Skip to content

feat: use dNSName primarily as TLS identity, fallback to CN#1002

Merged
levkk merged 3 commits into
mainfrom
levkk-san-cn-dnsname
May 26, 2026
Merged

feat: use dNSName primarily as TLS identity, fallback to CN#1002
levkk merged 3 commits into
mainfrom
levkk-san-cn-dnsname

Conversation

@levkk
Copy link
Copy Markdown
Collaborator

@levkk levkk commented May 26, 2026

  • feat: use dNSName as TLS identity, fallback to CN
  • refactor: remove [general.client_tls_validate_cn] setting; if [[users]] sets identity, we assume TLS auth is used

Comment thread pgdog/src/frontend/client/mod.rs Outdated
false
} else {
match auth_type {
AuthType::Md5 => {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
AuthType::Md5 => {
AuthType::Md5 => panic!("It is 2026 my dude what are you even doing")

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You'd be surprised

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😭 🔫

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Haha it's like 10 times faster than scram! Scram is sloowwwww

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd think not being able to reverse the hash on a consumer GPU from a decade ago would be a bigger concern but ¯\_(ツ)_/¯

@blacksmith-sh

This comment has been minimized.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 26, 2026

Codecov Report

❌ Patch coverage is 62.06897% with 33 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
pgdog/src/frontend/client/mod.rs 41.86% 25 Missing ⚠️
pgdog/src/net/tls.rs 88.57% 4 Missing ⚠️
pgdog/src/frontend/listener.rs 0.00% 2 Missing ⚠️
pgdog/src/net/stream.rs 66.66% 2 Missing ⚠️

📢 Thoughts on this report? Let us know!

@levkk levkk merged commit c9ff6ad into main May 26, 2026
24 of 25 checks passed
@levkk levkk deleted the levkk-san-cn-dnsname branch May 26, 2026 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants