aedes 0.45.2 → 0.46.3

package/.github/workflows/ci.yml

@@ -16,14 +16,14 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [10.x, 12.x, 14.x]
+        node-version: [12.x, 14.x, 16.x]
         os: [ubuntu-latest, windows-latest, macOS-latest]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.4.0
 
       - name: Use Node.js
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@v2.5.1
         with:
           node-version: ${{ matrix.node-version }}
 

package/.taprc

@@ -2,4 +2,5 @@ ts: false
 jsx: false
 flow: false
 coverage: true
-strict: true
+strict: true
+check-coverage: false

package/README.md

@@ -7,10 +7,8 @@
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/moscajs/aedes/pulls)\
 [![Total alerts](https://img.shields.io/lgtm/alerts/g/moscajs/aedes.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/moscajs/aedes/alerts/)
 [![Language grade: JavaScript](https://img.shields.io/lgtm/grade/javascript/g/moscajs/aedes.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/moscajs/aedes/context:javascript)
-[![Coverage Status](https://coveralls.io/repos/moscajs/aedes/badge.svg?branch=master&service=github)](https://coveralls.io/github/moscajs/aedes?branch=master)
+[![Coverage Status](https://coveralls.io/repos/moscajs/aedes/badge.svg?branch=main&service=github)](https://coveralls.io/github/moscajs/aedes?branch=main)
 [![Known Vulnerabilities](https://snyk.io/test/github/moscajs/aedes/badge.svg)](https://snyk.io/test/github/moscajs/aedes)\
-[![Dependencies Status](https://david-dm.org/moscajs/aedes/status.svg)](https://david-dm.org/moscajs/aedes)
-[![devDependencies Status](https://david-dm.org/moscajs/aedes/dev-status.svg)](https://david-dm.org/moscajs/aedes?type=dev)\
 ![node](https://img.shields.io/node/v/aedes)
 [![NPM version](https://img.shields.io/npm/v/aedes.svg?style=flat)](https://www.npmjs.com/aedes)
 [![NPM downloads](https://img.shields.io/npm/dm/aedes.svg?style=flat)](https://www.npmjs.com/aedes)

package/aedes.js

@@ -12,6 +12,7 @@ const Packet = require('aedes-packet')
 const memory = require('aedes-persistence')
 const mqemitter = require('mqemitter')
 const Client = require('./lib/client')
+const { $SYS_PREFIX } = require('./lib/utils')
 
 module.exports = Aedes.Server = Aedes
 
@@ -78,7 +79,7 @@ function Aedes (opts) {
   this.clients = {}
   this.brokers = {}
 
-  const heartbeatTopic = '$SYS/' + that.id + '/heartbeat'
+  const heartbeatTopic = $SYS_PREFIX + that.id + '/heartbeat'
   this._heartbeatInterval = setInterval(heartbeat, opts.heartbeatInterval)
 
   const bufId = Buffer.from(that.id, 'utf8')
@@ -138,12 +139,12 @@ function Aedes (opts) {
     }
   }
 
-  this.mq.on('$SYS/+/heartbeat', function storeBroker (packet, done) {
+  this.mq.on($SYS_PREFIX + '+/heartbeat', function storeBroker (packet, done) {
     that.brokers[packet.payload.toString()] = Date.now()
     done()
   })
 
-  this.mq.on('$SYS/+/new/clients', function closeSameClients (packet, done) {
+  this.mq.on($SYS_PREFIX + '+/new/clients', function closeSameClients (packet, done) {
     const serverId = packet.topic.split('/')[1]
     const clientId = packet.payload.toString()
 
@@ -206,7 +207,7 @@ function DoEnqueues () {
       return
     }
 
-    if (that.topic.indexOf('$SYS') === 0) {
+    if (that.topic.indexOf($SYS_PREFIX) === 0) {
       subs = subs.filter(removeSharp)
     }
 
@@ -281,7 +282,7 @@ Aedes.prototype._finishRegisterClient = function (client) {
   this.clients[client.id] = client
   this.emit('client', client)
   this.publish({
-    topic: '$SYS/' + this.id + '/new/clients',
+    topic: $SYS_PREFIX + this.id + '/new/clients',
     payload: Buffer.from(client.id, 'utf8')
   }, noop)
 }
@@ -291,7 +292,7 @@ Aedes.prototype.unregisterClient = function (client) {
   delete this.clients[client.id]
   this.emit('clientDisconnect', client)
   this.publish({
-    topic: '$SYS/' + this.id + '/disconnect/clients',
+    topic: $SYS_PREFIX + this.id + '/disconnect/clients',
     payload: Buffer.from(client.id, 'utf8')
   }, noop)
 }
@@ -326,6 +327,9 @@ function defaultAuthenticate (client, username, password, callback) {
 }
 
 function defaultAuthorizePublish (client, packet, callback) {
+  if (packet.topic.startsWith($SYS_PREFIX)) {
+    return callback(new Error($SYS_PREFIX + ' topic is reserved'))
+  }
   callback(null)
 }
 

package/docs/Aedes.md

@@ -113,7 +113,7 @@ Emitted when timeout happes in the `client` keepalive.
 - `packet` `<aedes-packet>` & [`PUBLISH`][PUBLISH]
 - `client` [`<Client>`](./Client.md) | `null`
 
-Emitted when servers delivers the `packet` to subscribed `client`. If there are no clients subscribed to the `packet` topic, server still publish the `packet` and emit thie event. `client` is `null` when `packet` is an internal message like aedes heartbeat message and LWT.
+Emitted when servers delivers the `packet` to subscribed `client`. If there are no clients subscribed to the `packet` topic, server still publish the `packet` and emit the event. `client` is `null` when `packet` is an internal message like aedes heartbeat message and LWT.
 
 > _Note! `packet` belongs `aedes-packet` type. Some properties belongs to aedes internal, any changes on them will break aedes internal flow._
 
@@ -315,6 +315,17 @@ aedes.authorizePublish = function (client, packet, callback) {
 }
 ```
 
+By default `authorizePublish` throws error in case a client publish to topics with `$SYS/` prefix to prevent possible DoS (see [#597](https://github.com/moscajs/aedes/issues/597)). If you write your own implementation of `authorizePublish` we suggest you to add a check for this. Default implementation:
+
+```js
+function defaultAuthorizePublish (client, packet, callback) {
+  if (packet.topic.startsWith($SYS_PREFIX)) {
+    return callback(new Error($SYS_PREFIX + ' topic is reserved'))
+  }
+  callback(null)
+}
+```
+
 ## Handler: authorizeSubscribe (client, subscription, callback)
 
 - client: [`<Client>`](./Client.md)
@@ -392,7 +403,7 @@ aedes.authorizeForward = function (client, packet) {
 - client: [`<Client>`](./Client.md)
 - callback: `<Function>`
 
-same as [`Event: publish`](#event-publish), but provides a backpressure functionality.
+same as [`Event: publish`](#event-publish), but provides a backpressure functionality. TLDR; If you are doing operations on packets that MUST require finishing operations on a packet before handling the next one use this otherwise, expecially for long running operations, you should use [`Event: publish`](#event-publish) instead.
 
 [CONNECT]: https://github.com/mqttjs/mqtt-packet#connect
 [CONNACK]: https://github.com/mqttjs/mqtt-packet#connack

package/lib/handlers/subscribe.js

@@ -3,7 +3,7 @@
 const fastfall = require('fastfall')
 const Packet = require('aedes-packet')
 const { through } = require('../utils')
-const { validateTopic } = require('../utils')
+const { validateTopic, $SYS_PREFIX } = require('../utils')
 const write = require('../write')
 
 const subscribeTopicActions = fastfall([
@@ -76,10 +76,11 @@ function _dedupe (subs) {
 function handleSubscribe (client, packet, restore, done) {
   packet.subscriptions = packet.subscriptions.length === 1 ? packet.subscriptions : _dedupe(packet.subscriptions)
   client.broker._parallel(
-    new SubscribeState(client, packet, restore, done),
-    doSubscribe,
-    packet.subscriptions,
-    restore ? done : completeSubscribe)
+    new SubscribeState(client, packet, restore, done), // what will be this in the functions
+    doSubscribe, // function to call
+    packet.subscriptions, // first argument of the function
+    restore ? done : completeSubscribe // the function to be called when the parallel ends
+  )
 }
 
 function doSubscribe (sub, done) {
@@ -184,7 +185,7 @@ function completeSubscribe (err) {
   const packet = this.packet
   const client = this.client
 
-  if (packet.messageId) {
+  if (packet.messageId !== undefined) {
     // [MQTT-3.9.3-1]
     write(client,
       new SubAck(packet, this.subState.map(obj => obj.granted)),
@@ -194,20 +195,27 @@ function completeSubscribe (err) {
   }
 
   const broker = client.broker
+
+  // subscriptions array to return as result in 'subscribe' event and $SYS
   const subs = packet.subscriptions
 
+  // topics we need to retrieve retain values from
   const topics = []
 
   for (let i = 0; i < subs.length; i++) {
-    topics.push(subs[i].topic)
-    subs.qos = this.subState[i].granted
+    // skip topics that are not allowed
+    if (this.subState[i].granted !== 128) {
+      topics.push(subs[i].topic)
+    }
+    // set granted qos to subscriptions
+    subs[i].qos = this.subState[i].granted
   }
 
   this.subState = []
 
   broker.emit('subscribe', subs, client)
   broker.publish({
-    topic: '$SYS/' + broker.id + '/new/subscribes',
+    topic: $SYS_PREFIX + broker.id + '/new/subscribes',
     payload: Buffer.from(JSON.stringify({
       clientId: client.id,
       subs: subs
@@ -218,22 +226,24 @@ function completeSubscribe (err) {
   // Restored sessions should not contain any retained message.
   // Retained message should be only fetched from SUBSCRIBE.
 
-  const persistence = broker.persistence
-  const stream = persistence.createRetainedStreamCombi(topics)
-  stream.pipe(through(function sendRetained (packet, enc, cb) {
-    packet = new Packet({
-      cmd: packet.cmd,
-      qos: packet.qos,
-      topic: packet.topic,
-      payload: packet.payload,
-      retain: true
-    }, broker)
-    // this should not be deduped
-    packet.brokerId = null
-    client.deliverQoS(packet, cb)
-  }))
+  if (topics.length > 0) {
+    const persistence = broker.persistence
+    const stream = persistence.createRetainedStreamCombi(topics)
+    stream.pipe(through(function sendRetained (packet, enc, cb) {
+      packet = new Packet({
+        cmd: packet.cmd,
+        qos: packet.qos,
+        topic: packet.topic,
+        payload: packet.payload,
+        retain: true
+      }, broker)
+      // this should not be deduped
+      packet.brokerId = null
+      client.deliverQoS(packet, cb)
+    }))
+  }
 }
 
-function noop () {}
+function noop () { }
 
 module.exports = handleSubscribe

package/lib/handlers/unsubscribe.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const write = require('../write')
-const { validateTopic } = require('../utils')
+const { validateTopic, $SYS_PREFIX } = require('../utils')
 
 function UnSubAck (packet) {
   this.cmd = 'unsuback'
@@ -26,7 +26,7 @@ function handleUnsubscribe (client, packet, done) {
     }
   }
 
-  if (packet.messageId) {
+  if (packet.messageId !== undefined) {
     if (client.clean) {
       return actualUnsubscribe(client, packet, done)
     }
@@ -80,7 +80,7 @@ function completeUnsubscribe (err) {
   const packet = this.packet
   const done = this.finish
 
-  if (packet.messageId) {
+  if (packet.messageId !== undefined) {
     write(client, new UnSubAck(packet),
       done)
   } else {
@@ -90,7 +90,7 @@ function completeUnsubscribe (err) {
   if ((!client.closed || client.clean === true) && packet.unsubscriptions.length > 0) {
     client.broker.emit('unsubscribe', packet.unsubscriptions, client)
     client.broker.publish({
-      topic: '$SYS/' + client.broker.id + '/new/unsubscribes',
+      topic: $SYS_PREFIX + client.broker.id + '/new/unsubscribes',
       payload: Buffer.from(JSON.stringify({
         clientId: client.id,
         subs: packet.unsubscriptions
@@ -99,6 +99,6 @@ function completeUnsubscribe (err) {
   }
 }
 
-function noop () {}
+function noop () { }
 
 module.exports = handleUnsubscribe

package/lib/utils.js

@@ -39,5 +39,6 @@ function through (transform) {
 
 module.exports = {
   validateTopic,
-  through
+  through,
+  $SYS_PREFIX: '$SYS/'
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aedes",
-  "version": "0.45.2",
+  "version": "0.46.3",
   "description": "Stream-based MQTT broker",
   "main": "aedes.js",
   "types": "aedes.d.ts",
@@ -49,13 +49,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/moscajs/aedes.git"
-  },
-  "bugs": {
-    "url": "http://github.com/moscajs/aedes/issues"
-  },
-  "engines": {
-    "node": ">=10"
+    "url": "git+https://github.com/moscajs/aedes.git"
   },
   "keywords": [
     "mqtt",
@@ -95,25 +89,32 @@
     }
   ],
   "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/moscajs/aedes/issues"
+  },
+  "homepage": "https://github.com/moscajs/aedes#readme",
+  "engines": {
+    "node": ">=12"
+  },
   "devDependencies": {
-    "@sinonjs/fake-timers": "^7.0.5",
-    "@types/node": "^14.14.41",
-    "@typescript-eslint/eslint-plugin": "^4.22.0",
-    "@typescript-eslint/parser": "^4.22.0",
+    "@sinonjs/fake-timers": "^9.1.0",
+    "@types/node": "^17.0.15",
+    "@typescript-eslint/eslint-plugin": "^5.10.2",
+    "@typescript-eslint/parser": "^5.10.2",
     "concat-stream": "^2.0.0",
-    "duplexify": "^4.1.1",
+    "duplexify": "^4.1.2",
     "license-checker": "^25.0.1",
-    "markdownlint-cli": "^0.27.1",
-    "mqtt": "^4.2.6",
+    "markdownlint-cli": "^0.31.0",
+    "mqtt": "^4.3.4",
     "mqtt-connection": "^4.1.0",
     "pre-commit": "^1.2.2",
     "proxyquire": "^2.1.3",
-    "release-it": "^14.6.1",
+    "release-it": "^14.12.4",
     "snazzy": "^9.0.0",
-    "standard": "^16.0.3",
-    "tap": "^15.0.2",
-    "tsd": "^0.14.0",
-    "typescript": "^4.2.4",
+    "standard": "^16.0.4",
+    "tap": "^15.1.6",
+    "tsd": "^0.19.1",
+    "typescript": "^4.5.5",
     "websocket-stream": "^5.5.2"
   },
   "dependencies": {
@@ -122,11 +123,11 @@
     "bulk-write-stream": "^2.0.1",
     "end-of-stream": "^1.4.4",
     "fastfall": "^1.5.1",
-    "fastparallel": "^2.4.0",
+    "fastparallel": "^2.4.1",
     "fastseries": "^2.0.0",
-    "hyperid": "^2.1.0",
-    "mqemitter": "^4.4.1",
-    "mqtt-packet": "^6.9.1",
+    "hyperid": "^3.0.0",
+    "mqemitter": "^4.5.0",
+    "mqtt-packet": "^7.1.2",
     "readable-stream": "^3.6.0",
     "retimer": "^3.0.0",
     "reusify": "^1.0.4",

package/test/auth.js

@@ -761,7 +761,7 @@ test('negate subscription', function (t) {
 })
 
 test('negate multiple subscriptions', function (t) {
-  t.plan(5)
+  t.plan(6)
 
   const s = connect(setup())
   t.teardown(s.broker.close.bind(s.broker))
@@ -771,6 +771,18 @@ test('negate multiple subscriptions', function (t) {
     cb(null, null)
   }
 
+  const expectedSubs = [{
+    topic: 'hello',
+    qos: 128
+  }, {
+    topic: 'world',
+    qos: 128
+  }]
+
+  s.broker.once('subscribe', function (subs, client) {
+    t.same(subs, expectedSubs)
+  })
+
   s.inStream.write({
     cmd: 'subscribe',
     messageId: 24,

package/test/basic.js

@@ -95,6 +95,23 @@ test('publish empty topic throws error', function (t) {
   })
 })
 
+test('publish to $SYS topic throws error', function (t) {
+  t.plan(1)
+
+  const s = connect(setup())
+  t.teardown(s.broker.close.bind(s.broker))
+
+  s.inStream.write({
+    cmd: 'publish',
+    topic: '$SYS/not/allowed',
+    payload: 'world'
+  })
+
+  s.broker.on('clientError', function (client, err) {
+    t.pass('should emit error')
+  })
+})
+
 ;[{ qos: 0, clean: false }, { qos: 0, clean: true }, { qos: 1, clean: false }, { qos: 1, clean: true }].forEach(function (ele) {
   test('subscribe a single topic in QoS ' + ele.qos + ' [clean=' + ele.clean + ']', function (t) {
     t.plan(5)
@@ -243,6 +260,35 @@ test('subscribe should have messageId', function (t) {
   })
 })
 
+test('subscribe with messageId 0 should return suback', function (t) {
+  t.plan(1)
+
+  const s = connect(setup())
+  t.teardown(s.broker.close.bind(s.broker))
+
+  s.inStream.write({
+    cmd: 'subscribe',
+    subscriptions: [{
+      topic: 'hello',
+      qos: 0
+    }],
+    messageId: 0
+  })
+  s.outStream.once('data', function (packet) {
+    t.same(packet, {
+      cmd: 'suback',
+      messageId: 0,
+      dup: false,
+      length: 3,
+      qos: 0,
+      retain: false,
+      granted: [
+        0
+      ]
+    }, 'packet matches')
+  })
+})
+
 test('unsubscribe', function (t) {
   t.plan(5)
 

package/test/qos1.js

@@ -3,6 +3,7 @@
 const { test } = require('tap')
 const concat = require('concat-stream')
 const { setup, connect, subscribe } = require('./helper')
+const Faketimers = require('@sinonjs/fake-timers')
 const aedes = require('../')
 
 test('publish QoS 1', function (t) {
@@ -510,65 +511,48 @@ test('resend publish on non-clean reconnect QoS 1', function (t) {
 })
 
 test('resend many publish on non-clean reconnect QoS 1', function (t) {
-  t.plan(38)
-
+  t.plan(4)
   const broker = aedes()
-  t.teardown(broker.close.bind(broker))
+  const clock = Faketimers.createClock()
+
+  t.teardown(() => {
+    broker.close.bind(broker)
+    clock.reset.bind(clock)
+  })
 
   const opts = { clean: false, clientId: 'abcde' }
   let subscriber = connect(setup(broker), opts)
+  const publisher = connect(setup(broker))
+  const { through } = require('../lib/utils')
+  const total = through().writableHighWaterMark * 2
+
+  let received = 0
+  clock.setTimeout(() => {
+    broker.close()
+    t.equal(received, total)
+  }, total)
 
   subscribe(t, subscriber, 'hello', 1, function () {
     subscriber.inStream.end()
 
-    const publisher = connect(setup(broker))
-
-    let count = 0
-    while (++count <= 17) {
+    for (let sent = 0; sent < total; sent++) {
       publisher.inStream.write({
         cmd: 'publish',
         topic: 'hello',
-        payload: 'message-' + count,
+        payload: 'message-' + sent,
         qos: 1,
-        messageId: 42 + count
+        messageId: 42 + sent
       })
     }
     publisher.outStream.once('data', function (packet) {
-      t.equal(packet.cmd, 'puback')
-
       subscriber = connect(setup(broker), opts)
-
-      const expected = [
-        [43, 'message-1'],
-        [44, 'message-2'],
-        [45, 'message-3'],
-        [46, 'message-4'],
-        [47, 'message-5'],
-        [48, 'message-6'],
-        [49, 'message-7'],
-        [50, 'message-8'],
-        [51, 'message-9'],
-        [52, 'message-10'],
-        [53, 'message-11'],
-        [54, 'message-12'],
-        [55, 'message-13'],
-        [56, 'message-14'],
-        [57, 'message-15'],
-        [58, 'message-16'],
-        [59, 'message-17']
-      ]
-
-      let recievedCount = 0
       subscriber.outStream.on('data', function (packet) {
         subscriber.inStream.write({
           cmd: 'puback',
           messageId: packet.messageId
         })
-
-        const [messageId, payload] = expected[recievedCount++]
-
-        t.not(packet.messageId, messageId, 'messageId should not match')
-        t.same(packet.payload, Buffer.from(payload), 'payload should match')
+        received++
+        clock.tick(1)
       })
     })
   })

package/test/retain.js

@@ -194,6 +194,43 @@ test('reconnected subscriber will not receive retained messages when QoS 0 and c
   })
 })
 
+test('subscriber will not receive retained messages when QoS is 128', function (t) {
+  t.plan(3)
+
+  const broker = aedes()
+  t.teardown(broker.close.bind(broker))
+
+  const pubPacket = {
+    cmd: 'publish',
+    topic: 'hello',
+    payload: 'world',
+    qos: 1,
+    retain: true,
+    messageId: 42
+  }
+
+  broker.authorizeSubscribe = function (client, sub, callback) {
+    if (sub.topic === pubPacket.topic) {
+      callback(null, null)
+    } else {
+      callback(null, sub)
+    }
+  }
+
+  const publisher = connect(setup(broker), { clean: true })
+
+  publisher.inStream.write(pubPacket)
+
+  publisher.outStream.on('data', function (packet) {
+    const subscriber = connect(setup(broker), { clean: true })
+    subscribe(t, subscriber, pubPacket.topic, 128, function () {
+      subscriber.outStream.on('data', function (packet) {
+        t.fail('should not received retain message')
+      })
+    })
+  })
+})
+
 // [MQTT-3.3.1-6]
 test('new QoS 0 subscribers receive QoS 0 retained messages when clean', function (t) {
   t.plan(9)

package/types/client.d.ts

@@ -1,8 +1,9 @@
 import { IncomingMessage } from 'http'
 import { PublishPacket, SubscribePacket, Subscription, Subscriptions, UnsubscribePacket } from './packet'
 import { Connection } from './instance'
+import { EventEmitter } from 'events'
 
-export interface Client {
+export interface Client extends EventEmitter {
   id: Readonly<string>
   clean: Readonly<boolean>
   version: Readonly<number>

package/types/instance.d.ts

@@ -2,6 +2,7 @@ import { Duplex } from 'stream'
 import { Socket } from 'net'
 import { Client } from './client'
 import type { AedesPublishPacket, ConnectPacket, ConnackPacket, Subscription, PingreqPacket, PublishPacket, PubrelPacket } from './packet'
+import { EventEmitter } from 'events'
 
 type LastHearthbeatTimestamp = Date;
 
@@ -12,7 +13,7 @@ export interface Brokers {
 export type Connection = Duplex | Socket
 
 /* eslint no-unused-vars: 0 */
-export enum AuthErrorCode {
+export const enum AuthErrorCode {
   UNNACCEPTABLE_PROTOCOL = 1,
   IDENTIFIER_REJECTED = 2,
   SERVER_UNAVAILABLE = 3,
@@ -56,7 +57,7 @@ export interface AedesOptions {
   published?: PublishedHandler
 }
 
-export interface Aedes {
+export interface Aedes extends EventEmitter {
   id: Readonly<string>
   connectedClients: Readonly<number>
   closed: Readonly<boolean>
@@ -89,4 +90,11 @@ export interface Aedes {
     callback: () => void
   ): void
   close (callback?: () => void): void
+
+  preConnect: PreConnectHandler
+  authenticate: AuthenticateHandler
+  authorizePublish: AuthorizePublishHandler
+  authorizeSubscribe: AuthorizeSubscribeHandler
+  authorizeForward: AuthorizeForwardHandler
+  published: PublishedHandler
 }