Adding OCSP Stapling support to mosquitto, so that the TLS client side
requests the certificate status and checks it.
This code uses the OpenSSL-based OCSP implementation and is somewhat
based on the libcurl code for OCSP stapling.
Signed-off-by: Dr. Lars Voelker <lars.voelker@bmw.de>
Auth plugins can be configured to disable the check for +# in
usernames/client ids with the auth_plugin_deny_special_chars option.
Thanks to wiebeytec.
Bug: https://github.com/eclipse/mosquitto/issues/462
Using the standard <syslog.h> header instead of <sys/syslog.h> makes it
consistent with other source files and fixes compilation on Android.
Signed-off-by: Fredrik Fornwall <fredrik@fornwall.net>
Using the standard <syslog.h> header instead of <sys/syslog.h> makes it
consistent with other source files and fixes compilation on Android.
Signed-off-by: Fredrik Fornwall <fredrik@fornwall.net>
This update adds an option to only publishes bridge
notification messages to the local side of the bridge.
It adds a config file option called notifications_local_only
that accepts a boolean value, defaults to false to be
consistent with existing behaviour.
Fixes#233
Signed-off-by: Ben Hardill <hardillb@uk.ibm.com>
Limiting queued message depth purely based on message count is hard to
control for memory constrained devices. The size of messages can vary
wildly, from a few bytes, to a few kilobytes. Support a new
max_queued_bytes option, and drop packets when the first limit is
reached. Option defaults to 0 (disabled) by default.
Support also a max_inflight_bytes variable, with similar behaviour.
Fixes (partof) https://github.com/eclipse/mosquitto/issues/100
This pulls up some helper routines for calculating whether to allow
inflight or queuing, resolving some inconsistences in connection
resumption.
Signed-off-by: Karl Palsson <karlp@etactica.com>
This adds an alternative option to use_identity_as_username.
In contrast to use_identity_as_username this option uses the full x509 subject as the username.
The subject is formatted as an rfc4514 distingushed name e.g. CN=client,OU=unit,O=org
Signed-off-by: Fabian Ruff <fabian@progra.de>
This change in behaviour can be justified by considering when the
timeout may have occurred.
* If a connection is unreliable and has dropped, but without one end
noticing, the messages will be retried on reconnection. Sending
additional PUBLISH or PUBREL would not have changed anything.
* If a client is overloaded/unable to respond/has a slow connection then
sending additional PUBLISH or PUBREL would not help the client catch
up. Once the backlog has cleared the client will respond. If it is not
able to catch up, sending additional duplicates would not help either.
Dr. Lars Voelker
Roger A. Light
Fredrik Fornwall
Ben Hardill
Karl Palsson
Frank Busse
Anmol Sarma
Fabian Ruff