ldap: add timeout and retry-backoff for ldap (#51927)

[ti-chi-bot]

This is an automated cherry-pick of #51927

What problem does this PR solve?

Issue Number: close #51883

This PR is a smaller version of #51912. We'll finally get #51912 merged, but we need a smaller one to focus on the timeout mechanism (which is much simpler than refactor the locks).

If the LDAP connection lost after the first handshake, the LDAP goroutine and function call will hang forever.

What changed and how does it work?

I have done two modifications in this PR:

1. Add a timeout for LDAP dialing and requests. Therefore, the lock will be held for at most several seconds.
2. Add an interval to the retry mechanism, to avoid using all quotas provided by the LDAP service.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

docker run --network host -it yangkeao/ldap-sasl-example:d2b324 /bin/bash to get an environment with LDAP server. Then running a TiDB server at port 4000.

Create user, setup variables, and prepare CA:

set global authentication_ldap_sasl_server_host='127.0.0.1';
set global authentication_ldap_sasl_bind_root_dn='cn=admin,dc=example,dc=org';
set global authentication_ldap_sasl_bind_root_pwd='123456';
set global authentication_ldap_sasl_ca_path='/tmp/ca.crt';
set global authentication_ldap_simple_server_host='127.0.0.1';
set global authentication_ldap_simple_bind_root_dn='cn=admin,dc=example,dc=org';
set global authentication_ldap_simple_bind_root_pwd='123456';
set global authentication_ldap_simple_ca_path='/tmp/ca.crt';
create user yangkeao IDENTIFIED WITH authentication_ldap_simple as 'cn=yangkeao+uid=yangkeao,dc=example,dc=org';

sudo cp /proc/$(pidof mysqld)/root/etc/ssl/certs/example.crt /tmp/ca.crt

Then you can login to TiDB with yangkeao user:

LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456

Enable or disable authentication_ldap_simple_tls are both fine.

Use the following iptables command to drop all packets to LDAP server:

sudo iptables -A INPUT -p tcp --dport 389 -j DROP

Then login without TLS will timeout after 10 seconds:

root@home:/# time LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'yangkeao'@'127.0.0.1' (using password: YES)

real    0m10.023s
user    0m0.000s
sys     0m0.009s

Then login with TLS will timeout after 20 seconds:

root@home:/# time LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 mysql -h 127.0.0.1 -u yangkeao -P 4000 -p123456
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'yangkeao'@'127.0.0.1' (using password: YES)

real    0m20.023s
user    0m0.005s
sys     0m0.004s

This PR also fixed some tiny issues: like rebuilding the connection pool after resetting the connection related variables, to avoid having wrong connection in the pool.

Release note

None

[YangKeao]

LGTM

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (release-7.1@1c78eed). Click here to learn what that means.
The diff coverage is 57.8947%.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-7.1     #51943   +/-   ##
================================================
  Coverage               ?   73.4420%           
================================================
  Files                  ?       1211           
  Lines                  ?     379785           
  Branches               ?          0           
================================================
  Hits                   ?     278922           
  Misses                 ?      83051           
  Partials               ?      17812           

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CbcWestwolf, YangKeao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [CbcWestwolf,YangKeao]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2024-04-12 08:33:38.270507721 +0000 UTC m=+1210479.798048259: ☑️ agreed by YangKeao.
• 2024-04-12 08:46:10.637634486 +0000 UTC m=+1211232.165175031: ☑️ agreed by CbcWestwolf.