[continued from previous message]

--- a/test/broker/11-persistent-subscription-no-local.py
+++ b/test/broker/11-persistent-subscription-no-local.py
@@ -5,16 +5,17 @@
@@ -365,7 +335,7 @@

rc = 1
keepalive = 60
-@@ -48,8 +49,8 @@
+@@ -48,8 +49,8 @@ mid = 2
publish2b_packet = mosq_test.gen_publish("subpub/local", qos=1, mid=mid, payload="message", proto_ver=5)
puback2b_packet = mosq_test.gen_puback(mid, proto_ver=5)

@@ -376,7 +346,7 @@

broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port)

-@@ -90,8 +91,8 @@
+@@ -90,8 +91,8 @@ finally:
(stdo, stde) = broker.communicate()
if rc:
print(stde.decode('utf-8'))
@@ -387,6 +357,8 @@


exit(rc)
+diff --git a/test/broker/11-persistent-subscription-v5.py b/test/broker/11-persistent-subscription-v5.py
+index 7cd9ae6..8bc4d8e 100755
--- a/test/broker/11-persistent-subscription-v5.py
+++ b/test/broker/11-persistent-subscription-v5.py
@@ -4,16 +4,17 @@
@@ -410,7 +382,7 @@

rc = 1
mid = 530
-@@ -35,8 +36,8 @@
+@@ -35,8 +36,8 @@ puback_packet = mosq_test.gen_puback(mid, proto_ver=5)
mid = 1
publish_packet2 = mosq_test.gen_publish("subpub/qos1", qos=1, mid=mid, payload="message", proto_ver=5)

@@ -421,7 +393,7 @@

broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port)

-@@ -67,8 +68,8 @@
+@@ -67,8 +68,8 @@ finally:
(stdo, stde) = broker.communicate()
if rc:
print(stde.decode('utf-8'))
@@ -432,6 +404,8 @@


exit(rc)
+diff --git a/test/broker/11-persistent-subscription.py b/test/broker/11-persistent-subscription.py
+index 2ec2871..a54b5b9 100755
--- a/test/broker/11-persistent-subscription.py
+++ b/test/broker/11-persistent-subscription.py
@@ -4,17 +4,18 @@
@@ -456,7 +430,7 @@

rc = 1
mid = 530
-@@ -35,8 +36,8 @@
+@@ -35,8 +36,8 @@ def do_test(proto_ver):
mid = 1
publish_packet2 = mosq_test.gen_publish("subpub/qos1", qos=1, mid=mid, payload="message", proto_ver=proto_ver)

@@ -467,7 +441,7 @@

broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port)

-@@ -65,8 +66,8 @@
+@@ -65,8 +66,8 @@ def do_test(proto_ver):
broker.terminate()
broker.wait()
(stdo, stde) = broker.communicate()
@@ -478,6 +452,8 @@
if rc:
print(stde.decode('utf-8'))
print("proto_ver=%d" % (proto_ver))
+diff --git a/test/broker/11-pub-props.py b/test/broker/11-pub-props.py
+index 1b76fa2..541719f 100755
--- a/test/broker/11-pub-props.py
+++ b/test/broker/11-pub-props.py
@@ -4,16 +4,17 @@
@@ -501,7 +477,7 @@

rc = 1
keepalive = 60
-@@ -37,8 +38,8 @@
+@@ -37,8 +38,8 @@ mid = 1
subscribe_packet = mosq_test.gen_subscribe(mid, "subpub/qos1", 0, proto_ver=5)
suback_packet = mosq_test.gen_suback(mid, 0, proto_ver=5)

@@ -512,7 +488,7 @@

broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port)

-@@ -72,8 +73,8 @@
+@@ -72,8 +73,8 @@ finally:
(stdo, stde) = broker.communicate()
if rc:
print(stde.decode('utf-8'))
@@ -523,6 +499,8 @@


exit(rc)
+diff --git a/test/broker/11-subscription-id.py b/test/broker/11-subscription-id.py
+index ed17842..4b9ad16 100755
--- a/test/broker/11-subscription-id.py
+++ b/test/broker/11-subscription-id.py
@@ -4,16 +4,17 @@
@@ -546,7 +524,7 @@

rc = 1
keepalive = 60
-@@ -42,8 +43,8 @@
+@@ -42,8 +43,8 @@ helper_publish_packet = mosq_test.gen_publish("subpub/qos1", qos=1, mid=mid, pay
helper_puback_packet = mosq_test.gen_puback(mid, proto_ver=5)


@@ -557,7 +535,7 @@

broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port)

-@@ -77,10 +78,8 @@
+@@ -77,10 +78,8 @@ finally:
(stdo, stde) = broker.communicate()
if rc:
print(stde.decode('utf-8'))
@@ -570,9 +548,11 @@

exit(rc)
-
+diff --git a/test/broker/Makefile b/test/broker/Makefile
+index d012c91..c935247 100644
--- a/test/broker/Makefile
+++ b/test/broker/Makefile
-@@ -120,13 +120,13 @@
+@@ -120,13 +120,13 @@ test : test-compile 01 02 03 04 05 06 07 08 09 10 11 12 13 14
06 :
./06-bridge-b2br-disconnect-qos1.py
./06-bridge-b2br-disconnect-qos2.py
@@ -588,7 +568,7 @@
./06-bridge-fail-persist-resend-qos1.py
./06-bridge-fail-persist-resend-qos2.py
./06-bridge-no-local.py
-@@ -156,9 +156,9 @@
+@@ -156,9 +156,9 @@ test : test-compile 01 02 03 04 05 06 07 08 09 10 11 12 13 14
ifeq ($(WITH_TLS),yes)
./08-ssl-bridge.py
./08-ssl-connect-cert-auth-crl.py
@@ -601,7 +581,7 @@
./08-ssl-connect-cert-auth.py
./08-ssl-connect-identity.py
./08-ssl-connect-no-auth-wrong-ca.py
-@@ -229,20 +229,20 @@
+@@ -229,20 +229,20 @@ endif
14 :
ifeq ($(WITH_TLS),yes)
ifeq ($(WITH_CJSON),yes)
@@ -637,9 +617,73 @@
+ #./14-dynsec-role-invalid.py
endif
endif
+diff --git a/test/broker/c/Makefile b/test/broker/c/Makefile
+index 6a561ba..1e8aa61 100644
+--- a/test/broker/c/Makefile
++++ b/test/broker/c/Makefile
+@@ -34,7 +34,7 @@ ${PLUGINS} : %.so: %.c
+
+
+ ${TESTS} : %.test: %.c
+- $(CC) ${CFLAGS} $< -o $@ ../../../lib/libmosquitto.so.1
++ $(CC) ${CFLAGS} $< -o $@ -lmosquitto
+
+
+ reallyclean : clean
+diff --git a/test/client/test.sh b/test/client/test.sh
+index 53ee84b..ed97cad 100755
+--- a/test/client/test.sh
++++ b/test/client/test.sh
+@@ -11,7 +11,7 @@ export PORT=1888
+ export SUB_TIMEOUT=1
+
+ # Start broker
+-../../src/mosquitto -p ${PORT} 2>/dev/null &
++/usr/sbin/mosquitto -p ${PORT} 2>/dev/null &
+ export MOSQ_PID=$!
+ sleep 0.5
+
+@@ -20,28 +20,28 @@ trap "kill $MOSQ_PID" EXIT
+
+
+ # Simple subscribe test - single message from $SYS +-${BASE_PATH}/client/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C 1 -t '$SYS/broker/uptime' >/dev/null
++/usr/bin/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C 1 -t '$SYS/broker/uptime' >/dev/null
+ echo "Simple subscribe ok"
+
+ # Simple publish/subscribe test - single message from mosquitto_pub +-${BASE_PATH}/client/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C 1 -t 'single/test' >/dev/null &
++/usr/bin/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C 1 -t 'single/test' >/dev/null &
+ export SUB_PID=$!
+-${BASE_PATH}/client/mosquitto_pub -p ${PORT} -t 'single/test' -m 'single-test'
++/usr/bin/mosquitto_pub -p ${PORT} -t 'single/test' -m 'single-test'
+ kill ${SUB_PID} 2>/dev/null || true
+ echo "Simple publish/subscribe ok"
+
+ # Publish a file and subscribe, do we get at least that many lines?
+ export TEST_LINES=$(wc -l test.sh | cut -d' ' -f1) +-${BASE_PATH}/client/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C ${TEST_LINES} -t 'file-publish' >/dev/null &
++/usr/bin/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C ${TEST_LINES} -t 'file-publish' >/dev/null &
+ export SUB_PID=$!
+-${BASE_PATH}/client/mosquitto_pub -p ${PORT} -t 'file-publish' -f ./test.sh ++/usr/bin/mosquitto_pub -p ${PORT} -t 'file-publish' -f ./test.sh
+ kill ${SUB_PID} 2>/dev/null || true
+ echo "File publish ok"
+
+ # Publish a file from stdin and subscribe, do we get at least that many lines?
+ export TEST_LINES=$(wc -l test.sh | cut -d' ' -f1) +-${BASE_PATH}/client/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C ${TEST_LINES} -t 'file-publish' >/dev/null &
++/usr/bin/mosquitto_sub -p ${PORT} -W ${SUB_TIMEOUT} -C ${TEST_LINES} -t 'file-publish' >/dev/null &
+ export SUB_PID=$!
+-${BASE_PATH}/client/mosquitto_pub -p ${PORT} -t 'file-publish' -l < ./test.sh ++/usr/bin/mosquitto_pub -p ${PORT} -t 'file-publish' -l < ./test.sh
+ kill ${SUB_PID} 2>/dev/null || true
+ echo "stdin publish ok"
+diff --git a/test/lib/Makefile b/test/lib/Makefile
+index 93603f5..e742ae3 100644
--- a/test/lib/Makefile
+++ b/test/lib/Makefile
-@@ -33,7 +33,7 @@
+@@ -33,7 +33,7 @@ c : test-compile
./02-subscribe-qos0.py $@/02-subscribe-qos0.test
./02-subscribe-qos1.py $@/02-subscribe-qos1.test
./02-subscribe-qos1.py $@/02-subscribe-qos1-async1.test
@@ -648,7 +692,7 @@
./02-subscribe-qos2.py $@/02-subscribe-qos2.test
./02-unsubscribe-multiple-v5.py $@/02-unsubscribe-multiple-v5.test
./02-unsubscribe-v5.py $@/02-unsubscribe-v5.test
-@@ -50,7 +50,7 @@
+@@ -50,7 +50,7 @@ c : test-compile
./03-publish-c2b-qos2-disconnect.py $@/03-publish-c2b-qos2-disconnect.test
./03-publish-c2b-qos2-len.py $@/03-publish-c2b-qos2-len.test
./03-publish-c2b-qos2-maximum-qos-0.py $@/03-publish-c2b-qos2-maximum-qos-0.test
@@ -657,29 +701,53 @@
./03-publish-c2b-qos2-pubrec-error.py $@/03-publish-c2b-qos2-pubrec-error.test
./03-publish-c2b-qos2-receive-maximum-1.py $@/03-publish-c2b-qos2-receive-maximum-1.test
./03-publish-c2b-qos2-receive-maximum-2.py $@/03-publish-c2b-qos2-receive-maximum-2.test
---- a/test/broker/08-tls-psk-bridge.py
-+++ b/test/broker/08-tls-psk-bridge.py
-@@ -29,8 +29,8 @@
- f.write("bridge_psk deadbeef\n")
+diff --git a/test/lib/c/Makefile b/test/lib/c/Makefile
+index 6c09e80..5dc3077 100644
+--- a/test/lib/c/Makefile
++++ b/test/lib/c/Makefile
+@@ -1,7 +1,7 @@
+ .PHONY: all clean reallyclean

- (port1, port2, port3) = mosq_test.get_port(3)
--conf_file1 = "08-tls-psk-bridge.conf"
--conf_file2 = "08-tls-psk-bridge.conf2"
-+conf_file1 = "/tmp/08-tls-psk-bridge.conf"
-+conf_file2 = "/tmp/08-tls-psk-bridge.conf2"
- write_config1(conf_file1, port1, port2)
- write_config2(conf_file2, port2, port3)
+ CFLAGS=-I../../../include -Werror
+-LIBS=../../../lib/libmosquitto.so.1
++LIBS=-lmosquitto

-@@ -54,9 +54,9 @@
+ SRC = \
+ 01-con-discon-success.c \
+diff --git a/test/lib/cpp/Makefile b/test/lib/cpp/Makefile
+index c4ae14c..022d103 100644
+--- a/test/lib/cpp/Makefile
++++ b/test/lib/cpp/Makefile
+@@ -1,7 +1,7 @@
+ .PHONY: all test 01 02 03 04 08 09 clean reallyclean

- publish_packet = mosq_test.gen_publish(topic="psk/test", payload="message", qos=0)
+ CFLAGS=-I../../../include -I../../../lib/cpp -DDEBUG +-LIBS=../../../lib/libmosquitto.so.1 ../../../lib/cpp/libmosquittopp.so.1 ++LIBS=-lmosquitto -lmosquittopp

--bridge_cmd = ['../../src/mosquitto', '-c', '08-tls-psk-bridge.conf2'] --broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port1)
--bridge = mosq_test.start_broker(filename=os.path.basename(__file__)+'_bridge', cmd=bridge_cmd, port=port3)
-+bridge_cmd = ['/usr/sbin/mosquitto', '-c', '/tmp/08-tls-psk-bridge.conf2'] -+broker = mosq_test.start_broker(filename=conf_file1, use_conf=True, port=port1)
-+bridge = mosq_test.start_broker(filename=conf_file2+'_bridge', cmd=bridge_cmd, port=port3)
+ all : 01 02 03 04 08 09
+
+diff --git a/test/mosq_test.py b/test/mosq_test.py
+index 52dcca0..ed38044 100644
+--- a/test/mosq_test.py
++++ b/test/mosq_test.py
+@@ -26,16 +26,16 @@ def start_broker(filename, cmd=None, port=0, use_conf=False, expect_fail=False):
+ delay = 0.1
+
+ if use_conf == True:
+- cmd = ['../../src/mosquitto', '-v', '-c', filename.replace('.py', '.conf')]
++ cmd = ['/usr/sbin/mosquitto', '-v', '-c', filename.replace('.py', '.conf')]
+
+ if port == 0:
+ port = 1888
+ else:
+ if cmd is None and port != 0:
+- cmd = ['../../src/mosquitto', '-v', '-p', str(port)]
++ cmd = ['/usr/sbin/mosquitto', '-v', '-p', str(port)]
+ elif cmd is None and port == 0:
+ port = 1888
+- cmd = ['../../src/mosquitto', '-v', '-c', filename.replace('.py', '.conf')]
++ cmd = ['/usr/sbin/mosquitto', '-v', '-c', filename.replace('.py', '.conf')]
+ elif cmd is not None and port == 0:
+ port = 1888

- pub = None
- try:
diff -Nru mosquitto-2.0.11/debian/patches/Fix-CONNECT-performance-with-many-user-properties.patch mosquitto-2.0.11/debian/patches/Fix-CONNECT-performance-with-many-user-properties.patch
--- mosquitto-2.0.11/debian/patches/Fix-CONNECT-performance-with-many-user-properties.patch 2023-09-30 19:28:09.000000000 +0200
+++ mosquitto-2.0.11/debian/patches/Fix-CONNECT-performance-with-many-user-properties.patch 2025-04-22 21:39:19.000000000 +0200
@@ -1,27 +1,29 @@
From: "Roger A. Light" <roger@atchoo.org>
Date: Tue, 10 Aug 2021 20:48:21 +0100
Subject: Fix CONNECT performance with many user-properties.
+
Origin: https://github.com/eclipse/mosquitto/commit/9d6a73f9f72005c2f19a262f15d28327eedea91f
Bug: https://bugs.eclipse.org/bugs/show_bug.cgi?id=575314
+Bug: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/637
Bug-Debian: https://bugs.debian.org/1001028
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-41039
-Bug: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/637

An MQTT v5 client connecting with a large number of user-property properties
could cause excessive CPU usage, leading to a loss of performance and
possible denial of service