security: use constant_eq for password checks (#1032)

Let's just be on par with Postgres itself on this
https://www.postgresql.org/support/security/CVE-2026-6478/

Author: meskill

pgdog/src/auth/md5.rs

@@ -67,7 +67,9 @@ impl<'a> Client<'a> {
 
     /// Check encrypted password against any of the configured passwords.
     pub fn check(&self, encrypted: &str) -> bool {
-        self.passwords.iter().any(|p| self.encrypt(p) == encrypted)
+        self.passwords.iter().any(|p| {
+            crate::util::constant_time_eq(self.encrypt(p).as_bytes(), encrypted.as_bytes())
+        })
     }
 }
 

pgdog/src/backend/databases.rs

@@ -181,7 +181,14 @@ pub(crate) fn add(user: ConfigUser) -> Result<AuthResult, Error> {
             add_user(existing)?;
             reload_from_existing()?;
             Ok(AuthResult::Ok)
-        } else if existing.password == user.password {
+        } else if existing
+            .password
+            .as_deref()
+            .zip(user.password.as_deref())
+            .is_some_and(|(stored, provided)| {
+                crate::util::constant_time_eq(stored.as_bytes(), provided.as_bytes())
+            })
+        {
             // Passwords match.
             Ok(AuthResult::Ok)
         } else if config.config.general.passthrough_auth.allows_change() {

pgdog/src/frontend/client/mod.rs

@@ -195,9 +195,11 @@ impl Client {
                     .await?;
                 let response = stream.read().await?;
                 let response = Password::from_bytes(response.to_bytes())?;
-                let is_match = passwords
-                    .iter()
-                    .any(|p| Some(p.as_str()) == response.password());
+                let is_match = response.password().is_some_and(|provided| {
+                    passwords.iter().any(|p| {
+                        crate::util::constant_time_eq(p.as_str().as_bytes(), provided.as_bytes())
+                    })
+                });
 
                 if is_match {
                     AuthResult::Ok

pgdog/src/net/messages/backend_key.rs

@@ -65,7 +65,7 @@ impl SecretKey {
     /// byte. Length is not secret, so an early length mismatch returning `false`
     /// is fine.
     pub fn constant_time_eq(&self, other: &SecretKey) -> bool {
-        aws_lc_rs::constant_time::verify_slices_are_equal(self.as_slice(), other.as_slice()).is_ok()
+        crate::util::constant_time_eq(self.as_slice(), other.as_slice())
     }
 
     pub fn len(&self) -> usize {

pgdog/src/util.rs

@@ -17,6 +17,20 @@ pub fn millis(duration: Duration) -> f64 {
     (duration.as_secs_f64() * 1_000_000.0).round() / 1000.0
 }
 
+/// Compare two byte slices in constant time with respect to their contents.
+///
+/// The running time depends only on the input lengths, never on the byte
+/// values, so it cannot leak (via a timing side channel) how many leading
+/// bytes matched. Use this wherever an attacker-supplied value is compared
+/// against a secret (passwords, cancel keys); a short-circuiting `==`/`memcmp`
+/// there is a covert timing channel that lets an attacker recover the secret
+/// byte by byte (cf. PostgreSQL CVE-2026-6478, the MD5 password comparison).
+///
+/// Length is not treated as secret: a length mismatch returns `false` early.
+pub fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    aws_lc_rs::constant_time::verify_slices_are_equal(a, b).is_ok()
+}
+
 pub fn human_duration_optional(duration: Option<Duration>) -> String {
     if let Some(duration) = duration {
         human_duration(duration)
@@ -411,4 +425,15 @@ mod test {
         }
         assert_eq!(node_id(), Ok(1));
     }
+
+    #[test]
+    fn test_constant_time_eq() {
+        assert!(constant_time_eq(b"hunter2", b"hunter2"));
+        assert!(!constant_time_eq(b"hunter2", b"hunter3"));
+        // Different lengths must not match.
+        assert!(!constant_time_eq(b"hunter2", b"hunter22"));
+        assert!(!constant_time_eq(b"", b"x"));
+        // Two empty slices are equal.
+        assert!(constant_time_eq(b"", b""));
+    }
 }