Auth passthrough (auth_query) (#266)

* Add a new exec_simple_query method

This adds a new `exec_simple_query` method so we can make 'out of band'
queries to servers that don't interfere with pools at all.
In order to reuse startup code for making these simple queries,
we need to set the stats (`Reporter`) optional, so using these
simple queries wont interfere with stats.

* Add auth passthough (auth_query)

Adds a feature that allows setting auth passthrough for md5 auth.

It adds 3 new (general and pool) config parameters:

- `auth_query`: An string containing a query that will be executed on boot
to obtain the hash of a given user. This query have to use a placeholder `$1`,
so pgcat can replace it with the user its trying to fetch the hash from.
- `auth_query_user`: The user to use for connecting to the server and executing the
auth_query.
- `auth_query_password`: The password to use for connecting to the server and executing the
auth_query.

The configuration can be done either on the general config (so pools share them) or in a per-pool basis.

The behavior is, at boot time, when validating server connections, a hash is fetched per server
and stored in the pool. When new server connections are created, and no cleartext password is specified,
the obtained hash is used for creating them, if the hash could not be obtained for whatever reason, it retries
it.

When client authentication is tried, it uses cleartext passwords if specified, it not, it checks whether
we have query_auth set up, if so, it tries to use the obtained hash for making client auth. If there is no
hash (we could not obtain one when validating the connection), a new fetch is tried.

Once we have a hash, we authenticate using it against whathever the client has sent us, if there is a failure
we refetch the hash and retry auth (so password changes can be done).

The idea with this 'retrial' mechanism is to make it fault tolerant, so if for whatever reason hash could not be
obtained during connection validation, or the password has change, we can still connect later.

* Add documentation for Auth passthrough

src/pool.rs

@@ -20,6 +20,7 @@ use tokio::sync::Notify;
 use crate::config::{get_config, Address, General, LoadBalancingMode, PoolMode, Role, User};
 use crate::errors::Error;
 
+use crate::auth_passthrough::AuthPassthrough;
 use crate::server::Server;
 use crate::sharding::ShardingFunction;
 use crate::stats::{AddressStats, ClientStats, PoolStats, ServerStats};
@@ -123,6 +124,11 @@ pub struct PoolSettings {
 
     // Limit how much of each query is searched for a potential shard regex match
     pub regex_search_limit: usize,
+
+    // Auth query parameters
+    pub auth_query: Option<String>,
+    pub auth_query_user: Option<String>,
+    pub auth_query_password: Option<String>,
 }
 
 impl Default for PoolSettings {
@@ -143,6 +149,9 @@ impl Default for PoolSettings {
             sharding_key_regex: None,
             shard_id_regex: None,
             regex_search_limit: 1000,
+            auth_query: None,
+            auth_query_user: None,
+            auth_query_password: None,
         }
     }
 }
@@ -183,6 +192,9 @@ pub struct ConnectionPool {
     paused_waiter: Arc<Notify>,
 
     pub stats: Arc<PoolStats>,
+
+    /// AuthInfo
+    pub auth_hash: Arc<RwLock<Option<String>>>,
 }
 
 impl ConnectionPool {
@@ -237,6 +249,7 @@ impl ConnectionPool {
 
                 // Sort by shard number to ensure consistency.
                 shard_ids.sort_by_key(|k| k.parse::<i64>().unwrap());
+                let pool_auth_hash: Arc<RwLock<Option<String>>> = Arc::new(RwLock::new(None));
 
                 for shard_idx in &shard_ids {
                     let shard = &pool_config.shards[shard_idx];
@@ -293,12 +306,35 @@ impl ConnectionPool {
                             replica_number += 1;
                         }
 
+                        // We assume every server in the pool share user/passwords
+                        let auth_passthrough = AuthPassthrough::from_pool_config(pool_config);
+
+                        if let Some(apt) = &auth_passthrough {
+                            match apt.fetch_hash(&address).await {
+				Ok(ok) => {
+				    if let Some(ref pool_auth_hash_value) = *(pool_auth_hash.read()) {
+					if ok != *pool_auth_hash_value {
+					    warn!("Hash is not the same across shards of the same pool, client auth will \
+						   be done using last obtained hash. Server: {}:{}, Database: {}", server.host, server.port, shard.database);
+					}
+				    }
+				    debug!("Hash obtained for {:?}", address);
+				    {
+					let mut pool_auth_hash = pool_auth_hash.write();
+					*pool_auth_hash = Some(ok.clone());
+				    }
+				},
+				Err(err) => warn!("Could not obtain password hashes using auth_query config, ignoring. Error: {:?}", err),
+			    }
+                        }
+
                         let manager = ServerPool::new(
                             address.clone(),
                             user.clone(),
                             &shard.database,
                             client_server_map.clone(),
                             pool_stats.clone(),
+                            pool_auth_hash.clone(),
                         );
 
                         let connect_timeout = match pool_config.connect_timeout {
@@ -330,6 +366,12 @@ impl ConnectionPool {
                 }
 
                 assert_eq!(shards.len(), addresses.len());
+                if let Some(ref _auth_hash) = *(pool_auth_hash.clone().read()) {
+                    info!(
+                        "Auth hash obtained from query_auth for pool {{ name: {}, user: {} }}",
+                        pool_name, user.username
+                    );
+                }
 
                 let pool = ConnectionPool {
                     databases: shards,
@@ -338,6 +380,7 @@ impl ConnectionPool {
                     banlist: Arc::new(RwLock::new(banlist)),
                     config_hash: new_pool_hash_value,
                     server_info: Arc::new(RwLock::new(BytesMut::new())),
+                    auth_hash: pool_auth_hash,
                     settings: PoolSettings {
                         pool_mode: pool_config.pool_mode,
                         load_balancing_mode: pool_config.load_balancing_mode,
@@ -366,6 +409,9 @@ impl ConnectionPool {
                             .clone()
                             .map(|regex| Regex::new(regex.as_str()).unwrap()),
                         regex_search_limit: pool_config.regex_search_limit.unwrap_or(1000),
+                        auth_query: pool_config.auth_query.clone(),
+                        auth_query_user: pool_config.auth_query_user.clone(),
+                        auth_query_password: pool_config.auth_query_password.clone(),
                     },
                     validated: Arc::new(AtomicBool::new(false)),
                     paused: Arc::new(AtomicBool::new(false)),
@@ -389,7 +435,8 @@ impl ConnectionPool {
         Ok(())
     }
 
-    /// Connect to all shards and grab server information.
+    /// Connect to all shards, grab server information, and possibly
+    /// passwords to use in client auth.
     /// Return server information we will pass to the clients
     /// when they connect.
     /// This also warms up the pool for clients that connect when
@@ -803,6 +850,7 @@ pub struct ServerPool {
     database: String,
     client_server_map: ClientServerMap,
     stats: Arc<PoolStats>,
+    auth_hash: Arc<RwLock<Option<String>>>,
 }
 
 impl ServerPool {
@@ -812,6 +860,7 @@ impl ServerPool {
         database: &str,
         client_server_map: ClientServerMap,
         stats: Arc<PoolStats>,
+        auth_hash: Arc<RwLock<Option<String>>>,
     ) -> ServerPool {
         ServerPool {
             address,
@@ -819,6 +868,7 @@ impl ServerPool {
             database: database.to_string(),
             client_server_map,
             stats,
+            auth_hash,
         }
     }
 }
@@ -847,6 +897,7 @@ impl ManageConnection for ServerPool {
             &self.database,
             self.client_server_map.clone(),
             stats.clone(),
+            self.auth_hash.clone(),
         )
         .await
         {