Skip to content

rusquitto 1.10.0

Choose a tag to compare

View all tags
@iamaliybi iamaliybi released this 05 Jul 23:18
v1.10.0
ec4669f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Mutual-TLS identity: a verified client certificate can now carry a per-device MQTT identity for ACLs — the last deferred item from the roadmap.

[tls] cert_cn_as_username

When mutual TLS is enabled and this is set (default false), a verified client certificate's subject Common Name becomes the MQTT username, so [[auth.users]] ACLs apply per device.

  • A cert-verified client that sends no username is authenticated by the certificate and keyed on its CN.
  • A client that also sends an explicit username is checked against [auth] the usual way (the certificate only gated the transport).
  • Default false preserves the prior behaviour (verified cert with no username → anonymous ACLs).

Internally: transport::tls gained a TlsIdentity enum and a resolver that extracts the leaf certificate's CN with x509-parser (rustls verifies the chain but does not expose the parsed subject).

Verified end-to-end

Live harness — client cert CN=sensor-01 mapped to a [[auth.users]] entry whose publish ACL is sensors/01/#, under allow_anonymous = false: the in-scope publish is delivered and the out-of-scope one is refused. Plus two CI unit tests.

96 unit + 15 integration tests, clippy -D warnings clean, fmt clean.

Assets

  • rusquitto-x86_64-unknown-linux-gnu — x86-64 Linux binary
  • rusquitto-aarch64-unknown-linux-gnu — ARM64 Linux binary
  • rusquitto.config.toml — annotated reference configuration
Assets 5
Loading