mosquitto 1.4.15-2ubuntu0.18.04.1 "Socket error on client <unknown>, disconnecting."

[Thomas E. Horner]

mosquitto version 1.4.15-2ubuntu0.18.04.1 introduces the following issue:

1550048392: mosquitto version 1.4.15 (build date Wed, 06 Feb 2019 17:03:31 +0000) starting
1550048392: Config loaded from /etc/mosquitto/mosquitto.conf.
1550048392: Opening ipv4 listen socket on port 8883.
1550048392: Opening ipv6 listen socket on port 8883.
1550048392: Opening ipv4 listen socket on port 1883.
1550048392: Opening ipv6 listen socket on port 1883.
1550048393: New connection from [client-ip-removed-before-posting] on port 8883.
1550048393: New connection from [client-ip-removed-before-posting] on port 8883.
1550048394: New connection from 127.0.0.1 on port 1883.
1550048394: Client [client-name-removed-before-posting]5c550b4417cd1 disconnected. >>>>>> https://bit.ly/2BtN52W
1550048394: Socket error on client <unknown>, disconnecting.
1550048394: New connection from 127.0.0.1 on port 1883.
1550048394: Client iot-bbq5c550b4434687 disconnected.
1550048394: Socket error on client <unknown>, disconnecting.
1550048394: New connection from 127.0.0.1 on port 1883.
1550048394: Client iot-bbq5c550b4441570 disconnected.
1550048394: Socket error on client <unknown>, disconnecting.
1550048395: Client esp32-shutter-304e363633178717 disconnected.
1550048395: Socket error on client <unknown>, disconnecting.
1550048395: Client esp32-rcswitch-304e363633107453 disconnected.
1550048395: Socket error on client <unknown>, disconnecting.
1550048395: New connection from [client-ip-removed-before-posting] on port 8883.
1550048395: New connection from [client-ip-removed-before-posting] on port 8883.
1550048397: Socket error on client <unknown>, disconnecting.
1550048397: Socket error on client <unknown>, disconnecting.
1550048398: New connection from [client-ip-removed-before-posting] on port 8883.
1550048399: New connection from [client-ip-removed-before-posting] on port 8883.
1550048399: New connection from [client-ip-removed-before-posting] on port 8883.
1550048399: Client cypher disconnected. https://bit.ly/2BtN52W
1550048399: Socket error on client <unknown>, disconnecting.
1550048400: Socket error on client <unknown>, disconnecting.
1550048400: New connection from [client-ip-removed-before-posting] on port 8883.
1550048401: Socket error on client <unknown>, disconnecting.
1550048401: New connection from [client-ip-removed-before-posting] on port 8883.
1550048402: Socket error on client <unknown>, disconnecting.
1550048403: Socket error on client <unknown>, disconnecting.
1550048403: New connection from [client-ip-removed-before-posting] on port 8883.
1550048404: New connection from [client-ip-removed-before-posting] on port 8883.
1550048404: New connection from 127.0.0.1 on port 1883.
1550048404: Socket error on client <unknown>, disconnecting.
1550048404: New connection from 127.0.0.1 on port 1883.
1550048404: Socket error on client <unknown>, disconnecting.
1550048404: New connection from 127.0.0.1 on port 1883.
1550048404: Socket error on client <unknown>, disconnecting.
1550048405: Socket error on client <unknown>, disconnecting.
1550048405: New connection from [client-ip-removed-before-posting] on port 8883.
1550048406: Socket error on client <unknown>, disconnecting.
1550048406: New connection from [client-ip-removed-before-posting] on port 8883.
1550048407: Socket error on client <unknown>, disconnecting.
1550048408: New connection from [client-ip-removed-before-posting] on port 8883.
1550048408: Socket error on client <unknown>, disconnecting.
1550048409: New connection from [client-ip-removed-before-posting] on port 8883.
1550048409: Socket error on client <unknown>, disconnecting.
1550048410: Socket error on client <unknown>, disconnecting.
1550048410: New connection from [client-ip-removed-before-posting] on port 8883.
1550048412: Socket error on client <unknown>, disconnecting.
1550048414: New connection from [client-ip-removed-before-posting] on port 8883.
1550048414: New connection from [client-ip-removed-before-posting] on port 8883.
1550048414: New connection from 127.0.0.1 on port 1883.
1550048414: Socket error on client <unknown>, disconnecting.
1550048414: New connection from 127.0.0.1 on port 1883.
1550048414: Socket error on client <unknown>, disconnecting.
1550048414: New connection from 127.0.0.1 on port 1883.
1550048414: Socket error on client <unknown>, disconnecting.
1550048415: Socket error on client <unknown>, disconnecting.
1550048416: New connection from [client-ip-removed-before-posting] on port 8883.
1550048416: Socket error on client <unknown>, disconnecting.
1550048416: New connection from [client-ip-removed-before-posting] on port 8883.
1550048418: Socket error on client <unknown>, disconnecting.
1550048418: Socket error on client <unknown>, disconnecting.
1550048419: New connection from [client-ip-removed-before-posting] on port 8883.
1550048419: New connection from [client-ip-removed-before-posting] on port 8883.
1550048419: New connection from [client-ip-removed-before-posting] on port 8883.
1550048420: Socket error on client <unknown>, disconnecting.
1550048421: Socket error on client <unknown>, disconnecting.
1550048421: New connection from [client-ip-removed-before-posting] on port 8883.
1550048421: Socket error on client <unknown>, disconnecting.
1550048422: New connection from [client-ip-removed-before-posting] on port 8883.
1550048423: Socket error on client <unknown>, disconnecting.
1550048424: Socket error on client <unknown>, disconnecting.
1550048424: New connection from 127.0.0.1 on port 1883.
1550048424: Socket error on client <unknown>, disconnecting.
1550048424: New connection from 127.0.0.1 on port 1883.
1550048424: Socket error on client <unknown>, disconnecting.
1550048424: New connection from 127.0.0.1 on port 1883.
1550048424: Socket error on client <unknown>, disconnecting.
1550048424: New connection from [client-ip-removed-before-posting] on port 8883.
1550048425: New connection from [client-ip-removed-before-posting] on port 8883.
1550048426: Socket error on client <unknown>, disconnecting.
1550048426: New connection from [client-ip-removed-before-posting] on port 8883.
1550048427: Socket error on client <unknown>, disconnecting.
1550048427: New connection from [client-ip-removed-before-posting] on port 8883.
1550048428: Socket error on client <unknown>, disconnecting.
1550048429: Socket error on client <unknown>, disconnecting.
1550048430: New connection from [client-ip-removed-before-posting] on port 8883.
1550048430: New connection from [client-ip-removed-before-posting] on port 8883.
1550048430: Socket error on client <unknown>, disconnecting.
1550048431: New connection from [client-ip-removed-before-posting] on port 8883.
1550048431: Socket error on client <unknown>, disconnecting.
1550048432: New connection from [client-ip-removed-before-posting] on port 8883.
1550048433: Socket error on client <unknown>, disconnecting.
1550048433: New connection from [client-ip-removed-before-posting] on port 8883.
1550048434: Socket error on client <unknown>, disconnecting.
1550048434: New connection from 127.0.0.1 on port 1883.
1550048434: Socket error on client <unknown>, disconnecting.
1550048434: New connection from 127.0.0.1 on port 1883.
1550048434: Socket error on client <unknown>, disconnecting.
1550048434: New connection from 127.0.0.1 on port 1883.
1550048434: Socket error on client <unknown>, disconnecting.
1550048435: Socket error on client <unknown>, disconnecting.
1550048435: New connection from [client-ip-removed-before-posting] on port 8883.
1550048436: New connection from [client-ip-removed-before-posting] on port 8883.
[...]
.
https://bit.ly/2BtN52W

downgraded to previous version using
sudo apt-get install mosquitto=1.4.15-2
-> issue is gone again:

1550048891: mosquitto version 1.4.15 (build date Sat, 07 Apr 2018 11:16:43 +0100) starting
1550048891: Config loaded from /etc/mosquitto/mosquitto.conf.
1550048891: Opening ipv4 listen socket on port 8883.
1550048891: Opening ipv6 listen socket on port 8883.
1550048891: Opening ipv4 listen socket on port 1883.
1550048891: Opening ipv6 listen socket on port 1883.
1550048892: New connection from [client-ip-removed-before-posting] on port 8883.
1550048892: New connection from [client-ip-removed-before-posting] on port 8883.
[...]

[Roger Light (roger.light)]

Can you share what config you are using?

[Thomas E. Horner (thomas.horner)]

mosquitto.conf is attaced

[Thomas E. Horner (thomas.horner)]

/etc/mosquitto/conf.d/local.conf is attached

[Thomas E. Horner (thomas.horner)]

local.conf is the only config file inside /etc/mosquitto/conf.d/

[Thomas E. Horner (thomas.horner)]

/etc/mosquitto/users.acl is attached

[Thomas E. Horner (thomas.horner)]

users.pwd does *not* contain any empty lines or comments
and each line *does* contain the ":" character

[Thomas E. Horner (thomas.horner)]

I see that the acl handling has been changed.

+ if(context->username && context->acl_list == NULL){
+ return MOSQ_ERR_INVAL;
+ }

Not sure this has anything to do with the issue.

[Pawel Kraszewski (root-kraszewscy)]

I have hit the very same error.

My scenario is:

* Mosquitto is listening on port 127.0.0.1:X (tcp) and 0.0.0.0:X+1 (ssl)

* I have ACL and users set.

* Logins via SSL are authorized via certificate only and have no matching user entry, plus "use_username_as_clientid true", "require_certificate true" and "use_identity_as_username true".

* SSL stations are FreeBSD with mosquitto 1.5.5 bridging local queues to Ubuntu central server

* Local login via tcp is via user/login.

* ACL is user1/topic, then user2/topic (for login/pass entries), then pattern for certificate users.There's no user/topic entry for any cert-based users.

Local logins succeed, SSL logins are rejected with abovementioned "Socket error on client <unknown>, disconnecting."

Downgrading mosquitto to basic 1.4.15-2 solved problem.

[Thomas E. Horner (thomas.horner)]

I've re-built 1.4.15-2ubuntu0.18.04.1 from source locally and I get the same connect issue.

The issue is caused by the patch "mosquitto-1.4.15-cve-2018-12546".
With that one removed and mosquitto-1.4.x-cve-2018-12550.patch and mosquitto-1.4.x-cve-2018-12551.patch re-added the binary works again.

With *all* patches fully applied again but only the lines I mentioned in #7 commented out, mosquitto works again. So definitely that's the issue.

I didn't analyse the ACL system thoroughly but this has to do with the ACL not being set explicitly for the user, which - according to my understanding - is perfectly legal. See my /etc/mosquitto/users.acl from post #5.

I've locally changed
    if(context->username && context->acl_list == NULL){
      return MOSQ_ERR_INVAL;
    }

to
    if(context->username && context->acl_list == NULL){
      _mosquitto_log_printf(NULL, MOSQ_LOG_NOTICE, "ACL entry not found for client with username \"%s\"", context->username);
      return MOSQ_ERR_SUCCESS;
    }

The root cause might be a misunderstanding of the original code that this patch moves into a new function. It seems that original code was only meant to *load* the users's ACLs (if any) and not to *find* that ACLs.

So basically the function acl__find_acls seems to be named wrong. The name should be more like acl__load_acls and the function should return success *even* if there's *NO* ACL found specific for that user.

Alternatively mosquitto_acl_check needs to be called in read_handle_server.c when acl__find_acls returns MOSQ_ERR_INVAL so that the %c and %u pattern matching will be performed, but probably the first option above is the better one.

[r0mulux (r-marie)]

I have same problem, clients (mqttfx or java with paho) can not connect to mosquitto with same error if option acl_file is used.
No problem with mosquitto 1.5.8-0mosquitto1~bion from ppa.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Thomas E. Horner (thomas.horner)]

Why would this be incomplete?

[Gianfranco Costamagna (costamagnagianfranco)]

Hello, can you please try again with a newer version e.g. from Ubuntu mantic? 2.0.18 is the current version, if it is still reproducible, just please set status back to new

[Launchpad Janitor (janitor)]

[Expired for mosquitto (Ubuntu) because there has been no activity for 60 days.]