formatted

.github/workflows/publish-deb-package.yml

@@ -1,9 +1,6 @@
 name: pgcat package (deb)
 
 on:
-  push:
-    tags:
-      - v*
   workflow_dispatch:
     inputs:
       packageVersion:
@@ -19,14 +16,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v3
-    - name: Set package version
-      if: github.event_name == 'push'  # For push event
-      run: |
-        TAG=${{ github.ref_name }}
-        echo "packageVersion=${TAG#v}" >> "$GITHUB_ENV"
-    - name: Set package version (manual dispatch)
-      if: github.event_name == 'workflow_dispatch'  # For manual dispatch
-      run: echo "packageVersion=${{ github.event.inputs.packageVersion }}" >> "$GITHUB_ENV"
     - uses: actions-rs/toolchain@v1
       with:
         toolchain: stable
@@ -50,10 +39,10 @@ jobs:
           export ARCH=arm64
         fi
 
-        bash utilities/deb.sh ${{ env.packageVersion }}
+        bash utilities/deb.sh ${{ inputs.packageVersion }}
 
         deb-s3 upload \
           --lock \
           --bucket apt.postgresml.org \
-          pgcat-${{ env.packageVersion }}-ubuntu22.04-${ARCH}.deb \
+          pgcat-${{ inputs.packageVersion }}-ubuntu22.04-${ARCH}.deb \
           --codename $(lsb_release -cs)

postinst

@@ -7,7 +7,3 @@ systemctl enable pgcat
 if ! id pgcat 2> /dev/null; then
 	useradd -s /usr/bin/false pgcat
 fi
-
-if [ -f /etc/pgcat.toml ]; then
-	systemctl start pgcat
-fi

src/auth_passthrough.rs

@@ -1,4 +1,3 @@
-use crate::config::AuthType;
 use crate::errors::Error;
 use crate::pool::ConnectionPool;
 use crate::server::Server;
@@ -72,7 +71,6 @@ impl AuthPassthrough {
     pub async fn fetch_hash(&self, address: &crate::config::Address) -> Result<String, Error> {
         let auth_user = crate::config::User {
             username: self.user.clone(),
-            auth_type: AuthType::MD5,
             password: Some(self.password.clone()),
             server_username: None,
             server_password: None,

src/client.rs

@@ -14,9 +14,7 @@ use tokio::sync::mpsc::Sender;
 
 use crate::admin::{generate_server_parameters_for_admin, handle_admin};
 use crate::auth_passthrough::refetch_auth_hash;
-use crate::config::{
-    get_config, get_idle_client_in_transaction_timeout, Address, AuthType, PoolMode,
-};
+use crate::config::{get_config, get_idle_client_in_transaction_timeout, Address, PoolMode};
 use crate::constants::*;
 use crate::messages::*;
 use crate::plugins::PluginOutput;
@@ -348,6 +346,14 @@ where
         // Client is requesting to cancel a running query (plain text connection).
         CANCEL_REQUEST_CODE => Ok((ClientConnectionType::CancelQuery, bytes)),
 
+        // Client is requesting a GSS encoded connection
+        GSSENC_REQUEST_CODE => {
+            error_response_terminal(stream, "").await?;
+            Err(Error::ProtocolSyncError(
+                "PGCat does not support GSSAPI encoding".into(),
+            ))
+        }
+
         // Something else, probably something is wrong and it's not our fault,
         // e.g. badly implemented Postgres client.
         _ => Err(Error::ProtocolSyncError(format!(
@@ -465,8 +471,8 @@ where
             .count()
             == 1;
 
+        // Kick any client that's not admin while we're in admin-only mode.
         if !admin && admin_only {
-            // Kick any client that's not admin while we're in admin-only mode.
             debug!(
                 "Rejecting non-admin connection to {} when in admin only mode",
                 pool_name
@@ -483,76 +489,72 @@ where
         let process_id: i32 = rand::random();
         let secret_key: i32 = rand::random();
 
+        // Perform MD5 authentication.
+        // TODO: Add SASL support.
+        let salt = md5_challenge(&mut write).await?;
+
+        let code = match read.read_u8().await {
+            Ok(p) => p,
+            Err(_) => {
+                return Err(Error::ClientSocketError(
+                    "password code".into(),
+                    client_identifier,
+                ))
+            }
+        };
+
+        // PasswordMessage
+        if code as char != 'p' {
+            return Err(Error::ProtocolSyncError(format!(
+                "Expected p, got {}",
+                code as char
+            )));
+        }
+
+        let len = match read.read_i32().await {
+            Ok(len) => len,
+            Err(_) => {
+                return Err(Error::ClientSocketError(
+                    "password message length".into(),
+                    client_identifier,
+                ))
+            }
+        };
+
+        let mut password_response = vec![0u8; (len - 4) as usize];
+
+        match read.read_exact(&mut password_response).await {
+            Ok(_) => (),
+            Err(_) => {
+                return Err(Error::ClientSocketError(
+                    "password message".into(),
+                    client_identifier,
+                ))
+            }
+        };
+
         let mut prepared_statements_enabled = false;
 
         // Authenticate admin user.
         let (transaction_mode, mut server_parameters) = if admin {
             let config = get_config();
-            // TODO: Add SASL support.
-            // Perform MD5 authentication.
-            match config.general.admin_auth_type {
-                AuthType::Trust => (),
-                AuthType::MD5 => {
-                    let salt = md5_challenge(&mut write).await?;
 
-                    let code = match read.read_u8().await {
-                        Ok(p) => p,
-                        Err(_) => {
-                            return Err(Error::ClientSocketError(
-                                "password code".into(),
-                                client_identifier,
-                            ))
-                        }
-                    };
+            // Compare server and client hashes.
+            let password_hash = md5_hash_password(
+                &config.general.admin_username,
+                &config.general.admin_password,
+                &salt,
+            );
 
-                    // PasswordMessage
-                    if code as char != 'p' {
-                        return Err(Error::ProtocolSyncError(format!(
-                            "Expected p, got {}",
-                            code as char
-                        )));
-                    }
+            if password_hash != password_response {
+                let error = Error::ClientGeneralError("Invalid password".into(), client_identifier);
 
-                    let len = match read.read_i32().await {
-                        Ok(len) => len,
-                        Err(_) => {
-                            return Err(Error::ClientSocketError(
-                                "password message length".into(),
-                                client_identifier,
-                            ))
-                        }
-                    };
+                warn!("{}", error);
+                wrong_password(&mut write, username).await?;
 
-                    let mut password_response = vec![0u8; (len - 4) as usize];
-
-                    match read.read_exact(&mut password_response).await {
-                        Ok(_) => (),
-                        Err(_) => {
-                            return Err(Error::ClientSocketError(
-                                "password message".into(),
-                                client_identifier,
-                            ))
-                        }
-                    };
-
-                    // Compare server and client hashes.
-                    let password_hash = md5_hash_password(
-                        &config.general.admin_username,
-                        &config.general.admin_password,
-                        &salt,
-                    );
-
-                    if password_hash != password_response {
-                        let error =
-                            Error::ClientGeneralError("Invalid password".into(), client_identifier);
-
-                        warn!("{}", error);
-                        wrong_password(&mut write, username).await?;
-
-                        return Err(error);
-                    }
-                }
+                return Err(error);
             }
+
             (false, generate_server_parameters_for_admin())
         }
         // Authenticate normal user.
@@ -579,143 +581,92 @@ where
             // Obtain the hash to compare, we give preference to that written in cleartext in config
             // if there is nothing set in cleartext and auth passthrough (auth_query) is configured, we use the hash obtained
             // when the pool was created. If there is no hash there, we try to fetch it one more time.
-            match pool.settings.user.auth_type {
-                AuthType::Trust => (),
-                AuthType::MD5 => {
-                    // Perform MD5 authentication.
-                    // TODO: Add SASL support.
-                    let salt = md5_challenge(&mut write).await?;
+            let password_hash = if let Some(password) = &pool.settings.user.password {
+                Some(md5_hash_password(username, password, &salt))
+            } else {
+                if !get_config().is_auth_query_configured() {
+                    wrong_password(&mut write, username).await?;
+                    return Err(Error::ClientAuthImpossible(username.into()));
+                }
 
-                    let code = match read.read_u8().await {
-                        Ok(p) => p,
-                        Err(_) => {
-                            return Err(Error::ClientSocketError(
-                                "password code".into(),
-                                client_identifier,
-                            ))
-                        }
-                    };
+                let mut hash = (*pool.auth_hash.read()).clone();
 
-                    // PasswordMessage
-                    if code as char != 'p' {
-                        return Err(Error::ProtocolSyncError(format!(
-                            "Expected p, got {}",
-                            code as char
-                        )));
-                    }
+                if hash.is_none() {
+                    warn!(
+                        "Query auth configured \
+                          but no hash password found \
+                          for pool {}. Will try to refetch it.",
+                        pool_name
+                    );
 
-                    let len = match read.read_i32().await {
-                        Ok(len) => len,
-                        Err(_) => {
-                            return Err(Error::ClientSocketError(
-                                "password message length".into(),
-                                client_identifier,
-                            ))
-                        }
-                    };
-
-                    let mut password_response = vec![0u8; (len - 4) as usize];
-
-                    match read.read_exact(&mut password_response).await {
-                        Ok(_) => (),
-                        Err(_) => {
-                            return Err(Error::ClientSocketError(
-                                "password message".into(),
-                                client_identifier,
-                            ))
-                        }
-                    };
-
-                    let password_hash = if let Some(password) = &pool.settings.user.password {
-                        Some(md5_hash_password(username, password, &salt))
-                    } else {
-                        if !get_config().is_auth_query_configured() {
-                            wrong_password(&mut write, username).await?;
-                            return Err(Error::ClientAuthImpossible(username.into()));
-                        }
-
-                        let mut hash = (*pool.auth_hash.read()).clone();
-
-                        if hash.is_none() {
-                            warn!(
-                                "Query auth configured \
-                                  but no hash password found \
-                                  for pool {}. Will try to refetch it.",
-                                pool_name
-                            );
-
-                            match refetch_auth_hash(&pool).await {
-                                Ok(fetched_hash) => {
-                                    warn!(
-                                        "Password for {}, obtained. Updating.",
-                                        client_identifier
-                                    );
-
-                                    {
-                                        let mut pool_auth_hash = pool.auth_hash.write();
-                                        *pool_auth_hash = Some(fetched_hash.clone());
-                                    }
-
-                                    hash = Some(fetched_hash);
-                                }
-
-                                Err(err) => {
-                                    wrong_password(&mut write, username).await?;
-
-                                    return Err(Error::ClientAuthPassthroughError(
-                                        err.to_string(),
-                                        client_identifier,
-                                    ));
-                                }
-                            }
-                        };
-
-                        Some(md5_hash_second_pass(&hash.unwrap(), &salt))
-                    };
-
-                    // Once we have the resulting hash, we compare with what the client gave us.
-                    // If they do not match and auth query is set up, we try to refetch the hash one more time
-                    // to see if the password has changed since the pool was created.
-                    //
-                    // @TODO: we could end up fetching again the same password twice (see above).
-                    if password_hash.unwrap() != password_response {
-                        warn!(
-                            "Invalid password {}, will try to refetch it.",
-                            client_identifier
-                        );
-
-                        let fetched_hash = match refetch_auth_hash(&pool).await {
-                            Ok(fetched_hash) => fetched_hash,
-                            Err(err) => {
-                                wrong_password(&mut write, username).await?;
-
-                                return Err(err);
-                            }
-                        };
-
-                        let new_password_hash = md5_hash_second_pass(&fetched_hash, &salt);
-
-                        // Ok password changed in server an auth is possible.
-                        if new_password_hash == password_response {
-                            warn!(
-                                "Password for {}, changed in server. Updating.",
-                                client_identifier
-                            );
+                    match refetch_auth_hash(&pool).await {
+                        Ok(fetched_hash) => {
+                            warn!("Password for {}, obtained. Updating.", client_identifier);
 
                             {
                                 let mut pool_auth_hash = pool.auth_hash.write();
-                                *pool_auth_hash = Some(fetched_hash);
+                                *pool_auth_hash = Some(fetched_hash.clone());
                             }
-                        } else {
+
+                            hash = Some(fetched_hash);
+                        }
+
+                        Err(err) => {
                             wrong_password(&mut write, username).await?;
-                            return Err(Error::ClientGeneralError(
-                                "Invalid password".into(),
+
+                            return Err(Error::ClientAuthPassthroughError(
+                                err.to_string(),
                                 client_identifier,
                             ));
                         }
                     }
+                };
+
+                Some(md5_hash_second_pass(&hash.unwrap(), &salt))
+            };
+
+            // Once we have the resulting hash, we compare with what the client gave us.
+            // If they do not match and auth query is set up, we try to refetch the hash one more time
+            // to see if the password has changed since the pool was created.
+            //
+            // @TODO: we could end up fetching again the same password twice (see above).
+            if password_hash.unwrap() != password_response {
+                warn!(
+                    "Invalid password {}, will try to refetch it.",
+                    client_identifier
+                );
+
+                let fetched_hash = match refetch_auth_hash(&pool).await {
+                    Ok(fetched_hash) => fetched_hash,
+                    Err(err) => {
+                        wrong_password(&mut write, username).await?;
+
+                        return Err(err);
+                    }
+                };
+
+                let new_password_hash = md5_hash_second_pass(&fetched_hash, &salt);
+
+                // Ok password changed in server an auth is possible.
+                if new_password_hash == password_response {
+                    warn!(
+                        "Password for {}, changed in server. Updating.",
+                        client_identifier
+                    );
+
+                    {
+                        let mut pool_auth_hash = pool.auth_hash.write();
+                        *pool_auth_hash = Some(fetched_hash);
+                    }
+                } else {
+                    wrong_password(&mut write, username).await?;
+                    return Err(Error::ClientGeneralError(
+                        "Invalid password".into(),
+                        client_identifier,
+                    ));
                 }
             }
+
             let transaction_mode = pool.settings.pool_mode == PoolMode::Transaction;
             prepared_statements_enabled =
                 transaction_mode && pool.prepared_statement_cache.is_some();

src/config.rs

@@ -208,9 +208,6 @@ impl Address {
 pub struct User {
     pub username: String,
     pub password: Option<String>,
-
-    #[serde(default = "User::default_auth_type")]
-    pub auth_type: AuthType,
     pub server_username: Option<String>,
     pub server_password: Option<String>,
     pub pool_size: u32,
@@ -228,7 +225,6 @@ impl Default for User {
         User {
             username: String::from("postgres"),
             password: None,
-            auth_type: AuthType::MD5,
             server_username: None,
             server_password: None,
             pool_size: 15,
@@ -243,10 +239,6 @@ impl Default for User {
 }
 
 impl User {
-    pub fn default_auth_type() -> AuthType {
-        AuthType::MD5
-    }
-
     fn validate(&self) -> Result<(), Error> {
         if let Some(min_pool_size) = self.min_pool_size {
             if min_pool_size > self.pool_size {
@@ -342,9 +334,6 @@ pub struct General {
     pub admin_username: String,
     pub admin_password: String,
 
-    #[serde(default = "General::default_admin_auth_type")]
-    pub admin_auth_type: AuthType,
-
     #[serde(default = "General::default_validate_config")]
     pub validate_config: bool,
 
@@ -359,10 +348,6 @@ impl General {
         "0.0.0.0".into()
     }
 
-    pub fn default_admin_auth_type() -> AuthType {
-        AuthType::MD5
-    }
-
     pub fn default_port() -> u16 {
         5432
     }
@@ -471,7 +456,6 @@ impl Default for General {
             verify_server_certificate: false,
             admin_username: String::from("admin"),
             admin_password: String::from("admin"),
-            admin_auth_type: AuthType::MD5,
             validate_config: true,
             auth_query: None,
             auth_query_user: None,
@@ -492,15 +476,6 @@ pub enum PoolMode {
     Session,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Copy, Hash)]
-pub enum AuthType {
-    #[serde(alias = "trust", alias = "Trust")]
-    Trust,
-
-    #[serde(alias = "md5", alias = "MD5")]
-    MD5,
-}
-
 impl std::fmt::Display for PoolMode {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {

src/constants.rs

@@ -11,6 +11,9 @@ pub const SSL_REQUEST_CODE: i32 = 80877103;
 // CancelRequest: the cancel request code.
 pub const CANCEL_REQUEST_CODE: i32 = 80877102;
 
+// GSSENCRequest: used to indicate we wants GSS connection
+pub const GSSENC_REQUEST_CODE: i32 = 80877104;
+
 // AuthenticationMD5Password
 pub const MD5_ENCRYPTED_PASSWORD: i32 = 5;
 

src/prometheus.rs

@@ -200,17 +200,18 @@ struct PrometheusMetric<Value: fmt::Display> {
 
 impl<Value: fmt::Display> fmt::Display for PrometheusMetric<Value> {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        let mut sorted_labels: Vec<_> = self.labels.iter().collect();
-        sorted_labels.sort_by_key(|&(key, _)| key);
-        let formatted_labels = sorted_labels
+        let formatted_labels = self
+            .labels
             .iter()
             .map(|(key, value)| format!("{}=\"{}\"", key, value))
             .collect::<Vec<_>>()
             .join(",");
         write!(
             f,
-            "{name}{{{formatted_labels}}} {value}",
+            "# HELP {name} {help}\n# TYPE {name} {ty}\n{name}{{{formatted_labels}}} {value}\n",
             name = format_args!("pgcat_{}", self.name),
+            help = self.help,
+            ty = self.ty,
             formatted_labels = formatted_labels,
             value = self.value
         )
@@ -246,7 +247,7 @@ impl<Value: fmt::Display> PrometheusMetric<Value> {
         labels.insert("pool", address.pool_name.clone());
         labels.insert("index", address.address_index.to_string());
         labels.insert("database", address.database.to_string());
-        labels.insert("username", address.username.clone());
+        labels.insert("user", address.username.clone());
 
         Self::from_name(&format!("databases_{}", name), value, labels)
     }
@@ -263,8 +264,7 @@ impl<Value: fmt::Display> PrometheusMetric<Value> {
         labels.insert("pool", address.pool_name.clone());
         labels.insert("index", address.address_index.to_string());
         labels.insert("database", address.database.to_string());
-        labels.insert("username", address.username.clone());
-
+        labels.insert("user", address.username.clone());
         Self::from_name(&format!("servers_{}", name), value, labels)
     }
 
@@ -276,7 +276,7 @@ impl<Value: fmt::Display> PrometheusMetric<Value> {
         labels.insert("role", address.role.to_string());
         labels.insert("index", address.address_index.to_string());
         labels.insert("database", address.database.to_string());
-        labels.insert("username", address.username.clone());
+        labels.insert("user", address.username.clone());
 
         Self::from_name(&format!("stats_{}", name), value, labels)
     }
@@ -288,15 +288,6 @@ impl<Value: fmt::Display> PrometheusMetric<Value> {
 
         Self::from_name(&format!("pools_{}", name), value, labels)
     }
-
-    fn get_header(&self) -> String {
-        format!(
-            "\n# HELP {name} {help}\n# TYPE {name} {ty}",
-            name = format_args!("pgcat_{}", self.name),
-            help = self.help,
-            ty = self.ty,
-        )
-    }
 }
 
 async fn prometheus_stats(
@@ -322,7 +313,6 @@ async fn prometheus_stats(
 
 // Adds metrics shown in a SHOW STATS admin command.
 fn push_address_stats(lines: &mut Vec<String>) {
-    let mut grouped_metrics: HashMap<String, Vec<PrometheusMetric<u64>>> = HashMap::new();
     for (_, pool) in get_all_pools() {
         for shard in 0..pool.shards() {
             for server in 0..pool.servers(shard) {
@@ -332,10 +322,7 @@ fn push_address_stats(lines: &mut Vec<String>) {
                     if let Some(prometheus_metric) =
                         PrometheusMetric::<u64>::from_address(address, &key, value)
                     {
-                        grouped_metrics
-                            .entry(key)
-                            .or_default()
-                            .push(prometheus_metric);
+                        lines.push(prometheus_metric.to_string());
                     } else {
                         debug!("Metric {} not implemented for {}", key, address.name());
                     }
@@ -343,53 +330,33 @@ fn push_address_stats(lines: &mut Vec<String>) {
             }
         }
     }
-    for (_key, metrics) in grouped_metrics {
-        if !metrics.is_empty() {
-            lines.push(metrics[0].get_header());
-            for metric in metrics {
-                lines.push(metric.to_string());
-            }
-        }
-    }
 }
 
 // Adds relevant metrics shown in a SHOW POOLS admin command.
 fn push_pool_stats(lines: &mut Vec<String>) {
-    let mut grouped_metrics: HashMap<String, Vec<PrometheusMetric<u64>>> = HashMap::new();
     let pool_stats = PoolStats::construct_pool_lookup();
     for (pool_id, stats) in pool_stats.iter() {
         for (name, value) in stats.clone() {
             if let Some(prometheus_metric) =
                 PrometheusMetric::<u64>::from_pool(pool_id.clone(), &name, value)
             {
-                grouped_metrics
-                    .entry(name)
-                    .or_default()
-                    .push(prometheus_metric);
+                lines.push(prometheus_metric.to_string());
             } else {
                 debug!("Metric {} not implemented for ({})", name, *pool_id);
             }
         }
     }
-    for (_key, metrics) in grouped_metrics {
-        if !metrics.is_empty() {
-            lines.push(metrics[0].get_header());
-            for metric in metrics {
-                lines.push(metric.to_string());
-            }
-        }
-    }
 }
 
 // Adds relevant metrics shown in a SHOW DATABASES admin command.
 fn push_database_stats(lines: &mut Vec<String>) {
-    let mut grouped_metrics: HashMap<String, Vec<PrometheusMetric<u32>>> = HashMap::new();
     for (_, pool) in get_all_pools() {
         let pool_config = pool.settings.clone();
         for shard in 0..pool.shards() {
             for server in 0..pool.servers(shard) {
                 let address = pool.address(shard, server);
                 let pool_state = pool.pool_state(shard, server);
+
                 let metrics = vec![
                     ("pool_size", pool_config.user.pool_size),
                     ("current_connections", pool_state.connections),
@@ -398,10 +365,7 @@ fn push_database_stats(lines: &mut Vec<String>) {
                     if let Some(prometheus_metric) =
                         PrometheusMetric::<u32>::from_database_info(address, key, value)
                     {
-                        grouped_metrics
-                            .entry(key.to_string())
-                            .or_default()
-                            .push(prometheus_metric);
+                        lines.push(prometheus_metric.to_string());
                     } else {
                         debug!("Metric {} not implemented for {}", key, address.name());
                     }
@@ -409,14 +373,6 @@ fn push_database_stats(lines: &mut Vec<String>) {
             }
         }
     }
-    for (_key, metrics) in grouped_metrics {
-        if !metrics.is_empty() {
-            lines.push(metrics[0].get_header());
-            for metric in metrics {
-                lines.push(metric.to_string());
-            }
-        }
-    }
 }
 
 // Adds relevant metrics shown in a SHOW SERVERS admin command.
@@ -449,7 +405,7 @@ fn push_server_stats(lines: &mut Vec<String>) {
             crate::stats::ServerState::Idle => entry.idle_count += 1,
         }
     }
-    let mut grouped_metrics: HashMap<String, Vec<PrometheusMetric<u64>>> = HashMap::new();
+
     for (_, pool) in get_all_pools() {
         for shard in 0..pool.shards() {
             for server in 0..pool.servers(shard) {
@@ -472,10 +428,7 @@ fn push_server_stats(lines: &mut Vec<String>) {
                         if let Some(prometheus_metric) =
                             PrometheusMetric::<u64>::from_server_info(address, key, value)
                         {
-                            grouped_metrics
-                                .entry(key.to_string())
-                                .or_default()
-                                .push(prometheus_metric);
+                            lines.push(prometheus_metric.to_string());
                         } else {
                             debug!("Metric {} not implemented for {}", key, address.name());
                         }
@@ -484,14 +437,6 @@ fn push_server_stats(lines: &mut Vec<String>) {
             }
         }
     }
-    for (_key, metrics) in grouped_metrics {
-        if !metrics.is_empty() {
-            lines.push(metrics[0].get_header());
-            for metric in metrics {
-                lines.push(metric.to_string());
-            }
-        }
-    }
 }
 
 pub async fn start_metric_server(http_addr: SocketAddr) {

tests/docker/Dockerfile

@@ -2,7 +2,9 @@ FROM rust:bullseye
 
 COPY --from=sclevine/yj /bin/yj /bin/yj
 RUN /bin/yj -h
-RUN apt-get update && apt-get install llvm-11 psmisc postgresql-contrib postgresql-client ruby ruby-dev libpq-dev python3 python3-pip lcov curl sudo iproute2 -y
+RUN apt-get update && apt-get install llvm-11 psmisc postgresql-contrib postgresql-client ruby ruby-dev libpq-dev python3 python3-pip lcov curl sudo iproute2 gnupg lsb-release -y
+RUN env DEBIAN_FRONTEND=noninteractive apt-get -y install krb5-kdc krb5-admin-server krb5-user
+
 RUN cargo install cargo-binutils rustfilt
 RUN rustup component add llvm-tools-preview
 RUN sudo gem install bundler

tests/python/test_auth.py

@@ -1,71 +0,0 @@
-import utils
-import signal
-
-class TestTrustAuth:
-    @classmethod
-    def setup_method(cls):
-        config= """
-        [general]
-        host = "0.0.0.0"
-        port = 6432
-        admin_username = "admin_user"
-        admin_password = ""
-        admin_auth_type = "trust"
-
-        [pools.sharded_db.users.0]
-        username = "sharding_user"
-        password = "sharding_user"
-        auth_type = "trust"
-        pool_size = 10
-        min_pool_size = 1
-        pool_mode = "transaction"
-
-        [pools.sharded_db.shards.0]
-        servers = [
-          [ "127.0.0.1", 5432, "primary" ],
-        ]
-        database = "shard0"
-        """
-        utils.pgcat_generic_start(config)
-
-    @classmethod
-    def teardown_method(self):
-        utils.pg_cat_send_signal(signal.SIGTERM)
-
-    def test_admin_trust_auth(self):
-        conn, cur = utils.connect_db_trust(admin=True)
-        cur.execute("SHOW POOLS")
-        res = cur.fetchall()
-        print(res)
-        utils.cleanup_conn(conn, cur)
-
-    def test_normal_trust_auth(self):
-        conn, cur = utils.connect_db_trust(autocommit=False)
-        cur.execute("SELECT 1")
-        res = cur.fetchall()
-        print(res)
-        utils.cleanup_conn(conn, cur)
-
-class TestMD5Auth:
-    @classmethod
-    def setup_method(cls):
-        utils.pgcat_start()
-
-    @classmethod
-    def teardown_method(self):
-        utils.pg_cat_send_signal(signal.SIGTERM)
-
-    def test_normal_db_access(self):
-        conn, cur = utils.connect_db(autocommit=False)
-        cur.execute("SELECT 1")
-        res = cur.fetchall()
-        print(res)
-        utils.cleanup_conn(conn, cur)
-
-    def test_admin_db_access(self):
-        conn, cur = utils.connect_db(admin=True)
-
-        cur.execute("SHOW POOLS")
-        res = cur.fetchall()
-        print(res)
-        utils.cleanup_conn(conn, cur)

tests/python/test_krb.py

@@ -0,0 +1,94 @@
+import signal
+import socket
+import subprocess
+import utils
+
+REALM = 'EXAMPLE.COM'
+SUPPORTED_ENCRYPTION_TYPES = 'aes256-cts-hmac-sha1-96:normal'
+KADMIN_PRINCIPAL = 'root'
+KADMIN_PASSWORD = 'root'
+KDC_KADMIN_SERVER = socket.gethostname()
+
+LOGDIR = 'log'
+PG_LOG = f'{LOGDIR}/krb.log'
+# Assumes packages are installed; krb5-kdc and krb5-admin-server on debian
+KADMIN_PRINCIPAL_FULL = f'{KADMIN_PRINCIPAL}@{REALM}'
+MASTER_PASSWORD = 'master_password'
+
+
+def setup_krb():
+    krb5_conf = f"""
+[libdefaults]
+        default_realm = {REALM}
+        rdns = false
+
+[realms]
+        {REALM} = {{
+                kdc_ports = 88,750
+                kadmind_port = 749
+                kdc = {KDC_KADMIN_SERVER}
+                admin_server = {KDC_KADMIN_SERVER}
+        }}
+    """
+    with open("/etc/krb5.conf", "w") as text_file:
+        text_file.write(krb5_conf)
+
+    kdc_conf = f"""
+[realms]
+        {REALM} = {{
+                acl_file = /etc/krb5kdc/kadm5.acl
+                max_renewable_life = 7d 0h 0m 0s
+                supported_enctypes = {SUPPORTED_ENCRYPTION_TYPES}
+                default_principal_flags = +preauth
+        }}
+    """
+    with open("/etc/krb5kdc/kdc.conf", "w") as text_file:
+        text_file.write(kdc_conf)
+
+    kadm5_acl = f"""
+    {KADMIN_PRINCIPAL_FULL} *
+    """
+    with open("/etc/krb5kdc/kadm5.acl", "w") as text_file:
+        text_file.write(kadm5_acl)
+
+    kerberos_command = f"""
+    krb5_newrealm <<EOF
+    {MASTER_PASSWORD}
+    {MASTER_PASSWORD}
+    EOF
+    """
+    subprocess.run(kerberos_command, check=False, shell=True)
+
+    delete_principal = f'kadmin.local -q "delete_principal -force {KADMIN_PRINCIPAL_FULL}"'
+    subprocess.run(delete_principal, check=True, shell=True)
+
+    create_principal = f'kadmin.local -q "addprinc -pw {KADMIN_PASSWORD} {KADMIN_PRINCIPAL_FULL}"'
+    subprocess.run(create_principal, check=True, shell=True)
+
+    kinit_command = f'echo {KADMIN_PASSWORD} | kinit'
+    subprocess.run(kinit_command, check=True, shell=True)
+
+    utils.pgcat_start()
+
+
+def teardown_krb():
+    subprocess.run('kdestroy', check=True, shell=True)
+
+    delete_principal = f'kadmin.local -q "delete_principal -force {KADMIN_PRINCIPAL_FULL}"'
+    subprocess.run(delete_principal, check=True, shell=True)
+
+    utils.pg_cat_send_signal(signal.SIGINT)
+
+
+def test_krb():
+    setup_krb()
+    # TODO test connect to database
+
+    utils.pgcat_start()
+    conn, cur = utils.connect_db(autocommit=False)
+    cur.execute("SELECT 1")
+    res = cur.fetchall()
+    print(res)
+    utils.cleanup_conn(conn, cur)
+
+    teardown_krb()

tests/python/test_pgcat.py

@@ -1,12 +1,30 @@
-
+import os
 import signal
 import time
 
 import psycopg2
+
 import utils
 
 SHUTDOWN_TIMEOUT = 5
 
+def test_normal_db_access():
+    utils.pgcat_start()
+    conn, cur = utils.connect_db(autocommit=False)
+    cur.execute("SELECT 1")
+    res = cur.fetchall()
+    print(res)
+    utils.cleanup_conn(conn, cur)
+
+
+def test_admin_db_access():
+    conn, cur = utils.connect_db(admin=True)
+
+    cur.execute("SHOW POOLS")
+    res = cur.fetchall()
+    print(res)
+    utils.cleanup_conn(conn, cur)
+
 
 def test_shutdown_logic():
 
@@ -238,5 +256,3 @@ def test_shutdown_logic():
 
     utils.cleanup_conn(conn, cur)
     utils.pg_cat_send_signal(signal.SIGTERM)
-
-    # - - - - - - - - - - - - - - - - - -

tests/python/utils.py

@@ -1,47 +1,18 @@
+from typing import Tuple
 import os
+import psutil
 import signal
 import time
-from typing import Tuple
-import tempfile
 
-import psutil
 import psycopg2
 
 PGCAT_HOST = "127.0.0.1"
 PGCAT_PORT = "6432"
 
-
-def _pgcat_start(config_path: str):
-    pg_cat_send_signal(signal.SIGTERM)
-    os.system(f"./target/debug/pgcat {config_path} &")
-    time.sleep(2)
-
-
 def pgcat_start():
-    _pgcat_start(config_path='.circleci/pgcat.toml')
-
-
-def pgcat_generic_start(config: str):
-    tmp = tempfile.NamedTemporaryFile()
-    with open(tmp.name, 'w') as f:
-        f.write(config)
-    _pgcat_start(config_path=tmp.name)
-
-
-def glauth_send_signal(signal: signal.Signals):
-    try:
-        for proc in psutil.process_iter(["pid", "name"]):
-            if proc.name() == "glauth":
-                os.kill(proc.pid, signal)
-    except Exception as e:
-        # The process can be gone when we send this signal
-        print(e)
-
-    if signal == signal.SIGTERM:
-        # Returns 0 if pgcat process exists
-        time.sleep(2)
-        if not os.system('pgrep glauth'):
-            raise Exception("glauth not closed after SIGTERM")
+    pg_cat_send_signal(signal.SIGTERM)
+    os.system("./target/debug/pgcat .circleci/pgcat.toml &")
+    time.sleep(2)
 
 
 def pg_cat_send_signal(signal: signal.Signals):
@@ -83,27 +54,6 @@ def connect_db(
 
     return (conn, cur)
 
-def connect_db_trust(
-    autocommit: bool = True,
-    admin: bool = False,
-) -> Tuple[psycopg2.extensions.connection, psycopg2.extensions.cursor]:
-
-    if admin:
-        user = "admin_user"
-        db = "pgcat"
-    else:
-        user = "sharding_user"
-        db = "sharded_db"
-
-    conn = psycopg2.connect(
-        f"postgres://{user}@{PGCAT_HOST}:{PGCAT_PORT}/{db}?application_name=testing_pgcat",
-        connect_timeout=2,
-    )
-    conn.autocommit = autocommit
-    cur = conn.cursor()
-
-    return (conn, cur)
-
 
 def cleanup_conn(conn: psycopg2.extensions.connection, cur: psycopg2.extensions.cursor):
     cur.close()