Re: PATCH: Disallow a netmask of zero unless the IP is also all zeroes

Greg Sabino Mullane <htamfids(at)gmail(dot)com> writes:
> I say "of course" but few people (even tech ones) know the distinction.
> (Nor should they have to! But that's for a nearby thread). This patch aims
> to prevent this very bad footgun by only allowing a /0 if the IP consists
> of only zeroes. It works for ipv4 and ipv6.

More generally, should we reject if the netmask causes *any* nonzero
IP bits to be ignored? Our CIDR type already imposes that rule:

regression=# select '1.2.3.4/24'::cidr;
ERROR: invalid cidr value: "1.2.3.4/24"
LINE 1: select '1.2.3.4/24'::cidr;
^
DETAIL: Value has bits set to right of mask.

I'm a bit distressed to realize that hba.c isn't using cidr_in.
Maybe we should try to share code instead of duplicating yet more.

regards, tom lane