Merge branch 'mqtt5' into develop

.gitignore

@@ -1,11 +1,17 @@
+*.db
+*.gcda
+*.gcno
+*.exe
 *.o
+*.old
+*.pyc
 *.so
-*.exe
-*.db
+*.vglog
+massif.out.*
+vglog*
+
 c/*.test
 cpp/*.test
-*.pyc
-*.vglog
 
 build/
 
@@ -50,5 +56,9 @@ test/ssl/*.csr
 test/lib/c/*.test
 test/lib/cpp/*.test
 
+test/unit/coverage.info
+test/unit/mosq_test
+test/unit/out
+
 www/cache/
 __pycache__

CMakeLists.txt

@@ -11,7 +11,7 @@ project(mosquitto)
 cmake_minimum_required(VERSION 2.8)
 # Only for version 3 and up. cmake_policy(SET CMP0042 NEW)
 
-set (VERSION 1.5.4)
+set (VERSION 1.5.90)
 
 add_definitions (-DCMAKE -DVERSION=\"${VERSION}\")
 
@@ -51,7 +51,7 @@ option(WITH_TLS_PSK
  "Include TLS-PSK support (requires WITH_TLS)?" ON)
 option(WITH_EC
  "Include Elliptic Curve support (requires WITH_TLS)?" ON)
-if (${WITH_TLS} STREQUAL ON)
+if (WITH_TLS)
  find_package(OpenSSL REQUIRED)
  add_definitions("-DWITH_TLS")
 
@@ -62,19 +62,19 @@ if (${WITH_TLS} STREQUAL ON)
  if (${WITH_EC} STREQUAL ON)
  add_definitions("-DWITH_EC")
  endif (${WITH_EC} STREQUAL ON)
-else (${WITH_TLS} STREQUAL ON)
+else (WITH_TLS)
  set (OPENSSL_INCLUDE_DIR "")
-endif (${WITH_TLS} STREQUAL ON)
+endif (WITH_TLS)
 
 option(WITH_SOCKS "Include SOCKS5 support?" ON)
-if (${WITH_SOCKS} STREQUAL ON)
+if (WITH_SOCKS)
  add_definitions("-DWITH_SOCKS")
-endif (${WITH_SOCKS} STREQUAL ON)
+endif (WITH_SOCKS)
 
 option(WITH_SRV "Include SRV lookup support?" OFF)
 
 option(WITH_THREADING "Include client library threading support?" ON)
-if (${WITH_THREADING} STREQUAL ON)
+if (WITH_THREADING)
  add_definitions("-DWITH_THREADING")
  if (WIN32)
  if (CMAKE_CL_64)
@@ -92,10 +92,10 @@ if (${WITH_THREADING} STREQUAL ON)
  endif()
  set (PTHREAD_INCLUDE_DIR "")
  endif (WIN32)
-else (${WITH_THREADING} STREQUAL ON)
+else (WITH_THREADING)
  set (PTHREAD_LIBRARIES "")
  set (PTHREAD_INCLUDE_DIR "")
-endif (${WITH_THREADING} STREQUAL ON)
+endif (WITH_THREADING)
 
 option(DOCUMENTATION "Build documentation?" ON)
 
@@ -106,9 +106,9 @@ option(DOCUMENTATION "Build documentation?" ON)
 add_subdirectory(lib)
 add_subdirectory(client)
 add_subdirectory(src)
-if (${DOCUMENTATION} STREQUAL ON)
+if (DOCUMENTATION)
  add_subdirectory(man)
-endif (${DOCUMENTATION} STREQUAL ON)
+endif (DOCUMENTATION)
 
 # ========================================
 # Install config file

ChangeLog.txt

@@ -1,6 +1,13 @@
 1.6 - 2018xxxx
 ==============
 
+Broker features:
+- Improved general support for broker generated client ids. Removed libuuid
+ dependency.
+- auto_id_prefix now defaults to 'auto-'.
+- Add max_keepalive option, to allow a maximum keepalive value to be set for
+ MQTT v5 clients only.
+
 Client library features:
 - Add mosquitto_subscribe_multiple() for sending subscriptions to multiple
  topics in one command.
@@ -9,6 +16,120 @@ Client features:
 - Add -E to mosquitto_sub, which causes it to exit immediately after having
  its subscriptions acknowledged. Use with -c to create a durable client
  session without requiring a message to be received.
+- -V now accepts `5, `311`, `31`, as well as `mqttv5` etc.
+
+Client fixes:
+- mosquitto_pub wouldn't always publish all messages when using `-l` and
+ QoS>0. This has been fixed.
+
+
+1.5.7 - 201902xx
+================
+
+Broker:
+- Fix build failure when using WITH_ADNS=yes
+- Ensure that an error occurs if `per_listener_settings true` is given after
+ other security options. Closes #1149.
+- Fix include_dir not sorting config files before loading. This was partially
+ fixed in 1.5 previously.
+
+Library:
+- Fix `mosquitto_topic_matches_sub()` not returning MOSQ_ERR_INVAL for
+ invalid subscriptions like `topic/#abc`. This only affects the return value,
+ not the match/no match result, which was already correct.
+
+Build:
+- Don't require C99 compiler.
+
+
+1.5.6 - 20190206
+================
+
+Security:
+- CVE-2018-12551: If Mosquitto is configured to use a password file for
+ authentication, any malformed data in the password file will be treated as
+ valid. This typically means that the malformed data becomes a username and no
+ password. If this occurs, clients can circumvent authentication and get access
+ to the broker by using the malformed username. In particular, a blank line
+ will be treated as a valid empty username. Other security measures are
+ unaffected. Users who have only used the mosquitto_passwd utility to create
+ and modify their password files are unaffected by this vulnerability.
+ Affects version 1.0 to 1.5.5 inclusive.
+- CVE-2018-12550: If an ACL file is empty, or has only blank lines or
+ comments, then mosquitto treats the ACL file as not being defined, which
+ means that no topic access is denied. Although denying access to all topics
+ is not a useful configuration, this behaviour is unexpected and could lead
+ to access being incorrectly granted in some circumstances. This is now
+ fixed. Affects versions 1.0 to 1.5.5 inclusive.
+- CVE-2018-12546. If a client publishes a retained message to a topic that
+ they have access to, and then their access to that topic is revoked, the
+ retained message will still be delivered to future subscribers. This
+ behaviour may be undesirable in some applications, so a configuration option
+ `check_retain_source` has been introduced to enforce checking of the
+ retained message source on publish.
+
+Broker:
+- Fixed comment handling for config options that have optional arguments.
+- Improved documentation around bridge topic remapping.
+- Handle mismatched handshakes (e.g. QoS1 PUBLISH with QoS2 reply) properly.
+- Fix spaces not being allowed in the bridge remote_username option. Closes
+ #1131.
+- Allow broker to always restart on Windows when using `log_dest file`. Closes
+ #1080.
+- Fix Will not being sent for Websockets clients. Closes #1143.
+- Windows: Fix possible crash when client disconnects. Closes #1137.
+- Fixed durable clients being unable to receive messages when offline, when
+ per_listener_settings was set to true. Closes #1081.
+- Add log message for the case where a client is disconnected for sending a
+ topic with invalid UTF-8. Closes #1144.
+
+Library:
+- Fix TLS connections not working over SOCKS.
+- Don't clear SSL context when TLS connection is closed, meaning if a user
+ provided an external SSL_CTX they have less chance of leaking references.
+
+Build:
+- Fix comparison of boolean values in CMake build. Closes #1101.
+- Fix compilation when openssl deprecated APIs are not available.
+ Closes #1094.
+- Man pages can now be built on any system. Closes #1139.
+
+
+1.5.5 - 20181211
+================
+
+Security:
+- If `per_listener_settings` is set to true, then the `acl_file` setting was
+ ignored for the "default listener" only. This has been fixed. This does not
+ affect any listeners defined with the `listener` option. Closes #1073.
+ This is now tracked as CVE-2018-20145.
+
+Broker:
+- Add `socket_domain` option to allow listeners to disable IPv6 support.
+ This is required to work around a problem in libwebsockets that means
+ sockets only listen on IPv6 by default if IPv6 support is compiled in.
+ Closes #1004.
+- When using ADNS, don't ask for all network protocols when connecting,
+ because this can lead to confusing "Protocol not supported" errors if the
+ network is down. Closes #1062.
+- Fix outgoing retained messages not being sent by bridges on initial
+ connection. Closes #1040.
+- Don't reload auth_opt_ options on reload, to match the behaviour of the
+ other plugin options. Closes #1068.
+- Print message on error when installing/uninstalling as a Windows service.
+- All non-error connect/disconnect messages are controlled by the
+ `connection_messages` option. Closes #772. Closes #613. Closes #537.
+
+Library:
+- Fix reconnect delay backoff behaviour. Closes #1027.
+- Don't call on_disconnect() twice if keepalive tests fail. Closes #1067.
+
+Client:
+- Always print leading zeros in mosquitto_sub when output format is hex.
+ Closes #1066.
+
+Build:
+- Fix building where TLS-PSK is not available. Closes #68.
 
 
 1.5.4 - 20181108

Makefile

@@ -81,3 +81,6 @@ copy : sign
  cd dist; scp *.html mosquitto:site/mosquitto.org/man/
  scp ChangeLog.txt mosquitto:site/mosquitto.org/
 
+coverage :
+ lcov --capture --directory . --output-file coverage.info
+ genhtml coverage.info --output-directory out

client/CMakeLists.txt

@@ -1,14 +1,15 @@
 include_directories(${mosquitto_SOURCE_DIR} ${mosquitto_SOURCE_DIR}/lib
- ${STDBOOL_H_PATH} ${STDINT_H_PATH} ${PTHREAD_INCLUDE_DIR})
+ ${STDBOOL_H_PATH} ${STDINT_H_PATH} ${PTHREAD_INCLUDE_DIR}
+ ${OPENSSL_INCLUDE_DIR})
 link_directories(${mosquitto_BINARY_DIR}/lib)
 
-set(shared_src client_shared.c client_shared.h)
+set(shared_src client_shared.c client_shared.h client_props.c)
 
-if (${WITH_SRV} STREQUAL ON)
+if (WITH_SRV)
  add_definitions("-DWITH_SRV")
-endif (${WITH_SRV} STREQUAL ON)
+endif (WITH_SRV)
 
-add_executable(mosquitto_pub pub_client.c ${shared_src})
+add_executable(mosquitto_pub pub_client.c pub_shared.c ${shared_src})
 add_executable(mosquitto_sub sub_client.c sub_client_output.c ${shared_src})
 
 

client/Makefile

@@ -20,21 +20,24 @@ static : static_pub static_sub
  # This makes mosquitto_pub/sub versions that are statically linked with
  # libmosquitto only.
 
-static_pub : pub_client.o client_shared.o ../lib/libmosquitto.a
+static_pub : pub_client.o pub_shared.o client_props.o client_shared.o ../lib/libmosquitto.a
  ${CROSS_COMPILE}${CC} $^ -o mosquitto_pub ${CLIENT_LDFLAGS} -lssl -lcrypto -lpthread
 
-static_sub : sub_client.o sub_client_output.o client_shared.o ../lib/libmosquitto.a
+static_sub : sub_client.o sub_client_output.o client_props.o client_shared.o ../lib/libmosquitto.a
  ${CROSS_COMPILE}${CC} $^ -o mosquitto_sub ${CLIENT_LDFLAGS} -lssl -lcrypto -lpthread
 
-mosquitto_pub : pub_client.o client_shared.o
+mosquitto_pub : pub_client.o pub_shared.o client_shared.o client_props.o
  ${CROSS_COMPILE}${CC} $^ -o $@ ${CLIENT_LDFLAGS}
 
-mosquitto_sub : sub_client.o sub_client_output.o client_shared.o
+mosquitto_sub : sub_client.o sub_client_output.o client_shared.o client_props.o
  ${CROSS_COMPILE}${CC} $^ -o $@ ${CLIENT_LDFLAGS}
 
 pub_client.o : pub_client.c ${SHARED_DEP}
  ${CROSS_COMPILE}${CC} -c $< -o $@ ${CLIENT_CFLAGS}
 
+pub_shared.o : pub_shared.c ${SHARED_DEP}
+ ${CROSS_COMPILE}${CC} -c $< -o $@ ${CLIENT_CFLAGS}
+
 sub_client.o : sub_client.c ${SHARED_DEP}
  ${CROSS_COMPILE}${CC} -c $< -o $@ ${CLIENT_CFLAGS}
 
@@ -44,6 +47,9 @@ sub_client_output.o : sub_client_output.c ${SHARED_DEP}
 client_shared.o : client_shared.c client_shared.h
  ${CROSS_COMPILE}${CC} -c $< -o $@ ${CLIENT_CFLAGS}
 
+client_props.o : client_props.c client_shared.h
+ ${CROSS_COMPILE}${CC} -c $< -o $@ ${CLIENT_CFLAGS}
+
 ../lib/libmosquitto.so.${SOVERSION} :
  $(MAKE) -C ../lib
 
@@ -62,4 +68,4 @@ uninstall :
 reallyclean : clean
 
 clean : 
- -rm -f *.o mosquitto_pub mosquitto_sub
+ -rm -f *.o mosquitto_pub mosquitto_sub *.gcda *.gcno