LoginSign Up
← Back to all sparks
O

Openfire

COMMS
Velocity2.5

Real-time collaboration server using the XMPP protocol.

www.igniterealtime.org/projects/openfire ↗

Openfire's 5.1 line pairs XMPP channel binding with a steady cleanup of its own crypto

xmppmessaging-serverfederationcrypto-hardeningmuc
◆Current state
Six releases across the 5.0 and 5.1 lines, each a long list of numbered improvements and bug fixes. The 5.1.0 release is the substantive one: support for channel binding, an admin console page for reviewing failed server-to-server connection attempts, visible S2S ports, and removal of a hardcoded initialization vector and a weak SHA-1-derived Blowfish key. The rest is multi-user chat correctness, pubsub behaviour and dependency currency.
◆Where it's heading
Two consistent threads run through the window: replacing the older cryptographic shortcuts still sitting in the codebase, and making federation failures diagnosable rather than silent. Multi-user chat and pubsub keep generating the highest volume of fixes, which is a fair map of where a working XMPP server actually spends its time.
◆Prediction
Expect the 5.1 line to continue with MUC and pubsub fixes plus further dependency upgrades, with any remaining legacy crypto paths the most likely target for the next round of hardening.

◆Recent moves

  1. 22d ago

    Openfire 5.1.1: MUC and pubsub subscription fixes

    Error handling in the multi-user chat service, an unhelpful history-reload log message, and inconsistent duplicate-subscription policy on collection nodes. Narrow cleanup following the 5.1.0 release.

    View source ↗
  2. 1mo ago

    Channel binding support and S2S connection diagnostics

    Adds XMPP channel binding, an admin page for failed server-to-server attempts and visible S2S ports, while removing a hardcoded encryption IV and a weak SHA-1-based Blowfish key. The clearest expression of the hardening and federation-visibility threads in this window.

    View source ↗
  3. 2mo ago

    Openfire 5.0.5: dependency currency and logging fixes

    Bumps BouncyCastle, MySQL Connector/J and Jetty, and improves LDAP and audit log detail. Housekeeping on the 5.0 line before 5.1 opened.

    View source ↗
  4. 4mo ago

    Fixes high CPU from exception-based control flow

    Removes exception-based control flow in user lookups that caused high CPU usage, improves TrustManager failure logging and targets pubsub cache purges more precisely. A performance fix administrators would actually feel.

    View source ↗
  5. 7mo ago

    Openfire 5.0.3: driver upgrades and MUC fixes

    PostgreSQL, HSQLDB and SQL Server driver updates alongside a concurrent modification error on room join and an incorrect chat room count. Routine maintenance.

    View source ↗
  6. 10mo ago

    Openfire 5.0.2: MUC status codes and ad-hoc command reporting

    Sends proper status codes when a room config changes, reports how many sessions an ad-hoc end-session command closed, and relaxes base64 whitespace handling. Protocol conformance detail.

    View source ↗