access rule
This commit is contained in:
Ery Lee
parent
1428223a2b
commit
db161a2025
|
|
@ -1,70 +0,0 @@
|
|||
%%%-----------------------------------------------------------------------------
|
||||
%%% @Copyright (C) 2012-2015, Feng Lee <feng@emqtt.io>
|
||||
%%%
|
||||
%%% Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
%%% of this software and associated documentation files (the "Software"), to deal
|
||||
%%% in the Software without restriction, including without limitation the rights
|
||||
%%% to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
%%% copies of the Software, and to permit persons to whom the Software is
|
||||
%%% furnished to do so, subject to the following conditions:
|
||||
%%%
|
||||
%%% The above copyright notice and this permission notice shall be included in all
|
||||
%%% copies or substantial portions of the Software.
|
||||
%%%
|
||||
%%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
%%% IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
%%% FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
%%% AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
%%% LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
%%% OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
%%% SOFTWARE.
|
||||
%%%-----------------------------------------------------------------------------
|
||||
%%% @doc
|
||||
%%% emqttd access rule match
|
||||
%%%
|
||||
%%% @end
|
||||
%%%-----------------------------------------------------------------------------
|
||||
-module(emqttd_access).
|
||||
|
||||
-include("emqttd.hrl").
|
||||
|
||||
-export([match/3]).
|
||||
|
||||
-type who() :: all |
|
||||
{clientid, binary()} |
|
||||
{peername, string() | inet:ip_address()} |
|
||||
{username, binary()}.
|
||||
|
||||
-type rule() :: {allow, all} |
|
||||
{allow, who(), binary()} |
|
||||
{deny, all} |
|
||||
{deny, who(), binary()}.
|
||||
|
||||
-spec match(mqtt_user(), binary(), list(rule())) -> allow | deny | nomatch.
|
||||
match(_User, _Topic, []) ->
|
||||
nomatch;
|
||||
match(_User, _Topic, [{AllowDeny, all}|_]) ->
|
||||
AllowDeny;
|
||||
match(User, Topic, [{AllowDeny, all, TopicFilter}|Rules]) ->
|
||||
case emqttd_topic:match(Topic, TopicFilter) of
|
||||
true -> AllowDeny;
|
||||
false -> match(User, Topic, Rules)
|
||||
end;
|
||||
match(User = #mqtt_user{clientid = ClientId}, Topic, [{AllowDeny, ClientId, TopicFilter}|Rules]) when is_binary(ClientId) ->
|
||||
case emqttd_topic:match(Topic, TopicFilter) of
|
||||
true -> AllowDeny;
|
||||
false -> match(User, Topic, Rules)
|
||||
end;
|
||||
match(User = #mqtt_user{peername = IpAddr}, Topic, [{AllowDeny, {peername, CIDR}, TopicFilter}|Rules]) ->
|
||||
case {match_cidr(IpAddr, CIDR), emqttd_topic:match(Topic, TopicFilter)} of
|
||||
{true, true} -> AllowDeny;
|
||||
_ -> match(User, Topic, Rules)
|
||||
end;
|
||||
match(User = #mqtt_user{username = Username}, Topic, [{AllowDeny, {username, Username}, TopicFilter}|Rules]) ->
|
||||
case emqttd_topic:match(Topic, TopicFilter) of
|
||||
true -> AllowDeny;
|
||||
false -> match(User, Topic, Rules)
|
||||
end.
|
||||
|
||||
match_cidr(IpAddr, CIDR) -> true.
|
||||
|
||||
|
|
@ -0,0 +1,141 @@
|
|||
%%%-----------------------------------------------------------------------------
|
||||
%%% @Copyright (C) 2012-2015, Feng Lee <feng@emqtt.io>
|
||||
%%%
|
||||
%%% Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
%%% of this software and associated documentation files (the "Software"), to deal
|
||||
%%% in the Software without restriction, including without limitation the rights
|
||||
%%% to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
%%% copies of the Software, and to permit persons to whom the Software is
|
||||
%%% furnished to do so, subject to the following conditions:
|
||||
%%%
|
||||
%%% The above copyright notice and this permission notice shall be included in all
|
||||
%%% copies or substantial portions of the Software.
|
||||
%%%
|
||||
%%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
%%% IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
%%% FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
%%% AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
%%% LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
%%% OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
%%% SOFTWARE.
|
||||
%%%-----------------------------------------------------------------------------
|
||||
%%% @doc
|
||||
%%% emqttd access rule
|
||||
%%%
|
||||
%%% @end
|
||||
%%%-----------------------------------------------------------------------------
|
||||
-module(emqttd_access_rule).
|
||||
|
||||
-author('feng@emqtt.io').
|
||||
|
||||
-include("emqttd.hrl").
|
||||
|
||||
-export([match/3, encode/1, decode/1]).
|
||||
|
||||
-type who() :: all | binary() |
|
||||
{ipaddr, esockd_access:cidr()} |
|
||||
{clientid, binary()} |
|
||||
{clientid, {regexp, binary()}} |
|
||||
{username, binary()} |
|
||||
{username, {regexp, binary()}}.
|
||||
|
||||
-type rule() :: {allow, all} |
|
||||
{allow, who(), binary()} |
|
||||
{deny, all} |
|
||||
{deny, who(), binary()}.
|
||||
|
||||
-opaque enc_who() :: all | binary() |
|
||||
{ipaddr, esockd_access:range()} |
|
||||
{clientid, binary()} |
|
||||
{clientid, {regexp, binary(), re:mp()}} |
|
||||
{username, binary()} |
|
||||
{username, {regexp, binary(), re:mp()}}.
|
||||
|
||||
-opaque enc_rule() :: {allow, all} |
|
||||
{allow, enc_who(), binary()} |
|
||||
{deny, all} |
|
||||
{deny, enc_who(), binary()}.
|
||||
|
||||
-export_type([who/0, rule/0, enc_who/0, enc_rule/0]).
|
||||
|
||||
-spec match(mqtt_user(), binary(), enc_rule()) -> {matched, allow} | {matched, deny} | nomatch.
|
||||
match(_User, _Topic, []) ->
|
||||
nomatch;
|
||||
match(_User, _Topic, [{AllowDeny, all}|_]) ->
|
||||
AllowDeny;
|
||||
match(User, Topic, [{AllowDeny, all, TopicFilter}|Rules]) ->
|
||||
case emqttd_topic:match(Topic, TopicFilter) of
|
||||
true -> AllowDeny;
|
||||
false -> match(User, Topic, Rules)
|
||||
end;
|
||||
match(User = #mqtt_user{clientid = ClientId}, Topic, [{AllowDeny, ClientId, TopicFilter}|Rules]) when is_binary(ClientId) ->
|
||||
case emqttd_topic:match(Topic, TopicFilter) of
|
||||
true -> AllowDeny;
|
||||
false -> match(User, Topic, Rules)
|
||||
end;
|
||||
match(User = #mqtt_user{peername = IpAddr}, Topic, [{AllowDeny, {peername, CIDR}, TopicFilter}|Rules]) ->
|
||||
case {match_cidr(IpAddr, CIDR), emqttd_topic:match(Topic, TopicFilter)} of
|
||||
{true, true} -> AllowDeny;
|
||||
_ -> match(User, Topic, Rules)
|
||||
end;
|
||||
match(User = #mqtt_user{username = Username}, Topic, [{AllowDeny, {username, Username}, TopicFilter}|Rules]) ->
|
||||
case emqttd_topic:match(Topic, TopicFilter) of
|
||||
true -> AllowDeny;
|
||||
false -> match(User, Topic, Rules)
|
||||
end.
|
||||
|
||||
|
||||
encode({allow, all}) ->
|
||||
{allow, all};
|
||||
encode({allow, Who, Topic}) ->
|
||||
{allow, encode(who, Who), Topic};
|
||||
encode({deny, all}) ->
|
||||
{deny, all};
|
||||
encode({deny, Who, Topic}) ->
|
||||
{deny, encode(who, Who), Topic}.
|
||||
|
||||
encode(who, all) ->
|
||||
all;
|
||||
encode(who, ClientId) when is_binary(ClientId) ->
|
||||
ClientId;
|
||||
encode(who, {ip, CIDR}) ->
|
||||
{Start, End} = esockd_access:range(CIDR),
|
||||
{ip, {CIDR, Start, End}};
|
||||
encode(who, {clientid, ClientId}) ->
|
||||
{clientid, compile(ClientId)};
|
||||
encode(who, {username, Username}) ->
|
||||
{username, compile(Username)}.
|
||||
|
||||
compile(Bin) when is_binary(Bin) ->
|
||||
Bin;
|
||||
compile({regexp, Regexp}) ->
|
||||
{ok, MP} = re:compile(Regexp),
|
||||
{regexp, Regexp, MP}.
|
||||
|
||||
decode({allow, all}) ->
|
||||
{allow, all};
|
||||
decode({allow, EncodedWho, Topic}) ->
|
||||
{allow, decode(who, EncodedWho), Topic};
|
||||
decode({deny, all}) ->
|
||||
{deny, all};
|
||||
decode({deny, EncodedWho, Topic}) ->
|
||||
{allow, decode(who, EncodedWho), Topic}.
|
||||
|
||||
decode(who, all) ->
|
||||
all;
|
||||
decode(who, ClientId) when is_binary(ClientId) ->
|
||||
ClientId;
|
||||
decode(who, {ip, {CIDR, _Start, _End}}) ->
|
||||
{ip, CIDR};
|
||||
decode(who, {clientid, ClientId}) when is_binary(ClientId) ->
|
||||
{clientid, uncompile(ClientId)};
|
||||
decode(who, {username, Username}) when is_binary(Username) ->
|
||||
{username, uncompile(Username)}.
|
||||
|
||||
uncompile(Bin) when is_binary(Bin) ->
|
||||
Bin;
|
||||
uncompile({regexp, Regexp, MP}) ->
|
||||
{ok, MP} = re:compile(Regexp),
|
||||
{regexp, Regexp}.
|
||||
|
||||
|
||||
Loading…
Reference in New Issue