|
|
@@ -36,8 +36,6 @@ all() ->
|
|
|
groups() ->
|
|
|
[{access_control, [sequence],
|
|
|
[reload_acl,
|
|
|
- register_mod,
|
|
|
- unregister_mod,
|
|
|
check_acl_1,
|
|
|
check_acl_2]},
|
|
|
{access_control_cache_mode, [],
|
|
|
@@ -98,58 +96,26 @@ write_config(Filename, Terms) ->
|
|
|
end_per_group(_Group, Config) ->
|
|
|
Config.
|
|
|
|
|
|
-init_per_testcase(_TestCase, Config) ->
|
|
|
- ?AC:start_link(),
|
|
|
- Config.
|
|
|
-end_per_testcase(_TestCase, _Config) ->
|
|
|
- ok.
|
|
|
-
|
|
|
-per_testcase_config(acl_cache_full, Config) ->
|
|
|
- Config;
|
|
|
-per_testcase_config(_TestCase, Config) ->
|
|
|
- Config.
|
|
|
-
|
|
|
%%--------------------------------------------------------------------
|
|
|
%% emqx_access_control
|
|
|
%%--------------------------------------------------------------------
|
|
|
|
|
|
reload_acl(_) ->
|
|
|
- [ok] = ?AC:reload_acl().
|
|
|
-
|
|
|
-register_mod(_) ->
|
|
|
- ok = ?AC:register_mod(acl, emqx_acl_test_mod, []),
|
|
|
- {emqx_acl_test_mod, _, 0} = hd(?AC:lookup_mods(acl)),
|
|
|
- ok = ?AC:register_mod(auth, emqx_auth_anonymous_test_mod,[]),
|
|
|
- ok = ?AC:register_mod(auth, emqx_auth_dashboard, [], 99),
|
|
|
- [{emqx_auth_dashboard, _, 99},
|
|
|
- {emqx_auth_anonymous_test_mod, _, 0}] = ?AC:lookup_mods(auth).
|
|
|
-
|
|
|
-unregister_mod(_) ->
|
|
|
- ok = ?AC:register_mod(acl, emqx_acl_test_mod, []),
|
|
|
- {emqx_acl_test_mod, _, 0} = hd(?AC:lookup_mods(acl)),
|
|
|
- ok = ?AC:unregister_mod(acl, emqx_acl_test_mod),
|
|
|
- timer:sleep(5),
|
|
|
- {emqx_acl_internal, _, 0}= hd(?AC:lookup_mods(acl)),
|
|
|
- ok = ?AC:register_mod(auth, emqx_auth_anonymous_test_mod,[]),
|
|
|
- [{emqx_auth_anonymous_test_mod, _, 0}] = ?AC:lookup_mods(auth),
|
|
|
-
|
|
|
- ok = ?AC:unregister_mod(auth, emqx_auth_anonymous_test_mod),
|
|
|
- timer:sleep(5),
|
|
|
- [] = ?AC:lookup_mods(auth).
|
|
|
+ ok = ?AC:reload_acl().
|
|
|
|
|
|
check_acl_1(_) ->
|
|
|
- SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>},
|
|
|
+ SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>, zone => external},
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"users/testuser/1">>),
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"clients/client1">>),
|
|
|
- deny = ?AC:check_acl(SelfUser, subscribe, <<"clients/client1/x/y">>),
|
|
|
+ deny = ?AC:check_acl(SelfUser, subscribe, <<"clients/client1/x/y">>),
|
|
|
allow = ?AC:check_acl(SelfUser, publish, <<"users/testuser/1">>),
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"a/b/c">>).
|
|
|
check_acl_2(_) ->
|
|
|
- SelfUser = #{client_id => <<"client2">>, username => <<"xyz">>},
|
|
|
+ SelfUser = #{client_id => <<"client2">>, username => <<"xyz">>, zone => external},
|
|
|
deny = ?AC:check_acl(SelfUser, subscribe, <<"a/b/c">>).
|
|
|
|
|
|
acl_cache_basic(_) ->
|
|
|
- SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>},
|
|
|
+ SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>, zone => external},
|
|
|
not_found = ?CACHE:get_acl_cache(subscribe, <<"users/testuser/1">>),
|
|
|
not_found = ?CACHE:get_acl_cache(subscribe, <<"clients/client1">>),
|
|
|
|
|
|
@@ -162,7 +128,7 @@ acl_cache_basic(_) ->
|
|
|
|
|
|
acl_cache_expiry(_) ->
|
|
|
application:set_env(emqx, acl_cache_ttl, 100),
|
|
|
- SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>},
|
|
|
+ SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>, zone => external},
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"clients/client1">>),
|
|
|
allow = ?CACHE:get_acl_cache(subscribe, <<"clients/client1">>),
|
|
|
ct:sleep(150),
|
|
|
@@ -172,7 +138,7 @@ acl_cache_expiry(_) ->
|
|
|
acl_cache_full(_) ->
|
|
|
application:set_env(emqx, acl_cache_max_size, 1),
|
|
|
|
|
|
- SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>},
|
|
|
+ SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>, zone => external},
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"users/testuser/1">>),
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"clients/client1">>),
|
|
|
|
|
|
@@ -187,7 +153,7 @@ acl_cache_cleanup(_) ->
|
|
|
application:set_env(emqx, acl_cache_ttl, 100),
|
|
|
application:set_env(emqx, acl_cache_max_size, 2),
|
|
|
|
|
|
- SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>},
|
|
|
+ SelfUser = #{client_id => <<"client1">>, username => <<"testuser">>, zone => external},
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"users/testuser/1">>),
|
|
|
allow = ?AC:check_acl(SelfUser, subscribe, <<"clients/client1">>),
|
|
|
|
|
|
@@ -357,8 +323,8 @@ compile_rule(_) ->
|
|
|
{deny, all} = compile({deny, all}).
|
|
|
|
|
|
match_rule(_) ->
|
|
|
- User = #{client_id => <<"testClient">>, username => <<"TestUser">>, peername => {{127,0,0,1}, 2948}},
|
|
|
- User2 = #{client_id => <<"testClient">>, username => <<"TestUser">>, peername => {{192,168,0,10}, 3028}},
|
|
|
+ User = #{client_id => <<"testClient">>, username => <<"TestUser">>, peername => {{127,0,0,1}, 2948}, zone => external},
|
|
|
+ User2 = #{client_id => <<"testClient">>, username => <<"TestUser">>, peername => {{192,168,0,10}, 3028}, zone => external},
|
|
|
|
|
|
{matched, allow} = match(User, <<"Test/Topic">>, {allow, all}),
|
|
|
{matched, deny} = match(User, <<"Test/Topic">>, {deny, all}),
|