Eclipse Mosquitto™ 1.4 Release Review

Type
Release
State
Successful
End Date of the Review Period

Reviews run for a minimum of one week. The outcome of the review is decided on this date. This is the last day to make comments or ask questions about this review.

Release

1.4

Description

This is the first release of the Mosquitto project from within the Eclipse Foundation.

It introduces a number of important changes:

  • Optional support for Websockets in the broker.
  • Bridge behaviour on the local broker has changed due to the introduction of the local_clientid/local_username options. This allows different authentication methods for the remote and local brokers.
  • The default TLS behaviour has changed to accept all of TLS v1.2, v1.1 and v1.0, rather than only only one version of the protocol. It is still possible to restrict a listener to a single version of TLS.
  • The Python client has been removed now that the Eclipse Paho Python client has had a release.
  • When a durable client reconnects, its queued messages are now checked against ACLs in case of a change in username/ACL state since it last connected.
  • New use_username_as_clientid option on the broker, for preventing hijacking of a client id.
  • The client library and clients now have experimental SOCKS5 support.
  • Support for wildcard certificates for clients and bridges.
  • The clients have support for config files with default options.

There are more changes not listed here, as well as bug fixes.

API Certification

The project leadership certifies that the APIs in this release are "Eclipse Quality".

Architectural Issues

Static analysis of the entire C code base, using Coverity Scan, highlighted some potential logic errors which have been fixed.

Gerrit is used to review contributions on the git source repositories.

Testing has been carried out externally to Eclipse, but will be migrated to the Mosquitto HIPP instance as soon as possible.

 

Security Issues

Both the broker and client code makes use of OpenSSL to provide secure TLS connections. OpenSSL is assumed to already be present on the end user machine, so the end user must ensure that it is up to date.

It is possible to use LibreSSL instead of OpenSSL by disabling TLS-PSK support.

Non-Code Aspects

User documentation is present and up to date in the form of man pages and API documents, both of which are available on the mosquitto website in HTML versions.

Tutorials and articles on various features of the broker have been written by the community.

The mosquitto.org website still runs outside of the Eclipse infrastructure, this will be consolidated in the next release cycle.

Usability Details

As a long running background service, the mosquitto broker usability doesn't have a user interface. Every attempt is made to make the configuration files straightforward and easy to use.

The command line client interfaces are documented and written in a style that should be familiar to any user of command line utilities.

End of Life

The broker information topics $SYS/broker/clients/active and $SYS/broker/clients/inactive are now deprecated and users should subscribe to the new topics $SYS/broker/clients/connected and $SYS/broker/clients/disconnected respectively. The active/inactive topics will be removed in a future release.

Standards

Broker, bridge and client support for MQTT v3.1 and v3.1.1.

 

Communities

There has been a lot of interest in the 1.4 release of mosquitto, primarily for the websockets support and some people have written tutorials on building mosquitto 1.4 from the repository:

  • https://www.justinribeiro.com/chronicle/2014/10/22/mosquitto-libwebsockets-google-compute-engine-setup/
  • https://goochgooch.wordpress.com/2014/08/01/building-mosquitto-1-4/

Other aspects of community involvement include the creation of binary packages for mosquitto on systems not supported directly by the project, and the writing of wrappers for the libmosquitto client library for at least the PHP and Swift programming languages.

Community supported packages include:

  • "homebrew" on Mac OS X
  • FreeBSD ports
  • Arch Linux

Interactions with the community both on the project mailing list and through bugzilla are healthy. There is a lot of interest from people integrating mosquitto with their systems. A good proportion of the bugs reported show that the person reporting the bug have spent analysing the problem before submitting the report, and often provide a hint as to where the problem lies.

The mosquitto website currently receives the most visitors out of the Eclipse IoT projects. This can be accounted for by the relatively long lifespan of the project outside of Eclipse, but also due to the fairly substantial number of blog posts that have been by non-project members that refer to mosquitto, increasing the visibility of the project.

Facebook adopted the libmosquitto client code for use in their Facebook Messenger app on the iPhone. They state they have 500 million mobile monthly active users as of November, 2014, and iPhone users will be a substantial proportion of that number.