update(mqtt config): Enforce strict parser mode by default

en_US/configuration/mqtt.md

@@ -1,8 +1,8 @@
 # MQTT Configuration
 
-[MQTT](https://mqtt.org/) is a standard messaging protocol for the Internet of Things (IoT). It is designed as an extremely lightweight publish/subscribe messaging transport that is ideal for connecting remote devices with a small code footprint and minimal network bandwidth. 
+[MQTT](https://mqtt.org/) is a lightweight publish/subscribe messaging protocol for connecting Internet of Things (IoT) devices. EMQX supports MQTT 3.1, 3.1.1, and 5.0.
 
-EMQX is 100% MQTT 5.0 and 3.x compliant. This section introduces the basic configuration items for MQTT-related features, covering topics like basic MQTT settings, subscription settings, session settings, force shutdown settings, and forced garbage collection settings.
+This page describes how to configure MQTT protocol behavior in EMQX, including packet validation and limits, subscriptions, delayed publishing, Keep Alive handling, and sessions.
 
 ## Basic MQTT Configurations
 
@@ -26,6 +26,7 @@ mqtt {
   max_qos_allowed = 2
   max_topic_alias = 65535
   retain_available = true
+  strict_mode = true
 }  
 ```
 
@@ -39,6 +40,39 @@ Where,
 | `max_qos_allowed`       | Max QoS              | QoS levels determine the level of reliability and delivery assurance for messages.<br /><br /> This sets maximum quality of service (QoS) level that is allowed for MQTT messages. |                   |                     |
 | `max_topic_alias`       | Max Topic Alias      | Topic aliases are a way to reduce the size of MQTT packets by using a shorter alias instead of the full topic name.<br /><br /> This sets the maximum number of topic aliases that can be used in an MQTT session. | `65535`           | `1` - `65535`       |
 | `retain_available`      | Retain Available     | Retained messages are used to store the last message published to a topic, so that new subscribers to the topic can receive the most recent message.<br /><br /> This sets whether to enable retained messages feature in MQTT. | `true`            | `true`, `false`     |
+| `strict_mode`           | Strict Mode          | This sets whether to apply additional protocol compliance checks to incoming MQTT packets. Packets that fail these checks cause the client connection to be closed. | `true` | `true`, `false` |
+
+### Strict MQTT Packet Validation
+
+Starting from EMQX 6.3.0, strict MQTT packet validation is enabled by default. With `strict_mode = true`, EMQX rejects malformed MQTT packets, including packets with:
+
+- Invalid MQTT fixed-header flag combinations.
+- In an MQTT 3.1.1 CONNECT packet, a Password Flag without a Username Flag.
+- Invalid UTF-8 strings in fields such as the client ID, topic name, username, password, Will Topic, or MQTT 5.0 string properties. This includes null characters and other prohibited control characters.
+- A zero Packet Identifier where the MQTT protocol requires a non-zero value.
+
+When a malformed packet is detected, EMQX closes the client connection and records a `frame_parse_error` log at the `info` level with the specific reason. For MQTT 5.0 clients, EMQX also sends a CONNACK or DISCONNECT packet with reason code `0x81` (Malformed Packet) when possible. MQTT 3.1 and MQTT 3.1.1 clients are disconnected without a reason code for malformed packets.
+
+If an existing client does not conform to these MQTT protocol requirements, you can temporarily disable the protocol compliance checks that are enforced only in strict mode:
+
+```bash
+mqtt.strict_mode = false
+```
+
+To disable strict-mode checks only for specific legacy clients, configure a zone and associate it with a dedicated listener:
+
+```bash
+zones.legacy_clients {
+  mqtt.strict_mode = false
+}
+
+listeners.tcp.legacy {
+  bind = "0.0.0.0:1884"
+  zone = legacy_clients
+}
+```
+
+Clients connected through other listeners continue to use strict validation. For more information about zones, see [Zone Override](./configuration.md#zone-override).
 
 ## Subscription Settings
 

zh_CN/configuration/mqtt.md

@@ -1,8 +1,8 @@
-# MQTT
+# MQTT 配置
 
-[MQTT](https://mqtt.org/) 是物联网 (IoT) 的标准消息传输协议。它被设计为一个极轻量级的发布/订阅消息传输机制，非常适合于需要小代码占用和最小网络带宽的远程设备连接。
+[MQTT](https://mqtt.org/) 是一种用于连接物联网（IoT）设备的轻量级发布/订阅消息传输协议。EMQX 支持 MQTT 3.1、3.1.1 和 5.0。
 
-EMQX 完全兼容 MQTT 5.0 和 3.x，本节将介绍 MQTT 相关功能的基本配置项，包括基本 MQTT 设置、订阅设置、会话设置、强制关闭设置和强制垃圾回收设置等。
+本页介绍如何配置 EMQX 的 MQTT 协议行为，包括报文校验和限制、订阅、延迟发布、Keep Alive 处理以及会话。
 
 ## 基本 MQTT 配置
 
@@ -24,6 +24,7 @@ mqtt {
   max_qos_allowed = 2
   max_topic_alias = 65535
   retain_available = true
+  strict_mode = true
 }  
 ```
 
@@ -37,6 +38,39 @@ mqtt {
 | `max_qos_allowed`  | 最大 QoS           | QoS 等级决定了消息的可靠性和传递保证等级。<br /><br />此设置允许 MQTT 消息的最大服务质量（QoS）等级。 |            |                 |
 | `max_topic_alias`  | 最大主题别名数     | 主题别名是通过使用较短的别名代替完整主题名称来减少 MQTT 数据包大小的一种方式。<br /><br />此设置允许在 MQTT 会话中使用的最大主题别名数量。 | `65535`    | `1` - `65535`   |
 | `retain_available` | 启用保留消息       | 保留消息用于存储发布到主题的最后一条消息，以便新订阅该主题的客户端可以接收到最新的消息。<br /><br />此设置是否启用 MQTT 中的保留消息功能。 | `true`     | `true`, `false` |
+| `strict_mode`      | 严格模式           | 设置是否对传入的 MQTT 报文执行额外的协议合规性校验。未通过这些校验的报文会导致客户端连接关闭。 | `true` | `true`, `false` |
+
+### MQTT 报文严格校验
+
+从 EMQX 6.3.0 开始，默认启用 MQTT 报文严格校验。设置 `strict_mode = true` 后，EMQX 会拒绝格式错误的 MQTT 报文，包括存在以下问题的报文：
+
+- MQTT 固定报文头中的标志位组合无效。
+- MQTT 3.1.1 CONNECT 报文设置了 Password Flag，但未设置 Username Flag。
+- 客户端 ID、主题名称、用户名、密码、Will Topic 或 MQTT 5.0 字符串属性等字段包含无效的 UTF-8 字符串，包括空字符和其他协议禁止的控制字符。
+- MQTT 协议要求 Packet Identifier 非零，但报文中的值为零。
+
+检测到格式错误的报文后，EMQX 会关闭客户端连接，并记录一条 `info` 级别的 `frame_parse_error` 日志，其中包含具体原因。对于 MQTT 5.0 客户端，EMQX 还会在可能的情况下发送原因码为 `0x81`（Malformed Packet）的 CONNACK 或 DISCONNECT 报文。对于 MQTT 3.1 和 MQTT 3.1.1 客户端，EMQX 会直接断开连接，不返回格式错误原因码。
+
+如果现有客户端不符合这些 MQTT 协议要求，可以通过以下配置暂时关闭仅在严格模式下执行的协议合规性校验：
+
+```bash
+mqtt.strict_mode = false
+```
+
+如需仅对特定旧客户端关闭严格模式校验，可以配置一个 Zone，并将其关联到专用监听器：
+
+```bash
+zones.legacy_clients {
+  mqtt.strict_mode = false
+}
+
+listeners.tcp.legacy {
+  bind = "0.0.0.0:1884"
+  zone = legacy_clients
+}
+```
+
+通过其他监听器连接的客户端仍使用严格校验。有关 Zone 的更多信息，请参见 [Zone 覆盖](./configuration.md#zone-覆盖)。
 
 ## 订阅设置