authenticateChildClient runs the cleartext-password handshake for a child worker connection. The password is always requested before any credential check, and validation is constant-time via auth.ValidateUserPassword, so an unknown user and a wrong password are indistinguishable to the client in bot
(reader *bufio.Reader, writer *bufio.Writer, users map[string]string, username, remoteAddr string)
| 134 | // unknown user and a wrong password are indistinguishable to the client in |
| 135 | // both protocol flow and error shape. Returns ExitSuccess after sending |
| 136 | // AuthOK, or the exit code to terminate with on failure. |
| 137 | func authenticateChildClient(reader *bufio.Reader, writer *bufio.Writer, users map[string]string, username, remoteAddr string) int { |
| 138 | // Request password |
| 139 | if err := wire.WriteAuthCleartextPassword(writer); err != nil { |
| 140 | slog.Error("Failed to request password", "error", err) |
| 141 | return ExitError |
| 142 | } |
| 143 | if err := writer.Flush(); err != nil { |
| 144 | slog.Error("Failed to flush writer", "error", err) |
| 145 | return ExitError |
| 146 | } |
| 147 | |
| 148 | // Read password response |
| 149 | msgType, body, err := wire.ReadMessage(reader) |
| 150 | if err != nil { |
| 151 | slog.Error("Failed to read password message", "error", err) |
| 152 | return ExitError |
| 153 | } |
| 154 | |
| 155 | if msgType != wire.MsgPassword { |
| 156 | slog.Error("Expected password message", "got", string(msgType)) |
| 157 | _ = wire.WriteErrorResponse(writer, "FATAL", "28000", "expected password message") |
| 158 | _ = writer.Flush() |
| 159 | return ExitError |
| 160 | } |
| 161 | |
| 162 | // Password is null-terminated |
| 163 | password := string(bytes.TrimRight(body, "\x00")) |
| 164 | |
| 165 | // Validate password (constant-time; does not leak whether the user exists) |
| 166 | if !auth.ValidateUserPassword(users, username, password) { |
| 167 | slog.Warn("Authentication failed", "user", username, "remote_addr", remoteAddr) |
| 168 | auth.AuthFailuresCounter.Inc() |
| 169 | _ = wire.WriteErrorResponse(writer, "FATAL", "28P01", "password authentication failed") |
| 170 | _ = writer.Flush() |
| 171 | return ExitAuthFailure |
| 172 | } |
| 173 | |
| 174 | // Send auth OK |
| 175 | if err := wire.WriteAuthOK(writer); err != nil { |
| 176 | slog.Error("Failed to send auth OK", "error", err) |
| 177 | return ExitError |
| 178 | } |
| 179 | |
| 180 | return ExitSuccess |
| 181 | } |
| 182 | |
| 183 | // notifyQueryCancel delivers one query-cancel request, coalescing bursts: if |