Since the wolfMQTT 2.1.0 release back in July, the team has been busy working on some major upgrades. Whether you’re running a client or a broker, there’s a lot to dig into in the current master branch on GitHub. We’ve focused on smoothing out the developer experience, tightening up protocol compliance, and, most importantly, a serious security hardening pass.
Here is the scoop on what has changed:
- Automatic Keep-Alive: The core client now handles PINGREQ automatically, so you can stop manually scheduling your pings. This was a requested feature, and we’ve made sure it respects your configuration (see GitHub issue #501).
- Smoother MQTT v5 Flow: We’ve made big improvements to how we handle flow control. The client is now better at enforcing Receive Maximum limits, which prevents duplicate QoS 2 message issues. We also improved adherence to Topic Alias Maximum and Maximum Packet Size.
- Smarter Broker Sessions: The broker is now fully compliant with MQTT v5 specifications. We’ve overhauled session semantics, including Session Expiry, Will Delay Interval, and Retain Handling, to ensure everything works as expected.
- Rock-Solid Persistence: We tackled several bugs in the session persistence layer. Expired messages are now actually purged, and we fixed issues where persistent sessions wouldn’t properly stick around after a WebSocket close.
- Security Hardening: This was a big one. We closed over 170 security findings from our internal Fenrir analyzer and Coverity. Major improvements include better credential and payload scrubbing, bounded decoders, and a fix for the WebSocket Origin allowlist.
A Heads-Up If You’re Upgrading
If you are planning to pull the latest changes, please keep these behavior shifts in mind:
- Default Settings: The default Receive Maximum is now set to 16. If your implementation requires something different, make sure to override that value in your settings.
- Stricter Error Handling: We are no longer ignoring malformed or protocol-invalid data; these will now close the connection.
- Blocking Builds: Keep in mind that unanswered pings in blocking builds will now return an explicit MQTT_CODE_ERROR_NETWORK.
You can find all of this available today on the master branch at GitHub. Clone it, build it with autotools or CMake, and let us know what you think.
wolfMQTT is written in portable C for embedded use, has a small footprint, supports MQTT v3.1.1, MQTT v5, and MQTT-SN, and runs on everything from bare-metal microcontrollers to Linux servers. TLS 1.3 comes from wolfSSL, with FIPS 140-3 validated cryptography available through wolfCrypt. wolfSSL products are dual licensed under GPLv3 and a commercial license, backed by the wolfSSL support team. For commercial licensing, FIPS 140-3 validated cryptography, or integration assistance, contact facts@wolfssl.com or licensing@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now