STARTTLS support for LDAP in s_client

[robert-scheck]

It would be great to be able to run openssl s_client -connect localhost:389 -starttls ldap for TLS related debugging purposes at LDAP where the classical SSL variant with TCP port 636 isn't available. As per http://stackoverflow.com/questions/11549731/is-it-possible-to-send-ldap-requests-via-telnet it does not make much sense to try to speak LDAP "by hand", but having STARTTLS support for LDAP in s_client would be still appreciated for TLS related testing and debugging.

[vdukhovni]

I don't think it is a good idea to create a mutual dependency between OpenSSL and OpenLDAP. If speaking LDAP starttls "by hand" is too difficult, then such debugging tools should be created on the OpenLDAP side and not in s_client.

[robert-scheck]

I also wouldn't speak FTP or XMPP "by hand", but openssl s_client supports it. My intention behind STARTTLS support for LDAP is more the TLS part to check certificate chains, force some TLS versions or ciphers etc. I guess only less people are doing more than that "by hand" with the FTP or XMPP support in openssl s_client, too. And I'm definately not interested in creating a real dependency, but sending some LDAP-ish sequences to initiate a STARTTLS for LDAP should be possible without any OpenLDAP code dependency, I assume (that's about what happens for XMPP at the moment).

[robert-scheck]

Now that I did #2293, I was made aware by @rtandy that @quanah pointed out an existing patch at https://rt.openssl.org/Ticket/Display.html?id=2665 already years ago – which meanwhile lead to #1733 and #1735 (it seems to do indeed more than my PR does, but I'm unfortunately not knowledged enough to follow up #1735 though).

[richsalz]

so many ldap PR's :) we'll have to sort this out.

[levitte]

Only two PRs, really... and they really do the same, one just happens to be a bit more verbose than the other (and easier to change, should it come to that)

[akostadinov]

Can this issue be closed as a duplicate of #1733 and possibly the PR moved forward?

[richsalz]

Yes, dup of #1733.