Fix SCRAM authentication DoS vulnerabilities and add IP-based rate limiting

example.pgdog.toml

@@ -245,6 +245,14 @@ mirror_queue = 128
 # - trust
 auth_type = "scram"
 
+# Authentication rate limit (attempts per minute per IP address).
+#
+# Prevents brute-force authentication attacks by limiting the number
+# of authentication attempts from a single IP address.
+#
+# Default: 10
+auth_rate_limit = 10
+
 # Disable cross-shard queries.
 #
 # Default: false

pgdog/Cargo.toml

@@ -48,6 +48,7 @@ regex = "1"
 uuid = { version = "1", features = ["v4", "serde"] }
 url = "2"
 ratatui = { version = "0.30.0-alpha.1", optional = true }
+governor = "0.6"
 rmp-serde = "1"
 rust_decimal = { version = "1.36", features = ["db-postgres"] }
 chrono = "0.4"
@@ -60,7 +61,6 @@ indexmap = "2.9"
 lru = "0.16"
 hickory-resolver = "0.25.2"
 lazy_static = "1"
-dashmap = "6"
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemallocator = "0.6"

pgdog/src/auth/mod.rs

@@ -2,6 +2,7 @@
 
 pub mod error;
 pub mod md5;
+pub mod rate_limit;
 pub mod scram;
 
 pub use error::Error;