Derek Viljoen <derekv@infinite.io> writes:
> In hba.c in check_hba() function:
> /* Check SSL state */
> if (port->ssl_in_use)
> {
> /* Connection is SSL, match both "host" and "hostssl" */
> if (hba->conntype == ctHostNoSSL)
> continue;
> }
> else
> {
> /* Connection is not SSL, match both "host" and "hostnossl"
> */
> if (hba->conntype == ctHostSSL)
> continue;
> }
> It looks to me like conntype should be reversed in this code block.
I think people would have noticed if this were backwards ;-)
Possibly what's confusing you is that the "continue" statements execute
when we don't have a "match"; if the hba entry does match the connection
in this respect, then we fall through to keep on examining the entry.
> If that is not correct, then the comments should be updated to reflect the
> code.
What would you propose exactly? Perhaps we could s/match/accept/ but
I'm not sure that's any clearer.
The bigger picture here is that all the "continue" statements in this
loop should be read as "this entry fails to match, so try the next one".
If there's any comment change needed, I'd be inclined to think about
making that more explicit; but it's an awfully common coding pattern.
regards, tom lane