On 2/11/25 9:25 PM, Tom Lane wrote:
Greg Sabino Mullane writes:
I say "of course" but few people (even tech ones) know the distinction.
(Nor should they have to! But that's for a nearby thread). This patch aims
to prevent this very bad footgun by only allowing a /0 if the IP consists
of only ze
On Tue, Feb 11, 2025 at 3:25 PM Tom Lane wrote:
> More generally, should we reject if the netmask causes *any* nonzero
> IP bits to be ignored? Our CIDR type already imposes that rule:
>
Yeah, I like that idea a lot. That's a great DETAIL message.
Cheers,
Greg
--
Crunchy Data - https://www.cr
> On 11 Feb 2025, at 21:25, Tom Lane wrote:
> I'm a bit distressed to realize that hba.c isn't using cidr_in.
> Maybe we should try to share code instead of duplicating yet more.
+1. I have a note along these lines on my never-shrinking TODO, I think it
would be great if we took a stab at that.
Greg Sabino Mullane writes:
> I say "of course" but few people (even tech ones) know the distinction.
> (Nor should they have to! But that's for a nearby thread). This patch aims
> to prevent this very bad footgun by only allowing a /0 if the IP consists
> of only zeroes. It works for ipv4 and ipv
I ran into this alarming mistake again the other day. Luckily it was on a
dev system. Someone sees an entry in a pg_hba.conf that looks like this:
host all all 0.0.0.0/0 md5
They are gobsmacked when they learn this means to let everyone in. So they
fix it by adding new entries that look like this
