Eclipse Hono 1.6.0

1.6.0

Description

This minor release introduces the following new features

  • Apache Kafka is now supported as a messaging system for events and telemetry messages. This can be enabled by configuring protocol adapters to use Hono's new Kafka-based client. Note that this is considered an experimental feature for the time being, i.e. the functionality and API may change without prior notice.
  • New APIs have been added for the Kafka-based messaging. Please refer to the API docs the specifications.
  • The MQTT adapter now allows clients to indicate whether they want the target device's tenant and/or device IDs to be included in the topic used when publishing commands.
  • The caching behavior of the protocol adapters' AMQP based registry clients has been changed. All adapter Verticle instances now share a single cache instance per service. In particular, there is a single cache for all responses returned by the Tenant, Device Registration and Credentials service respectively. In addition, each cache is now being used for all responses to requests regardless of the tenant. Consequently, the service client configurations' responseCacheMinSize and responseCacheMaxSize properties now determine the overall number of responses that can be cached per service. In previous versions the properties determined the number of entries per client instance and tenant. The new approach allows for better control over the maximum amount of memory being used by the cache and should also increase cache hits when deploying multiple adapter Verticle instances. The org.eclipse.hono.adapter.client.registry.amqp.ProtonBasedTenantClient now makes sure that only a single request to the Tenant service is issued when multiple (parallel) get method invocations run into a cache miss. This should reduce the load on the Tenant service significantly in scenarios where devices of the same tenant connect to an adapter at a high rate, e.g. when re-connecting after one or more adapter pods have crashed.
  • The Device Registry Management API's update credentials operation has been extended to allow specifying the auth-id and validity period implicitly by means of including a (Base64 encoded) client certificate in the new cert property. This can be used instead of specifying the client certificate's subject DN and public key's validity period explicitly in the auth-id and secrets properties. This should make setting the correct auth-id value much less error prone.
  • Hono now supports auto-provisioning of devices that connect via gateway. For more information please refer to the Device Provisioning concept page in the documentation.
  • The Device Registry Management API has been extended now to support searching tenants with optional filters, paging and sorting options. Note that this is implemented and supported by the MongoDB based device registry only at the moment.

In addition to these new features, many bugs have been fixed as well.

API Certification

The project leadership certifies that the APIs in this release are "Eclipse Quality".

Architectural Issues

The dependency on the legacy client module has been further reduced by adding implementations of the interfaces defined by the new clients/adapter module which no longer depend on the corresponding legacy client module implementation classes.

The AMQP adapter is now also available in a variant based on Quarkus instead of the Spring Boot framework. The plan is to gradually provide Quarkus based implementations of all standard adapters and services that come with Hono and then remove the dependency on Spring Boot altogether.

Security Issues

This release includes a fix for

  • CVE-2020-27220

    The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.
Conforms To UI/UX Guidelines
Not verified
End of Life

The legacy client module has been deprecated and will be removed completely in Hono 2.0.0.

Users should start migrating their code to use the newly added clients/* modules instead. These provide service client implementations that are geared towards particular use case scenarios and types of client applications. They also provide means to (almost) seamlessly switch between using the AMQP 1.0 Messaging Network and Kafka as the message transport under the hood.