Skip to content

fix(mqtt_publisher): pass tls_insecure=None for non-TLS connections#465

Open
csutcliff wants to merge 1 commit into
SAIC-iSmart-API:developfrom
csutcliff:fix/tls-insecure-plain-tcp
Open

fix(mqtt_publisher): pass tls_insecure=None for non-TLS connections#465
csutcliff wants to merge 1 commit into
SAIC-iSmart-API:developfrom
csutcliff:fix/tls-insecure-plain-tcp

Conversation

@csutcliff

Copy link
Copy Markdown

Problem

Since the aiomqtt migration (#457), the gateway hangs at startup when configured with a plain tcp:// broker URI. It logs

[INFO]: Connecting to MQTT Broker - mqtt_gateway
[INFO]: MQTT client disconnected - publisher.mqtt_publisher

and then does nothing forever: no connection ever reaches the broker, no error is logged, no retry happens, and the process stays alive. 0.12.0 works with the same configuration.

Root cause

MqttPublisher.__run_loop passes tls_insecure=bool(ssl_context and ...) to aiomqtt.Client. Without TLS that evaluates to False rather than None, and aiomqtt applies any non-None value via paho's tls_insecure_set(), which raises:

ValueError: Must configure SSL context before using tls_insecure_set.

The ValueError isn't one of the exceptions the reconnect loop handles (MqttConnectError/MqttError/CancelledError), so the connect task dies with only the finally block's "MQTT client disconnected" log, the connected event is never set, and connect() waits on it forever.

Fix

Only pass a tls_insecure value when TLS is enabled with hostname checking disabled; otherwise leave it None so aiomqtt skips tls_insecure_set() entirely. Semantics for the TLS cases are unchanged.

Added regression tests covering the three combinations (plain TCP → None, TLS without hostname check → True, TLS with hostname check → None); the plain-TCP and TLS-with-check cases fail against current develop. mypy, ruff check, ruff format --check and pytest all pass.

aiomqtt forwards any non-None tls_insecure value to paho's
tls_insecure_set(), which raises "Must configure SSL context before
using tls_insecure_set" when no SSL context is configured. That
ValueError isn't caught by the reconnect loop, so the connect task
dies silently and connect() waits forever on the connected event:
with a plain tcp:// broker URI the gateway logs only "MQTT client
disconnected" and hangs at startup without ever reaching the broker.

Only pass a value when TLS is enabled with hostname checking
disabled; otherwise leave it None so aiomqtt skips tls_insecure_set()
entirely.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant