Re: pg_hba.conf: samehost and samenet [REVIEW]

Stef Walter <stef-list(at)memberwebs(dot)com> writes:
> Allowing host names in pg_hba.conf would also solve this problem,
> although the last person who tried to implement this it was a topic of
> contention. I asked if I should focus on reverse DNS host names in
> pg_hba.conf or portability for this samenet patch, and it was indicated
> that I should do the latter.

Agreed, a DNS-based solution would be a huge pain in the rear to do
correctly. However, I think what Robert wanted to know was just how
portable you believe this solution is. If it doesn't work, and work
pretty much the same, on all our supported platforms then I'm afraid
we can't use it. There's nothing worse than a security-critical
feature that works differently than you expect it to.

In this case what particularly scares me is the idea that 'samenet'
might be interpreted to let in a larger subnet than the user expected,
eg 10/8 instead of 10.0.0/24. You'd likely not notice the problem until
after you'd been broken into ...

regards, tom lane