From 414f6af663c061edccb087f878ca1eec4fc72960 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Thu, 1 Jun 2023 00:26:40 +0800
Subject: [PATCH 01/18] chore: sync some code from ee

---
 apps/emqx_management/src/emqx_mgmt_http.erl    | 13 +++++++++++--
 apps/emqx_retainer/src/emqx_retainer.appup.src | 18 ++++++++----------
 apps/emqx_retainer/src/emqx_retainer.erl       |  2 +-
 src/emqx_plugins.erl                           |  6 ++++--
 test/emqx_plugins_SUITE.erl                    |  3 ++-
 5 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/apps/emqx_management/src/emqx_mgmt_http.erl b/apps/emqx_management/src/emqx_mgmt_http.erl
index 7f571ee70..d6b63180c 100644
--- a/apps/emqx_management/src/emqx_mgmt_http.erl
+++ b/apps/emqx_management/src/emqx_mgmt_http.erl
@@ -144,7 +144,17 @@ authorize_appid(_Method, _Path, Req) ->
     end.
 
 -ifdef(EMQX_ENTERPRISE).
-filter(_) ->
+filter(#{module := Module} = Route) ->
+    %% true if anything goes wrong
+    try
+        case erlang:function_exported(Module, filter, 1) of
+            true -> apply(Module, filter, [Route]);
+            false -> true
+        end
+    catch _:_ ->
+        true
+    end;
+filter(_Route) ->
     true.
 -else.
 filter(#{app := emqx_modules}) -> true;
@@ -156,7 +166,6 @@ filter(#{app := App}) ->
     end.
 -endif.
 
-
 format(Port) when is_integer(Port) ->
     io_lib:format("0.0.0.0:~w", [Port]);
 format({Addr, Port}) when is_list(Addr) ->
diff --git a/apps/emqx_retainer/src/emqx_retainer.appup.src b/apps/emqx_retainer/src/emqx_retainer.appup.src
index 3609fa78a..d944426a3 100644
--- a/apps/emqx_retainer/src/emqx_retainer.appup.src
+++ b/apps/emqx_retainer/src/emqx_retainer.appup.src
@@ -1,25 +1,23 @@
 %% -*- mode: erlang -*-
 %% Unless you know what you are doing, DO NOT edit manually!!
 {VSN,
-  [{<<"4\\.4\\.[1-5]">>,
+  [{"4.4.6",[{load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
+   {<<"4\\.4\\.[1-5]">>,
     [{load_module,emqx_retainer_sup,brutal_purge,soft_purge,[]},
      {apply,{emqx_retainer_sup,ensure_worker_pool_started,[]}},
-     {load_module,emqx_retainer,brutal_purge,soft_purge,[]}
-    ]},
+     {load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
    {"4.4.0",
     [{load_module,emqx_retainer_sup,brutal_purge,soft_purge,[]},
      {apply,{emqx_retainer_sup,ensure_worker_pool_started,[]}},
      {load_module,emqx_retainer,brutal_purge,soft_purge,[]},
-     {load_module,emqx_retainer_cli,brutal_purge,soft_purge,[]}
-    ]},
+     {load_module,emqx_retainer_cli,brutal_purge,soft_purge,[]}]},
    {<<".*">>,[]}],
-  [{<<"4\\.4\\.[1-5]">>,
+  [{"4.4.6",[{load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
+   {<<"4\\.4\\.[1-5]">>,
     [{load_module,emqx_retainer_sup,brutal_purge,soft_purge,[]},
-     {load_module,emqx_retainer,brutal_purge,soft_purge,[]}
-    ]},
+     {load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
    {"4.4.0",
     [{load_module,emqx_retainer_sup,brutal_purge,soft_purge,[]},
      {load_module,emqx_retainer,brutal_purge,soft_purge,[]},
-     {load_module,emqx_retainer_cli,brutal_purge,soft_purge,[]}
-    ]},
+     {load_module,emqx_retainer_cli,brutal_purge,soft_purge,[]}]},
    {<<".*">>,[]}]}.
diff --git a/apps/emqx_retainer/src/emqx_retainer.erl b/apps/emqx_retainer/src/emqx_retainer.erl
index 281aacb6b..e1bf32d99 100644
--- a/apps/emqx_retainer/src/emqx_retainer.erl
+++ b/apps/emqx_retainer/src/emqx_retainer.erl
@@ -36,7 +36,7 @@
         , on_message_publish/2
         ]).
 
--export([clean/1]).
+-export([clean/1, read_messages/1]).
 
 %% for emqx_pool task func
 -export([dispatch/2]).
diff --git a/src/emqx_plugins.erl b/src/emqx_plugins.erl
index 7f7d531c0..3ca36f26c 100644
--- a/src/emqx_plugins.erl
+++ b/src/emqx_plugins.erl
@@ -253,13 +253,15 @@ default_plugins() ->
         %% default is true in data/load_modules. **NOT HERE**
         {emqx_retainer, false},
         {emqx_recon, false},
-        %% emqx_telemetry is not exist in enterprise.
+        %% emqx_telemetry does not exist in enterprise.
         %% {emqx_telemetry, false},
         {emqx_rule_engine, true},
         {emqx_bridge_mqtt, false},
         {emqx_schema_registry, true},
         {emqx_eviction_agent, true},
-        {emqx_node_rebalance, true}
+        {emqx_node_rebalance, true},
+        %% emqx_gcp_device is managed by emqx_modules.
+        {emqx_gcp_device, false}
     ].
 
 -endif.
diff --git a/test/emqx_plugins_SUITE.erl b/test/emqx_plugins_SUITE.erl
index 6e0994757..3d5a9712f 100644
--- a/test/emqx_plugins_SUITE.erl
+++ b/test/emqx_plugins_SUITE.erl
@@ -119,7 +119,8 @@ default_plugins() ->
         {emqx_rule_engine, true},
         {emqx_schema_registry, true},
         {emqx_eviction_agent, true},
-        {emqx_node_rebalance, true}
+        {emqx_node_rebalance, true},
+        {emqx_gcp_device, false}
     ].
 
 

From 007144a3ccedbebf3d0e694d15076430015561ad Mon Sep 17 00:00:00 2001
From: William Yang <mscame@gmail.com>
Date: Thu, 8 Jun 2023 13:24:46 +0200
Subject: [PATCH 02/18] chore: add missing TLS defaults in emqx.conf

- partial chain
- verify_peer_ext_key_usage
---
 etc/emqx.conf | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/etc/emqx.conf b/etc/emqx.conf
index 9abb6b414..f3d91a4bb 100644
--- a/etc/emqx.conf
+++ b/etc/emqx.conf
@@ -1673,6 +1673,41 @@ crl_cache_refresh_interval = 15m
 ## Value: Ciphers
 listener.ssl.external.ciphers = TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHA,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES128-SHA256,AES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA
 
+## When EMQX verifies a client certificate during the x509 path validation
+## process, it constructs a certificate chain that starts with the client
+## certificate and ends with a trust anchor.
+## By default, if the setting is set to `false`, the trust anchor is the
+## rootCA, and the certificate chain must be complete.
+## However, if the setting is set to `true` or `cacert_from_cacertfile`,
+## the last certificate in the cacertfile will be used as the trust anchor
+## certificate (such as an intermediate CA). This creates a partial chain
+## in the path validation.
+## Alternatively, if the setting is set to `two_cacerts_from_cacertfile`,
+## one of the last two certificates in the cacertfile will be used as the
+## trust anchor certificate, forming a partial chain. This option is
+## particularly useful for CA certificate rotation.
+## However, please note that it incurs some additional overhead, so it
+## should only be used for certificate rotation purposes.
+##
+## Values: false | true | cacert_from_cacertfile | two_cacerts_from_cacertfile
+## listener.ssl.external.partial_chain = false
+
+## For additional client certificate validation, the value defined here must present in the
+## 'Extended Key Usage' of client certificate defined in
+## [rfc5280](https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12).
+##
+## Allowed values are
+## - "clientAuth"
+## - "serverAuth"
+## - "codeSigning"
+## - "emailProtection"
+## - "timeStamping"
+## - "ocspSigning"
+## - raw OID, example: "OID:1.3.6.1.5.5.7.3.2"
+## Comma-separated string is also supported for validating the subset of key usages.
+## example, "serverAuth,OID:1.3.6.1.5.5.7.3.2"
+##
+## listener.ssl.external.verify_peer_ext_key_usage = "clientAuth"
 
 ## Ciphers for TLS PSK.
 ## Note that 'listener.ssl.external.ciphers' and 'listener.ssl.external.psk_ciphers' cannot

From 2487aa906f811dbf33c9c3785964dd85931b9a9c Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Sun, 11 Jun 2023 18:56:46 +0800
Subject: [PATCH 03/18] fix: improve the change logs

---
 changes/v4.4.19-en.md | 8 ++++++--
 changes/v4.4.19-zh.md | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/changes/v4.4.19-en.md b/changes/v4.4.19-en.md
index f7525a253..a71da1a3a 100644
--- a/changes/v4.4.19-en.md
+++ b/changes/v4.4.19-en.md
@@ -21,9 +21,13 @@
   2023-04-20T18:10:17.205436+08:00 [error] [esockd_proxy_protocol] The listener 127.0.0.1:8883 is working in proxy protocol mode, but timed out while waiting for proxy_protocol header
   ```
 
-- Adds a new feature to enable partial certificate chain validation for TLS listeners[#10553](https://github.com/emqx/emqx/pull/10553).
+- Adds a new feature to enable partial certificate chain validation for TLS listeners [#10553](https://github.com/emqx/emqx/pull/10553).
 
-- Adds a new feature to enable client certificate extended key usage validation for TLS listeners[#10669](https://github.com/emqx/emqx/pull/10669).
+  For details please checkout the `listener.ssl.external.partial_chain` in the `zones.conf` config file.
+
+- Adds a new feature to enable client certificate extended key usage validation for TLS listeners [#10669](https://github.com/emqx/emqx/pull/10669).
+
+  For details please checkout the `listener.ssl.external.verify_peer_ext_key_usage` in the `zones.conf` config file.
 
 - Added the `live_connections` field in the HTTP API `/api/v4/nodes` response [#10859](https://github.com/emqx/emqx/pull/10859).
 
diff --git a/changes/v4.4.19-zh.md b/changes/v4.4.19-zh.md
index cf0294713..e07915749 100644
--- a/changes/v4.4.19-zh.md
+++ b/changes/v4.4.19-zh.md
@@ -21,9 +21,13 @@
   2023-04-20T18:10:17.205436+08:00 [error] [esockd_proxy_protocol] The listener 127.0.0.1:8883 is working in proxy protocol mode, but timed out while waiting for proxy_protocol header
   ```
 
-- 增加了一个新功能，为 TLS 监听器启用部分证书链验证 [#10553](https://github.com/emqx/emqx/pull/10553)。
+- 增加了一个新功能，用户可以在 TLS 监听器中启用“部分证书链验证”了 [#10553](https://github.com/emqx/emqx/pull/10553)。
 
-- 增加了一个新功能，为 TLS 监听器启用客户端证书扩展密钥使用验证 [#10669](https://github.com/emqx/emqx/pull/10669)。
+  详情请查看 `zones.conf` 配置文件中的 `listener.ssl.external.partial_chain` 配置项。
+
+- 增加了一个新功能，用户可以在 TLS 监听器中启用“客户端证书扩展密钥用途验证”了 [#10669](https://github.com/emqx/emqx/pull/10669)。
+
+  详情请查看 `zones.conf` 配置文件中的 `listener.ssl.external.verify_peer_ext_key_usage` 配置项。
 
 - 在 HTTP API `/api/v4/nodes` 的返回中增加 `live_connections` 字段 [#10859](https://github.com/emqx/emqx/pull/10859)。
 

From 6426bf29eb0d1364fc2843b338260637af169e46 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Sun, 11 Jun 2023 18:57:30 +0800
Subject: [PATCH 04/18] chore: release v4.4.19-alpha.2

---
 include/emqx_release.hrl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/emqx_release.hrl b/include/emqx_release.hrl
index 9f54519d9..b0943366e 100644
--- a/include/emqx_release.hrl
+++ b/include/emqx_release.hrl
@@ -29,7 +29,7 @@
 
 -ifndef(EMQX_ENTERPRISE).
 
--define(EMQX_RELEASE, {opensource, "4.4.19-alpha.1"}).
+-define(EMQX_RELEASE, {opensource, "4.4.19-alpha.2"}).
 
 -else.
 

From fd551e92d1f0f7fbebd83a6c2eacd2236b97962d Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Sun, 11 Jun 2023 19:23:39 +0800
Subject: [PATCH 05/18] chore: sync code from ee

---
 apps/emqx_retainer/src/emqx_retainer.app.src  |  2 +-
 .../emqx_retainer/src/emqx_retainer.appup.src |  6 ++--
 apps/emqx_retainer/src/emqx_retainer_sup.erl  |  7 ++++-
 etc/emqx.conf                                 |  2 +-
 scripts/get-dashboard.sh                      |  3 +-
 src/emqx_hooks.erl                            |  4 +++
 src/emqx_listeners.erl                        |  3 +-
 src/emqx_tls_lib.erl                          | 31 +++++++++++++++++++
 8 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/apps/emqx_retainer/src/emqx_retainer.app.src b/apps/emqx_retainer/src/emqx_retainer.app.src
index 5f206a155..40cdcd11d 100644
--- a/apps/emqx_retainer/src/emqx_retainer.app.src
+++ b/apps/emqx_retainer/src/emqx_retainer.app.src
@@ -1,6 +1,6 @@
 {application, emqx_retainer,
  [{description, "EMQX Retainer"},
-  {vsn, "4.4.6"}, % strict semver, bump manually!
+  {vsn, "4.4.7"}, % strict semver, bump manually!
   {modules, []},
   {registered, [emqx_retainer_sup]},
   {applications, [kernel,stdlib]},
diff --git a/apps/emqx_retainer/src/emqx_retainer.appup.src b/apps/emqx_retainer/src/emqx_retainer.appup.src
index d944426a3..a41678b21 100644
--- a/apps/emqx_retainer/src/emqx_retainer.appup.src
+++ b/apps/emqx_retainer/src/emqx_retainer.appup.src
@@ -1,8 +1,7 @@
 %% -*- mode: erlang -*-
 %% Unless you know what you are doing, DO NOT edit manually!!
 {VSN,
-  [{"4.4.6",[{load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
-   {<<"4\\.4\\.[1-5]">>,
+  [{<<"4\\.4\\.[1-6]">>,
     [{load_module,emqx_retainer_sup,brutal_purge,soft_purge,[]},
      {apply,{emqx_retainer_sup,ensure_worker_pool_started,[]}},
      {load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
@@ -12,8 +11,7 @@
      {load_module,emqx_retainer,brutal_purge,soft_purge,[]},
      {load_module,emqx_retainer_cli,brutal_purge,soft_purge,[]}]},
    {<<".*">>,[]}],
-  [{"4.4.6",[{load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
-   {<<"4\\.4\\.[1-5]">>,
+  [{<<"4\\.4\\.[1-6]">>,
     [{load_module,emqx_retainer_sup,brutal_purge,soft_purge,[]},
      {load_module,emqx_retainer,brutal_purge,soft_purge,[]}]},
    {"4.4.0",
diff --git a/apps/emqx_retainer/src/emqx_retainer_sup.erl b/apps/emqx_retainer/src/emqx_retainer_sup.erl
index 02ced41ef..97f56140c 100644
--- a/apps/emqx_retainer/src/emqx_retainer_sup.erl
+++ b/apps/emqx_retainer/src/emqx_retainer_sup.erl
@@ -32,7 +32,12 @@ start_link(Env) ->
 
 ensure_worker_pool_started() ->
     try
-        supervisor:start_child(?MODULE, worker_pool_spec())
+        case is_managed_by_modules() of
+            true ->
+                supervisor:start_child(emqx_modules_sup, worker_pool_spec());
+            false ->
+                supervisor:start_child(?MODULE, worker_pool_spec())
+        end
     catch
         _:_ -> ignore
     end.
diff --git a/etc/emqx.conf b/etc/emqx.conf
index f3d91a4bb..84d0864ee 100644
--- a/etc/emqx.conf
+++ b/etc/emqx.conf
@@ -2611,7 +2611,7 @@ broker.route_batch_clean = off
 ## are mostly published to topics with large number of levels.
 ##
 ## NOTE: This is a cluster-wide configuration.
-## It rquires all nodes to be stopped before changing it.
+## It requires all nodes to be stopped before changing it.
 ##
 ## Value: Enum
 ##  - true: enable trie path compaction
diff --git a/scripts/get-dashboard.sh b/scripts/get-dashboard.sh
index 632fed25c..0ba0d82ec 100755
--- a/scripts/get-dashboard.sh
+++ b/scripts/get-dashboard.sh
@@ -14,7 +14,7 @@ case "${PKG_VSN}" in
     4.4*)
         # keep the above 4.3 untouched, otherwise conflicts!
         EMQX_CE_DASHBOARD_VERSION='v4.4.11'
-        EMQX_EE_DASHBOARD_VERSION='v4.4.24'
+        EMQX_EE_DASHBOARD_VERSION='v4.4.26'
         ;;
     *)
         echo "Unsupported version $PKG_VSN" >&2
@@ -49,6 +49,7 @@ if [ -d "$DASHBOARD_PATH/www" ] && [ "$(version)" = "$VERSION" ]; then
     exit 0
 fi
 
+echo "Downloading dashboard from $DIRECT_DOWNLOAD_URL"
 curl -L --silent --show-error \
      --header "Accept: application/octet-stream" \
      --output "${RELEASE_ASSET_FILE}" \
diff --git a/src/emqx_hooks.erl b/src/emqx_hooks.erl
index c7ec23fcf..aaf92a44a 100644
--- a/src/emqx_hooks.erl
+++ b/src/emqx_hooks.erl
@@ -21,6 +21,9 @@
 -include("logger.hrl").
 -include("types.hrl").
 
+-include_lib("snabbkaffe/include/snabbkaffe.hrl").
+
+
 -ifdef(TEST).
 -include_lib("eunit/include/eunit.hrl").
 -endif.
@@ -285,6 +288,7 @@ handle_cast({del, HookPoint, Action}, State) ->
         Callbacks ->
             ok = insert_hook(HookPoint, Callbacks)
     end,
+    ?tp(debug, emqx_hook_removed, #{hookpoint => HookPoint, action => Action}),
     {noreply, State};
 
 handle_cast(Msg, State) ->
diff --git a/src/emqx_listeners.erl b/src/emqx_listeners.erl
index baa840d04..13be71cf3 100644
--- a/src/emqx_listeners.erl
+++ b/src/emqx_listeners.erl
@@ -140,7 +140,8 @@ start_listener(Proto, ListenOn, Options0) when Proto == ssl; Proto == tls ->
     Options1 = proplists:delete(listener_id, Options0),
     Options2 = emqx_ocsp_cache:inject_sni_fun(ListenerID, Options1),
     Options3 = emqx_tls_lib:inject_root_fun(Options2),
-    Options = emqx_tls_lib:inject_verify_fun(Options3),
+    Options4 = emqx_tls_lib:inject_verify_fun(Options3),
+    Options = emqx_tls_lib:maybe_drop_incompatible_options(Options4),
     ok = maybe_register_crl_urls(Options),
     start_mqtt_listener('mqtt:ssl', ListenOn, Options);
 
diff --git a/src/emqx_tls_lib.erl b/src/emqx_tls_lib.erl
index 6aca651f5..2e330992a 100644
--- a/src/emqx_tls_lib.erl
+++ b/src/emqx_tls_lib.erl
@@ -26,6 +26,7 @@
         , inject_verify_fun/1
         , opt_partial_chain/1
         , opt_verify_fun/1
+        , maybe_drop_incompatible_options/1
         ]).
 
 -include("logger.hrl").
@@ -239,6 +240,23 @@ do_rootfun_trusted_ca_from_cacertfile(NumOfCerts, Cacertfile) ->
                              lists:sublist(public_key:pem_decode(PemBin), Pos, NumOfCerts)],
     emqx_const_v2:make_tls_root_fun(cacert_from_cacertfile, Trusted).
 
+maybe_drop_incompatible_options(Options) ->
+    case proplists:get_value(ssl_options, Options) of
+        undefined ->
+            Options;
+        SslOpts ->
+            maybe_drop_incompatible_options(Options, SslOpts, lists:keyfind(versions, 1, SslOpts))
+    end.
+
+maybe_drop_incompatible_options(Options, _SslOpts, false) ->
+    Options;
+maybe_drop_incompatible_options(Options, SslOpts0, {versions, ['tlsv1.3']}) ->
+    Incompatible = [reuse_sessions, secure_renegotiate, user_lookup_fun, client_renegotiation],
+    SslOpts = lists:filter(fun({K, _V}) -> not lists:member(K, Incompatible) end, SslOpts0),
+    lists:keyreplace(ssl_options, 1, Options, {ssl_options, SslOpts});
+maybe_drop_incompatible_options(Options, _SslOpts, {versions, [_ | _]}) ->
+    Options.
+
 -if(?OTP_RELEASE > 22).
 -ifdef(TEST).
 -include_lib("eunit/include/eunit.hrl").
@@ -261,5 +279,18 @@ drop_tls13_no_versions_cipers_test() ->
 has_tlsv13_cipher(Ciphers) ->
     lists:any(fun(C) -> lists:member(C, Ciphers) end, ?TLSV13_EXCLUSIVE_CIPHERS).
 
+maybe_drop_incompatible_options_test() ->
+    Opts0 = [{ssl_options, [{versions, ['tlsv1.3']}, {ciphers, ?TLSV13_EXCLUSIVE_CIPHERS},
+                            {reuse_sessions, true}, {secure_renegotiate, true},
+                            {user_lookup_fun, fun maybe_drop_incompatible_options/1},
+                            {client_renegotiation, true}]}],
+    Opts = maybe_drop_incompatible_options(Opts0),
+    ?assertNot(lists:member(reuse_sessions, proplists:get_value(ssl_options, Opts))),
+    ?assertNot(lists:member(secure_renegotiate, proplists:get_value(ssl_options, Opts))),
+    ?assertNot(lists:member(user_lookup_fun, proplists:get_value(ssl_options, Opts))),
+    ?assertNot(lists:member(client_renegotiation, proplists:get_value(ssl_options, Opts))),
+    ?assertEqual([{versions, ['tlsv1.3']}, {ciphers, ?TLSV13_EXCLUSIVE_CIPHERS}],
+                 proplists:get_value(ssl_options, Opts)).
+
 -endif. %% TEST
 -endif. %% OTP_RELEASE > 22

From e64587f3daeb06054afba04f35816b6eb89977a3 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Thu, 15 Jun 2023 14:58:03 +0800
Subject: [PATCH 06/18] fix: password leaks from rule engine logs

---
 apps/emqx_rule_engine/include/rule_engine.hrl   |  6 ++++--
 apps/emqx_rule_engine/src/emqx_rule_actions.erl |  1 -
 apps/emqx_rule_engine/src/emqx_rule_engine.erl  |  1 -
 .../src/emqx_rule_engine_api.erl                | 17 ++++++++---------
 apps/emqx_rule_engine/src/emqx_rule_events.erl  |  5 ++---
 apps/emqx_rule_engine/src/emqx_rule_monitor.erl |  3 +--
 .../emqx_rule_engine/src/emqx_rule_registry.erl |  4 +---
 apps/emqx_rule_engine/src/emqx_rule_runtime.erl |  1 -
 .../src/emqx_rule_sqltester.erl                 |  1 -
 apps/emqx_rule_engine/src/emqx_rule_utils.erl   |  1 -
 rebar.config                                    |  2 +-
 11 files changed, 17 insertions(+), 25 deletions(-)

diff --git a/apps/emqx_rule_engine/include/rule_engine.hrl b/apps/emqx_rule_engine/include/rule_engine.hrl
index fe2cc1880..da53bc01d 100644
--- a/apps/emqx_rule_engine/include/rule_engine.hrl
+++ b/apps/emqx_rule_engine/include/rule_engine.hrl
@@ -14,6 +14,8 @@
 %% limitations under the License.
 %%--------------------------------------------------------------------
 
+-include_lib("emqx/include/logger.hrl").
+
 -define(APP, emqx_rule_engine).
 
 -define(KV_TAB, '@rule_engine_db').
@@ -186,11 +188,11 @@
             case lists:filter(fun(ResParttern) -> false; (_) -> true end, ResL) of
                 [] -> ResL;
                 ErrL ->
-                    ?LOG(error, "cluster_call error found, ResL: ~p", [ResL]),
+                    ?LOG_SENSITIVE(error, "cluster_call error found, ResL: ~p", [ResL]),
                     throw({Func, ErrL})
             end;
         {ResL, BadNodes} ->
-            ?LOG(error, "cluster_call bad nodes found: ~p, ResL: ~p", [BadNodes, ResL]),
+            ?LOG_SENSITIVE(error, "cluster_call bad nodes found: ~p, ResL: ~p", [BadNodes, ResL]),
             throw({Func, {failed_on_nodes, BadNodes}})
    end end()).
 
diff --git a/apps/emqx_rule_engine/src/emqx_rule_actions.erl b/apps/emqx_rule_engine/src/emqx_rule_actions.erl
index 4351a5410..d51ee61b6 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_actions.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_actions.erl
@@ -20,7 +20,6 @@
 -include("rule_engine.hrl").
 -include("rule_actions.hrl").
 -include_lib("emqx/include/emqx.hrl").
--include_lib("emqx/include/logger.hrl").
 
 -define(BAD_TOPIC_WITH_WILDCARD, wildcard_topic_not_allowed_for_publish).
 
diff --git a/apps/emqx_rule_engine/src/emqx_rule_engine.erl b/apps/emqx_rule_engine/src/emqx_rule_engine.erl
index 03ae80bd9..9571ae221 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_engine.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine.erl
@@ -17,7 +17,6 @@
 -module(emqx_rule_engine).
 
 -include("rule_engine.hrl").
--include_lib("emqx/include/logger.hrl").
 
 -export([ load_providers/0
         , unload_providers/0
diff --git a/apps/emqx_rule_engine/src/emqx_rule_engine_api.erl b/apps/emqx_rule_engine/src/emqx_rule_engine_api.erl
index 951f9b4f2..2c0dba552 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_engine_api.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine_api.erl
@@ -19,7 +19,6 @@
 -behaviour(gen_server).
 
 -include("rule_engine.hrl").
--include_lib("emqx/include/logger.hrl").
 
 -logger_header("[RuleEngineAPI]").
 
@@ -329,7 +328,7 @@ do_create_rule(Params) ->
                 error -> do_create_rule2(ParsedParams)
             end;
         {error, Reason} ->
-            ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+            ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
@@ -339,7 +338,7 @@ do_create_rule2(ParsedParams) ->
         {error, {action_not_found, ActionName}} ->
             return({error, 400, ?ERR_NO_ACTION(ActionName)});
         {error, Reason} ->
-            ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+            ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
@@ -352,11 +351,11 @@ delegate_update_rule(#{id := Id0}, Params) ->
                 {error, {not_found, RuleId}} ->
                     return({error, 400, ?ERR_NO_RULE(RuleId)});
                 {error, Reason} ->
-                    ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+                    ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
                     return({error, 400, ?ERR_BADARGS(Reason)})
             end;
         {error, Reason} ->
-            ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+            ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
@@ -409,7 +408,7 @@ delegate_create_resource(#{}, Params) ->
                     fun() -> do_create_resource(create_resource, ParsedParams) end,
                     Params);
         {error, Reason} ->
-            ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+            ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
@@ -434,7 +433,7 @@ do_create_resource2(Create, ParsedParams) ->
         {error, {init_resource, _}} ->
             return({error, 500, <<"Init resource failure!">>});
         {error, Reason} ->
-            ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+            ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
@@ -483,7 +482,7 @@ delegate_start_resource(#{id := Id0}, _Params) ->
         {error, {resource_not_found, ResId}} ->
             return({error, 400, ?ERR_NO_RESOURCE(ResId)});
         {error, Reason} ->
-            ?LOG(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
+            ?LOG_SENSITIVE(error, "~p failed: ~0p", [?FUNCTION_NAME, Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
@@ -508,7 +507,7 @@ delegate_update_resource(#{id := Id0}, NewParams) ->
         {error, {dependent_rules_exists, RuleIds}} ->
             return({error, 400, ?ERR_DEP_RULES_EXISTS(RuleIds)});
         {error, Reason} ->
-            ?LOG(error, "Resource update failed: ~0p", [Reason]),
+            ?LOG_SENSITIVE(error, "Resource update failed: ~0p", [Reason]),
             return({error, 400, ?ERR_BADARGS(Reason)})
     end.
 
diff --git a/apps/emqx_rule_engine/src/emqx_rule_events.erl b/apps/emqx_rule_engine/src/emqx_rule_events.erl
index f5c18d639..b15419ded 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_events.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_events.erl
@@ -16,11 +16,10 @@
 
 -module(emqx_rule_events).
 
+-logger_header("[RuleEvents]").
+
 -include("rule_engine.hrl").
 -include_lib("emqx/include/emqx.hrl").
--include_lib("emqx/include/logger.hrl").
-
--logger_header("[RuleEvents]").
 
 -export([ load/1
         , unload/0
diff --git a/apps/emqx_rule_engine/src/emqx_rule_monitor.erl b/apps/emqx_rule_engine/src/emqx_rule_monitor.erl
index 4e4d4ebe1..19fa2c56b 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_monitor.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_monitor.erl
@@ -18,9 +18,8 @@
 
 -behavior(gen_server).
 
--include("rule_engine.hrl").
--include_lib("emqx/include/logger.hrl").
 -logger_header("[Rule Monitor]").
+-include("rule_engine.hrl").
 
 -export([init/1,
          handle_call/3,
diff --git a/apps/emqx_rule_engine/src/emqx_rule_registry.erl b/apps/emqx_rule_engine/src/emqx_rule_registry.erl
index 37bca84aa..7b038e97a 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_registry.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_registry.erl
@@ -18,10 +18,8 @@
 
 -behaviour(gen_server).
 
--include("rule_engine.hrl").
--include_lib("emqx/include/logger.hrl").
-
 -logger_header("[RuleRegistry]").
+-include("rule_engine.hrl").
 
 -export([start_link/0]).
 
diff --git a/apps/emqx_rule_engine/src/emqx_rule_runtime.erl b/apps/emqx_rule_engine/src/emqx_rule_runtime.erl
index 56c64924f..44fa65c44 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_runtime.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_runtime.erl
@@ -19,7 +19,6 @@
 -include("rule_engine.hrl").
 -include("rule_actions.hrl").
 -include_lib("emqx/include/emqx.hrl").
--include_lib("emqx/include/logger.hrl").
 
 -export([ apply_rule/2
         , apply_rules/2
diff --git a/apps/emqx_rule_engine/src/emqx_rule_sqltester.erl b/apps/emqx_rule_engine/src/emqx_rule_sqltester.erl
index 6ee2c3209..241cea493 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_sqltester.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_sqltester.erl
@@ -15,7 +15,6 @@
 -module(emqx_rule_sqltester).
 
 -include("rule_engine.hrl").
--include_lib("emqx/include/logger.hrl").
 
 -export([ test/1
         ]).
diff --git a/apps/emqx_rule_engine/src/emqx_rule_utils.erl b/apps/emqx_rule_engine/src/emqx_rule_utils.erl
index 78d77ed58..ea376f1ef 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_utils.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_utils.erl
@@ -17,7 +17,6 @@
 -module(emqx_rule_utils).
 
 -include("rule_engine.hrl").
--include_lib("emqx/include/logger.hrl").
 
 -export([ replace_var/2
         ]).
diff --git a/rebar.config b/rebar.config
index 31b06bb0f..ac2894b57 100644
--- a/rebar.config
+++ b/rebar.config
@@ -52,7 +52,7 @@
     , {ekka, {git, "https://github.com/emqx/ekka", {tag, "0.8.1.11"}}}
     , {gen_rpc, {git, "https://github.com/emqx/gen_rpc", {tag, "3.0.1"}}}
     , {cuttlefish, {git, "https://github.com/emqx/cuttlefish", {tag, "v3.3.6"}}}
-    , {minirest, {git, "https://github.com/emqx/minirest", {tag, "0.3.11"}}}
+    , {minirest, {git, "https://github.com/emqx/minirest", {tag, "0.3.12"}}}
     , {ecpool, {git, "https://github.com/emqx/ecpool", {tag, "0.5.2"}}}
     , {replayq, {git, "https://github.com/emqx/replayq", {tag, "0.3.5"}}}
     , {pbkdf2, {git, "https://github.com/emqx/erlang-pbkdf2.git", {branch, "2.0.4"}}}

From 4836bc62f61e893e1dbf5de41cbe9a4ce076f0dd Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Thu, 15 Jun 2023 15:07:17 +0800
Subject: [PATCH 07/18] chore: update emqx_rule_engine.appup.src

---
 .../src/emqx_rule_engine.appup.src            | 266 +++++++++++++++---
 1 file changed, 232 insertions(+), 34 deletions(-)

diff --git a/apps/emqx_rule_engine/src/emqx_rule_engine.appup.src b/apps/emqx_rule_engine/src/emqx_rule_engine.appup.src
index c3b0154a1..6cd923618 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_engine.appup.src
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine.appup.src
@@ -1,25 +1,88 @@
 %% -*- mode: erlang -*-
 %% Unless you know what you are doing, DO NOT edit manually!!
 {VSN,
-  [{"4.4.18",[{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]}]},
+  [{"4.4.18",
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]}]},
    {"4.4.17",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]}]},
    {"4.4.16",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.4.15",
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {<<"4\\.4\\.1[3-4]">>,
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
@@ -27,7 +90,15 @@
      {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.12",
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
@@ -38,7 +109,13 @@
      {update,emqx_rule_engine_jwt_sup,supervisor},
      {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]}]},
    {"4.4.11",
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
@@ -52,7 +129,11 @@
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_started,[]}},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.10",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
@@ -70,7 +151,10 @@
      {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.4.9",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
@@ -89,7 +173,10 @@
      {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.8",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
@@ -108,7 +195,10 @@
      {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {<<"4\\.4\\.[6-7]">>,
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -127,7 +217,9 @@
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.4.5",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -147,7 +239,9 @@
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_validator,brutal_purge,soft_purge,[]}]},
    {"4.4.4",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -167,7 +261,9 @@
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]}]},
    {"4.4.3",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -189,7 +285,8 @@
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.2",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -212,7 +309,8 @@
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.1",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -235,7 +333,8 @@
      {add_module,emqx_rule_date},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.4.0",
-    [{add_module,emqx_rule_engine_jwt},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {add_module,emqx_rule_engine_jwt},
      {add_module,emqx_rule_engine_jwt_worker},
      {add_module,emqx_rule_engine_jwt_sup},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -258,25 +357,88 @@
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]}]},
    {<<".*">>,[]}],
-  [{"4.4.18",[{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]}]},
+  [{"4.4.18",
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]}]},
    {"4.4.17",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]}]},
    {"4.4.16",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.4.15",
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {<<"4\\.4\\.1[3-4]">>,
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
@@ -284,7 +446,15 @@
      {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.12",
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
@@ -295,7 +465,13 @@
      {update,emqx_rule_engine_jwt_sup,supervisor},
      {load_module,emqx_rule_engine_jwt,brutal_purge,soft_purge,[]}]},
    {"4.4.11",
-    [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_metrics,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_jwt_worker,brutal_purge,soft_purge,[]},
@@ -309,7 +485,11 @@
      {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]}]},
    {"4.4.10",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqltester,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
@@ -328,7 +508,10 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.9",
-    [{load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
@@ -348,7 +531,10 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.8",
-    [{load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
@@ -368,7 +554,10 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {<<"4\\.4\\.[6-7]">>,
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_validator,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@@ -388,7 +577,9 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.5",
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@@ -409,7 +600,9 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.4",
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
@@ -430,7 +623,9 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.3",
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_engine_cli,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -453,7 +648,8 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.2",
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -477,7 +673,8 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.1",
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},
@@ -501,7 +698,8 @@
      {delete_module,emqx_rule_engine_jwt_worker},
      {delete_module,emqx_rule_engine_jwt}]},
    {"4.4.0",
-    [{load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_rule_sqlparser,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_monitor,brutal_purge,soft_purge,[]},
      {apply,{emqx_rule_engine_sup,ensure_api_delegator_stopped,[]}},
      {load_module,emqx_rule_engine_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_sup,brutal_purge,soft_purge,[]},

From 391c0880609c6cf94b48a9f37f3616bc0d1071f1 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Thu, 15 Jun 2023 15:36:56 +0800
Subject: [PATCH 08/18] fix: dialyzer problems

---
 apps/emqx_retainer/src/emqx_retainer_sup.erl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/emqx_retainer/src/emqx_retainer_sup.erl b/apps/emqx_retainer/src/emqx_retainer_sup.erl
index 97f56140c..db08f2110 100644
--- a/apps/emqx_retainer/src/emqx_retainer_sup.erl
+++ b/apps/emqx_retainer/src/emqx_retainer_sup.erl
@@ -30,6 +30,7 @@
 start_link(Env) ->
 	supervisor:start_link({local, ?MODULE}, ?MODULE, [Env]).
 
+-dialyzer({no_match, [ensure_worker_pool_started/0]}).
 ensure_worker_pool_started() ->
     try
         case is_managed_by_modules() of

From 57cc1d2235bdf6c1d5e451582be46fa560612826 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Thu, 15 Jun 2023 15:40:02 +0800
Subject: [PATCH 09/18] chore: update appup.src

This reverts commit 4836bc62f61e893e1dbf5de41cbe9a4ce076f0dd.
---
 src/emqx.appup.src | 50 +++++++++++++++++++++++++++++++---------------
 1 file changed, 34 insertions(+), 16 deletions(-)

diff --git a/src/emqx.appup.src b/src/emqx.appup.src
index cb76375f1..effdab40f 100644
--- a/src/emqx.appup.src
+++ b/src/emqx.appup.src
@@ -2,7 +2,9 @@
 %% Unless you know what you are doing, DO NOT edit manually!!
 {VSN,
   [{"4.4.18",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_plugins,brutal_purge,soft_purge,[]},
+     {load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -13,7 +15,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.17",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -25,7 +28,8 @@
      {load_module,emqx_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_plugins,brutal_purge,soft_purge,[]}]},
    {"4.4.16",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -40,7 +44,8 @@
      {load_module,emqx_plugins,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.15",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -57,7 +62,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.14",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
@@ -79,7 +85,8 @@
      {load_module,emqx_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions_trans,brutal_purge,soft_purge,[]}]},
    {"4.4.13",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
      {load_module,emqx_tls_lib,brutal_purge,soft_purge,[]},
@@ -101,7 +108,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.12",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
      {load_module,emqx_tls_lib,brutal_purge,soft_purge,[]},
@@ -123,7 +131,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.11",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
      {load_module,emqx_tls_lib,brutal_purge,soft_purge,[]},
@@ -638,7 +647,9 @@
                          [gen_rpc,insecure_auth_fallback_allowed,true]}}]},
    {<<".*">>,[]}],
   [{"4.4.18",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_plugins,brutal_purge,soft_purge,[]},
+     {load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -648,7 +659,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.17",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -659,7 +671,8 @@
      {load_module,emqx_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_plugins,brutal_purge,soft_purge,[]}]},
    {"4.4.16",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -673,7 +686,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.15",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_connection,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
@@ -689,7 +703,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.14",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
@@ -710,7 +725,8 @@
      {load_module,emqx_app,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions_trans,brutal_purge,soft_purge,[]}]},
    {"4.4.13",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
      {load_module,emqx_tls_lib,brutal_purge,soft_purge,[]},
@@ -731,7 +747,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.12",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
      {load_module,emqx_tls_lib,brutal_purge,soft_purge,[]},
@@ -752,7 +769,8 @@
      {load_module,emqx_relup,brutal_purge,soft_purge,[]},
      {load_module,emqx_app,brutal_purge,soft_purge,[]}]},
    {"4.4.11",
-    [{load_module,emqx_zone,brutal_purge,soft_purge,[]},
+    [{load_module,emqx_hooks,brutal_purge,soft_purge,[]},
+     {load_module,emqx_zone,brutal_purge,soft_purge,[]},
      {load_module,emqx_cm_locker,brutal_purge,soft_purge,[]},
      {load_module,emqx_listeners,brutal_purge,soft_purge,[]},
      {load_module,emqx_tls_lib,brutal_purge,soft_purge,[]},

From c1e47914a66cc3a8674ee6dc74fabaf11b96fa1d Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Fri, 16 Jun 2023 14:52:57 +0800
Subject: [PATCH 10/18] fix: make rule cache update more reliable

---
 .../src/emqx_rule_registry.erl                | 37 +++++++++++++++++--
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/apps/emqx_rule_engine/src/emqx_rule_registry.erl b/apps/emqx_rule_engine/src/emqx_rule_registry.erl
index 7b038e97a..6185efdb9 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_registry.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_registry.erl
@@ -75,6 +75,8 @@
 
 -export([ update_rules_cache/0
         , clear_rules_cache/0
+        , get_rules_from_cache/0
+        , update_rules_cache_locally/0
         ]).
 
 %% for debug purposes
@@ -465,16 +467,19 @@ delete_resource_type(Type) ->
 init([]) ->
     _TableId = ets:new(?KV_TAB, [named_table, set, public, {write_concurrency, true},
                                  {read_concurrency, true}]),
+    ok = ensure_table_subscribed(),
     {ok, #{}}.
 
 handle_call({add_rules, Rules}, _From, State) ->
     trans(fun lists:foreach/2, [fun insert_rule/1, Rules]),
-    _ = ?CLUSTER_CALL(update_rules_cache, []),
+    %% the multicall is necessary, because the other nodes maybe running an older emqx version
+    %% so the table has not been subscribed
+    update_rules_cache_on_all_nodes(),
     {reply, ok, State};
 
 handle_call({remove_rules, Rules}, _From, State) ->
     trans(fun lists:foreach/2, [fun delete_rule/1, Rules]),
-    _ = ?CLUSTER_CALL(update_rules_cache, []),
+    update_rules_cache_on_all_nodes(),
     {reply, ok, State};
 
 handle_call(Req, _From, State) ->
@@ -482,13 +487,25 @@ handle_call(Req, _From, State) ->
     {reply, ignored, State}.
 
 handle_cast(update_rules_cache, State) ->
-    _ = update_rules_cache(),
+    ok = ensure_table_subscribed(),
+    ok = update_rules_cache(),
     {noreply, State};
 
 handle_cast(Msg, State) ->
     ?LOG(error, "unexpected cast ~p", [Msg]),
     {noreply, State}.
 
+handle_info({mnesia_table_event, {write, _Tab, _NewRule, _OldRules, _Tid} = Event}, State) ->
+    ?LOG(debug, "mnesia_table_event: ~p~n", [Event]),
+    ok = update_rules_cache_locally(),
+    {noreply, State};
+
+handle_info({mnesia_table_event, {Delete, _Tab, _What, _OldRules, _Tid} = Event}, State)
+        when Delete =:= delete; Delete =:= delete_object ->
+    ?LOG(debug, "mnesia_table_event: ~p~n", [Event]),
+    ok = update_rules_cache_locally(),
+    {noreply, State};
+
 handle_info(Info, State) ->
     ?LOG(error, "unexpected info ~p", [Info]),
     {noreply, State}.
@@ -502,6 +519,20 @@ code_change(_OldVsn, State, _Extra) ->
 %%------------------------------------------------------------------------------
 %% Private functions
 %%------------------------------------------------------------------------------
+update_rules_cache_on_all_nodes() ->
+    ok = update_rules_cache(),
+    case ekka_mnesia:running_nodes() -- [node()] of
+        [] -> ok;
+        OtherNodes ->
+            _ = rpc:multicall(OtherNodes, ?MODULE, update_rules_cache_locally, [], 5000),
+            ok
+    end.
+
+ensure_table_subscribed() ->
+    case mnesia:subscribe({table, ?RULE_TAB, detailed}) of
+        {error, {already_exists, _}} -> ok;
+        {ok, _} -> ok
+    end.
 
 get_all_records(Tab) ->
     %mnesia:dirty_match_object(Tab, mnesia:table_info(Tab, wild_pattern)).

From 38d92c940107f55e93c4dd9abdee19e74cc3a732 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Tue, 20 Jun 2023 10:30:06 +0800
Subject: [PATCH 11/18] fix: add range validation for max_clientid_len

---
 priv/emqx.schema | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/priv/emqx.schema b/priv/emqx.schema
index 9e2487757..7aa0592f2 100644
--- a/priv/emqx.schema
+++ b/priv/emqx.schema
@@ -276,6 +276,9 @@ end}.
 {validator, "range:1-65535", "must be 1 to 65535",
   fun(X) -> X >= 1 andalso X =< 65535 end}.
 
+{validator, "range:23-65535", "must be 23 to 65535",
+  fun(X) -> X >= 23 andalso X =< 65535 end}.
+
 {validator, "range:1-9", "must be 1 to 9",
   fun(X) -> X >= 1 andalso X =< 9 end}.
 
@@ -955,7 +958,8 @@ end}.
 %% @doc Set the Max ClientId Length Allowed.
 {mapping, "mqtt.max_clientid_len", "emqx.max_clientid_len", [
   {default, 65535},
-  {datatype, integer}
+  {datatype, integer},
+  {validators, ["range:23-65535"]}
 ]}.
 
 %% @doc Set the Maximum topic levels.

From e6ae98dd407d8af1568987acc1924644aab6acb4 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Tue, 20 Jun 2023 20:47:44 +0800
Subject: [PATCH 12/18] chore: sync code from ee

---
 src/emqx_tls_lib.erl | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/src/emqx_tls_lib.erl b/src/emqx_tls_lib.erl
index 2e330992a..9a05bd64d 100644
--- a/src/emqx_tls_lib.erl
+++ b/src/emqx_tls_lib.erl
@@ -224,15 +224,20 @@ replace(Opts, Key, Value) -> [{Key, Value} | proplists:delete(Key, Opts)].
 %% @doc Helper, make TLS root_fun
 rootfun_trusted_ca_from_cacertfile(NumOfCerts, SslOpts) ->
     Cacertfile = proplists:get_value(cacertfile, SslOpts, undefined),
-    try do_rootfun_trusted_ca_from_cacertfile(NumOfCerts, Cacertfile)
-    catch _Error:_Info:ST ->
-            %% The cacertfile will be checked by OTP SSL as well and OTP choice to be silent on this.
-            %% We are touching security sutffs, don't leak extra info..
-            ?LOG(error, "Failed to look for trusted cacert from cacertfile. Stacktrace: ~p", [ST]),
-            throw({error, ?FUNCTION_NAME})
+    case file:read_file(Cacertfile) of
+        {ok, PemBin} ->
+            try do_rootfun_trusted_ca_from_cacertfile(NumOfCerts, PemBin)
+            catch _Error:_Info:ST ->
+                %% The cacertfile will be checked by OTP SSL as well and OTP choice to be silent on this.
+                %% We are touching security sutffs, don't leak extra info..
+                ?LOG(error, "Failed to look for trusted cacert from cacertfile. Stacktrace: ~p", [ST]),
+                throw({error, ?FUNCTION_NAME})
+            end;
+        {error, Reason} ->
+            throw({error, {read_cacertfile_error, Cacertfile, Reason}})
     end.
-do_rootfun_trusted_ca_from_cacertfile(NumOfCerts, Cacertfile) ->
-    {ok, PemBin} = file:read_file(Cacertfile),
+
+do_rootfun_trusted_ca_from_cacertfile(NumOfCerts, PemBin) ->
     %% The last one or two should be the top parent in the chain if it is a chain
     Certs = public_key:pem_decode(PemBin),
     Pos = length(Certs) - NumOfCerts + 1,

From 74006440a87b5784f18b4f132ef2fb280c9d0d49 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Tue, 20 Jun 2023 20:49:06 +0800
Subject: [PATCH 13/18] chore: release v4.4.19-alpha.3

---
 include/emqx_release.hrl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/emqx_release.hrl b/include/emqx_release.hrl
index b0943366e..922ade43e 100644
--- a/include/emqx_release.hrl
+++ b/include/emqx_release.hrl
@@ -29,7 +29,7 @@
 
 -ifndef(EMQX_ENTERPRISE).
 
--define(EMQX_RELEASE, {opensource, "4.4.19-alpha.2"}).
+-define(EMQX_RELEASE, {opensource, "4.4.19-alpha.3"}).
 
 -else.
 

From 2929e986ef797541cd748748064f05bc87fc8d02 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Wed, 21 Jun 2023 16:16:54 +0800
Subject: [PATCH 14/18] feat: add new sql-funcs random/0 and uuid_v4/0

---
 .../src/emqx_rule_engine.app.src              |  2 +-
 apps/emqx_rule_engine/src/emqx_rule_funcs.erl | 21 +++++++++++++++++++
 rebar.config                                  |  1 +
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/apps/emqx_rule_engine/src/emqx_rule_engine.app.src b/apps/emqx_rule_engine/src/emqx_rule_engine.app.src
index 84b1de762..e679244b2 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_engine.app.src
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine.app.src
@@ -3,7 +3,7 @@
   {vsn, "4.4.19"}, % strict semver, bump manually!
   {modules, []},
   {registered, [emqx_rule_engine_sup, emqx_rule_registry, emqx_rule_engine_jwt_sup]},
-  {applications, [kernel,stdlib,rulesql,getopt,jose]},
+  {applications, [kernel,stdlib,rulesql,getopt,jose,uuid]},
   {mod, {emqx_rule_engine_app, []}},
   {env, []},
   {licenses, ["Apache-2.0"]},
diff --git a/apps/emqx_rule_engine/src/emqx_rule_funcs.erl b/apps/emqx_rule_engine/src/emqx_rule_funcs.erl
index d308ff521..b71adef44 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_funcs.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_funcs.erl
@@ -216,6 +216,12 @@
         , mongo_date/2
         ]).
 
+%% Random Funcs
+-export([ random/0
+        , uuid_v4/0
+        , uuid_v4_nodash/0
+        ]).
+
 %% Proc Dict Func
  -export([ proc_dict_get/1
          , proc_dict_put/2
@@ -887,6 +893,18 @@ term_encode(Term) ->
 term_decode(Data) when is_binary(Data) ->
     erlang:binary_to_term(Data).
 
+%%------------------------------------------------------------------------------
+%% Random Funcs
+%%------------------------------------------------------------------------------
+random() ->
+    rand:uniform().
+
+uuid_v4() ->
+    uuid_str(uuid:get_v4(), binary_standard).
+
+uuid_v4_nodash() ->
+    uuid_str(uuid:get_v4(), binary_nodash).
+
 %%------------------------------------------------------------------------------
 %% Dict Funcs
 %%------------------------------------------------------------------------------
@@ -1039,3 +1057,6 @@ function_literal(Fun, [FArg | Args]) when is_atom(Fun), is_list(Args) ->
     end, WithFirstArg, Args) ++ ")";
 function_literal(Fun, Args) ->
     {invalid_func, {Fun, Args}}.
+
+uuid_str(UUID, DisplyOpt) ->
+    uuid:uuid_to_string(UUID, DisplyOpt).
diff --git a/rebar.config b/rebar.config
index ac2894b57..74eaf5d09 100644
--- a/rebar.config
+++ b/rebar.config
@@ -67,6 +67,7 @@
     , {mysql, {git, "https://github.com/emqx/mysql-otp", {tag, "1.7.2"}}}
     , {epgsql, {git, "https://github.com/emqx/epgsql.git", {tag, "4.6.0"}}}
     , {grpc, {git, "https://github.com/emqx/grpc-erl", {tag, "0.6.7"}}}
+    , {uuid, {git, "https://github.com/okeuday/uuid.git", {tag, "v2.0.6"}}}
     ]}.
 
 {xref_ignores,

From 20cf06c917722c26e186c013ab904bc988aa5ee1 Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Wed, 21 Jun 2023 16:35:28 +0800
Subject: [PATCH 15/18] chore: add changelogs for random sql functions

---
 apps/emqx_rule_engine/src/emqx_rule_funcs.erl | 4 ++--
 changes/v4.4.19-en.md                         | 6 ++++++
 changes/v4.4.19-zh.md                         | 6 ++++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/apps/emqx_rule_engine/src/emqx_rule_funcs.erl b/apps/emqx_rule_engine/src/emqx_rule_funcs.erl
index b71adef44..0531af225 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_funcs.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_funcs.erl
@@ -219,7 +219,7 @@
 %% Random Funcs
 -export([ random/0
         , uuid_v4/0
-        , uuid_v4_nodash/0
+        , uuid_v4_no_hyphen/0
         ]).
 
 %% Proc Dict Func
@@ -902,7 +902,7 @@ random() ->
 uuid_v4() ->
     uuid_str(uuid:get_v4(), binary_standard).
 
-uuid_v4_nodash() ->
+uuid_v4_no_hyphen() ->
     uuid_str(uuid:get_v4(), binary_nodash).
 
 %%------------------------------------------------------------------------------
diff --git a/changes/v4.4.19-en.md b/changes/v4.4.19-en.md
index a71da1a3a..62c52fb5a 100644
--- a/changes/v4.4.19-en.md
+++ b/changes/v4.4.19-en.md
@@ -33,6 +33,12 @@
 
   Previously, this interface had a `connections` field, which represented the number of active connections on the current node that had not expired. This means that even if the MQTT connection has been disconnected, as long as the client has a persistent session, it would still be counted in the `connections` field. The newly added `live_connections` field specifically counts the number of clients with MQTT connections that have not been disconnected.
 
+- Added 3 random SQL functions to the rule engine [#11113](https://github.com/emqx/emqx/pull/11113).
+
+  - random(): Generates a random number between 0 and 1 (0.0 =< X < 1.0).
+  - uuid_v4(): Generates a random UUID (version 4) string.
+  - uuid_v4_no_hyphen(): Generates a random UUID (version 4) string without hyphens.
+
 ## Bug fixes
 
 - Fixed an issue where the rule engine was unable to access variables exported by `FOREACH` in the `DO` clause [#10620](https://github.com/emqx/emqx/pull/10620).
diff --git a/changes/v4.4.19-zh.md b/changes/v4.4.19-zh.md
index e07915749..0f6e1da7b 100644
--- a/changes/v4.4.19-zh.md
+++ b/changes/v4.4.19-zh.md
@@ -33,6 +33,12 @@
 
   此前该接口中有一个 `connections` 字段，它代表当前节点上会话未过期的连接数量。这意味着即使 MQTT 连接已经断开，只要客户端保持了会话，它仍然会被统计在 `connections` 中。新增的 `live_connections` 字段则仅仅统计 MQTT 连接未断开的客户端数量。
 
+- 规则引擎新增了三个随机函数 [#11113](https://github.com/emqx/emqx/pull/11113)。
+
+  - random()：生成 0 到 1 之间的随机数 (0.0 =< X < 1.0)。
+  - uuid_v4()：生成随机的 UUID (version4) 字符串。
+  - uuid_v4_no_hyphen()：生成随机的不带连词符的 UUID (version4) 字符串。
+
 ## 修复
 
 - 修复规则引擎无法在 `DO` 子句中访问 `FOREACH` 导出的变量的问题 [#10620](https://github.com/emqx/emqx/pull/10620)。

From 705f2df456c647a99a59386dd57695b9d6a3e72f Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Wed, 21 Jun 2023 17:31:35 +0800
Subject: [PATCH 16/18] chore: release v4.4.19-alpha.4

---
 include/emqx_release.hrl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/emqx_release.hrl b/include/emqx_release.hrl
index 922ade43e..acdd3c84f 100644
--- a/include/emqx_release.hrl
+++ b/include/emqx_release.hrl
@@ -29,7 +29,7 @@
 
 -ifndef(EMQX_ENTERPRISE).
 
--define(EMQX_RELEASE, {opensource, "4.4.19-alpha.3"}).
+-define(EMQX_RELEASE, {opensource, "4.4.19-alpha.4"}).
 
 -else.
 

From 23786e949e72c57ef940da99d50cddb8d8fdd6fc Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Sun, 25 Jun 2023 16:48:40 +0800
Subject: [PATCH 17/18] chore: update change logs

---
 changes/v4.4.19-en.md | 6 ++++++
 changes/v4.4.19-zh.md | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/changes/v4.4.19-en.md b/changes/v4.4.19-en.md
index 62c52fb5a..08bb67aae 100644
--- a/changes/v4.4.19-en.md
+++ b/changes/v4.4.19-en.md
@@ -39,6 +39,8 @@
   - uuid_v4(): Generates a random UUID (version 4) string.
   - uuid_v4_no_hyphen(): Generates a random UUID (version 4) string without hyphens.
 
+- Added numerical range validation (23-65535) for the `mqtt.max_clientid_len` configuration parameter [#11096](https://github.com/emqx/emqx/pull/11096).
+
 ## Bug fixes
 
 - Fixed an issue where the rule engine was unable to access variables exported by `FOREACH` in the `DO` clause [#10620](https://github.com/emqx/emqx/pull/10620).
@@ -53,6 +55,10 @@
   `[{"elem": "a","date": "undefined"}]`.
   After the fix, the output of the SQL statement is: `[{"elem": "a","date": "2023-05-06"}]`
 
+- Fixed the issue where the cache of rules failed to update in certain cases [#11072](https://github.com/emqx/emqx/pull/11072).
+
+  Prior to the fix, after manually updating the rules, there could be instances where the cache update did not synchronize to certain nodes. This would result in inconsistent rule execution states across different nodes.
+
 - Fixed an issue where the WebHook plugin failed to execute the `on_client_connack` hook [#10710](https://github.com/emqx/emqx/pull/10710).
 
   See https://github.com/emqx/emqx/issues/10628 for more details.
diff --git a/changes/v4.4.19-zh.md b/changes/v4.4.19-zh.md
index 0f6e1da7b..c6768b03f 100644
--- a/changes/v4.4.19-zh.md
+++ b/changes/v4.4.19-zh.md
@@ -39,6 +39,8 @@
   - uuid_v4()：生成随机的 UUID (version4) 字符串。
   - uuid_v4_no_hyphen()：生成随机的不带连词符的 UUID (version4) 字符串。
 
+- 为 `mqtt.max_clientid_len` 配置项增加数值范围校验 (23-65535) [#11096](https://github.com/emqx/emqx/pull/11096)。
+
 ## 修复
 
 - 修复规则引擎无法在 `DO` 子句中访问 `FOREACH` 导出的变量的问题 [#10620](https://github.com/emqx/emqx/pull/10620)。
@@ -53,6 +55,10 @@
   `[{"elem": "a","date": "undefined"}]`。
   修复后，SQL 的输出为：`[{"elem": "a","date": "2023-05-06"}]`
 
+- 修复在某些情况下，规则的缓存没能更新的问题 [#11072](https://github.com/emqx/emqx/pull/11072)。
+
+  修复前，手动更新规则之后，可能会出现缓存的更新没能同步到某些节点上的情况，这会导致规则在不同的节点上运行状态不一致。
+
 - 修复 WebHook 插件执行 `on_client_connack` 钩子失败的问题 [#10710](https://github.com/emqx/emqx/pull/10710)。
 
   详见 https://github.com/emqx/emqx/issues/10628

From bfc336bc5ecddbabfe80151acc3376bb5c2b79cc Mon Sep 17 00:00:00 2001
From: Shawn <506895667@qq.com>
Date: Sun, 25 Jun 2023 19:14:59 +0800
Subject: [PATCH 18/18] chore: release v4.4.19

---
 include/emqx_release.hrl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/emqx_release.hrl b/include/emqx_release.hrl
index acdd3c84f..d63bfb67c 100644
--- a/include/emqx_release.hrl
+++ b/include/emqx_release.hrl
@@ -29,7 +29,7 @@
 
 -ifndef(EMQX_ENTERPRISE).
 
--define(EMQX_RELEASE, {opensource, "4.4.19-alpha.4"}).
+-define(EMQX_RELEASE, {opensource, "4.4.19"}).
 
 -else.