QPID-4123: C++ Broker ACL creates too many rules

Recent changes have added new tables to define what
are ACL lookups and their properties. This commit
finishes that work by not propagating rules that
will never match. Also, it completes the scaffolding
for allowed and denied host lists to be fully 
integrated. This commit:

* Adds startup logging of ACL validation tables
  with cross references to possible rule matches.
* Hooks the ACL host allow/deny connection lists
  into self test.
* Fixes self tests that get broken by proper rule
  table handling.
* Introduces a 'create connection' decision mode
  similar to ACL rule decision mode.
* Describes it all in doc book.



git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1612874 13f79535-47bb-0310-9956-ffa450edef68

15 files changed, 2178 insertions, 1213 deletions

diff --git a/qpid/cpp/src/qpid/acl/Acl.cpp b/qpid/cpp/src/qpid/acl/Acl.cpp
index cc3a08c754..bd9482ef41 100644
--- a/qpid/cpp/src/qpid/acl/Acl.cpp
+++ b/qpid/cpp/src/qpid/acl/Acl.cpp
@@ -169,17 +169,13 @@ bool Acl::approveConnection(const qpid::broker::Connection& conn)
     }
 
     (void) dataLocal->getConnQuotaForUser(userName, &connectionLimit);
-    boost::shared_ptr<const AclData::bwHostRuleSet> globalRules = dataLocal->getGlobalConnectionRules();
-    boost::shared_ptr<const AclData::bwHostRuleSet> userRules   = dataLocal->getUserConnectionRules(userName);
 
-
-    return connectionCounter->approveConnection(conn,
-                                                userName,
-                                                dataLocal->enforcingConnectionQuotas(),
-                                                connectionLimit,
-                                                globalRules,
-                                                userRules
-                                               );
+    return connectionCounter->approveConnection(
+        conn,
+        userName,
+        dataLocal->enforcingConnectionQuotas(),
+        connectionLimit,
+        dataLocal);
 }
 
 bool Acl::approveCreateQueue(const std::string& userId, const std::string& queueName)
@@ -295,6 +291,9 @@ bool Acl::readAclFile(std::string& aclFile, std::string& errorText) {
         QPID_LOG(debug, "ACL: Queue quotas are Enabled.");
     }
 
+    QPID_LOG(debug, "ACL: Default connection mode : "
+        << AclHelper::getAclResultStr(d->connectionMode()));
+
     data->aclSource = aclFile;
     if (mgmtObject!=0){
         mgmtObject->set_transferAcl(transferAcl?1:0);
@@ -317,6 +316,7 @@ void Acl::loadEmptyAclRuleset() {
     boost::shared_ptr<AclData> d(new AclData);
     d->decisionMode = ALLOW;
     d->aclSource = "";
+    d->connectionDecisionMode = ALLOW;
     {
         Mutex::ScopedLock locker(dataLock);
         data = d;
@@ -357,13 +357,23 @@ Manageable::status_t Acl::lookup(qpid::management::Args& args, std::string& text
             Mutex::ScopedLock locker(dataLock);
             dataLocal = data;  //rcu copy
         }
-        AclResult aclResult = dataLocal->lookup(
-            ioArgs.i_userId,
-            action,
-            objType,
-            ioArgs.i_objectName,
-            &propertyMap);
-
+        AclResult aclResult;
+        // CREATE CONNECTION does not use lookup()
+        if (action == ACT_CREATE && objType == OBJ_CONNECTION) {
+            std::string host = propertyMap[acl::PROP_HOST];
+            std::string logString;
+            aclResult = dataLocal->isAllowedConnection(
+                ioArgs.i_userId,
+                host,
+                logString);
+        } else {
+            aclResult = dataLocal->lookup(
+                ioArgs.i_userId,
+                action,
+                objType,
+                ioArgs.i_objectName,
+                &propertyMap);
+        }
         ioArgs.o_result = AclHelper::getAclResultStr(aclResult);
         result = STATUS_OK;
 
diff --git a/qpid/cpp/src/qpid/acl/AclConnectionCounter.cpp b/qpid/cpp/src/qpid/acl/AclConnectionCounter.cpp
index 0e780a95bc..ca3da50088 100644
--- a/qpid/cpp/src/qpid/acl/AclConnectionCounter.cpp
+++ b/qpid/cpp/src/qpid/acl/AclConnectionCounter.cpp
@@ -139,8 +139,9 @@ void ConnectionCounter::releaseLH(
         }
     } else {
         // User had no connections.
-        QPID_LOG(notice, "ACL ConnectionCounter Connection for '" << theName
-            << "' not found in connection count pool");
+        // Connections denied by ACL never get users added
+        //QPID_LOG(notice, "ACL ConnectionCounter Connection for '" << theName
+        //    << "' not found in connection count pool");
     }
 }
 
@@ -215,8 +216,7 @@ bool ConnectionCounter::approveConnection(
         const std::string& userName,
         bool enforcingConnectionQuotas,
         uint16_t connectionUserQuota,
-        boost::shared_ptr<const AclData::bwHostRuleSet> globalBWRules,
-        boost::shared_ptr<const AclData::bwHostRuleSet> userBWRules)
+        boost::shared_ptr<AclData> localdata)
 {
     const std::string& hostName(getClientHost(connection.getMgmtId()));
 
@@ -227,74 +227,17 @@ bool ConnectionCounter::approveConnection(
                              C_OPENED, false, false);
 
     // Run global black/white list check
-    //
-    // TODO: The global check could be run way back in AsynchIO where
-    // disapproval would mean that the socket is not accepted. Or
-    // it may be accepted and closed right away without running any
-    // protocol and creating the connection churn that gets here.
-    //
     sys::SocketAddress sa(hostName, "");
+    bool okByHostList(true);
+    std::string hostLimitText;
     if (sa.isIp()) {
-        if (boost::shared_ptr<const AclData::bwHostRuleSet>() != globalBWRules) {
-            AclData::bwHostRuleSet::const_iterator it;
-            for (it=globalBWRules->begin(); it!=globalBWRules->end(); it++) {
-                if (it->getAclHost().match(hostName)) {
-                    // This host matches a global spec and controls the
-                    // allow/deny decision for this connection.
-                    AclResult res = it->getAclResult();
-                    if (res == DENY || res == DENYLOG) {
-                        // The result is deny
-                        QPID_LOG(trace, "ACL ConnectionApprover global rule " << it->toString()
-                                << " denies connection for host " << hostName << ", user "
-                                << userName);
-                        acl.reportConnectLimit(userName, hostName);
-                        return false;
-                    } else {
-                        // The result is allow
-                        QPID_LOG(trace, "ACL ConnectionApprover global rule " << it->toString()
-                                << " allows connection for host " << hostName << ", user "
-                                << userName);
-                        break;
-                    }
-                } else {
-                    // This rule in the global spec doesn't match and
-                    // does not control the allow/deny decision.
-                }
-            }
+        AclResult result = localdata->isAllowedConnection(userName, hostName, hostLimitText);
+        okByHostList = AclHelper::resultAllows(result);
+        if (okByHostList) {
+            QPID_LOG(trace, "ACL: ConnectionApprover host list " << hostLimitText);
         }
-
-        // Run user black/white list check
-        if (boost::shared_ptr<const AclData::bwHostRuleSet>() != userBWRules) {
-            AclData::bwHostRuleSet::const_iterator it;
-            for (it=userBWRules->begin(); it!=userBWRules->end(); it++) {
-                if (it->getAclHost().match(hostName)) {
-                    // This host matches a user spec and controls the
-                    // allow/deny decision for this connection.
-                    AclResult res = it->getAclResult();
-                    if (res == DENY || res == DENYLOG) {
-                        // The result is deny
-                        QPID_LOG(trace, "ACL ConnectionApprover user rule " << it->toString()
-                                << " denies connection for host " << hostName << ", user "
-                                << userName);
-                        acl.reportConnectLimit(userName, hostName);
-                        return false;
-                    } else {
-                        // The result is allow
-                        QPID_LOG(trace, "ACL ConnectionApprover user rule " << it->toString()
-                                << " allows connection for host " << hostName << ", user "
-                                << userName);
-                        break;
-                    }
-                } else {
-                    // This rule in the user's spec doesn't match and
-                    // does not control the allow/deny decision.
-                }
-            }
-        }
-    } else {
-        // Non-IP hosts don't get subjected to blacklist and whitelist
-        // checks.
     }
+
     // Approve total connections
     bool okTotal  = true;
     if (totalLimit > 0) {
@@ -313,6 +256,10 @@ bool ConnectionCounter::approveConnection(
                                       enforcingConnectionQuotas);
 
     // Emit separate log for each disapproval
+    if (!okByHostList) {
+        QPID_LOG(error, "ACL: ConnectionApprover host list " << hostLimitText
+                 << " Connection refused.");
+    }
     if (!okTotal) {
         QPID_LOG(error, "Client max total connection count limit of " << totalLimit
                  << " exceeded by '"
@@ -333,7 +280,7 @@ bool ConnectionCounter::approveConnection(
     }
 
     // Count/Event once for each disapproval
-    bool result = okTotal && okByIP && okByUser;
+    bool result = okByHostList && okTotal && okByIP && okByUser;
     if (!result) {
         acl.reportConnectLimit(userName, hostName);
     }
diff --git a/qpid/cpp/src/qpid/acl/AclConnectionCounter.h b/qpid/cpp/src/qpid/acl/AclConnectionCounter.h
index 6b8f396867..3683b573ff 100644
--- a/qpid/cpp/src/qpid/acl/AclConnectionCounter.h
+++ b/qpid/cpp/src/qpid/acl/AclConnectionCounter.h
@@ -97,8 +97,7 @@ public:
                            const std::string& userName,
                            bool enforcingConnectionQuotas,
                            uint16_t connectionLimit,
-                           boost::shared_ptr<const AclData::bwHostRuleSet> globalBWRules,
-                           boost::shared_ptr<const AclData::bwHostRuleSet> userBWRules
+                           boost::shared_ptr<AclData> localdata
                           );
 };
 
diff --git a/qpid/cpp/src/qpid/acl/AclData.cpp b/qpid/cpp/src/qpid/acl/AclData.cpp
index d325442353..a629e44d60 100644
--- a/qpid/cpp/src/qpid/acl/AclData.cpp
+++ b/qpid/cpp/src/qpid/acl/AclData.cpp
@@ -17,10 +17,13 @@
  */
 
 #include "qpid/acl/AclData.h"
+#include "qpid/acl/AclValidator.h"
 #include "qpid/log/Statement.h"
 #include "qpid/sys/IntegerTypes.h"
 #include <boost/lexical_cast.hpp>
 #include <boost/shared_ptr.hpp>
+#include <sstream>
+#include <iomanip>
 
 namespace qpid {
 namespace acl {
@@ -49,10 +52,11 @@ AclData::AclData():
     decisionMode(qpid::acl::DENY),
     transferAcl(false),
     aclSource("UNKNOWN"),
+    connectionDecisionMode(qpid::acl::ALLOW),
     connQuotaRuleSettings(new quotaRuleSet),
     queueQuotaRuleSettings(new quotaRuleSet),
     connBWHostsGlobalRules(new bwHostRuleSet),
-    connBWHostsRuleSettings(new bwHostUserRuleMap)
+    connBWHostsUserRules(new bwHostUserRuleMap)
 {
     for (unsigned int cnt=0; cnt< qpid::acl::ACTIONSIZE; cnt++) {
         actionList[cnt]=0;
@@ -74,12 +78,56 @@ void AclData::clear ()
         delete[] actionList[cnt];
     }
     transferAcl = false;
+    connectionDecisionMode = qpid::acl::ALLOW;
     connQuotaRuleSettings->clear();
     queueQuotaRuleSettings->clear();
     connBWHostsGlobalRules->clear();
-    connBWHostsRuleSettings->clear();
+    connBWHostsUserRules->clear();
 }
 
+void AclData::printDecisionRules(int userFieldWidth) {
+    AclValidator validator;
+    QPID_LOG(trace, "ACL: Decision rule cross reference");
+    for (int act=0; act<acl::ACTIONSIZE; act++) {
+        acl::Action action = acl::Action(act);
+        for (int obj=0; obj<acl::OBJECTSIZE; obj++) {
+            acl::ObjectType object = acl::ObjectType(obj);
+            if (actionList[act] != NULL && actionList[act][obj] != NULL) {
+                for (actObjItr aoitr = actionList[act][obj]->begin();
+                    aoitr != actionList[act][obj]->end();
+                    aoitr++) {
+                    std::string user = (*aoitr).first;
+                    ruleSetItr rsitr = (*aoitr).second.end();
+                    for (size_t rCnt=0; rCnt < (*aoitr).second.size(); rCnt++) {
+                        rsitr--;
+                        std::vector<int> candidates;
+                        validator.findPossibleLookupMatch(
+                            action, object, rsitr->props, candidates);
+                        std::stringstream ss;
+                        std::string sep("");
+                        for (std::vector<int>::const_iterator
+                            itr = candidates.begin(); itr != candidates.end(); itr++) {
+                            ss << sep << *itr;
+                            sep = ",";
+                        }
+                        QPID_LOG(trace, "ACL: User: "
+                            << std::setfill(' ') << std::setw(userFieldWidth +1) << std::left
+                            << user << " "
+                            << std::setfill(' ') << std::setw(acl::ACTION_STR_WIDTH +1) << std::left
+                            << AclHelper::getActionStr(action)
+                            << std::setfill(' ') << std::setw(acl::OBJECTTYPE_STR_WIDTH) << std::left
+                            << AclHelper::getObjectTypeStr(object)
+                            << " Rule: "
+                            << rsitr->toString() << " may match Lookups : ("
+                            << ss.str() << ")");
+                    }
+                }
+            } else {
+                // no rules for action/object
+            }
+        }
+    }
+}
 
 //
 // matchProp
@@ -619,22 +667,66 @@ void AclData::setConnGlobalRules (boost::shared_ptr<bwHostRuleSet> cgr) {
 }
 
 void AclData::setConnUserRules (boost::shared_ptr<bwHostUserRuleMap> hurm) {
-    connBWHostsRuleSettings = hurm;
+    connBWHostsUserRules = hurm;
 }
 
+AclResult AclData::isAllowedConnection(const std::string& userName,
+                                       const std::string& hostName,
+                                       std::string& logText) {
+    bool decisionMade(false);
+    AclResult result(ALLOW);
+    for (bwHostRuleSetItr it=connBWHostsGlobalRules->begin();
+                          it!=connBWHostsGlobalRules->end(); it++) {
+        if (it->getAclHost().match(hostName)) {
+            // This host matches a global spec and controls the
+            // allow/deny decision for this connection.
+            result = it->getAclResult();
+            logText = QPID_MSG("global rule " << it->toString()
+                    << (AclHelper::resultAllows(result) ? " allows" : " denies")
+                    << " connection for host " << hostName << ", user "
+                    << userName);
+            decisionMade = true;
+            break;
+        } else {
+            // This rule in the global spec doesn't match and
+            // does not control the allow/deny decision.
+        }
+    }
 
-//
-// Get user-specific black/white connection rule list
-//
-boost::shared_ptr<const AclData::bwHostRuleSet> AclData::getUserConnectionRules(const std::string& name){
-    AclData::bwHostUserRuleMapItr itrRule = connBWHostsRuleSettings->find(name);
-    if (itrRule == connBWHostsRuleSettings->end()) {
-        return boost::shared_ptr<const bwHostRuleSet>();
-    } else {
-        return boost::shared_ptr<const bwHostRuleSet>(&itrRule->second);
+    // Run user black/white list check
+    if (!decisionMade) {
+        bwHostUserRuleMapItr itrRule = connBWHostsUserRules->find(userName);
+        if (itrRule != connBWHostsUserRules->end()) {
+            for (bwHostRuleSetItr it=(*itrRule).second.begin();
+                 it!=(*itrRule).second.end(); it++) {
+                if (it->getAclHost().match(hostName)) {
+                    // This host matches a user spec and controls the
+                    // allow/deny decision for this connection.
+                    result = it->getAclResult();
+                    logText = QPID_MSG("global rule " << it->toString()
+                            << (AclHelper::resultAllows(result) ? " allows" : " denies")
+                            << " connection for host " << hostName << ", user "
+                            << userName);
+                    decisionMade = true;
+                    break;
+                } else {
+                    // This rule in the user's spec doesn't match and
+                    // does not control the allow/deny decision.
+                }
+            }
+        }
     }
-}
 
+    // Apply global connection mode
+    if (!decisionMade) {
+        result = connectionDecisionMode;
+        logText = QPID_MSG("default connection policy "
+                << (AclHelper::resultAllows(result) ? "allows" : "denies")
+                << " connection for host " << hostName << ", user "
+                << userName);
+    }
+    return result;
+}
 
 //
 //
diff --git a/qpid/cpp/src/qpid/acl/AclData.h b/qpid/cpp/src/qpid/acl/AclData.h
index 2167af66b8..105a5d9c67 100644
--- a/qpid/cpp/src/qpid/acl/AclData.h
+++ b/qpid/cpp/src/qpid/acl/AclData.h
@@ -69,7 +69,7 @@ public:
     typedef specPropertyMap::const_iterator                specPropertyMapItr;
 
     //
-    // rule
+    // Rule
     //
     // Created by AclReader and stored in a ruleSet vector for subsequent
     //  run-time lookup matching and allow/deny decisions.
@@ -92,6 +92,8 @@ public:
         bool                  pubExchNameMatchesBlank;
         std::string           pubExchName;
         std::vector<bool>     ruleHasUserSub;
+        std::string           lookupSource;
+        std::string           lookupHelp;
 
         Rule (int ruleNum, qpid::acl::AclResult res, specPropertyMap& p) :
             rawRuleNum(ruleNum),
@@ -106,6 +108,24 @@ public:
             ruleHasUserSub(PROPERTYSIZE, false)
             {}
 
+        // Variation of Rule for tracking PropertyDefs
+        // for AclValidation.
+        Rule (int ruleNum, qpid::acl::AclResult res, specPropertyMap& p,
+              const std::string& ls, const std::string& lh
+        ) :
+            rawRuleNum(ruleNum),
+            ruleMode(res),
+            props(p),
+            pubRoutingKeyInRule(false),
+            pubRoutingKey(),
+            pubExchNameInRule(false),
+            pubExchNameMatchesBlank(false),
+            pubExchName(),
+            ruleHasUserSub(PROPERTYSIZE, false),
+            lookupSource(ls),
+            lookupHelp(lh)
+            {}
+
 
         std::string toString () const {
             std::ostringstream ruleStr;
@@ -148,11 +168,12 @@ public:
     typedef  std::map<std::string, bwHostRuleSet> bwHostUserRuleMap; //<username, hosts-vector>
     typedef  bwHostUserRuleMap::const_iterator    bwHostUserRuleMapItr;
 
-    // Action*[] -> Object*[] -> map<user -> set<Rule> >
+    // Action*[] -> Object*[] -> map<user, set<Rule> >
     aclAction*           actionList[qpid::acl::ACTIONSIZE];
     qpid::acl::AclResult decisionMode;  // allow/deny[-log] if no matching rule found
     bool                 transferAcl;
     std::string          aclSource;
+    qpid::acl::AclResult connectionDecisionMode;
 
     AclResult lookup(
         const std::string&               id,        // actor id
@@ -172,10 +193,14 @@ public:
         return connBWHostsGlobalRules;
     }
 
-    boost::shared_ptr<const AclData::bwHostRuleSet> getUserConnectionRules(const std::string& name);
+    boost::shared_ptr<const bwHostUserRuleMap> getUserConnectionRules() {
+        return connBWHostsUserRules;
+    }
 
     bool matchProp(const std::string & src, const std::string& src1);
     void clear ();
+    void printDecisionRules(int userFieldWidth);
+
     static const std::string ACL_KEYWORD_USER_SUBST;
     static const std::string ACL_KEYWORD_DOMAIN_SUBST;
     static const std::string ACL_KEYWORD_USERDOMAIN_SUBST;
@@ -243,6 +268,19 @@ public:
         return "65530";
     }
 
+    /**
+     * isAllowedConnection
+     * Return true if this user is allowed to connect to this host.
+     * Return log text describing both success and failure.
+     */
+    AclResult isAllowedConnection(const std::string& userName,
+                                  const std::string& hostName,
+                                  std::string& logText);
+
+    AclResult connectionMode() const {
+        return connectionDecisionMode;
+    }
+
     AclData();
     virtual ~AclData();
 
@@ -277,7 +315,7 @@ private:
     boost::shared_ptr<bwHostRuleSet> connBWHostsGlobalRules;
 
     // Per-user host connection black/white rule set map
-    boost::shared_ptr<bwHostUserRuleMap> connBWHostsRuleSettings;
+    boost::shared_ptr<bwHostUserRuleMap> connBWHostsUserRules;
 };
 
 }} // namespace qpid::acl
diff --git a/qpid/cpp/src/qpid/acl/AclLexer.cpp b/qpid/cpp/src/qpid/acl/AclLexer.cpp
index d0f149db84..4006e5271f 100644
--- a/qpid/cpp/src/qpid/acl/AclLexer.cpp
+++ b/qpid/cpp/src/qpid/acl/AclLexer.cpp
@@ -32,7 +32,7 @@ namespace acl {
 
 // ObjectType
 const std::string objectNames[OBJECTSIZE] = {
-    "queue", "exchange", "broker", "link", "method", "query", "connection" };
+    "broker", "connection", "exchange", "link", "method", "query", "queue" };
 
 ObjectType AclHelper::getObjectType(const std::string& str) {
     for (int i=0; i< OBJECTSIZE; ++i) {
@@ -48,9 +48,9 @@ const std::string& AclHelper::getObjectTypeStr(const ObjectType o) {
 
 // Action
 const std::string actionNames[ACTIONSIZE] = {
-    "consume", "publish", "create", "access", "bind",
-    "unbind", "delete", "purge", "update", "move",
-    "redirect", "reroute" };
+    "access", "bind", "consume", "create", "delete",
+    "move", "publish", "purge", "redirect", "reroute",
+    "unbind", "update" };
 
 Action AclHelper::getAction(const std::string& str) {
     for (int i=0; i< ACTIONSIZE; ++i) {
@@ -133,4 +133,9 @@ const std::string& AclHelper::getAclResultStr(const AclResult r) {
     return resultNames[r];
 }
 
+bool AclHelper::resultAllows(const AclResult r) {
+    bool answer = r == ALLOW || r == ALLOWLOG;
+    return answer;
+}
+
 }} // namespace qpid::acl
diff --git a/qpid/cpp/src/qpid/acl/AclLexer.h b/qpid/cpp/src/qpid/acl/AclLexer.h
index a8032ddee7..d3df411afd 100644
--- a/qpid/cpp/src/qpid/acl/AclLexer.h
+++ b/qpid/cpp/src/qpid/acl/AclLexer.h
@@ -43,31 +43,35 @@ namespace acl {
 
     // ObjectType  shared between ACL spec and ACL authorise interface
     enum ObjectType {
-        OBJ_QUEUE,
-        OBJ_EXCHANGE,
         OBJ_BROKER,
+        OBJ_CONNECTION,
+        OBJ_EXCHANGE,
         OBJ_LINK,
         OBJ_METHOD,
         OBJ_QUERY,
-        OBJ_CONNECTION,
+        OBJ_QUEUE,
         OBJECTSIZE }; // OBJECTSIZE must be last in list
 
+    const int OBJECTTYPE_STR_WIDTH = 10;
+
     // Action  shared between ACL spec and ACL authorise interface
     enum Action {
-        ACT_CONSUME,
-        ACT_PUBLISH,
-        ACT_CREATE,
         ACT_ACCESS,
         ACT_BIND,
-        ACT_UNBIND,
+        ACT_CONSUME,
+        ACT_CREATE,
         ACT_DELETE,
-        ACT_PURGE,
-        ACT_UPDATE,
         ACT_MOVE,
+        ACT_PUBLISH,
+        ACT_PURGE,
         ACT_REDIRECT,
         ACT_REROUTE,
+        ACT_UNBIND,
+        ACT_UPDATE,
         ACTIONSIZE }; // ACTIONSIZE must be last in list
 
+    const int ACTION_STR_WIDTH = 8;
+
     // Property used in ACL authorize interface
     enum Property {
         PROP_NAME,
@@ -153,6 +157,7 @@ namespace acl {
         static QPID_BROKER_EXTERN const std::string&   getPropertyStr(const SpecProperty p);
         static QPID_BROKER_EXTERN AclResult              getAclResult(const std::string& str);
         static QPID_BROKER_EXTERN const std::string&  getAclResultStr(const AclResult r);
+        static QPID_BROKER_EXTERN bool                   resultAllows(const AclResult r);
 
         typedef std::set<Property>                  propSet;
         typedef boost::shared_ptr<propSet>          propSetPtr;
@@ -160,9 +165,6 @@ namespace acl {
         typedef std::map<Action, propSetPtr>        actionMap;
         typedef boost::shared_ptr<actionMap>        actionMapPtr;
         typedef std::pair<ObjectType, actionMapPtr> objectPair;
-        typedef std::map<ObjectType, actionMapPtr>  objectMap;
-        typedef objectMap::const_iterator           omCitr;
-        typedef boost::shared_ptr<objectMap>        objectMapPtr;
         typedef std::map<Property, std::string>     propMap;
         typedef propMap::const_iterator             propMapItr;
         typedef std::map<SpecProperty, std::string> specPropMap;
diff --git a/qpid/cpp/src/qpid/acl/AclReader.cpp b/qpid/cpp/src/qpid/acl/AclReader.cpp
index a0b4c67bf3..e8223c3570 100644
--- a/qpid/cpp/src/qpid/acl/AclReader.cpp
+++ b/qpid/cpp/src/qpid/acl/AclReader.cpp
@@ -26,6 +26,7 @@
 #include "qpid/log/Statement.h"
 #include "qpid/Exception.h"
 #include <boost/lexical_cast.hpp>
+#include <algorithm>
 
 #include <iomanip> // degug
 #include <iostream> // debug
@@ -55,11 +56,6 @@ namespace acl {
         return props.insert(propNvPair(p, v)).second;
     }
 
-    bool AclReader::aclRule::validate(const AclHelper::objectMapPtr& /*validationMap*/) {
-        // TODO - invalid rules won't ever be called in real life...
-        return true;
-    }
-
     // Debug aid
     std::string AclReader::aclRule::toString() {
         std::ostringstream oss;
@@ -89,6 +85,7 @@ namespace acl {
         d->clear();
         QPID_LOG(debug, "ACL: Load Rules");
         bool foundmode = false;
+        bool foundConnectionMode = false;
 
         rlCitr i = rules.end();
         for (int cnt = rules.size(); cnt; cnt--) {
@@ -96,6 +93,18 @@ namespace acl {
             QPID_LOG(debug, "ACL: Processing " << std::setfill(' ') << std::setw(2)
                 << cnt << " " << (*i)->toString());
 
+            if (!(*i)->actionAll && (*i)->objStatus == aclRule::VALUE &&
+                !validator.validateAllowedProperties(
+                    (*i)->action, (*i)->object, (*i)->props, false)) {
+                    // specific object/action has bad property
+                    // this rule gets ignored
+                    continue;
+            } else {
+                // action=all or object=none/all means the rule gets propagated
+                // possibly to many places.
+                // Invalid rule combinations are not propagated.
+            }
+
             if (!foundmode && (*i)->actionAll && (*i)->names.size() == 1
                 && (*((*i)->names.begin())).compare(AclData::ACL_KEYWORD_WILDCARD) == 0) {
                     d->decisionMode = (*i)->res;
@@ -105,18 +114,33 @@ namespace acl {
             } else if ((*i)->action == acl::ACT_CREATE && (*i)->object == acl::OBJ_CONNECTION) {
                 // Intercept CREATE CONNECTION rules process them into separate lists to
                 // be consumed in the connection approval code path.
+                propMap::const_iterator pName = (*i)->props.find(SPECPROP_NAME);
+                if (pName != (*i)->props.end()) {
+                    throw Exception(QPID_MSG("ACL: CREATE CONNECTION rule " << cnt << " must not have a 'name' property"));
+                }
                 propMap::const_iterator pHost = (*i)->props.find(SPECPROP_HOST);
                 if (pHost == (*i)->props.end()) {
                     throw Exception(QPID_MSG("ACL: CREATE CONNECTION rule " << cnt << " has no 'host' property"));
                 }
                 // create the connection rule
-                AclBWHostRule bwRule((*i)->res,
-                                     (pHost->second.compare(AclData::ACL_KEYWORD_ALL) != 0 ? pHost->second : ""));
+                bool allUsers = (*(*i)->names.begin()).compare(AclData::ACL_KEYWORD_WILDCARD) == 0;
+                bool allHosts = pHost->second.compare(AclData::ACL_KEYWORD_ALL) == 0;
+                AclBWHostRule bwRule((*i)->res, (allHosts ? "" : pHost->second));
 
                 // apply the rule globally or to user list
-                if ((*(*i)->names.begin()).compare(AclData::ACL_KEYWORD_WILDCARD) == 0) {
-                    // Rules for user "all" go into the gloabl list
-                    globalHostRules->insert( globalHostRules->begin(), bwRule );
+                if (allUsers) {
+                    if (allHosts) {
+                        // allow one specification of allUsers,allHosts
+                        if (foundConnectionMode) {
+                            throw Exception(QPID_MSG("ACL: only one CREATE CONNECTION rule for user=all and host=all allowed"));
+                        }
+                        foundConnectionMode = true;
+                        d->connectionDecisionMode = (*i)->res;
+                        QPID_LOG(trace, "ACL: Found connection mode: " << AclHelper::getAclResultStr( (*i)->res ));
+                    } else {
+                        // Rules for allUsers but not allHosts go into the global list
+                        globalHostRules->insert( globalHostRules->begin(), bwRule );
+                    }
                 } else {
                     // other rules go into binned rule sets for each user
                     for (nsCitr itr  = (*i)->names.begin();
@@ -127,7 +151,6 @@ namespace acl {
                 }
             } else {
                 AclData::Rule rule(cnt, (*i)->res, (*i)->props);
-
                 // Record which properties have the user substitution string
                 for (pmCitr pItr=rule.props.begin(); pItr!=rule.props.end(); pItr++) {
                     if ((pItr->second.find(AclData::ACL_KEYWORD_USER_SUBST, 0)       != std::string::npos) ||
@@ -179,7 +202,6 @@ namespace acl {
                             d->actionList[acnt][j] = NULL;
                     }
 
-                    // TODO: optimize this loop to limit to valid options only!!
                     for (int ocnt = ((*i)->objStatus != aclRule::VALUE ? 0
                         : (*i)->object);
                         ocnt < acl::OBJECTSIZE;
@@ -199,20 +221,23 @@ namespace acl {
                         for (nsCitr itr  = (allNames ? names.begin() : (*i)->names.begin());
                                     itr != (allNames ? names.end()   : (*i)->names.end());
                                     itr++) {
-                            AclData::actObjItr itrRule =
-                                d->actionList[acnt][ocnt]->find(*itr);
-
-                            if (itrRule == d->actionList[acnt][ocnt]->end()) {
-                                AclData::ruleSet rSet;
-                                rSet.push_back(rule);
-                                d->actionList[acnt][ocnt]->insert
-                                    (make_pair(std::string(*itr), rSet));
+                            if (validator.validateAllowedProperties(acl::Action(acnt),
+                                                                    acl::ObjectType(ocnt),
+                                                                    (*i)->props,
+                                                                    false)) {
+                                AclData::actObjItr itrRule =
+                                    d->actionList[acnt][ocnt]->find(*itr);
+
+                                if (itrRule == d->actionList[acnt][ocnt]->end()) {
+                                    AclData::ruleSet rSet;
+                                    rSet.push_back(rule);
+                                    d->actionList[acnt][ocnt]->insert
+                                        (make_pair(std::string(*itr), rSet));
+                                } else {
+                                        itrRule->second.push_back(rule);
+                                }
                             } else {
-                                // TODO add code to check for dead rules
-                                // allow peter create queue name=tmp <-- dead rule!!
-                                // allow peter create queue
-
-                                itrRule->second.push_back(rule);
+                                // Skip propagating this rule as it will never match.
                             }
                         }
                     }
@@ -241,7 +266,7 @@ namespace acl {
                     AclHelper::propertyMapToString(&rule.props)
                     << " for users {" <<
                     userstr.str().substr(0,userstr.str().length()-1)
-                    << "}" );
+                    << "}");
             }
         }
 
@@ -271,7 +296,6 @@ namespace acl {
 
     AclReader::AclReader(uint16_t theCliMaxConnPerUser, uint16_t theCliMaxQueuesPerUser) :
         lineNumber(0), contFlag(false),
-        validationMap(new AclHelper::objectMap),
         cliMaxConnPerUser (theCliMaxConnPerUser),
         connQuotaRulesExist(false),
         connQuota(new AclData::quotaRuleSet),
@@ -347,6 +371,8 @@ namespace acl {
         }
         printGlobalConnectRules();
         printUserConnectRules();
+        validator.tracePropertyDefs();
+        d->printDecisionRules( printNamesFieldWidth() );
 
         return 0;
     }
@@ -598,7 +624,9 @@ namespace acl {
         names.insert(name);
     }
 
-    // Debug aid
+    /**
+     * Emit debug logs exposing the name lists
+     */
     void AclReader::printNames() const {
         QPID_LOG(debug, "ACL: Group list: " << groups.size() << " groups found:" );
         std::string tmp("ACL: ");
@@ -622,6 +650,17 @@ namespace acl {
         QPID_LOG(debug, tmp);
     }
 
+    /**
+     * compute the width of longest user name
+     */
+    int AclReader::printNamesFieldWidth() const {
+        std::string::size_type max = 0;
+        for (nsCitr k=names.begin(); k!=names.end(); k++) {
+            max = std::max(max, (*k).length());
+        }
+        return max;
+    }
+
     bool AclReader::processAclLine(tokList& toks) {
         const unsigned toksSize = toks.size();
         if (toksSize < 4) {
@@ -709,12 +748,6 @@ namespace acl {
             }
         }
 
-        // If rule validates, add to rule list
-        if (!rule->validate(validationMap)) {
-            errorStream << ACL_FORMAT_ERR_LOG_PREFIX << "Line : " << lineNumber
-                << ", Invalid object/action/property combination.";
-            return false;
-        }
         rules.push_back(rule);
 
         return true;
@@ -726,6 +759,9 @@ namespace acl {
         int cnt = 1;
         for (rlCitr i=rules.begin(); i<rules.end(); i++,cnt++) {
             QPID_LOG(debug, "ACL:   " << std::setfill(' ') << std::setw(2) << cnt << " " << (*i)->toString());
+            if (!(*i)->actionAll && (*i)->objStatus == aclRule::VALUE) {
+                (void)validator.validateAllowedProperties((*i)->action, (*i)->object, (*i)->props, true);
+            }
         }
     }
 
diff --git a/qpid/cpp/src/qpid/acl/AclReader.h b/qpid/cpp/src/qpid/acl/AclReader.h
index 1f3cf6dca1..24237a82ce 100644
--- a/qpid/cpp/src/qpid/acl/AclReader.h
+++ b/qpid/cpp/src/qpid/acl/AclReader.h
@@ -30,6 +30,7 @@
 #include "qpid/acl/AclData.h"
 #include "qpid/acl/Acl.h"
 #include "qpid/broker/AclModule.h"
+#include "qpid/acl/AclValidator.h"
 
 namespace qpid {
 namespace acl {
@@ -70,7 +71,6 @@ class AclReader {
         void setObjectType(const ObjectType o);
         void setObjectTypeAll();
         bool addProperty(const SpecProperty p, const std::string v);
-        bool validate(const AclHelper::objectMapPtr& validationMap);
         std::string toString(); // debug aid
       private:
         void processName(const std::string& name, const groupMap& groups);
@@ -97,7 +97,7 @@ class AclReader {
     nameSet                 names;
     groupMap                groups;
     ruleList                rules;
-    AclHelper::objectMapPtr validationMap;
+    AclValidator            validator;
     std::ostringstream      errorStream;
 
   public:
@@ -108,7 +108,7 @@ class AclReader {
 
   private:
     bool processLine(char* line);
-    void loadDecisionData( boost::shared_ptr<AclData> d);
+    void loadDecisionData(boost::shared_ptr<AclData> d);
     int tokenize(char* line, tokList& toks);
 
     bool processGroupLine(tokList& toks, const bool cont);
@@ -116,6 +116,7 @@ class AclReader {
     void addName(const std::string& name, nameSetPtr groupNameSet);
     void addName(const std::string& name);
     void printNames() const; // debug aid
+    int  printNamesFieldWidth() const;
 
     bool processAclLine(tokList& toks);
     void printRules() const; // debug aid
diff --git a/qpid/cpp/src/qpid/acl/AclValidator.cpp b/qpid/cpp/src/qpid/acl/AclValidator.cpp
index 655e7942fe..32be06d9e1 100644
--- a/qpid/cpp/src/qpid/acl/AclValidator.cpp
+++ b/qpid/cpp/src/qpid/acl/AclValidator.cpp
@@ -18,6 +18,7 @@
 
 #include "qpid/acl/AclValidator.h"
 #include "qpid/acl/AclData.h"
+#include "qpid/acl/AclLexer.h"
 #include "qpid/Exception.h"
 #include "qpid/log/Statement.h"
 #include "qpid/sys/IntegerTypes.h"
@@ -26,6 +27,7 @@
 #include <boost/bind.hpp>
 #include <numeric>
 #include <sstream>
+#include <iomanip>
 
 namespace qpid {
 namespace acl {
@@ -78,7 +80,7 @@ namespace acl {
         return oss.str();
     }
 
-    AclValidator::AclValidator(){
+    AclValidator::AclValidator() : propertyIndex(1) {
         validators.insert(Validator(acl::SPECPROP_MAXQUEUESIZELOWERLIMIT,
                           boost::shared_ptr<PropertyType>(
                             new IntPropertyType(0,std::numeric_limits<int64_t>::max()))));
@@ -135,41 +137,111 @@ namespace acl {
 
         // Insert allowed action/object/property sets (generated manually 20140712)
 #define RP registerProperties
-        RP("Broker::getTimestampConfig",            ACT_ACCESS,  OBJ_BROKER);
-        RP("ExchangeHandlerImpl::query",            ACT_ACCESS,  OBJ_EXCHANGE);
-        RP("ExchangeHandlerImpl::bound",            ACT_ACCESS,  OBJ_EXCHANGE, "queuename routingkey");
-        RP("ExchangeHandlerImpl::declare",          ACT_ACCESS,  OBJ_EXCHANGE, "type alternate durable autodelete");
-        RP("Authorise::access",                     ACT_ACCESS,  OBJ_EXCHANGE, "type durable");
-        RP("Authorise::access",                     ACT_ACCESS,  OBJ_EXCHANGE);
-        RP("ManagementAgent::handleMethodRequest",  ACT_ACCESS,  OBJ_METHOD, "schemapackage schemaclass");
-        RP("ManagementAgent::authorizeAgentMessage",ACT_ACCESS,  OBJ_METHOD, "schemapackage schemaclass");
-        RP("ManagementAgent::handleGetQuery",       ACT_ACCESS,  OBJ_QUERY, "schemaclass");
-        RP("Broker::queryQueue",                    ACT_ACCESS,  OBJ_QUEUE);
-        RP("QueueHandlerImpl::query",               ACT_ACCESS,  OBJ_QUEUE);
-        RP("QueueHandlerImpl::declare",             ACT_ACCESS,  OBJ_QUEUE, "alternate durable exclusive autodelete policytype maxqueuecount maxqueuesize");
-        RP("Authorise::access",                     ACT_ACCESS,  OBJ_QUEUE, "alternate durable exclusive autodelete policytype maxqueuecount maxqueuesize");
-        RP("Authorise::access",                     ACT_ACCESS,  OBJ_QUEUE);
-        RP("Broker::bind",                          ACT_BIND,    OBJ_EXCHANGE, "queuename routingkey");
-        RP("Authorise::outgoing",                   ACT_BIND,    OBJ_EXCHANGE, "queuename routingkey");
-        RP("MessageHandlerImpl::subscribe",         ACT_CONSUME, OBJ_QUEUE);
-        RP("Authorise::outgoing",                   ACT_CONSUME, OBJ_QUEUE);
-        RP("ConnectionHandler",                     ACT_CREATE,  OBJ_CONNECTION, "host");
-        RP("Broker::createQueue",                   ACT_CREATE,  OBJ_QUEUE, "alternate durable exclusive autodelete policytype paging maxpages maxpagefactor maxqueuecount maxqueuesize maxfilecount maxfilesize");
-        RP("Broker::createExchange",                ACT_CREATE,  OBJ_EXCHANGE, "type alternate durable autodelete");
-        RP("ConnectionHandler::Handler::open",      ACT_CREATE,  OBJ_LINK);
-        RP("Authorise::interlink",                  ACT_CREATE,  OBJ_LINK);
-        RP("Broker::deleteQueue",                   ACT_DELETE,  OBJ_QUEUE, "alternate durable exclusive autodelete policytype");
-        RP("Broker::deleteExchange",                ACT_DELETE,  OBJ_EXCHANGE, "type alternate durable");
-        RP("Broker::queueMoveMessages",             ACT_MOVE,    OBJ_QUEUE, "queuename");
-        RP("SemanticState::route",                  ACT_PUBLISH, OBJ_EXCHANGE, "routingkey");
-        RP("Authorise::incoming",                   ACT_PUBLISH, OBJ_EXCHANGE);
-        RP("Authorise::route",                      ACT_PUBLISH, OBJ_EXCHANGE, "routingkey");
-        RP("Queue::ManagementMethod",               ACT_PURGE,   OBJ_QUEUE);
-        RP("QueueHandlerImpl::purge",               ACT_PURGE,   OBJ_QUEUE);
-        RP("Broker::queueRedirect",                 ACT_REDIRECT,OBJ_QUEUE, "queuename");
-        RP("Queue::ManagementMethod",               ACT_REROUTE, OBJ_QUEUE, "exchangename");
-        RP("Broker::unbind",                        ACT_UNBIND,  OBJ_EXCHANGE, "queuename routingkey");
-        RP("Broker::setTimestampConfig",            ACT_UPDATE,  OBJ_BROKER);
+        RP( "Broker::getTimestampConfig",
+            "User querying message timestamp setting ",
+            ACT_ACCESS,  OBJ_BROKER);
+        RP( "ExchangeHandlerImpl::query",
+            "AMQP 0-10 protocol received 'query'     ",
+            ACT_ACCESS,  OBJ_EXCHANGE, "name");
+        RP( "ExchangeHandlerImpl::bound",
+            "AMQP 0-10 query binding                 ",
+            ACT_ACCESS,  OBJ_EXCHANGE, "name queuename routingkey");
+        RP( "ExchangeHandlerImpl::declare",
+            "AMQP 0-10 exchange declare              ",
+            ACT_ACCESS,  OBJ_EXCHANGE, "name type alternate durable autodelete");
+        RP( "Authorise::access",
+            "AMQP 1.0 exchange access                ",
+            ACT_ACCESS,  OBJ_EXCHANGE, "name type durable");
+        RP( "Authorise::access",
+            "AMQP 1.0 node resolution                ",
+            ACT_ACCESS,  OBJ_EXCHANGE, "name");
+        RP( "ManagementAgent::handleMethodRequest",
+            "Management method request               ",
+            ACT_ACCESS,  OBJ_METHOD, "name schemapackage schemaclass");
+        RP( "ManagementAgent::authorizeAgentMessage",
+            "Management agent method request         ",
+            ACT_ACCESS,  OBJ_METHOD, "name schemapackage schemaclass");
+        RP( "ManagementAgent::handleGetQuery",
+            "Management agent query                  ",
+            ACT_ACCESS,  OBJ_QUERY, "name schemaclass");
+        RP( "Broker::queryQueue",
+            "QMF 'query queue' method                ",
+            ACT_ACCESS,  OBJ_QUEUE, "name");
+        RP( "QueueHandlerImpl::query",
+            "AMQP 0-10 query                         ",
+            ACT_ACCESS,  OBJ_QUEUE, "name");
+        RP( "QueueHandlerImpl::declare",
+            "AMQP 0-10 queue declare                 ",
+            ACT_ACCESS,  OBJ_QUEUE, "name alternate durable exclusive autodelete policytype maxqueuecount maxqueuesize");
+        RP( "Authorise::access",
+            "AMQP 1.0 queue access                   ",
+            ACT_ACCESS,  OBJ_QUEUE, "name alternate durable exclusive autodelete policytype maxqueuecount maxqueuesize");
+        RP( "Authorise::access",
+            "AMQP 1.0 node resolution                ",
+            ACT_ACCESS,  OBJ_QUEUE, "name");
+        RP( "Broker::bind",
+            "AMQP 0-10 or QMF bind request           ",
+            ACT_BIND,    OBJ_EXCHANGE, "name queuename routingkey");
+        RP( "Authorise::outgoing",
+            "AMQP 1.0 new outgoing link from exchange",
+            ACT_BIND,    OBJ_EXCHANGE, "name queuename routingkey");
+        RP( "MessageHandlerImpl::subscribe",
+            "AMQP 0-10 subscribe request             ",
+            ACT_CONSUME, OBJ_QUEUE, "name");
+        RP( "Authorise::outgoing",
+            "AMQP 1.0 new outgoing link from queue   ",
+            ACT_CONSUME, OBJ_QUEUE, "name");
+        RP( "ConnectionHandler",
+            "TCP/IP connection creation              ",
+            ACT_CREATE,  OBJ_CONNECTION, "host");
+        RP( "Broker::createExchange",
+            "Create exchange                         ",
+            ACT_CREATE,  OBJ_EXCHANGE, "name type alternate durable autodelete");
+        RP( "ConnectionHandler::Handler::open",
+            "Interbroker link creation               ",
+            ACT_CREATE,  OBJ_LINK);
+        RP( "Authorise::interlink",
+            "Interbroker link creation               ",
+            ACT_CREATE,  OBJ_LINK);
+        RP( "Broker::createQueue",
+            "Create queue                            ",
+            ACT_CREATE,  OBJ_QUEUE, "name alternate durable exclusive autodelete policytype paging maxpages maxpagefactor maxqueuecount maxqueuesize maxfilecount maxfilesize");
+        RP( "Broker::deleteExchange",
+            "Delete exchange                         ",
+            ACT_DELETE,  OBJ_EXCHANGE, "name type alternate durable");
+        RP( "Broker::deleteQueue",
+            "Delete queue                            ",
+            ACT_DELETE,  OBJ_QUEUE, "name alternate durable exclusive autodelete policytype");
+        RP( "Broker::queueMoveMessages",
+            "Management 'move queue' request         ",
+            ACT_MOVE,    OBJ_QUEUE, "name queuename");
+        RP( "SemanticState::route",
+            "AMQP 0-10 received message processing   ",
+            ACT_PUBLISH, OBJ_EXCHANGE, "name routingkey");
+        RP( "Authorise::incoming",
+            "AMQP 1.0 establish sender link to queue ",
+            ACT_PUBLISH, OBJ_EXCHANGE, "routingkey");
+        RP( "Authorise::route",
+            "AMQP 1.0 received message processing    ",
+            ACT_PUBLISH, OBJ_EXCHANGE, "name routingkey");
+        RP( "Queue::ManagementMethod",
+            "Management 'purge queue' request        ",
+            ACT_PURGE,   OBJ_QUEUE, "name");
+        RP( "QueueHandlerImpl::purge",
+            "Management 'purge queue' request        ",
+            ACT_PURGE,   OBJ_QUEUE, "name");
+        RP( "Broker::queueRedirect",
+            "Management 'redirect queue' request     ",
+            ACT_REDIRECT,OBJ_QUEUE, "name queuename");
+        RP( "Queue::ManagementMethod",
+            "Management 'reroute queue' request      ",
+            ACT_REROUTE, OBJ_QUEUE, "name exchangename");
+        RP( "Broker::unbind",
+            "Management 'unbind exchange' request    ",
+            ACT_UNBIND,  OBJ_EXCHANGE, "name queuename routingkey");
+        RP( "Broker::setTimestampConfig",
+            "User modifying message timestamp setting",
+            ACT_UPDATE,  OBJ_BROKER);
     }
 
     AclValidator::~AclValidator(){
@@ -189,10 +261,10 @@ namespace acl {
                         std::for_each(d->actionList[cnt][cnt1]->begin(),
                                       d->actionList[cnt][cnt1]->end(),
                                       boost::bind(&AclValidator::validateRuleSet, this, _1));
-                    }//if
-                }//for
-            }//if
-        }//for
+                    }
+                }
+            }
+        }
     }
 
     void AclValidator::validateRuleSet(std::pair<const std::string, qpid::acl::AclData::ruleSet>& rules){
@@ -225,23 +297,155 @@ namespace acl {
     }
 
     /**
+     * validateAllowedProperties
+     * verify that at least one lookup definition can satisfy this
+     * action/object/props tuple.
+     * Return false and conditionally emit a warning log entry if the
+     * incoming definition can not be matched.
+     */
+    bool AclValidator::validateAllowedProperties(qpid::acl::Action action,
+                                                 qpid::acl::ObjectType object,
+                                                 const AclData::specPropertyMap& props,
+                                                 bool emitLog) const {
+        // No rules defined means no match
+        if (!allowedSpecProperties[action][object].get()) {
+            if (emitLog) {
+                QPID_LOG(warning, "ACL rule ignored: Broker never checks for rules with action: '"
+                    << AclHelper::getActionStr(action) << "' and object: '"
+                    << AclHelper::getObjectTypeStr(object) << "'");
+            }
+            return false;
+        }
+        // two empty property sets is a match
+        if (allowedSpecProperties[action][object]->size() == 0) {
+            if ((props.size() == 0) ||
+                (props.size() == 1 && props.find(acl::SPECPROP_NAME) != props.end())) {
+                return true;
+            }
+        }
+        // Scan vector of rules looking for one that matches all properties
+        bool validRuleFound = false;
+        for (std::vector<AclData::Rule>::const_iterator
+            ruleItr  = allowedSpecProperties[action][object]->begin();
+            ruleItr != allowedSpecProperties[action][object]->end() && !validRuleFound;
+            ruleItr++) {
+            // Scan one rule
+            validRuleFound = true;
+            for(AclData::specPropertyMapItr itr = props.begin();
+                itr != props.end();
+                itr++) {
+                if ((*itr).first != acl::SPECPROP_NAME &&
+                    ruleItr->props.find((*itr).first) ==
+                    ruleItr->props.end()) {
+                    // Test property not found in this rule
+                    validRuleFound = false;
+                    break;
+                }
+            }
+        }
+        if (!validRuleFound) {
+            if (emitLog) {
+                QPID_LOG(warning, "ACL rule ignored: Broker checks for rules with action: '"
+                    << AclHelper::getActionStr(action) << "' and object: '"
+                    << AclHelper::getObjectTypeStr(object)
+                    << "' but will never match with property set: "
+                    << AclHelper::propertyMapToString(&props));
+            }
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * Return a list of indexes of definitions that this lookup might match
+     */
+    void AclValidator::findPossibleLookupMatch(qpid::acl::Action action,
+                                               qpid::acl::ObjectType object,
+                                               const AclData::specPropertyMap& props,
+                                               std::vector<int>& result) const {
+        if (!allowedSpecProperties[action][object].get()) {
+            return;
+        } else {
+            // Scan vector of rules returning the indexes of all that match
+            bool validRuleFound;
+            for (std::vector<AclData::Rule>::const_iterator
+                ruleItr  = allowedSpecProperties[action][object]->begin();
+                ruleItr != allowedSpecProperties[action][object]->end();
+                ruleItr++) {
+                // Scan one rule
+                validRuleFound = true;
+                for(AclData::specPropertyMapItr
+                    itr = props.begin(); itr != props.end(); itr++) {
+                    if ((*itr).first != acl::SPECPROP_NAME &&
+                        ruleItr->props.find((*itr).first) ==
+                        ruleItr->props.end()) {
+                        // Test property not found in this rule
+                        validRuleFound = false;
+                        break;
+                    }
+                }
+                if (validRuleFound) {
+                    result.push_back(ruleItr->rawRuleNum);
+                }
+            }
+        }
+        return;
+    }
+
+    /**
+     * Emit trace log of original property definitions
+     */
+    void AclValidator::tracePropertyDefs() {
+        QPID_LOG(trace, "ACL: Definitions of action, object, (allowed properties) lookups");
+        for (int iA=0; iA<acl::ACTIONSIZE; iA++) {
+            for (int iO=0; iO<acl::OBJECTSIZE; iO++) {
+                if (allowedSpecProperties[iA][iO].get()) {
+                    for (std::vector<AclData::Rule>::const_iterator
+                        ruleItr  = allowedSpecProperties[iA][iO]->begin();
+                        ruleItr != allowedSpecProperties[iA][iO]->end();
+                        ruleItr++) {
+                        std::string pstr;
+                        for (AclData::specPropertyMapItr pMItr  = ruleItr->props.begin();
+                            pMItr != ruleItr->props.end();
+                            pMItr++) {
+                            pstr += AclHelper::getPropertyStr((SpecProperty) pMItr-> first);
+                            pstr += ",";
+                        }
+                        QPID_LOG(trace, "ACL: Lookup "
+                            << std::setfill(' ') << std::setw(2)
+                            << ruleItr->rawRuleNum << ": "
+                            << ruleItr->lookupHelp << " "
+                            << std::setfill(' ') << std::setw(acl::ACTION_STR_WIDTH +1) << std::left
+                            << AclHelper::getActionStr(acl::Action(iA))
+                            << std::setfill(' ') << std::setw(acl::OBJECTTYPE_STR_WIDTH) << std::left
+                            << AclHelper::getObjectTypeStr(acl::ObjectType(iO))
+                            << " (" << pstr.substr(0, pstr.length()-1) << ")");
+                    }
+                }
+            }
+        }
+    }
+
+    /**
      * Construct a record of all the calls that the broker will
      * make to acl::authorize and the properties for each call.
      * From that create the list of all the spec properties that
      * users are then allowed to specify in acl rule files.
      */
     void AclValidator::registerProperties(
-        const std::string& /* source */,
+        const std::string& source,
+        const std::string& description,
         Action action,
         ObjectType object,
         const std::string& properties) {
         if (!allowedProperties[action][object].get()) {
             boost::shared_ptr<std::set<Property> > t1(new std::set<Property>());
             allowedProperties[action][object] = t1;
-            boost::shared_ptr<std::set<SpecProperty> > t2(new std::set<SpecProperty>());
+            boost::shared_ptr<std::vector<AclData::Rule> > t2(new std::vector<AclData::Rule>());
             allowedSpecProperties[action][object] = t2;
         }
         std::vector<std::string> props = split(properties, " ");
+        AclData::specPropertyMap spm;
         for (size_t i=0; i<props.size(); i++) {
             Property prop = AclHelper::getProperty(props[i]);
             allowedProperties[action][object]->insert(prop);
@@ -250,35 +454,39 @@ namespace acl {
             switch (prop) {
                 // Cases where broker supplies a property but Acl has upper/lower limit for it
                 case PROP_MAXPAGES:
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXPAGESLOWERLIMIT);
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXPAGESUPPERLIMIT);
+                    spm[SPECPROP_MAXPAGESLOWERLIMIT]="";
+                    spm[SPECPROP_MAXPAGESUPPERLIMIT]="";
                     break;
                 case PROP_MAXPAGEFACTOR:
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXPAGEFACTORLOWERLIMIT);
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXPAGEFACTORUPPERLIMIT);
+                    spm[SPECPROP_MAXPAGEFACTORLOWERLIMIT]="";
+                    spm[SPECPROP_MAXPAGEFACTORUPPERLIMIT]="";
                     break;
                 case PROP_MAXQUEUESIZE:
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXQUEUESIZELOWERLIMIT);
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXQUEUESIZEUPPERLIMIT);
+                    spm[SPECPROP_MAXQUEUESIZELOWERLIMIT]="";
+                    spm[SPECPROP_MAXQUEUESIZEUPPERLIMIT]="";
                     break;
                 case PROP_MAXQUEUECOUNT:
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXQUEUECOUNTLOWERLIMIT);
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXQUEUECOUNTUPPERLIMIT);
+                    spm[SPECPROP_MAXQUEUECOUNTLOWERLIMIT]="";
+                    spm[SPECPROP_MAXQUEUECOUNTUPPERLIMIT]="";
                     break;
                 case PROP_MAXFILESIZE:
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXFILESIZELOWERLIMIT);
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXFILESIZEUPPERLIMIT);
+                    spm[SPECPROP_MAXFILESIZELOWERLIMIT]="";
+                    spm[SPECPROP_MAXFILESIZEUPPERLIMIT]="";
                     break;
                 case PROP_MAXFILECOUNT:
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXFILECOUNTLOWERLIMIT);
-                    allowedSpecProperties[action][object]->insert(SPECPROP_MAXFILECOUNTUPPERLIMIT);
+                    spm[SPECPROP_MAXFILECOUNTLOWERLIMIT]="";
+                    spm[SPECPROP_MAXFILECOUNTUPPERLIMIT]="";
                     break;
                 default:
                     // Cases where broker supplies a property and Acl matches it directly
-                    allowedSpecProperties[action][object]->insert( SpecProperty(prop) );
+                    SpecProperty sp = SpecProperty(prop);
+                    spm[ sp ]="";
                     break;
             }
         }
+        AclData::Rule someProps(propertyIndex, acl::ALLOW, spm, source, description);
+        propertyIndex++;
+        allowedSpecProperties[action][object]->push_back(someProps);
     }
 
 }}
diff --git a/qpid/cpp/src/qpid/acl/AclValidator.h b/qpid/cpp/src/qpid/acl/AclValidator.h
index 03a80c5b09..8f555797c2 100644
--- a/qpid/cpp/src/qpid/acl/AclValidator.h
+++ b/qpid/cpp/src/qpid/acl/AclValidator.h
@@ -24,6 +24,7 @@
 #include "qpid/acl/AclData.h"
 #include "qpid/sys/IntegerTypes.h"
 #include <boost/shared_ptr.hpp>
+#include <boost/concept_check.hpp>
 #include <vector>
 #include <sstream>
 
@@ -65,8 +66,8 @@ class AclValidator {
     typedef std::pair<acl::SpecProperty,boost::shared_ptr<PropertyType> > Validator;
     typedef std::map<acl::SpecProperty,boost::shared_ptr<PropertyType> > ValidatorMap;
     typedef ValidatorMap::iterator ValidatorItr;
-    typedef boost::shared_ptr<std::set<Property> >     AllowedProperties    [ACTIONSIZE][OBJECTSIZE];
-    typedef boost::shared_ptr<std::set<SpecProperty> > AllowedSpecProperties[ACTIONSIZE][OBJECTSIZE];
+    typedef boost::shared_ptr<std::set<Property> >         AllowedProperties    [ACTIONSIZE][OBJECTSIZE];
+    typedef boost::shared_ptr<std::vector<AclData::Rule> > AllowedSpecProperties[ACTIONSIZE][OBJECTSIZE];
 
     ValidatorMap validators;
     AllowedProperties     allowedProperties;
@@ -78,14 +79,26 @@ public:
     void validateRule(qpid::acl::AclData::Rule& rule);
     void validateProperty(std::pair<const qpid::acl::SpecProperty, std::string>& prop);
     void validate(boost::shared_ptr<AclData> d);
+    bool validateAllowedProperties(qpid::acl::Action action,
+                                   qpid::acl::ObjectType object,
+                                   const AclData::specPropertyMap& props,
+                                   bool emitLog) const;
+    void findPossibleLookupMatch(qpid::acl::Action action,
+                                 qpid::acl::ObjectType object,
+                                 const AclData::specPropertyMap& props,
+                                 std::vector<int>& result) const;
+    void tracePropertyDefs();
+
     AclValidator();
     ~AclValidator();
 
 private:
     void registerProperties(const std::string& source,
+                            const std::string& description,
                             Action action,
                             ObjectType object,
                             const std::string& properties = "");
+    int propertyIndex;
 };
 
 }} // namespace qpid::acl
diff --git a/qpid/cpp/src/qpid/broker/Broker.cpp b/qpid/cpp/src/qpid/broker/Broker.cpp
index b981a6d0fe..3afaf43b81 100644
--- a/qpid/cpp/src/qpid/broker/Broker.cpp
+++ b/qpid/cpp/src/qpid/broker/Broker.cpp
@@ -607,7 +607,7 @@ Manageable::status_t Broker::ManagementMethod (uint32_t methodId,
         _qmf::ArgsBrokerQueueMoveMessages& moveArgs=
             dynamic_cast<_qmf::ArgsBrokerQueueMoveMessages&>(args);
         QPID_LOG (debug, "Broker::queueMoveMessages()");
-        if (queueMoveMessages(moveArgs.i_srcQueue, moveArgs.i_destQueue, moveArgs.i_qty, 
+        if (queueMoveMessages(moveArgs.i_srcQueue, moveArgs.i_destQueue, moveArgs.i_qty,
                               moveArgs.i_filter, getCurrentPublisher()) >=0)
             status = Manageable::STATUS_OK;
         else
@@ -1245,7 +1245,7 @@ Manageable::status_t Broker::queueRedirect(const std::string& srcQueue,
             if (!acl->authorise((context)?context->getUserId():"", acl::ACT_REDIRECT, acl::OBJ_QUEUE, srcQ->getName(), &params))
                 throw framing::UnauthorizedAccessException(QPID_MSG("ACL denied redirect request from " << ((context)?context->getUserId():"(uknown)")));
         }
-                                  
+
         queueRedirectDestroy(srcQ, tgtQ, true);
 
         return Manageable::STATUS_OK;
diff --git a/qpid/cpp/src/tests/Acl.cpp b/qpid/cpp/src/tests/Acl.cpp
index 75a52c8ca1..9c3de0de62 100644
--- a/qpid/cpp/src/tests/Acl.cpp
+++ b/qpid/cpp/src/tests/Acl.cpp
@@ -45,6 +45,13 @@ QPID_AUTO_TEST_CASE(TestLexerObjectEnums) {
     OBJ_ENUMS(OBJ_METHOD,     "method");
     OBJ_ENUMS(OBJ_QUERY,      "query");
     OBJ_ENUMS(OBJ_CONNECTION, "connection");
+    int maxLen = 0;
+    for (int i=0; i<acl::OBJECTSIZE; i++) {
+        int thisLen = AclHelper::getObjectTypeStr( ObjectType(i) ).length();
+        if (thisLen > maxLen)
+            maxLen = thisLen;
+    }
+    BOOST_CHECK_EQUAL(maxLen, acl::OBJECTTYPE_STR_WIDTH);
 }
 
 #define ACT_ENUMS(e, s) \
@@ -65,6 +72,13 @@ QPID_AUTO_TEST_CASE(TestLexerActionEnums) {
     ACT_ENUMS(ACT_MOVE,     "move");
     ACT_ENUMS(ACT_REDIRECT, "redirect");
     ACT_ENUMS(ACT_REROUTE,  "reroute");
+    int maxLen = 0;
+    for (int i=0; i<acl::ACTIONSIZE; i++) {
+        int thisLen = AclHelper::getActionStr( Action(i) ).length();
+        if (thisLen > maxLen)
+            maxLen = thisLen;
+    }
+    BOOST_CHECK_EQUAL(maxLen, acl::ACTION_STR_WIDTH);
 }
 
 #define PROP_ENUMS(e, s) \
diff --git a/qpid/cpp/src/tests/acl.py b/qpid/cpp/src/tests/acl.py
index 5f5d1e01fe..75aa39295a 100755
--- a/qpid/cpp/src/tests/acl.py
+++ b/qpid/cpp/src/tests/acl.py
@@ -46,10 +46,10 @@ class ACLTests(TestBase010):
         parms = {'username':user, 'password':passwd, 'sasl_mechanisms':'PLAIN'}
         brokerurl="%s:%s" %(self.broker.host, self.broker.port)
         connection = qpid.messaging.Connection(brokerurl, **parms)
-        connection.open()       
+        connection.open()
         return connection
 
-    # For connection limit tests this function 
+    # For connection limit tests this function
     #  throws if the connection won't start
     #  returns a connection that the caller can close if he likes.
     def get_connection(self, user, passwd):
@@ -2115,6 +2115,7 @@ class ACLTests(TestBase010):
         aclf.write('acl allow all access method\n')
         # this should let bob access the timestamp configuration
         aclf.write('acl allow bob@QPID access broker\n')
+        aclf.write('acl allow bob@QPID update broker\n')
         aclf.write('acl allow admin@QPID all all\n')
         aclf.write('acl deny all all')
         aclf.close()
@@ -2239,7 +2240,7 @@ class ACLTests(TestBase010):
             self.LookupPublish(u, "company.topic", "private.audit.This", "allow-log")
 
         for u in uInTest:
-            for a in action_all:
+            for a in ['bind', 'unbind', 'access', 'publish']:
                 self.Lookup(u, a, "exchange", "company.topic", {"routingkey":"private.audit.This"}, "allow-log")
 
         for u in uOutTest:
@@ -3709,6 +3710,179 @@ class ACLTests(TestBase010):
             self.assertEqual(403,e.args[0].error_code)
             self.fail("ACL should allow exchange delete request for edae3h");
 
+    #=====================================
+    # 'create connection' tests
+    #=====================================
+#    def test_connect_mode_file_rejects_two_defaults(self):
+#        """
+#        Should reject a file with two connect mode statements
+#        """
+#        aclf = self.get_acl_file()
+#        aclf.write('acl allow all create connection host=all\n')
+#        aclf.write('acl allow all create connection host=all\n')
+#        aclf.close()
+#
+#        result = self.reload_acl()
+#        if (result):
+#            pass
+#        else:
+#            self.fail(result)
+
+    def test_connect_mode_accepts_host_spec_formats(self):
+        """
+        Should accept host specs of various forms
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl allow bob@QPID create connection host=all\n')
+        aclf.write('acl allow bob@QPID create connection host=1.1.1.1\n')
+        aclf.write('acl allow bob@QPID create connection host=1.1.1.1,2.2.2.2\n')
+        aclf.write('acl allow bob@QPID create connection host=localhost\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+    def test_connect_mode_allow_all_mode(self):
+        """
+        Should allow one 'all', 'all'
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl allow all create connection host=all\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+        session = self.get_session('bob','bob')
+
+
+    def test_connect_mode_allow_all_localhost(self):
+        """
+        Should allow 'all' 'localhost'
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl allow all create connection host=localhost\n')
+        aclf.write('acl deny  all create connection host=all\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+        session = self.get_session('bob','bob')
+
+
+    def test_connect_mode_global_deny(self):
+        """
+        Should allow 'all' 'localhost'
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl allow all create connection host=localhost\n')
+        aclf.write('acl deny  all create connection host=all\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+        session = self.get_session('bob','bob')
+
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"127.0.0.1"}, "allow")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"127.0.0.2"}, "deny")
+
+
+    def test_connect_mode_global_range(self):
+        """
+        Should allow 'all' 'localhost'
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl allow all create connection host=10.0.0.0,10.255.255.255\n')
+        aclf.write('acl allow all create connection host=localhost\n')
+        aclf.write('acl deny  all create connection host=all\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+        session = self.get_session('bob','bob')
+
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"0.0.0.0"},        "deny")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"9.255.255.255"},  "deny")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.0.0"},       "allow")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.255.255.255"}, "allow")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"11.0.0.0"},       "deny")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"255.255.255.255"},"deny")
+
+
+    def test_connect_mode_nested_ranges(self):
+        """
+        Tests nested ranges for single user
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl deny-log  bob@QPID create connection host=10.0.1.0,10.0.1.255\n')
+        aclf.write('acl allow-log bob@QPID create connection host=10.0.0.0,10.255.255.255\n')
+        aclf.write('acl deny-log  bob@QPID create connection host=all\n')
+        aclf.write('acl allow all create connection host=localhost\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+        session = self.get_session('bob','bob')
+
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"0.0.0.0"},        "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"9.255.255.255"},  "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.0.0"},       "allow-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.0.255"},     "allow-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.1.0"},       "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.1.255"},     "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.2.0"},       "allow-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.255.255.255"}, "allow-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"11.0.0.0"},       "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"255.255.255.255"},"deny-log")
+
+
+    def test_connect_mode_user_ranges(self):
+        """
+        Two user ranges should not interfere with each other
+        """
+        aclf = self.get_acl_file()
+        aclf.write('acl allow-log bob@QPID create connection host=10.0.0.0,10.255.255.255\n')
+        aclf.write('acl deny-log  bob@QPID create connection host=all\n')
+        aclf.write('acl allow-log cat@QPID create connection host=192.168.0.0,192.168.255.255\n')
+        aclf.write('acl deny-log  cat@QPID create connection host=all\n')
+        aclf.write('acl allow all create connection host=localhost\n')
+        aclf.write('acl allow all all\n')
+        aclf.close()
+
+        result = self.reload_acl()
+        if (result):
+            self.fail(result)
+
+        session = self.get_session('bob','bob')
+
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"0.0.0.0"},        "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"9.255.255.255"},  "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.0.0.0"},       "allow-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"10.255.255.255"}, "allow-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"11.0.0.0"},       "deny-log")
+        self.Lookup("bob@QPID", "create", "connection", "", {"host":"255.255.255.255"},"deny-log")
+        self.Lookup("cat@QPID", "create", "connection", "", {"host":"0.0.0.0"},        "deny-log")
+        self.Lookup("cat@QPID", "create", "connection", "", {"host":"192.167.255.255"},"deny-log")
+        self.Lookup("cat@QPID", "create", "connection", "", {"host":"192.168.0.0"},    "allow-log")
+        self.Lookup("cat@QPID", "create", "connection", "", {"host":"192.168.255.255"},"allow-log")
+        self.Lookup("cat@QPID", "create", "connection", "", {"host":"192.169.0.0"},    "deny-log")
+        self.Lookup("cat@QPID", "create", "connection", "", {"host":"255.255.255.255"},"deny-log")
 
 
 class BrokerAdmin:
diff --git a/qpid/doc/book/src/cpp-broker/Security.xml b/qpid/doc/book/src/cpp-broker/Security.xml
index 00b325fb24..8f42e6abdf 100644
--- a/qpid/doc/book/src/cpp-broker/Security.xml
+++ b/qpid/doc/book/src/cpp-broker/Security.xml
@@ -312,45 +312,45 @@ com.sun.security.jgss.initiate {
 
 	</section>
 
-	 <!--          ###################################################          --> <section id="sect-Messaging_User_Guide-Security-Authorization">
-		<title>Authorization</title>
-		 <para>
-		   In Qpid, Authorization specifies which actions can be performed by each authenticated user using an Access Control List (ACL).
-		 </para>
-		 <para>
-		   Use the <command>--acl-file</command> command to load the access control list. The filename should have a <filename>.acl</filename> extension:
-		</para>
+         <!--          ###################################################          --> <section id="sect-Messaging_User_Guide-Security-Authorization">
+                <title>Authorization</title>
+                 <para>
+                   In Qpid, Authorization specifies which actions can be performed by each authenticated user using an Access Control List (ACL).
+                 </para>
+                 <para>
+                   Use the <command>--acl-file</command> command to load the access control list. The filename should have a <filename>.acl</filename> extension:
+                </para>
 
 <screen>
     $ qpidd --acl-file <replaceable>./aclfilename.acl</replaceable></screen>
-		 <para>
-			Each line in an ACL file grants or denies specific rights to a user. If the last line in an ACL file is <literal>acl deny all all</literal>, the ACL uses <firstterm>deny mode</firstterm>, and only those rights that are explicitly allowed are granted:
-		</para>
+                 <para>
+                        Each line in an ACL file grants or denies specific rights to a user. If the last line in an ACL file is <literal>acl deny all all</literal>, the ACL uses <firstterm>deny mode</firstterm>, and only those rights that are explicitly allowed are granted:
+                </para>
 
 <programlisting>
     acl allow rajith@QPID all all
     acl deny all all
 </programlisting>
-		 <para>
-			On this server, <literal>rajith@QPID</literal> can perform any action, but nobody else can. Deny mode is the default, so the previous example is equivalent to the following ACL file:
-		</para>
+                 <para>
+                        On this server, <literal>rajith@QPID</literal> can perform any action, but nobody else can. Deny mode is the default, so the previous example is equivalent to the following ACL file:
+                </para>
 
 <programlisting>
     acl allow rajith@QPID all all
 </programlisting>
-		 <para>
-		   Alternatively the ACL file may use <firstterm>allow mode</firstterm> by placing:
-		</para>
+                 <para>
+                   Alternatively the ACL file may use <firstterm>allow mode</firstterm> by placing:
+                </para>
 <programlisting>
     acl allow all all
 </programlisting>
-		 <para>
-			as the final line in the ACL file. In <emphasis>allow mode</emphasis> all actions by all users are allowed unless otherwise denied by specific ACL rules.
-			The ACL rule which selects <emphasis>deny mode</emphasis> or <emphasis>allow mode</emphasis> must be the last line in the ACL rule file.
-		</para>
-		 <para>
-			ACL syntax allows fine-grained access rights for specific actions:
-		</para>
+                 <para>
+                        as the final line in the ACL file. In <emphasis>allow mode</emphasis> all actions by all users are allowed unless otherwise denied by specific ACL rules.
+                        The ACL rule which selects <emphasis>deny mode</emphasis> or <emphasis>allow mode</emphasis> must be the last line in the ACL rule file.
+                </para>
+                 <para>
+                        ACL syntax allows fine-grained access rights for specific actions:
+                </para>
 
 <programlisting>
     acl allow carlt@QPID create exchange name=carl.*
@@ -359,18 +359,18 @@ com.sun.security.jgss.initiate {
     acl allow all bind exchange
     acl deny all all
 </programlisting>
-		 <para>
-			An ACL file can define user groups, and assign permissions to them:
-		</para>
+                 <para>
+                        An ACL file can define user groups, and assign permissions to them:
+                </para>
 
 <programlisting>
     group admin ted@QPID martin@QPID
     acl allow admin create all
     acl deny all all
 </programlisting>
-		 <para>
-			An ACL file can define per user connection and queue quotas:
-		</para>
+                 <para>
+                        An ACL file can define per user connection and queue quotas:
+                </para>
 
 <programlisting>
     group admin ted@QPID martin@QPID
@@ -383,28 +383,28 @@ com.sun.security.jgss.initiate {
     quota queues       1 test@qpid
 </programlisting>
 
-		 <para>
-			Performance Note: Most ACL queries are performed infrequently. The overhead associated with
-			ACL passing an allow or deny decision on the creation of a queue is negligible
-			compared to actually creating and using the queue. One notable exception is the <command>publish exchange</command>
-			query. ACL files with no <emphasis>publish exchange</emphasis> rules are noted and the broker short circuits the logic
-			associated with the per-messsage <emphasis>publish exchange</emphasis> ACL query.
-			However, if an ACL file has any <emphasis>publish exchange</emphasis> rules
-			then the broker is required to perform a <emphasis>publish exchange</emphasis> query for each message published.
-			Users with performance critical applications are encouraged to structure exchanges, queues, and bindings so that
-			the <emphasis>publish exchange</emphasis> ACL rules are unnecessary.
-		</para>
-
-		 <!--          ########          --> <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntax">
-			<title>ACL Syntax</title>
-			 <para>
-				ACL rules follow this syntax:
+                 <para>
+                        Performance Note: Most ACL queries are performed infrequently. The overhead associated with
+                        ACL passing an allow or deny decision on the creation of a queue is negligible
+                        compared to actually creating and using the queue. One notable exception is the <command>publish exchange</command>
+                        query. ACL files with no <emphasis>publish exchange</emphasis> rules are noted and the broker short circuits the logic
+                        associated with the per-messsage <emphasis>publish exchange</emphasis> ACL query.
+                        However, if an ACL file has any <emphasis>publish exchange</emphasis> rules
+                        then the broker is required to perform a <emphasis>publish exchange</emphasis> query for each message published.
+                        Users with performance critical applications are encouraged to structure exchanges, queues, and bindings so that
+                        the <emphasis>publish exchange</emphasis> ACL rules are unnecessary.
+                </para>
+
+                 <!--          ########          --> <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntax">
+                        <title>ACL Syntax</title>
+                         <para>
+                                ACL rules follow this syntax:
 <programlisting><![CDATA[
 aclline = ( comment | aclspec | groupspec | quotaspec )
 
 comment = "#" [ STRING ]
 
-aclspec = "acl" permission ( groupname | name | "all" ) 
+aclspec = "acl" permission ( groupname | name | "all" )
           ( action | "all" ) [ ( object | "all ) [ ( property "=" STRING )* ] ]
 
 groupspec = "group" groupname ( name )* [ "\" ]
@@ -438,152 +438,111 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
             "pagefactorlowerlimit"    | "pagefactorupperlimit"
 ]]></programlisting>
 
-				 ACL rules can also include a single object name (or the keyword <parameter>all</parameter>) and one or more property name value pairs in the form <command>property=value</command>
-			</para>
-			 <para>
-				The following tables show the possible values for <command>permission</command>, <command>action</command>, <command>object</command>, and <command>property</command> in an ACL rules file.
-			 </para>
-			 <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rules_permission">
-			   <title>ACL Rules: permission</title>
-			   <tgroup cols="2">
-			     <tbody>
-			       <row>
-				 <entry>
-				   <command>allow</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Allow the action <!--          ### rule => the action          -->
-				   </para>
-				 </entry>
-				 </row>
-				 <row>
-				   <entry>
-				     <command>allow-log</command>
-				   </entry>
-				   <entry>
-				     <para>
-				       Allow the action and log the action in the event log
-				     </para>
-				   </entry>
-				 </row>
-				 <row>
-				   <entry>
-				     <command>deny</command>
-				   </entry>
-				   <entry>
-				     <para>
-				       Deny the action
-				     </para>
-				   </entry>
-				 </row>
-				 <row>
-				   <entry>
-				     <command>deny-log</command>
-				   </entry>
-				   <entry>
-				     <para>
-				       Deny the action and log the action in the event log
-				     </para>
-				   </entry>
-				 </row>
-			     </tbody>
-			   </tgroup>
-			 </table>
-			 <!--          Actions          --> <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesaction">
-			   <title>ACL Rules: action</title>
-			   <tgroup cols="2">
-			     <tbody>
-			       <row>
-				 <entry>
-				   <command>consume</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Using an object
-				   </para>
-				   
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>publish</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Authenticating an incoming message.
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>create</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Creating an object.
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>access</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Accessing or reading an object
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>bind</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Associating a queue to an exchange with a routing key.
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>unbind</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Disassociating a queue from an exchange with a routing key.
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>delete</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Deleting an object.
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>purge</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Purging a queue.
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>update</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Changing a broker configuration setting.
-				   </para>
-				 </entry>
+                                 ACL rules can also include a single object name (or the keyword <parameter>all</parameter>) and one or more property name value pairs in the form <command>property=value</command>
+                        </para>
+                         <para>
+                                The following tables show the possible values for <command>permission</command>, <command>action</command>, <command>object</command>, and <command>property</command> in an ACL rules file.
+                         </para>
+                         <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rules_permission">
+                           <title>ACL Rules: permission</title>
+                           <tgroup cols="2">
+                             <tbody>
+                               <row>
+                                 <entry>
+                                   <command>allow</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Allow the action <!--          ### rule => the action          -->
+                                   </para>
+                                 </entry>
+                                 </row>
+                                 <row>
+                                   <entry>
+                                     <command>allow-log</command>
+                                   </entry>
+                                   <entry>
+                                     <para>
+                                       Allow the action and log the action in the event log
+                                     </para>
+                                   </entry>
+                                 </row>
+                                 <row>
+                                   <entry>
+                                     <command>deny</command>
+                                   </entry>
+                                   <entry>
+                                     <para>
+                                       Deny the action
+                                     </para>
+                                   </entry>
+                                 </row>
+                                 <row>
+                                   <entry>
+                                     <command>deny-log</command>
+                                   </entry>
+                                   <entry>
+                                     <para>
+                                       Deny the action and log the action in the event log
+                                     </para>
+                                   </entry>
+                                 </row>
+                             </tbody>
+                           </tgroup>
+                         </table>
+                         <!--          Actions          --> <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesaction">
+                           <title>ACL Rules: action</title>
+                           <tgroup cols="2">
+                             <tbody>
+                               <row>
+                                 <entry>
+                                   <command>access</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Accessing or reading an object
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>bind</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Associating a queue to an exchange with a routing key.
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>consume</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Using an object
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>create</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Creating an object.
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>delete</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Deleting an object.
+                                   </para>
+                                 </entry>
                                </row>
                                <row>
                                  <entry>
@@ -597,6 +556,26 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
                                </row>
                                <row>
                                  <entry>
+                                   <command>publish</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Authenticating an incoming message.
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>purge</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Purging a queue.
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
                                    <command>redirect</command>
                                  </entry>
                                  <entry>
@@ -614,68 +593,40 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
                                      Rerouting messages from a queue to an exchange
                                    </para>
                                  </entry>
-			       </row>
-			     </tbody>
-			   </tgroup>
-			 </table>
-			 <!--          object types          --> <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesobject">
-			   <title>ACL Rules:object</title>
-			   <tgroup cols="2">
-			     <tbody>
-			       <row>
-				 <entry>
-				   <command>queue</command>
-				 </entry>
-				 <entry>
-				   <para>
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>exchange</command>
-				 </entry>
-				 <entry>
-				   <para>
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>broker</command>
-				 </entry>
-				 <entry>
-				   <para>
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>link</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     A federation or inter-broker link
-				   </para>
-				 </entry>
-			       </row>
-			       <row>
-				 <entry>
-				   <command>method</command>
-				 </entry>
-				 <entry>
-				   <para>
-				     Management method
-				   </para>
-				 </entry>
-			       </row>
+                               </row>
                                <row>
                                  <entry>
-                                   <command>query</command>
+                                   <command>unbind</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Disassociating a queue from an exchange with a routing key.
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>update</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Changing a broker configuration setting.
+                                   </para>
+                                 </entry>
+                               </row>
+                             </tbody>
+                           </tgroup>
+                         </table>
+                         <!--          object types          --> <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesobject">
+                           <title>ACL Rules:object</title>
+                           <tgroup cols="2">
+                             <tbody>
+                               <row>
+                                 <entry>
+                                   <command>broker</command>
                                  </entry>
                                  <entry>
                                    <para>
-                                     Management query of an object or class
                                    </para>
                                  </entry>
                                </row>
@@ -689,99 +640,125 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
                                    </para>
                                  </entry>
                                </row>
-			     </tbody>
-			   </tgroup>
-			 </table>
-			 <!--
+                               <row>
+                                 <entry>
+                                   <command>exchange</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>link</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     A federation or inter-broker link
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>method</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Management method
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>query</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                     Management query of an object or class
+                                   </para>
+                                 </entry>
+                               </row>
+                               <row>
+                                 <entry>
+                                   <command>queue</command>
+                                 </entry>
+                                 <entry>
+                                   <para>
+                                   </para>
+                                 </entry>
+                               </row>
+                             </tbody>
+                           </tgroup>
+                         </table>
+                         <!--
         <para>
-          Wild cards can be used on properties that are a string. The following rule properties are supported:          --> <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty">
-			   <title>ACL Rules: property</title>
-			   <tgroup cols="4">
-			     <thead>
-			       <row>
-				 <entry>Property</entry>
-				 <entry>Type</entry>
-				 <entry>Description</entry>
-				 <entry>Usage</entry>
-			       </row>
-			     </thead>
-			     <tbody>
-			       <row>
-				 <entry> <command>name</command> </entry>
-				 <entry>String</entry>
-				 <entry>Rule refers to objects with this name</entry>
-				 <entry></entry>
-			       </row>
-			       <row>
-				 <entry> <command>durable</command> </entry>
-				 <entry>Boolean</entry>
-				 <entry>Rule applies to durable objects</entry>
-				 <entry>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE, DELETE QUEUE, DELETE EXCHANGE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>routingkey</command> </entry>
-				 <entry>String</entry>
-				 <entry>Specifies routing key</entry>
-				 <entry>BIND EXCHANGE, UNBIND EXCHANGE, ACCESS EXCHANGE, PUBLISH EXCHANGE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>autodelete</command> </entry>
-				 <entry>Boolean</entry>
-				 <entry>Indicates whether or not the object gets deleted when the connection is closed</entry>
-				 <entry>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE, DELETE QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>exclusive</command> </entry>
-				 <entry>Boolean</entry>
-				 <entry>Indicates the presence of an <parameter>exclusive</parameter> flag</entry>
-				 <entry>CREATE QUEUE, ACCESS QUEUE, DELETE QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>type</command> </entry>
-				 <entry>String</entry>
-				 <entry>Type of exchange, such as topic, fanout, or xml</entry>
-				 <entry>CREATE EXCHANGE, ACCESS EXCHANGE, DELETE EXCHANGE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>alternate</command> </entry>
-				 <entry>String</entry>
-				 <entry>Name of the alternate exchange</entry>
-				 <entry>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE, DELETE QUEUE, DELETE EXCHANGE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>queuename</command> </entry>
-				 <entry>String</entry>
-				 <entry>Name of the queue</entry>
-				 <entry>ACCESS EXCHANGE, BIND EXCHANGE, MOVE QUEUE, UNBIND EXCHANGE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>exchangename</command> </entry>
-				 <entry>String</entry>
-				 <entry>Name of the exchange</entry>
-				 <entry>REROUTE QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>schemapackage</command> </entry>
-				 <entry>String</entry>
-				 <entry>QMF schema package name</entry>
-				 <entry>ACCESS METHOD</entry>
-			       </row>
-			       <row>
-				 <entry> <command>schemaclass</command> </entry>
-				 <entry>String</entry>
-				 <entry>QMF schema class name</entry>
-				 <entry>ACCESS METHOD, ACCESS QUERY</entry>
-			       </row>
-			       <row>
-				 <entry> <command>policytype</command> </entry>
-				 <entry>String</entry>
-				 <entry>"ring", "self-destruct", "reject"</entry>
-				 <entry>CREATE QUEUE, ACCESS QUEUE, DELETE QUEUE</entry>
-			       </row>
+          Wild cards can be used on properties that are a string. The following rule properties are supported:          -->
+                         <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty">
+                           <title>ACL Rules: property</title>
+                           <tgroup cols="4">
+                             <thead>
                                <row>
-                                 <entry> <command>paging</command> </entry>
+                                 <entry>Property</entry>
+                                 <entry>Type</entry>
+                                 <entry>Description</entry>
+                                 <entry>Usage</entry>
+                               </row>
+                             </thead>
+                             <tbody>
+                               <row>
+                                 <entry> <command>name</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>Rule refers to objects with this name. When 'name' is blank or absent then the rule
+                                 applies to all objects of the given type.</entry>
+                                 <entry></entry>
+                               </row>
+                               <row>
+                                 <entry> <command>alternate</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>Name of an alternate exchange</entry>
+                                 <entry>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE, DELETE QUEUE, DELETE EXCHANGE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>autodelete</command> </entry>
+                                 <entry>Boolean</entry>
+                                 <entry>Indicates whether or not the object gets deleted when the connection that created it is closed</entry>
+                                 <entry>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE, DELETE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>durable</command> </entry>
                                  <entry>Boolean</entry>
-                                 <entry>Indicates if the queue is paging queue</entry>
+                                 <entry>Rule applies to durable objects</entry>
+                                 <entry>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE, DELETE QUEUE, DELETE EXCHANGE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>exchangename</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>Name of the exchange to which queue's entries are routed</entry>
+                                 <entry>REROUTE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>filemaxcountlowerlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Minimum value for file.max_count (files)</entry>
+                                 <entry>CREATE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>filemaxcountupperlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Maximum value for file.max_count (files)</entry>
+                                 <entry>CREATE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>filemaxsizelowerlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Minimum value for file.max_size (64kb pages)</entry>
+                                 <entry>CREATE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>filemaxsizeupperlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Maximum value for file.max_size (64kb pages)</entry>
                                  <entry>CREATE QUEUE</entry>
                                </row>
                                <row>
@@ -790,443 +767,481 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
                                  <entry>Target TCP/IP host or host range for create connection rules</entry>
                                  <entry>CREATE CONNECTION</entry>
                                </row>
-			       <row>
-				 <entry> <command>queuemaxsizelowerlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Minimum value for queue.max_size (memory bytes)</entry>
-				 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>queuemaxsizeupperlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Maximum value for queue.max_size (memory bytes)</entry>
-				 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>queuemaxcountlowerlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Minimum value for queue.max_count (messages)</entry>
-				 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>queuemaxcountupperlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Maximum value for queue.max_count (messages)</entry>
-				 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>filemaxsizelowerlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Minimum value for file.max_size (64kb pages)</entry>
-				 <entry>CREATE QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>filemaxsizeupperlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Maximum value for file.max_size (64kb pages)</entry>
-				 <entry>CREATE QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>filemaxcountlowerlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Minimum value for file.max_count (files)</entry>
-				 <entry>CREATE QUEUE</entry>
-			       </row>
-			       <row>
-				 <entry> <command>filemaxcountupperlimit</command> </entry>
-				 <entry>Integer</entry>
-				 <entry>Maximum value for file.max_count (files)</entry>
-				 <entry>CREATE QUEUE</entry>
-			       </row>
                                <row>
-                                 <entry> <command>pageslowerlimit</command> </entry>
+                                 <entry> <command>exclusive</command> </entry>
+                                 <entry>Boolean</entry>
+                                 <entry>Indicates the presence of an <parameter>exclusive</parameter> flag</entry>
+                                 <entry>CREATE QUEUE, ACCESS QUEUE, DELETE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>pagefactorlowerlimit</command> </entry>
                                  <entry>Integer</entry>
-                                 <entry>Minimum value for number of pages in memory of paged queue</entry>
+                                 <entry>Minimum value for size of a page in paged queue</entry>
                                  <entry>CREATE QUEUE</entry>
                                </row>
                                <row>
-                                 <entry> <command>pagesupperlimit</command> </entry>
+                                 <entry> <command>pagefactorupperlimit</command> </entry>
                                  <entry>Integer</entry>
-                                 <entry>Maximum value for number of pages in memory of paged queue</entry>
+                                 <entry>Maximum value for size of a page in paged queue</entry>
                                  <entry>CREATE QUEUE</entry>
                                </row>
                                <row>
-                                 <entry> <command>pagefactorlowerlimit</command> </entry>
+                                 <entry> <command>pageslowerlimit</command> </entry>
                                  <entry>Integer</entry>
-                                 <entry>Minimum value for size of one page in paged queue</entry>
+                                 <entry>Minimum value for number of paged queue pages in memory</entry>
                                  <entry>CREATE QUEUE</entry>
                                </row>
                                <row>
-                                 <entry> <command>pagefactorupperlimit</command> </entry>
+                                 <entry> <command>pagesupperlimit</command> </entry>
                                  <entry>Integer</entry>
-                                 <entry>Maximum value for size of one page in paged queue</entry>
+                                 <entry>Maximum value for number of paged queue pages in memory</entry>
+                                 <entry>CREATE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>paging</command> </entry>
+                                 <entry>Boolean</entry>
+                                 <entry>Indicates if the queue is a paging queue</entry>
                                  <entry>CREATE QUEUE</entry>
                                </row>
-			     </tbody>
-			   </tgroup>
-			 </table>
-
-			 <section id="sect-Messaging_User_Guide-Authorization-ACL_ActionObjectPropertyTuples">
-			   <title>ACL Action-Object-Property Tuples</title>
-			   <para>
-			     Not every ACL action is applicable to every ACL object. Furthermore, not every property may be
-			     specified for every action-object pair.
-			     The following table enumerates which action and object pairs are allowed.
-			     The table also lists which optional ACL properties are allowed to qualify
-			     action-object pairs.
-			   </para>
-			   <para>
-			     The <emphasis>access</emphasis> action is called with different argument
-			     lists for the <emphasis>exchange</emphasis> and <emphasis>queue</emphasis> objects.
-			     A separate column shows the AMQP 0.10 method that the Access ACL rule is satisfying.
-			     Write separate rules with the additional arguments for the <emphasis>declare</emphasis>
-			     and <emphasis>bind</emphasis> methods and include these rules in the ACL file
-			     before the rules for the <emphasis>query</emphasis> method.
-			     <!-- The exact sequence of calling these methods is a product of the client
-				  library. The user might not know anything about a 'declare' or a 'query' or
-				  a passive declaration. -->
-			   </para>
-			   <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties">
-			     <title>ACL Properties Allowed for each Action and Object</title>
-			     <tgroup cols="4">
-			       <thead>
-				 <row>
-				   <entry>Action</entry>
-				   <entry>Object</entry>
-				   <entry>Properties</entry>
-				   <entry>Method</entry>
-				 </row>
-			       </thead>
-			       <tbody>
+                               <row>
+                                 <entry> <command>policytype</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>"ring", "self-destruct", "reject"</entry>
+                                 <entry>CREATE QUEUE, ACCESS QUEUE, DELETE QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>queuename</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>Name of the target queue</entry>
+                                 <entry>ACCESS EXCHANGE, BIND EXCHANGE, MOVE QUEUE, UNBIND EXCHANGE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>queuemaxsizelowerlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Minimum value for queue.max_size (memory bytes)</entry>
+                                 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>queuemaxsizeupperlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Maximum value for queue.max_size (memory bytes)</entry>
+                                 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>queuemaxcountlowerlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Minimum value for queue.max_count (messages)</entry>
+                                 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>queuemaxcountupperlimit</command> </entry>
+                                 <entry>Integer</entry>
+                                 <entry>Maximum value for queue.max_count (messages)</entry>
+                                 <entry>CREATE QUEUE, ACCESS QUEUE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>routingkey</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>Specifies routing key</entry>
+                                 <entry>BIND EXCHANGE, UNBIND EXCHANGE, ACCESS EXCHANGE, PUBLISH EXCHANGE</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>schemaclass</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>QMF schema class name</entry>
+                                 <entry>ACCESS METHOD, ACCESS QUERY</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>schemapackage</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>QMF schema package name</entry>
+                                 <entry>ACCESS METHOD</entry>
+                               </row>
+                               <row>
+                                 <entry> <command>type</command> </entry>
+                                 <entry>String</entry>
+                                 <entry>Type of exchange, such as topic, fanout, or xml</entry>
+                                 <entry>CREATE EXCHANGE, ACCESS EXCHANGE, DELETE EXCHANGE</entry>
+                               </row>
+                             </tbody>
+                           </tgroup>
+                         </table>
+
+                         <section id="sect-Messaging_User_Guide-Authorization-ACL_ActionObjectPropertyTuples">
+                           <title>ACL Action-Object-Property Combinations</title>
+                           <para>
+                             Not every ACL action is applicable to every ACL object. Furthermore, not every property may be
+                             specified for every action-object pair. The following table lists the broker events
+                             that trigger ACL lookups. Then for each event it lists the action, object, and properties
+                             allowed in the lookup.
+                           </para>
+                           <para>
+                             User-specified ACL rules constrain property sets to those that match one or more of
+                             the action and object pairs. For example these rules are allowed:
+                           </para>
+<programlisting>
+    acl allow all access exchange
+    acl allow all access exchange name=abc
+    acl allow all access exchange name=abc durable=true
+</programlisting>
+                           <para>
+                             These rules could possibly match one or more of the broker lookups. However, this rule
+                             is not allowed:
+                           </para>
+<programlisting>
+    acl allow all access exchange queuename=queue1 durable=true
+</programlisting>
+                           <para>
+                             Properties <emphasis>queuename</emphasis> and <emphasis>durable</emphasis>
+                             are not in the list of allowed properties for any 'access exchange' lookup.
+                             This rule would never match a broker lookup query and would never contribute to an
+                             allow or deny decision.
+                           </para>
+                           <para>
+                             For more information about matching ACL rules please refer to
+                             <link linkend="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching">
+                               ACL Rule Matching
+                             </link>
+                           </para>
+
+                           <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties">
+                             <title>Broker Lookup Events With Allowed Action, Object, and Properties</title>
+                             <tgroup cols="4">
+                               <thead>
                                  <row>
+                                   <entry>Lookup Event</entry>
+                                   <entry>Action</entry>
+                                   <entry>Object</entry>
+                                   <entry>Properties</entry>
+                                 </row>
+                               </thead>
+                               <tbody>
+                                 <row>
+                                   <entry>User querying message timestamp setting </entry>
                                    <entry>access</entry>
                                    <entry>broker</entry>
                                    <entry></entry>
-                                   <entry>Broker:: getTimestampConfig</entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 protocol received 'query'     </entry>
                                    <entry>access</entry>
                                    <entry>exchange</entry>
-                                   <entry></entry>
-                                   <entry>ExchangeHandlerImpl:: query</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 query binding                 </entry>
                                    <entry>access</entry>
                                    <entry>exchange</entry>
-                                   <entry></entry>
-                                   <entry>Authorise:: access</entry>
+                                   <entry>name queuename routingkey </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 exchange declare              </entry>
                                    <entry>access</entry>
                                    <entry>exchange</entry>
-                                   <entry>type alternate durable autodelete </entry>
-                                   <entry>ExchangeHandlerImpl:: declare</entry>
+                                   <entry>name type alternate durable autodelete </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 exchange access                </entry>
                                    <entry>access</entry>
                                    <entry>exchange</entry>
-                                   <entry>queuename routingkey </entry>
-                                   <entry>ExchangeHandlerImpl:: bound</entry>
+                                   <entry>name type durable </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 node resolution                </entry>
                                    <entry>access</entry>
                                    <entry>exchange</entry>
-                                   <entry>type durable </entry>
-                                   <entry>Authorise:: access</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>Management method request               </entry>
                                    <entry>access</entry>
                                    <entry>method</entry>
-                                   <entry>schemapackage schemaclass </entry>
-                                   <entry>ManagementAgent:: handleMethodRequest</entry>
+                                   <entry>name schemapackage schemaclass </entry>
                                  </row>
                                  <row>
+                                   <entry>Management agent method request         </entry>
                                    <entry>access</entry>
                                    <entry>method</entry>
-                                   <entry>schemapackage schemaclass </entry>
-                                   <entry>ManagementAgent:: authorizeAgentMessage</entry>
+                                   <entry>name schemapackage schemaclass </entry>
                                  </row>
                                  <row>
+                                   <entry>Management agent query                  </entry>
                                    <entry>access</entry>
                                    <entry>query</entry>
-                                   <entry>schemaclass </entry>
-                                   <entry>ManagementAgent:: handleGetQuery</entry>
+                                   <entry>name schemaclass </entry>
                                  </row>
                                  <row>
+                                   <entry>QMF 'query queue' method                </entry>
                                    <entry>access</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>Authorise:: access</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 query                         </entry>
                                    <entry>access</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>QueueHandlerImpl:: query</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 queue declare                 </entry>
                                    <entry>access</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>Broker:: queryQueue</entry>
+                                   <entry>name alternate durable exclusive autodelete policytype queuemaxcountlowerlimit queuemaxcountupperlimit queuemaxsizelowerlimit queuemaxsizeupperlimit </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 queue access                   </entry>
                                    <entry>access</entry>
                                    <entry>queue</entry>
-                                   <entry>alternate durable exclusive autodelete policytype queuemaxcountlowerlimit queuemaxcountupperlimit queuemaxsizelowerlimit queuemaxsizeupperlimit </entry>
-                                   <entry>QueueHandlerImpl:: declare</entry>
+                                   <entry>name alternate durable exclusive autodelete policytype queuemaxcountlowerlimit queuemaxcountupperlimit queuemaxsizelowerlimit queuemaxsizeupperlimit </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 node resolution                </entry>
                                    <entry>access</entry>
                                    <entry>queue</entry>
-                                   <entry>alternate durable exclusive autodelete policytype queuemaxcountlowerlimit queuemaxcountupperlimit queuemaxsizelowerlimit queuemaxsizeupperlimit </entry>
-                                   <entry>Authorise:: access</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 or QMF bind request           </entry>
                                    <entry>bind</entry>
                                    <entry>exchange</entry>
-                                   <entry>queuename routingkey </entry>
-                                   <entry>Broker:: bind</entry>
+                                   <entry>name queuename routingkey </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 new outgoing link from exchange</entry>
                                    <entry>bind</entry>
                                    <entry>exchange</entry>
-                                   <entry>queuename routingkey </entry>
-                                   <entry>Authorise:: outgoing</entry>
+                                   <entry>name queuename routingkey </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 subscribe request             </entry>
                                    <entry>consume</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>MessageHandlerImpl:: subscribe</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 new outgoing link from queue   </entry>
                                    <entry>consume</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>Authorise:: outgoing</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>TCP/IP connection creation              </entry>
                                    <entry>create</entry>
                                    <entry>connection</entry>
-                                   <entry>host</entry>
-                                   <entry>Connection creation</entry>
+                                   <entry>host </entry>
                                  </row>
                                  <row>
+                                   <entry>Create exchange                         </entry>
                                    <entry>create</entry>
                                    <entry>exchange</entry>
-                                   <entry>type alternate durable autodelete </entry>
-                                   <entry>Broker:: createExchange</entry>
+                                   <entry>name type alternate durable autodelete </entry>
                                  </row>
                                  <row>
+                                   <entry>Interbroker link creation               </entry>
                                    <entry>create</entry>
                                    <entry>link</entry>
                                    <entry></entry>
-                                   <entry>ConnectionHandler:: Handler:: open</entry>
                                  </row>
                                  <row>
+                                   <entry>Interbroker link creation               </entry>
                                    <entry>create</entry>
                                    <entry>link</entry>
                                    <entry></entry>
-                                   <entry>Authorise:: interlink</entry>
                                  </row>
                                  <row>
+                                   <entry>Create queue                            </entry>
                                    <entry>create</entry>
                                    <entry>queue</entry>
-                                   <entry>alternate durable exclusive autodelete policytype paging pageslowerlimit pagesupperlimit pagefactorlowerlimit pagefactorupperlimit queuemaxcountlowerlimit queuemaxcountupperlimit queuemaxsizelowerlimit queuemaxsizeupperlimit filemaxcountlowerlimit filemaxcountupperlimit filemaxsizelowerlimit filemaxsizeupperlimit </entry>
-                                   <entry>Broker:: createQueue</entry>
+                                   <entry>name alternate durable exclusive autodelete policytype paging pageslowerlimit pagesupperlimit pagefactorlowerlimit pagefactorupperlimit queuemaxcountlowerlimit queuemaxcountupperlimit queuemaxsizelowerlimit queuemaxsizeupperlimit filemaxcountlowerlimit filemaxcountupperlimit filemaxsizelowerlimit filemaxsizeupperlimit </entry>
                                  </row>
                                  <row>
+                                   <entry>Delete exchange                         </entry>
                                    <entry>delete</entry>
                                    <entry>exchange</entry>
-                                   <entry>type alternate durable </entry>
-                                   <entry>Broker:: deleteExchange</entry>
+                                   <entry>name type alternate durable </entry>
                                  </row>
                                  <row>
+                                   <entry>Delete queue                            </entry>
                                    <entry>delete</entry>
                                    <entry>queue</entry>
-                                   <entry>alternate durable exclusive autodelete policytype </entry>
-                                   <entry>Broker:: deleteQueue</entry>
+                                   <entry>name alternate durable exclusive autodelete policytype </entry>
                                  </row>
                                  <row>
+                                   <entry>Management 'move queue' request         </entry>
                                    <entry>move</entry>
                                    <entry>queue</entry>
-                                   <entry>queuename</entry>
-                                   <entry>Broker:: queueMoveMessages</entry>
+                                   <entry>name queuename </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 0-10 received message processing   </entry>
                                    <entry>publish</entry>
                                    <entry>exchange</entry>
-                                   <entry></entry>
-                                   <entry>Authorise:: incoming</entry>
+                                   <entry>name routingkey </entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 establish sender link to queue </entry>
                                    <entry>publish</entry>
                                    <entry>exchange</entry>
                                    <entry>routingkey </entry>
-                                   <entry>SemanticState:: route</entry>
                                  </row>
                                  <row>
+                                   <entry>AMQP 1.0 received message processing    </entry>
                                    <entry>publish</entry>
                                    <entry>exchange</entry>
-                                   <entry>routingkey </entry>
-                                   <entry>Authorise:: route</entry>
+                                   <entry>name routingkey </entry>
                                  </row>
                                  <row>
+                                   <entry>Management 'purge queue' request        </entry>
                                    <entry>purge</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>QueueHandlerImpl:: purge</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>Management 'purge queue' request        </entry>
                                    <entry>purge</entry>
                                    <entry>queue</entry>
-                                   <entry></entry>
-                                   <entry>Queue:: ManagementMethod</entry>
+                                   <entry>name </entry>
                                  </row>
                                  <row>
+                                   <entry>Management 'redirect queue' request     </entry>
                                    <entry>redirect</entry>
                                    <entry>queue</entry>
-                                   <entry>queuename</entry>
-                                   <entry>Broker:: queueRedirect</entry>
+                                   <entry>name queuename </entry>
                                  </row>
                                  <row>
+                                   <entry>Management 'reroute queue' request      </entry>
                                    <entry>reroute</entry>
                                    <entry>queue</entry>
-                                   <entry>exchangename </entry>
-                                   <entry>Queue:: ManagementMethod</entry>
+                                   <entry>name exchangename </entry>
                                  </row>
                                  <row>
+                                   <entry>Management 'unbind exchange' request    </entry>
                                    <entry>unbind</entry>
                                    <entry>exchange</entry>
-                                   <entry>queuename routingkey </entry>
-                                   <entry>Broker:: unbind</entry>
+                                   <entry>name queuename routingkey </entry>
                                  </row>
                                  <row>
+                                   <entry>User modifying message timestamp setting</entry>
                                    <entry>update</entry>
                                    <entry>broker</entry>
                                    <entry></entry>
-                                   <entry>Broker:: setTimestampConfig</entry>
                                  </row>
-			       </tbody>
-			     </tgroup>
-			   </table>
-			   <para>
-			     
-			   </para>
-			 </section>
-		       </section>
-
-		 <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions">
-			<title>ACL Syntactic Conventions</title>
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-comments">
-			  <title>Comments</title>
-			  <para>
-			    <itemizedlist>
-			      <listitem>
-				<para>
-				  A line starting with the <command>#</command> character is considered a comment and is ignored.
-				</para>
-			      </listitem>
-			      <listitem>
-				<para>
-				  Embedded comments and trailing comments are not allowed. The <command>#</command> is commonly found in routing keys and other AMQP literals which occur naturally in ACL rule specifications.
-				</para>
-			      </listitem>
-			    </itemizedlist>
-			  </para>
-			</section>
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-whitespace">
-			  <title>White Space</title>
-			  <itemizedlist>
-			    <listitem>
-			      <para>
-				Empty lines and lines that contain only whitespace (' ', '\f', '\n', '\r', '\t', '\v') are ignored.
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				Additional whitespace between and after tokens is allowed.
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				Group and Acl definitions must start with <command>group</command> and <command>acl</command> respectively and with no preceding whitespace.
-			      </para>
-			    </listitem>
-			  </itemizedlist>
-			</section>
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-characterset">
-			  <title>Character Set</title>
-			  <itemizedlist>
-			    <listitem>
-			      <para>
-				ACL files use 7-bit ASCII characters only
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				Group names may contain only
-				<itemizedlist>
-				  <listitem><command>[a-z]</command></listitem>
-				  <listitem><command>[A-Z]</command></listitem>
-				  <listitem><command>[0-9]</command></listitem>
-				  <listitem><command>'-'</command> hyphen</listitem>
-				  <listitem><command>'_'</command> underscore</listitem>
-				</itemizedlist>
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				Individual user names may contain only
-				<itemizedlist>
-				  <listitem><command>[a-z]</command></listitem>
-				  <listitem><command>[A-Z]</command></listitem>
-				  <listitem><command>[0-9]</command></listitem>
-				  <listitem><command>'-'</command> hyphen</listitem>
-				  <listitem><command>'_'</command> underscore</listitem>
-				  <listitem><command>'.'</command> period</listitem>
-				  <listitem><command>'@'</command> ampersand</listitem>
-				  <listitem><command>'/'</command> slash</listitem>
-				</itemizedlist>
-			      </para>
-			    </listitem>
-			  </itemizedlist>
-			</section>
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-casesensitivity">
-			  <title>Case Sensitivity</title>
-			  <itemizedlist>
-			    <listitem>
-			      <para>
-				All tokens are case sensitive. <parameter>name1</parameter> is not the same as <parameter>Name1</parameter> and <parameter>create</parameter> is not the same as <parameter>CREATE</parameter>.
-			      </para>
-			    </listitem>
-			  </itemizedlist>
-			</section>
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linecontinuation">
-			  <title>Line Continuation</title>
-			  <itemizedlist>
-			    <listitem>
-			      <para>
-				Group lists can be extended to the following line by terminating the line with the <command>'\'</command> character. No other ACL file lines may be continued.
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				Group specification lines may be continued only after the group name or any of the user names included in the group. See example below.
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				Lines consisting solely of a <command>'\'</command> character are not permitted.
-			      </para>
-			    </listitem>
-			    <listitem>
-			      <para>
-				The <command>'\'</command> continuation character is recognized only if it is the last character in the line. Any characters after the <command>'\'</command> are not permitted.
-			      </para>
-			    </listitem>
-			  </itemizedlist>
+                               </tbody>
+                             </tgroup>
+                           </table>
+                         </section>
+                       </section>
+
+                 <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions">
+                        <title>ACL Syntactic Conventions</title>
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-comments">
+                          <title>Comments</title>
+                          <para>
+                            <itemizedlist>
+                              <listitem>
+                                <para>
+                                  A line starting with the <command>#</command> character is considered a comment and is ignored.
+                                </para>
+                              </listitem>
+                              <listitem>
+                                <para>
+                                  Embedded comments and trailing comments are not allowed. The <command>#</command> is commonly found in routing keys and other AMQP literals which occur naturally in ACL rule specifications.
+                                </para>
+                              </listitem>
+                            </itemizedlist>
+                          </para>
+                        </section>
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-whitespace">
+                          <title>White Space</title>
+                          <itemizedlist>
+                            <listitem>
+                              <para>
+                                Empty lines and lines that contain only whitespace (' ', '\f', '\n', '\r', '\t', '\v') are ignored.
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                Additional whitespace between and after tokens is allowed.
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                Group and Acl definitions must start with <command>group</command> and <command>acl</command> respectively and with no preceding whitespace.
+                              </para>
+                            </listitem>
+                          </itemizedlist>
+                        </section>
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-characterset">
+                          <title>Character Set</title>
+                          <itemizedlist>
+                            <listitem>
+                              <para>
+                                ACL files use 7-bit ASCII characters only
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                Group names may contain only
+                                <itemizedlist>
+                                  <listitem><command>[a-z]</command></listitem>
+                                  <listitem><command>[A-Z]</command></listitem>
+                                  <listitem><command>[0-9]</command></listitem>
+                                  <listitem><command>'-'</command> hyphen</listitem>
+                                  <listitem><command>'_'</command> underscore</listitem>
+                                </itemizedlist>
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                Individual user names may contain only
+                                <itemizedlist>
+                                  <listitem><command>[a-z]</command></listitem>
+                                  <listitem><command>[A-Z]</command></listitem>
+                                  <listitem><command>[0-9]</command></listitem>
+                                  <listitem><command>'-'</command> hyphen</listitem>
+                                  <listitem><command>'_'</command> underscore</listitem>
+                                  <listitem><command>'.'</command> period</listitem>
+                                  <listitem><command>'@'</command> ampersand</listitem>
+                                  <listitem><command>'/'</command> slash</listitem>
+                                </itemizedlist>
+                              </para>
+                            </listitem>
+                          </itemizedlist>
+                        </section>
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-casesensitivity">
+                          <title>Case Sensitivity</title>
+                          <itemizedlist>
+                            <listitem>
+                              <para>
+                                All tokens are case sensitive. <parameter>name1</parameter> is not the same as <parameter>Name1</parameter> and <parameter>create</parameter> is not the same as <parameter>CREATE</parameter>.
+                              </para>
+                            </listitem>
+                          </itemizedlist>
+                        </section>
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linecontinuation">
+                          <title>Line Continuation</title>
+                          <itemizedlist>
+                            <listitem>
+                              <para>
+                                Group lists can be extended to the following line by terminating the line with the <command>'\'</command> character. No other ACL file lines may be continued.
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                Group specification lines may be continued only after the group name or any of the user names included in the group. See example below.
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                Lines consisting solely of a <command>'\'</command> character are not permitted.
+                              </para>
+                            </listitem>
+                            <listitem>
+                              <para>
+                                The <command>'\'</command> continuation character is recognized only if it is the last character in the line. Any characters after the <command>'\'</command> are not permitted.
+                              </para>
+                            </listitem>
+                          </itemizedlist>
 <programlisting><![CDATA[
     #
     # Examples of extending group lists using a trailing '\' character
@@ -1253,81 +1268,81 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
                  name10
 ]]></programlisting>
 
-			</section>
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linelength">
-			  <title>Line Length</title>
-			  <itemizedlist>
-			    <listitem>
-			      <para>
-				ACL file lines are limited to 1024 characters.
-			      </para>
-			    </listitem>
-			  </itemizedlist>
-			</section>
-
-
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords">
-			  <title>ACL File Keywords</title>
-			  ACL reserves several words for convenience and for context sensitive substitution.
-
-			  <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-all">
-			    <title>The <command>all</command> Keyword</title>
-			    The keyword <command>all</command> is reserved. It may be used in ACL rules to match all individuals and groups, all actions, or all objects.
-			    <itemizedlist>
-			      <listitem>acl allow all create queue</listitem>
-			      <listitem>acl allow bob@QPID all queue</listitem>
-			      <listitem>acl allow bob@QPID create all</listitem>
-			    </itemizedlist>
-			  </section>
-
-			  <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-userdomain">
-			    <title>User Name and Domain Name Keywords</title>
-			    <para>
-			      In the C++ Broker 0.20 a simple set of user name and domain name substitution variable keyword tokens is defined. This provides administrators with an easy way to describe private or shared resources.
-			    </para>
-			    <para>
-			      Symbol substitution is allowed in the ACL file anywhere that text is supplied for a property value.
-			    </para>
-			    <para>
-			      In the following table an authenticated user named bob.user@QPID.COM has his substitution keywords expanded.
-
-			      <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_UsernameSubstitution">
-				<title>ACL User Name and Domain Name Substitution Keywords</title>
-				<tgroup cols="2">
-				  <thead>
-				    <row>
-				      <entry>Keyword</entry>
-				      <entry>Expansion</entry>
-				    </row>
-				  </thead>
-				  <tbody>
-				    <row>
-				      <entry> <command>${userdomain}</command> </entry>
-				      <entry>bob_user_QPID_COM</entry>
-				    </row>
-				    <row>
-				      <entry> <command>${user}</command> </entry>
-				      <entry>bob_user</entry>
-				    </row>
-				    <row>
-				      <entry> <command>${domain}</command> </entry>
-				      <entry>QPID_COM</entry>
-				    </row>
-				  </tbody>
-				</tgroup>
-			      </table>
-			    </para>
-
-			    <para>
-			      <itemizedlist>
-				<listitem>
-				  The original user name has the period “.” and ampersand “@” characters translated into underscore “_”. This allows substitution to work when the substitution keyword is used in a routingkey in the Acl file.
-				</listitem>
-				<listitem>
-				  The Acl processing matches ${userdomain} before matching either ${user} or ${domain}. Rules that specify the combination ${user}_${domain} will never match.
-				</listitem>
-			      </itemizedlist>
-			    </para>
+                        </section>
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linelength">
+                          <title>Line Length</title>
+                          <itemizedlist>
+                            <listitem>
+                              <para>
+                                ACL file lines are limited to 1024 characters.
+                              </para>
+                            </listitem>
+                          </itemizedlist>
+                        </section>
+
+
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords">
+                          <title>ACL File Keywords</title>
+                          ACL reserves several words for convenience and for context sensitive substitution.
+
+                          <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-all">
+                            <title>The <command>all</command> Keyword</title>
+                            The keyword <command>all</command> is reserved. It may be used in ACL rules to match all individuals and groups, all actions, or all objects.
+                            <itemizedlist>
+                              <listitem>acl allow all create queue</listitem>
+                              <listitem>acl allow bob@QPID all queue</listitem>
+                              <listitem>acl allow bob@QPID create all</listitem>
+                            </itemizedlist>
+                          </section>
+
+                          <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-userdomain">
+                            <title>User Name and Domain Name Keywords</title>
+                            <para>
+                              In the C++ Broker 0.20 a simple set of user name and domain name substitution variable keyword tokens is defined. This provides administrators with an easy way to describe private or shared resources.
+                            </para>
+                            <para>
+                              Symbol substitution is allowed in the ACL file anywhere that text is supplied for a property value.
+                            </para>
+                            <para>
+                              In the following table an authenticated user named bob.user@QPID.COM has his substitution keywords expanded.
+
+                              <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_UsernameSubstitution">
+                                <title>ACL User Name and Domain Name Substitution Keywords</title>
+                                <tgroup cols="2">
+                                  <thead>
+                                    <row>
+                                      <entry>Keyword</entry>
+                                      <entry>Expansion</entry>
+                                    </row>
+                                  </thead>
+                                  <tbody>
+                                    <row>
+                                      <entry> <command>${userdomain}</command> </entry>
+                                      <entry>bob_user_QPID_COM</entry>
+                                    </row>
+                                    <row>
+                                      <entry> <command>${user}</command> </entry>
+                                      <entry>bob_user</entry>
+                                    </row>
+                                    <row>
+                                      <entry> <command>${domain}</command> </entry>
+                                      <entry>QPID_COM</entry>
+                                    </row>
+                                  </tbody>
+                                </tgroup>
+                              </table>
+                            </para>
+
+                            <para>
+                              <itemizedlist>
+                                <listitem>
+                                  The original user name has the period “.” and ampersand “@” characters translated into underscore “_”. This allows substitution to work when the substitution keyword is used in a routingkey in the Acl file.
+                                </listitem>
+                                <listitem>
+                                  The Acl processing matches ${userdomain} before matching either ${user} or ${domain}. Rules that specify the combination ${user}_${domain} will never match.
+                                </listitem>
+                              </itemizedlist>
+                            </para>
 
 <programlisting><![CDATA[
   # Example:
@@ -1388,122 +1403,122 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
 ]]></programlisting>
                           </section>
 
-			</section>
-
-			<section id="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards">
-			  <title>Wildcards</title>
-			  ACL privides two types of wildcard matching to provide flexibility in writing rules.
-
-			  <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-asterisk">
-			    <title>Property Value Wildcard</title>
-			    <para>
-			      Text specifying a property value may end with a single trailing <command>*</command> character.
-			      This is a simple wildcard match indicating that strings which match up to that point are matches for the ACL property rule.
-			      An ACL rule such as
-			    </para>
-			    <para>
-			      <programlisting>    acl allow bob@QPID create queue name=bob*</programlisting>
-			    </para>
-			    <para>
-			      allow user bob@QPID to create queues named bob1, bob2, bobQueue3, and so on.
-			    </para>
-			  </section>
-
-			  <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-topickey">
-			    <title>Topic Routing Key Wildcard</title>
-			    <para>
-			      In the C++ Broker 0.20 the logic governing the ACL Match has changed for each ACL rule that contains a routingkey property.
-			      The routingkey property is matched according to Topic Exchange match logic the broker uses when it distributes messages published to a topic exchange.
-			    </para>
-			    <para>
-			      Routing keys are hierarchical where each level is separated by a period:
-			      <itemizedlist>
-				<listitem>weather.usa</listitem>
-				<listitem>weather.europe.germany</listitem>
-				<listitem>weather.europe.germany.berlin</listitem>
-				<listitem>company.engineering.repository</listitem>
-			      </itemizedlist>
-			    </para>
-			    <para>
-			      Within the routing key hierarchy two wildcard characters are defined.
-			      <itemizedlist>
-				<listitem><command>*</command> matches one field</listitem>
-				<listitem><command>#</command> matches zero or more fields</listitem>
-			      </itemizedlist>
-			    </para>
-			    <para>
-			      Suppose an ACL rule file is:
-			    </para>
-			    <para>
-			      <programlisting>
+                        </section>
+
+                        <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards">
+                          <title>Wildcards</title>
+                          ACL privides two types of wildcard matching to provide flexibility in writing rules.
+
+                          <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-asterisk">
+                            <title>Property Value Wildcard</title>
+                            <para>
+                              Text specifying a property value may end with a single trailing <command>*</command> character.
+                              This is a simple wildcard match indicating that strings which match up to that point are matches for the ACL property rule.
+                              An ACL rule such as
+                            </para>
+                            <para>
+                              <programlisting>    acl allow bob@QPID create queue name=bob*</programlisting>
+                            </para>
+                            <para>
+                              allow user bob@QPID to create queues named bob1, bob2, bobQueue3, and so on.
+                            </para>
+                          </section>
+
+                          <section id="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-topickey">
+                            <title>Topic Routing Key Wildcard</title>
+                            <para>
+                              In the C++ Broker 0.20 the logic governing the ACL Match has changed for each ACL rule that contains a routingkey property.
+                              The routingkey property is matched according to Topic Exchange match logic the broker uses when it distributes messages published to a topic exchange.
+                            </para>
+                            <para>
+                              Routing keys are hierarchical where each level is separated by a period:
+                              <itemizedlist>
+                                <listitem>weather.usa</listitem>
+                                <listitem>weather.europe.germany</listitem>
+                                <listitem>weather.europe.germany.berlin</listitem>
+                                <listitem>company.engineering.repository</listitem>
+                              </itemizedlist>
+                            </para>
+                            <para>
+                              Within the routing key hierarchy two wildcard characters are defined.
+                              <itemizedlist>
+                                <listitem><command>*</command> matches one field</listitem>
+                                <listitem><command>#</command> matches zero or more fields</listitem>
+                              </itemizedlist>
+                            </para>
+                            <para>
+                              Suppose an ACL rule file is:
+                            </para>
+                            <para>
+                              <programlisting>
     acl allow-log uHash1@COMPANY publish exchange name=X routingkey=a.#.b
     acl deny all all
-			      </programlisting>
-			    </para>
-			    <para>
-			      When user uHash1@COMPANY attempts to publish to exchange X the ACL will return these results:
-
-			      <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_TopicExchangeMatch">
-				<title>Topic Exchange Wildcard Match Examples</title>
-				<tgroup cols="2">
-				  <thead>
-				    <row>
-				      <entry>routingkey in publish to exchange X</entry>
-				      <entry>result</entry>
-				    </row>
-				  </thead>
-				  <tbody>
-				    <row>
-				      <entry> <command>a.b</command> </entry>
-				      <entry>allow-log</entry>
-				    </row>
-				    <row>
-				      <entry> <command>a.x.b</command> </entry>
-				      <entry>allow-log</entry>
-				    </row>
-				    <row>
-				      <entry> <command>a.x.y.zz.b</command> </entry>
-				      <entry>allow-log</entry>
-				    </row>
-				    <row>
-				      <entry> <command>a.b.</command> </entry>
-				      <entry>deny</entry>
-				    </row>
-				    <row>
-				      <entry> <command>q.x.b</command> </entry>
-				      <entry>deny</entry>
-				    </row>
-				  </tbody>
-				</tgroup>
-			      </table>
-
-			    </para>
-			  </section>
-
-			</section>
-
-
-
-		      </section>
-
-		 <section id="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching">
-			<title>ACL Rule Matching</title>
-			 <para>
-			   The minimum matching criteria for ACL rules are:
-			   <itemizedlist>
-			     <listitem>An actor (individually named or group member)</listitem>
-			     <listitem>An action</listitem>
-			     <listitem>An object</listitem>
-			   </itemizedlist>
-			 </para>
-			 <para>
-			   If a rule does not match the minimum criteria then that rule does not control the ACL allow or deny decision.
-			 </para>
-			 <para>
-			   ACL rules optionally specify object names and property name=value pairs. If an ACL rule specifies an object name or property values than all of them must match to cause the rule to match.
-			 </para>
-			 <para>
-			   The following illustration shows how ACL rules are processed to find matching rules.
+                              </programlisting>
+                            </para>
+                            <para>
+                              When user uHash1@COMPANY attempts to publish to exchange X the ACL will return these results:
+
+                              <table id="tabl-Messaging_User_Guide-ACL_Syntax-ACL_TopicExchangeMatch">
+                                <title>Topic Exchange Wildcard Match Examples</title>
+                                <tgroup cols="2">
+                                  <thead>
+                                    <row>
+                                      <entry>routingkey in publish to exchange X</entry>
+                                      <entry>result</entry>
+                                    </row>
+                                  </thead>
+                                  <tbody>
+                                    <row>
+                                      <entry> <command>a.b</command> </entry>
+                                      <entry>allow-log</entry>
+                                    </row>
+                                    <row>
+                                      <entry> <command>a.x.b</command> </entry>
+                                      <entry>allow-log</entry>
+                                    </row>
+                                    <row>
+                                      <entry> <command>a.x.y.zz.b</command> </entry>
+                                      <entry>allow-log</entry>
+                                    </row>
+                                    <row>
+                                      <entry> <command>a.b.</command> </entry>
+                                      <entry>deny</entry>
+                                    </row>
+                                    <row>
+                                      <entry> <command>q.x.b</command> </entry>
+                                      <entry>deny</entry>
+                                    </row>
+                                  </tbody>
+                                </tgroup>
+                              </table>
+
+                            </para>
+                          </section>
+
+                        </section>
+
+
+
+                      </section>
+
+                 <section id="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching">
+                        <title>ACL Rule Matching</title>
+                         <para>
+                           The minimum matching criteria for ACL rules are:
+                           <itemizedlist>
+                             <listitem>An actor (individually named or group member)</listitem>
+                             <listitem>An action</listitem>
+                             <listitem>An object</listitem>
+                           </itemizedlist>
+                         </para>
+                         <para>
+                           If a rule does not match the minimum criteria then that rule does not control the ACL allow or deny decision.
+                         </para>
+                         <para>
+                           ACL rules optionally specify object names and property name=value pairs. If an ACL rule specifies an object name or property values than all of them must match to cause the rule to match.
+                         </para>
+                         <para>
+                           The following illustration shows how ACL rules are processed to find matching rules.
 <programlisting><![CDATA[
     # Example of rule matching
     #
@@ -1551,21 +1566,21 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
     #  7. Rule 2 is the matching rule and the decision is 'deny'.
     #
 ]]></programlisting>
-			 </para>
-			 <para>
-			   Referring to <link linkend="tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties">ACL Properties Allowed for each Action and Object table</link> observe that some Action/Object pairs have different sets of allowed properties. For example different broker ACL lookups for <emphasis>access exchange</emphasis> have different property subsets.
-			 </para>
+                         </para>
+                         <para>
+                           Referring to <link linkend="tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties">ACL Properties Allowed for each Action and Object table</link> observe that some Action/Object pairs have different sets of allowed properties. For example different broker ACL lookups for <emphasis>access exchange</emphasis> have different property subsets.
+                         </para>
 
 <programlisting>
-    access exchange
-    access exchange type alternate durable autodelete
-    access exchange queuename routingkey
-    access exchange type durable
+    [1] access exchange name
+    [2] access exchange name type alternate durable autodelete
+    [3] access exchange name queuename routingkey
+    [4] access exchange name type durable
 </programlisting>
 
                          <para>
-			   If an ACL rule specifies the <emphasis>autodelete</emphasis> property then it can possibly match only the second case above. It can never match cases 1, 3, and 4 because the broker calls to ACL will not present the autodelete property for matching. To get proper matching the ACL rule must have only the properties of the intended lookup case.
-			 </para>
+                           If an ACL rule specifies the <emphasis>autodelete</emphasis> property then it can possibly match only the second case above. It can never match cases 1, 3, and 4 because the broker calls to ACL will not present the autodelete property for matching. To get proper matching the ACL rule must have only the properties of the intended lookup case.
+                         </para>
 
 <programlisting>
     acl allow bob access exchange alternate=other    ! may match pattern 2 only
@@ -1574,16 +1589,16 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
     acl deny  bob access exchange                    ! may match all patterns
 </programlisting>
 
-		 </section>
+                 </section>
 
-		 <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Permissions">
-			<title>Specifying ACL Permissions</title>
-			 <para>
-			   Now that we have seen the ACL syntax, we will provide representative examples and guidelines for ACL files.
-			</para>
-			 <para>
-				Most ACL files begin by defining groups:
-			</para>
+                 <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Permissions">
+                        <title>Specifying ACL Permissions</title>
+                         <para>
+                           Now that we have seen the ACL syntax, we will provide representative examples and guidelines for ACL files.
+                        </para>
+                         <para>
+                                Most ACL files begin by defining groups:
+                        </para>
 
 <programlisting>
     group admin ted@QPID martin@QPID
@@ -1592,9 +1607,9 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
     group publisher group2 \
     tom@QPID andrew@QPID debbie@QPID
 </programlisting>
-			 <para>
-				Rules in an ACL file grant or deny specific permissions to users or groups:
-			</para>
+                         <para>
+                                Rules in an ACL file grant or deny specific permissions to users or groups:
+                        </para>
 
 <programlisting>
     acl allow carlt@QPID create exchange name=carl.*
@@ -1612,26 +1627,26 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
     acl allow all bind exchange
     acl deny all all
 </programlisting>
-			 <para>
-				In the previous example, the last line, <literal>acl deny all all</literal>, denies all authorizations that have not been specifically granted. This is the default, but it is useful to include it explicitly on the last line for the sake of clarity. If you want to grant all rights by default, you can specify <literal>acl allow all all</literal> in the last line.
-			</para>
-			<para>
-			  ACL allows specification of conflicting rules. Be sure to specify the most specific rules first followed by more general rules. Here is an example:
-			</para>
-			<para>
+                         <para>
+                                In the previous example, the last line, <literal>acl deny all all</literal>, denies all authorizations that have not been specifically granted. This is the default, but it is useful to include it explicitly on the last line for the sake of clarity. If you want to grant all rights by default, you can specify <literal>acl allow all all</literal> in the last line.
+                        </para>
+                        <para>
+                          ACL allows specification of conflicting rules. Be sure to specify the most specific rules first followed by more general rules. Here is an example:
+                        </para>
+                        <para>
 <programlisting>
     group users alice@QPID bob@QPID charlie@QPID
     acl deny  charlie@QPID create queue
     acl allow users        create queue
     acl deny all all
 </programlisting>
-			</para>
-			<para>
-			  In this example users alice and bob would be able to create queues due to their membership in the users group. However, user charlie is denied from creating a queue despite his membership in the users group because a deny rule for him is stated before the allow rule for the users group.
-			</para>
-			 <para>
-				Do not allow <parameter>guest</parameter> to access and log QMF management methods that could cause security breaches:
-			</para>
+                        </para>
+                        <para>
+                          In this example users alice and bob would be able to create queues due to their membership in the users group. However, user charlie is denied from creating a queue despite his membership in the users group because a deny rule for him is stated before the allow rule for the users group.
+                        </para>
+                         <para>
+                                Do not allow <parameter>guest</parameter> to access and log QMF management methods that could cause security breaches:
+                        </para>
 
 <programlisting>
     group allUsers guest@QPID
@@ -1642,110 +1657,519 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
     acl allow all all
 </programlisting>
 
-		</section>
-	      </section>
+                </section>
+                <section id="sect-Messaging_User_Guide-Authorization-Auditing_ACL_Settings">
+                  <title>Auditing ACL Settings</title>
+                  <para>
+                    The 0.30 C++ Broker ACL module provides a comprehensive set of run-time and debug logging checks.
+                    The following example ACL file is used to illustrate working with the ACL module debugging features.
+                  </para>
+<programlisting>
+   group x a@QPID b@QPID b2@QPID b3@QPID
+   acl allow all delete broker
+   acl allow all create queue name=abc
+   acl allow all create queue exchangename=xyz
+   acl allow all create connection host=1.1.1.1
+   acl allow all access exchange alternate=abc queuename=xyz
+   acl allow all access exchange queuename=xyz
+   acl allow all access exchange alternate=abc
+   acl allow a@qpid all all exchangename=123
+   acl allow b@qpid all all
+   acl allow all all
+</programlisting>
+                  <para>
+                    When this file is loaded it will show the following (truncated, formatted) Info-level log.
+                  </para>
+<programlisting>
+  notice ACL: Read file "/home/chug/acl/svn-acl.acl"
+  warning ACL rule ignored: Broker never checks for rules with
+                            action: 'delete' and object: 'broker'
+  warning ACL rule ignored: Broker checks for rules with
+                            action: 'create' and object: 'queue'
+              but will never match with property set: { exchangename=xyz }
+  warning ACL rule ignored: Broker checks for rules with
+                            action: 'access' and object: 'exchange'
+              but will never match with property set: { alternate=abc queuename=xyz }
+  info ACL Plugin loaded
+</programlisting>
+                  <para>
+                    Three of the rules are invalid. The first invalid rule is rejected because there are no rules
+                    that specify 'delete broker' regardless of the properties. The other two rules are rejected
+                    because the property sets in the ACL rule don't match any broker lookups.
+                  </para>
+                  <para>
+                    The ACL module only issues a warning about these rules and continues to operate. Users upgrading
+                    from previous versions should be concerned that these rules never had any effect and should fix
+                    the rules to have the property sets needed to allow or deny the intended broker events.
+                  </para>
+                  <para>
+                    The next illustration shows the Debug-level log. Debug log level includes information about
+                    constructing the rule tables, expanding groups and keywords, connection and queue quotas, and
+                    connection black and white lists.
+                  </para>
+<programlisting>
+  notice ACL: Read file "/home/chug/acl/svn-acl.acl"
+  debug ACL: Group list: 1 groups found:
+  debug ACL:   "x": a@QPID b2@QPID b3@QPID b@QPID
+  debug ACL: name list: 7 names found:
+  debug ACL:  * a@QPID a@qpid b2@QPID b3@QPID b@QPID b@qpid
+  debug ACL: Rule list: 10 ACL rules found:
+  debug ACL:    1 allow [*] delete broker
+  warning ACL rule ignored: Broker never checks for rules with
+                            action: 'delete' and object: 'broker'
+  debug ACL:    2 allow [*] create queue name=abc
+  debug ACL:    3 allow [*] create queue exchangename=xyz
+  warning ACL rule ignored: Broker checks for rules with
+                            action: 'create' and object: 'queue'
+                     but will never match with property set: { exchangename=xyz }
+  debug ACL:    4 allow [*] create connection host=1.1.1.1
+  debug ACL:    5 allow [*] access exchange alternate=abc queuename=xyz
+  warning ACL rule ignored: Broker checks for rules with
+                            action: 'access' and object: 'exchange'
+                     but will never match with property set: { alternate=abc queuename=xyz }
+  debug ACL:    6 allow [*] access exchange queuename=xyz
+  debug ACL:    7 allow [*] access exchange alternate=abc
+  debug ACL:    8 allow [a@qpid] * * exchangename=123
+  debug ACL:    9 allow [b@qpid] * *
+  debug ACL:   10 allow [*] *
+  debug ACL: connections quota: 0 rules found:
+  debug ACL: queues quota: 0 rules found:
+  debug ACL: Load Rules
+  debug ACL: Processing 10 allow [*] *
+  debug ACL: FoundMode allow
+  debug ACL: Processing  9 allow [b@qpid] * *
+  debug ACL: Adding actions {access,bind,consume,create,delete,move,publish,purge,
+                             redirect,reroute,unbind,update}
+                 to objects {broker,connection,exchange,link,method,query,queue}
+                 with props { }
+                  for users {b@qpid}
+  debug ACL: Processing  8 allow [a@qpid] * * exchangename=123
+  debug ACL: Adding actions {access,bind,consume,create,delete,move,publish,purge,
+                             redirect,reroute,unbind,update}
+                 to objects {broker,connection,exchange,link,method,query,queue}
+                 with props { exchangename=123 }
+                  for users {a@qpid}
+  debug ACL: Processing  7 allow [*] access exchange alternate=abc
+  debug ACL: Adding actions {access}
+                 to objects {exchange}
+                 with props { alternate=abc }
+                  for users {*,a@QPID,a@qpid,b2@QPID,b3@QPID,b@QPID,b@qpid}
+  debug ACL: Processing  6 allow [*] access exchange queuename=xyz
+  debug ACL: Adding actions {access}
+                 to objects {exchange}
+                 with props { queuename=xyz }
+                  for users {*,a@QPID,a@qpid,b2@QPID,b3@QPID,b@QPID,b@qpid}
+  debug ACL: Processing  5 allow [*] access exchange alternate=abc queuename=xyz
+  debug ACL: Processing  4 allow [*] create connection host=1.1.1.1
+  debug ACL: Processing  3 allow [*] create queue exchangename=xyz
+  debug ACL: Processing  2 allow [*] create queue name=abc
+  debug ACL: Adding actions {create}
+                 to objects {queue}
+                 with props { name=abc }
+                  for users {*,a@QPID,a@qpid,b2@QPID,b3@QPID,b@QPID,b@qpid}
+  debug ACL: Processing  1 allow [*] delete broker
+  debug ACL: global Connection Rule list : 1 rules found :
+  debug ACL:    1 [ruleMode = allow {(1.1.1.1,1.1.1.1)}
+  debug ACL: User Connection Rule lists : 0 user lists found :
+  debug ACL: Transfer ACL is Enabled!
+  info ACL Plugin loaded
+</programlisting>
+                  <para>
+                    The previous illustration is interesting because it shows the settings as the <emphasis>all</emphasis> keywords are
+                    being expanded. However, that does not show the information about what is actually going into the ACL lookup tables.
+                  </para>
+                  <para>
+                    The next two illustrations show additional information provided by Trace-level logs for ACL startup.
+                    The first shows a dump of the broker's internal
+                    action/object/properties table. This table is authoratative.
+                  </para>
+<programlisting>
+  trace ACL: Definitions of action, object, (allowed properties) lookups
+  trace ACL: Lookup  1: "User querying message timestamp setting  "
+                          access   broker     ()
+  trace ACL: Lookup  2: "AMQP 0-10 protocol received 'query'      "
+                          access   exchange   (name)
+  trace ACL: Lookup  3: "AMQP 0-10 query binding                  "
+                          access   exchange   (name,routingkey,queuename)
+  trace ACL: Lookup  4: "AMQP 0-10 exchange declare               "
+                          access   exchange   (name,durable,autodelete,type,alternate)
+  trace ACL: Lookup  5: "AMQP 1.0 exchange access                 "
+                          access   exchange   (name,durable,type)
+  trace ACL: Lookup  6: "AMQP 1.0 node resolution                 "
+                          access   exchange   (name)
+  trace ACL: Lookup  7: "Management method request                "
+                          access   method     (name,schemapackage,schemaclass)
+  trace ACL: Lookup  8: "Management agent method request          "
+                          access   method     (name,schemapackage,schemaclass)
+  trace ACL: Lookup  9: "Management agent query                   "
+                          access   query      (name,schemaclass)
+  trace ACL: Lookup 10: "QMF 'query queue' method                 "
+                          access   queue      (name)
+  trace ACL: Lookup 11: "AMQP 0-10 query                          "
+                          access   queue      (name)
+  trace ACL: Lookup 12: "AMQP 0-10 queue declare                  "
+                          access   queue      (name,durable,autodelete,exclusive,alternate,
+                            policytype,queuemaxsizelowerlimit,queuemaxsizeupperlimit,
+                            queuemaxcountlowerlimit,queuemaxcountupperlimit)
+  trace ACL: Lookup 13: "AMQP 1.0 queue access                    "
+                          access   queue      (name,durable,autodelete,exclusive,alternate,
+                            policytype,queuemaxsizelowerlimit,queuemaxsizeupperlimit,
+                            queuemaxcountlowerlimit,queuemaxcountupperlimit)
+  trace ACL: Lookup 14: "AMQP 1.0 node resolution                 "
+                          access   queue      (name)
+  trace ACL: Lookup 15: "AMQP 0-10 or QMF bind request            "
+                          bind     exchange   (name,routingkey,queuename)
+  trace ACL: Lookup 16: "AMQP 1.0 new outgoing link from exchange "
+                          bind     exchange   (name,routingkey,queuename)
+  trace ACL: Lookup 17: "AMQP 0-10 subscribe request              "
+                          consume  queue      (name)
+  trace ACL: Lookup 18: "AMQP 1.0 new outgoing link from queue    "
+                          consume  queue      (name)
+  trace ACL: Lookup 19: "TCP/IP connection creation               "
+                          create   connection (host)
+  trace ACL: Lookup 20: "Create exchange                          "
+                          create   exchange   (name,durable,autodelete,type,alternate)
+  trace ACL: Lookup 21: "Interbroker link creation                "
+                          create   link       ()
+  trace ACL: Lookup 22: "Interbroker link creation                "
+                          create   link       ()
+  trace ACL: Lookup 23: "Create queue                             "
+                          create   queue      (name,durable,autodelete,exclusive,
+                            alternate,policytype,paging,
+                            queuemaxsizelowerlimit,queuemaxsizeupperlimit,
+                            queuemaxcountlowerlimit,queuemaxcountupperlimit,
+                            filemaxsizelowerlimit,filemaxsizeupperlimit,
+                            filemaxcountlowerlimit,filemaxcountupperlimit,
+                            pageslowerlimit,pagesupperlimit,
+                            pagefactorlowerlimit,pagefactorupperlimit)
+  trace ACL: Lookup 24: "Delete exchange                          "
+                          delete   exchange   (name,durable,type,alternate)
+  trace ACL: Lookup 25: "Delete queue                             "
+                          delete   queue      (name,durable,autodelete,exclusive,
+                            alternate,policytype)
+  trace ACL: Lookup 26: "Management 'move queue' request          "
+                          move     queue      (name,queuename)
+  trace ACL: Lookup 27: "AMQP 0-10 received message processing    "
+                          publish  exchange   (name,routingkey)
+  trace ACL: Lookup 28: "AMQP 1.0 establish sender link to queue  "
+                          publish  exchange   (routingkey)
+  trace ACL: Lookup 29: "AMQP 1.0 received message processing     "
+                          publish  exchange   (name,routingkey)
+  trace ACL: Lookup 30: "Management 'purge queue' request         "
+                          purge    queue      (name)
+  trace ACL: Lookup 31: "Management 'purge queue' request         "
+                          purge    queue      (name)
+  trace ACL: Lookup 32: "Management 'redirect queue' request      "
+                          redirect queue      (name,queuename)
+  trace ACL: Lookup 33: "Management 'reroute queue' request       "
+                          reroute  queue      (name,exchangename)
+  trace ACL: Lookup 34: "Management 'unbind exchange' request     "
+                          unbind   exchange   (name,routingkey,queuename)
+  trace ACL: Lookup 35: "User modifying message timestamp setting "
+                          update   broker     ()
+</programlisting>
+                  <para>
+                    The final illustration shows a dump of every rule for every user in the ACL database.
+                    It includes the user name, action, object, original ACL rule number, allow or deny status,
+                    and a cross reference indicating which Lookup Events the rule could possibly satisfy.
+                  </para>
+                  <para>
+                    Note that rules identified by <emphasis>User: *</emphasis> are the rules in effect
+                    for users otherwise unnamed in the ACL file.
+                  </para>
+
+<programlisting>
+  trace ACL: Decision rule cross reference
+  trace ACL: User: b@qpid   access   broker
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (1)
+  trace ACL: User: *        access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: *        access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: a@QPID   access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: a@QPID   access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: a@qpid   access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: a@qpid   access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: b2@QPID  access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: b2@QPID  access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: b3@QPID  access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: b3@QPID  access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: b@QPID   access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: b@QPID   access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: b@qpid   access   exchange
+                        Rule: [rule 6 ruleMode = allow props{ queuename=xyz }]
+                              may match Lookups : (3)
+  trace ACL: User: b@qpid   access   exchange
+                        Rule: [rule 7 ruleMode = allow props{ alternate=abc }]
+                              may match Lookups : (4)
+  trace ACL: User: b@qpid   access   exchange
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (2,3,4,5,6)
+  trace ACL: User: b@qpid   access   method
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (7,8)
+  trace ACL: User: b@qpid   access   query
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (9)
+  trace ACL: User: b@qpid   access   queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (10,11,12,13,14)
+  trace ACL: User: b@qpid   bind     exchange
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (15,16)
+  trace ACL: User: b@qpid   consume  queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (17,18)
+  trace ACL: User: b@qpid   create   connection
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (19)
+  trace ACL: User: b@qpid   create   exchange
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (20)
+  trace ACL: User: b@qpid   create   link
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (21,22)
+  trace ACL: User: *        create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: a@QPID   create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: a@qpid   create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: b2@QPID  create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: b3@QPID  create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: b@QPID   create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: b@qpid   create   queue
+                        Rule: [rule 2 ruleMode = allow props{ name=abc }]
+                              may match Lookups : (23)
+  trace ACL: User: b@qpid   create   queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (23)
+  trace ACL: User: b@qpid   delete   exchange
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (24)
+  trace ACL: User: b@qpid   delete   queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (25)
+  trace ACL: User: b@qpid   move     queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (26)
+  trace ACL: User: b@qpid   publish  exchange
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (27,28,29)
+  trace ACL: User: b@qpid   purge    queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (30,31)
+  trace ACL: User: b@qpid   redirect queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (32)
+  trace ACL: User: a@qpid   reroute  queue
+                        Rule: [rule 8 ruleMode = allow props{ exchangename=123 }]
+                              may match Lookups : (33)
+  trace ACL: User: b@qpid   reroute  queue
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (33)
+  trace ACL: User: b@qpid   unbind   exchange
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (34)
+  trace ACL: User: b@qpid   update   broker
+                        Rule: [rule 9 ruleMode = allow props{ }]
+                              may match Lookups : (35)
+</programlisting>
 
-	      <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Quotas">
-		<title>User Connection and Queue Quotas</title>
-		The ACL module enforces various quotas and thereby limits user activity.
-
-		<section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Limits">
-		  <title>Connection Count Limits</title>
-		  <para>
-		    The ACL module creates broker command line switches that set limits on the number of concurrent connections allowed per user or per client host address. These settings are not specified in the ACL file.
-		  </para>
-		  <para>
-		    <programlisting>
+                </section>
+              </section>
+
+              <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Quotas">
+                <title>User Connection and Queue Quotas</title>
+                <para>
+                  The ACL module enforces various quotas and thereby limits user activity.
+                </para>
+
+                <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Limits">
+                  <title>Connection Count Limits</title>
+                  <para>
+                    The ACL module creates broker command line switches that set limits on the number of concurrent connections allowed per user or per client host address. These settings are not specified in the ACL file.
+                  </para>
+                  <para>
+                    <programlisting>
     --max-connections           N
     --connection-limit-per-user N
     --connection-limit-per-ip   N
-		    </programlisting>
-		  </para>
-		  <para>
-		    <command>--max-connections</command> specifies an upper limit for all user connections.
-		  </para>
-		  <para>
-		    <command>--connection-limit-per-user</command> specifies an upper limit for each user based on the authenticated user name. This limit is enforced regardless of the client IP address from which the connection originates.
-		  </para>
-		  <para>
-		    <command>--connection-limit-per-ip</command> specifies an upper limit for connections for all users based on the originating client IP address. This limit is enforced regardless of the user credentials presented with the connection.
-		    <itemizedlist>
-		      <listitem>
-			Note that addresses using different transports are counted separately even though the originating host is actually the same physical machine. In the setting illustrated above a host would allow N_IP connections from [::1] IPv6 transport localhost and another N_IP connections from [127.0.0.1] IPv4 transport localhost.
-		      </listitem>
-		      <listitem>
-			The connection-limit-per-ip and connection-limit-per-user counts are active simultaneously. From a given client system users may be denied access to the broker by either connection limit.
-		      </listitem>
-		    </itemizedlist>
-		  </para>
-		  <para>
-		    The 0.22 C++ Broker ACL module accepts fine grained per-user connection limits through quota rules in the ACL file.
-		  </para>
-		  <para>
-		    <programlisting>
+                    </programlisting>
+                  </para>
+                  <para>
+                    <command>--max-connections</command> specifies an upper limit for all user connections.
+                  </para>
+                  <para>
+                    <command>--connection-limit-per-user</command> specifies an upper limit for each user based on the authenticated user name. This limit is enforced regardless of the client IP address from which the connection originates.
+                  </para>
+                  <para>
+                    <command>--connection-limit-per-ip</command> specifies an upper limit for connections for all users based on the originating client IP address. This limit is enforced regardless of the user credentials presented with the connection.
+                    <itemizedlist>
+                      <listitem>
+                        Note that addresses using different transports are counted separately even though the originating host is actually the same physical machine. In the setting illustrated above a host would allow N_IP connections from [::1] IPv6 transport localhost and another N_IP connections from [127.0.0.1] IPv4 transport localhost.
+                      </listitem>
+                      <listitem>
+                        The connection-limit-per-ip and connection-limit-per-user counts are active simultaneously. From a given client system users may be denied access to the broker by either connection limit.
+                      </listitem>
+                    </itemizedlist>
+                  </para>
+                  <para>
+                    The 0.22 C++ Broker ACL module accepts fine grained per-user connection limits through quota rules in the ACL file.
+                  </para>
+                  <para>
+                    <programlisting>
     quota connections 10 admins userX@QPID
-		    </programlisting>
-		  </para>
-		  <para>
-		    <itemizedlist>
-		      <listitem>
-			User <literal>all</literal> receives the value passed by the command line switch <literal>--connection-limit-per-user</literal>.
-		      </listitem>
-		      <listitem>
-			Values specified in the ACL rule for user <literal>all</literal> overwrite the value specified on the command line if any.
-		      </listitem>
-		      <listitem>
-			Connection quotas values are determined by first searching for the authenticated user name. If that user name is not specified then the value for user <literal>all</literal>
-			is used. If user <literal>all</literal> is not specified then the connection is denied.
-		      </listitem>
-		      <listitem>
-			The connection quota values range from 0..65530 inclusive. A value of zero disables connections from that user.
-		      </listitem>
-		      <listitem>
-			A user's quota may be specified many times in the ACL rule file. Only the last value specified is retained and enforced.
-		      </listitem>
-		      <listitem>
-			Per-user connection quotas are disabled when two conditions are true: 1) No --connection-limit-per-user command line switch and 2) No <literal>quota connections</literal>
-			rules in the ACL file. Per-user connections are always counted even if connection quotas are not enforced. This supports ACL file reloading that may subsequently
-			enable per-user connection quotas.
-		      </listitem>
-		      <listitem>
-			An ACL file reload may lower a user's connection quota value to a number lower than the user's current connection count. In that case the active connections
-			remain unaffected. New connections are denied until that user closes enough of his connections so that his count falls below the configured limit.
-		      </listitem>
-		    </itemizedlist>
-		  </para>
-		</section>
-
-		<section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Host_Limits">
-		  <title>Connection Limits by Host Name</title>
-		  <para>
-		    The 0.30 C++ Broker ACL module adds the ability to create allow and deny lists of the TCP/IP hosts from which users may connect. The rule accepts these forms:
-		  </para>
-		  <para>
-		    <programlisting>
+                    </programlisting>
+                  </para>
+                  <para>
+                    <itemizedlist>
+                      <listitem>
+                        User <literal>all</literal> receives the value passed by the command line switch <literal>--connection-limit-per-user</literal>.
+                      </listitem>
+                      <listitem>
+                        Values specified in the ACL rule for user <literal>all</literal> overwrite the value specified on the command line if any.
+                      </listitem>
+                      <listitem>
+                        Connection quotas values are determined by first searching for the authenticated user name. If that user name is not specified then the value for user <literal>all</literal>
+                        is used. If user <literal>all</literal> is not specified then the connection is denied.
+                      </listitem>
+                      <listitem>
+                        The connection quota values range from 0..65530 inclusive. A value of zero disables connections from that user.
+                      </listitem>
+                      <listitem>
+                        A user's quota may be specified many times in the ACL rule file. Only the last value specified is retained and enforced.
+                      </listitem>
+                      <listitem>
+                        Per-user connection quotas are disabled when two conditions are true: 1) No --connection-limit-per-user command line switch and 2) No <literal>quota connections</literal>
+                        rules in the ACL file. Per-user connections are always counted even if connection quotas are not enforced. This supports ACL file reloading that may subsequently
+                        enable per-user connection quotas.
+                      </listitem>
+                      <listitem>
+                        An ACL file reload may lower a user's connection quota value to a number lower than the user's current connection count. In that case the active connections
+                        remain unaffected. New connections are denied until that user closes enough of his connections so that his count falls below the configured limit.
+                      </listitem>
+                    </itemizedlist>
+                  </para>
+                </section>
+
+                <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Host_Limits">
+                  <title>Connection Limits by Host Name</title>
+                  <para>
+                    The 0.30 C++ Broker ACL module adds the ability to create allow and deny lists of the TCP/IP hosts from which users may connect. The rule accepts these forms:
+                  </para>
+                  <para>
+                    <programlisting>
     acl allow user create connection host=host1
     acl allow user create connection host=host1,host2
     acl deny  user create connection host=all
-		    </programlisting>
-		  </para>
-		  <para>
-		    Using the form <command>host=host1</command> specifies a single host. With a single host the name may resolve to multiple TCP/IP addresses. For example <emphasis>localhost</emphasis> resolves to both <emphasis>127.0.0.1</emphasis> and <emphasis>::1</emphasis> and possibly many other addresses. A connection from any of the addresses associated with this host match the rule and the connection is allowed or denied accordingly.
-		  </para>
-		  <para>
-		    Using the form <command>host=host1,host2</command> specifies a range of TCP/IP addresses. With a host range each host must resolve to a single TCP/IP address and the second address must be numerically larger than the first. A connection from any host where host &#62;= host1 and host &#60;= host2 match the rule and the connection is allowed or denied accordingly.
-		  </para>
-		  <para>
-		    Using the form <command>host=all</command> specifies all TCP/IP addresses. A connection from any host matches the rule and the connection is allowed or denied accordingly.
-		  </para>
-		  <para>
-		    Connection denial is only applied to incoming TCP/IP connections. Other socket types are not subjected to nor denied by range checks.
-		  </para>
-		  <para>
-		    The following example illustrates how this feature can be used.
-		  </para>
-		  <para>
-		    <programlisting>
+                    </programlisting>
+                  </para>
+                  <para>
+                    Using the form <command>host=host1</command> specifies a single host. With a single host the name may resolve to multiple TCP/IP addresses. For example <emphasis>localhost</emphasis> resolves to both <emphasis>127.0.0.1</emphasis> and <emphasis>::1</emphasis> and possibly many other addresses. A connection from any of the addresses associated with this host matches the rule and the connection is allowed or denied accordingly.
+                  </para>
+                  <para>
+                    Using the form <command>host=host1,host2</command> specifies a range of TCP/IP addresses. With a host range each host must resolve to a single TCP/IP address and the second address must be numerically larger than the first. A connection from any host where host &#62;= host1 and host &#60;= host2 match the rule and the connection is allowed or denied accordingly.
+                  </para>
+                  <para>
+                    Using the form <command>host=all</command> specifies all TCP/IP addresses. A connection from any host matches the rule and the connection is allowed or denied accordingly.
+                  </para>
+                  <para>
+                    Connection denial is only applied to incoming TCP/IP connections. Other socket types are not subjected to nor denied by range checks.
+                  </para>
+                  <para>
+                    Connection creation rules are divided into three categories:
+                  </para>
+                  <procedure>
+                    <step>
+                      <para>
+                        User = all, host != all
+                      </para>
+                      <para>
+                        These define global rules and are applied before any specific user rules. 
+                        These rules may be used to reject connections before any AMPQ protocol is run and before
+                        any user names have been negotiated.
+                      </para>
+                    </step>
+                    <step>
+                      <para>
+                        User != all, host = any legal host or 'all'
+                      </para>
+                      <para>
+                        These define user rules. These rules are applied after the global rules and
+                        after the AMQP protocol has negotiated user identities.
+                      </para>
+                    </step>
+                    <step>
+                      <para>
+                        User = all, host = all
+                      </para>
+                      <para>
+                        This rule defines what to do if no other rule matches. The default value is "ALLOW".
+                        Only one rule of this type may be defined.
+                      </para>
+                    </step>
+                  </procedure>
+
+                  <para>
+                    The following example illustrates how this feature can be used.
+                  </para>
+                  <para>
+                    <programlisting>
+    group admins alice bob chuck
+    group Company1 c1_usera c1_userb
+    group Company2 c2_userx c2_usery c2_userz
+    acl allow admins   create connection host=localhost
+    acl allow admins   create connection host=10.0.0.0,10.255.255.255
+    acl allow admins   create connection host=192.168.0.0,192.168.255.255
+    acl allow admins   create connection host=[fc00::],[fc00::ff]
+    acl allow Company1 create connection host=company1.com
+    acl deny  Company1 create connection host=all
+    acl allow Company2 create connection host=company2.com
+    acl deny  Company2 create connection host=all
+                    </programlisting>
+                  </para>
+                  <para>
+                    In this example admins may connect from localhost or from any system on the 10.0.0.0/24, 192.168.0.0/16, and fc00::/7 subnets. Company1 users may connect only from company1.com and Company2 users may connect only from company2.com.
+                    However, this example has a flaw. Although the admins group has specific hosts
+                    from which it is allowed to make connections it is not blocked from connecting
+                    from anywhere. The Company1 and Company2 groups are blocked appropriately.
+                    This ACL file may be rewritten as follows:
+                  </para>
+                  <para>
+                    <programlisting>
     group admins alice bob chuck
     group Company1 c1_usera c1_userb
     group Company2 c2_userx c2_usery c2_userz
@@ -1756,64 +2180,66 @@ property =  "name" | "durable" | "routingkey" | "autodelete" |
     acl allow Company1 create connection host=company1.com
     acl allow Company2 create connection host=company2.com
     acl deny  all      create connection host=all
-		    </programlisting>
-		  </para>
-		  <para>
-		    In this example admins may connect from localhost or from any system on the 10.0.0.0/24, 192.168.0.0/16, and fc00::/7 subnets. Company1 users may connect only from company1.com and Company2 users may connect only from company2.com. All other connections are denied.
-		  </para>
-		</section>
-
-		<section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Queue_Limits">
-		  <title>Queue Limits</title>
-		  <para>
-		    The ACL module creates a broker command line switch that set limits on the number of queues each user is allowed to create. This settings is not specified in the ACL file.
-		  </para>
-		  <para>
-		    <programlisting>
+                    </programlisting>
+                  </para>
+                  <para>
+                    Now admins are blocked from connecting from anywhere but their allowed
+                    hosts.
+                  </para>
+
+                </section>
+
+                <section id="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Queue_Limits">
+                  <title>Queue Limits</title>
+                  <para>
+                    The ACL module creates a broker command line switch that set limits on the number of queues each user is allowed to create. This settings is not specified in the ACL file.
+                  </para>
+                  <para>
+                    <programlisting>
     --max-queues-per-user N
-		    </programlisting>
-		  </para>
-		  <para>
-		    The queue limit is set for all users on the broker.
-		  </para>
-		  <para>
-		    The 0.22 C++ Broker ACL module accepts fine grained per-user queue limits through quota rules in the ACL file.
-		  </para>
-		  <para>
-		    <programlisting>
+                    </programlisting>
+                  </para>
+                  <para>
+                    The queue limit is set for all users on the broker.
+                  </para>
+                  <para>
+                    The 0.22 C++ Broker ACL module accepts fine grained per-user queue limits through quota rules in the ACL file.
+                  </para>
+                  <para>
+                    <programlisting>
     quota queues 10 admins userX@QPID
-		    </programlisting>
-		  </para>
-		  <para>
-		    <itemizedlist>
-		      <listitem>
-			User <literal>all</literal> receives the value passed by the command line switch <literal>--max-queues-per-user</literal>.
-		      </listitem>
-		      <listitem>
-			Values specified in the ACL rule for user <literal>all</literal> overwrite the value specified on the command line if any.
-		      </listitem>
-		      <listitem>
-			Queue quotas values are determined by first searching for the authenticated user name. If that user name is not specified then the value for user <literal>all</literal>
-			is used. If user <literal>all</literal> is not specified then the queue creation is denied.
-		      </listitem>
-		      <listitem>
-			The queue quota values range from 0..65530 inclusive. A value of zero disables queue creation by that user.
-		      </listitem>
-		      <listitem>
-			A user's quota may be specified many times in the ACL rule file. Only the last value specified is retained and enforced.
-		      </listitem>
-		      <listitem>
-			Per-user queue quotas are disabled when two conditions are true: 1) No --queue-limit-per-user command line switch and 2) No <literal>quota queues</literal>
-			rules in the ACL file. Per-user queue creations are always counted even if queue quotas are not enforced. This supports ACL file reloading that may subsequently
-			enable per-user queue quotas.
-		      </listitem>
-		      <listitem>
-			An ACL file reload may lower a user's queue quota value to a number lower than the user's current queue count. In that case the active queues
-			remain unaffected. New queues are denied until that user closes enough of his queues so that his count falls below the configured limit.
-		      </listitem>
-		    </itemizedlist>
-		  </para>
-		</section>
+                    </programlisting>
+                  </para>
+                  <para>
+                    <itemizedlist>
+                      <listitem>
+                        User <literal>all</literal> receives the value passed by the command line switch <literal>--max-queues-per-user</literal>.
+                      </listitem>
+                      <listitem>
+                        Values specified in the ACL rule for user <literal>all</literal> overwrite the value specified on the command line if any.
+                      </listitem>
+                      <listitem>
+                        Queue quotas values are determined by first searching for the authenticated user name. If that user name is not specified then the value for user <literal>all</literal>
+                        is used. If user <literal>all</literal> is not specified then the queue creation is denied.
+                      </listitem>
+                      <listitem>
+                        The queue quota values range from 0..65530 inclusive. A value of zero disables queue creation by that user.
+                      </listitem>
+                      <listitem>
+                        A user's quota may be specified many times in the ACL rule file. Only the last value specified is retained and enforced.
+                      </listitem>
+                      <listitem>
+                        Per-user queue quotas are disabled when two conditions are true: 1) No --queue-limit-per-user command line switch and 2) No <literal>quota queues</literal>
+                        rules in the ACL file. Per-user queue creations are always counted even if queue quotas are not enforced. This supports ACL file reloading that may subsequently
+                        enable per-user queue quotas.
+                      </listitem>
+                      <listitem>
+                        An ACL file reload may lower a user's queue quota value to a number lower than the user's current queue count. In that case the active queues
+                        remain unaffected. New queues are denied until that user closes enough of his queues so that his count falls below the configured limit.
+                      </listitem>
+                    </itemizedlist>
+                  </para>
+                </section>
 
 	      </section>