mod_c2s,mod_s2s: Adapt to XEP-xxxx: Stream Limits Advertisement

Thanks MattJ

6 files changed, 29 insertions, 9 deletions

diff --git a/doc/doap.xml b/doc/doap.xml
index b8973799..2bc2ea9a 100644
--- a/doc/doap.xml
+++ b/doc/doap.xml
@@ -865,5 +865,9 @@
         <xmpp:status>complete</xmpp:status>
       </xmpp:SupportedXep>
     </implements>
+    <implements>
+      <xmpp:xep rdf:resources="https://xmpp.org/extensions/inbox/xep-sla.xml"/>
+      <xmpp:since>trunk</xmpp:since>
+    </implements>
   </Project>
 </rdf:RDF>
diff --git a/net/resolvers/service.lua b/net/resolvers/service.lua
index a7ce76a3..39031503 100644
--- a/net/resolvers/service.lua
+++ b/net/resolvers/service.lua
@@ -111,12 +111,17 @@ function methods:next(cb)
 			answer = {};
 		end
 		if answer then
-			if self.extra and not answer.secure then
-				self.extra.use_dane = false;
-			elseif answer.bogus then
+			if answer.bogus then
 				self.last_error = "Validation error in SRV lookup";
 				ready();
 				return;
+			elseif self.extra then
+				if answer.secure then
+					self.extra.secure_hostname = "HMMMMMMM";
+				else
+					-- Insecure results, so no DANE
+					self.extra.use_dane = false;
+				end
 			end
 
 			if #answer == 0 then
diff --git a/plugins/mod_c2s.lua b/plugins/mod_c2s.lua
index a99d965d..9af463b6 100644
--- a/plugins/mod_c2s.lua
+++ b/plugins/mod_c2s.lua
@@ -132,7 +132,8 @@ function stream_callbacks._streamopened(session, attr)
 	if features.tags[1] or session.full_jid then
 		if stanza_size_limit then
 			features:reset();
-			features:tag("stanza-size-limit", { xmlns = "xmpp:prosody.im/stream/limits", bytes = string.format("%d", stanza_size_limit) });
+			features:tag("limits", { xmlns = "urn:xmpp:stream-limits:0" })
+				:text_tag("max-size", string.format("%d", stanza_size_limit)):up();
 		end
 		send(features);
 	else
diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua
index afed3575..24a301f1 100644
--- a/plugins/mod_s2s.lua
+++ b/plugins/mod_s2s.lua
@@ -250,9 +250,9 @@ function module.add_host(module)
 	module:hook("s2s-authenticated", make_authenticated, -1);
 	module:hook("s2s-read-timeout", keepalive, -1);
 	module:hook_stanza("http://etherx.jabber.org/streams", "features", function (session, stanza) -- luacheck: ignore 212/stanza
-		local limits = stanza:get_child("stanza-size-limit", "xmpp:prosody.im/stream/limits");
+		local limits = stanza:get_child("limits", "urn:xmpp:stream-limits:0");
 		if limits then
-			session.outgoing_stanza_size_limit = tonumber(limits.attr.bytes);
+			session.outgoing_stanza_size_limit = tonumber(limits:get_child_text("max-size"));
 		end
 		if session.type == "s2sout" then
 			-- Stream is authenticated and we are seem to be done with feature negotiation,
@@ -524,7 +524,8 @@ function stream_callbacks._streamopened(session, attr)
 			if ( session.type == "s2sin" or session.type == "s2sout" ) or features.tags[1] then
 				if stanza_size_limit then
 					features:reset();
-					features:tag("stanza-size-limit", { xmlns = "xmpp:prosody.im/stream/limits", bytes = string.format("%d", stanza_size_limit) });
+					features:tag("limits", { xmlns = "urn:xmpp:stream-limits:0" })
+						:text_tag("max-size", string.format("%d", stanza_size_limit)):up();
 				end
 
 				log("debug", "Sending stream features: %s", features);
diff --git a/plugins/mod_s2s_auth_certs.lua b/plugins/mod_s2s_auth_certs.lua
index bde3cb82..5f5cce02 100644
--- a/plugins/mod_s2s_auth_certs.lua
+++ b/plugins/mod_s2s_auth_certs.lua
@@ -12,6 +12,8 @@ module:hook("s2s-check-certificate", function(event)
 	local conn = session.conn;
 	local log = session.log or log;
 
+	local secure_hostname = conn.extra and conn.extra.dane_hostname;
+
 	if not cert then
 		log("warn", "No certificate provided by %s", host or "unknown host");
 		return;
@@ -37,6 +39,14 @@ module:hook("s2s-check-certificate", function(event)
 
 		-- We'll go ahead and verify the asserted identity if the
 		-- connecting server specified one.
+		if secure_hostname then
+			if cert_verify_identity(secure_hostname, "xmpp-server", cert) then
+				module:log("info", "Secure SRV name delegation %q -> %q", secure_hostname, host);
+				session.cert_identity_status = "valid"
+			else
+				session.cert_identity_status = "invalid"
+			end
+		end
 		if host then
 			if cert_verify_identity(host, "xmpp-server", cert) then
 				session.cert_identity_status = "valid"
diff --git a/util/x509.lua b/util/x509.lua
index 51ca3c96..ae250a55 100644
--- a/util/x509.lua
+++ b/util/x509.lua
@@ -276,8 +276,7 @@ local function get_identities(cert) --> map of names to sets of services
 	return names.data;
 end
 
-local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n"..
-"([0-9A-Za-z+/=\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-";
+local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n([0-9A-Za-z+/=\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-";
 
 local function pem2der(pem)
 	local typ, data = pem:match(pat);