From 1742757734374ecbb611d2f10f3f2310caae085d Mon Sep 17 00:00:00 2001
From: Badlop <badlop@process-one.net>
Date: Wed, 27 Jan 2010 10:56:13 +0100
Subject: [PATCH] Applied patch for s2s_proxy. Needs testing.

---
 doc/guide.html          |  326 +++++++++++++++++++++++++++--------------------
 doc/guide.tex           |   61 +++++++++
 src/ejabberd_config.erl |    2 +
 src/ejabberd_s2s.erl    |   31 +++++-
 src/ejabberd_s2s_in.erl |   64 +++++----
 src/mod_s2s_proxy.erl   |  115 +++++++++++++++++
 6 files changed, 429 insertions(+), 170 deletions(-)
 create mode 100644 src/mod_s2s_proxy.erl

diff --git a/doc/guide.html b/doc/guide.html
index b0f3ad7..0266809 100644
--- a/doc/guide.html
+++ b/doc/guide.html
@@ -126,98 +126,99 @@ BLOCKQUOTE.figure DIV.center DIV.center HR{display:none;}
 </LI><LI CLASS="li-toc"><A HREF="#htoc28">3.1.7&#XA0;&#XA0;Default Language</A>
 </LI><LI CLASS="li-toc"><A HREF="#htoc29">3.1.8&#XA0;&#XA0;CAPTCHA</A>
 </LI><LI CLASS="li-toc"><A HREF="#htoc30">3.1.9&#XA0;&#XA0;STUN</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc31">3.1.10&#XA0;&#XA0;Include Additional Configuration Files</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc32">3.1.11&#XA0;&#XA0;Option Macros in Configuration File</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc31">3.1.10&#XA0;&#XA0;S2S-proxy</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc32">3.1.11&#XA0;&#XA0;Include Additional Configuration Files</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc33">3.1.12&#XA0;&#XA0;Option Macros in Configuration File</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc33">3.2&#XA0;&#XA0;Database and LDAP Configuration</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc34">3.2&#XA0;&#XA0;Database and LDAP Configuration</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc34">3.2.1&#XA0;&#XA0;MySQL</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc35">3.2.2&#XA0;&#XA0;Microsoft SQL Server</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc36">3.2.3&#XA0;&#XA0;PostgreSQL</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc37">3.2.4&#XA0;&#XA0;ODBC Compatible</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc38">3.2.5&#XA0;&#XA0;LDAP</A>
+<A HREF="#htoc35">3.2.1&#XA0;&#XA0;MySQL</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc36">3.2.2&#XA0;&#XA0;Microsoft SQL Server</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc37">3.2.3&#XA0;&#XA0;PostgreSQL</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc38">3.2.4&#XA0;&#XA0;ODBC Compatible</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc39">3.2.5&#XA0;&#XA0;LDAP</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc39">3.3&#XA0;&#XA0;Modules Configuration</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc40">3.3&#XA0;&#XA0;Modules Configuration</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc40">3.3.1&#XA0;&#XA0;Modules Overview</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc41">3.3.2&#XA0;&#XA0;Common Options</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc42">3.3.3&#XA0;&#XA0;<TT>mod_announce</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc43">3.3.4&#XA0;&#XA0;<TT>mod_disco</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc44">3.3.5&#XA0;&#XA0;<TT>mod_echo</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc45">3.3.6&#XA0;&#XA0;<TT>mod_http_bind</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc46">3.3.7&#XA0;&#XA0;<TT>mod_http_fileserver</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc47">3.3.8&#XA0;&#XA0;<TT>mod_irc</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc48">3.3.9&#XA0;&#XA0;<TT>mod_last</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc49">3.3.10&#XA0;&#XA0;<TT>mod_muc</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc50">3.3.11&#XA0;&#XA0;<TT>mod_muc_log</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc51">3.3.12&#XA0;&#XA0;<TT>mod_offline</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc52">3.3.13&#XA0;&#XA0;<TT>mod_ping</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc53">3.3.14&#XA0;&#XA0;<TT>mod_privacy</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc54">3.3.15&#XA0;&#XA0;<TT>mod_private</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc55">3.3.16&#XA0;&#XA0;<TT>mod_proxy65</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc56">3.3.17&#XA0;&#XA0;<TT>mod_pubsub</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc57">3.3.18&#XA0;&#XA0;<TT>mod_register</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc58">3.3.19&#XA0;&#XA0;<TT>mod_roster</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc59">3.3.20&#XA0;&#XA0;<TT>mod_service_log</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc60">3.3.21&#XA0;&#XA0;<TT>mod_shared_roster</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc61">3.3.22&#XA0;&#XA0;<TT>mod_stats</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc62">3.3.23&#XA0;&#XA0;<TT>mod_time</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc63">3.3.24&#XA0;&#XA0;<TT>mod_vcard</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc64">3.3.25&#XA0;&#XA0;<TT>mod_vcard_ldap</TT></A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc65">3.3.26&#XA0;&#XA0;<TT>mod_version</TT></A>
+<A HREF="#htoc41">3.3.1&#XA0;&#XA0;Modules Overview</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc42">3.3.2&#XA0;&#XA0;Common Options</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc43">3.3.3&#XA0;&#XA0;<TT>mod_announce</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc44">3.3.4&#XA0;&#XA0;<TT>mod_disco</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc45">3.3.5&#XA0;&#XA0;<TT>mod_echo</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc46">3.3.6&#XA0;&#XA0;<TT>mod_http_bind</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc47">3.3.7&#XA0;&#XA0;<TT>mod_http_fileserver</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc48">3.3.8&#XA0;&#XA0;<TT>mod_irc</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc49">3.3.9&#XA0;&#XA0;<TT>mod_last</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc50">3.3.10&#XA0;&#XA0;<TT>mod_muc</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc51">3.3.11&#XA0;&#XA0;<TT>mod_muc_log</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc52">3.3.12&#XA0;&#XA0;<TT>mod_offline</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc53">3.3.13&#XA0;&#XA0;<TT>mod_ping</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc54">3.3.14&#XA0;&#XA0;<TT>mod_privacy</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc55">3.3.15&#XA0;&#XA0;<TT>mod_private</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc56">3.3.16&#XA0;&#XA0;<TT>mod_proxy65</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc57">3.3.17&#XA0;&#XA0;<TT>mod_pubsub</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc58">3.3.18&#XA0;&#XA0;<TT>mod_register</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc59">3.3.19&#XA0;&#XA0;<TT>mod_roster</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc60">3.3.20&#XA0;&#XA0;<TT>mod_service_log</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc61">3.3.21&#XA0;&#XA0;<TT>mod_shared_roster</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc62">3.3.22&#XA0;&#XA0;<TT>mod_stats</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc63">3.3.23&#XA0;&#XA0;<TT>mod_time</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc64">3.3.24&#XA0;&#XA0;<TT>mod_vcard</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc65">3.3.25&#XA0;&#XA0;<TT>mod_vcard_ldap</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc66">3.3.26&#XA0;&#XA0;<TT>mod_version</TT></A>
 </LI></UL>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc66">Chapter&#XA0;4&#XA0;&#XA0;Managing an <TT>ejabberd</TT> Server</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc67">Chapter&#XA0;4&#XA0;&#XA0;Managing an <TT>ejabberd</TT> Server</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc67">4.1&#XA0;&#XA0;<TT>ejabberdctl</TT></A>
+<A HREF="#htoc68">4.1&#XA0;&#XA0;<TT>ejabberdctl</TT></A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc68">4.1.1&#XA0;&#XA0;ejabberdctl Commands</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc69">4.1.2&#XA0;&#XA0;Erlang Runtime System</A>
+<A HREF="#htoc69">4.1.1&#XA0;&#XA0;ejabberdctl Commands</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc70">4.1.2&#XA0;&#XA0;Erlang Runtime System</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc70">4.2&#XA0;&#XA0;<TT>ejabberd</TT> Commands</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc71">4.2&#XA0;&#XA0;<TT>ejabberd</TT> Commands</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc71">4.2.1&#XA0;&#XA0;List of ejabberd Commands</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc72">4.2.2&#XA0;&#XA0;Restrict Execution with AccessCommands</A>
+<A HREF="#htoc72">4.2.1&#XA0;&#XA0;List of ejabberd Commands</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc73">4.2.2&#XA0;&#XA0;Restrict Execution with AccessCommands</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc73">4.3&#XA0;&#XA0;Web Admin</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc74">4.4&#XA0;&#XA0;Ad-hoc Commands</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc75">4.5&#XA0;&#XA0;Change Computer Hostname</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc74">4.3&#XA0;&#XA0;Web Admin</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc75">4.4&#XA0;&#XA0;Ad-hoc Commands</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc76">4.5&#XA0;&#XA0;Change Computer Hostname</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc76">Chapter&#XA0;5&#XA0;&#XA0;Securing <TT>ejabberd</TT></A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc77">Chapter&#XA0;5&#XA0;&#XA0;Securing <TT>ejabberd</TT></A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc77">5.1&#XA0;&#XA0;Firewall Settings</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc78">5.2&#XA0;&#XA0;epmd</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc79">5.3&#XA0;&#XA0;Erlang Cookie</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc80">5.4&#XA0;&#XA0;Erlang Node Name</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc81">5.5&#XA0;&#XA0;Securing Sensitive Files</A>
+<A HREF="#htoc78">5.1&#XA0;&#XA0;Firewall Settings</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc79">5.2&#XA0;&#XA0;epmd</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc80">5.3&#XA0;&#XA0;Erlang Cookie</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc81">5.4&#XA0;&#XA0;Erlang Node Name</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc82">5.5&#XA0;&#XA0;Securing Sensitive Files</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc82">Chapter&#XA0;6&#XA0;&#XA0;Clustering</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc83">Chapter&#XA0;6&#XA0;&#XA0;Clustering</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc83">6.1&#XA0;&#XA0;How it Works</A>
+<A HREF="#htoc84">6.1&#XA0;&#XA0;How it Works</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc84">6.1.1&#XA0;&#XA0;Router</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc85">6.1.2&#XA0;&#XA0;Local Router</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc86">6.1.3&#XA0;&#XA0;Session Manager</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc87">6.1.4&#XA0;&#XA0;s2s Manager</A>
+<A HREF="#htoc85">6.1.1&#XA0;&#XA0;Router</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc86">6.1.2&#XA0;&#XA0;Local Router</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc87">6.1.3&#XA0;&#XA0;Session Manager</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc88">6.1.4&#XA0;&#XA0;s2s Manager</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc88">6.2&#XA0;&#XA0;Clustering Setup</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc89">6.3&#XA0;&#XA0;Service Load-Balancing</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc89">6.2&#XA0;&#XA0;Clustering Setup</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc90">6.3&#XA0;&#XA0;Service Load-Balancing</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc90">6.3.1&#XA0;&#XA0;Components Load-Balancing</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc91">6.3.2&#XA0;&#XA0;Domain Load-Balancing Algorithm</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc92">6.3.3&#XA0;&#XA0;Load-Balancing Buckets</A>
+<A HREF="#htoc91">6.3.1&#XA0;&#XA0;Components Load-Balancing</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc92">6.3.2&#XA0;&#XA0;Domain Load-Balancing Algorithm</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc93">6.3.3&#XA0;&#XA0;Load-Balancing Buckets</A>
 </LI></UL>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc93">Chapter&#XA0;7&#XA0;&#XA0;Debugging</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc94">Chapter&#XA0;7&#XA0;&#XA0;Debugging</A>
 <UL CLASS="toc"><LI CLASS="li-toc">
-<A HREF="#htoc94">7.1&#XA0;&#XA0;Log Files</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc95">7.2&#XA0;&#XA0;Debug Console</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc96">7.3&#XA0;&#XA0;Watchdog Alerts</A>
+<A HREF="#htoc95">7.1&#XA0;&#XA0;Log Files</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc96">7.2&#XA0;&#XA0;Debug Console</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc97">7.3&#XA0;&#XA0;Watchdog Alerts</A>
 </LI></UL>
-</LI><LI CLASS="li-toc"><A HREF="#htoc97">Appendix&#XA0;A&#XA0;&#XA0;Internationalization and Localization</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc98">Appendix&#XA0;B&#XA0;&#XA0;Release Notes</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc99">Appendix&#XA0;C&#XA0;&#XA0;Acknowledgements</A>
-</LI><LI CLASS="li-toc"><A HREF="#htoc100">Appendix&#XA0;D&#XA0;&#XA0;Copyright Information</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc98">Appendix&#XA0;A&#XA0;&#XA0;Internationalization and Localization</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc99">Appendix&#XA0;B&#XA0;&#XA0;Release Notes</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc100">Appendix&#XA0;C&#XA0;&#XA0;Acknowledgements</A>
+</LI><LI CLASS="li-toc"><A HREF="#htoc101">Appendix&#XA0;D&#XA0;&#XA0;Copyright Information</A>
 </LI></UL><!--TOC chapter Introduction-->
 <H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc1">Chapter&#XA0;1</A>&#XA0;&#XA0;Introduction</H1><!--SEC END --><P>
 <A NAME="intro"></A></P><P><TT>ejabberd</TT> is a free and open source instant messaging server written in <A HREF="http://www.erlang.org/">Erlang/OTP</A>.</P><P><TT>ejabberd</TT> is cross-platform, distributed, fault-tolerant, and based on open standards to achieve real-time communication.</P><P><TT>ejabberd</TT> is designed to be a rock-solid and feature rich XMPP server.</P><P><TT>ejabberd</TT> is suitable for small deployments, whether they need to be scalable or not, as well as extremely big deployments.</P><!--TOC section Key Features-->
@@ -1307,8 +1308,53 @@ of <A HREF="http://tools.ietf.org/html/rfc5389">RFC 5389</A> for details.</P><P>
 </P><PRE CLASS="verbatim">_stun._udp   IN SRV  0 0 3478 stun.example.com.
 _stun._tcp   IN SRV  0 0 3478 stun.example.com.
 _stuns._tcp  IN SRV  0 0 5349 stun.example.com.
+</PRE><!--TOC subsection S2S-proxy-->
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc31">3.1.10</A>&#XA0;&#XA0;S2S-proxy</H3><!--SEC END --><P>
+<A NAME="s2sproxy"></A>
+</P><P>It is possible to configure an ejabberd server to act as S2S-proxy server or as S2S-proxy client.</P><P>This feature will be illustrated with an example scenario
+with two ejabberd servers: <TT>server1.example.org</TT> and <TT>server2.example.org</TT>.
+Both servers allow client and server connections.
+Both servers can connect to each other using S2S.
+But only server1 is connected to Internet;
+while server2 can&#X2019;t connect to Internet because a firewall blocks him the port 5269.
+You want to allow users in server2 to connect to Jabber servers outside your LAN.</P><P>In this setup, server1 will act as a S2S-proxy server,
+and server2 as a S2S-proxy client.
+So, when a user in server2 wants to connect to a remote Jabber server in Internet,
+server2 will send all the traffic over server1, and this one to and from Internet.</P><P>Note that there isn&#X2019;t DNS address translation or JID rewrite.
+The DNS names of the proxy clients and proxy server must be resolvable.
+It will not work correctly if using local DNS names.
+The S2S connections of server2 will be proxied by server1,
+but the JID will remain intact.
+This means that server2 DNS name must point to server1
+so remote servers can reach the S2S-proxy server.</P><P>Configuration in ejabberd.cfg of server1:
+</P><PRE CLASS="verbatim">{hosts, ["server1.example.org"]}.
+
+{modules,
+ [
+  %% Enable the module and define the proxy clients
+  {mod_s2s_proxy, [{hosts, ["server2.example.org"]}]},
+  ...
+ ]
+}.
+</PRE><P>Configuration in ejabberd.cfg of server2:
+</P><PRE CLASS="verbatim">{hosts, ["server2.example.org"]}.
+
+%%
+%% Define local domains that are inside the LAN and don't require proxying
+%%
+{acl, local_domains, {server_glob, "*.example.org"}}.
+
+%%
+%% Don't relay internal s2s connections via the proxy server
+%%
+{access, via_proxy, [{deny, local_domains}, {allow, all}]}.
+
+%%
+%% s2s_hub: define the proxy server and Access rule
+%%
+{s2s_hub, [{host, "server1.example.org"}, {access, via_proxy}]}.
 </PRE><P> <A NAME="includeconfigfile"></A> </P><!--TOC subsection Include Additional Configuration Files-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc31">3.1.10</A>&#XA0;&#XA0;<A HREF="#includeconfigfile">Include Additional Configuration Files</A></H3><!--SEC END --><P> <A NAME="includeconfigfile"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc32">3.1.11</A>&#XA0;&#XA0;<A HREF="#includeconfigfile">Include Additional Configuration Files</A></H3><!--SEC END --><P> <A NAME="includeconfigfile"></A> 
 </P><P>The option <TT>include_config_file</TT> in a configuration file instructs <TT>ejabberd</TT> to include other configuration files immediately.</P><P>The basic syntax is:
 </P><DL CLASS="description"><DT CLASS="dt-description"><B><TT>{include_config_file, Filename}.</TT></B></DT></DL><P>
 It is possible to specify suboptions using the full syntax:
@@ -1338,7 +1384,7 @@ and later includes another file with additional rules:
 </P><PRE CLASS="verbatim">{acl, admin, {user, "bob", "localhost"}}.
 {acl, admin, {user, "jan", "localhost"}}.
 </PRE><P> <A NAME="optionmacros"></A> </P><!--TOC subsection Option Macros in Configuration File-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc32">3.1.11</A>&#XA0;&#XA0;<A HREF="#optionmacros">Option Macros in Configuration File</A></H3><!--SEC END --><P> <A NAME="optionmacros"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc33">3.1.12</A>&#XA0;&#XA0;<A HREF="#optionmacros">Option Macros in Configuration File</A></H3><!--SEC END --><P> <A NAME="optionmacros"></A> 
 </P><P>In the <TT>ejabberd</TT> configuration file,
 it is possible to define a macro for a value
 and later use this macro when defining an option.</P><P>A macro is defined with this syntax:
@@ -1387,7 +1433,7 @@ This usage behaves as if it were defined and used this way:
  ]
 }.
 </PRE><P> <A NAME="database"></A> </P><!--TOC section Database and LDAP Configuration-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc33">3.2</A>&#XA0;&#XA0;<A HREF="#database">Database and LDAP Configuration</A></H2><!--SEC END --><P> <A NAME="database"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc34">3.2</A>&#XA0;&#XA0;<A HREF="#database">Database and LDAP Configuration</A></H2><!--SEC END --><P> <A NAME="database"></A> 
 
 </P><P><TT>ejabberd</TT> uses its internal Mnesia database by default. However, it is
 possible to use a relational database or an LDAP server to store persistent,
@@ -1420,7 +1466,7 @@ For example:
   {auth_method, [odbc]}
 ]}.
 </PRE><P> <A NAME="mysql"></A> </P><!--TOC subsection MySQL-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc34">3.2.1</A>&#XA0;&#XA0;<A HREF="#mysql">MySQL</A></H3><!--SEC END --><P> <A NAME="mysql"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc35">3.2.1</A>&#XA0;&#XA0;<A HREF="#mysql">MySQL</A></H3><!--SEC END --><P> <A NAME="mysql"></A> 
 </P><P>Although this section will describe <TT>ejabberd</TT>&#X2019;s configuration when you want to
 use the native MySQL driver, it does not describe MySQL&#X2019;s installation and
 database creation. Check the MySQL documentation and the tutorial <A HREF="http://support.process-one.net/doc/display/MESSENGER/Using+ejabberd+with+MySQL+native+driver">Using ejabberd with MySQL native driver</A> for information regarding these topics.
@@ -1477,7 +1523,7 @@ relational databases like MySQL. To enable storage to your database, just make
 sure that your database is running well (see previous sections), and replace the
 suffix-less or ldap module variant with the odbc module variant. Keep in mind
 that you cannot have several variants of the same module loaded!</P><P> <A NAME="mssql"></A> </P><!--TOC subsection Microsoft SQL Server-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc35">3.2.2</A>&#XA0;&#XA0;<A HREF="#mssql">Microsoft SQL Server</A></H3><!--SEC END --><P> <A NAME="mssql"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc36">3.2.2</A>&#XA0;&#XA0;<A HREF="#mssql">Microsoft SQL Server</A></H3><!--SEC END --><P> <A NAME="mssql"></A> 
 </P><P>Although this section will describe <TT>ejabberd</TT>&#X2019;s configuration when you want to
 use Microsoft SQL Server, it does not describe Microsoft SQL Server&#X2019;s
 installation and database creation. Check the MySQL documentation and the
@@ -1515,7 +1561,7 @@ database, just make sure that your database is running well (see previous
 sections), and replace the suffix-less or ldap module variant with the odbc
 module variant. Keep in mind that you cannot have several variants of the same
 module loaded!</P><P> <A NAME="pgsql"></A> </P><!--TOC subsection PostgreSQL-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc36">3.2.3</A>&#XA0;&#XA0;<A HREF="#pgsql">PostgreSQL</A></H3><!--SEC END --><P> <A NAME="pgsql"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc37">3.2.3</A>&#XA0;&#XA0;<A HREF="#pgsql">PostgreSQL</A></H3><!--SEC END --><P> <A NAME="pgsql"></A> 
 </P><P>Although this section will describe <TT>ejabberd</TT>&#X2019;s configuration when you want to
 use the native PostgreSQL driver, it does not describe PostgreSQL&#X2019;s installation
 and database creation. Check the PostgreSQL documentation and the tutorial <A HREF="http://support.process-one.net/doc/display/MESSENGER/Using+ejabberd+with+MySQL+native+driver">Using ejabberd with MySQL native driver</A> for information regarding these topics.
@@ -1572,7 +1618,7 @@ relational databases like PostgreSQL. To enable storage to your database, just
 make sure that your database is running well (see previous sections), and
 replace the suffix-less or ldap module variant with the odbc module variant.
 Keep in mind that you cannot have several variants of the same module loaded!</P><P> <A NAME="odbc"></A> </P><!--TOC subsection ODBC Compatible-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc37">3.2.4</A>&#XA0;&#XA0;<A HREF="#odbc">ODBC Compatible</A></H3><!--SEC END --><P> <A NAME="odbc"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc38">3.2.4</A>&#XA0;&#XA0;<A HREF="#odbc">ODBC Compatible</A></H3><!--SEC END --><P> <A NAME="odbc"></A> 
 </P><P>Although this section will describe <TT>ejabberd</TT>&#X2019;s configuration when you want to
 use the ODBC driver, it does not describe the installation and database creation
 of your database. Check the documentation of your database. The tutorial <A HREF="http://support.process-one.net/doc/display/MESSENGER/Using+ejabberd+with+MySQL+native+driver">Using ejabberd with MySQL native driver</A> also can help you. Note that the tutorial
@@ -1617,7 +1663,7 @@ database, just make sure that your database is running well (see previous
 sections), and replace the suffix-less or ldap module variant with the odbc
 module variant. Keep in mind that you cannot have several variants of the same
 module loaded!</P><P> <A NAME="ldap"></A> </P><!--TOC subsection LDAP-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc38">3.2.5</A>&#XA0;&#XA0;<A HREF="#ldap">LDAP</A></H3><!--SEC END --><P> <A NAME="ldap"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc39">3.2.5</A>&#XA0;&#XA0;<A HREF="#ldap">LDAP</A></H3><!--SEC END --><P> <A NAME="ldap"></A> 
 </P><P><TT>ejabberd</TT> has built-in LDAP support. You can authenticate users against LDAP
 server and use LDAP directory as vCard storage. Shared rosters are not supported
 yet.</P><P>Note that <TT>ejabberd</TT> treats LDAP as a read-only storage:
@@ -1803,7 +1849,7 @@ configuration is shown below:</P><PRE CLASS="verbatim">{auth_method, ldap}.
   ...
  ]}.
 </PRE><P> <A NAME="modules"></A> </P><!--TOC section Modules Configuration-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc39">3.3</A>&#XA0;&#XA0;<A HREF="#modules">Modules Configuration</A></H2><!--SEC END --><P> <A NAME="modules"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc40">3.3</A>&#XA0;&#XA0;<A HREF="#modules">Modules Configuration</A></H2><!--SEC END --><P> <A NAME="modules"></A> 
 </P><P>The option <TT>modules</TT> defines the list of modules that will be loaded after
 <TT>ejabberd</TT>&#X2019;s startup. Each entry in the list is a tuple in which the first
 element is the name of a module and the second is a list of options for that
@@ -1826,7 +1872,7 @@ all entries end with a comma:
   {mod_version,   []}
  ]}.
 </PRE></LI></UL><P> <A NAME="modoverview"></A> </P><!--TOC subsection Modules Overview-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc40">3.3.1</A>&#XA0;&#XA0;<A HREF="#modoverview">Modules Overview</A></H3><!--SEC END --><P> <A NAME="modoverview"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc41">3.3.1</A>&#XA0;&#XA0;<A HREF="#modoverview">Modules Overview</A></H3><!--SEC END --><P> <A NAME="modoverview"></A> 
 </P><P>The following table lists all modules included in <TT>ejabberd</TT>.</P><BLOCKQUOTE CLASS="table"><DIV CLASS="center"><DIV CLASS="center"><HR WIDTH="80%" SIZE=2></DIV>
 <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=1><TR><TD ALIGN=left NOWRAP><B>Module</B></TD><TD ALIGN=left NOWRAP><B>Feature</B></TD><TD ALIGN=left NOWRAP><B>Dependencies</B></TD></TR>
 <TR><TD ALIGN=left NOWRAP><TT>mod_adhoc</TT></TD><TD ALIGN=left NOWRAP>Ad-Hoc Commands (<A HREF="http://xmpp.org/extensions/xep-0050.html">XEP-0050</A>)</TD><TD ALIGN=left NOWRAP>&nbsp;</TD></TR>
@@ -1890,7 +1936,7 @@ Last connection date and time: Use <TT>mod_last_odbc</TT> instead of
 <TT>ejabberd</TT> website. Please remember that these contributions might not work or
 that they can contain severe bugs and security leaks. Therefore, use them at
 your own risk!</P><P> <A NAME="modcommonoptions"></A> </P><!--TOC subsection Common Options-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc41">3.3.2</A>&#XA0;&#XA0;<A HREF="#modcommonoptions">Common Options</A></H3><!--SEC END --><P> <A NAME="modcommonoptions"></A> </P><P>The following options are used by many modules. Therefore, they are described in
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc42">3.3.2</A>&#XA0;&#XA0;<A HREF="#modcommonoptions">Common Options</A></H3><!--SEC END --><P> <A NAME="modcommonoptions"></A> </P><P>The following options are used by many modules. Therefore, they are described in
 this separate section.</P><P> <A NAME="modiqdiscoption"></A> </P><!--TOC subsubsection <TT>iqdisc</TT>-->
 <H4 CLASS="subsubsection"><!--SEC ANCHOR --><A HREF="#modiqdiscoption"><TT>iqdisc</TT></A></H4><!--SEC END --><P> <A NAME="modiqdiscoption"></A> 
 </P><P>Many modules define handlers for processing IQ queries of different namespaces
@@ -1944,7 +1990,7 @@ the "@HOST@" keyword must be used:
   ...
  ]}.
 </PRE><P> <A NAME="modannounce"></A> </P><!--TOC subsection <TT>mod_announce</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc42">3.3.3</A>&#XA0;&#XA0;<A HREF="#modannounce"><TT>mod_announce</TT></A></H3><!--SEC END --><P> <A NAME="modannounce"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc43">3.3.3</A>&#XA0;&#XA0;<A HREF="#modannounce"><TT>mod_announce</TT></A></H3><!--SEC END --><P> <A NAME="modannounce"></A> 
 </P><P>This module enables configured users to broadcast announcements and to set
 the message of the day (MOTD).
 Configured users can perform these actions with a
@@ -2008,7 +2054,7 @@ Only administrators can send announcements:
 </PRE></LI></UL><P>Note that <TT>mod_announce</TT> can be resource intensive on large
 deployments as it can broadcast lot of messages. This module should be
 disabled for instances of <TT>ejabberd</TT> with hundreds of thousands users.</P><P> <A NAME="moddisco"></A> </P><!--TOC subsection <TT>mod_disco</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc43">3.3.4</A>&#XA0;&#XA0;<A HREF="#moddisco"><TT>mod_disco</TT></A></H3><!--SEC END --><P> <A NAME="moddisco"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc44">3.3.4</A>&#XA0;&#XA0;<A HREF="#moddisco"><TT>mod_disco</TT></A></H3><!--SEC END --><P> <A NAME="moddisco"></A> 
 
 
 
@@ -2082,7 +2128,7 @@ and admin addresses for both the main server and the vJUD service:
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modecho"></A> </P><!--TOC subsection <TT>mod_echo</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc44">3.3.5</A>&#XA0;&#XA0;<A HREF="#modecho"><TT>mod_echo</TT></A></H3><!--SEC END --><P> <A NAME="modecho"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc45">3.3.5</A>&#XA0;&#XA0;<A HREF="#modecho"><TT>mod_echo</TT></A></H3><!--SEC END --><P> <A NAME="modecho"></A> 
 </P><P>This module simply echoes any XMPP
 packet back to the sender. This mirror can be of interest for
 <TT>ejabberd</TT> and XMPP client debugging.</P><P>Options:
@@ -2102,7 +2148,7 @@ of them all?
   ...
  ]}.
 </PRE><P> <A NAME="modhttpbind"></A> </P><!--TOC subsection <TT>mod_http_bind</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc45">3.3.6</A>&#XA0;&#XA0;<A HREF="#modhttpbind"><TT>mod_http_bind</TT></A></H3><!--SEC END --><P> <A NAME="modhttpbind"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc46">3.3.6</A>&#XA0;&#XA0;<A HREF="#modhttpbind"><TT>mod_http_bind</TT></A></H3><!--SEC END --><P> <A NAME="modhttpbind"></A> 
 </P><P>This module implements XMPP over Bosh (formerly known as HTTP Binding)
 as defined in <A HREF="http://xmpp.org/extensions/xep-0124.html">XEP-0124</A> and <A HREF="http://xmpp.org/extensions/xep-0206.html">XEP-0206</A>.
 It extends ejabberd&#X2019;s built in HTTP service with a configurable
@@ -2155,7 +2201,7 @@ For example, to set 50 seconds:
   ...
 ]}.
 </PRE></DD></DL><P> <A NAME="modhttpfileserver"></A> </P><!--TOC subsection <TT>mod_http_fileserver</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc46">3.3.7</A>&#XA0;&#XA0;<A HREF="#modhttpfileserver"><TT>mod_http_fileserver</TT></A></H3><!--SEC END --><P> <A NAME="modhttpfileserver"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc47">3.3.7</A>&#XA0;&#XA0;<A HREF="#modhttpfileserver"><TT>mod_http_fileserver</TT></A></H3><!--SEC END --><P> <A NAME="modhttpfileserver"></A> 
 </P><P>This simple module serves files from the local disk over HTTP.</P><P>Options:
 </P><DL CLASS="description"><DT CLASS="dt-description">
 <B><TT>{docroot, Path}</TT></B></DT><DD CLASS="dd-description"> 
@@ -2222,7 +2268,7 @@ To use this module you must enable it:
   ...
 ]}.
 </PRE><P> <A NAME="modirc"></A> </P><!--TOC subsection <TT>mod_irc</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc47">3.3.8</A>&#XA0;&#XA0;<A HREF="#modirc"><TT>mod_irc</TT></A></H3><!--SEC END --><P> <A NAME="modirc"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc48">3.3.8</A>&#XA0;&#XA0;<A HREF="#modirc"><TT>mod_irc</TT></A></H3><!--SEC END --><P> <A NAME="modirc"></A> 
 </P><P>This module is an IRC transport that can be used to join channels on IRC
 servers.</P><P>End user information:
 
@@ -2283,7 +2329,7 @@ of <TT>example.org</TT>, and any user of <TT>example.com</TT>:
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modlast"></A> </P><!--TOC subsection <TT>mod_last</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc48">3.3.9</A>&#XA0;&#XA0;<A HREF="#modlast"><TT>mod_last</TT></A></H3><!--SEC END --><P> <A NAME="modlast"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc49">3.3.9</A>&#XA0;&#XA0;<A HREF="#modlast"><TT>mod_last</TT></A></H3><!--SEC END --><P> <A NAME="modlast"></A> 
 </P><P>This module adds support for Last Activity (<A HREF="http://xmpp.org/extensions/xep-0012.html">XEP-0012</A>). It can be used to
 discover when a disconnected user last accessed the server, to know when a
 connected user was last active on the server, or to query the uptime of the
@@ -2292,7 +2338,7 @@ connected user was last active on the server, or to query the uptime of the
 <B><TT>{iqdisc, Discipline}</TT></B></DT><DD CLASS="dd-description"> This specifies
 the processing discipline for Last activity (<TT>jabber:iq:last</TT>) IQ queries (see section&#XA0;<A HREF="#modiqdiscoption">3.3.2</A>).
 </DD></DL><P> <A NAME="modmuc"></A> </P><!--TOC subsection <TT>mod_muc</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc49">3.3.10</A>&#XA0;&#XA0;<A HREF="#modmuc"><TT>mod_muc</TT></A></H3><!--SEC END --><P> <A NAME="modmuc"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc50">3.3.10</A>&#XA0;&#XA0;<A HREF="#modmuc"><TT>mod_muc</TT></A></H3><!--SEC END --><P> <A NAME="modmuc"></A> 
 </P><P>This module provides a Multi-User Chat (<A HREF="http://xmpp.org/extensions/xep-0045.html">XEP-0045</A>) service.
 Users can discover existing rooms, join or create them.
 Occupants of a room can chat in public or have private chats.</P><P>Some of the features of Multi-User Chat:
@@ -2515,7 +2561,7 @@ the newly created rooms have by default those options.
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modmuclog"></A> </P><!--TOC subsection <TT>mod_muc_log</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc50">3.3.11</A>&#XA0;&#XA0;<A HREF="#modmuclog"><TT>mod_muc_log</TT></A></H3><!--SEC END --><P> <A NAME="modmuclog"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc51">3.3.11</A>&#XA0;&#XA0;<A HREF="#modmuclog"><TT>mod_muc_log</TT></A></H3><!--SEC END --><P> <A NAME="modmuclog"></A> 
 </P><P>This module enables optional logging of Multi-User Chat (MUC) public conversations to
 HTML. Once you enable this module, users can join a room using a MUC capable
 XMPP client, and if they have enough privileges, they can request the
@@ -2634,7 +2680,7 @@ top link will be the default <CODE>&lt;a href="/"&gt;Home&lt;/a&gt;</CODE>.
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modoffline"></A> </P><!--TOC subsection <TT>mod_offline</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc51">3.3.12</A>&#XA0;&#XA0;<A HREF="#modoffline"><TT>mod_offline</TT></A></H3><!--SEC END --><P> <A NAME="modoffline"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc52">3.3.12</A>&#XA0;&#XA0;<A HREF="#modoffline"><TT>mod_offline</TT></A></H3><!--SEC END --><P> <A NAME="modoffline"></A> 
 </P><P>This module implements offline message storage (<A HREF="http://xmpp.org/extensions/xep-0160.html">XEP-0160</A>).
 This means that all messages
 sent to an offline user will be stored on the server until that user comes
@@ -2666,7 +2712,7 @@ and all the other users up to 100.
   ...
  ]}.
 </PRE><P> <A NAME="modping"></A> </P><!--TOC subsection <TT>mod_ping</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc52">3.3.13</A>&#XA0;&#XA0;<A HREF="#modping"><TT>mod_ping</TT></A></H3><!--SEC END --><P> <A NAME="modping"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc53">3.3.13</A>&#XA0;&#XA0;<A HREF="#modping"><TT>mod_ping</TT></A></H3><!--SEC END --><P> <A NAME="modping"></A> 
 </P><P>This module implements support for XMPP Ping (<A HREF="http://xmpp.org/extensions/xep-0199.html">XEP-0199</A>) and periodic keepalives.
 When this module is enabled ejabberd responds correctly to
 ping requests, as defined in the protocol.</P><P>Configuration options:
@@ -2694,7 +2740,7 @@ and if a client does not answer to the ping in less than 32 seconds, its connect
   ...
  ]}.
 </PRE><P> <A NAME="modprivacy"></A> </P><!--TOC subsection <TT>mod_privacy</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc53">3.3.14</A>&#XA0;&#XA0;<A HREF="#modprivacy"><TT>mod_privacy</TT></A></H3><!--SEC END --><P> <A NAME="modprivacy"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc54">3.3.14</A>&#XA0;&#XA0;<A HREF="#modprivacy"><TT>mod_privacy</TT></A></H3><!--SEC END --><P> <A NAME="modprivacy"></A> 
 </P><P>This module implements Blocking Communication (also known as Privacy Rules)
 as defined in section 10 from XMPP IM. If end users have support for it in
 their XMPP client, they will be able to:
@@ -2722,7 +2768,7 @@ subscription type (or globally).
 <B><TT>{iqdisc, Discipline}</TT></B></DT><DD CLASS="dd-description"> This specifies
 the processing discipline for Blocking Communication (<TT>jabber:iq:privacy</TT>) IQ queries (see section&#XA0;<A HREF="#modiqdiscoption">3.3.2</A>).
 </DD></DL><P> <A NAME="modprivate"></A> </P><!--TOC subsection <TT>mod_private</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc54">3.3.15</A>&#XA0;&#XA0;<A HREF="#modprivate"><TT>mod_private</TT></A></H3><!--SEC END --><P> <A NAME="modprivate"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc55">3.3.15</A>&#XA0;&#XA0;<A HREF="#modprivate"><TT>mod_private</TT></A></H3><!--SEC END --><P> <A NAME="modprivate"></A> 
 </P><P>This module adds support for Private XML Storage (<A HREF="http://xmpp.org/extensions/xep-0049.html">XEP-0049</A>):
 </P><BLOCKQUOTE CLASS="quote">
 Using this method, XMPP entities can store private data on the server and
@@ -2734,7 +2780,7 @@ of client-specific preferences; another is Bookmark Storage (<A HREF="http://xmp
 <B><TT>{iqdisc, Discipline}</TT></B></DT><DD CLASS="dd-description"> This specifies
 the processing discipline for Private XML Storage (<TT>jabber:iq:private</TT>) IQ queries (see section&#XA0;<A HREF="#modiqdiscoption">3.3.2</A>).
 </DD></DL><P> <A NAME="modproxy"></A> </P><!--TOC subsection <TT>mod_proxy65</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc55">3.3.16</A>&#XA0;&#XA0;<A HREF="#modproxy"><TT>mod_proxy65</TT></A></H3><!--SEC END --><P> <A NAME="modproxy"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc56">3.3.16</A>&#XA0;&#XA0;<A HREF="#modproxy"><TT>mod_proxy65</TT></A></H3><!--SEC END --><P> <A NAME="modproxy"></A> 
 </P><P>This module implements SOCKS5 Bytestreams (<A HREF="http://xmpp.org/extensions/xep-0065.html">XEP-0065</A>).
 It allows <TT>ejabberd</TT> to act as a file transfer proxy between two
 XMPP clients.</P><P>Options:
@@ -2792,7 +2838,7 @@ The simpliest configuration of the module:
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modpubsub"></A> </P><!--TOC subsection <TT>mod_pubsub</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc56">3.3.17</A>&#XA0;&#XA0;<A HREF="#modpubsub"><TT>mod_pubsub</TT></A></H3><!--SEC END --><P> <A NAME="modpubsub"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc57">3.3.17</A>&#XA0;&#XA0;<A HREF="#modpubsub"><TT>mod_pubsub</TT></A></H3><!--SEC END --><P> <A NAME="modpubsub"></A> 
 </P><P>This module offers a Publish-Subscribe Service (<A HREF="http://xmpp.org/extensions/xep-0060.html">XEP-0060</A>).
 The functionality in <TT>mod_pubsub</TT> can be extended using plugins.
 The plugin that implements PEP (Personal Eventing via Pubsub) (<A HREF="http://xmpp.org/extensions/xep-0163.html">XEP-0163</A>)
@@ -2870,7 +2916,7 @@ with ODBC usage:
   ...
  ]}.
 </PRE><P> <A NAME="modregister"></A> </P><!--TOC subsection <TT>mod_register</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc57">3.3.18</A>&#XA0;&#XA0;<A HREF="#modregister"><TT>mod_register</TT></A></H3><!--SEC END --><P> <A NAME="modregister"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc58">3.3.18</A>&#XA0;&#XA0;<A HREF="#modregister"><TT>mod_register</TT></A></H3><!--SEC END --><P> <A NAME="modregister"></A> 
 </P><P>This module adds support for In-Band Registration (<A HREF="http://xmpp.org/extensions/xep-0077.html">XEP-0077</A>). This protocol
 enables end users to use a XMPP client to:
 </P><UL CLASS="itemize"><LI CLASS="li-itemize">
@@ -2949,7 +2995,7 @@ Also define a registration timeout of one hour:
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modroster"></A> </P><!--TOC subsection <TT>mod_roster</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc58">3.3.19</A>&#XA0;&#XA0;<A HREF="#modroster"><TT>mod_roster</TT></A></H3><!--SEC END --><P> <A NAME="modroster"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc59">3.3.19</A>&#XA0;&#XA0;<A HREF="#modroster"><TT>mod_roster</TT></A></H3><!--SEC END --><P> <A NAME="modroster"></A> 
 </P><P>This module implements roster management as defined in
 <A HREF="http://xmpp.org/rfcs/rfc3921.html#roster">RFC 3921: XMPP IM</A>.
 It also supports Roster Versioning (<A HREF="http://xmpp.org/extensions/xep-0237.html">XEP-0237</A>).</P><P>Options:
@@ -2975,7 +3021,7 @@ Important: if you use <TT>mod_shared_roster</TT>, you must disable this option.
   ...
  ]}.
 </PRE><P> <A NAME="modservicelog"></A> </P><!--TOC subsection <TT>mod_service_log</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc59">3.3.20</A>&#XA0;&#XA0;<A HREF="#modservicelog"><TT>mod_service_log</TT></A></H3><!--SEC END --><P> <A NAME="modservicelog"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc60">3.3.20</A>&#XA0;&#XA0;<A HREF="#modservicelog"><TT>mod_service_log</TT></A></H3><!--SEC END --><P> <A NAME="modservicelog"></A> 
 </P><P>This module adds support for logging end user packets via a XMPP message
 auditing service such as
 <A HREF="http://www.funkypenguin.info/project/bandersnatch/">Bandersnatch</A>. All user
@@ -3005,7 +3051,7 @@ To log all end user packets to the Bandersnatch service running on
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modsharedroster"></A> </P><!--TOC subsection <TT>mod_shared_roster</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc60">3.3.21</A>&#XA0;&#XA0;<A HREF="#modsharedroster"><TT>mod_shared_roster</TT></A></H3><!--SEC END --><P> <A NAME="modsharedroster"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc61">3.3.21</A>&#XA0;&#XA0;<A HREF="#modsharedroster"><TT>mod_shared_roster</TT></A></H3><!--SEC END --><P> <A NAME="modsharedroster"></A> 
 </P><P>This module enables you to create shared roster groups. This means that you can
 create groups of people that can see members from (other) groups in their
 rosters. The big advantages of this feature are that end users do not need to
@@ -3080,7 +3126,7 @@ roster groups as shown in the following table:
 </TABLE>
 <DIV CLASS="center"><HR WIDTH="80%" SIZE=2></DIV></DIV></BLOCKQUOTE>
 </LI></UL><P> <A NAME="modstats"></A> </P><!--TOC subsection <TT>mod_stats</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc61">3.3.22</A>&#XA0;&#XA0;<A HREF="#modstats"><TT>mod_stats</TT></A></H3><!--SEC END --><P> <A NAME="modstats"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc62">3.3.22</A>&#XA0;&#XA0;<A HREF="#modstats"><TT>mod_stats</TT></A></H3><!--SEC END --><P> <A NAME="modstats"></A> 
 </P><P>This module adds support for Statistics Gathering (<A HREF="http://xmpp.org/extensions/xep-0039.html">XEP-0039</A>). This protocol
 allows you to retrieve next statistics from your <TT>ejabberd</TT> deployment:
 </P><UL CLASS="itemize"><LI CLASS="li-itemize">
@@ -3112,14 +3158,14 @@ by sending:
   &lt;/query&gt;
 &lt;/iq&gt;
 </PRE></LI></UL><P> <A NAME="modtime"></A> </P><!--TOC subsection <TT>mod_time</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc62">3.3.23</A>&#XA0;&#XA0;<A HREF="#modtime"><TT>mod_time</TT></A></H3><!--SEC END --><P> <A NAME="modtime"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc63">3.3.23</A>&#XA0;&#XA0;<A HREF="#modtime"><TT>mod_time</TT></A></H3><!--SEC END --><P> <A NAME="modtime"></A> 
 </P><P>This module features support for Entity Time (<A HREF="http://xmpp.org/extensions/xep-0202.html">XEP-0202</A>). By using this XEP,
 you are able to discover the time at another entity&#X2019;s location.</P><P>Options:
 </P><DL CLASS="description"><DT CLASS="dt-description">
 <B><TT>{iqdisc, Discipline}</TT></B></DT><DD CLASS="dd-description"> This specifies
 the processing discipline for Entity Time (<TT>jabber:iq:time</TT>) IQ queries (see section&#XA0;<A HREF="#modiqdiscoption">3.3.2</A>).
 </DD></DL><P> <A NAME="modvcard"></A> </P><!--TOC subsection <TT>mod_vcard</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc63">3.3.24</A>&#XA0;&#XA0;<A HREF="#modvcard"><TT>mod_vcard</TT></A></H3><!--SEC END --><P> <A NAME="modvcard"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc64">3.3.24</A>&#XA0;&#XA0;<A HREF="#modvcard"><TT>mod_vcard</TT></A></H3><!--SEC END --><P> <A NAME="modvcard"></A> 
 </P><P>This module allows end users to store and retrieve their vCard, and to retrieve
 other users vCards, as defined in vcard-temp (<A HREF="http://xmpp.org/extensions/xep-0054.html">XEP-0054</A>). The module also
 implements an uncomplicated Jabber User Directory based on the vCards of
@@ -3174,7 +3220,7 @@ and that all virtual hosts will be searched instead of only the current one:
   ...
  ]}.
 </PRE></LI></UL><P> <A NAME="modvcardldap"></A> </P><!--TOC subsection <TT>mod_vcard_ldap</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc64">3.3.25</A>&#XA0;&#XA0;<A HREF="#modvcardldap"><TT>mod_vcard_ldap</TT></A></H3><!--SEC END --><P> <A NAME="modvcardldap"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc65">3.3.25</A>&#XA0;&#XA0;<A HREF="#modvcardldap"><TT>mod_vcard_ldap</TT></A></H3><!--SEC END --><P> <A NAME="modvcardldap"></A> 
 </P><P><TT>ejabberd</TT> can map LDAP attributes to vCard fields. This behaviour is
 implemented in the <TT>mod_vcard_ldap</TT> module. This module does not depend on the
 authentication method (see&#XA0;<A HREF="#ldapauth">3.2.5</A>).</P><P>Note that <TT>ejabberd</TT> treats LDAP as a read-only storage:
@@ -3353,7 +3399,7 @@ searching his info in LDAP.</P></LI><LI CLASS="li-itemize"><TT>ldap_vcard_map</T
   {"Nickname", "NICKNAME"}
  ]},
 </PRE></LI></UL><P> <A NAME="modversion"></A> </P><!--TOC subsection <TT>mod_version</TT>-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc65">3.3.26</A>&#XA0;&#XA0;<A HREF="#modversion"><TT>mod_version</TT></A></H3><!--SEC END --><P> <A NAME="modversion"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc66">3.3.26</A>&#XA0;&#XA0;<A HREF="#modversion"><TT>mod_version</TT></A></H3><!--SEC END --><P> <A NAME="modversion"></A> 
 </P><P>This module implements Software Version (<A HREF="http://xmpp.org/extensions/xep-0092.html">XEP-0092</A>). Consequently, it
 answers <TT>ejabberd</TT>&#X2019;s version when queried.</P><P>Options:
 </P><DL CLASS="description"><DT CLASS="dt-description">
@@ -3362,8 +3408,8 @@ The default value is <TT>true</TT>.
 </DD><DT CLASS="dt-description"><B><TT>{iqdisc, Discipline}</TT></B></DT><DD CLASS="dd-description"> This specifies
 the processing discipline for Software Version (<TT>jabber:iq:version</TT>) IQ queries (see section&#XA0;<A HREF="#modiqdiscoption">3.3.2</A>).
 </DD></DL><P> <A NAME="manage"></A> </P><!--TOC chapter Managing an <TT>ejabberd</TT> Server-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc66">Chapter&#XA0;4</A>&#XA0;&#XA0;<A HREF="#manage">Managing an <TT>ejabberd</TT> Server</A></H1><!--SEC END --><P> <A NAME="manage"></A> </P><P> <A NAME="ejabberdctl"></A> </P><!--TOC section <TT>ejabberdctl</TT>-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc67">4.1</A>&#XA0;&#XA0;<A HREF="#ejabberdctl"><TT>ejabberdctl</TT></A></H2><!--SEC END --><P> <A NAME="ejabberdctl"></A> </P><P>With the <TT>ejabberdctl</TT> command line administration script 
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc67">Chapter&#XA0;4</A>&#XA0;&#XA0;<A HREF="#manage">Managing an <TT>ejabberd</TT> Server</A></H1><!--SEC END --><P> <A NAME="manage"></A> </P><P> <A NAME="ejabberdctl"></A> </P><!--TOC section <TT>ejabberdctl</TT>-->
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc68">4.1</A>&#XA0;&#XA0;<A HREF="#ejabberdctl"><TT>ejabberdctl</TT></A></H2><!--SEC END --><P> <A NAME="ejabberdctl"></A> </P><P>With the <TT>ejabberdctl</TT> command line administration script 
 you can execute <TT>ejabberdctl commands</TT> (described in the next section, <A HREF="#ectl-commands">4.1.1</A>)
 and also many general <TT>ejabberd commands</TT> (described in section <A HREF="#eja-commands">4.2</A>).
 This means you can start, stop and perform many other administrative tasks
@@ -3375,7 +3421,7 @@ and other codes may be used for specific results.
 This can be used by other scripts to determine automatically
 if a command succeeded or failed,
 for example using: <TT>echo $?</TT></P><P> <A NAME="ectl-commands"></A> </P><!--TOC subsection ejabberdctl Commands-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc68">4.1.1</A>&#XA0;&#XA0;<A HREF="#ectl-commands">ejabberdctl Commands</A></H3><!--SEC END --><P> <A NAME="ectl-commands"></A> </P><P>When <TT>ejabberdctl</TT> is executed without any parameter,
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc69">4.1.1</A>&#XA0;&#XA0;<A HREF="#ectl-commands">ejabberdctl Commands</A></H3><!--SEC END --><P> <A NAME="ectl-commands"></A> </P><P>When <TT>ejabberdctl</TT> is executed without any parameter,
 it displays the available options. If there isn&#X2019;t an <TT>ejabberd</TT> server running,
 the available parameters are:
 </P><DL CLASS="description"><DT CLASS="dt-description">
@@ -3411,7 +3457,7 @@ robot1
 testuser1
 testuser2
 </PRE><P> <A NAME="erlangconfiguration"></A> </P><!--TOC subsection Erlang Runtime System-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc69">4.1.2</A>&#XA0;&#XA0;<A HREF="#erlangconfiguration">Erlang Runtime System</A></H3><!--SEC END --><P> <A NAME="erlangconfiguration"></A> </P><P><TT>ejabberd</TT> is an Erlang/OTP application that runs inside an Erlang runtime system.
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc70">4.1.2</A>&#XA0;&#XA0;<A HREF="#erlangconfiguration">Erlang Runtime System</A></H3><!--SEC END --><P> <A NAME="erlangconfiguration"></A> </P><P><TT>ejabberd</TT> is an Erlang/OTP application that runs inside an Erlang runtime system.
 This system is configured using environment variables and command line parameters.
 The <TT>ejabberdctl</TT> administration script uses many of those possibilities.
 You can configure some of them with the file <TT>ejabberdctl.cfg</TT>,
@@ -3488,7 +3534,7 @@ not &#X201C;Simple Authentication and Security Layer&#X201D;.
 </DD></DL><P>
 Note that some characters need to be escaped when used in shell scripts, for instance <CODE>"</CODE> and <CODE>{}</CODE>.
 You can find other options in the Erlang manual page (<TT>erl -man erl</TT>).</P><P> <A NAME="eja-commands"></A> </P><!--TOC section <TT>ejabberd</TT> Commands-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc70">4.2</A>&#XA0;&#XA0;<A HREF="#eja-commands"><TT>ejabberd</TT> Commands</A></H2><!--SEC END --><P> <A NAME="eja-commands"></A> </P><P>An <TT>ejabberd command</TT> is an abstract function identified by a name,
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc71">4.2</A>&#XA0;&#XA0;<A HREF="#eja-commands"><TT>ejabberd</TT> Commands</A></H2><!--SEC END --><P> <A NAME="eja-commands"></A> </P><P>An <TT>ejabberd command</TT> is an abstract function identified by a name,
 with a defined number and type of calling arguments and type of result
 that is registered in the <TT>ejabberd_commands</TT> service.
 Those commands can be defined in any Erlang module and executed using any valid frontend.</P><P><TT>ejabberd</TT> includes a frontend to execute <TT>ejabberd commands</TT>: the script <TT>ejabberdctl</TT>.
@@ -3496,7 +3542,7 @@ Other known frontends that can be installed to execute ejabberd commands in diff
 <TT>ejabberd_xmlrpc</TT> (XML-RPC service),
 <TT>mod_rest</TT> (HTTP POST service),
 <TT>mod_shcommands</TT> (ejabberd WebAdmin page).</P><P> <A NAME="list-eja-commands"></A> </P><!--TOC subsection List of ejabberd Commands-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc71">4.2.1</A>&#XA0;&#XA0;<A HREF="#list-eja-commands">List of ejabberd Commands</A></H3><!--SEC END --><P> <A NAME="list-eja-commands"></A> </P><P><TT>ejabberd</TT> includes a few ejabberd Commands by default.
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc72">4.2.1</A>&#XA0;&#XA0;<A HREF="#list-eja-commands">List of ejabberd Commands</A></H3><!--SEC END --><P> <A NAME="list-eja-commands"></A> </P><P><TT>ejabberd</TT> includes a few ejabberd Commands by default.
 When more modules are installed, new commands may be available in the frontends.</P><P>The easiest way to get a list of the available commands, and get help for them is to use
 the ejabberdctl script:
 </P><PRE CLASS="verbatim">$ ejabberdctl help
@@ -3548,7 +3594,7 @@ is very high.
 </DD><DT CLASS="dt-description"><B><TT>register user host password</TT></B></DT><DD CLASS="dd-description"> Register an account in that domain with the given password.
 </DD><DT CLASS="dt-description"><B><TT>unregister user host</TT></B></DT><DD CLASS="dd-description"> Unregister the given account.
 </DD></DL><P> <A NAME="accesscommands"></A> </P><!--TOC subsection Restrict Execution with AccessCommands-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc72">4.2.2</A>&#XA0;&#XA0;<A HREF="#accesscommands">Restrict Execution with AccessCommands</A></H3><!--SEC END --><P> <A NAME="accesscommands"></A> </P><P>The frontends can be configured to restrict access to certain commands.
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc73">4.2.2</A>&#XA0;&#XA0;<A HREF="#accesscommands">Restrict Execution with AccessCommands</A></H3><!--SEC END --><P> <A NAME="accesscommands"></A> </P><P>The frontends can be configured to restrict access to certain commands.
 In that case, authentication information must be provided.
 In each frontend the <TT>AccessCommands</TT> option is defined
 in a different place. But in all cases the option syntax is the same:
@@ -3593,7 +3639,7 @@ and the provided arguments do not contradict Arguments.</P><P>As an example to u
  {_bot_reg_test, [register, unregister], [{host, "test.org"}]}
 ]
 </PRE><P> <A NAME="webadmin"></A> </P><!--TOC section Web Admin-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc73">4.3</A>&#XA0;&#XA0;<A HREF="#webadmin">Web Admin</A></H2><!--SEC END --><P> <A NAME="webadmin"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc74">4.3</A>&#XA0;&#XA0;<A HREF="#webadmin">Web Admin</A></H2><!--SEC END --><P> <A NAME="webadmin"></A> 
 </P><P>The <TT>ejabberd</TT> Web Admin allows to administer most of <TT>ejabberd</TT> using a web browser.</P><P>This feature is enabled by default:
 a <TT>ejabberd_http</TT> listener with the option <TT>web_admin</TT> (see
 section&#XA0;<A HREF="#listened">3.1.3</A>) is included in the listening ports. Then you can open
@@ -3665,13 +3711,13 @@ The file is searched by default in
 The directory of the documentation can be specified in
 the environment variable <TT>EJABBERD_DOC_PATH</TT>.
 See section <A HREF="#erlangconfiguration">4.1.2</A>.</P><P> <A NAME="adhoccommands"></A> </P><!--TOC section Ad-hoc Commands-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc74">4.4</A>&#XA0;&#XA0;<A HREF="#adhoccommands">Ad-hoc Commands</A></H2><!--SEC END --><P> <A NAME="adhoccommands"></A> </P><P>If you enable <TT>mod_configure</TT> and <TT>mod_adhoc</TT>,
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc75">4.4</A>&#XA0;&#XA0;<A HREF="#adhoccommands">Ad-hoc Commands</A></H2><!--SEC END --><P> <A NAME="adhoccommands"></A> </P><P>If you enable <TT>mod_configure</TT> and <TT>mod_adhoc</TT>,
 you can perform several administrative tasks in <TT>ejabberd</TT>
 with a XMPP client.
 The client must support Ad-Hoc Commands (<A HREF="http://xmpp.org/extensions/xep-0050.html">XEP-0050</A>),
 and you must login in the XMPP server with
 an account with proper privileges.</P><P> <A NAME="changeerlangnodename"></A> </P><!--TOC section Change Computer Hostname-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc75">4.5</A>&#XA0;&#XA0;<A HREF="#changeerlangnodename">Change Computer Hostname</A></H2><!--SEC END --><P> <A NAME="changeerlangnodename"></A> </P><P><TT>ejabberd</TT> uses the distributed Mnesia database.
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc76">4.5</A>&#XA0;&#XA0;<A HREF="#changeerlangnodename">Change Computer Hostname</A></H2><!--SEC END --><P> <A NAME="changeerlangnodename"></A> </P><P><TT>ejabberd</TT> uses the distributed Mnesia database.
 Being distributed, Mnesia enforces consistency of its file,
 so it stores the name of the Erlang node in it (see section <A HREF="#nodename">5.4</A>).
 The name of an Erlang node includes the hostname of the computer.
@@ -3717,8 +3763,8 @@ mv /var/lib/ejabberd/*.* /var/lib/ejabberd/oldfiles/
 </PRE></LI><LI CLASS="li-enumerate">Check that the information of the old database is available: accounts, rosters...
 After you finish, remember to delete the temporary backup files from public directories.
 </LI></OL><P> <A NAME="secure"></A> </P><!--TOC chapter Securing <TT>ejabberd</TT>-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc76">Chapter&#XA0;5</A>&#XA0;&#XA0;<A HREF="#secure">Securing <TT>ejabberd</TT></A></H1><!--SEC END --><P> <A NAME="secure"></A> </P><P> <A NAME="firewall"></A> </P><!--TOC section Firewall Settings-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc77">5.1</A>&#XA0;&#XA0;<A HREF="#firewall">Firewall Settings</A></H2><!--SEC END --><P> <A NAME="firewall"></A> 
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc77">Chapter&#XA0;5</A>&#XA0;&#XA0;<A HREF="#secure">Securing <TT>ejabberd</TT></A></H1><!--SEC END --><P> <A NAME="secure"></A> </P><P> <A NAME="firewall"></A> </P><!--TOC section Firewall Settings-->
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc78">5.1</A>&#XA0;&#XA0;<A HREF="#firewall">Firewall Settings</A></H2><!--SEC END --><P> <A NAME="firewall"></A> 
 </P><P>You need to take the following TCP ports in mind when configuring your firewall:
 </P><BLOCKQUOTE CLASS="table"><DIV CLASS="center"><DIV CLASS="center"><HR WIDTH="80%" SIZE=2></DIV>
 <TABLE BORDER=1 CELLSPACING=0 CELLPADDING=1><TR><TD ALIGN=left NOWRAP><B>Port</B></TD><TD ALIGN=left NOWRAP><B>Description</B></TD></TR>
@@ -3729,7 +3775,7 @@ After you finish, remember to delete the temporary backup files from public dire
 <TR><TD ALIGN=left NOWRAP>port range</TD><TD ALIGN=left NOWRAP>Used for connections between Erlang nodes. This range is configurable (see section <A HREF="#epmd">5.2</A>).</TD></TR>
 </TABLE>
 <DIV CLASS="center"><HR WIDTH="80%" SIZE=2></DIV></DIV></BLOCKQUOTE><P> <A NAME="epmd"></A> </P><!--TOC section epmd-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc78">5.2</A>&#XA0;&#XA0;<A HREF="#epmd">epmd</A></H2><!--SEC END --><P> <A NAME="epmd"></A> </P><P><A HREF="http://www.erlang.org/doc/man/epmd.html">epmd (Erlang Port Mapper Daemon)</A>
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc79">5.2</A>&#XA0;&#XA0;<A HREF="#epmd">epmd</A></H2><!--SEC END --><P> <A NAME="epmd"></A> </P><P><A HREF="http://www.erlang.org/doc/man/epmd.html">epmd (Erlang Port Mapper Daemon)</A>
 is a small name server included in Erlang/OTP
 and used by Erlang programs when establishing distributed Erlang communications.
 <TT>ejabberd</TT> needs <TT>epmd</TT> to use <TT>ejabberdctl</TT> and also when clustering <TT>ejabberd</TT> nodes.
@@ -3754,7 +3800,7 @@ but can be configured in the file <TT>ejabberdctl.cfg</TT>.
 The Erlang command-line parameter used internally is, for example:
 </P><PRE CLASS="verbatim">erl ... -kernel inet_dist_listen_min 4370 inet_dist_listen_max 4375
 </PRE><P> <A NAME="cookie"></A> </P><!--TOC section Erlang Cookie-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc79">5.3</A>&#XA0;&#XA0;<A HREF="#cookie">Erlang Cookie</A></H2><!--SEC END --><P> <A NAME="cookie"></A> </P><P>The Erlang cookie is a string with numbers and letters.
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc80">5.3</A>&#XA0;&#XA0;<A HREF="#cookie">Erlang Cookie</A></H2><!--SEC END --><P> <A NAME="cookie"></A> </P><P>The Erlang cookie is a string with numbers and letters.
 An Erlang node reads the cookie at startup from the command-line parameter <TT>-setcookie</TT>.
 If not indicated, the cookie is read from the cookie file <TT>$HOME/.erlang.cookie</TT>.
 If this file does not exist, it is created immediately with a random cookie.
@@ -3768,7 +3814,7 @@ to prevent unauthorized access or intrusion to an Erlang node.
 The communication between Erlang nodes are not encrypted,
 so the cookie could be read sniffing the traffic on the network.
 The recommended way to secure the Erlang node is to block the port 4369.</P><P> <A NAME="nodename"></A> </P><!--TOC section Erlang Node Name-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc80">5.4</A>&#XA0;&#XA0;<A HREF="#nodename">Erlang Node Name</A></H2><!--SEC END --><P> <A NAME="nodename"></A> </P><P>An Erlang node may have a node name.
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc81">5.4</A>&#XA0;&#XA0;<A HREF="#nodename">Erlang Node Name</A></H2><!--SEC END --><P> <A NAME="nodename"></A> </P><P>An Erlang node may have a node name.
 The name can be short (if indicated with the command-line parameter <TT>-sname</TT>)
 or long (if indicated with the parameter <TT>-name</TT>).
 Starting an Erlang node with -sname limits the communication between Erlang nodes to the LAN.</P><P>Using the option <TT>-sname</TT> instead of <TT>-name</TT> is a simple method
@@ -3777,7 +3823,7 @@ However, it is not ultimately effective to prevent access to the Erlang node,
 because it may be possible to fake the fact that you are on another network
 using a modified version of Erlang <TT>epmd</TT>.
 The recommended way to secure the Erlang node is to block the port 4369.</P><P> <A NAME="secure-files"></A> </P><!--TOC section Securing Sensitive Files-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc81">5.5</A>&#XA0;&#XA0;<A HREF="#secure-files">Securing Sensitive Files</A></H2><!--SEC END --><P> <A NAME="secure-files"></A> </P><P><TT>ejabberd</TT> stores sensitive data in the file system either in plain text or binary files.
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc82">5.5</A>&#XA0;&#XA0;<A HREF="#secure-files">Securing Sensitive Files</A></H2><!--SEC END --><P> <A NAME="secure-files"></A> </P><P><TT>ejabberd</TT> stores sensitive data in the file system either in plain text or binary files.
 The file system permissions should be set to only allow the proper user to read,
 write and execute those files and directories.</P><DL CLASS="description"><DT CLASS="dt-description">
 <B><TT>ejabberd configuration file: /etc/ejabberd/ejabberd.cfg</TT></B></DT><DD CLASS="dd-description">
@@ -3797,9 +3843,9 @@ so it is preferable to secure the whole <TT>/var/lib/ejabberd/</TT> directory.
 </DD><DT CLASS="dt-description"><B><TT>Erlang cookie file: /var/lib/ejabberd/.erlang.cookie</TT></B></DT><DD CLASS="dd-description">
 See section <A HREF="#cookie">5.3</A>.
 </DD></DL><P> <A NAME="clustering"></A> </P><!--TOC chapter Clustering-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc82">Chapter&#XA0;6</A>&#XA0;&#XA0;<A HREF="#clustering">Clustering</A></H1><!--SEC END --><P> <A NAME="clustering"></A> 
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc83">Chapter&#XA0;6</A>&#XA0;&#XA0;<A HREF="#clustering">Clustering</A></H1><!--SEC END --><P> <A NAME="clustering"></A> 
 </P><P> <A NAME="howitworks"></A> </P><!--TOC section How it Works-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc83">6.1</A>&#XA0;&#XA0;<A HREF="#howitworks">How it Works</A></H2><!--SEC END --><P> <A NAME="howitworks"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc84">6.1</A>&#XA0;&#XA0;<A HREF="#howitworks">How it Works</A></H2><!--SEC END --><P> <A NAME="howitworks"></A> 
 </P><P>A XMPP domain is served by one or more <TT>ejabberd</TT> nodes. These nodes can
 be run on different machines that are connected via a network. They all
 must have the ability to connect to port 4369 of all another nodes, and must
@@ -3813,29 +3859,29 @@ router,
 </LI><LI CLASS="li-itemize">session manager,
 </LI><LI CLASS="li-itemize">s2s manager.
 </LI></UL><P> <A NAME="router"></A> </P><!--TOC subsection Router-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc84">6.1.1</A>&#XA0;&#XA0;<A HREF="#router">Router</A></H3><!--SEC END --><P> <A NAME="router"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc85">6.1.1</A>&#XA0;&#XA0;<A HREF="#router">Router</A></H3><!--SEC END --><P> <A NAME="router"></A> 
 </P><P>This module is the main router of XMPP packets on each node. It
 routes them based on their destination&#X2019;s domains. It uses a global
 routing table. The domain of the packet&#X2019;s destination is searched in the
 routing table, and if it is found, the packet is routed to the
 appropriate process. If not, it is sent to the s2s manager.</P><P> <A NAME="localrouter"></A> </P><!--TOC subsection Local Router-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc85">6.1.2</A>&#XA0;&#XA0;<A HREF="#localrouter">Local Router</A></H3><!--SEC END --><P> <A NAME="localrouter"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc86">6.1.2</A>&#XA0;&#XA0;<A HREF="#localrouter">Local Router</A></H3><!--SEC END --><P> <A NAME="localrouter"></A> 
 </P><P>This module routes packets which have a destination domain equal to
 one of this server&#X2019;s host names. If the destination JID has a non-empty user
 part, it is routed to the session manager, otherwise it is processed depending
 on its content.</P><P> <A NAME="sessionmanager"></A> </P><!--TOC subsection Session Manager-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc86">6.1.3</A>&#XA0;&#XA0;<A HREF="#sessionmanager">Session Manager</A></H3><!--SEC END --><P> <A NAME="sessionmanager"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc87">6.1.3</A>&#XA0;&#XA0;<A HREF="#sessionmanager">Session Manager</A></H3><!--SEC END --><P> <A NAME="sessionmanager"></A> 
 </P><P>This module routes packets to local users. It looks up to which user
 resource a packet must be sent via a presence table. Then the packet is
 either routed to the appropriate c2s process, or stored in offline
 storage, or bounced back.</P><P> <A NAME="s2smanager"></A> </P><!--TOC subsection s2s Manager-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc87">6.1.4</A>&#XA0;&#XA0;<A HREF="#s2smanager">s2s Manager</A></H3><!--SEC END --><P> <A NAME="s2smanager"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc88">6.1.4</A>&#XA0;&#XA0;<A HREF="#s2smanager">s2s Manager</A></H3><!--SEC END --><P> <A NAME="s2smanager"></A> 
 </P><P>This module routes packets to other XMPP servers. First, it
 checks if an opened s2s connection from the domain of the packet&#X2019;s
 source to the domain of the packet&#X2019;s destination exists. If that is the case,
 the s2s manager routes the packet to the process
 serving this connection, otherwise a new connection is opened.</P><P> <A NAME="cluster"></A> </P><!--TOC section Clustering Setup-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc88">6.2</A>&#XA0;&#XA0;<A HREF="#cluster">Clustering Setup</A></H2><!--SEC END --><P> <A NAME="cluster"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc89">6.2</A>&#XA0;&#XA0;<A HREF="#cluster">Clustering Setup</A></H2><!--SEC END --><P> <A NAME="cluster"></A> 
 </P><P>Suppose you already configured <TT>ejabberd</TT> on one machine named (<TT>first</TT>),
 and you need to setup another one to make an <TT>ejabberd</TT> cluster. Then do
 following steps:</P><OL CLASS="enumerate" type=1><LI CLASS="li-enumerate">
@@ -3873,10 +3919,10 @@ and &#X2018;<CODE>access</CODE>&#X2019; options because they will be taken from
 enabled only on one machine in the cluster.
 </LI></OL><P>You can repeat these steps for other machines supposed to serve this
 domain.</P><P> <A NAME="servicelb"></A> </P><!--TOC section Service Load-Balancing-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc89">6.3</A>&#XA0;&#XA0;<A HREF="#servicelb">Service Load-Balancing</A></H2><!--SEC END --><P> <A NAME="servicelb"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc90">6.3</A>&#XA0;&#XA0;<A HREF="#servicelb">Service Load-Balancing</A></H2><!--SEC END --><P> <A NAME="servicelb"></A> 
 </P><P> <A NAME="componentlb"></A> </P><!--TOC subsection Components Load-Balancing-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc90">6.3.1</A>&#XA0;&#XA0;<A HREF="#componentlb">Components Load-Balancing</A></H3><!--SEC END --><P> <A NAME="componentlb"></A> </P><P> <A NAME="domainlb"></A> </P><!--TOC subsection Domain Load-Balancing Algorithm-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc91">6.3.2</A>&#XA0;&#XA0;<A HREF="#domainlb">Domain Load-Balancing Algorithm</A></H3><!--SEC END --><P> <A NAME="domainlb"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc91">6.3.1</A>&#XA0;&#XA0;<A HREF="#componentlb">Components Load-Balancing</A></H3><!--SEC END --><P> <A NAME="componentlb"></A> </P><P> <A NAME="domainlb"></A> </P><!--TOC subsection Domain Load-Balancing Algorithm-->
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc92">6.3.2</A>&#XA0;&#XA0;<A HREF="#domainlb">Domain Load-Balancing Algorithm</A></H3><!--SEC END --><P> <A NAME="domainlb"></A> 
 </P><P><TT>ejabberd</TT> includes an algorithm to load balance the components that are plugged on an <TT>ejabberd</TT> cluster. It means that you can plug one or several instances of the same component on each <TT>ejabberd</TT> cluster and that the traffic will be automatically distributed.</P><P>The default distribution algorithm try to deliver to a local instance of a component. If several local instances are available, one instance is chosen randomly. If no instance is available locally, one instance is chosen randomly among the remote component instances.</P><P>If you need a different behaviour, you can change the load balancing behaviour with the option <TT>domain_balancing</TT>. The syntax of the option is the following:
 </P><DL CLASS="description"><DT CLASS="dt-description"><B><TT>{domain_balancing, "component.example.com", BalancingCriteria}.</TT></B></DT></DL><P>Several balancing criteria are available:
 </P><UL CLASS="itemize"><LI CLASS="li-itemize">
@@ -3885,12 +3931,12 @@ domain.</P><P> <A NAME="servicelb"></A> </P><!--TOC section Service Load-Balanci
 </LI><LI CLASS="li-itemize"><TT>bare_destination</TT>: the bare JID (without resource) of the packet <TT>to</TT> attribute is used.
 </LI><LI CLASS="li-itemize"><TT>bare_source</TT>: the bare JID (without resource) of the packet <TT>from</TT> attribute is used.
 </LI></UL><P>If the value corresponding to the criteria is the same, the same component instance in the cluster will be used.</P><P> <A NAME="lbbuckets"></A> </P><!--TOC subsection Load-Balancing Buckets-->
-<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc92">6.3.3</A>&#XA0;&#XA0;<A HREF="#lbbuckets">Load-Balancing Buckets</A></H3><!--SEC END --><P> <A NAME="lbbuckets"></A> 
+<H3 CLASS="subsection"><!--SEC ANCHOR --><A NAME="htoc93">6.3.3</A>&#XA0;&#XA0;<A HREF="#lbbuckets">Load-Balancing Buckets</A></H3><!--SEC END --><P> <A NAME="lbbuckets"></A> 
 </P><P>When there is a risk of failure for a given component, domain balancing can cause service trouble. If one component is failing the service will not work correctly unless the sessions are rebalanced.</P><P>In this case, it is best to limit the problem to the sessions handled by the failing component. This is what the <TT>domain_balancing_component_number</TT> option does, making the load balancing algorithm not dynamic, but sticky on a fix number of component instances.</P><P>The syntax is:
 </P><DL CLASS="description"><DT CLASS="dt-description"><B><TT>{domain_balancing_component_number, "component.example.com", Number}.</TT></B></DT></DL><P> <A NAME="debugging"></A> </P><!--TOC chapter Debugging-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc93">Chapter&#XA0;7</A>&#XA0;&#XA0;<A HREF="#debugging">Debugging</A></H1><!--SEC END --><P> <A NAME="debugging"></A> 
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc94">Chapter&#XA0;7</A>&#XA0;&#XA0;<A HREF="#debugging">Debugging</A></H1><!--SEC END --><P> <A NAME="debugging"></A> 
 </P><P> <A NAME="logfiles"></A> </P><!--TOC section Log Files-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc94">7.1</A>&#XA0;&#XA0;<A HREF="#logfiles">Log Files</A></H2><!--SEC END --><P> <A NAME="logfiles"></A> </P><P>An <TT>ejabberd</TT> node writes two log files:
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc95">7.1</A>&#XA0;&#XA0;<A HREF="#logfiles">Log Files</A></H2><!--SEC END --><P> <A NAME="logfiles"></A> </P><P>An <TT>ejabberd</TT> node writes two log files:
 </P><DL CLASS="description"><DT CLASS="dt-description">
 	<B><TT>ejabberd.log</TT></B></DT><DD CLASS="dd-description"> is the ejabberd service log, with the messages reported by <TT>ejabberd</TT> code
 	</DD><DT CLASS="dt-description"><B><TT>erlang.log</TT></B></DT><DD CLASS="dd-description"> is the Erlang/OTP system log, with the messages reported by Erlang/OTP using SASL (System Architecture Support Libraries)
@@ -3912,12 +3958,12 @@ The ejabberdctl command <TT>reopen-log</TT>
 (please refer to section <A HREF="#ectl-commands">4.1.1</A>)
 reopens the log files,
 and also renames the old ones if you didn&#X2019;t rename them.</P><P> <A NAME="debugconsole"></A> </P><!--TOC section Debug Console-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc95">7.2</A>&#XA0;&#XA0;<A HREF="#debugconsole">Debug Console</A></H2><!--SEC END --><P> <A NAME="debugconsole"></A> </P><P>The Debug Console is an Erlang shell attached to an already running <TT>ejabberd</TT> server.
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc96">7.2</A>&#XA0;&#XA0;<A HREF="#debugconsole">Debug Console</A></H2><!--SEC END --><P> <A NAME="debugconsole"></A> </P><P>The Debug Console is an Erlang shell attached to an already running <TT>ejabberd</TT> server.
 With this Erlang shell, an experienced administrator can perform complex tasks.</P><P>This shell gives complete control over the <TT>ejabberd</TT> server,
 so it is important to use it with extremely care.
 There are some simple and safe examples in the article
 <A HREF="http://www.ejabberd.im/interconnect-erl-nodes">Interconnecting Erlang Nodes</A></P><P>To exit the shell, close the window or press the keys: control+c control+c.</P><P> <A NAME="watchdog"></A> </P><!--TOC section Watchdog Alerts-->
-<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc96">7.3</A>&#XA0;&#XA0;<A HREF="#watchdog">Watchdog Alerts</A></H2><!--SEC END --><P> <A NAME="watchdog"></A> 
+<H2 CLASS="section"><!--SEC ANCHOR --><A NAME="htoc97">7.3</A>&#XA0;&#XA0;<A HREF="#watchdog">Watchdog Alerts</A></H2><!--SEC END --><P> <A NAME="watchdog"></A> 
 </P><P><TT>ejabberd</TT> includes a watchdog mechanism that may be useful to developers
 when troubleshooting a problem related to memory usage.
 If a process in the <TT>ejabberd</TT> server consumes more memory than the configured threshold,
@@ -3937,7 +3983,7 @@ or in a conversation with the watchdog alert bot.</P><P>The syntax is:
 To remove all watchdog admins, set the option with an empty list:
 </P><PRE CLASS="verbatim">{watchdog_admins, []}.
 </PRE><P> <A NAME="i18ni10n"></A> </P><!--TOC chapter Internationalization and Localization-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc97">Appendix&#XA0;A</A>&#XA0;&#XA0;<A HREF="#i18ni10n">Internationalization and Localization</A></H1><!--SEC END --><P> <A NAME="i18ni10n"></A> 
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc98">Appendix&#XA0;A</A>&#XA0;&#XA0;<A HREF="#i18ni10n">Internationalization and Localization</A></H1><!--SEC END --><P> <A NAME="i18ni10n"></A> 
 </P><P>The source code of <TT>ejabberd</TT> supports localization.
 The translators can edit the
 <A HREF="http://www.gnu.org/software/gettext/">gettext</A> .po files
@@ -3972,9 +4018,9 @@ HTTP header &#X2018;Accept-Language: ru&#X2019;</TD></TR>
 </TABLE></DIV>
 <A NAME="fig:webadmmainru"></A>
 <DIV CLASS="center"><HR WIDTH="80%" SIZE=2></DIV></DIV></BLOCKQUOTE><P> <A NAME="releasenotes"></A> </P><!--TOC chapter Release Notes-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc98">Appendix&#XA0;B</A>&#XA0;&#XA0;<A HREF="#releasenotes">Release Notes</A></H1><!--SEC END --><P> <A NAME="releasenotes"></A> 
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc99">Appendix&#XA0;B</A>&#XA0;&#XA0;<A HREF="#releasenotes">Release Notes</A></H1><!--SEC END --><P> <A NAME="releasenotes"></A> 
 </P><P>Release notes are available from <A HREF="http://www.process-one.net/en/ejabberd/release_notes/">ejabberd Home Page</A></P><P> <A NAME="acknowledgements"></A> </P><!--TOC chapter Acknowledgements-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc99">Appendix&#XA0;C</A>&#XA0;&#XA0;<A HREF="#acknowledgements">Acknowledgements</A></H1><!--SEC END --><P> <A NAME="acknowledgements"></A> </P><P>Thanks to all people who contributed to this guide:
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc100">Appendix&#XA0;C</A>&#XA0;&#XA0;<A HREF="#acknowledgements">Acknowledgements</A></H1><!--SEC END --><P> <A NAME="acknowledgements"></A> </P><P>Thanks to all people who contributed to this guide:
 </P><UL CLASS="itemize"><LI CLASS="li-itemize">
 Alexey Shchepin (<A HREF="xmpp:aleksey@jabber.ru"><TT>xmpp:aleksey@jabber.ru</TT></A>)
 </LI><LI CLASS="li-itemize">Badlop (<A HREF="xmpp:badlop@jabberes.org"><TT>xmpp:badlop@jabberes.org</TT></A>)
@@ -3986,7 +4032,7 @@ Alexey Shchepin (<A HREF="xmpp:aleksey@jabber.ru"><TT>xmpp:aleksey@jabber.ru</TT
 </LI><LI CLASS="li-itemize">Sergei Golovan (<A HREF="xmpp:sgolovan@nes.ru"><TT>xmpp:sgolovan@nes.ru</TT></A>)
 </LI><LI CLASS="li-itemize">Vsevolod Pelipas (<A HREF="xmpp:vsevoload@jabber.ru"><TT>xmpp:vsevoload@jabber.ru</TT></A>)
 </LI></UL><P> <A NAME="copyright"></A> </P><!--TOC chapter Copyright Information-->
-<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc100">Appendix&#XA0;D</A>&#XA0;&#XA0;<A HREF="#copyright">Copyright Information</A></H1><!--SEC END --><P> <A NAME="copyright"></A> </P><P>Ejabberd Installation and Operation Guide.<BR>
+<H1 CLASS="chapter"><!--SEC ANCHOR --><A NAME="htoc101">Appendix&#XA0;D</A>&#XA0;&#XA0;<A HREF="#copyright">Copyright Information</A></H1><!--SEC END --><P> <A NAME="copyright"></A> </P><P>Ejabberd Installation and Operation Guide.<BR>
 Copyright &#XA9; 2003 &#X2014; 2010 ProcessOne</P><P>This document is free software; you can redistribute it and/or
 modify it under the terms of the GNU General Public License
 as published by the Free Software Foundation; either version 2
diff --git a/doc/guide.tex b/doc/guide.tex
index 640e2bb..580ab7f 100644
--- a/doc/guide.tex
+++ b/doc/guide.tex
@@ -1634,6 +1634,67 @@ _stun._tcp   IN SRV  0 0 3478 stun.example.com.
 _stuns._tcp  IN SRV  0 0 5349 stun.example.com.
 \end{verbatim}
 
+\subsection{S2S-proxy}
+\label{s2sproxy}
+\ind{options!s2sproxy}\ind{s2sproxy}
+
+It is possible to configure an ejabberd server to act as S2S-proxy server or as S2S-proxy client.
+
+This feature will be illustrated with an example scenario
+with two ejabberd servers: \term{server1.example.org} and \term{server2.example.org}.
+Both servers allow client and server connections.
+Both servers can connect to each other using S2S.
+But only server1 is connected to Internet;
+while server2 can't connect to Internet because a firewall blocks him the port 5269.
+You want to allow users in server2 to connect to Jabber servers outside your LAN.
+
+In this setup, server1 will act as a S2S-proxy server,
+and server2 as a S2S-proxy client.
+So, when a user in server2 wants to connect to a remote Jabber server in Internet,
+server2 will send all the traffic over server1, and this one to and from Internet.
+
+Note that there isn't DNS address translation or JID rewrite.
+The DNS names of the proxy clients and proxy server must be resolvable.
+It will not work correctly if using local DNS names.
+The S2S connections of server2 will be proxied by server1,
+but the JID will remain intact.
+This means that server2 DNS name must point to server1
+so remote servers can reach the S2S-proxy server.
+
+Configuration in ejabberd.cfg of server1:
+\begin{verbatim}
+{hosts, ["server1.example.org"]}.
+
+{modules,
+ [
+  %% Enable the module and define the proxy clients
+  {mod_s2s_proxy, [{hosts, ["server2.example.org"]}]},
+  ...
+ ]
+}.
+\end{verbatim}
+
+Configuration in ejabberd.cfg of server2:
+\begin{verbatim}
+{hosts, ["server2.example.org"]}.
+
+%%
+%% Define local domains that are inside the LAN and don't require proxying
+%%
+{acl, local_domains, {server_glob, "*.example.org"}}.
+
+%%
+%% Don't relay internal s2s connections via the proxy server
+%%
+{access, via_proxy, [{deny, local_domains}, {allow, all}]}.
+
+%%
+%% s2s_hub: define the proxy server and Access rule
+%%
+{s2s_hub, [{host, "server1.example.org"}, {access, via_proxy}]}.
+\end{verbatim}
+
+
 \makesubsection{includeconfigfile}{Include Additional Configuration Files}
 \ind{options!includeconfigfile}\ind{includeconfigfile}
 
diff --git a/src/ejabberd_config.erl b/src/ejabberd_config.erl
index 2b508ac..6d4f696 100644
--- a/src/ejabberd_config.erl
+++ b/src/ejabberd_config.erl
@@ -405,6 +405,8 @@ process_term(Term, State) ->
 			"the specified file is not readable: ",
 		    throw({error, ErrorText ++ CertFile})
 	    end;
+	{s2s_hub, Server} ->
+	    add_option(s2s_hub, Server, State);
 	{domain_certfile, Domain, CertFile} ->
 	    case ejabberd_config:is_file_readable(CertFile) of
 		true -> add_option({domain_certfile, Domain}, CertFile, State);
diff --git a/src/ejabberd_s2s.erl b/src/ejabberd_s2s.erl
index a5c0878..432555e 100644
--- a/src/ejabberd_s2s.erl
+++ b/src/ejabberd_s2s.erl
@@ -39,6 +39,7 @@
 	 remove_connection/3,
 	 dirty_get_connections/0,
 	 allow_host/2,
+	 find_connection/2,
 	 incoming_s2s_number/0,
 	 outgoing_s2s_number/0
 	]).
@@ -276,9 +277,37 @@ do_route(From, To, Packet) ->
 	    false
     end.
 
+%% @spec find_proxy(DestinationHost) -> direct | {via, ProxyServer}
+%%       DestinationHost = jid()
+%%       ProxyServer = string()
+find_proxy(To) ->
+    case ejabberd_config:get_local_option(s2s_hub) of
+	Opts when is_list(Opts) ->
+	    LTo = To#jid.lserver,
+	    case gen_mod:get_opt(host, Opts, LTo) of
+		ProxyServer when LTo /= ProxyServer ->
+		    ACL = gen_mod:get_opt(access, Opts, all),
+		    case acl:match_rule(global, ACL, To) of
+			allow ->
+			    {via, ProxyServer};
+			deny ->
+			    direct
+		    end;
+		_ ->
+		    direct
+	    end;
+	_ ->
+	    direct
+    end.
+
+
 find_connection(From, To) ->
     #jid{lserver = MyServer} = From,
-    #jid{lserver = Server} = To,
+    #jid{lserver = ToServer} = To,
+    Server = case find_proxy(To) of
+		 direct -> ToServer;
+		 {via, ProxyServer} -> ProxyServer
+	     end,
     FromTo = {MyServer, Server},
     MaxS2SConnectionsNumber = max_s2s_connections_number(FromTo),
     MaxS2SConnectionsNumberPerNode =
diff --git a/src/ejabberd_s2s_in.erl b/src/ejabberd_s2s_in.erl
index f221302..8a6000e 100644
--- a/src/ejabberd_s2s_in.erl
+++ b/src/ejabberd_s2s_in.erl
@@ -70,6 +70,7 @@
 		tls_enabled = false,
 		tls_options = [],
 		authenticated = false,
+		proxy,
 		auth_domain,
 	        connections = ?DICT:new(),
 		timer}).
@@ -156,12 +157,19 @@ init([{SockMod, Socket}, Opts]) ->
 		  CertFile ->
 		      [{certfile, CertFile}]
 	      end,
+    Proxy = case ejabberd_config:get_local_option(s2s_hub) of
+		OptList when is_list(OptList) ->
+		    gen_mod:get_opt(host, OptList, none);
+		_ ->
+		    none
+	    end,
     Timer = erlang:start_timer(?S2STIMEOUT, self(), []),
     {ok, wait_for_stream,
      #state{socket = Socket,
 	    sockmod = SockMod,
 	    streamid = new_id(),
 	    shaper = Shaper,
+	    proxy = Proxy,
 	    tls = StartTLS,
 	    tls_enabled = false,
 	    tls_options = TLSOpts,
@@ -401,45 +409,32 @@ stream_established({xmlstreamelement, El}, StateData) ->
 		(To /= error) and (From /= error) ->
 		    LFrom = From#jid.lserver,
 		    LTo = To#jid.lserver,
+		    ProxyServer = StateData#state.proxy,
+		    MyDomains = ejabberd_router:dirty_get_all_domains(),
+		    AuthDomain = StateData#state.auth_domain,
 		    if
 			StateData#state.authenticated ->
-			    case (LFrom == StateData#state.auth_domain)
-				andalso
-				lists:member(
-				  LTo,
-				  ejabberd_router:dirty_get_all_domains()) of
+			    case lists:member(LTo, MyDomains) of
 				true ->
-				    if ((Name == "iq") or
-					(Name == "message") or
-					(Name == "presence")) ->
-					    ejabberd_hooks:run(
-					      s2s_receive_packet,
-					      LTo,
-					      [From, To, NewEl]),
-					    ejabberd_router:route(
-					      From, To, NewEl);
-				       true ->
+				    case lists:member(AuthDomain, [LFrom, ProxyServer]) of
+					true ->
+					    route_stanza(Name, From, LTo, To, NewEl);
+					false ->
 					    error
 				    end;
 				false ->
-				    error
+				    case lists:member(LFrom, MyDomains) of
+					true ->
+					    route_stanza(Name, From, LTo, To, NewEl);
+					false ->
+					    error
+				    end
 			    end;
 			true ->
 			    case ?DICT:find({LFrom, LTo},
 					    StateData#state.connections) of
 				{ok, established} ->
-				    if ((Name == "iq") or
-					(Name == "message") or
-					(Name == "presence")) ->
-					    ejabberd_hooks:run(
-					      s2s_receive_packet,
-					      LTo,
-					      [From, To, NewEl]),
-					    ejabberd_router:route(
-					      From, To, NewEl);
-				       true ->
-					    error
-				    end;
+				    route_stanza(Name, From, LTo, To, NewEl);
 				_ ->
 				    error
 			    end
@@ -463,7 +458,9 @@ stream_established({valid, From, To}, StateData) ->
     LTo = jlib:nameprep(To),
     NSD = StateData#state{
 	    connections = ?DICT:store({LFrom, LTo}, established,
-				      StateData#state.connections)},
+				      StateData#state.connections),
+		auth_domain = LFrom,
+		authenticated = true},
     {next_state, stream_established, NSD};
 
 stream_established({invalid, From, To}, StateData) ->
@@ -611,6 +608,15 @@ send_text(StateData, Text) ->
 send_element(StateData, El) ->
     send_text(StateData, xml:element_to_string(El)).
 
+route_stanza(Name, From, LTo, To, NewEl) ->
+    if ((Name == "iq") or
+	(Name == "message") or
+	(Name == "presence")) ->
+	    ejabberd_hooks:run(s2s_receive_packet, LTo, [From, To, NewEl]),
+	    ejabberd_router:route(From, To, NewEl);
+       true ->
+	    error
+    end.
 
 change_shaper(StateData, Host, JID) ->
     Shaper = acl:match_rule(Host, StateData#state.shaper, JID),
diff --git a/src/mod_s2s_proxy.erl b/src/mod_s2s_proxy.erl
new file mode 100644
index 0000000..c2cbf4d
--- /dev/null
+++ b/src/mod_s2s_proxy.erl
@@ -0,0 +1,115 @@
+%%%----------------------------------------------------------------------
+%%% File    : mod_s2s_proxy.erl
+%%% Author  : Evgeniy Khramtsov <xram@jabber.ru>
+%%% Purpose : S2S-proxy server
+%%% Created : 13 Aug 2006 by Evgeniy Khramtsov <xram@jabber.ru>
+%%%
+%%%
+%%% ejabberd, Copyright (C) 2002-2010   ProcessOne
+%%%
+%%% This program is free software; you can redistribute it and/or
+%%% modify it under the terms of the GNU General Public License as
+%%% published by the Free Software Foundation; either version 2 of the
+%%% License, or (at your option) any later version.
+%%%
+%%% This program is distributed in the hope that it will be useful,
+%%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+%%% General Public License for more details.
+%%%
+%%% You should have received a copy of the GNU General Public License
+%%% along with this program; if not, write to the Free Software
+%%% Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+%%% 02111-1307 USA
+%%%
+%%%----------------------------------------------------------------------
+
+-module(mod_s2s_proxy).
+-author('xram@jabber.ru').
+
+-behaviour(gen_mod).
+-behaviour(gen_server).
+
+%% gen_server callbacks.
+-export([init/1,
+	 handle_info/2,
+	 handle_call/3,
+	 handle_cast/2,
+	 terminate/2,
+	 code_change/3
+	]).
+
+%% gen_mod callbacks.
+-export([start/2, stop/1]).
+
+%% API.
+-export([start_link/2]).
+
+-define(PROCNAME, ?MODULE).
+-include("ejabberd.hrl").
+-include("jlib.hrl").
+
+-record(state, {host, routes}).
+
+%% Unused callbacks.
+handle_cast(_Request, State) ->
+    {noreply, State}.
+code_change(_OldVsn, State, _Extra) ->
+    {ok, State}.
+%% -----
+
+start(Host, Opts) ->
+    Proc = gen_mod:get_module_proc(Host, ?PROCNAME),
+    ChildSpec = {
+      Proc, {?MODULE, start_link, [Host, Opts]},
+      transient, 5000, worker, [?MODULE]
+     },
+    supervisor:start_child(ejabberd_sup, ChildSpec).
+
+stop(Host) ->
+    Proc = gen_mod:get_module_proc(Host, ?PROCNAME),
+    gen_server:call(Proc, stop),
+    supervisor:terminate_child(ejabberd_sup, Proc),
+    supervisor:delete_child(ejabberd_sup, Proc).
+
+start_link(Host, Opts) ->
+    Proc = gen_mod:get_module_proc(Host, ?PROCNAME),
+    gen_server:start_link({local, Proc}, ?MODULE, [Host, Opts], []).
+
+init([Host, Opts]) ->
+    case gen_mod:get_opt(hosts, Opts, []) of
+	RelayRoutes when is_list(RelayRoutes) ->
+	    ejabberd_router:register_routes(RelayRoutes),
+	    {ok, #state{routes=RelayRoutes, host=Host}};
+	Junk ->
+	    ?ERROR_MSG("Incorrect configuration of relay domains: ~p", [Junk]),
+	    error
+    end.
+
+handle_info({route, From, To, Packet}, #state{host=Host} = State) ->
+    MyHost = From#jid{lserver=Host, server=Host},
+    %% FIXME: Exporting find_connection/2 from ejabberd_s2s.erl
+    %% looks like copy-pasting hack, but what can we do?
+    case ejabberd_s2s:find_connection(MyHost, To) of
+	{atomic, Pid} when is_pid(Pid) ->
+	    {xmlelement, Name, Attrs, Els} = Packet,
+	    NewAttrs = jlib:replace_from_to_attrs(jlib:jid_to_string(From),
+						  jlib:jid_to_string(To),
+						  Attrs),
+	    Pid ! {send_element, {xmlelement, Name, NewAttrs, Els}};
+	{aborted, _Reason} ->
+	    ?DEBUG("delivery failed: ~p~n", [_Reason])
+    end,
+    {noreply, State};
+
+handle_info(_Info, State) ->
+    {noreply, State}.
+
+handle_call(stop, _From, State) ->
+    {stop, normal, ok, State};
+handle_call(_Request, _From, State) ->
+    {reply, ok, State}.
+
+terminate(_Reason, #state{routes = RelayRoutes}) ->
+    ejabberd_router:unregister_routes(RelayRoutes),
+    ok.
-- 
1.6.4.3

