Re: PATCH: Disallow a netmask of zero unless the IP is also all zeroes - Mailing list pgsql-hackers

Greg Sabino Mullane <htamfids@gmail.com> writes:
> I say "of course" but few people (even tech ones) know the distinction.
> (Nor should they have to! But that's for a nearby thread). This patch aims
> to prevent this very bad footgun by only allowing a /0 if the IP consists
> of only zeroes. It works for ipv4 and ipv6.

More generally, should we reject if the netmask causes *any* nonzero
IP bits to be ignored?  Our CIDR type already imposes that rule:

regression=# select '1.2.3.4/24'::cidr;
ERROR:  invalid cidr value: "1.2.3.4/24"
LINE 1: select '1.2.3.4/24'::cidr;
               ^
DETAIL:  Value has bits set to right of mask.

I'm a bit distressed to realize that hba.c isn't using cidr_in.
Maybe we should try to share code instead of duplicating yet more.

            regards, tom lane