Message-ID: <4f55303e-62c1-1072-61db-fbfb30bd66c8@gmail.com>
Date: Fri, 14 Oct 2022 15:04:34 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.3.3
Subject: Re: Patch proposal: make use of regular expressions for the username
 in pg_hba.conf
Content-Language: en-US
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Jacob Champion <jchampion@timescale.com>,
 PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
References: <4177827.1662684400@sss.pgh.pa.us>
 <CAAWbhmjxPcvUAKhpb1mu8PvszaiL7yFi_0ZUQVbfiowsFVaW4A@mail.gmail.com>
 <Yyk5rfYUTylD8XRg@paquier.xyz> <572017.1663646973@sss.pgh.pa.us>
 <YylB+vmF9dti1Alq@paquier.xyz>
 <e3091081-dc98-7f2b-829f-c247b9337653@gmail.com>
 <Yz0xO0emJ+mxtj2a@paquier.xyz>
 <e346f82f-4a6b-22f7-d6c1-cef16d472de9@gmail.com>
 <Y0UNP4FJyOBn6WX5@paquier.xyz>
 <607af3c9-e45d-3941-41a2-d21065d6594b@gmail.com>
 <Y0jz8QeyeEsnXKlm@paquier.xyz>
From: "Drouvot, Bertrand" <bertranddrouvot.pg@gmail.com>
In-Reply-To: <Y0jz8QeyeEsnXKlm@paquier.xyz>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/4f55303e-62c1-1072-61db-fbfb30bd66c8%40gmail.com>
Precedence: bulk

Hi,

On 10/14/22 7:30 AM, Michael Paquier wrote:
> On Wed, Oct 12, 2022 at 08:17:14AM +0200, Drouvot, Bertrand wrote:
>> Indeed, ;-)
> 
> So, I have spent the last two days looking at all that, studying the
> structure of the patch and the existing HEAD code,

Thanks!

> The code could be split to tackle things step-by-step:
> - One refactoring patch to introduce token_regcomp() and
> token_regexec(), with the introduction of a new structure that
> includes the compiled regexes.  (Feel free to counterargue about the
> use of AuthToken for this purpose, of course!)
> - Plug in the refactored logic for the lists of role names and
> database names in pg_hba.conf.
> - Handle the case of single host entries in pg_hba.conf.
> --

I agree to work step-by-step.

While looking at it again now, I discovered that the new TAP test for 
the regexp on the hostname in ssl/002_scram.pl is failing on some of my 
tests environment (and not all..).

So, I agree with the dedicated steps you are proposing and that the 
"host case" needs a dedicated attention.

I'm not ignoring all the remarks you've just done up-thread, I'll 
address them and/or provide my feedback on them when I'll come back with 
the step-by-step sub patches.

Regards,

-- 
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com