{185248490} Skip external auth tunable in cdb2_sqlreplay by default, add flag to override

Signed-off-by: Salil Chandra <schandra107@bloomberg.net>

Author: chands10

tests/cdb2_sqlreplay_externalauth.test/Makefile

@@ -0,0 +1,8 @@
+ifeq ($(TESTSROOTDIR),)
+  include ../testcase.mk
+else
+  include $(TESTSROOTDIR)/testcase.mk
+endif
+ifeq ($(TEST_TIMEOUT),)
+	export TEST_TIMEOUT=5m
+endif

tests/cdb2_sqlreplay_externalauth.test/runit

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+bash -n "$0" | exit 1
+
+# Verify that cdb2_sqlreplay skips 'PUT TUNABLE externalauth' by default, and
+# replays it when --replay-externalauth is given.  We assert on the tool's own
+# (verbose) behavior rather than flipping externalauth on a live db, since
+# enabling externalauth can break connectivity for a db with no auth backend.
+
+source ${TESTSROOTDIR}/tools/runit_common.sh
+
+CDB2_SQLREPLAY_EXE=${CDB2_SQLREPLAY_EXE:-${BUILDDIR}/tools/cdb2_sqlreplay/cdb2_sqlreplay}
+
+cdb2sql ${CDB2_OPTIONS} ${DBNAME} default "create table t1 { schema { int id } }"
+
+# Build a replay log.  Each line is one JSON event as emitted by the event
+# logger.  We interleave marker inserts with several 'put tunable externalauth'
+# variants (quoted, uppercase) plus a similarly-named tunable that must NOT be
+# skipped (externalauth_warn).
+cat > replay.log <<'EOF'
+{"type":"sql","time":1,"sql":"insert into t1(id) values(1)"}
+{"type":"sql","time":2,"sql":"put tunable externalauth 'off'"}
+{"type":"sql","time":3,"sql":"PUT TUNABLE externalauth 'off'"}
+{"type":"sql","time":4,"sql":"put tunable externalauth_warn 'off'"}
+{"type":"sql","time":5,"sql":"insert into t1(id) values(2)"}
+EOF
+
+########################################################################
+# Default behavior: externalauth statements are skipped.
+########################################################################
+echo "=== default replay (externalauth should be skipped) ==="
+${CDB2_SQLREPLAY_EXE} --verbose ${DBNAME} replay.log > default.out 2>&1
+cat default.out
+
+# Both externalauth variants must be skipped ...
+skipped=$(grep -c "^skipping.*externalauth" default.out)
+assertres $skipped 2
+
+# ... and the executed (bare) sql line for them must be absent.
+ran=$(grep -c "^put tunable externalauth 'off'$" default.out)
+assertres $ran 0
+ran=$(grep -c "^PUT TUNABLE externalauth 'off'$" default.out)
+assertres $ran 0
+
+# The lookalike tunable must NOT be skipped.
+skippedwarn=$(grep -c "skipping.*externalauth_warn" default.out)
+assertres $skippedwarn 0
+
+# Replay must continue past the skipped statements: both markers inserted.
+cnt=$(cdb2sql --tabs ${CDB2_OPTIONS} ${DBNAME} default "select count(*) from t1")
+assertres $cnt 2
+
+########################################################################
+# --replay-externalauth: externalauth statements are replayed.
+########################################################################
+cdb2sql ${CDB2_OPTIONS} ${DBNAME} default "truncate t1"
+
+echo "=== replay with --replay-externalauth (externalauth should run) ==="
+${CDB2_SQLREPLAY_EXE} --verbose --replay-externalauth ${DBNAME} replay.log > allow.out 2>&1
+cat allow.out
+
+# Nothing should be skipped now.
+skipped=$(grep -c "^skipping" allow.out)
+assertres $skipped 0
+
+# The externalauth statements must actually be handed to the server (verbose
+# prints the bare sql line right before running it).
+ran=$(grep -c "^put tunable externalauth 'off'$" allow.out)
+assertres $ran 1
+ran=$(grep -c "^PUT TUNABLE externalauth 'off'$" allow.out)
+assertres $ran 1
+
+# Every replayed statement (including externalauth) executed without error.
+errs=$(grep -c "Error: run rc" allow.out)
+assertres $errs 0
+
+# Connection stays healthy and markers still replay.
+cnt=$(cdb2sql --tabs ${CDB2_OPTIONS} ${DBNAME} default "select count(*) from t1")
+assertres $cnt 2
+
+echo "Success"
+exit 0

tools/cdb2_sqlreplay/cdb2_sqlreplay.cpp

@@ -50,6 +50,7 @@ std::map<std::string, std::list<cson_value*>> transactions;
 
 bool diffs = false;
 bool verbose = false;
+bool replay_externalauth = false; /* skip 'PUT TUNABLE externalauth' by default */
 int threshold_percent = 5;
 
 int64_t maxevents = 0;
@@ -64,6 +65,8 @@ static const char *usage_text =
     "  --verbose              Lots of verbose output\n"
     "  --threshold N          Set diff threshold to N% (default 5)\n"
     "  --stopat N             Stop after N events processed\n"
+    "  --replay-externalauth  Replay 'PUT TUNABLE externalauth' statements\n"
+    "                         (skipped by default)\n"
     "\n"
     ;
 
@@ -699,6 +702,26 @@ void dump_sql_event(cson_value *event) {
     printf("tranid 0 %s", sql.c_str());
 }
 
+/* Detect a 'PUT TUNABLE externalauth ...' statement (case-insensitive). The
+   tunable name may optionally be quoted, e.g. put tunable 'externalauth' 1. */
+static bool is_put_tunable_externalauth(const char *sql) {
+    if (sql == nullptr)
+        return false;
+    std::string s(sql);
+    std::transform(s.begin(), s.end(), s.begin(), ::tolower);
+    std::istringstream iss(s);
+    std::vector<std::string> toks;
+    std::string tok;
+    while (iss >> tok)
+        toks.push_back(tok);
+    if (toks.size() < 3 || toks[0] != "put" || toks[1] != "tunable")
+        return false;
+    std::string name = toks[2];
+    if (name.size() >= 2 && (name.front() == '\'' || name.front() == '"'))
+        name = name.substr(1, name.size() - 2);
+    return name == "externalauth";
+}
+
 void replay(cdb2_hndl_tp *db, cson_value *event_val) {
     const char *sql = get_strprop(event_val, "sql");
     if(sql == nullptr) {
@@ -715,6 +738,12 @@ void replay(cdb2_hndl_tp *db, cson_value *event_val) {
 	    sql = (*s).second.c_str();
     }
 
+    if (!replay_externalauth && is_put_tunable_externalauth(sql)) {
+        if (verbose)
+            std::cout << "skipping (use --replay-externalauth to replay): " << sql << std::endl;
+        return;
+    }
+
     std::vector<uint8_t *> blobs_vect;
     bool ok = do_bindings(db, event_val, blobs_vect);
     if (!ok) {
@@ -1126,6 +1155,8 @@ int main(int argc, char **argv) {
             }
             threshold_percent = (int) strtol(argv[0], nullptr, 10);
         }
+        else if (strcmp(argv[0], "--replay-externalauth") == 0)
+            replay_externalauth = true;
         else if (strcmp(argv[0], "--stopat") == 0) {
             argc--;
             argv++;