Thread

1. pg_hba.conf host name wildcard support

   Peter Eisentraut <peter_e@gmx.net> — 2010-10-21T03:38:55Z

   So, as previously indicated, let's add some wildcard support to the
   pg_hba.conf host name feature.  After looking around a bit, two syntaxes
   appear to be on offer:
   
   1. TCP Wrappers style, leading dot indicates suffix match.
   So .example.com matches anything.example.com.  Not sure how useful that
   would be, but it could be implemented in about 3 lines of code.
   
   2. Full regular expressions.  I'd suggest the pg_ident.conf style, where
   a leading slash indicates a regex.  An example could be /^dbserver\d\.
   With some code refactoring, this would also only take a few extra lines
   of code.
   
   Comments, other ideas?
   
   
   
   

2. Re: pg_hba.conf host name wildcard support

   Tom Lane <tgl@sss.pgh.pa.us> — 2010-10-21T04:54:26Z

   Peter Eisentraut <peter_e@gmx.net> writes:
   > So, as previously indicated, let's add some wildcard support to the
   > pg_hba.conf host name feature.  After looking around a bit, two syntaxes
   > appear to be on offer:
   
   > 1. TCP Wrappers style, leading dot indicates suffix match.
   > So .example.com matches anything.example.com.  Not sure how useful that
   > would be, but it could be implemented in about 3 lines of code.
   
   > 2. Full regular expressions.  I'd suggest the pg_ident.conf style, where
   > a leading slash indicates a regex.  An example could be /^dbserver\d\.
   > With some code refactoring, this would also only take a few extra lines
   > of code.
   
   I'd lean to #1 myself.  Regexes would be a perpetual foot-gun because
   (a) dot is a metacharacter to a regex and (b) a non-anchored pattern
   is default but would be insecure in most usages.
   
   There is a SQL-ish solution to those two objections: use LIKE or SIMILAR
   TO pattern language not standard regex.  But #1 would be far more
   familiar to most admin types.
   
   			regards, tom lane
   
   

3. Re: pg_hba.conf host name wildcard support

   Dimitri Fontaine <dimitri@2ndquadrant.fr> — 2010-10-21T09:49:41Z

   Tom Lane <tgl@sss.pgh.pa.us> writes:
   > Peter Eisentraut <peter_e@gmx.net> writes:
   >> 1. TCP Wrappers style, leading dot indicates suffix match.
   >> So .example.com matches anything.example.com.  Not sure how useful that
   >> would be, but it could be implemented in about 3 lines of code.
   >
   > I'd lean to #1 myself.
   
   FWIW, +1
   
   -- 
   Dimitri Fontaine
   http://2ndQuadrant.fr     PostgreSQL : Expertise, Formation et Support
   
   

4. Re: pg_hba.conf host name wildcard support

   Peter Eisentraut <peter_e@gmx.net> — 2010-10-23T12:19:02Z

   On tor, 2010-10-21 at 06:38 +0300, Peter Eisentraut wrote:
   > So, as previously indicated, let's add some wildcard support to the
   > pg_hba.conf host name feature.  After looking around a bit, two syntaxes
   > appear to be on offer:
   > 
   > 1. TCP Wrappers style, leading dot indicates suffix match.
   > So .example.com matches anything.example.com.  Not sure how useful that
   > would be, but it could be implemented in about 3 lines of code.
   
   Here is a patch for that.