Andrew Dunstan <[EMAIL PROTECTED]> writes: > One thing that bothers me slightly is that we would need to look up each > name (at least until we found a match) for each connection. If you had > lots of names in your pg_hba.conf that could be quite a hit.
A possible answer to that is to *not* look up the names from pg_hba.conf, but instead restrict the feature to matching the reverse-DNS name of the client. This limits the cost to one lookup per connection instead of N (and it'd be essentially free if you have log_hostnames turned on, since we already do that lookup in that case). I'm not sure about the relative usefulness of this compared to the forward-lookup case, nor whether it's riskier or less risky from a spoofing point of view. But something to consider. regards, tom lane ---------------------------(end of broadcast)--------------------------- TIP 9: In versions below 8.0, the planner will ignore your desire to choose an index scan if your joining column's datatypes do not match