Eclipse Mosquitto™ is an open source (EPL/EDL licensed) message broker that implements the MQTT protocol versions 3.1 and 3.1.1. MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "Internet of Things" messaging such as with low power sensors or mobile devices such as phones, embedded computers or microcontrollers like the Arduino.

Mosquitto is an iot.eclipse.org project

Version 1.4.8 released

This is a security bugfix release. Any users of the “mount_point” feature are strongly advised to upgrade because versions prior to 1.4.8 allow clients to inject messages outside of their mount_point through the use of a Will.

Broker

  • Wills published by clients connected to a listener with mount_point defined
    now correctly obey the mount point. This was a potential security risk
    because it allowed clients to publish messages outside of their restricted
    mount point. This is only affects brokers where the mount_point option is in
    use. Closes #487178.
  • Fix detection of broken connections on Windows. Closes #485143.
  • Close stdin etc. when daemonised. Closes #485589.
  • Fix incorrect detection of FreeBSD and OpenBSD. Closes #485131.

Client library

  • mosq->want_write should be cleared immediately before a call to SSL_write,
    to allow clients using mosquitto_want_write() to get accurate results.

test6.mosquitto.org

Thanks to a short discussion on irc, test6.mosquitto.org now exists. This is a DNS entry that points to the same address as test.mosquitto.org, but only with an AAAA record. This means that test6.mosquitto.org can be used to test clients using IPv6 and to be sure that IPv6 is actually being used.

Version 1.4.7 released

This is a bugfix release. The changes below include the changes for 1.4.6, which wasn’t announced.

Broker

  • Add support for libwebsockets 1.6.

Client library

  • Fix _mosquitto_socketpair() on Windows, reducing the chance of delays when
    publishing. Closes #483979.

Clients

  • Fix “mosquitto_pub -l” stripping the final character on a line. Closes
    #483981.

If you want to use TLS certificates you’ve generated using the Let’s Encrypt service, this is how you should configure your listener (replace “example.com” with your own domain of course):

Then use the following for your mosquitto.conf:

listener 8883
cafile /etc/ssl/certs/DST_Root_CA_X3.pem
certfile /etc/letsencrypt/live/example.com/fullchain.pem
keyfile /etc/letsencrypt/live/example.com/privkey.pem

You need to be aware that current versions of mosquitto never update listener settings when running, so when you regenerate the server certificates you will need to completely restart the broker.

Version 1.4.5 released

This is a bugfix release:

Broker

  • Fix possible memory leak if bridge using SSL attempts to connect to a host that is not up.
  • Free unused topic tree elements (fix in 1.4.3 was incomplete). Closes
    #468987.

Clients

  • “mosquitto_pub -l” now no longer limited to 1024 byte lines. Closes #478917.

Version 1.4.4 released

This is a bugfix release.

  • Don’t leak sockets when outgoing bridge with multiple addresses cannot connect. Closes #477571.
  • Fix cross compiling of websockets. Closes #475807.
  • Fix memory free related crashes on openwrt and FreeBSD. Closes #475707.
  • Fix excessive calls to message retry check.

Version 1.4.3 released

This is a bugfix release.

Broker

  • Fix incorrect bridge notification on initial connection. Closes #467096.
  • Build fixes for OpenBSD.
  • Fix incorrect behaviour for autosave_interval, most noticable for autosave_interval=1. Closes #465438.
  • Fix handling of outgoing QoS>0 messages for bridges that could not be sent because the bridge connection was down.
  • Free unused topic tree elements. Closes #468987.
  • Fix some potential memory leaks. Closes #470253.
  • Fix potential crash on libwebsockets error.

Client library

  • Add missing error strings to mosquitto_strerror.
  • Handle fragmented TLS packets without a delay. Closes #470660.
  • Fix incorrect loop timeout being chosen when using threaded interface and keepalive = 0. Closes #471334.
  • Increment inflight messages count correctly. Closes #474935.

Clients

  • Report error string on connection failure rather than error code.

The current unreleased libwebsockets master branch defines the VERSION macro in its header files. I believe this to be a bug in libwebsockets.

This bug causes compilation of mosquitto with websockets support to fail.

Please use a released version of libwebsockets, either 1.2, 1.3 or 1.4. Mosquitto will compile with all of these versions.

I do not recommend using an unreleased version of libwebsockets, the project is not shy about making ABI/API incompatible changes between releases so it is impractical to provide support for.

Version 1.4.2 released

This is a bugfix release.

Broker

  • Fix bridge prefixes only working for the first outgoing message. Closes #464437.
  • Fix incorrect bridge connection notifications on local broker.
  • Fix persistent db writing on Windows. Closes #464779.
  • ACLs are now checked before sending a will message.
  • Fix possible crash when using bridges on Windows. Closes #465384.
  • Fix parsing of auth_opt_ arguments with extra spaces/tabs.
  • Broker will return CONNACK rc=5 when a username/password is not authorised. This was being incorrectly set as rc=4.
  • Fix handling of payload lengths>4096 with websockets.

Client library

  • Inflight message count wasn’t being decreased for outgoing messages using QoS 2, meaning that only up to 20 QoS 2 messages could be sent. This has been fixed. Closes #464436.
  • Fix CMake dependencies for C++ wrapper building. Closes #463884.
  • Fix possibility of select() being called with a socket that is >FD_SETSIZE. This is a fix for #464632 that will be followed up by removing the select() call in a future version.
  • Fix calls to mosquitto_connect*_async() not completing.

Version 1.4.1 released

This is a bugfix and security release. Users of mosquitto 1.4 are strongly advised to upgrade. Upgrading from earlier versions is recommended but not as important.

Broker

  • Fix possible crash under heavy network load. Closes #463241. This bug only affects version 1.4.
  • Fix possible crash when using pattern ACLs.
  • Fix problems parsing config strings with multiple leading spaces. Closes #462154.
  • Websockets clients are now periodically disconnected if they have not maintained their keepalive timer. Closes #461619.
  • Fix possible minor memory leak on acl parsing.

Client library

  • Inflight limits should only apply to outgoing messages. Closes #461620.
  • Fix reconnect bug on Windows. Closes #463000.
  • Return -1 on error from mosquitto_socket(). Closes #461705.
  • Fix crash on multiple calls to mosquitto_lib_init/mosquitto_lib_cleanup. Closes #462780.
  • Allow longer paths on Windows. Closes #462781.
  • Make _mosquitto_mid_generate() thread safe. Closes #463479.