Add config to adjust MQTT whether disconnect when publish or subscribe non-authorized topic#15123
Add config to adjust MQTT whether disconnect when publish or subscribe non-authorized topic#15123iamdrq wants to merge 4 commits intorabbitmq:mainfrom
Conversation
There was a problem hiding this comment.
The rationale of this PR makes sense because the MQTT 5.0 spec states:
Errors other than Malformed Packet and Protocol Errors cannot be anticipated by the sender because the receiver might have constraints which it has not communicated to the sender. A receiving Client or Server might encounter a transient error, such as a shortage of memory, that prevents successful processing of an individual MQTT Control Packet. Acknowledgment packets PUBACK, PUBREC, PUBREL, PUBCOMP, SUBACK, UNSUBACK with a Reason Code of 0x80 or greater indicate that the received packet, identified by a Packet Identifier, was in error. There are no consequences for other Sessions or other Packets flowing on the same Session.
EMQX also has a config option to toggle this disconnect on authz failure behaviour.
I find maintain_connection_on_authorization_failures is too long.
Let's name it disconnect_on_unauthorized (defaulting to true since that's today's behaviour).
@iamdrq tests are missing. Please add tests.
|
|
mqtt.disconnect_on_unauthorized=true(defualt) disconnect the clinet when publish or subscribe unauthorized topic. mqtt.disconnect_on_unauthorized=false subscribe unauthorized topic, reply SUBACK(non-authorized) and send retained messages for the successfully subscribed topics and keep connection. publish unauthorized topic, MQTT v5 and QoS1 reply with PUBACK including an error reason code and keep connection, MQTT v3 and QoS1 reply with PUBACK no error reason code and keep connection, QoS0 drop silently and keep connection.
|
@iamdrq this was not forgotten but chances are, it will now be reviewed after Jan 2. |
|
@michaelklishin Thanks for the update! That’s totally fine, I appreciate you letting me know. |
mqtt.disconnect_on_unauthorized=true(defualt) disconnect the clinet when publish or subscribe unauthorized topic. mqtt.disconnect_on_unauthorized=false subscribe unauthorized topic, reply SUBACK(non-authorized) and send retained messages for the successfully subscribed topics and keep connection. publish unauthorized topic, QoS1 reply with PUBACK(non-authorized) and keep connection, QoS0 drop silently and keep connection.
(cherry picked from commit 416bf86)
Proposed Changes
Thanks all works.
In MQTT spec, not clear descipe client whether disconnect when publish or subscribe non-authorized topic,
So implement has diffrent action:
In AMQP spec, disconnect client when touch non-authorized topic, so Rabbitmq MQTT keep this action now.
In MQTT spec,this is not clear.
Someone hope touch non-authorized topic disconnect and someone hope not, #12902
So let's add config to adjust Rabbitmq MQTT whether disconnect when
publishorsubscribenon-authorized topic,give control to the user.
rabbitmq.conf
mqtt.ignore_unauthorized=false
mqtt.ignore_unauthorized=true
Types of Changes
What types of changes does your code introduce to this project?
Checklist
CONTRIBUTING.mddocument