From: Drouvot, Bertrand <bertranddrouvot.pg@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jacob Champion <jchampion@timescale.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf
Date: Mon, 10 Oct 2022 09:04:16 +0200
Message-ID: <df1cec01-c0d0-dd9a-ed98-c7ed859f6801@gmail.com> (raw)
In-Reply-To: <Yz4m+6eD0De9Kmyf@paquier.xyz>
References: <fff0d7c1-8ad4-76a1-9db3-0ab6ec338bf7@amazon.com>
<CAAWbhmhifLJfCGk1zMjWNHg+uGo9SohdSEqsFo0wa2rBNCB85g@mail.gmail.com>
<4177827.1662684400@sss.pgh.pa.us>
<CAAWbhmjxPcvUAKhpb1mu8PvszaiL7yFi_0ZUQVbfiowsFVaW4A@mail.gmail.com>
<Yyk5rfYUTylD8XRg@paquier.xyz>
<572017.1663646973@sss.pgh.pa.us>
<YylB+vmF9dti1Alq@paquier.xyz>
<e3091081-dc98-7f2b-829f-c247b9337653@gmail.com>
<Yz0xO0emJ+mxtj2a@paquier.xyz>
<f13e7161-c962-c430-e745-b3f148a2f0c2@gmail.com>
<Yz4m+6eD0De9Kmyf@paquier.xyz>
Hi,
On 10/6/22 2:53 AM, Michael Paquier wrote:
> On Wed, Oct 05, 2022 at 03:32:20PM +0200, Drouvot, Bertrand wrote:
>> On 10/5/22 9:24 AM, Michael Paquier wrote:
>>> - test_role() -> test_conn() to be able to pass down a database name.
>>> - reset_pg_hba() to control the host, db and user parts. The host
>>> part does not really apply after moving the hosts checks to a more
>>> secure location, so I guess that this had better be extended just for
>>> the user and database, keeping host=local all the time.
>>> I am planning to apply 0001 attached independently,
>>
>> 0001 looks good to me.
>
> Thanks. I have applied this refactoring, leaving the host part out of
> the equation as we should rely only on local connections for this
> part of the test.
Thanks!
>> Thanks! I'll look at it and the comments you just made up-thread.
>
> Cool, thanks. One thing that matters a lot IMO (that I forgot to
> mention previously) is to preserve the order of the items parsed from
> the configuration files.
Fully agree, all the versions that have been submitted in this thread
preserves the ordering.
>
> Also, I am wondering whether we'd better have some regression tests
> where a regex includes a comma and a role name itself has a comma,
> actually, just to stress more the parsing of individual items in the
> HBA file.
Good idea, it has been added in v5 just shared up-thread.
Regards,
--
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bertranddrouvot.pg@gmail.com, michael@paquier.xyz, tgl@sss.pgh.pa.us, jchampion@timescale.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf
In-Reply-To: <df1cec01-c0d0-dd9a-ed98-c7ed859f6801@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox