目录
Neil

[FIXED] MQTT: QoS2 message released on a resumed session lost its QoS and PI (#8414)

This came up while testing with https://github.com/ConnectEverything/mqtt-test/pull/4

Two root causes. The delivery callbacks and the retain handling read the publishing connection’s c.mqtt.pp — the last PUBLISH parsed — which is stale for a PUBREL- or will-initiated delivery, so a QoS2 message released after a reconnect was delivered as QoS0 with no packet identifier. And the staged copy in $MQTT_qos2in never persisted the retain flag, so it could not be recovered on another connection at all. Same-connection flows worked only while the scratch happened to still hold the right packet. Because of the interplay, the two must be fixed together.

The delivered message now becomes the client’s current publish for the duration of the broadcast (swapped into the readLoop-owned c.mqtt.pp, restored by the same defer as the pubargs); wills build their own mqttPublish and use the common path instead of writing into the scratch by hand. The staged copy persists the retain flag in a second, flags byte of the Nmqtt-Pub header value, restored when the PUBREL rebuilds the publish; older servers read only the first (QoS) byte, and messages without a flags byte read as not retained.

Retained QoS2 messages now survive an in-flight reconnect: a PUBLISH staged on one connection and released by the PUBREL on the next stores the retained message, where before the retain bit died with the first connection’s parser state. This matches Spec [MQTT-4.3.3] Method A as implemented by mosquitto, which likewise persists the retain flag with the staged message and applies it at release, together with the delivery.

Added regression tests: a PUBREL on a resumed session delivers at the subscription’s QoS exactly once, a retransmitted PUBREL is acknowledged without redelivering, and the retain flag survives the staging round trip.

2天前12883次提交

NATS Logo

NATS is a simple, secure and performant communications system for digital systems, services and devices. NATS is part of the Cloud Native Computing Foundation (CNCF). NATS has over 40 client language implementations, and its server can run on-premise, in the cloud, at the edge, and even on a Raspberry Pi. NATS can secure and simplify design and operation of modern distributed systems.

License Build Release Slack Coverage Docker Downloads GitHub Downloads CII Best Practices Artifact Hub

Documentation

Contact

  • Twitter: Follow us on Twitter!
  • Google Groups: Where you can ask questions
  • Slack: Click here to join. You can ask questions to our maintainers and to the rich and active community.

Contributing

If you are interested in contributing to NATS, read about our…

Roadmap

The NATS product roadmap can be found here.

Adopters

Who uses NATS? See our list of users on https://nats.io.

Security

Security Audit

A third party security audit was performed by Trail of Bits following engagement by the Open Source Technology Improvement Fund (OSTIF). You can see the full report from April 2025 here.

Reporting Security Vulnerabilities

If you’ve found a vulnerability or a potential vulnerability in the NATS server, please let us know at nats-security.

License

Unless otherwise noted, the NATS source files are distributed under the Apache Version 2.0 license found in the LICENSE file.

邀请码
    Gitlink(确实开源)
  • 加入我们
  • 官网邮箱:gitlink@ccf.org.cn
  • QQ群
  • QQ群
  • 公众号
  • 公众号

版权所有:中国计算机学会技术支持:开源发展技术委员会
京ICP备13000930号-9 京公网安备 11010802047560号