Merge branch 'master' into develop

2026-09-26 12:27:28 +08:00 · 2021-09-07 19:17:11 +01:00
parent 76c9e44deb 9afeeb1a56
commit aa29b45e70
151 changed files with 7204 additions and 2243 deletions
@@ -6,7 +6,7 @@

 cmake_minimum_required(VERSION 3.10)

-set (VERSION 2.0.11)
+set (VERSION 2.0.99)
 project(mosquitto
 	VERSION ${VERSION}
 	DESCRIPTION "Eclipse Mosquitto"
@@ -70,6 +70,69 @@ Client library:
  `%u` patterns for client id / username substitution.
 - Performance: reduce memory allocations when sending packets.

+
+2.0.12 - 2021-08-31
+===================
+
+Security:
+- An MQTT v5 client connecting with a large number of user-property properties
+  could cause excessive CPU usage, leading to a loss of performance and
+  possible denial of service. This has been fixed.
+- Fix `max_keepalive` not applying to MQTT v3.1.1 and v3.1 connections.
+  These clients are now rejected if their keepalive value exceeds
+  max_keepalive. This option allows CVE-2020-13849, which is for the MQTT
+  v3.1.1 protocol itself rather than an implementation, to be addressed.
+- Using certain listener related configuration options e.g. `cafile`, that
+  apply to the default listener without defining any listener would cause a
+  remotely accessible listener to be opened that was not confined to the local
+  machine but did have anonymous access enabled, contrary to the
+  documentation. This has been fixed. Closes #2283.
+- CVE-2021-34434: If a plugin had granted ACL subscription access to a
+  durable/non-clean-session client, then removed that access, the client would
+  keep its existing subscription. This has been fixed.
+- Incoming QoS 2 messages that had not completed the QoS flow were not being
+  checked for ACL access when a clean session=False client was reconnecting.
+  This has been fixed.
+
+Broker:
+- Fix possible out of bounds memory reads when reading a corrupt/crafted
+  configuration file. Unless your configuration file is writable by untrusted
+  users this is not a risk. Closes #567213.
+- Fix `max_connections` option not being correctly counted.
+- Fix TLS certificates and TLS-PSK not being able to be configured at the same
+  time.
+- Disable TLS v1.3 when using TLS-PSK, because it isn't correctly configured.
+- Fix `max_keepalive` not applying to MQTT v3.1.1 and v3.1 connections.
+  These clients are now rejected if their keepalive value exceeds
+  max_keepalive. This option allows CVE-2020-13849, which is for the MQTT
+  v3.1.1 protocol itself rather than an implementation, to be addressed.
+- Fix broker not quiting if e.g. the `password_file` is specified as a
+  directory. Closes #2241.
+- Fix listener mount_point not being removed on outgoing messages.
+  Closes #2244.
+- Strict protocol compliance fixes, plus test suite.
+- Fix $share subscriptions not being recovered for durable clients that
+  reconnect.
+- Update plugin configuration documentation. Closes #2286.
+
+Client library:
+- If a client uses TLS-PSK then force the default cipher list to use "PSK"
+  ciphers only. This means that a client connecting to a broker configured
+  with x509 certificates only will now fail. Prior to this, the client would
+  connect successfully without verifying certificates, because they were not
+  configured.
+- Disable TLS v1.3 when using TLS-PSK, because it isn't correctly configured.
+- Threaded mode is deconfigured when the mosquitto_loop_start() thread ends,
+  which allows mosquitto_loop_start() to be called again. Closes #2242.
+- Fix MOSQ_OPT_SSL_CTX not being able to be set to NULL. Closes #2289.
+- Fix reconnecting failing when MOSQ_OPT_TLS_USE_OS_CERTS was in use, but none
+  of capath, cafile, psk, nor MOSQ_OPT_SSL_CTX were set, and
+  MOSQ_OPT_SSL_CTX_WITH_DEFAULTS was set to the default value of true.
+  Closes #2288.
+
+Apps:
+- Fix `mosquitto_ctrl dynsec setDefaultACLAccess` command not working.
+
 Clients:
 - Add `-o` option for all clients loading options from a specific file.
 - Add `--no-tls` option for all clients which disables all TLS options for
@@ -83,6 +146,14 @@ Clients:
  not required in all situations.
 - mosquitto_sub and mosquitto_rr now open stdout in binary mode on Windows
  so binary payloads are not modified when printing.
+- Document TLS certificate behaviour when using `-p 8883`.
+
+Build:
+- Fix installation using WITH_TLS=no. Closes #2281.
+- Fix builds with libressl 3.4.0. Closes #2198.
+- Remove some unnecessary code guards related to libressl.
+- Fix printf format build warning on MIPS. Closes #2271.
+


 2.0.11 - 2021-06-08
@@ -104,6 +175,7 @@ Broker:
  reconnecting. Closes #2173.
 - Fix QoS 0 messages not being queued when `queue_qos0_messages` was enabled.
  Closes #2224.
+- Fix openssl not being linked to dynamic security plugin. Closes #2277.

 Clients:
 - If sending mosquitto_sub output to a pipe, mosquitto_sub will now detect
@@ -116,7 +188,7 @@ Clients:
 ==================

 Security:
- CVE-2021-23980: If an authenticated client connected with MQTT v5 sent a
+- CVE-2021-28166: If an authenticated client connected with MQTT v5 sent a
  malformed CONNACK message to the broker a NULL pointer dereference occurred,
  most likely resulting in a segfault.
  Affects versions 2.0.0 to 2.0.9 inclusive.
@@ -124,7 +196,7 @@ Security:
 Broker:
 - Don't over write new receive-maximum if a v5 client connects and takes over
  an old session. Closes #2134.
- Fix CVE-xxxx-xxxx. Closes #2163.
+- Fix CVE-2021-28166. Closes #2163.

 Clients:
 - Set `receive-maximum` to not exceed the `-C` message count in mosquitto_sub
@@ -1337,8 +1409,8 @@ Build:
 ==============

 Security:
- Fix memory leak that could be caused by a malicious CONNECT packet. This
-  does not yet have a CVE assigned. Closes #533493 (on Eclipse bugtracker)
+- Fix memory leak that could be caused by a malicious CONNECT packet.
+  CVE-2017-7654. Closes #533493 (on Eclipse bugtracker)

 Broker features:
 - Add per_listener_settings to allow authentication and access control to be
@@ -129,7 +129,7 @@ static int dump__cfg_chunk_process(FILE *db_fd, uint32_t length)
 	if(do_print) printf("\tShutdown: %d\n", chunk.shutdown);
 	if(do_print) printf("\tDB ID size: %d\n", chunk.dbid_size);
 	if(chunk.dbid_size != sizeof(dbid_t)){
-		fprintf(stderr, "Error: Incompatible database configuration (dbid size is %d bytes, expected %ld)",
+		fprintf(stderr, "Error: Incompatible database configuration (dbid size is %d bytes, expected %zu)",
 				chunk.dbid_size, sizeof(dbid_t));
 		fclose(db_fd);
 		return 1;
@@ -457,6 +457,7 @@ static void dynsec__payload_callback(struct mosq_ctrl *ctrl, long payloadlen, co
 static int dynsec__set_default_acl_access(int argc, char *argv[], cJSON *j_command)
 {
 	char *acltype, *access;
+	bool b_access;
 	cJSON *j_acls, *j_acl;

 	if(argc == 2){
@@ -474,7 +475,11 @@ static int dynsec__set_default_acl_access(int argc, char *argv[], cJSON *j_comma
 		return MOSQ_ERR_INVAL;
 	}

-	if(strcasecmp(access, "allow") && strcasecmp(access, "deny")){
+	if(!strcasecmp(access, "allow")){
+		b_access = true;
+	}else if(!strcasecmp(access, "deny")){
+		b_access = false;
+	}else{
 		fprintf(stderr, "Error: access must be \"allow\" or \"deny\".\n");
 		return MOSQ_ERR_INVAL;
 	}
@@ -492,7 +497,7 @@ static int dynsec__set_default_acl_access(int argc, char *argv[], cJSON *j_comma
 	}
 	cJSON_AddItemToArray(j_acls, j_acl);
 	if(cJSON_AddStringToObject(j_acl, "acltype", acltype) == NULL
-			|| cJSON_AddStringToObject(j_acl, "access", access) == NULL
+			|| cJSON_AddBoolToObject(j_acl, "allow", b_access) == NULL
 			){

 		return MOSQ_ERR_NOMEM;
@@ -37,8 +37,10 @@ password_mosq.o : ../../src/password_mosq.c ../../src/password_mosq.h
 	${CROSS_COMPILE}${CC} $(APP_CPPFLAGS) $(APP_CFLAGS) -c $< -o $@

 install : all
+ifeq ($(WITH_TLS),yes)
 	$(INSTALL) -d "${DESTDIR}$(prefix)/bin"
 	$(INSTALL) ${STRIP_OPTS} mosquitto_passwd "${DESTDIR}${prefix}/bin/mosquitto_passwd"
+endif

 uninstall :
 	-rm -f "${DESTDIR}${prefix}/bin/mosquitto_passwd"
@@ -105,6 +105,15 @@ static FILE *mpw_tmpfile(void)
 }
 #endif

+int log__printf(void *mosq, unsigned int level, const char *fmt, ...)
+{
+	/* Stub for misc_mosq.c */
+	UNUSED(mosq);
+	UNUSED(level);
+	UNUSED(fmt);
+	return 0;
+}
+

 static void print_usage(void)
 {
@@ -31,13 +31,14 @@ special_variants = [
 ]


+import os
 import random
 import subprocess

 def run_test(msg, opts):
    subprocess.run(["make", "clean"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    print("%s: %s" % (msg, str(opts)))
-    args = ["make", "-j"] + opts
+    args = ["make", "-j%d" % (os.cpu_count())] + opts
    proc = subprocess.run(args, stdout=subprocess.DEVNULL)
    if proc.returncode != 0:
        raise RuntimeError("BUILD FAILED: %s" % (' '.join(args)))
@@ -127,7 +127,7 @@ WITH_XTREPORT=no

 # Also bump lib/mosquitto.h, CMakeLists.txt,
 # installer/mosquitto.nsi, installer/mosquitto64.nsi
-VERSION=2.0.11
+VERSION=2.0.12

 # Client library SO version. Bump if incompatible API/ABI changes are made.
 SOVERSION=1
@@ -28,6 +28,7 @@ RUN set -x && \
        -DLWS_WITHOUT_CLIENT=ON \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
@@ -1,4 +1,4 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"
@@ -30,6 +30,7 @@ RUN set -x && \
        -DLWS_WITHOUT_CLIENT=ON \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
@@ -1,4 +1,4 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"
@@ -6,8 +6,8 @@ LABEL maintainer="Roger Light <roger@atchoo.org>" \
 ENV VERSION=1.6.15 \
    DOWNLOAD_SHA256=5ff2271512f745bf1a451072cd3768a5daed71e90c5179fae12b049d6c02aa0f \
    GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \
-    LWS_VERSION=4.2.0 \
-    LWS_SHA256=a57e9a4765dbcd4d880feba8089b43ed69995eaf10d5d61a07981d9ddd975f40
+    LWS_VERSION=4.2.1 \
+    LWS_SHA256=842da21f73ccba2be59e680de10a8cce7928313048750eb6ad73b6fa50763c51

 RUN set -x && \
    apk --no-cache add --virtual build-deps \
@@ -33,6 +33,7 @@ RUN set -x && \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_EXTERNAL_POLL=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
@@ -1,4 +1,4 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"
@@ -6,8 +6,8 @@ LABEL maintainer="Roger Light <roger@atchoo.org>" \
 ENV VERSION=1.6.15 \
    DOWNLOAD_SHA256=5ff2271512f745bf1a451072cd3768a5daed71e90c5179fae12b049d6c02aa0f \
    GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \
-    LWS_VERSION=4.2.0 \
-    LWS_SHA256=a57e9a4765dbcd4d880feba8089b43ed69995eaf10d5d61a07981d9ddd975f40
+    LWS_VERSION=4.2.1 \
+    LWS_SHA256=842da21f73ccba2be59e680de10a8cce7928313048750eb6ad73b6fa50763c51

 RUN set -x && \
    apk --no-cache add --virtual build-deps \
@@ -33,6 +33,7 @@ RUN set -x && \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_EXTERNAL_POLL=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
@@ -1,20 +1,19 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"

-ENV VERSION=2.0.11 \
-    DOWNLOAD_SHA256=7b36a7198bce85cf31b132f5c6ee36dcf5dadf86fb768501eb1e11ce95d4f78a \
+ENV VERSION=2.0.12 \
+    DOWNLOAD_SHA256=31cf0065cb431d6f4e57a5f4d56663e839c9d177362eff89582d7cfde191c933 \
    GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \
-    LWS_VERSION=4.2.0 \
-    LWS_SHA256=a57e9a4765dbcd4d880feba8089b43ed69995eaf10d5d61a07981d9ddd975f40 \
-    CJSON_VERSION=1.7.14 \
-    CJSON_SHA256=fb50a663eefdc76bafa80c82bc045af13b1363e8f45cec8b442007aef6a41343
+    LWS_VERSION=4.2.1 \
+    LWS_SHA256=842da21f73ccba2be59e680de10a8cce7928313048750eb6ad73b6fa50763c51

 RUN set -x && \
    apk --no-cache add --virtual build-deps \
        build-base \
        cmake \
+        cjson-dev \
        gnupg \
        linux-headers \
        openssl-dev \
@@ -35,26 +34,12 @@ RUN set -x && \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_EXTERNAL_POLL=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
    make -j "$(nproc)" && \
    rm -rf /root/.cmake && \
-    wget https://github.com/DaveGamble/cJSON/archive/v${CJSON_VERSION}.tar.gz -O /tmp/cjson.tar.gz && \
-    echo "$CJSON_SHA256  /tmp/cjson.tar.gz" | sha256sum -c - && \
-    mkdir -p /build/cjson && \
-    tar --strip=1 -xf /tmp/cjson.tar.gz -C /build/cjson && \
-    rm /tmp/cjson.tar.gz && \
-    cd /build/cjson && \
-    cmake . \
-        -DCMAKE_BUILD_TYPE=MinSizeRel \
-        -DBUILD_SHARED_AND_STATIC_LIBS=OFF \
-        -DBUILD_SHARED_LIBS=OFF \
-        -DCJSON_BUILD_SHARED_LIBS=OFF \
-        -DCJSON_OVERRIDE_BUILD_SHARED_LIBS=OFF \
-        -DCMAKE_INSTALL_PREFIX=/usr && \
-    make -j "$(nproc)" && \
-    rm -rf /root/.cmake && \
    wget https://mosquitto.org/files/source/mosquitto-${VERSION}.tar.gz -O /tmp/mosq.tar.gz && \
    echo "$DOWNLOAD_SHA256  /tmp/mosq.tar.gz" | sha256sum -c - && \
    wget https://mosquitto.org/files/source/mosquitto-${VERSION}.tar.gz.asc -O /tmp/mosq.tar.gz.asc && \
@@ -78,7 +63,7 @@ RUN set -x && \
    rm /tmp/mosq.tar.gz && \
    make -C /build/mosq -j "$(nproc)" \
        CFLAGS="-Wall -O2 -I/build/lws/include -I/build" \
-        LDFLAGS="-L/build/lws/lib -L/build/cjson" \
+        LDFLAGS="-L/build/lws/lib" \
        WITH_ADNS=no \
        WITH_DOCS=no \
        WITH_SHARED_LIBRARIES=yes \
@@ -100,13 +85,13 @@ RUN set -x && \
    install -s -m755 /build/mosq/apps/mosquitto_passwd/mosquitto_passwd /usr/bin/mosquitto_passwd && \
    install -s -m755 /build/mosq/plugins/dynamic-security/mosquitto_dynamic_security.so /usr/lib/mosquitto_dynamic_security.so && \
    install -m644 /build/mosq/mosquitto.conf /mosquitto/config/mosquitto.conf && \
-    install -Dm644 /build/cjson/LICENSE /usr/share/licenses/cJSON/LICENSE && \
    install -Dm644 /build/lws/LICENSE /usr/share/licenses/libwebsockets/LICENSE && \
    install -Dm644 /build/mosq/epl-v20 /usr/share/licenses/mosquitto/epl-v20 && \
    install -Dm644 /build/mosq/edl-v10 /usr/share/licenses/mosquitto/edl-v10 && \
    chown -R mosquitto:mosquitto /mosquitto && \
    apk --no-cache add \
-        ca-certificates && \
+        ca-certificates \
+        cjson && \
    apk del build-deps && \
    rm -rf /build

@@ -1,20 +1,19 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"

-ENV VERSION=2.0.11 \
-    DOWNLOAD_SHA256=7b36a7198bce85cf31b132f5c6ee36dcf5dadf86fb768501eb1e11ce95d4f78a \
+ENV VERSION=2.0.12 \
+    DOWNLOAD_SHA256=31cf0065cb431d6f4e57a5f4d56663e839c9d177362eff89582d7cfde191c933 \
    GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \
-    LWS_VERSION=4.2.0 \
-    LWS_SHA256=a57e9a4765dbcd4d880feba8089b43ed69995eaf10d5d61a07981d9ddd975f40 \
-    CJSON_VERSION=1.7.14 \
-    CJSON_SHA256=fb50a663eefdc76bafa80c82bc045af13b1363e8f45cec8b442007aef6a41343
+    LWS_VERSION=4.2.1 \
+    LWS_SHA256=842da21f73ccba2be59e680de10a8cce7928313048750eb6ad73b6fa50763c51

 RUN set -x && \
    apk --no-cache add --virtual build-deps \
        build-base \
        cmake \
+        cjson-dev \
        gnupg \
        libressl-dev \
        linux-headers \
@@ -35,26 +34,12 @@ RUN set -x && \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_EXTERNAL_POLL=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
    make -j "$(nproc)" && \
    rm -rf /root/.cmake && \
-    wget https://github.com/DaveGamble/cJSON/archive/v${CJSON_VERSION}.tar.gz -O /tmp/cjson.tar.gz && \
-    echo "$CJSON_SHA256  /tmp/cjson.tar.gz" | sha256sum -c - && \
-    mkdir -p /build/cjson && \
-    tar --strip=1 -xf /tmp/cjson.tar.gz -C /build/cjson && \
-    rm /tmp/cjson.tar.gz && \
-    cd /build/cjson && \
-    cmake . \
-        -DCMAKE_BUILD_TYPE=MinSizeRel \
-        -DBUILD_SHARED_AND_STATIC_LIBS=OFF \
-        -DBUILD_SHARED_LIBS=OFF \
-        -DCJSON_BUILD_SHARED_LIBS=OFF \
-        -DCJSON_OVERRIDE_BUILD_SHARED_LIBS=OFF \
-        -DCMAKE_INSTALL_PREFIX=/usr && \
-    make -j "$(nproc)" && \
-    rm -rf /root/.cmake && \
    wget https://mosquitto.org/files/source/mosquitto-${VERSION}.tar.gz -O /tmp/mosq.tar.gz && \
    echo "$DOWNLOAD_SHA256  /tmp/mosq.tar.gz" | sha256sum -c - && \
    wget https://mosquitto.org/files/source/mosquitto-${VERSION}.tar.gz.asc -O /tmp/mosq.tar.gz.asc && \
@@ -78,7 +63,7 @@ RUN set -x && \
    rm /tmp/mosq.tar.gz && \
    make -C /build/mosq -j "$(nproc)" \
        CFLAGS="-Wall -O2 -I/build/lws/include -I/build" \
-        LDFLAGS="-L/build/lws/lib -L/build/cjson" \
+        LDFLAGS="-L/build/lws/lib" \
        WITH_ADNS=no \
        WITH_DOCS=no \
        WITH_SHARED_LIBRARIES=yes \
@@ -101,13 +86,13 @@ RUN set -x && \
    install -s -m755 /build/mosq/apps/mosquitto_passwd/mosquitto_passwd /usr/bin/mosquitto_passwd && \
    install -s -m755 /build/mosq/plugins/dynamic-security/mosquitto_dynamic_security.so /usr/lib/mosquitto_dynamic_security.so && \
    install -m644 /build/mosq/mosquitto.conf /mosquitto/config/mosquitto.conf && \
-    install -Dm644 /build/cjson/LICENSE /usr/share/licenses/cJSON/LICENSE && \
    install -Dm644 /build/lws/LICENSE /usr/share/licenses/libwebsockets/LICENSE && \
    install -Dm644 /build/mosq/epl-v20 /usr/share/licenses/mosquitto/epl-v20 && \
    install -Dm644 /build/mosq/edl-v10 /usr/share/licenses/mosquitto/edl-v10 && \
    chown -R mosquitto:mosquitto /mosquitto && \
    apk --no-cache add \
        ca-certificates \
+        cjson \
        libressl && \
    apk del build-deps && \
    rm -rf /build
@@ -1,4 +1,4 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"
@@ -8,8 +8,8 @@ RUN test -n "${VERSION}"

 ENV \
    GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \
-    LWS_VERSION=4.2.0 \
-    LWS_SHA256=a57e9a4765dbcd4d880feba8089b43ed69995eaf10d5d61a07981d9ddd975f40 \
+    LWS_VERSION=4.2.1 \
+    LWS_SHA256=842da21f73ccba2be59e680de10a8cce7928313048750eb6ad73b6fa50763c51 \
    CJSON_VERSION=1.7.14 \
    CJSON_SHA256=fb50a663eefdc76bafa80c82bc045af13b1363e8f45cec8b442007aef6a41343

@@ -18,7 +18,7 @@ RUN set -x && \
        build-base \
        cmake \
        gnupg \
-		linux-headers \
+        linux-headers \
        openssl-dev \
        util-linux-dev && \
    wget https://github.com/warmcat/libwebsockets/archive/v${LWS_VERSION}.tar.gz -O /tmp/lws.tar.gz && \
@@ -37,6 +37,7 @@ RUN set -x && \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_EXTERNAL_POLL=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
@@ -1,10 +1,10 @@
-FROM alpine:3.12
+FROM alpine:3.14

 LABEL maintainer="Roger Light <roger@atchoo.org>" \
    description="Eclipse Mosquitto MQTT Broker"

-ENV LWS_VERSION=4.2.0 \
-	CJSON_VERSION=1.7.14
+ENV LWS_VERSION=4.2.1 \
+    CJSON_VERSION=1.7.14

 COPY mosq.tar.gz /tmp

@@ -13,7 +13,7 @@ RUN set -x && \
        build-base \
        cmake \
        gnupg \
-		linux-headers \
+        linux-headers \
        openssl-dev \
        util-linux-dev && \
    wget https://github.com/warmcat/libwebsockets/archive/v${LWS_VERSION}.tar.gz -O /tmp/lws.tar.gz && \
@@ -31,17 +31,18 @@ RUN set -x && \
        -DLWS_WITHOUT_EXTENSIONS=ON \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_EXTERNAL_POLL=ON \
+        -DLWS_WITH_HTTP2=OFF \
        -DLWS_WITH_SHARED=OFF \
        -DLWS_WITH_ZIP_FOPS=OFF \
        -DLWS_WITH_ZLIB=OFF && \
    make -j "$(nproc)" && \
    rm -rf /root/.cmake && \
-	wget https://github.com/DaveGamble/cJSON/archive/v${CJSON_VERSION}.tar.gz -O /tmp/cjson.tar.gz && \
-	mkdir -p /build/cjson && \
-	tar --strip=1 -xf /tmp/cjson.tar.gz -C /build/cjson && \
-	rm /tmp/cjson.tar.gz && \
-	cd /build/cjson && \
-	make -j "$(nproc)" libcjson.a && \
+    wget https://github.com/DaveGamble/cJSON/archive/v${CJSON_VERSION}.tar.gz -O /tmp/cjson.tar.gz && \
+    mkdir -p /build/cjson && \
+    tar --strip=1 -xf /tmp/cjson.tar.gz -C /build/cjson && \
+    rm /tmp/cjson.tar.gz && \
+    cd /build/cjson && \
+    make -j "$(nproc)" libcjson.a && \
    mkdir -p /build/mosq && \
    tar --strip=1 -xf /tmp/mosq.tar.gz -C /build/mosq && \
    rm /tmp/mosq.tar.gz && \
@@ -49,7 +50,7 @@ RUN set -x && \
        CFLAGS="-Wall -O2 -I/build/lws/include -I/build" \
        LDFLAGS="-L/build/lws/lib -L/build/cjson" \
        WITH_ADNS=no \
-		WITH_CJSON=yes \
+        WITH_CJSON=yes \
        WITH_DOCS=no \
        WITH_SHARED_LIBRARIES=yes \
        WITH_SRV=no \
@@ -66,7 +66,7 @@ extern "C" {

 #define LIBMOSQUITTO_MAJOR 2
 #define LIBMOSQUITTO_MINOR 0
-#define LIBMOSQUITTO_REVISION 11
+#define LIBMOSQUITTO_REVISION 12
 /* LIBMOSQUITTO_VERSION_NUMBER looks like 1002001 for e.g. version 1.2.1. */
 #define LIBMOSQUITTO_VERSION_NUMBER (LIBMOSQUITTO_MAJOR*1000000+LIBMOSQUITTO_MINOR*1000+LIBMOSQUITTO_REVISION)

@@ -9,7 +9,7 @@
 !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"'

 Name "Eclipse Mosquitto"
-!define VERSION 2.0.11
+!define VERSION 2.0.12
 OutFile "mosquitto-${VERSION}-install-windows-x86.exe"

 InstallDir "$PROGRAMFILES\mosquitto"
@@ -9,7 +9,7 @@
 !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"'

 Name "Eclipse Mosquitto"
-!define VERSION 2.0.11
+!define VERSION 2.0.12
 OutFile "mosquitto-${VERSION}-install-windows-x64.exe"

 !include "x64.nsh"
@@ -41,6 +41,9 @@ int handle__auth(struct mosquitto *mosq)
 	if(mosq->protocol != mosq_p_mqtt5){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->in_packet.command != CMD_AUTH){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 	if(packet__read_byte(&mosq->in_packet, &reason_code)) return 1;

@@ -40,6 +40,10 @@ int handle__connack(struct mosquitto *mosq)
 	char *clientid = NULL;

 	assert(mosq);
+	if(mosq->in_packet.command != CMD_CONNACK){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}
+
 	rc = packet__read_byte(&mosq->in_packet, &connect_flags);
 	if(rc) return rc;
 	rc = packet__read_byte(&mosq->in_packet, &reason_code);
@@ -44,6 +44,9 @@ int handle__disconnect(struct mosquitto *mosq)
 	if(mosq->protocol != mosq_p_mqtt5){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->in_packet.command != CMD_DISCONNECT){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 	rc = packet__read_byte(&mosq->in_packet, &reason_code);
 	if(rc) return rc;
@@ -44,11 +44,14 @@ int handle__pingreq(struct mosquitto *mosq)
 	if(mosquitto__get_state(mosq) != mosq_cs_active){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->in_packet.command != CMD_PINGREQ){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 #ifdef WITH_BROKER
 	log__printf(NULL, MOSQ_LOG_DEBUG, "Received PINGREQ from %s", mosq->id);
 #else
-	log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s received PINGREQ", mosq->id);
+	return MOSQ_ERR_PROTOCOL;
 #endif
 	return send__pingresp(mosq);
 }
@@ -63,6 +66,9 @@ int handle__pingresp(struct mosquitto *mosq)

 	mosq->ping_t = 0; /* No longer waiting for a PINGRESP. */
 #ifdef WITH_BROKER
+	if(mosq->bridge == NULL){
+		return MOSQ_ERR_PROTOCOL;
+	}
 	log__printf(NULL, MOSQ_LOG_DEBUG, "Received PINGRESP from %s", mosq->id);
 #else
 	log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s received PINGRESP", mosq->id);
@@ -52,6 +52,11 @@ int handle__pubackcomp(struct mosquitto *mosq, const char *type)
 	if(mosquitto__get_state(mosq) != mosq_cs_active){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->protocol != mosq_p_mqtt31){
+		if((mosq->in_packet.command&0x0F) != 0x00){
+			return MOSQ_ERR_MALFORMED_PACKET;
+		}
+	}

 	pthread_mutex_lock(&mosq->msgs_out.mutex);
 	util__increment_send_quota(mosq);
@@ -59,17 +64,59 @@ int handle__pubackcomp(struct mosquitto *mosq, const char *type)

 	rc = packet__read_uint16(&mosq->in_packet, &mid);
 	if(rc) return rc;
-	qos = type[3] == 'A'?1:2; /* pubAck or pubComp */
-	if(mid == 0) return MOSQ_ERR_PROTOCOL;
+	if(type[3] == 'A'){ /* pubAck or pubComp */
+		if(mosq->in_packet.command != CMD_PUBACK){
+			return MOSQ_ERR_MALFORMED_PACKET;
+		}
+		qos = 1;
+	}else{
+		if(mosq->in_packet.command != CMD_PUBCOMP){
+			return MOSQ_ERR_MALFORMED_PACKET;
+		}
+		qos = 2;
+	}
+	if(mid == 0){
+		return MOSQ_ERR_PROTOCOL;
+	}

 	if(mosq->protocol == mosq_p_mqtt5 && mosq->in_packet.remaining_length > 2){
 		rc = packet__read_byte(&mosq->in_packet, &reason_code);
-		if(rc) return rc;
+		if(rc){
+			return rc;
+		}

 		if(mosq->in_packet.remaining_length > 3){
 			rc = property__read_all(CMD_PUBACK, &mosq->in_packet, &properties);
 			if(rc) return rc;
 		}
+		if(type[3] == 'A'){ /* pubAck or pubComp */
+			if(reason_code != MQTT_RC_SUCCESS
+					&& reason_code != MQTT_RC_NO_MATCHING_SUBSCRIBERS
+					&& reason_code != MQTT_RC_UNSPECIFIED
+					&& reason_code != MQTT_RC_IMPLEMENTATION_SPECIFIC
+					&& reason_code != MQTT_RC_NOT_AUTHORIZED
+					&& reason_code != MQTT_RC_TOPIC_NAME_INVALID
+					&& reason_code != MQTT_RC_PACKET_ID_IN_USE
+					&& reason_code != MQTT_RC_QUOTA_EXCEEDED
+					&& reason_code != MQTT_RC_PAYLOAD_FORMAT_INVALID
+					){
+
+				return MOSQ_ERR_PROTOCOL;
+			}
+		}else{
+			if(reason_code != MQTT_RC_SUCCESS
+					&& reason_code != MQTT_RC_PACKET_ID_NOT_FOUND
+					){
+
+				return MOSQ_ERR_PROTOCOL;
+			}
+		}
+	}
+	if(mosq->in_packet.pos < mosq->in_packet.remaining_length){
+#ifdef WITH_BROKER
+		mosquitto_property_free_all(&properties);
+#endif
+		return MOSQ_ERR_MALFORMED_PACKET;
 	}

 #ifdef WITH_BROKER
@@ -50,6 +50,9 @@ int handle__pubrec(struct mosquitto *mosq)
 	if(mosquitto__get_state(mosq) != mosq_cs_active){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->in_packet.command != CMD_PUBREC){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 	rc = packet__read_uint16(&mosq->in_packet, &mid);
 	if(rc) return rc;
@@ -59,14 +62,34 @@ int handle__pubrec(struct mosquitto *mosq)
 		rc = packet__read_byte(&mosq->in_packet, &reason_code);
 		if(rc) return rc;

+		if(reason_code != MQTT_RC_SUCCESS
+				&& reason_code != MQTT_RC_NO_MATCHING_SUBSCRIBERS
+				&& reason_code != MQTT_RC_UNSPECIFIED
+				&& reason_code != MQTT_RC_IMPLEMENTATION_SPECIFIC
+				&& reason_code != MQTT_RC_NOT_AUTHORIZED
+				&& reason_code != MQTT_RC_TOPIC_NAME_INVALID
+				&& reason_code != MQTT_RC_PACKET_ID_IN_USE
+				&& reason_code != MQTT_RC_QUOTA_EXCEEDED){
+
+			return MOSQ_ERR_PROTOCOL;
+		}
+
 		if(mosq->in_packet.remaining_length > 3){
 			rc = property__read_all(CMD_PUBREC, &mosq->in_packet, &properties);
 			if(rc) return rc;
+
 			/* Immediately free, we don't do anything with Reason String or User Property at the moment */
 			mosquitto_property_free_all(&properties);
 		}
 	}

+	if(mosq->in_packet.pos < mosq->in_packet.remaining_length){
+#ifdef WITH_BROKER
+		mosquitto_property_free_all(&properties);
+#endif
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}
+
 #ifdef WITH_BROKER
 	log__printf(NULL, MOSQ_LOG_DEBUG, "Received PUBREC from %s (Mid: %d)", mosq->id, mid);

@@ -54,6 +54,9 @@ int handle__pubrel(struct mosquitto *mosq)
 	if(mosquitto__get_state(mosq) != mosq_cs_active){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->protocol != mosq_p_mqtt31 && mosq->in_packet.command != (CMD_PUBREL|2)){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 	if(mosq->protocol != mosq_p_mqtt31){
 		if((mosq->in_packet.command&0x0F) != 0x02){
@@ -68,12 +71,23 @@ int handle__pubrel(struct mosquitto *mosq)
 		rc = packet__read_byte(&mosq->in_packet, &reason_code);
 		if(rc) return rc;

+		if(reason_code != MQTT_RC_SUCCESS && reason_code != MQTT_RC_PACKET_ID_NOT_FOUND){
+			return MOSQ_ERR_PROTOCOL;
+		}
+
 		if(mosq->in_packet.remaining_length > 3){
 			rc = property__read_all(CMD_PUBREL, &mosq->in_packet, &properties);
 			if(rc) return rc;
 		}
 	}

+	if(mosq->in_packet.pos < mosq->in_packet.remaining_length){
+#ifdef WITH_BROKER
+		mosquitto_property_free_all(&properties);
+#endif
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}
+
 #ifdef WITH_BROKER
 	log__printf(NULL, MOSQ_LOG_DEBUG, "Received PUBREL from %s (Mid: %d)", mosq->id, mid);

@@ -51,8 +51,15 @@ int handle__suback(struct mosquitto *mosq)
 	if(mosquitto__get_state(mosq) != mosq_cs_active){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->in_packet.command != CMD_SUBACK){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 #ifdef WITH_BROKER
+	if(mosq->bridge == NULL){
+		/* Client is not a bridge, so shouldn't be sending SUBACK */
+		return MOSQ_ERR_PROTOCOL;
+	}
 	log__printf(NULL, MOSQ_LOG_DEBUG, "Received SUBACK from %s", mosq->id);
 #else
 	log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s received SUBACK", mosq->id);
@@ -51,8 +51,15 @@ int handle__unsuback(struct mosquitto *mosq)
 	if(mosquitto__get_state(mosq) != mosq_cs_active){
 		return MOSQ_ERR_PROTOCOL;
 	}
+	if(mosq->in_packet.command != CMD_UNSUBACK){
+		return MOSQ_ERR_MALFORMED_PACKET;
+	}

 #ifdef WITH_BROKER
+	if(mosq->bridge == NULL){
+		/* Client is not a bridge, so shouldn't be sending SUBACK */
+		return MOSQ_ERR_PROTOCOL;
+	}
 	log__printf(NULL, MOSQ_LOG_DEBUG, "Received UNSUBACK from %s", mosq->id);
 #else
 	log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s received UNSUBACK", mosq->id);
@@ -37,6 +37,7 @@ Contributors:
 #endif

 #include "misc_mosq.h"
+#include "logging_mosq.h"


 FILE *mosquitto__fopen(const char *path, const char *mode, bool restrict_read)
@@ -116,6 +117,20 @@ FILE *mosquitto__fopen(const char *path, const char *mode, bool restrict_read)
 		}
 	}
 #else
+	if(mode[0] == 'r'){
+		struct stat statbuf;
+		if(stat(path, &statbuf) < 0){
+			return NULL;
+		}
+
+		if(!S_ISREG(statbuf.st_mode) && !S_ISLNK(statbuf.st_mode)){
+#ifdef WITH_BROKER
+			log__printf(NULL, MOSQ_LOG_ERR, "Error: %s is not a file.", path);
+#endif
+			return NULL;
+		}
+	}
+
 	if (restrict_read) {
 		FILE *fptr;
 		mode_t old_mask;
@@ -156,6 +171,7 @@ char *fgets_extending(char **buf, int *buflen, FILE *stream)
 	char endchar;
 	int offset = 0;
 	char *newbuf;
+	size_t len;

 	if(stream == NULL || buf == NULL || buflen == NULL || *buflen < 1){
 		return NULL;
@@ -163,11 +179,15 @@ char *fgets_extending(char **buf, int *buflen, FILE *stream)

 	do{
 		rc = fgets(&((*buf)[offset]), (*buflen)-offset, stream);
-		if(feof(stream)){
+		if(feof(stream) || rc == NULL){
 			return rc;
 		}

-		endchar = (*buf)[strlen(*buf)-1];
+		len = strlen(*buf);
+		if(len == 0){
+			return rc;
+		}
+		endchar = (*buf)[len-1];
 		if(endchar == '\n'){
 			return rc;
 		}
@@ -258,6 +258,9 @@ struct mosquitto {
 #ifdef WITH_TLS
 	SSL *ssl;
 	SSL_CTX *ssl_ctx;
+#ifndef WITH_BROKER
+	SSL_CTX *user_ssl_ctx;
+#endif
 	char *tls_cafile;
 	char *tls_capath;
 	char *tls_certfile;
@@ -302,11 +305,9 @@ struct mosquitto {
 	struct mosquitto__acl_user *acl_list;
 	struct mosquitto__listener *listener;
 	struct mosquitto__packet *out_packet_last;
-	struct mosquitto__subhier **subs;
-	struct mosquitto__subshared_ref **shared_subs;
+	struct mosquitto__client_sub **subs;
 	char *auth_method;
 	int sub_count;
-	int shared_sub_count;
 #  ifndef WITH_EPOLL
 	int pollfd_index;
 #  endif
@@ -260,6 +260,7 @@ int net__socket_close(struct mosquitto *mosq)
 #ifdef WITH_BROKER
 	if(mosq->listener){
 		mosq->listener->client_count--;
+		mosq->listener = NULL;
 	}
 #endif

@@ -652,15 +653,18 @@ static int net__init_ssl_ctx(struct mosquitto *mosq)
 #if !defined(OPENSSL_NO_ENGINE)
 	EVP_PKEY *pkey;
 #endif
-
-	if(mosq->ssl_ctx){
+ 
+#ifndef WITH_BROKER
+	if(mosq->user_ssl_ctx){
+		mosq->ssl_ctx = mosq->user_ssl_ctx;
 		if(!mosq->ssl_ctx_defaults){
 			return MOSQ_ERR_SUCCESS;
 		}else if(!mosq->tls_cafile && !mosq->tls_capath && !mosq->tls_psk){
-			log__printf(mosq, MOSQ_LOG_ERR, "Error: MOSQ_OPT_SSL_CTX_WITH_DEFAULTS used without specifying cafile, capath or psk.");
+			log__printf(mosq, MOSQ_LOG_ERR, "Error: If you use MOSQ_OPT_SSL_CTX then MOSQ_OPT_SSL_CTX_WITH_DEFAULTS must be true, or at least one of cafile, capath or psk must be specified.");
 			return MOSQ_ERR_INVAL;
 		}
 	}
+#endif

 	/* Apply default SSL_CTX settings. This is only used if MOSQ_OPT_SSL_CTX
 	 * has not been set, or if both of MOSQ_OPT_SSL_CTX and
@@ -682,8 +686,14 @@ static int net__init_ssl_ctx(struct mosquitto *mosq)
 			}
 		}

+#ifdef SSL_OP_NO_TLSv1_3
+		if(mosq->tls_psk){
+			SSL_CTX_set_options(mosq->ssl_ctx, SSL_OP_NO_TLSv1_3);
+		}
+#endif
+
 		if(!mosq->tls_version){
-			SSL_CTX_set_options(mosq->ssl_ctx, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
+			SSL_CTX_set_options(mosq->ssl_ctx, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1);
 #ifdef SSL_OP_NO_TLSv1_3
 		}else if(!strcmp(mosq->tls_version, "tlsv1.3")){
 			SSL_CTX_set_options(mosq->ssl_ctx, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2);
@@ -852,6 +862,9 @@ static int net__init_ssl_ctx(struct mosquitto *mosq)
 #ifdef FINAL_WITH_TLS_PSK
 		}else if(mosq->tls_psk){
 			SSL_CTX_set_psk_client_callback(mosq->ssl_ctx, psk_client_callback);
+			if(mosq->tls_ciphers == NULL){
+				SSL_CTX_set_cipher_list(mosq->ssl_ctx, "PSK");
+			}
 #endif
 		}
 	}
@@ -906,6 +919,9 @@ int net__socket_connect_step3(struct mosquitto *mosq, const char *host)
 		}

 	}
+#else
+	UNUSED(mosq);
+	UNUSED(host);
 #endif
 	return MOSQ_ERR_SUCCESS;
 }
@@ -1199,6 +1215,8 @@ void *mosquitto_ssl_get(struct mosquitto *mosq)
 #ifdef WITH_TLS
 	return mosq->ssl;
 #else
+	UNUSED(mosq);
+
 	return NULL;
 #endif
 }
@@ -205,6 +205,13 @@ int mosquitto_tls_set(struct mosquitto *mosq, const char *cafile, const char *ca

 	return MOSQ_ERR_SUCCESS;
 #else
+	UNUSED(mosq);
+	UNUSED(cafile);
+	UNUSED(capath);
+	UNUSED(certfile);
+	UNUSED(keyfile);
+	UNUSED(pw_callback);
+
 	return MOSQ_ERR_NOT_SUPPORTED;

 #endif
@@ -247,8 +254,12 @@ int mosquitto_tls_opts_set(struct mosquitto *mosq, int cert_reqs, const char *tl

 	return MOSQ_ERR_SUCCESS;
 #else
-	return MOSQ_ERR_NOT_SUPPORTED;
+	UNUSED(mosq);
+	UNUSED(cert_reqs);
+	UNUSED(tls_version);
+	UNUSED(ciphers);

+	return MOSQ_ERR_NOT_SUPPORTED;
 #endif
 }

@@ -260,6 +271,9 @@ int mosquitto_tls_insecure_set(struct mosquitto *mosq, bool value)
 	mosq->tls_insecure = value;
 	return MOSQ_ERR_SUCCESS;
 #else
+	UNUSED(mosq);
+	UNUSED(value);
+
 	return MOSQ_ERR_NOT_SUPPORTED;
 #endif
 }
@@ -379,6 +393,11 @@ int mosquitto_tls_psk_set(struct mosquitto *mosq, const char *psk, const char *i

 	return MOSQ_ERR_SUCCESS;
 #else
+	UNUSED(mosq);
+	UNUSED(psk);
+	UNUSED(identity);
+	UNUSED(ciphers);
+
 	return MOSQ_ERR_NOT_SUPPORTED;
 #endif
 }
@@ -388,26 +407,17 @@ int mosquitto_opts_set(struct mosquitto *mosq, enum mosq_opt_t option, void *val
 {
 	int ival;

-	if(!mosq || !value) return MOSQ_ERR_INVAL;
+	if(!mosq) return MOSQ_ERR_INVAL;

 	switch(option){
 		case MOSQ_OPT_PROTOCOL_VERSION:
+			if(value == NULL){
+				return MOSQ_ERR_INVAL;
+			}
 			ival = *((int *)value);
 			return mosquitto_int_option(mosq, option, ival);
 		case MOSQ_OPT_SSL_CTX:
-#ifdef WITH_TLS
-			mosq->ssl_ctx = (SSL_CTX *)value;
-			if(mosq->ssl_ctx){
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
-				SSL_CTX_up_ref(mosq->ssl_ctx);
-#else
-				CRYPTO_add(&(mosq->ssl_ctx)->references, 1, CRYPTO_LOCK_SSL_CTX);
-#endif
-			}
-			break;
-#else
-			return MOSQ_ERR_NOT_SUPPORTED;
-#endif
+			return mosquitto_void_option(mosq, option, value);
 		default:
 			return MOSQ_ERR_INVAL;
 	}
@@ -503,17 +513,17 @@ int mosquitto_int_option(struct mosquitto *mosq, enum mosq_opt_t option, int val

 int mosquitto_void_option(struct mosquitto *mosq, enum mosq_opt_t option, void *value)
 {
-	if(!mosq || !value) return MOSQ_ERR_INVAL;
+	if(!mosq) return MOSQ_ERR_INVAL;

 	switch(option){
 		case MOSQ_OPT_SSL_CTX:
 #ifdef WITH_TLS
-			mosq->ssl_ctx = (SSL_CTX *)value;
-			if(mosq->ssl_ctx){
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
-				SSL_CTX_up_ref(mosq->ssl_ctx);
+			mosq->user_ssl_ctx = (SSL_CTX *)value;
+			if(mosq->user_ssl_ctx){
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+				SSL_CTX_up_ref(mosq->user_ssl_ctx);
 #else
-				CRYPTO_add(&(mosq->ssl_ctx)->references, 1, CRYPTO_LOCK_SSL_CTX);
+				CRYPTO_add(&(mosq->user_ssl_ctx)->references, 1, CRYPTO_LOCK_SSL_CTX);
 #endif
 			}
 			break;
@@ -49,7 +49,7 @@ Contributors:
 int packet__read_byte(struct mosquitto__packet_in *packet, uint8_t *byte)
 {
 	assert(packet);
-	if(packet->pos+1 > packet->remaining_length) return MOSQ_ERR_PROTOCOL;
+	if(packet->pos+1 > packet->remaining_length) return MOSQ_ERR_MALFORMED_PACKET;

 	*byte = packet->payload[packet->pos];
 	packet->pos++;
@@ -71,7 +71,7 @@ void packet__write_byte(struct mosquitto__packet *packet, uint8_t byte)
 int packet__read_bytes(struct mosquitto__packet_in *packet, void *bytes, uint32_t count)
 {
 	assert(packet);
-	if(packet->pos+count > packet->remaining_length) return MOSQ_ERR_PROTOCOL;
+	if(packet->pos+count > packet->remaining_length) return MOSQ_ERR_MALFORMED_PACKET;

 	memcpy(bytes, &(packet->payload[packet->pos]), count);
 	packet->pos += count;
@@ -105,7 +105,7 @@ int packet__read_binary(struct mosquitto__packet_in *packet, uint8_t **data, uin
 		return MOSQ_ERR_SUCCESS;
 	}

-	if(packet->pos+slen > packet->remaining_length) return MOSQ_ERR_PROTOCOL;
+	if(packet->pos+slen > packet->remaining_length) return MOSQ_ERR_MALFORMED_PACKET;

 	*data = mosquitto__malloc(slen+1U);
 	if(*data){
@@ -153,7 +153,7 @@ int packet__read_uint16(struct mosquitto__packet_in *packet, uint16_t *word)
 	uint8_t msb, lsb;

 	assert(packet);
-	if(packet->pos+2 > packet->remaining_length) return MOSQ_ERR_PROTOCOL;
+	if(packet->pos+2 > packet->remaining_length) return MOSQ_ERR_MALFORMED_PACKET;

 	msb = packet->payload[packet->pos];
 	packet->pos++;
@@ -179,7 +179,7 @@ int packet__read_uint32(struct mosquitto__packet_in *packet, uint32_t *word)
 	int i;

 	assert(packet);
-	if(packet->pos+4 > packet->remaining_length) return MOSQ_ERR_PROTOCOL;
+	if(packet->pos+4 > packet->remaining_length) return MOSQ_ERR_MALFORMED_PACKET;

 	for(i=0; i<4; i++){
 		val = (val << 8) + packet->payload[packet->pos];
@@ -219,7 +219,7 @@ int packet__read_varint(struct mosquitto__packet_in *packet, uint32_t *word, uin
 			if((byte & 128) == 0){
 				if(lbytes > 1 && byte == 0){
 					/* Catch overlong encodings */
-					return MOSQ_ERR_PROTOCOL;
+					return MOSQ_ERR_MALFORMED_PACKET;
 				}else{
 					*word = lword;
 					if(bytes) (*bytes) = lbytes;
@@ -227,10 +227,10 @@ int packet__read_varint(struct mosquitto__packet_in *packet, uint32_t *word, uin
 				}
 			}
 		}else{
-			return MOSQ_ERR_PROTOCOL;
+			return MOSQ_ERR_MALFORMED_PACKET;
 		}
 	}
-	return MOSQ_ERR_PROTOCOL;
+	return MOSQ_ERR_MALFORMED_PACKET;
 }


@@ -251,7 +251,7 @@ int packet__write_varint(struct mosquitto__packet *packet, uint32_t word)
 	}while(word > 0 && count < 5);

 	if(count == 5){
-		return MOSQ_ERR_PROTOCOL;
+		return MOSQ_ERR_MALFORMED_PACKET;
 	}
 	return MOSQ_ERR_SUCCESS;
 }
@@ -399,7 +399,7 @@ int packet__read(struct mosquitto *mosq)
 				 * Anything more likely means a broken/malicious client.
 				 */
 				if(mosq->in_packet.remaining_count < -4){
-					return MOSQ_ERR_PROTOCOL;
+					return MOSQ_ERR_MALFORMED_PACKET;
 				}

 				G_BYTES_RECEIVED_INC(1);
@@ -431,6 +431,37 @@ int packet__read(struct mosquitto *mosq)
 		mosq->in_packet.remaining_count = (int8_t)(mosq->in_packet.remaining_count * -1);

 #ifdef WITH_BROKER
+		switch(mosq->in_packet.command & 0xF0){
+			case CMD_CONNECT:
+				if(mosq->in_packet.remaining_length > 100000){ /* Arbitrary limit, make configurable */
+					return MOSQ_ERR_MALFORMED_PACKET;
+				}
+				break;
+
+			case CMD_PUBACK:
+			case CMD_PUBREC:
+			case CMD_PUBREL:
+			case CMD_PUBCOMP:
+			case CMD_UNSUBACK:
+				if(mosq->protocol != mosq_p_mqtt5 && mosq->in_packet.remaining_length != 2){
+					return MOSQ_ERR_MALFORMED_PACKET;
+				}
+				break;
+
+			case CMD_PINGREQ:
+			case CMD_PINGRESP:
+				if(mosq->in_packet.remaining_length != 0){
+					return MOSQ_ERR_MALFORMED_PACKET;
+				}
+				break;
+
+			case CMD_DISCONNECT:
+				if(mosq->protocol != mosq_p_mqtt5 && mosq->in_packet.remaining_length != 0){
+					return MOSQ_ERR_MALFORMED_PACKET;
+				}
+				break;
+		}
+
 		if(db.config->max_packet_size > 0 && mosq->in_packet.remaining_length+1 > db.config->max_packet_size){
 			if(mosq->protocol == mosq_p_mqtt5){
 				send__disconnect(mosq, MQTT_RC_PACKET_TOO_LARGE, NULL);
@@ -48,7 +48,9 @@ static int property__read(struct mosquitto__packet_in *packet, uint32_t *len, mo
 	if(!property) return MOSQ_ERR_INVAL;

 	rc = packet__read_varint(packet, &property_identifier, NULL);
-	if(rc) return rc;
+	if(rc){
+		return rc;
+	}
 	*len -= 1;

 	memset(property, 0, sizeof(mosquitto_property));
@@ -932,6 +934,7 @@ int mosquitto_property_check_all(int command, const mosquitto_property *properti
 	while(p){
 		/* Validity checks */
 		if(p->identifier == MQTT_PROP_REQUEST_PROBLEM_INFORMATION
+				|| p->identifier == MQTT_PROP_PAYLOAD_FORMAT_INDICATOR
 				|| p->identifier == MQTT_PROP_REQUEST_RESPONSE_INFORMATION
 				|| p->identifier == MQTT_PROP_MAXIMUM_QOS
 				|| p->identifier == MQTT_PROP_RETAIN_AVAILABLE
@@ -959,14 +962,14 @@ int mosquitto_property_check_all(int command, const mosquitto_property *properti
 		if(rc) return rc;

 		/* Check for duplicates */
-		tail = p->next;
-		while(tail){
-			if(p->identifier == tail->identifier
-					&& p->identifier != MQTT_PROP_USER_PROPERTY){
-
-				return MOSQ_ERR_DUPLICATE_PROPERTY;
+		if(p->identifier != MQTT_PROP_USER_PROPERTY){
+			tail = p->next;
+			while(tail){
+				if(p->identifier == tail->identifier){
+					return MOSQ_ERR_DUPLICATE_PROPERTY;
+				}
+				tail = tail->next;
 			}
-			tail = tail->next;
 		}

 		p = p->next;
@@ -43,8 +43,8 @@ Contributors:
 int send__publish(struct mosquitto *mosq, uint16_t mid, const char *topic, uint32_t payloadlen, const void *payload, uint8_t qos, bool retain, bool dup, uint32_t subscription_identifier, const mosquitto_property *store_props, uint32_t expiry_interval)
 {
 #ifdef WITH_BROKER
-#ifdef WITH_BRIDGE
 	size_t len;
+#ifdef WITH_BRIDGE
 	struct mosquitto__bridge_topic *cur_topic;
 	bool match;
 	int rc;
@@ -61,6 +61,15 @@ int send__publish(struct mosquitto *mosq, uint16_t mid, const char *topic, uint3
 	}

 #ifdef WITH_BROKER
+	if(mosq->listener && mosq->listener->mount_point){
+		len = strlen(mosq->listener->mount_point);
+		if(len < strlen(topic)){
+			topic += len;
+		}else{
+			/* Invalid topic string. Should never happen, but silently swallow the message anyway. */
+			return MOSQ_ERR_SUCCESS;
+		}
+	}
 #ifdef WITH_BRIDGE
 	if(mosq->bridge && mosq->bridge->topics && mosq->bridge->topic_remapping){
 		LL_FOREACH(mosq->bridge->topics, cur_topic){
@@ -108,6 +108,12 @@ int mosquitto_socks5_set(struct mosquitto *mosq, const char *host, int port, con

 	return MOSQ_ERR_SUCCESS;
 #else
+	UNUSED(mosq);
+	UNUSED(host);
+	UNUSED(port);
+	UNUSED(username);
+	UNUSED(password);
+
 	return MOSQ_ERR_NOT_SUPPORTED;
 #endif
 }
@@ -37,6 +37,9 @@ static void srv_callback(void *arg, int status, int timeouts, unsigned char *abu
 {   
 	struct mosquitto *mosq = arg;
 	struct ares_srv_reply *reply = NULL;
+
+	UNUSED(timeouts);
+
 	if(status == ARES_SUCCESS){
 		status = ares_parse_srv_reply(abuf, alen, &reply);
 		if(status == ARES_SUCCESS){
@@ -58,6 +61,8 @@ int mosquitto_connect_srv(struct mosquitto *mosq, const char *host, int keepaliv
 	int rc;
 	if(!mosq) return MOSQ_ERR_INVAL;

+	UNUSED(bind_address);
+
 	if(keepalive < 0 || keepalive > UINT16_MAX){
 		return MOSQ_ERR_INVAL;
 	}
@@ -42,7 +42,7 @@ const char *mosquitto_strerror(int mosq_errno)
 		case MOSQ_ERR_PROTOCOL:
 			return "A network protocol error occurred when communicating with the broker.";
 		case MOSQ_ERR_INVAL:
-			return "Invalid function arguments provided.";
+			return "Invalid arguments provided.";
 		case MOSQ_ERR_NO_CONN:
 			return "The client is not currently connected.";
 		case MOSQ_ERR_CONN_REFUSED:
@@ -129,6 +129,9 @@ void *mosquitto__thread_main(void *obj)
 		/* Sleep for our keepalive value. publish() etc. will wake us up. */
 		mosquitto_loop_forever(mosq, mosq->keepalive*1000, 1);
 	}
+	if(mosq->threaded == mosq_ts_self){
+		mosq->threaded = mosq_ts_none;
+	}

 	return obj;
 }
@@ -43,7 +43,7 @@
 					<para>
 						Load configuration from a file. If not given, then the broker will listen on port 1883 bound to the loopback interface,
 						and the default values as described in
-						<citerefentry><refentrytitle><link xlink:href="mosquitto_conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
+						<citerefentry><refentrytitle><link xlink:href="mosquitto-conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
 						are used.
 					</para>
 					<important><para>See the <option>-p</option> option for a description of changes in behaviour from 1.6.x to 2.0.</para></important>
@@ -102,7 +102,7 @@
 		<title>Configuration</title>
 		<para>The broker can be configured using a configuration file as
 			described in
-			<citerefentry><refentrytitle><link xlink:href="mosquitto_conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
+			<citerefentry><refentrytitle><link xlink:href="mosquitto-conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
 			and this is the main point of information for mosquitto.
 			The files required for SSL/TLS support are described in 
 			<citerefentry><refentrytitle><link xlink:href="mosquitto-tls-7.html">mosquitto-tls</link></refentrytitle><manvolnum>7</manvolnum></citerefentry>.
@@ -563,7 +563,7 @@
 						dropped due to inflight/queuing limits. See the
 						max_inflight_messages and max_queued_messages options
 						in
-						<citerefentry><refentrytitle><link xlink:href="mosquitto_conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
+						<citerefentry><refentrytitle><link xlink:href="mosquitto-conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
 						for more information.</para>
 				</listitem>
 			</varlistentry>
@@ -670,11 +670,16 @@
 		local to each
 		broker.</para>
 		<para>For information on configuring bridges, see
-		<citerefentry><refentrytitle><link xlink:href="mosquitto_conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+		<citerefentry><refentrytitle><link xlink:href="mosquitto-conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 	</refsect1>

 	<refsect1>
 		<title>Signals</title>
+		<para>
+			On POSIX systems Mosquitto can receive signals and act on them as
+			described below. To send signals, use e.g.
+			<command>kill -HUP &lt;process id of mosquitto&gt;</command>
+		</para>
 		<variablelist>
 			<varlistentry>
 				<term>SIGHUP</term>
@@ -684,7 +689,7 @@
 					the <option>-c</option> argument was provided when
 					mosquitto was started. Not all configuration parameters can
 					be reloaded without restarting. See
-					<citerefentry><refentrytitle><link xlink:href="mosquitto_conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
+					<citerefentry><refentrytitle><link xlink:href="mosquitto-conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>
 					for details.</para>
 					<para>If TLS certificates are in use, then mosquitto will
 					also reload certificate on receiving a SIGHUP.</para>
@@ -716,7 +721,7 @@
 			<varlistentry>
 				<term><filename>/etc/mosquitto/mosquitto.conf</filename></term>
 				<listitem>
-					<para>Configuration file. See <citerefentry><refentrytitle><link xlink:href="mosquitto_conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+					<para>Configuration file. See <citerefentry><refentrytitle><link xlink:href="mosquitto-conf-5.html">mosquitto.conf</link></refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 				</listitem>
 			</varlistentry>
 			<varlistentry>
@@ -28,6 +28,12 @@
 		use the default values listed below. See
 		<citerefentry><refentrytitle><link xlink:href="mosquitto-8.html">mosquitto</link></refentrytitle><manvolnum>8</manvolnum></citerefentry>
 		for information on how to load a configuration file.</para>
+		<para>
+			Mosquitto can be instructed to reload the configuration file by sending
+			a SIGHUP signal as described in the Signals section of
+			<citerefentry><refentrytitle><link xlink:href="mosquitto-8.html">mosquitto</link></refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+			Not all configuration options can be reloaded, as detailed in the options below.
+		</para>
 	</refsect1>

 	<refsect1>
@@ -619,6 +625,15 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S
 						The maximum value allowable, and default value, is
 						65535. Do not set below 10 seconds.</para>

+					<para>
+						For MQTT v3.1.1 and v3.1 clients, there is no mechanism
+						to tell the client what keepalive value they should use.
+						If an MQTT v3.1.1 or v3.1 client specifies a keepalive
+						time greater than max_keepalive they will be sent a
+						CONNACK message with the "identifier rejected" reason
+						code, and disconnected.
+					</para>
+
 					<para>This option applies globally.</para>

 					<para>Reloaded on reload signal.</para>
@@ -776,9 +791,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S
 						<option>acl_file</option>, <option>psk_file</option>,
 						<option>allow_anonymous</option>,
 						<option>allow_zero_length_clientid</option>,
-						<option>plugin</option>,
-						<option>auth_opt_*</option>,
 						<option>auto_id_prefix</option>.</para>
+						<option>plugin</option>,
+						<option>plugin_opt_*</option>,
 					<para>Note that if set to true, then a durable client (i.e.
 						with clean session set to false) that has disconnected
 						will use the ACL settings defined for the listener that
@@ -883,17 +898,25 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S
 			</varlistentry>
 			<varlistentry>
 				<term><option>plugin_opt_*</option> <replaceable>value</replaceable></term>
-				<term><option>auth_opt_*</option> <replaceable>value</replaceable></term>
 				<listitem>
-					<para>Options to be passed to a plugin. See the
-						specific plugin instructions.</para>
+					<para>
+						Options to be passed to the most recent
+						<option>plugin</option> defined in the
+						configuration file. See the specific
+						plugin instructions for details of what
+						options are available.
+					</para>

 					<para>Applies to the current plugin/global_plugin being configured.</para>
+					<para>
+						This is also available as the <option>auth_opt_*</option>
+						option, but this use is deprecated and will be removed
+						in a future version.
+					</para>
 				</listitem>
 			</varlistentry>
 			<varlistentry>
 				<term><option>plugin</option> <replaceable>file path</replaceable></term>
-				<term><option>auth_plugin</option> <replaceable>file path</replaceable></term>
 				<listitem>
 					<para>Specify an external module to use for authentication,
 						access control, and other features. This allows custom
@@ -916,6 +939,11 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S
 						<ulink url="https://mosquitto.org/documentation/dynamic-security/"/>
 						and the <option>global_plugin</option> option.
 					</para>
+					<para>
+						This is also available as the <option>auth_plugin</option>
+						option, but this use is deprecated and will be removed
+						in a future version.
+					</para>
 				</listitem>
 			</varlistentry>
 			<varlistentry>
@@ -109,8 +109,12 @@
 			connections. It is strongly recommended that you use an encrypted
 			connection for anything more than the most basic setup.</para>
 		<para>To enable TLS connections when using x509 certificates, one of
-			either <option>--cafile</option> or <option>--capath</option> must
+			either <option>--cafile</option> or <option>--capath</option> can
 			be provided as an option.</para>
+		<para>Alternatively, if the <option>-p 8883</option> option is used
+			then the OS provided certificates will be loaded and neither
+			<option>--cafile</option> or <option>--capath</option> are
+			needed</para>
 		<para>To enable TLS connections when using TLS-PSK, you must use the
 			<option>--psk</option> and the <option>--psk-identity</option>
 			options.</para>
@@ -120,8 +120,12 @@
 			connections. It is strongly recommended that you use an encrypted
 			connection for anything more than the most basic setup.</para>
 		<para>To enable TLS connections when using x509 certificates, one of
-			either <option>--cafile</option> or <option>--capath</option> must
+			either <option>--cafile</option> or <option>--capath</option> can
 			be provided as an option.</para>
+		<para>Alternatively, if the <option>-p 8883</option> option is used
+			then the OS provided certificates will be loaded and neither
+			<option>--cafile</option> or <option>--capath</option> are
+			needed</para>
 		<para>To enable TLS connections when using TLS-PSK, you must use the
 			<option>--psk</option> and the <option>--psk-identity</option>
 			options.</para>
@@ -127,8 +127,12 @@
 			connections. It is strongly recommended that you use an encrypted
 			connection for anything more than the most basic setup.</para>
 		<para>To enable TLS connections when using x509 certificates, one of
-			either <option>--cafile</option> or <option>--capath</option> must
+			either <option>--cafile</option> or <option>--capath</option> can
 			be provided as an option.</para>
+		<para>Alternatively, if the <option>-p 8883</option> option is used
+			then the OS provided certificates will be loaded and neither
+			<option>--cafile</option> or <option>--capath</option> are
+			needed</para>
 		<para>To enable TLS connections when using TLS-PSK, you must use the
 			<option>--psk</option> and the <option>--psk-identity</option>
 			options.</para>
@@ -12,16 +12,21 @@
 # Place this script in /etc/letsencrypt/renewal-hooks/deploy/ and make it
 # executable after editing it to your needs.

-if [ ${RENEWED_DOMAINS} = "my-mosquitto-domain" ]; then
+# Set which domain this script will be run for
+MY_DOMAIN=example.com
+# Set the directory that the certificates will be copied to.
+CERTIFICATE_DIR=/etc/mosquitto/certs
+
+if [ "${RENEWED_DOMAINS}" = "${MY_DOMAIN}" ]; then
 	# Copy new certificate to Mosquitto directory
-	cp ${RENEWED_LINEAGE}/fullchain.pem /etc/mosquitto/certs/server.pem
-	cp ${RENEWED_LINEAGE}/privkey.pem /etc/mosquitto/certs/server.key
+	cp ${RENEWED_LINEAGE}/fullchain.pem ${CERTIFICATE_DIR}/server.pem
+	cp ${RENEWED_LINEAGE}/privkey.pem ${CERTIFICATE_DIR}/server.key

 	# Set ownership to Mosquitto
-	chown mosquitto: /etc/mosquitto/certs/server.pem /etc/mosquitto/certs/server.key
+	chown mosquitto: ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key

 	# Ensure permissions are restrictive
-	chmod 0600 /etc/mosquitto/certs/server.pem /etc/mosquitto/certs/server.key
+	chmod 0600 ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key

 	# Tell Mosquitto to reload certificates and configuration
 	pkill -HUP -x mosquitto
@@ -19,8 +19,14 @@
 # options are controlled on a per listener basis. The following options are
 # affected:
 #
-# password_file acl_file psk_file plugin plugin_opt_* allow_anonymous
-# auto_id_prefix allow_zero_length_clientid
+# acl_file
+# allow_anonymous
+# allow_zero_length_clientid
+# auto_id_prefix
+# password_file
+# plugin
+# plugin_opt_*
+# psk_file
 #
 # Note that if set to true, then a durable client (i.e. with clean session set
 # to false) that has disconnected will use the ACL settings defined for the
@@ -75,6 +81,12 @@
 # value, otherwise they will be sent a server keepalive telling them to use
 # max_keepalive. This only applies to MQTT v5 clients. The maximum value
 # allowable is 65535. Do not set below 10.
+#
+# For MQTT v3.1.1 and v3.1 clients, there is no mechanism to tell the client
+# what keepalive value they should use. If an MQTT v3.1.1 or v3.1 client
+# specifies a keepalive time greater than max_keepalive they will be sent a
+# CONNACK message with the "identifier rejected" reason code, and disconnected.
+#
 #max_keepalive 65535

 # For MQTT v5 clients, it is possible to have the server send a "maximum packet
@@ -538,7 +550,7 @@
 #
 # See the TLS client require_certificate and use_identity_as_username options
 # for alternative authentication options. If a plugin is used as well as
-# password_file, the plugin check will be made after the password_file check.
+# password_file, the plugin check will be made first.
 #password_file

 # Access may also be controlled using a pre-shared-key file. This requires
@@ -546,7 +558,7 @@
 # lines in the format:
 # identity:key
 # The key should be in hexadecimal format without a leading "0x".
-# If an plugin is used as well, the plugin check will be made second.
+# If an plugin is used as well, the plugin check will be made first.
 #psk_file

 # Control access to topics on the broker using an access control list
@@ -601,7 +613,7 @@
 # pattern write sensor/%u/data
 #
 # If an plugin is used as well as acl_file, the plugin check will be
-# made after the acl_file check.
+# made first.
 #acl_file

 # -----------------------------------------------------------------
@@ -615,8 +627,14 @@
 # The plugin option can be specified multiple times to load multiple
 # plugins. The plugins will be processed in the order that they are specified
 # here. If the plugin option is specified alongside either of
-# password_file or acl_file then the plugin checks will be made after the built
-# in checks.
+# password_file or acl_file then the plugin checks will be made first.
+#
+# If the per_listener_settings option is false, the plugin will be apply to all
+# listeners. If per_listener_settings is true, then the plugin will apply to
+# the current listener being defined only.
+#
+# This option is also available as `auth_plugin`, but this use is deprecated
+# and will be removed in the future.
 #
 #plugin <path to plugin>

@@ -624,6 +642,9 @@
 # plugin here as described by the plugin instructions. All options named
 # using the format plugin_opt_* will be passed to the plugin, for example:
 #
+# This option is also available as `auth_opt_*`, but this use is deprecated
+# and will be removed in the future.
+#
 # plugin_opt_db_host
 # plugin_opt_db_port
 # plugin_opt_db_username
@@ -45,7 +45,7 @@ if(CJSON_FOUND AND WITH_TLS)
 		POSITION_INDEPENDENT_CODE 1
 	)

-	target_link_libraries(mosquitto_dynamic_security ${CJSON_LIBRARIES})
+	target_link_libraries(mosquitto_dynamic_security ${CJSON_LIBRARIES} ${OPENSSL_LIBRARIES})
 	if(WIN32)
 		target_link_libraries(mosquitto_dynamic_security mosquitto)
 	endif()
@@ -2,7 +2,7 @@

 MAJOR=2
 MINOR=0
-REVISION=11
+REVISION=12

 sed -i "s/^VERSION=.*/VERSION=${MAJOR}.${MINOR}.${REVISION}/" config.mk

@@ -1,5 +1,5 @@
 name: mosquitto
-version: 2.0.11
+version: 2.0.12
 summary: Eclipse Mosquitto MQTT broker
 description: This is a message broker that supports version 5.0, 3.1.1, and 3.1 of the MQTT
    protocol.
--- a/Show More
+++ b/Show More