Re: BUG #4433: entries like "host all all 10.0.50.31/0 ..." should not be allowed or trigger a warning

On Tue, 23 Sep 2008 11:44:24 +0200, security  improvement proposal:
pg_hba.conf and CIDR mask <marc@intershop.de> wrote:
> Description:        entries like "host    all       all   10.0.50.31/0
> ..."
> should not be allowed or trigger a warning


> A CIDR mask length of 0 will allow to connect from any location.
Hm, it will allow to match any location, what it does with that later
depends on your settings. Putting "reject" as the method will, well,
reject them.
Also, I use "host dbname username 0.0.0.0/0 md5" in quite a few places,
and I believe I know what I'm doing. ;-)

> Checking the mask against the IP address would prevent such errors:
> /0 : disallow ?
Sorry, I can't agree here. I need that!

Kind of offtopic:
> /24 : IP must ends with .0
> /16 : IP must ends with .0.0
> ...
Precisely, /24 is A.B.C.*, /16 is A.B.*.*, /8 is A.*.*.*. It's not just .0
or .0.0, it's "anything".

HTH too. ;-)

--
ru