CONNACK Message not sent for Unauthorized Connect Request for Websocket

[ralight]

migrated from Bugzilla #484761
status UNCONFIRMED severity critical in component Mosquitto for 1.4
Reported in version 1.4 on platform PC
Assigned to: Roger Light

On 2015-12-21 08:43:30 -0500, koray sariteke wrote:

For Authentication, we implemented mosquitto_plugin.h functions.

When we Start mqtt broker in Websocket protocol, CONNACK with result code 5 IS NOT sent back to client. TCP client is disconnected by Mosquitto Server without information.

Up to MQTT RFC
http:https://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html#_Toc398718035

If a well formed CONNECT Packet is received by the Server, but the Server is unable to process it for some reason, then the Server SHOULD attempt to send a CONNACK packet containing the appropriate non-zero Connect return code from this table. If a server sends a CONNACK packet containing a non-zero return code it MUST then close the Network Connection [MQTT-3.2.2-5].

On 2015-12-21 09:02:10 -0500, koray sariteke wrote:

vi read_handle_server.c +364

ifdef REAL_WITH_TLS_PSK

            }

endif /* REAL_WITH_TLS_PSK */

    }else{

endif /* WITH_TLS */

            if(username_flag){
                    rc = mosquitto_unpwd_check(db, username, password);
                    switch(rc){
                            case MOSQ_ERR_SUCCESS:
                                    break;
                            case MOSQ_ERR_AUTH:
                                    _mosquitto_send_connack(context, 0, CONNACK_REFUSED_NOT_AUTHORIZED);
                                    mqtt3_context_disconnect(db, context);
                                    rc = 0;
                                    goto handle_connect_error;
                                    break;

if mqtt3_context_disconnect(db, context); line removed and rc set to 0, CONNACK sent to client with reason code 5 but TCP connection stays open which is not true state.

[ramarro123]

@ralight i know that this bug it's starting to age as a good wine, but i am pinging you to know if it will be closed as a non issue or if it's still in work.

i am affected from this bug unfortunately, reported on ngx-mqtt as an issue and linked here.

[PierreF]

This is still an issue on fixes and develop. To show the issue, the following Python client show the issue:

cat > /tmp/mosquitto.conf << EOF
listener 1884
protocol websockets
password_file /tmp/password
EOF

touch /tmp/password
mosquitto_passwd -b /tmp/password user pass
mosquitto -c /tmp/mosquitto.conf

import paho.mqtt.client as mqtt

def on_connect(client, userdata, flags, rc):
    print("Yes, got the connack with rc=%s" % rc)
    client.disconnect()

client = mqtt.Client(transport='websockets')
client.on_connect = on_connect
client.username_pw_set('user', 'bad')
client.connect("localhost", 1884)
client.loop_forever()

This will hang because connack is never received. With fix from PR #660 it will terminate and show "Yes, got the connack with rc=5"

[ralight]

This is now fixed in the fixes branch.