#2010 S2S connection with conference.jabber.ru closes with "connection-timeout" despite successful TLS and SASL EXTERNAL
Reporter
owl5053
Owner
Nobody
Created
Updated
Stars
★ (1)
Tags
Type-Defect
Compliance
Priority-Medium
Status-New
owl5053
on
Im running the latest nightly build of Prosody and I'm seeing a reproducible issue with S2S federation to conference.jabber.ru (and also jabber.ru itself). The incoming S2S connection completes successfully - TLS is negotiated, SASL EXTERNAL succeeds, and the stream is marked as "complete" - but shortly afterwards Prosody closes the stream with connection-timeout. A tcpdump capture shows that TCP traffic is flowing in both directions and the connection is not being reset by the remote side.
Environment:
Prosody version: Prosody 13.0 nightly build 98 (2026-06-07, 75d09be04f13)
Lua: 5.4
LuaSec: 1.3.2
OpenSSL: 3.5.6
OS: Linux 6.12.100+deb13-amd64
Running in Docker
Domain: my_xmpp_server.com (*.ddns.net)
Remote: conference.jabber.ru / jabber.ru (116.202.237.43)
Relevant Prosody log excerpt:
<code>
s2sin... info Stream encrypted (TLSv1.2 with ECDHE-ECDSA-AES256-GCM-SHA384)
...:saslauth info Accepting SASL EXTERNAL identity from conference.jabber.ru
s2sin... info Incoming s2s connection conference.jabber.ru->my_xmpp_server.com complete
s2sout... info Stream encrypted (TLSv1.2 with ECDHE-RSA-AES128-GCM-SHA256)
s2sout... info Outgoing s2s connection my_xmpp_server.com->conference.jabber.ru complete
s2sin... info Incoming s2s stream conference.jabber.ru->my_xmpp_server.com closed: connection-timeout
</code>
The same pattern occurs for jabber.ru itself: connection completes, then times out.
I captured traffic with: tcpdump -i any -n host conference.jabber.ru and port 5269 -A
The capture shows:
Incoming packets from 116.202.237.43:42885 to my_xmpp_server.com:5269 (length 429, 429, 202, 202 …)
ACKs and outgoing packets from my_xmpp_server.com:5269 back to 116.202.237.xx:42885
No FIN or RST from the remote side - the TCP connection stays open
A second flow on a dynamic port (47072 -> 5269) from my server to jabber.ru, also active
So TCP, TLS, and SASL all appear to work, and data is being exchanged, yet Prosody still declares connection-timeout.
Additional notes:
telnet conference.jabber.ru 5269 works fine from the same host.
The issue is specific to jabber.ru / conference.jabber.ru; other federated servers work normally.
I found issue #237 ("s2s with xmpp.ru (ejabberd) sometimes fails"), which describes a very similar symptom, but it was closed long ago (fixed in 0.8.2). It looks like a recurrence of the same underlying incompatibility with ejabberd-based servers on the current nightly build.
s2s_timeout is not a config option, so I can't tune it from prosody.cfg.lua.
Questions:
- Is there a way to get more verbose S2S debug logging to see which stanzas (or lack thereof) trigger the timeout?
- Is this a known incompatibility with ejabberd-based servers, and is there a workaround?
- Would it help to capture debug logs on my side and attach them to this issue?
I'm happy to provide full debug logs, tcpdump captures, or any other data that would help.
Thanks!
Im running the latest nightly build of Prosody and I'm seeing a reproducible issue with S2S federation to conference.jabber.ru (and also jabber.ru itself). The incoming S2S connection completes successfully - TLS is negotiated, SASL EXTERNAL succeeds, and the stream is marked as "complete" - but shortly afterwards Prosody closes the stream with connection-timeout. A tcpdump capture shows that TCP traffic is flowing in both directions and the connection is not being reset by the remote side. Environment: Prosody version: Prosody 13.0 nightly build 98 (2026-06-07, 75d09be04f13) Lua: 5.4 LuaSec: 1.3.2 OpenSSL: 3.5.6 OS: Linux 6.12.100+deb13-amd64 Running in Docker Domain: my_xmpp_server.com (*.ddns.net) Remote: conference.jabber.ru / jabber.ru (116.202.237.43) Relevant Prosody log excerpt: <code> s2sin... info Stream encrypted (TLSv1.2 with ECDHE-ECDSA-AES256-GCM-SHA384) ...:saslauth info Accepting SASL EXTERNAL identity from conference.jabber.ru s2sin... info Incoming s2s connection conference.jabber.ru->my_xmpp_server.com complete s2sout... info Stream encrypted (TLSv1.2 with ECDHE-RSA-AES128-GCM-SHA256) s2sout... info Outgoing s2s connection my_xmpp_server.com->conference.jabber.ru complete s2sin... info Incoming s2s stream conference.jabber.ru->my_xmpp_server.com closed: connection-timeout </code> The same pattern occurs for jabber.ru itself: connection completes, then times out. I captured traffic with: tcpdump -i any -n host conference.jabber.ru and port 5269 -A The capture shows: Incoming packets from 116.202.237.43:42885 to my_xmpp_server.com:5269 (length 429, 429, 202, 202 …) ACKs and outgoing packets from my_xmpp_server.com:5269 back to 116.202.237.xx:42885 No FIN or RST from the remote side - the TCP connection stays open A second flow on a dynamic port (47072 -> 5269) from my server to jabber.ru, also active So TCP, TLS, and SASL all appear to work, and data is being exchanged, yet Prosody still declares connection-timeout. Additional notes: telnet conference.jabber.ru 5269 works fine from the same host. The issue is specific to jabber.ru / conference.jabber.ru; other federated servers work normally. I found issue #237 ("s2s with xmpp.ru (ejabberd) sometimes fails"), which describes a very similar symptom, but it was closed long ago (fixed in 0.8.2). It looks like a recurrence of the same underlying incompatibility with ejabberd-based servers on the current nightly build. s2s_timeout is not a config option, so I can't tune it from prosody.cfg.lua. Questions: - Is there a way to get more verbose S2S debug logging to see which stanzas (or lack thereof) trigger the timeout? - Is this a known incompatibility with ejabberd-based servers, and is there a workaround? - Would it help to capture debug logs on my side and attach them to this issue? I'm happy to provide full debug logs, tcpdump captures, or any other data that would help. Thanks!