+            </varlistentry>
+
+            <varlistentry>
+                <term>
+                    <option>--debug-level=</option>
+                </term>
+                <listitem>
+                    <para>
+                        Turn on debugging at the specified level.  0
+                        corresponds to no logging, while 1 turns on basic
+                        debug logging.  Level 2 increases verbosity, including
+                        more detailed credential verification.
+                    </para>
+                    <para>
+                        At level 3 and above, KRB5_TRACE output is logged.  If
+                        KRB5_TRACE was already set in the execution
+                        environment, trace output is sent to its value
+                        instead.
                     </para>
                 </listitem>
             </varlistentry>
diff --git a/man/gssproxy.conf.5.xml b/man/gssproxy.conf.5.xml
index de846b4..21c9653 100644
--- a/man/gssproxy.conf.5.xml
+++ b/man/gssproxy.conf.5.xml
@@ -192,7 +192,10 @@
                 <varlistentry>
                     <term>debug (boolean)</term>
                     <listitem>
-                        <para>Enable debugging to syslog.</para>
+                        <para>
+                            Enable debugging to syslog.  Setting to true is
+                            identical to setting debug_level to 1.
+                        </para>
                         <para>Default: debug = false</para>
                     </listitem>
                 </varlistentry>

From 4ee8ccdcbb3bcd84eceaaa72c4654dc3dd98fd47 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Apr 11 2018 21:53:45 +0000
Subject: [PATCH 2/2] Always choose highest requested debug level


Allowing the CLI to lower the debug level specified in a config file
is dubious, and previously broken since we don't distinguish "default
value" from "explicitly requested value of 0" in popt.  This resulted
in "Debug Enabled (level: 0)" even when the log level was not actually
0, which is confusing for users.

Remove the gp_debug_args() function since it is no longer used.

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

---

diff --git a/src/gp_debug.c b/src/gp_debug.c
index 4a141fc..a0f51f0 100644
--- a/src/gp_debug.c
+++ b/src/gp_debug.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2011 the GSS-PROXY contributors, see COPYING for license */
+/* Copyright (C) 2011,2018 the GSS-PROXY contributors, see COPYING for license */
 
 #include "config.h"
 #include <stdbool.h>
@@ -7,35 +7,17 @@
 #include "gp_log.h"
 
 /* global debug switch */
-int gp_debug;
-
-int gp_debug_args(int level) {
-    static int args_level = 0;
-
-    if (level != 0) {
-        args_level = level;
-    }
-    return args_level;
-}
+int gp_debug = 0;
 
 void gp_debug_toggle(int level)
 {
-    static bool krb5_trace_set = false;
+    if (level <= gp_debug)
+        return;
 
-    /* Command line and environment options override config file */
-    gp_debug = gp_debug_args(0);
-    if (gp_debug == 0) {
-        gp_debug = level;
-    }
-    if (level >= 3) {
-        if (!getenv("KRB5_TRACE")) {
-            setenv("KRB5_TRACE", "/dev/stderr", 1);
-            krb5_trace_set = true;
-        }
-    } else if (krb5_trace_set) {
-        unsetenv("KRB5_TRACE");
-        krb5_trace_set = false;
-    }
+    if (level >= 3 && !getenv("KRB5_TRACE"))
+        setenv("KRB5_TRACE", "/dev/stderr", 1);
+
+    gp_debug = level;
     GPDEBUG("Debug Enabled (level: %d)\n", level);
 }
 
diff --git a/src/gp_debug.h b/src/gp_debug.h
index 1c2f8a3..4932bfd 100644
--- a/src/gp_debug.h
+++ b/src/gp_debug.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2011 the GSS-PROXY contributors, see COPYING for license */
+/* Copyright (C) 2011,2018 the GSS-PROXY contributors, see COPYING for license */
 
 #ifndef _GP_DEBUG_H_
 #define _GP_DEBUG_H_
@@ -10,7 +10,6 @@
 
 extern int gp_debug;
 
-int gp_debug_args(int level);
 void gp_debug_toggle(int);
 void gp_debug_printf(const char *format, ...);
 void gp_debug_time_printf(const char *format, ...);
diff --git a/src/gssproxy.c b/src/gssproxy.c
index 6d36a5d..db6e89b 100644
--- a/src/gssproxy.c
+++ b/src/gssproxy.c
@@ -208,7 +208,7 @@ int main(int argc, const char *argv[])
 
     if (opt_debug || opt_debug_level > 0) {
         if (opt_debug_level == 0) opt_debug_level = 1;
-        gp_debug_args(opt_debug_level);
+        gp_debug_toggle(opt_debug_level);
     }
 
     if (opt_daemon && opt_interactive) {