public inbox for [email protected]  

help / color / mirror / Atom feed

From: Christoph Berg <[email protected]>
To: Diego <[email protected]>
Cc: [email protected]
Subject: Re: libpq: decouple the .pgpass lookup port from the connection port
Date: Wed, 8 Jul 2026 19:15:47 +0200
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>

Re: Diego
> Why the port wildcard is not enough
> -----------------------------------
> 
> One can write the entry with a wildcard port:
> 
>     db.example.com:*:appdb:alice:secret
> and it does match the tunnel. But the wildcard over-matches: a single
> local forwarding port (say 54321, or even a fixed local port reused for
> several tunnels at different times) ends up matching every server reached
> through that port,

If you are giving the correct remote name to libpq, the rule won't
match several different hosts. If you don't care about that part, you
don't need anything extra and could just match on localhost:54321 (or
localhost:*).

> so the same password line can be applied to different
> servers. That is precisely the kind of "password sent to the wrong
> server" situation the 2018 host fix was trying to avoid. The wildcard
> trades safety for convenience; it is not a substitute for matching the
> real server port.

Don't use a wildcard, put :54321 in.

TBH I don't see why yet more connection parameters are required when
the problem is already solved by setting the hostname/hostaddr
correctly. (The part that remains when doing that can be avoided by
not reusing ports I think. You should do that anyway for general
sanity.)

>     - pgpassport / passfileport (it only affects the password file)

Is this proposal just a giant buildup for a "PG passport" joke? :)

Christoph

view thread (4+ messages)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: libpq: decouple the .pgpass lookup port from the connection port
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox