Version 1.5.5 released

This is a bugfix and security release.

Version 1.5.5 changes

Security

  • If per_listener_settings is set to true, then the acl_file setting was ignored for the "default listener" only. This has been fixed. This does not affect any listeners defined with the listener option. Closes #1073.

Broker

  • Add socket_domain option to allow listeners to disable IPv6 support. This is required to work around a problem in libwebsockets that means sockets only listen on IPv6 by default if IPv6 support is compiled in. Closes #1004.
  • When using ADNS, don't ask for all network protocols when connecting, because this can lead to confusing "Protocol not supported" errors if the network is down. Closes #1062.
  • Fix outgoing retained messages not being sent by bridges on initial connection. Closes #1040.
  • Don't reload auth_opt_ options on reload, to match the behaviour of the other plugin options. Closes #1068.
  • Print message on error when installing/uninstalling as a Windows service.
  • All non-error connect/disconnect messages are controlled by the connection_messages option. Closes #772. Closes #613. Closes #537.

Library

  • Fix reconnect delay backoff behaviour. Closes #1027.
  • Don't call on_disconnect() twice if keepalive tests fail. Closes #1067.

Client

  • Always print leading zeros in mosquitto_sub when output format is hex. Closes #1066.

Build

  • Fix building where TLS-PSK is not available. Closes #68.

MQTT 5 progress

Development of support for MQTT 5 is ongoing and making good progress, but has been substantially delayed due to other non-Mosquitto work having to take priority.

It is possible to test the current state of MQTT 5 support by using the mqtt5 branch of the repository. Please note that this is very much a work in progress, so parts are incomplete and interfaces may yet change. The client library in particular has had to have an increase in functions available in order to provide the features needed whilst providing backwards compatibility. Part of the plan for the 2.0 release, which will follow after 1.6, is to consolidate the libmosquitto API with breaking changes. There are more details on the roadmap.

Current features include:

  • Support for all incoming and outgoing packets, although not everything is processed.
  • Support for sending and receiving all properties, with not all properties processed.
  • Client support for setting properties
  • Request/response support (client cannot process incoming correlation data)
  • Retain availability
  • Message expiry interval support
  • Server support for assigned client identifiers
  • Payload format indicator support
  • Content-type support
  • Basic topic alias support from client to broker
  • Lots of new tests

Both mosquitto_pub and mosquitto_sub support setting properties on the command line, for example:

mosquitto_sub -t topic -v -D connect session-expiry-interval 60 -D connect user-property key value -D subscribe user-property sub-key sub-value
mosquitto_pub -t topic -m '{"key":"value"}' -D publish content-type "application/json"
./sensor_read.sh | mosquitto_pub -t topic -l  -D publish topic-alias 1

Further updates will be posted when more features are available.


Version 1.5.4 released

This is a bugfix and security release.

Version 1.5.4 changes

Security

  • When using a TLS enabled websockets listener with require_certificate enabled, the mosquitto broker does not correctly verify client certificates. This is now fixed. All other security measures operate as expected, and in particular non-websockets listeners are not affected by this. Closes #996.

Broker

  • Process all pending messages even when a client has disconnected. This means a client that send a PUBLISH then DISCONNECT quickly, then disconnects will have its DISCONNECT message processed properly and so no Will will be sent. Closes #7.
  • $SYS/broker/clients/disconnected should never be negative. Closes #287.
  • Give better error message if a client sends a password without a username. Closes #1015.
  • Fix bridge not honoring restart_timeout. Closes #1019.
  • Don't disconnect a client if an auth plugin denies access to SUBSCRIBE. Closes #1016.

Library

  • Fix memory leak that occurred if mosquitto_reconnect() was used when TLS errors were present. Closes #592.
  • Fix TLS connections when using an external event loop with mosquitto_loop_read() and mosquitto_write(). Closes #990.

Build

  • Fix clients not being compiled with threading support when using CMake. Closes #983.
  • Header fixes for FreeBSD. Closes #977.
  • Use _GNU_SOURCE to fix build errors in websockets and getaddrinfo usage. Closes [#862] and #933.
  • Fix builds on QNX 7.0.0. Closes #1018.

Security advisory: CVE-2018-12543

Mosquitto 1.5.3 has been released to address a security vulnerability. It also includes other bug fixes.

CVE-2018-12543

A vulnerability exists in Mosquitto versions 1.5 to 1.5.2 inclusive, known as CVE-2018-12543.

If a message received by the broker has a topic that begins with $, but that does not begin $SYS, an assert is triggered that should otherwise not be accessible, causing Mosquitto to exit.

The issue is fixed in Mosquitto 1.5.3. Patches for older versions are available at https://mosquitto.org/files/cve/2018-12543

The fix addresses the problem by reverting a commit that intended to remove some unused checks, but also stopped part of the topic hierarchy being created.

Version 1.5.3 Changes

The complete list of fixes addressed in version 1.5.3 is:

Security

  • Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit.

Broker

  • Elevate log level to warning for situation when socket limit is hit.
  • Remove requirement to use user root in snap package config files.
  • Fix retained messages not sent by bridges on outgoing topics at the first connection. Closes #701.
  • Documentation fixes. Closes #520, #600.
  • Fix duplicate clients being added to by_id hash before the old client was removed. Closes #645.
  • Fix Windows version not starting if include_dir did not contain any files. Closes #566.

Build

  • Various fixes to ease building.

Version 1.5.2 released

This is a bugfix release.

Version 1.5.2 changes

Broker

  • Fix build when using WITH_ADNS=yes.
  • Fix incorrect call to setsockopt() for TCP_NODELAY. Closes #941.
  • Fix excessive CPU usage when the number of sockets exceeds the system limit. Closes #948.
  • Fix for bridge connections when using WITH_ADNS=yes.
  • Fix round_robin false behaviour. Closes #481.
  • Fix segfault on HUP when bridges and security options are configured. Closes #965.

Library

  • Fix situation where username and password is used with SOCKS5 proxy. Closes #927.
  • Fix SOCKS5 behaviour when passing IP addresses. Closes #927.

Build

  • Make it easier to build without bundled uthash.h using WITH_BUNDLED_DEPS=no.
  • Fix build with OPENSSL_NO_ENGINE. Closes #932.

Version 1.5.1 released

This is a bugfix release.

Packaging changes

  • The snap package now has support for websockets included.
  • The Windows packages have changed.
    • Support for Windows XP was dropped in Mosquitto 1.5, so the need for the Cygwin build has gone, and this has been dropped.
    • There are now 64-bit and 32-bit native packages.
    • Websockets support is included.
    • Threading support is not included in libmosquitto to simplify installation, alternative solutions are being looked into for the future.
    • The only external dependency is now OpenSSL.

Version 1.5.1 changes

Broker

  • Fix plugin cleanup function not being called on exit of the broker. Closes #900.
  • Print more OpenSSL errors when loading certificates/keys fail.
  • Use AF_UNSPEC etc. instead of PF_UNSPEC to comply with POSIX. Closes #863.
  • Remove use of AI_ADDRCONFIG, which means the broker can be used on systems where only the loopback interface is defined. Closes #869, Closes #901.
  • Fix IPv6 addresses not being able to be used as bridge addresses. Closes #886.
  • All clients now time out if they exceed their keepalive*1.5, rather than just reach it. This was inconsistent in two places.
  • Fix segfault on startup if bridge CA certificates could not be read. Closes #851.
  • Fix problem opening listeners on Pi caused by unsigned char being default. Found via #849.
  • ACL patterns that do not contain either %c or %u now produce a warning in the log. Closes #209.
  • Fix bridge publishing failing when per_listener_settings was true. Closes #860.
  • Fix use_identity_as_username true not working. Closes #833.
  • Fix UNSUBACK messages not being logged. Closes #903.
  • Fix possible endian issue when reading the memory_limit option.
  • Fix building for libwebsockets < 1.6.
  • Fix accessor functions for username and client id when used in plugin auth check.

Library

  • Fix some places where return codes were incorrect, including to the on_disconnect() callback. This has resulted in two new error codes, MOSQ_ERR_KEEPALIVE and MOSQ_ERR_LOOKUP.
  • Fix connection problems when mosquitto_loop_start() was called before mosquitto_connect_async(). Closes #848.

Clients

  • When compiled using WITH_TLS=no, the default port was incorrectly being set to -1. This has been fixed.
  • Fix compiling on Mac OS X <10.12. Closes #813 and #240.

Build

  • Fixes for building on NetBSD. Closes #258.
  • Fixes for building on FreeBSD.
  • Add support for compiling with static libwebsockets library.

Updated Debian Repository Backend

The backend software for administering the Debian repository at https://repo.mosquitto.org/ has been migrated from reprepro to aptly. This has the benefit of allowing multiple versions of a package to remain in the repository.

For mosquitto, this now means that old versions of the Debian packages will remain available even after newer versions are published, and so you can depend on a particular version. The recommendation is always to use the latest version of course.

This change should be transparent to all current users, but there is the possibility that something is different between the two repository tools. If you do find a problem, please let us know.

The repository now has builds for versions 1.4.15 and 1.5.


Press release

I am pleased to announce that I am being paid to work on Mosquitto by Cedalo AG. I will be leaving my current job at the end of June this year, but have already started work for Cedalo on a limited basis.

The press release for this change is below:

New 1.5 release, MQTT 5.0 roadmap and commercial sponsor for Open-Source Eclipse Mosquitto MQTT Broker

Open-Source MQTT Broker Version 1.5 released – Estimate for availability of MQTT 5.0 compliant version – German based Cedalo AG becomes commercial sponsor for future Mosquitto Open Source development

A new version of the open source Eclipse Mosquitto MQTT broker is available on the Mosquitto website at mosquitto.org. Mosquitto version 1.5 brings a host of changes to the broker, including performance improvements and more flexible authentication and access control, as well as numerous bug fixes. The client library has added some helper functions to allow the creation of extremely simple MQTT clients.

The initiator and core developer of the Mosquitto project is now employed by the German based company Cedalo AG (www.cedalo.com). Cedalo has hired Roger Light to sponsor the further development of Mosquitto and to accelerate the public availability of a powerful MQTT broker. Cedalo is the creator of the end-user oriented IoT modelling tool “Streamsheets”.

With the new sponsorship the project is now able to accelerate the path towards new releases. The next version of Mosquitto will add support for MQTT version 5, which is the most substantial revision of the protocol since the first public specification was released. MQTT v5 adds error reporting, enhancements for scalability at the server side, features to help resource constrained clients, and extensible metadata - which is used amongst other things to introduce support for a request/response capability.

The MQTT v5 compliant release is planned for the end of August 2018.

Press Contact: Cedalo AG 79098 Freiburg, Schnewlinstr. 6

Kristian Raue Mail: presse@cedalo.com


Version 1.5 released

1.5 - 20180502

This is a features release. Updated binaries will be available shortly.

Security

  • Fix memory leak that could be caused by a malicious CONNECT packet. This does not yet have a CVE assigned. Closes #533493 (on Eclipse bugtracker)

Broker features

  • Add per_listener_settings to allow authentication and access control to be per listener.
  • Add limited support for reloading listener settings. This allows settings for an already defined listener to be reloaded, but port numbers must not be changed.
  • Add ability to deny access to SUBSCRIBE messages as well as the current read/write accesses. Currently for auth plugins only.
  • Reduce calls to malloc through the use of UHPA.
  • Outgoing messages with QoS>1 are no longer retried after a timeout period. Messages will be retried when a client reconnects. This change in behaviour can be justified by considering when the timeout may have occurred.
  • If a connection is unreliable and has dropped, but without one end noticing, the messages will be retried on reconnection. Sending additional PUBLISH or PUBREL would not have changed anything.
  • If a client is overloaded/unable to respond/has a slow connection then sending additional PUBLISH or PUBREL would not help the client catch up. Once the backlog has cleared the client will respond. If it is not able to catch up, sending additional duplicates would not help either.
  • Add use_subject_as_username option for certificate based client authentication to use the entire certificate subject as a username, rather than just the CN. Closes #469467.
  • Change sys tree printing output. This format shouldn't be relied upon and may change at any time. Closes #470246.
  • Minimum supported libwebsockets version is now 1.3.
  • Add systemd startup notification and services. Closes #471053.
  • Reduce unnecessary malloc and memcpy when receiving a message and storing it. Closes #470258.
  • Support for Windows XP has been dropped.
  • Bridge connections now default to using MQTT v3.1.1.
  • mosquitto_db_dump tool can now output some stats on clients.
  • Perform utf-8 validation on incoming will, subscription and unsubscription topics.
  • new $SYS/broker/store/messages/count (deprecates $SYS/broker/messages/stored)
  • new $SYS/broker/store/messages/bytes
  • max_queued_bytes feature to limit queues by real size rather than than just message count. Closes Eclipse #452919 or Github #100
  • Add support for bridges to be configured to only send notifications to the local broker.
  • Add set_tcp_nodelay option to allow Nagle's algorithm to be disabled on client sockets. Closes #433.
  • The behaviour of allow_anonymous has changed. In the old behaviour, the default if not set was to allow anonymous access. The new behaviour is to default is to allow anonymous access unless another security option is set. For example, if password_file is set and allow_anonymous is not set, then anonymous access will be denied. It is still possible to allow anonymous access by setting it explicitly.

Broker fixes

  • Fix UNSUBSCRIBE with no topic is accepted on MQTT 3.1.1. Closes #665.
  • Produce an error if two bridges share the same local_clientid.
  • Miscellaneous fixes on Windows.
  • queue_qos0_messages was not observing max_queued_** limits
  • When using the include_dir configuration option sort the files alphabetically before loading them. Closes #17.
  • IPv6 is no longer disabled for websockets listeners.
  • Remove all build timestamp information including $SYS/broker/timestamp. Closes #651.
  • Correctly handle incoming strings that contain a NULL byte. Closes #693.
  • Use constant time memcmp for password comparisons.
  • Fix incorrect PSK key being used if it had leading zeroes.
  • Fix memory leak if a client provided a username/password for a listener with use_identity_as_username configured.
  • Fix use_identity_as_username not working on websockets clients.
  • Don't crash if an auth plugin returns MOSQ_ERR_AUTH for a username check on a websockets client. Closes #490.
  • Fix 08-ssl-bridge.py test when using async dns lookups. Closes #507.
  • Lines in the config file are no longer limited to 1024 characters long. Closes #652.
  • Fix $SYS counters of messages and bytes sent when message is sent over a Websockets. Closes #250.
  • Fix upgrade_outgoing_qos for retained message. Closes #534.
  • Fix CONNACK message not being sent for unauthorised connect on websockets. Closes #8.
  • Maximum connections on Windows increased to 2048.
  • When a client with an in-use client-id connects, if the old client has a will, send the will message. Closes #26.
  • Fix parsing of configuration options that end with a space. Closes #804.

Client library features

  • Outgoing messages with QoS>1 are no longer retried after a timeout period. Messages will be retried when a client reconnects.
  • DNS-SRV support is now disabled by default.
  • Add mosquitto_subscribe_simple() This is a helper function to make retrieving messages from a broker very straightforward. Examples of its use are in examples/subscribe_simple.
  • Add mosquitto_subscribe_callback() This is a helper function to make processing messages from a broker very straightforward. An example of its use is in examples/subscribe_simple.
  • Connections now default to using MQTT v3.1.1.
  • Add mosquitto_validate_utf8() to check whether a string is valid UTF-8 according to the UTF-8 spec and to the additional restrictions imposed by the MQTT spec.
  • Topic inputs are checked for UTF-8 validity.
  • Add mosquitto_userdata function to allow retrieving the client userdata member variable. Closes #111.
  • Add mosquitto_pub_topic_check2(), mosquitto_sub_topic_check2(), and mosquitto_topic_matches_sub2() which are identical to the similarly named functions but also take length arguments.
  • Add mosquitto_connect_with_flags_callback_set(), which allows a second connect callback to be used which also exposes the connect flags parameter. Closes #738 and #128.
  • Add MOSQ_OPT_SSL_CTX option to allow a user specified SSL_CTX to be used instead of the one generated by libmosquitto. This allows greater control over what options can be set. Closes #715.
  • Add MOSQ_OPT_SSL_CTX_WITH_DEFAULTS to work with MOSQ_OPT_SSL_CTX and have the default libmosquitto SSL_CTX configuration applied to the user provided SSL_CTX. Closes #567.

Client library fixes

  • Fix incorrect PSK key being used if it had leading zeroes.
  • Initialise "result" variable as soon as possible in mosquitto_topic_matches_sub. Closes #654.
  • No need to close socket again if setting non-blocking failed. Closes #649.
  • Fix mosquitto_topic_matches_sub() not correctly matching foo/bar against foo/+/#. Closes #670.
  • SNI host support added.

Client features

  • Add -F to mosquitto_sub to allow the user to choose the output format.
  • Add -U to mosquitto_sub for unsubscribing from topics.
  • Add -c (clean session) to mosquitto_pub.
  • Add --retained-only to mosquitto_sub to exit after receiving all retained messages.
  • Add -W to allow mosquitto_sub to stop processing incoming messages after a timeout.
  • Connections now default to using MQTT v3.1.1.
  • Default to using port 8883 when using TLS.
  • mosquitto_sub doesn't continue to keep connecting if CONNACK tells it the connection was refused.

Client fixes

  • Correctly handle empty files with mosquitto_pub -l. Closes #676.

Build

  • Add WITH_STRIP option (defaulting to "no") that when set to "yes" will strip executables and shared libraries when installing.
  • Add WITH_STATIC_LIBRARIES (defaulting to "no") that when set to "yes" will build and install static versions of the client libraries.
  • Don't run TLS-PSK tests if TLS-PSK disabled at compile time. Closes #636.
  • Support for openssl versions 1.0.0 and 1.0.1 has been removed as these are no longer supported by openssl.

Documentation

  • Replace mentions of deprecated c_rehash with openssl rehash.

Security advisory: CVE-2017-7651, CVE-2017-7652

Mosquitto 1.4.15 has been released to address two security vulnerabilities.

CVE-2017-7651

A vulnerability exists in all Mosquitto versions up to and including 1.4.14 known as CVE-2017-7651.

Unauthenticated clients can send a crafted CONNECT packet which causes large amounts of memory use in the broker. If multiple clients do this, an out of memory situation can occur and the system may become unresponsive or the broker will be killed by the operating system.

The issue is fixed in Mosquitto 1.4.15. Patches for older versions are available at https://mosquitto.org/files/cve/2017-7651

The fix addresses the problem by limiting the permissible size for CONNECT packet, and by adding a memory_limit configuration option that allows the broker to self limit the amount of memory it uses.

Thanks to Felipe Balabanian for finding this vulnerability and responsibly reporting it.

CVE-2017-7652

A vulnerability exists in Mosquitto versions 1.0 to 1.4.14 inclusive known as CVE-2017-7652.

If the broker has exhausted all of its free sockets/file descriptors and then a SIGHUP signal is received to trigger reloading of the configuration, then the reloading will fail. This results in many of the configuration options, including security options, being set to their default value. This means that authorisation and access control may no longer be in place.

The issue is fixed in Mosquitto 1.4.15. Patches for older versions are available at https://mosquitto.org/files/cve/2017-7652

The fix addresses the problem by only copying the new configuration options to the in use configuration after a successful reload has taken place.

Version 1.4.15 Changes

The complete list of fixes addressed in version 1.4.15 is:

Security

  • Fix CVE-2017-7652. If a SIGHUP is sent to the broker when there are no more file descriptors, then opening the configuration file will fail and security settings will be set back to their default values.
  • Fix CVE-2017-7651. Unauthenticated clients can cause excessive memory use by setting "remaining length" to be a large value. This is now mitigated by limiting the size of remaining length to valid values. A memory_limit configuration option has also been added to allow the overall memory used by the broker to be limited.

Broker

  • Use constant time memcmp for password comparisons.
  • Fix incorrect PSK key being used if it had leading zeroes.
  • Fix memory leak if a client provided a username/password for a listener with use_identity_as_username configured.
  • Fix use_identity_as_username not working on websockets clients.
  • Don't crash if an auth plugin returns MOSQ_ERR_AUTH for a username check on a websockets client. Closes #490.
  • Fix 08-ssl-bridge.py test when using async dns lookups. Closes #507.
  • Lines in the config file are no longer limited to 1024 characters long. Closes #652.
  • Fix $SYS counters of messages and bytes sent when message is sent over a Websockets. Closes #250.
  • Fix upgrade_outgoing_qos for retained message. Closes #534.
  • Fix CONNACK message not being sent for unauthorised connect on websockets. Closes #8.

Client library

  • Fix incorrect PSK key being used if it had leading zeroes.
  • Initialise "result" variable as soon as possible in mosquitto_topic_matches_sub. Closes #654.
  • No need to close socket again if setting non-blocking failed. Closes #649.
  • Fix mosquitto_topic_matches_sub() not correctly matching foo/bar against foo/+/#. Closes #670.

Clients

  • Correctly handle empty files with mosquitto_pub -l. Closes #676.

Build

  • Don't run TLS-PSK tests if TLS-PSK disabled at compile time. Closes #636.