--- a/doc/doap.xml	Tue Mar 16 18:30:54 2021 +0100
+++ b/doc/doap.xml	Thu Oct 20 14:04:56 2022 +0200
@@ -865,5 +865,9 @@
         <xmpp:status>complete</xmpp:status>
       </xmpp:SupportedXep>
     </implements>
+    <implements>
+      <xmpp:xep rdf:resources="https://xmpp.org/extensions/inbox/xep-sla.xml"/>
+      <xmpp:since>trunk</xmpp:since>
+    </implements>
   </Project>
 </rdf:RDF>

--- a/net/resolvers/service.lua	Tue Mar 16 18:30:54 2021 +0100
+++ b/net/resolvers/service.lua	Thu Oct 20 14:04:56 2022 +0200
@@ -111,12 +111,17 @@
 			answer = {};
 		end
 		if answer then
-			if self.extra and not answer.secure then
-				self.extra.use_dane = false;
-			elseif answer.bogus then
+			if answer.bogus then
 				self.last_error = "Validation error in SRV lookup";
 				ready();
 				return;
+			elseif self.extra then
+				if answer.secure then
+					self.extra.secure_hostname = "HMMMMMMM";
+				else
+					-- Insecure results, so no DANE
+					self.extra.use_dane = false;
+				end
 			end
 
 			if #answer == 0 then

--- a/plugins/mod_c2s.lua	Tue Mar 16 18:30:54 2021 +0100
+++ b/plugins/mod_c2s.lua	Thu Oct 20 14:04:56 2022 +0200
@@ -132,7 +132,8 @@
 	if features.tags[1] or session.full_jid then
 		if stanza_size_limit then
 			features:reset();
-			features:tag("stanza-size-limit", { xmlns = "xmpp:prosody.im/stream/limits", bytes = string.format("%d", stanza_size_limit) });
+			features:tag("limits", { xmlns = "urn:xmpp:stream-limits:0" })
+				:text_tag("max-size", string.format("%d", stanza_size_limit)):up();
 		end
 		send(features);
 	else

--- a/plugins/mod_s2s.lua	Tue Mar 16 18:30:54 2021 +0100
+++ b/plugins/mod_s2s.lua	Thu Oct 20 14:04:56 2022 +0200
@@ -250,9 +250,9 @@
 	module:hook("s2s-authenticated", make_authenticated, -1);
 	module:hook("s2s-read-timeout", keepalive, -1);
 	module:hook_stanza("http://etherx.jabber.org/streams", "features", function (session, stanza) -- luacheck: ignore 212/stanza
-		local limits = stanza:get_child("stanza-size-limit", "xmpp:prosody.im/stream/limits");
+		local limits = stanza:get_child("limits", "urn:xmpp:stream-limits:0");
 		if limits then
-			session.outgoing_stanza_size_limit = tonumber(limits.attr.bytes);
+			session.outgoing_stanza_size_limit = tonumber(limits:get_child_text("max-size"));
 		end
 		if session.type == "s2sout" then
 			-- Stream is authenticated and we are seem to be done with feature negotiation,
@@ -524,7 +524,8 @@
 			if ( session.type == "s2sin" or session.type == "s2sout" ) or features.tags[1] then
 				if stanza_size_limit then
 					features:reset();
-					features:tag("stanza-size-limit", { xmlns = "xmpp:prosody.im/stream/limits", bytes = string.format("%d", stanza_size_limit) });
+					features:tag("limits", { xmlns = "urn:xmpp:stream-limits:0" })
+						:text_tag("max-size", string.format("%d", stanza_size_limit)):up();
 				end
 
 				log("debug", "Sending stream features: %s", features);

--- a/plugins/mod_s2s_auth_certs.lua	Tue Mar 16 18:30:54 2021 +0100
+++ b/plugins/mod_s2s_auth_certs.lua	Thu Oct 20 14:04:56 2022 +0200
@@ -12,6 +12,8 @@
 	local conn = session.conn;
 	local log = session.log or log;
 
+	local secure_hostname = conn.extra and conn.extra.dane_hostname;
+
 	if not cert then
 		log("warn", "No certificate provided by %s", host or "unknown host");
 		return;
@@ -37,6 +39,14 @@
 
 		-- We'll go ahead and verify the asserted identity if the
 		-- connecting server specified one.
+		if secure_hostname then
+			if cert_verify_identity(secure_hostname, "xmpp-server", cert) then
+				module:log("info", "Secure SRV name delegation %q -> %q", secure_hostname, host);
+				session.cert_identity_status = "valid"
+			else
+				session.cert_identity_status = "invalid"
+			end
+		end
 		if host then
 			if cert_verify_identity(host, "xmpp-server", cert) then
 				session.cert_identity_status = "valid"

--- a/util/x509.lua	Tue Mar 16 18:30:54 2021 +0100
+++ b/util/x509.lua	Thu Oct 20 14:04:56 2022 +0200
@@ -276,8 +276,7 @@
 	return names.data;
 end
 
-local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n"..
-"([0-9A-Za-z+/=\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-";
+local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n([0-9A-Za-z+/=\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-";
 
 local function pem2der(pem)
 	local typ, data = pem:match(pat);