From: Drouvot, Bertrand <bertranddrouvot.pg@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jacob Champion <jchampion@timescale.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf
Date: Fri, 14 Oct 2022 14:47:04 +0200
Message-ID: <1a7c54f7-d06b-1fa4-f356-19a229ffb986@gmail.com> (raw)
In-Reply-To: <Y0j/TFm806nLxD4g@paquier.xyz>
References: <CAAWbhmjxPcvUAKhpb1mu8PvszaiL7yFi_0ZUQVbfiowsFVaW4A@mail.gmail.com>
<Yyk5rfYUTylD8XRg@paquier.xyz>
<572017.1663646973@sss.pgh.pa.us>
<YylB+vmF9dti1Alq@paquier.xyz>
<e3091081-dc98-7f2b-829f-c247b9337653@gmail.com>
<Yz0xO0emJ+mxtj2a@paquier.xyz>
<e346f82f-4a6b-22f7-d6c1-cef16d472de9@gmail.com>
<Y0UNP4FJyOBn6WX5@paquier.xyz>
<607af3c9-e45d-3941-41a2-d21065d6594b@gmail.com>
<Y0jz8QeyeEsnXKlm@paquier.xyz>
<Y0j/TFm806nLxD4g@paquier.xyz>
Hi,
On 10/14/22 8:18 AM, Michael Paquier wrote:
> On Fri, Oct 14, 2022 at 02:30:25PM +0900, Michael Paquier wrote:
>> First, as of HEAD, AuthToken is only used for elements in a list of
>> role and database names in hba.conf before filling in each HbaLine,
>> hence we limit its usage to the initial parsing. The patch assigns an
>> optional regex_t to it, then extends the use of AuthToken for single
>> hostname entries in pg_hba.conf. Things going first: shouldn't we
>> combine ident_user and "re" together in the same structure? Even if
>> we finish by not using AuthToken to store the computed regex, it seems
>> to me that we'd better use the same base structure for pg_ident.conf
>> and pg_hba.conf. While looking closely at the patch, we would expand
>> the use of AuthToken outside its original context. I have also looked
>> at make_auth_token(), and wondered if it could be possible to have this
>> routine compile the regexes. This approach would not stick with
>> pg_ident.conf though, as we validate the fields in each line when we
>> put our hands on ident_user and after the base validation of a line
>> (number of fields, etc.). So with all that in mind, it feels right to
>> not use AuthToken at all when building each HbaLine and each
>> IdentLine, but a new, separate, structure. We could call that an
>> AuthItem (string, its compiled regex) perhaps? It could have its own
>> make() routine, taking in input an AuthToken and process
>> pg_regcomp(). Better ideas for this new structure would be welcome,
>> and the idea is that we'd store the post-parsing state of an
>> AuthToken to something that has a compiled regex. We could finish by
>> using AuthToken at the end and expand its use, but it does not feel
>> completely right either to have a make() routine but not be able to
>> compile its regular expression when creating the AuthToken.
>
> I have have sent this part too quickly. As AuthTokens are used in
> check_db() and check_role() when matching entries, it is more
> intuitive to store the regex_t directly in it.
Yeah, I also think this is the right place for it.
> Changing IdentLine to
> use a AuthToken makes the "quoted" part useless in this case, still it
> could be used in Assert()s to make sure that the data is shaped as
> expected at check-time, enforced at false when creating it in
> parse_ident_line()?
I agree, that makes sense. I'll work on that.
Regards,
--
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bertranddrouvot.pg@gmail.com, michael@paquier.xyz, tgl@sss.pgh.pa.us, jchampion@timescale.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf
In-Reply-To: <1a7c54f7-d06b-1fa4-f356-19a229ffb986@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox