Openfire (master)

• 

  Guus der Kinderen 05 Mar 2026 47a35bd7577fb5c208aa9b6941b6cfd0b0547978

  OF-3176: Tie shared Netty S2S outbound resource lifecycle to ConnectionManagerImpl
  Previously, the shared Netty thread pools for outbound S2S were initialized and torn down from ConnectionListener, causing a race condition where outbound connections could be attempted before the inbound S2S listener had started.
  
  Resources are now initialized in ConnectionManagerImpl.initialize() and destroyed in ConnectionManagerImpl.destroy(), ensuring they are available for the full duration of the server lifecycle.

  • xmppserver/src/main/java/org/jivesoftware/openfire/nio/NettySessionInitializer.java (version 47a35bd7577fb5c208aa9b6941b6cfd0b0547978)
  • xmppserver/src/main/java/org/jivesoftware/openfire/spi/ConnectionListener.java (version 47a35bd7577fb5c208aa9b6941b6cfd0b0547978)
  • xmppserver/src/main/java/org/jivesoftware/openfire/spi/ConnectionManagerImpl.java (version 47a35bd7577fb5c208aa9b6941b6cfd0b0547978)
• 

  Guus der Kinderen 05 Mar 2026 ab9894954559d7d6aabcca66ebbad4f1f8df473a

  OF-3176: Fix NPE race condition in DirectTLS channelActive handler
  CONNECTION attribute could be null when channelActive fired before handlerAdded had executed on the blockingHandlerExecutor, causing a NullPointerException when attempting to start DirectTLS.
  
  Fix by deferring DirectTLS initialisation behind stanzaHandlerFuture, which guarantees CONNECTION is set before it is accessed. Applied to both inbound (NettyServerInitializer) and outbound (NettySessionInitializer) connection handlers.

  • xmppserver/src/main/java/org/jivesoftware/openfire/nio/NettySessionInitializer.java (version ab9894954559d7d6aabcca66ebbad4f1f8df473a)
  • xmppserver/src/main/java/org/jivesoftware/openfire/spi/NettyServerInitializer.java (version ab9894954559d7d6aabcca66ebbad4f1f8df473a)
• 

  Guus der Kinderen 05 Mar 2026 941d305be4410c1ba34a2a390c8e25c5a4898a8c

  OF-3176: Fix DirectTLS channelActive not propagating to downstream handlers after TLS handshake
  In both NettySessionInitializer and NettyServerInitializer, the tlsAndAutoReadHandler was unconditionally suppressing channelActive on the directTLS path, including the post-handshake re-fire from NettyConnectionHandler.userEventTriggered(). This meant downstream handlers such as NettyOutboundConnectionHandler never received channelActive after TLS was established.
  
  Fix by inspecting the pipeline for the presence of an SslHandler before deciding whether to suppress or propagate channelActive. On the first call no SslHandler is present yet, so propagation is suppressed and TLS initiation is scheduled as before. On the post-handshake re-fire, startTLS() will have already added an SslHandler to the pipeline head, so the event is forwarded downstream normally.

  • xmppserver/src/main/java/org/jivesoftware/openfire/nio/NettySessionInitializer.java (version 941d305be4410c1ba34a2a390c8e25c5a4898a8c)
  • xmppserver/src/main/java/org/jivesoftware/openfire/spi/NettyServerInitializer.java (version 941d305be4410c1ba34a2a390c8e25c5a4898a8c)