acl: ACLName rule should match if any part of ACLName matches

diff --git a/src/acl.erl b/src/acl.erl
index 95c9ebbd42a479653526394534ff3c0fd3ef35f5..31a7547dd5cf115630afd1ea52a3e0c133881ce8 100644 (file)
--- a/src/acl.erl
+++ b/src/acl.erl
@@ -371,6 +371,16 @@ all_acl_rules_matches2([Rule | Tail], Data, Host) ->
 all_acl_rules_matches2([], _Data, _Host) ->
     true.
 
+any_acl_rules_matches([], _Data, _Host) ->
+    false;
+any_acl_rules_matches([Rule|Tail], Data, Host) ->
+    case acl_rule_matches(Rule, Data, Host) of
+       true ->
+           true;
+       false ->
+           any_acl_rules_matches(Tail, Data, Host)
+    end.
+
 -spec acl_rule_matches(aclspec(), any(), global|binary()) -> boolean().
 
 acl_rule_matches(all, _Data, _Host) ->
@@ -380,7 +390,7 @@ acl_rule_matches({acl, all}, _Data, _Host) ->
 acl_rule_matches({acl, Name}, Data, Host) ->
     ACLs = get_aclspecs(Name, Host),
     RawACLs = lists:map(fun(#acl{aclspec = R}) -> R end, ACLs),
-    all_acl_rules_matches(RawACLs, Data, Host);
+    any_acl_rules_matches(RawACLs, Data, Host);
 acl_rule_matches({ip, {Net, Mask}}, #{ip := {IP, _Port}}, _Host) ->
     is_ip_match(IP, Net, Mask);
 acl_rule_matches({ip, {Net, Mask}}, #{ip := IP}, _Host) ->

diff --git a/test/acl_test.exs b/test/acl_test.exs
index 398943434d092b16657043b226acd19ae9a9fe27..551c74ae077b35a1db8bc3e0ade72d0027970a2f 100644 (file)
--- a/test/acl_test.exs
+++ b/test/acl_test.exs
@@ -36,13 +36,17 @@ defmodule ACLTest do
 
   test "access rule match with user part ACL" do
     :acl.add(:global, :basic_acl_1, {:user, "test1"})
+    :acl.add(:global, :basic_acl_1, {:user, "test2"})
     :acl.add_access(:global, :basic_rule_1, [{:allow, [{:acl, :basic_acl_1}]}])
     # JID can only be passes as jid record.
     # => TODO: Support passing JID as binary.
     assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test1@domain1")) == :allow
     assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test1@domain2")) == :allow
+    assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test2@domain1")) == :allow
+    assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test2@domain2")) == :allow
     # We match on user part only for local domain. As an implicit rule remote domain are not matched
     assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test1@otherdomain")) == :deny
+    assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test2@otherdomain")) == :deny
     assert :acl.match_rule(:global, :basic_rule_1, :jid.from_string("test11@domain1")) == :deny
 
     :acl.add(:global, :basic_acl_2, {:user, {"test2", "domain1"}})