Merge branch 'master' into rabbitmq-server-505

6 files changed, 594 insertions, 11 deletions

diff --git a/test/clustering_management_SUITE.erl b/test/clustering_management_SUITE.erl
index 9b605d07ae..3253695364 100644
--- a/test/clustering_management_SUITE.erl
+++ b/test/clustering_management_SUITE.erl
@@ -644,7 +644,7 @@ assert_not_clustered(Node) ->
 
 assert_failure(Fun) ->
     case catch Fun() of
-        {error, Code, Reason}          -> Reason;
+        {error, _Code, Reason}         -> Reason;
         {error, Reason}                -> Reason;
         {error_string, Reason}         -> Reason;
         {badrpc, {'EXIT', Reason}}     -> Reason;
diff --git a/test/config_schema_SUITE_data/snippets.config b/test/config_schema_SUITE_data/snippets.config
index f5832981bc..7a854a10e1 100644
--- a/test/config_schema_SUITE_data/snippets.config
+++ b/test/config_schema_SUITE_data/snippets.config
@@ -786,5 +786,26 @@ background_gc_target_interval = 30000",
 [{rabbit, [
     {background_gc_enabled, false},
     {background_gc_target_interval, 30000}
+]}],[]},
+
+{78.1,
+"credential_validator.validation_backend = rabbit_credential_validator_min_password_length
+credential_validator.min_length = 10",
+[{rabbit, [
+    {credential_validator, [
+      {validation_backend, rabbit_credential_validator_min_password_length},
+      {min_length,         10}
+    ]}
+]}],[]},
+
+{78.2,
+"credential_validator.validation_backend = rabbit_credential_validator_password_regexp
+credential_validator.regexp = ^abc\\d+",
+[{rabbit, [
+    {credential_validator, [
+      {validation_backend, rabbit_credential_validator_password_regexp},
+      {regexp,             "^abc\\d+"}
+    ]}
 ]}],[]}
+
 ].
diff --git a/test/credential_validation_SUITE.erl b/test/credential_validation_SUITE.erl
new file mode 100644
index 0000000000..3ed2e832bd
--- /dev/null
+++ b/test/credential_validation_SUITE.erl
@@ -0,0 +1,275 @@
+%% The contents of this file are subject to the Mozilla Public License
+%% Version 1.1 (the "License"); you may not use this file except in
+%% compliance with the License. You may obtain a copy of the License
+%% at http://www.mozilla.org/MPL/
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and
+%% limitations under the License.
+%%
+%% The Original Code is RabbitMQ.
+%%
+%% The Initial Developer of the Original Code is GoPivotal, Inc.
+%% Copyright (c) 2007-2016 Pivotal Software, Inc.  All rights reserved.
+%%
+
+-module(credential_validation_SUITE).
+
+-compile(export_all).
+-include_lib("proper/include/proper.hrl").
+-include_lib("common_test/include/ct.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+all() ->
+    [
+     {group, unit},
+     {group, integration}
+    ].
+
+groups() ->
+    [
+     {integration, [], [
+                        min_length_integration_fails
+                        , regexp_integration_fails
+                        , min_length_integration_succeeds
+                        , regexp_integration_succeeds
+                        , min_length_change_password_integration_fails
+                        , regexp_change_password_integration_fails
+                        , min_length_change_password_integration_succeeds
+                        , regexp_change_password_integration_succeeds
+                       ]},
+     {unit, [parallel], [
+                         basic_unconditionally_accepting_succeeds,
+                         min_length_fails,
+                         min_length_succeeds,
+                         min_length_proper_fails,
+                         min_length_proper_succeeds,
+                         regexp_fails,
+                         regexp_succeeds,
+                         regexp_proper_fails,
+                         regexp_proper_succeeds
+                        ]}
+].
+
+suite() ->
+    [
+      {timetrap, {minutes, 4}}
+    ].
+
+%%
+%% Setup/teardown
+%%
+
+init_per_suite(Config) ->
+    rabbit_ct_helpers:log_environment(),
+    rabbit_ct_helpers:run_setup_steps(Config).
+
+end_per_suite(Config) ->
+    rabbit_ct_helpers:run_teardown_steps(Config).
+
+init_per_group(integration, Config) ->
+    Suffix = rabbit_ct_helpers:testcase_absname(Config, "", "-"),
+    Config1 = rabbit_ct_helpers:set_config(Config, [
+        {rmq_nodes_count, 1},
+        {rmq_nodename_suffix, Suffix}
+    ]),
+    rabbit_ct_helpers:run_steps(Config1,
+      rabbit_ct_broker_helpers:setup_steps());
+
+init_per_group(unit, Config) ->
+    Config.
+
+end_per_group(integration, Config) ->
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, accept_everything),
+    rabbit_ct_helpers:run_steps(Config,
+      rabbit_ct_broker_helpers:teardown_steps());
+end_per_group(unit, Config) ->
+    Config.
+
+-define(USERNAME, <<"abc">>).
+
+init_per_testcase(Testcase, Config) ->
+    rabbit_ct_helpers:testcase_started(Config, Testcase).
+
+end_per_testcase(Testcase, Config) ->
+    rabbit_ct_helpers:testcase_finished(Config, Testcase).
+
+%%
+%% Test Cases
+%%
+
+basic_unconditionally_accepting_succeeds(_Config) ->
+    F = fun rabbit_credential_validator_accept_everything:validate/2,
+
+    Pwd1 = crypto:strong_rand_bytes(1),
+    ?assertEqual(ok, F(?USERNAME, Pwd1)),
+    Pwd2 = crypto:strong_rand_bytes(5),
+    ?assertEqual(ok, F(?USERNAME, Pwd2)),
+    Pwd3 = crypto:strong_rand_bytes(10),
+    ?assertEqual(ok, F(?USERNAME, Pwd3)),
+    Pwd4 = crypto:strong_rand_bytes(50),
+    ?assertEqual(ok, F(?USERNAME, Pwd4)),
+    Pwd5 = crypto:strong_rand_bytes(100),
+    ?assertEqual(ok, F(?USERNAME, Pwd5)),
+    Pwd6 = crypto:strong_rand_bytes(1000),
+    ?assertEqual(ok, F(?USERNAME, Pwd6)).
+
+min_length_fails(_Config) ->
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+
+    Pwd1 = crypto:strong_rand_bytes(1),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd1, 5)),
+    Pwd2 = crypto:strong_rand_bytes(5),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd2, 6)),
+    Pwd3 = crypto:strong_rand_bytes(10),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd3, 15)),
+    Pwd4 = crypto:strong_rand_bytes(50),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd4, 60)).
+
+min_length_succeeds(_Config) ->
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(1), 1)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(6), 6)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(7), 6)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(20), 20)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(40), 30)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(50), 50)).
+
+min_length_proper_fails(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_min_length_fails_validation/0, [], 500).
+
+min_length_proper_succeeds(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_min_length_passes_validation/0, [], 500).
+
+regexp_fails(_Config) ->
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+
+    ?assertMatch({error, _}, F(?USERNAME, <<"abc">>,    "^xyz")),
+    ?assertMatch({error, _}, F(?USERNAME, <<"abcdef">>, "^xyz")),
+    ?assertMatch({error, _}, F(?USERNAME, <<"abcxyz">>, "^abc\\d+")).
+
+regexp_succeeds(_Config) ->
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+
+    ?assertEqual(ok, F(?USERNAME, <<"abc">>,    "^abc")),
+    ?assertEqual(ok, F(?USERNAME, <<"abcdef">>, "^abc")),
+    ?assertEqual(ok, F(?USERNAME, <<"abc123">>, "^abc\\d+")).
+
+regexp_proper_fails(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_regexp_fails_validation/0, [], 500).
+
+regexp_proper_succeeds(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_regexp_passes_validation/0, [], 500).
+
+min_length_integration_fails(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, min_length, 50),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch({error, "minimum required password length is 50"},
+                 rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"_">>)).
+
+regexp_integration_fails(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch({error, _}, rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"_">>)).
+
+min_length_integration_succeeds(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, min_length, 5),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch(ok, rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"abcdefghi">>)).
+
+regexp_integration_succeeds(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch(ok, rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"xyz12345678901">>)).
+
+min_length_change_password_integration_fails(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, accept_everything),
+    rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, min_length, 50),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch({error, "minimum required password length is 50"},
+                 rabbit_ct_broker_helpers:change_password(Config, ?USERNAME, <<"_">>)).
+
+regexp_change_password_integration_fails(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, accept_everything),
+    rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch({error, _}, rabbit_ct_broker_helpers:change_password(Config, ?USERNAME, <<"_">>)).
+
+min_length_change_password_integration_succeeds(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, accept_everything),
+    rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, min_length, 5),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch(ok, rabbit_ct_broker_helpers:change_password(Config, ?USERNAME, <<"abcdefghi">>)).
+
+regexp_change_password_integration_succeeds(Config) ->
+    rabbit_ct_broker_helpers:delete_user(Config, ?USERNAME),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, accept_everything),
+    rabbit_ct_broker_helpers:add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    rabbit_ct_broker_helpers:switch_credential_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch(ok, rabbit_ct_broker_helpers:change_password(Config, ?USERNAME, <<"xyz12345678901">>)).
+
+%%
+%% PropEr
+%%
+
+prop_min_length_fails_validation() ->
+    N = 5,
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+    ?FORALL(Val, binary(N),
+            ?FORALL(Length, choose(N + 1, 100),
+                   failed_validation(F(?USERNAME, Val, Length + 1)))).
+
+prop_min_length_passes_validation() ->
+    N = 20,
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+    ?FORALL(Val, binary(N),
+            ?FORALL(Length, choose(1, N - 1),
+                   passed_validation(F(?USERNAME, Val, Length)))).
+
+prop_regexp_fails_validation() ->
+    N = 5,
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+    ?FORALL(Val, binary(N),
+            ?FORALL(Length, choose(N + 1, 100),
+                   failed_validation(F(?USERNAME, Val, regexp_that_requires_length_of_at_least(Length + 1))))).
+
+prop_regexp_passes_validation() ->
+    N = 5,
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+    ?FORALL(Val, binary(N),
+            passed_validation(F(?USERNAME, Val, regexp_that_requires_length_of_at_most(size(Val) + 1)))).
+
+%%
+%% Helpers
+%%
+
+passed_validation(ok) ->
+    true;
+passed_validation({error, _}) ->
+    false.
+
+failed_validation(Result) ->
+    not passed_validation(Result).
+
+regexp_that_requires_length_of_at_least(N) when is_integer(N) ->
+    rabbit_misc:format("^[a-zA-Z0-9]{~p,~p}", [N, N + 10]).
+
+regexp_that_requires_length_of_at_most(N) when is_integer(N) ->
+    rabbit_misc:format("^[a-zA-Z0-9]{0,~p}", [N]).
+
+validator_backend(Config) ->
+    rabbit_ct_broker_helpers:rpc(Config, 0, rabbit_credential_validation, backend, []).
+
diff --git a/test/per_user_connection_tracking_SUITE.erl b/test/per_user_connection_tracking_SUITE.erl
new file mode 100644
index 0000000000..7f93aef1ac
--- /dev/null
+++ b/test/per_user_connection_tracking_SUITE.erl
@@ -0,0 +1,280 @@
+%% The contents of this file are subject to the Mozilla Public License
+%% Version 1.1 (the "License"); you may not use this file except in
+%% compliance with the License. You may obtain a copy of the License at
+%% http://www.mozilla.org/MPL/
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
+%% License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% The Original Code is RabbitMQ.
+%%
+%% The Initial Developer of the Original Code is GoPivotal, Inc.
+%% Copyright (c) 2011-2016 Pivotal Software, Inc.  All rights reserved.
+%%
+
+-module(per_user_connection_tracking_SUITE).
+
+-include_lib("common_test/include/ct.hrl").
+-include_lib("amqp_client/include/amqp_client.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+-compile(export_all).
+
+all() ->
+    [
+     {group, cluster_size_1_network},
+     {group, cluster_size_2_network},
+     {group, cluster_size_1_direct},
+     {group, cluster_size_2_direct}
+    ].
+
+groups() ->
+    ClusterSize1Tests = [
+        single_node_list_of_user,
+        single_node_user_deletion_forces_connection_closure
+    ],
+    ClusterSize2Tests = [
+        cluster_user_deletion_forces_connection_closure
+    ],
+    [
+      {cluster_size_1_network, [], ClusterSize1Tests},
+      {cluster_size_2_network, [], ClusterSize2Tests},
+      {cluster_size_1_direct, [], ClusterSize1Tests},
+      {cluster_size_2_direct, [], ClusterSize2Tests}
+    ].
+
+suite() ->
+    [
+      %% If a test hangs, no need to wait for 30 minutes.
+      {timetrap, {minutes, 8}}
+    ].
+
+%% -------------------------------------------------------------------
+%% Testsuite setup/teardown.
+%% -------------------------------------------------------------------
+
+init_per_suite(Config) ->
+    rabbit_ct_helpers:log_environment(),
+    rabbit_ct_helpers:run_setup_steps(Config, [
+                                               fun rabbit_ct_broker_helpers:enable_dist_proxy_manager/1
+                                              ]).
+
+end_per_suite(Config) ->
+    rabbit_ct_helpers:run_teardown_steps(Config).
+
+init_per_group(cluster_size_1_network, Config) ->
+    Config1 = rabbit_ct_helpers:set_config(Config, [{connection_type, network}]),
+    init_per_multinode_group(cluster_size_1_network, Config1, 1);
+init_per_group(cluster_size_2_network, Config) ->
+    Config1 = rabbit_ct_helpers:set_config(Config, [{connection_type, network}]),
+    init_per_multinode_group(cluster_size_2_network, Config1, 2);
+init_per_group(cluster_size_1_direct, Config) ->
+    Config1 = rabbit_ct_helpers:set_config(Config, [{connection_type, direct}]),
+    init_per_multinode_group(cluster_size_1_direct, Config1, 1);
+init_per_group(cluster_size_2_direct, Config) ->
+    Config1 = rabbit_ct_helpers:set_config(Config, [{connection_type, direct}]),
+    init_per_multinode_group(cluster_size_2_direct, Config1, 2).
+
+init_per_multinode_group(_Group, Config, NodeCount) ->
+    Suffix = rabbit_ct_helpers:testcase_absname(Config, "", "-"),
+    Config1 = rabbit_ct_helpers:set_config(Config, [
+                                                    {rmq_nodes_count, NodeCount},
+                                                    {rmq_nodename_suffix, Suffix}
+      ]),
+    rabbit_ct_helpers:run_steps(Config1,
+                                rabbit_ct_broker_helpers:setup_steps() ++
+                                    rabbit_ct_client_helpers:setup_steps()).
+
+end_per_group(_Group, Config) ->
+    rabbit_ct_helpers:run_steps(Config,
+      rabbit_ct_client_helpers:teardown_steps() ++
+      rabbit_ct_broker_helpers:teardown_steps()).
+
+init_per_testcase(Testcase, Config) ->
+    rabbit_ct_helpers:testcase_started(Config, Testcase),
+    clear_all_connection_tracking_tables(Config),
+    Config.
+
+end_per_testcase(Testcase, Config) ->
+    clear_all_connection_tracking_tables(Config),
+    rabbit_ct_helpers:testcase_finished(Config, Testcase).
+
+clear_all_connection_tracking_tables(Config) ->
+    [rabbit_ct_broker_helpers:rpc(Config,
+        N,
+        rabbit_connection_tracking,
+        clear_tracked_connection_tables_for_this_node,
+        []) || N <- rabbit_ct_broker_helpers:get_node_configs(Config, nodename)].
+
+%% -------------------------------------------------------------------
+%% Test cases.
+%% -------------------------------------------------------------------
+single_node_list_of_user(Config) ->
+    Username = proplists:get_value(rmq_username, Config),
+    Username2 = <<"guest2">>,
+
+    Vhost = proplists:get_value(rmq_vhost, Config),
+    
+    rabbit_ct_broker_helpers:add_user(Config, Username2),
+    rabbit_ct_broker_helpers:set_full_permissions(Config, Username2, Vhost),
+
+    ?assertEqual(0, length(connections_in(Config, Username))),
+    ?assertEqual(0, length(connections_in(Config, Username2))),
+
+    [Conn1] = open_connections(Config, [0]),
+    [#tracked_connection{username = Username}] = connections_in(Config, Username),
+    close_connections([Conn1]),
+    ?assertEqual(0, length(connections_in(Config, Username))),
+
+    [Conn2] = open_connections(Config, [{0, Username2}]),
+    [#tracked_connection{username = Username2}] = connections_in(Config, Username2),
+
+    [Conn3] = open_connections(Config, [0]),
+    [#tracked_connection{username = Username}] = connections_in(Config, Username),
+
+    [Conn4] = open_connections(Config, [0]),
+    kill_connections([Conn4]),
+    [#tracked_connection{username = Username}] = connections_in(Config, Username),
+
+    [Conn5] = open_connections(Config, [0]),
+    [Username, Username] =
+        lists:map(fun (#tracked_connection{username = U}) -> U end,
+                  connections_in(Config, Username)),
+    
+    close_connections([Conn2, Conn3, Conn5]),
+    rabbit_ct_broker_helpers:delete_user(Config, Username2),
+    ?assertEqual(0, length(all_connections(Config))).
+
+single_node_user_deletion_forces_connection_closure(Config) ->
+    Username = proplists:get_value(rmq_username, Config),
+    Username2 = <<"guest2">>,
+
+    Vhost = proplists:get_value(rmq_vhost, Config),
+    
+    rabbit_ct_broker_helpers:add_user(Config, Username2),
+    rabbit_ct_broker_helpers:set_full_permissions(Config, Username2, Vhost),
+
+    ?assertEqual(0, count_connections_in(Config, Username)),
+    ?assertEqual(0, count_connections_in(Config, Username2)),
+
+    [Conn1] = open_connections(Config, [0]),
+    ?assertEqual(1, count_connections_in(Config, Username)),
+
+    [_Conn2] = open_connections(Config, [{0, Username2}]),
+    ?assertEqual(1, count_connections_in(Config, Username2)),
+
+    rabbit_ct_broker_helpers:delete_user(Config, Username2),
+    timer:sleep(200),
+    ?assertEqual(0, count_connections_in(Config, Username2)),
+
+    close_connections([Conn1]),
+    ?assertEqual(0, count_connections_in(Config, Username)).
+
+cluster_user_deletion_forces_connection_closure(Config) ->
+    Username = proplists:get_value(rmq_username, Config),
+    Username2 = <<"guest2">>,
+
+    Vhost = proplists:get_value(rmq_vhost, Config),
+    
+    rabbit_ct_broker_helpers:add_user(Config, Username2),
+    rabbit_ct_broker_helpers:set_full_permissions(Config, Username2, Vhost),
+
+    ?assertEqual(0, count_connections_in(Config, Username)),
+    ?assertEqual(0, count_connections_in(Config, Username2)),
+
+    [Conn1] = open_connections(Config, [{0, Username}]),
+    ?assertEqual(1, count_connections_in(Config, Username)),
+
+    [_Conn2] = open_connections(Config, [{1, Username2}]),
+    ?assertEqual(1, count_connections_in(Config, Username2)),
+
+    rabbit_ct_broker_helpers:delete_user(Config, Username2),
+    timer:sleep(200),
+    ?assertEqual(0, count_connections_in(Config, Username2)),
+
+    close_connections([Conn1]),
+    ?assertEqual(0, count_connections_in(Config, Username)).
+
+%% -------------------------------------------------------------------
+%% Helpers
+%% -------------------------------------------------------------------
+
+open_connections(Config, NodesAndUsers) ->
+    % Randomly select connection type
+    OpenConnectionFun = case ?config(connection_type, Config) of
+        network -> open_unmanaged_connection;
+        direct  -> open_unmanaged_connection_direct
+    end,
+    Conns = lists:map(fun
+      ({Node, User}) ->
+          rabbit_ct_client_helpers:OpenConnectionFun(Config, Node,
+                                                     User, User);
+      (Node) ->
+          rabbit_ct_client_helpers:OpenConnectionFun(Config, Node)
+      end, NodesAndUsers),
+    timer:sleep(500),
+    Conns.
+
+close_connections(Conns) ->
+    lists:foreach(fun
+      (Conn) ->
+          rabbit_ct_client_helpers:close_connection(Conn)
+      end, Conns),
+    timer:sleep(500).
+
+kill_connections(Conns) ->
+    lists:foreach(fun
+      (Conn) ->
+          (catch exit(Conn, please_terminate))
+      end, Conns),
+    timer:sleep(500).
+
+
+count_connections_in(Config, Username) ->
+    length(connections_in(Config, Username)).
+
+connections_in(Config, Username) ->
+    connections_in(Config, 0, Username).
+connections_in(Config, NodeIndex, Username) ->
+    rabbit_ct_broker_helpers:rpc(Config, NodeIndex,
+                                 rabbit_connection_tracking,
+                                 list_of_user, [Username]).
+
+all_connections(Config) ->
+    all_connections(Config, 0).
+all_connections(Config, NodeIndex) ->
+    rabbit_ct_broker_helpers:rpc(Config, NodeIndex,
+                                 rabbit_connection_tracking,
+                                 list, []).
+
+set_up_vhost(Config, VHost) ->
+    rabbit_ct_broker_helpers:add_vhost(Config, VHost),
+    rabbit_ct_broker_helpers:set_full_permissions(Config, <<"guest">>, VHost),
+    set_vhost_connection_limit(Config, VHost, -1).
+
+set_vhost_connection_limit(Config, VHost, Count) ->
+    set_vhost_connection_limit(Config, 0, VHost, Count).
+
+set_vhost_connection_limit(Config, NodeIndex, VHost, Count) ->
+    Node  = rabbit_ct_broker_helpers:get_node_config(
+              Config, NodeIndex, nodename),
+    ok = rabbit_ct_broker_helpers:control_action(
+      set_vhost_limits, Node,
+      ["{\"max-connections\": " ++ integer_to_list(Count) ++ "}"],
+      [{"-p", binary_to_list(VHost)}]).
+
+await_running_node_refresh(_Config, _NodeIndex) ->
+    timer:sleep(250).
+
+expect_that_client_connection_is_rejected(Config) ->
+    expect_that_client_connection_is_rejected(Config, 0).
+
+expect_that_client_connection_is_rejected(Config, NodeIndex) ->
+    {error, not_allowed} =
+      rabbit_ct_client_helpers:open_unmanaged_connection(Config, NodeIndex).
+
+expect_that_client_connection_is_rejected(Config, NodeIndex, VHost) ->
+    {error, not_allowed} =
+      rabbit_ct_client_helpers:open_unmanaged_connection(Config, NodeIndex, VHost).
diff --git a/test/unit_inbroker_SUITE.erl b/test/unit_inbroker_SUITE.erl
index af86371fc2..91a3eb32a6 100644
--- a/test/unit_inbroker_SUITE.erl
+++ b/test/unit_inbroker_SUITE.erl
@@ -237,9 +237,21 @@ orelse Group =:= backing_queue_embed_limit_1024 ->
 end_per_group1(_, Config) ->
     Config.
 
+init_per_testcase(Testcase, Config) when Testcase == variable_queue_requeue;
+                                         Testcase == variable_queue_fold ->
+    ok = rabbit_ct_broker_helpers:rpc(
+           Config, 0, application, set_env,
+           [rabbit, queue_explicit_gc_run_operation_threshold, 0]),
+    rabbit_ct_helpers:testcase_started(Config, Testcase);
 init_per_testcase(Testcase, Config) ->
     rabbit_ct_helpers:testcase_started(Config, Testcase).
 
+end_per_testcase(Testcase, Config) when Testcase == variable_queue_requeue;
+                                        Testcase == variable_queue_fold ->
+    ok = rabbit_ct_broker_helpers:rpc(
+           Config, 0, application, set_env,
+           [rabbit, queue_explicit_gc_run_operation_threshold, 1000]),
+    rabbit_ct_helpers:testcase_finished(Config, Testcase);
 end_per_testcase(Testcase, Config) ->
     rabbit_ct_helpers:testcase_finished(Config, Testcase).
 
diff --git a/test/worker_pool_SUITE.erl b/test/worker_pool_SUITE.erl
index 7eb4d6fd04..9b6b0721a2 100644
--- a/test/worker_pool_SUITE.erl
+++ b/test/worker_pool_SUITE.erl
@@ -41,7 +41,7 @@ end_per_testcase(_, Config) ->
     unlink(Pool),
     exit(Pool, kill).
 
-run_code_synchronously(Config) ->
+run_code_synchronously(_) ->
     Self = self(),
     Test = make_ref(),
     Sleep = 200,
@@ -63,7 +63,7 @@ run_code_synchronously(Config) ->
     % Worker is a separate process
     true = (Self /= Result).
 
-run_code_asynchronously(Config) ->
+run_code_asynchronously(_) ->
     Self = self(),
     Test = make_ref(),
     Sleep = 200,
@@ -84,7 +84,7 @@ run_code_asynchronously(Config) ->
     % Worker is a separate process
     true = (Self /= Result).
 
-set_timeout(Config) ->
+set_timeout(_) ->
     Self = self(),
     Test = make_ref(),
     Worker = worker_pool:submit(?POOL_NAME,
@@ -112,7 +112,7 @@ set_timeout(Config) ->
     end.
 
 
-cancel_timeout(Config) ->
+cancel_timeout(_) ->
     Self = self(),
     Test = make_ref(),
     Worker = worker_pool:submit(?POOL_NAME,
@@ -146,7 +146,7 @@ cancel_timeout(Config) ->
     after 0 -> ok
     end.
 
-cancel_timeout_by_setting(Config) ->
+cancel_timeout_by_setting(_) ->
     Self = self(),
     Test = make_ref(),
     Worker = worker_pool:submit(?POOL_NAME,
@@ -186,8 +186,3 @@ cancel_timeout_by_setting(Config) ->
     receive {hello_reset, Worker, Test} -> ok
     after 1000 -> exit(timeout_is_late)
     end.
-
-
-
-
-