Feature/add deny option for acl

[BrandtHill]

This features adds an option to the acl_file to allow a user to be explicitly denied access to a topic that might otherwise be granted from a broader topic.
For example in an acl file:

user bob
topic readwrite api/#
topic deny api/sensitive/#

The user bob would be granted read/write access to all topics matching api/# with the exception of topics matching api/sensitive/#.
This allows us to configure mosquitto (no extra plugins) more easily without the need for extensive whitelists like this:

user bob
topic readwrite api/fun/#
topic readwrite api/stuff/#
topic readwrite api/hello/#
topic readwrite api/so/#
topic readwrite api/many/#
topic readwrite api/topics/#
...

Because tests aren't passing on develop branch currently, I also made these changes off master to test.

I hope the purpose of these changes was made clear.

Brandt

---

• If you are contributing a new feature, is your work based off the develop branch?
• If you are contributing a bugfix, is your work based off the fixes branch?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you successfully run make test with your changes locally?
• Have you signed the Eclipse Contributor Agreement, using the same email address as you used in your commits?
• Do each of your commits have a "Signed-off-by" line, with the correct email address? Use "git commit -s" to generate this line for you.

---

[BrandtHill]

Let me know if this feature seems reasonable and if any changes are required.

[ralight]

Thank you for the nudge, and sorry for not getting to look at this earlier - I have been working on other things. I am definitely interested in this and will take a proper look soon.

[dbeinder]

Looks like a neat feature!
One minor thing: With this change, the ACL check has to loop though all client ACLs, and exiting early on SUCCESS is no longer possible. If all deny ACLs were put into a separate deny list in mosquitto__acl_user and checked first, we could keep early exit and this could be implemented with no performance impact on existing configs.

[ralight]

I think that's a good idea, ACL checking really has to be fast.

Sorry to be a pain, each of the commits has to have a signed-off-by line in them. Could you fix that please? I think it might be easiest for you to squash all the commits together and do that at the same time.

[BrandtHill]

I'll work on adding a separate deny list for an early exit, definitely necessary for performance with large ACLs.

I will try to squash once changes are made.

[BrandtHill]

I've changed it to add deny acl entries to the top of the list, so that once any denials have been passed during the check, any read|write matches can exit early with the assurance that it won't be caught by lingering denials. I've found this approach to be minimally invasive compared to adding a separate mosquitto__acl* for each user and one for patterns. It passes tests when based on the current develop branch with make test WITH_CJSON=no.

I've attempted to squash all of the commits into one with a signoff, but I'm not sure it had the desired effect.

Edit- I successfully force pushed my squashed commit 👍

[BrandtHill]

Let me know if my solution looks good. It should have no performance impact on existing ACLs. 👍

[dsb3]

+1 - this feature will help my use case as well.

[ralight]

Thanks @BrandtHill, and sorry for the delay getting to it. It looks nice and is now merged.

[BrandtHill]

Thank you so much, and I hope people find it useful and look forward to its release!