Use negative values to disable per-vhost limits, 0 to refuse all connections

Per recommendation from @dumbbell.

3 files changed, 27 insertions, 13 deletions

diff --git a/src/rabbit_connection_tracking.erl b/src/rabbit_connection_tracking.erl
index 5e8c4415d3..2d23e7c888 100644
--- a/src/rabbit_connection_tracking.erl
+++ b/src/rabbit_connection_tracking.erl
@@ -195,16 +195,23 @@ list_on_node(Node) ->
 -spec is_over_connection_limit(rabbit_types:vhost()) -> {true, non_neg_integer()} | false.
 
 is_over_connection_limit(VirtualHost) ->
-    ConnectionCount = count_connections_in(VirtualHost),
     case rabbit_vhost_limit:connection_limit(VirtualHost) of
-        undefined   -> false;
-        {ok, Limit} -> case {ConnectionCount, ConnectionCount >= Limit} of
-                           %% 0 = no limit
-                           {0, _}     -> false;
-                           %% the limit hasn't been reached
-                           {_, false} -> false;
-                           {_N, true} -> {true, Limit}
-                       end
+        %% no limit configured
+        undefined                                            -> false;
+        %% with limit = 0, no connections are allowed
+        {ok, 0}                                              -> {true, 0};
+        {ok, Limit} when is_integer(Limit) andalso Limit > 0 ->
+          ConnectionCount = count_connections_in(VirtualHost),
+          case ConnectionCount >= Limit of
+            false -> false;
+            true  -> {true, Limit}
+          end;
+        %% any negative value means "no limit". Note that parameter validation
+        %% will replace negative integers with 'undefined', so this is to be
+        %% explicit and extra defensive
+        {ok, Limit} when is_integer(Limit) andalso Limit < 0 -> false;
+        %% ignore non-integer limits
+        {ok, _Limit}                                         -> false
     end.
 
 
diff --git a/src/rabbit_parameter_validation.erl b/src/rabbit_parameter_validation.erl
index 90ab1d5286..00e83d2757 100644
--- a/src/rabbit_parameter_validation.erl
+++ b/src/rabbit_parameter_validation.erl
@@ -16,7 +16,7 @@
 
 -module(rabbit_parameter_validation).
 
--export([number/2, binary/2, boolean/2, list/2, regex/2, proplist/3, enum/1]).
+-export([number/2, integer/2, binary/2, boolean/2, list/2, regex/2, proplist/3, enum/1]).
 
 number(_Name, Term) when is_number(Term) ->
     ok;
@@ -24,6 +24,12 @@ number(_Name, Term) when is_number(Term) ->
 number(Name, Term) ->
     {error, "~s should be number, actually was ~p", [Name, Term]}.
 
+integer(_Name, Term) when is_integer(Term) ->
+    ok;
+
+integer(Name, Term) ->
+    {error, "~s should be number, actually was ~p", [Name, Term]}.
+
 binary(_Name, Term) when is_binary(Term) ->
     ok;
 
diff --git a/src/rabbit_vhost_limit.erl b/src/rabbit_vhost_limit.erl
index dd7ce51089..2d9a2f075e 100644
--- a/src/rabbit_vhost_limit.erl
+++ b/src/rabbit_vhost_limit.erl
@@ -72,7 +72,7 @@ clear(VHost) ->
                                         <<"limits">>).
 
 vhost_limit_validation() ->
-    [{<<"max-connections">>, fun rabbit_parameter_validation:number/2, mandatory}].
+    [{<<"max-connections">>, fun rabbit_parameter_validation:integer/2, mandatory}].
 
 update_vhost(VHostName, Limits) ->
     rabbit_misc:execute_mnesia_transaction(
@@ -91,8 +91,9 @@ get_limit(VirtualHost, Limit) ->
                        undefined -> undefined;
                        Val       -> case pget(Limit, Val) of
                                         undefined     -> undefined;
-                                        N when N =< 0 -> undefined;
-                                        N when N > 0  -> {ok, N}
+                                        %% no limit
+                                        N when N < 0  -> undefined;
+                                        N when N >= 0 -> {ok, N}
                                     end
                    end
     end.