acl...

apps/emqttd/src/emqttd_access.erl

@@ -1,155 +0,0 @@
-%%%-----------------------------------------------------------------------------
-%%% @Copyright (C) 2012-2015, Feng Lee <feng@emqtt.io>
-%%%
-%%% Permission is hereby granted, free of charge, to any person obtaining a copy
-%%% of this software and associated documentation files (the "Software"), to deal
-%%% in the Software without restriction, including without limitation the rights
-%%% to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-%%% copies of the Software, and to permit persons to whom the Software is
-%%% furnished to do so, subject to the following conditions:
-%%%
-%%% The above copyright notice and this permission notice shall be included in all
-%%% copies or substantial portions of the Software.
-%%%
-%%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-%%% IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-%%% FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-%%% AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-%%% LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-%%% OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-%%% SOFTWARE.
-%%%-----------------------------------------------------------------------------
-%%% @doc
-%%% emqttd access rule.
-%%%
-%%% @end
-%%%-----------------------------------------------------------------------------
--module(emqttd_access).
-
--author('feng@emqtt.io').
-
--include("emqttd.hrl").
-
--export([compile/1, match/3]).
-
--type pubsub() :: subscribe | publish | pubsub.
-
--type who() :: all | binary() |
-               {ipaddr, esockd_access:cidr()} |
-               {client, binary()} |
-               {user, binary()}.
-
--type rule() :: {allow, all} |
-                {allow, who(), pubsub(), list(binary())} |
-                {deny, all} |
-                {deny, who(), pubsub(), list(binary())}.
-
--define('allow|deny'(A), (A =:= allow) orelse (A =:= deny)).
-
-%%%-----------------------------------------------------------------------------
-%% @doc
-%% Compile rule.
-%%
-%% @end
-%%%-----------------------------------------------------------------------------
-compile({A, all}) when ?'allow|deny'(A) ->
-    {A, all};
-
-compile({A, Who, PubSub, TopicFilters}) when ?'allow|deny'(A) ->
-    {A, compile(who, Who), PubSub, [compile(topic, bin(Topic)) || Topic <- TopicFilters]}.
-
-compile(who, all) -> 
-    all;
-compile(who, {ipaddr, CIDR}) ->
-    {Start, End} = esockd_access:range(CIDR),
-    {ipaddr, {CIDR, Start, End}};
-compile(who, {client, all}) ->
-    {client, all};
-compile(who, {client, ClientId}) ->
-    {client, bin(ClientId)};
-compile(who, {user, all}) ->
-    {user, all};
-compile(who, {user, Username}) ->
-    {user, bin(Username)};
-
-compile(topic, Topic) ->
-    Words = emqttd_topic:words(Topic),
-    case pattern(Words) of
-        true -> {pattern, Words};
-        false -> Words
-    end.
-
-pattern(Words) ->
-    lists:member(<<"$u">>, Words)
-        orelse lists:member(<<"$c">>, Words).
-
-bin(L) when is_list(L) ->
-    list_to_binary(L);
-bin(B) when is_binary(B) ->
-    B.
-
-%%%-----------------------------------------------------------------------------
-%% @doc
-%% Match rule.
-%%
-%% @end
-%%%-----------------------------------------------------------------------------
--spec match(mqtt_user(), binary(), rule()) -> {matched, allow} | {matched, deny} | nomatch.
-match(_User, _Topic, {AllowDeny, all}) when ?'allow|deny'(AllowDeny) ->
-    {matched, AllowDeny};
-match(User, Topic, {AllowDeny, Who, _PubSub, TopicFilters})
-        when ?'allow|deny'(AllowDeny) ->
-    case match_who(User, Who) andalso match_topics(User, Topic, TopicFilters) of
-        true -> {matched, AllowDeny};
-        false -> nomatch
-    end.
-
-match_who(_User, all) ->
-    true;
-match_who(_User, {user, all}) ->
-    true;
-match_who(_User, {client, all}) ->
-    true;
-match_who(#mqtt_user{clientid = ClientId}, {client, ClientId}) ->
-    true;
-match_who(#mqtt_user{username = Username}, {user, Username}) ->
-    true;
-match_who(#mqtt_user{ipaddr = IP}, {ipaddr, {_CDIR, Start, End}}) ->
-    I = esockd_access:atoi(IP),
-    I >= Start andalso I =< End;
-match_who(_User, _Who) ->
-    false.
-
-match_topics(_User, _Topic, []) ->
-    false;
-match_topics(User, Topic, [{pattern, PatternFilter}|Filters]) ->
-    TopicFilter = feed_user(User, PatternFilter),
-    case match_topic(emqttd_topic:words(Topic), TopicFilter) of
-        true -> true;
-        false -> match_topics(User, Topic, Filters)
-    end;
-match_topics(User, Topic, [TopicFilter|Filters]) ->
-   case match_topic(emqttd_topic:words(Topic), TopicFilter) of
-    true -> true;
-    false -> match_topics(User, Topic, Filters)
-    end.
-
-match_topic(Topic, TopicFilter) ->
-    emqttd_topic:match(Topic, TopicFilter).
-
-feed_user(User, Pattern) ->
-    feed_user(User, Pattern, []).
-feed_user(_User, [], Acc) ->
-    lists:reverse(Acc);
-feed_user(User = #mqtt_user{clientid = undefined}, [<<"$c">>|Words], Acc) ->
-    feed_user(User, Words, [<<"$c">>|Acc]);
-feed_user(User = #mqtt_user{clientid = ClientId}, [<<"$c">>|Words], Acc) ->
-    feed_user(User, Words, [ClientId |Acc]);
-feed_user(User = #mqtt_user{username = undefined}, [<<"$u">>|Words], Acc) ->
-    feed_user(User, Words, [<<"$u">>|Acc]);
-feed_user(User = #mqtt_user{username = Username}, [<<"$u">>|Words], Acc) ->
-    feed_user(User, Words, [Username|Acc]);
-feed_user(User, [W|Words], Acc) ->
-    feed_user(User, Words, [W|Acc]).
-
-

apps/emqttd/src/emqttd_acl.erl

@@ -27,8 +27,6 @@
 %%% subscribe topic
 %%% publish to topic
 %%%
-%%% TODO: Support regexp...
-%%%
 %%% @end
 %%%-----------------------------------------------------------------------------
 -module(emqttd_acl).
@@ -41,30 +39,38 @@
 
 -define(SERVER, ?MODULE).
 
--define(ACL_TAB, mqtt_acl).
-
 %% API Function Exports
--export([start_link/0, check/3, allow/3, deny/3]).
+-export([start_link/1, check/3, reload/0]).
+
+-ifdef(TEST).
+
+-export([compile/1, match/3]).
+
+-endif.
 
 %% gen_server callbacks
 -export([init/1, handle_call/3, handle_cast/2, handle_info/2,
          terminate/2, code_change/3]).
 
--type pubsub() :: publish | subscribe.
+-type pubsub() :: subscribe | publish | pubsub.
 
 -type who() :: all | binary() |
-               {clientid, binary()} | 
+               {ipaddr, esockd_access:cidr()} |
-               {peername, string() | inet:ip_address()} |
+               {client, binary()} |
-               {username, binary()}.
+               {user, binary()}.
 
 -type rule() :: {allow, all} |
-                {allow, who(), binary()} |
+                {allow, who(), pubsub(), list(binary())} |
-                {deny,  all} |
+                {deny, all} |
-                {deny,  who(), binary()}.
+                {deny, who(), pubsub(), list(binary())}.
 
 -record(mqtt_acl, {pubsub   :: pubsub(),
                    rules    :: list(rule())}).
 
+-define(ACL_TAB, mqtt_acl).
+
+-record(state, {raw_rules = []}).
+
 %%%=============================================================================
 %%% API
 %%%=============================================================================
@@ -75,19 +81,20 @@
 %%
 %% @end
 %%------------------------------------------------------------------------------
--spec start_link() -> {ok, pid()} | ignore | {error, any()}.
+-spec start_link(AclOpts) -> {ok, pid()} | ignore | {error, any()} when
-start_link() ->
+    AclOpts     :: [{file, list()}].
-    gen_server:start_link({local, ?SERVER}, ?MODULE, [], []).
+start_link(AclOpts) ->
+    gen_server:start_link({local, ?SERVER}, ?MODULE, [AclOpts], []).
 
--spec check(PubSub, User, Topic) -> allowed | refused when
+-spec check(PubSub, User, Topic) -> allow | deny when
       PubSub :: pubsub(),
       User   :: mqtt_user(),
       Topic  :: binary().
 check(PubSub, User, Topic) ->
     case match(User, Topic, lookup(PubSub)) of
-        nomatch -> allowed;
+        nomatch          -> allow;
-        allowed -> allowed;
+        {matched, allow} -> allow;
-        refused -> refused
+        {matched, deny}  -> deny 
     end.
 
 lookup(PubSub) ->
@@ -98,68 +105,46 @@ lookup(PubSub) ->
 
 match(_User, _Topic, []) ->
     nomatch;
-match(User, Topic, Rules) ->
-    %TODO:...
-    nomatch.
 
--spec allow(PubSub, Who, Topic) -> ok | {error, any()} when 
+match(User, Topic, [Rule|Rules]) ->
-      PubSub :: pubsub(),
+    case match_rule(User, Topic, Rule) of
-      Who    :: who(),
+        nomatch -> match(User, Topic, Rules);
-      Topic  :: binary().
+        {matched, AllowDeny} -> {matched, AllowDeny}
-allow(PubSub, Who, Topic) ->
-    add_rule(PubSub, {allow, Who, Topic}).
-
--spec deny(PubSub, Who, Topic) -> ok | {error, any()} when
-      PubSub :: pubsub(),
-      Who    :: who(),
-      Topic  :: binary().
-deny(PubSub, Who, Topic) ->
-    add_rule(PubSub, {deny, Who, Topic}).
-
-add_rule(PubSub, RawRule) ->
-    case rule(RawRule) of
-        {error, Error} ->
-            {error, Error};
-        Rule -> 
-            F = fun() -> 
-                case mnesia:wread(?ACL_TAB, PubSub) of
-                    [] ->
-                        mnesia:write(?ACL_TAB, #mqtt_acl{pubsub = PubSub, rules = [Rule]});
-                    [Rules] ->
-                        mnesia:write(?ACL_TAB, #mqtt_acl{pubsub = PubSub, rules = [Rule|Rules]})
-                end
-            end,
-            case mnesia:transaction(F) of
-                {atomic, _} -> ok;
-                {aborted, Reason} -> {error, {aborted, Reason}}
-            end
     end.
 
-%% TODO: 
+-spec reload() -> ok.
--spec rule(rule()) -> rule().
+reload() ->
-rule({allow, all}) ->
+    gen_server:call(?SERVER, reload).
-    {allow, all};
-rule({allow, Who, Topic}) ->
-    {allow, Who, Topic};
-rule({deny, Who, Topic}) ->
-    {deny, Who, Topic};
-rule({deny, all}) ->
-    {deny, all}.
 
 %% ------------------------------------------------------------------
 %% gen_server Function Definitions
 %% ------------------------------------------------------------------
-init(Args) ->
+init([AclOpts]) ->
-    mnesia:create_table(?ACL_TAB, [
+    AclFile = proplists:get_value(file, AclOpts),
-		{type, set},
+    {ok, Terms} = file:consult(AclFile),
-		{record_name, mqtt_acl},
+    Rules = [compile(Term) || Term <- Terms],
-		{ram_copies, [node()]},
+    ets:new(?ACL_TAB, [set, protected, named_table, {keypos, 2}]),
-		{attributes, record_info(fields, mqtt_acl)}]),
+    lists:foreach(fun(PubSub) ->
-    mnesia:add_table_copy(?ACL_TAB, node(), ram_copies),
+        ets:insert(?ACL_TAB, #mqtt_acl{pubsub = PubSub, rules = 
-    {ok, Args}.
+            lists:filter(fun(Rule) -> filter(PubSub, Rule) end, Rules)})
+        end, [publish, subscribe]),
+    {ok, #state{raw_rules = Terms}}.
 
-handle_call(_Request, _From, State) ->
+filter(_PubSub, {allow, all}) ->
-    {reply, error, State}.
+    true;
+filter(_PubSub, {deny, all}) ->
+    true;
+filter(publish, {_AllowDeny, _Who, publish, _Topics}) ->
+    true;
+filter(_PubSub, {_AllowDeny, _Who, pubsub, _Topics}) ->
+    true;
+filter(subscribe, {_AllowDeny, _Who, subscribe, _Topics}) ->
+    true;
+filter(_PubSub, {_AllowDeny, _Who, _, _Topics}) ->
+    false.
+
+handle_call(reload, _From, State) ->
+    {reply, {error, unsupported}, State}.
 
 handle_cast(_Msg, State) ->
     {noreply, State}.
@@ -173,9 +158,114 @@ terminate(_Reason, _State) ->
 code_change(_OldVsn, State, _Extra) ->
     {ok, State}.
 
-%% ------------------------------------------------------------------
+%%%=============================================================================
-%% Internal Function Definitions
+%%% Internal functions
-%% ------------------------------------------------------------------
+%%%=============================================================================
-
+
+%%%-----------------------------------------------------------------------------
+%% @doc
+%% Compile rule.
+%%
+%% @end
+%%%-----------------------------------------------------------------------------
+compile({A, all}) when (A =:= allow) orelse (A =:= deny) ->
+    {A, all};
+
+compile({A, Who, PubSub, TopicFilters}) when (A =:= allow) orelse (A =:= deny) ->
+    {A, compile(who, Who), PubSub, [compile(topic, bin(Topic)) || Topic <- TopicFilters]}.
+
+compile(who, all) -> 
+    all;
+compile(who, {ipaddr, CIDR}) ->
+    {Start, End} = esockd_access:range(CIDR),
+    {ipaddr, {CIDR, Start, End}};
+compile(who, {client, all}) ->
+    {client, all};
+compile(who, {client, ClientId}) ->
+    {client, bin(ClientId)};
+compile(who, {user, all}) ->
+    {user, all};
+compile(who, {user, Username}) ->
+    {user, bin(Username)};
+
+compile(topic, Topic) ->
+    Words = emqttd_topic:words(Topic),
+    case pattern(Words) of
+        true -> {pattern, Words};
+        false -> Words
+    end.
+
+pattern(Words) ->
+    lists:member(<<"$u">>, Words)
+        orelse lists:member(<<"$c">>, Words).
+
+bin(L) when is_list(L) ->
+    list_to_binary(L);
+bin(B) when is_binary(B) ->
+    B.
+
+%%%-----------------------------------------------------------------------------
+%% @doc
+%% Match rule.
+%%
+%% @end
+%%%-----------------------------------------------------------------------------
+-spec match_rule(mqtt_user(), binary(), rule()) -> {matched, allow} | {matched, deny} | nomatch.
+match_rule(_User, _Topic, {AllowDeny, all}) when (AllowDeny =:= allow) orelse (AllowDeny =:= deny) ->
+    {matched, AllowDeny};
+match_rule(User, Topic, {AllowDeny, Who, _PubSub, TopicFilters})
+        when (AllowDeny =:= allow) orelse (AllowDeny =:= deny)  ->
+    case match_who(User, Who) andalso match_topics(User, Topic, TopicFilters) of
+        true -> {matched, AllowDeny};
+        false -> nomatch
+    end.
+
+match_who(_User, all) ->
+    true;
+match_who(_User, {user, all}) ->
+    true;
+match_who(_User, {client, all}) ->
+    true;
+match_who(#mqtt_user{clientid = ClientId}, {client, ClientId}) ->
+    true;
+match_who(#mqtt_user{username = Username}, {user, Username}) ->
+    true;
+match_who(#mqtt_user{ipaddr = IP}, {ipaddr, {_CDIR, Start, End}}) ->
+    I = esockd_access:atoi(IP),
+    I >= Start andalso I =< End;
+match_who(_User, _Who) ->
+    false.
+
+match_topics(_User, _Topic, []) ->
+    false;
+match_topics(User, Topic, [{pattern, PatternFilter}|Filters]) ->
+    TopicFilter = feed_var(User, PatternFilter),
+    case match_topic(emqttd_topic:words(Topic), TopicFilter) of
+        true -> true;
+        false -> match_topics(User, Topic, Filters)
+    end;
+match_topics(User, Topic, [TopicFilter|Filters]) ->
+   case match_topic(emqttd_topic:words(Topic), TopicFilter) of
+    true -> true;
+    false -> match_topics(User, Topic, Filters)
+    end.
+
+match_topic(Topic, TopicFilter) ->
+    emqttd_topic:match(Topic, TopicFilter).
+
+feed_var(User, Pattern) ->
+    feed_var(User, Pattern, []).
+feed_var(_User, [], Acc) ->
+    lists:reverse(Acc);
+feed_var(User = #mqtt_user{clientid = undefined}, [<<"$c">>|Words], Acc) ->
+    feed_var(User, Words, [<<"$c">>|Acc]);
+feed_var(User = #mqtt_user{clientid = ClientId}, [<<"$c">>|Words], Acc) ->
+    feed_var(User, Words, [ClientId |Acc]);
+feed_var(User = #mqtt_user{username = undefined}, [<<"$u">>|Words], Acc) ->
+    feed_var(User, Words, [<<"$u">>|Acc]);
+feed_var(User = #mqtt_user{username = Username}, [<<"$u">>|Words], Acc) ->
+    feed_var(User, Words, [Username|Acc]);
+feed_var(User, [W|Words], Acc) ->
+    feed_var(User, Words, [W|Acc]).
 
 

apps/emqttd/test/emqttd_acl_tests.erl

@@ -20,11 +20,11 @@
 %%% SOFTWARE.
 %%%-----------------------------------------------------------------------------
 %%% @doc
-%%% emqttd_access rules tests.
+%%% emqttd_acl tests.
 %%%
 %%% @end
 %%%-----------------------------------------------------------------------------
--module(emqttd_access_tests).
+-module(emqttd_acl_tests).
 
 -include("emqttd.hrl").
 
@@ -34,43 +34,44 @@
 
 compile_test() ->
     ?assertMatch({allow, {ipaddr, {"127.0.0.1", _I, _I}}, subscribe, [ [<<"$SYS">>, '#'], ['#'] ]},
-                 emqttd_access:compile({allow, {ipaddr, "127.0.0.1"}, subscribe, ["$SYS/#", "#"]})),
+                 emqttd_acl:compile({allow, {ipaddr, "127.0.0.1"}, subscribe, ["$SYS/#", "#"]})),
     ?assertMatch({allow, {user, <<"testuser">>}, subscribe, [ [<<"a">>, <<"b">>, <<"c">>], [<<"d">>, <<"e">>, <<"f">>, '#'] ]},
-                 emqttd_access:compile({allow, {user, "testuser"}, subscribe, ["a/b/c", "d/e/f/#"]})),
+                 emqttd_acl:compile({allow, {user, "testuser"}, subscribe, ["a/b/c", "d/e/f/#"]})),
     ?assertEqual({allow, {user, <<"admin">>}, pubsub, [ [<<"d">>, <<"e">>, <<"f">>, '#'] ]},
-                 emqttd_access:compile({allow, {user, "admin"}, pubsub, ["d/e/f/#"]})),
+                 emqttd_acl:compile({allow, {user, "admin"}, pubsub, ["d/e/f/#"]})),
     ?assertEqual({allow, {client, <<"testClient">>}, publish, [ [<<"testTopics">>, <<"testClient">>] ]},
-                 emqttd_access:compile({allow, {client, "testClient"}, publish, ["testTopics/testClient"]})),
+                 emqttd_acl:compile({allow, {client, "testClient"}, publish, ["testTopics/testClient"]})),
     ?assertEqual({allow, all, pubsub, [{pattern, [<<"clients">>, <<"$c">>]}]},
-                 emqttd_access:compile({allow, all, pubsub, ["clients/$c"]})),
+                 emqttd_acl:compile({allow, all, pubsub, ["clients/$c"]})),
     ?assertEqual({allow, all, subscribe, [{pattern, [<<"users">>, <<"$u">>, '#']}]},
-                 emqttd_access:compile({allow, all, subscribe, ["users/$u/#"]})),
+                 emqttd_acl:compile({allow, all, subscribe, ["users/$u/#"]})),
     ?assertEqual({deny, all, subscribe, [ [<<"$SYS">>, '#'], ['#'] ]},
-                 emqttd_access:compile({deny, all, subscribe, ["$SYS/#", "#"]})),
+                 emqttd_acl:compile({deny, all, subscribe, ["$SYS/#", "#"]})),
-    ?assertEqual({allow, all}, emqttd_access:compile({allow, all})),
+    ?assertEqual({allow, all}, emqttd_acl:compile({allow, all})),
-    ?assertEqual({deny, all},  emqttd_access:compile({deny, all})).
+    ?assertEqual({deny, all},  emqttd_acl:compile({deny, all})).
 
 match_test() ->
     User = #mqtt_user{ipaddr = {127,0,0,1}, clientid = <<"testClient">>, username = <<"TestUser">>},
     User2 = #mqtt_user{ipaddr = {192,168,0,10}, clientid = <<"testClient">>, username = <<"TestUser">>},
-    ?assertEqual({matched, allow}, emqttd_access:match(User, <<"Test/Topic">>, {allow, all})),
+    
-    ?assertEqual({matched, deny},  emqttd_access:match(User, <<"Test/Topic">>, {deny, all})),
+    ?assertEqual({matched, allow}, emqttd_acl:match(User, <<"Test/Topic">>, [{allow, all}])),
-    ?assertMatch({matched, allow}, emqttd_access:match(User, <<"Test/Topic">>,
+    ?assertEqual({matched, deny},  emqttd_acl:match(User, <<"Test/Topic">>, [{deny, all}])),
-                 emqttd_access:compile({allow, {ipaddr, "127.0.0.1"}, subscribe, ["$SYS/#", "#"]}))),
+    ?assertMatch({matched, allow}, emqttd_acl:match(User, <<"Test/Topic">>,
-    ?assertMatch({matched, allow}, emqttd_access:match(User2, <<"Test/Topic">>,
+                 emqttd_acl:compile({allow, {ipaddr, "127.0.0.1"}, subscribe, ["$SYS/#", "#"]}))),
-                 emqttd_access:compile({allow, {ipaddr, "192.168.0.1/24"}, subscribe, ["$SYS/#", "#"]}))),
+    ?assertMatch({matched, allow}, emqttd_acl:match(User2, <<"Test/Topic">>,
-    ?assertMatch({matched, allow}, emqttd_access:match(User, <<"d/e/f/x">>,
+                 emqttd_acl:compile({allow, {ipaddr, "192.168.0.1/24"}, subscribe, ["$SYS/#", "#"]}))),
-                                                       emqttd_access:compile({allow, {user, "TestUser"}, subscribe, ["a/b/c", "d/e/f/#"]}))),
+    ?assertMatch({matched, allow}, emqttd_acl:match(User, <<"d/e/f/x">>,
-    ?assertEqual(nomatch, emqttd_access:match(User, <<"d/e/f/x">>, emqttd_access:compile({allow, {user, "admin"}, pubsub, ["d/e/f/#"]}))),
+                                                       emqttd_acl:compile({allow, {user, "TestUser"}, subscribe, ["a/b/c", "d/e/f/#"]}))),
-    ?assertMatch({matched, allow}, emqttd_access:match(User, <<"testTopics/testClient">>,
+    ?assertEqual(nomatch, emqttd_acl:match(User, <<"d/e/f/x">>, emqttd_access:compile({allow, {user, "admin"}, pubsub, ["d/e/f/#"]}))),
-                 emqttd_access:compile({allow, {client, "testClient"}, publish, ["testTopics/testClient"]}))),
+    ?assertMatch({matched, allow}, emqttd_acl:match(User, <<"testTopics/testClient">>,
-    ?assertMatch({matched, allow}, emqttd_access:match(User, <<"clients/testClient">>,
+                 emqttd_acl:compile({allow, {client, "testClient"}, publish, ["testTopics/testClient"]}))),
-                                                       emqttd_access:compile({allow, all, pubsub, ["clients/$c"]}))),
+    ?assertMatch({matched, allow}, emqttd_acl:match(User, <<"clients/testClient">>,
-    ?assertMatch({matched, allow}, emqttd_access:match(#mqtt_user{username = <<"user2">>}, <<"users/user2/abc/def">>,
+                                                       emqttd_acl:compile({allow, all, pubsub, ["clients/$c"]}))),
-                                                                  emqttd_access:compile({allow, all, subscribe, ["users/$u/#"]}))),
+    ?assertMatch({matched, allow}, emqttd_acl:match(#mqtt_user{username = <<"user2">>}, <<"users/user2/abc/def">>,
+                                                                  emqttd_acl:compile({allow, all, subscribe, ["users/$u/#"]}))),
     ?assertMatch({matched, deny}, 
-                 emqttd_access:match(User, <<"d/e/f">>,
+                 emqttd_acl:match(User, <<"d/e/f">>,
-                                     emqttd_access:compile({deny, all, subscribe, ["$SYS/#", "#"]}))).
+                                     emqttd_acl:compile({deny, all, subscribe, ["$SYS/#", "#"]}))).
 
 -endif.
 

rel/files/acl.config

@@ -1,6 +1,3 @@
-
-
-
 {allow, {ipaddr, "127.0.0.1"}, subscribe, ["$SYS/#", "#"]}.
 
 {allow, {user, "testuser"}, subscribe, ["a/b/c", "d/e/f/#"]}.
@@ -16,3 +13,4 @@
 {deny, all, subscribe, ["$SYS/#", "#"]}.
 
 {allow, all}.
+

rel/files/app.config

@@ -38,9 +38,10 @@
     {logger, {lager, info}}
  ]},
  {emqttd, [
-    %Authetication. Internal, Anonymous Default.
+    %Authetication. Internal, Anonymous Default
-    {auth, {anonymous, []}}, 
+    {auth, {anonymous, []}},
-    {access, []},
+    %ACL config
+    {acl, [{file, "etc/acl.config"}]},
     {packet, [
         {max_clientid_len, 1024},
         {max_packet_size, 16#ffff}