Message-ID: <df1cec01-c0d0-dd9a-ed98-c7ed859f6801@gmail.com>
Date: Mon, 10 Oct 2022 09:04:16 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.3.2
Subject: Re: Patch proposal: make use of regular expressions for the username
 in pg_hba.conf
Content-Language: en-US
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Jacob Champion <jchampion@timescale.com>,
 PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
References: <fff0d7c1-8ad4-76a1-9db3-0ab6ec338bf7@amazon.com>
 <CAAWbhmhifLJfCGk1zMjWNHg+uGo9SohdSEqsFo0wa2rBNCB85g@mail.gmail.com>
 <4177827.1662684400@sss.pgh.pa.us>
 <CAAWbhmjxPcvUAKhpb1mu8PvszaiL7yFi_0ZUQVbfiowsFVaW4A@mail.gmail.com>
 <Yyk5rfYUTylD8XRg@paquier.xyz> <572017.1663646973@sss.pgh.pa.us>
 <YylB+vmF9dti1Alq@paquier.xyz>
 <e3091081-dc98-7f2b-829f-c247b9337653@gmail.com>
 <Yz0xO0emJ+mxtj2a@paquier.xyz>
 <f13e7161-c962-c430-e745-b3f148a2f0c2@gmail.com>
 <Yz4m+6eD0De9Kmyf@paquier.xyz>
From: "Drouvot, Bertrand" <bertranddrouvot.pg@gmail.com>
In-Reply-To: <Yz4m+6eD0De9Kmyf@paquier.xyz>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/df1cec01-c0d0-dd9a-ed98-c7ed859f6801%40gmail.com>
Precedence: bulk

Hi,

On 10/6/22 2:53 AM, Michael Paquier wrote:
> On Wed, Oct 05, 2022 at 03:32:20PM +0200, Drouvot, Bertrand wrote:
>> On 10/5/22 9:24 AM, Michael Paquier wrote:
>>> - test_role() -> test_conn() to be able to pass down a database name.
>>> - reset_pg_hba() to control the host, db and user parts.  The host
>>> part does not really apply after moving the hosts checks to a more
>>> secure location, so I guess that this had better be extended just for
>>> the user and database, keeping host=local all the time.
>>> I am planning to apply 0001 attached independently,
>>
>> 0001 looks good to me.
> 
> Thanks.  I have applied this refactoring, leaving the host part out of
> the equation as we should rely only on local connections for this
> part of the test. 

Thanks!

>> Thanks! I'll look at it and the comments you just made up-thread.
> 
> Cool, thanks.  One thing that matters a lot IMO (that I forgot to
> mention previously) is to preserve the order of the items parsed from
> the configuration files.

Fully agree, all the versions that have been submitted in this thread 
preserves the ordering.

> 
> Also, I am wondering whether we'd better have some regression tests
> where a regex includes a comma and a role name itself has a comma,
> actually, just to stress more the parsing of individual items in the
> HBA file.

Good idea, it has been added in v5 just shared up-thread.

Regards,

-- 
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com