diff -up openssl-1.0.2k/apps/apps.c.starttls openssl-1.0.2k/apps/apps.c

--- openssl-1.0.2k/apps/apps.c.starttls	2017-01-26 14:22:03.000000000 +0100

+++ openssl-1.0.2k/apps/apps.c	2017-03-09 17:35:35.519765927 +0100

@@ -3277,3 +3277,11 @@ int raw_write_stdout(const void *buf, in

     return write(fileno_stdout(), buf, siz);

 }

 #endif

+

+void make_uppercase(char *string)

+{

+    int i;

+

+    for (i = 0; string[i] != '\0'; i++)

+        string[i] = toupper((unsigned char)string[i]);

+}

diff -up openssl-1.0.2k/apps/apps.h.starttls openssl-1.0.2k/apps/apps.h

--- openssl-1.0.2k/apps/apps.h.starttls	2017-03-09 17:35:28.632604234 +0100

+++ openssl-1.0.2k/apps/apps.h	2017-03-09 17:35:35.520765950 +0100

@@ -384,6 +384,8 @@ int raw_write_stdout(const void *, int);

 # define TM_STOP         1

 double app_tminterval(int stop, int usertime);

+void make_uppercase(char *string);

+

 # define OPENSSL_NO_SSL_INTERN

 #endif

diff -up openssl-1.0.2k/apps/s_client.c.starttls openssl-1.0.2k/apps/s_client.c

--- openssl-1.0.2k/apps/s_client.c.starttls	2017-03-09 17:35:28.684605455 +0100

+++ openssl-1.0.2k/apps/s_client.c	2017-03-09 17:52:59.153207946 +0100

@@ -134,7 +134,8 @@

  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR

  * OTHERWISE.

  */

-

+/* for strcasestr */

+#define _GNU_SOURCE

 #include <assert.h>

 #include <ctype.h>

 #include <stdio.h>

@@ -202,6 +203,7 @@ static char *krb5svc = NULL;

 #undef BUFSIZZ

 #define BUFSIZZ 1024*8

+#define S_CLIENT_IRC_READ_TIMEOUT 8

 extern int verify_depth;

 extern int verify_error;

@@ -228,6 +230,7 @@ static void print_stuff(BIO *berr, SSL *

 #ifndef OPENSSL_NO_TLSEXT

 static int ocsp_resp_cb(SSL *s, void *arg);

 #endif

+static int ldap_ExtendedResponse_parse(const char *buf, long rem);

 static BIO *bio_c_out = NULL;

 static BIO *bio_c_msg = NULL;

 static int c_quiet = 0;

@@ -402,8 +405,14 @@ static void sc_usage(void)

     BIO_printf(bio_err,

                "                 'prot' defines which one to assume.  Currently,\n");

     BIO_printf(bio_err,

-               "                 only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");

-    BIO_printf(bio_err, "                 are supported.\n");

+               "                 only \"smtp\", \"pop3\", \"imap\", \"ftp\", \"xmpp\",\n");

+    BIO_printf(bio_err,

+               "                 \"xmpp-server\", \"irc\", \"postgres\", \"lmtp\", \"nntp\",\n");

+    BIO_printf(bio_err, "                 \"sieve\" and \"ldap\" are supported.\n");

+    BIO_printf(bio_err,

+               " -xmpphost host - Host to use with \"-starttls xmpp[-server]\"\n");

+    BIO_printf(bio_err,

+               " -name host     - Hostname to use for \"-starttls lmtp\" or \"-starttls smtp\"\n");

 #ifndef OPENSSL_NO_KRB5

     BIO_printf(bio_err, " -krb5svc arg  - Kerberos service name\n");

 #endif

@@ -657,7 +666,15 @@ enum {

     PROTO_POP3,

     PROTO_IMAP,

     PROTO_FTP,

-    PROTO_XMPP

+    PROTO_TELNET,

+    PROTO_XMPP,

+    PROTO_XMPP_SERVER,

+    PROTO_IRC,

+    PROTO_POSTGRES,

+    PROTO_LMTP,

+    PROTO_NNTP,

+    PROTO_SIEVE,

+    PROTO_LDAP

 };

 int MAIN(int, char **);

@@ -726,6 +743,8 @@ int MAIN(int argc, char **argv)

 #endif

     char *sess_in = NULL;

     char *sess_out = NULL;

+    char *xmpphost = NULL;

+    const char *ehlo = "openssl.client.net";

     struct sockaddr peer;

     int peerlen = sizeof(peer);

     int fallback_scsv = 0;

@@ -1097,8 +1116,32 @@ int MAIN(int argc, char **argv)

                 starttls_proto = PROTO_FTP;

             else if (strcmp(*argv, "xmpp") == 0)

                 starttls_proto = PROTO_XMPP;

+            else if (strcmp(*argv, "xmpp-server") == 0)

+                starttls_proto = PROTO_XMPP_SERVER;

+            else if (strcmp(*argv, "telnet") == 0)

+                starttls_proto = PROTO_TELNET;

+            else if (strcmp(*argv, "irc") == 0)

+                starttls_proto = PROTO_IRC;

+            else if (strcmp(*argv, "postgres") == 0)

+                starttls_proto = PROTO_POSTGRES;

+            else if (strcmp(*argv, "lmtp") == 0)

+                starttls_proto = PROTO_LMTP;

+            else if (strcmp(*argv, "nntp") == 0)

+                starttls_proto = PROTO_NNTP;

+            else if (strcmp(*argv, "sieve") == 0)

+                starttls_proto = PROTO_SIEVE;

+            else if (strcmp(*argv, "ldap") == 0)

+                starttls_proto = PROTO_LDAP;

             else

                 goto bad;

+        } else if (strcmp(*argv, "-xmpphost") == 0) {

+            if (--argc < 1)

+                goto bad;

+            xmpphost = *(++argv);

+        } else if (strcmp(*argv, "-name") == 0) {

+            if (--argc < 1)

+                goto bad;

+            ehlo = *(++argv);

         }

 #ifndef OPENSSL_NO_ENGINE

         else if (strcmp(*argv, "-engine") == 0) {

@@ -1599,19 +1642,24 @@ int MAIN(int argc, char **argv)

      * BIO into the chain that is removed again later on to not disturb the

      * rest of the s_client operation.

      */

-    if (starttls_proto == PROTO_SMTP) {

+    if (starttls_proto == PROTO_SMTP || starttls_proto == PROTO_LMTP) {

         int foundit = 0;

         BIO *fbio = BIO_new(BIO_f_buffer());

         BIO_push(fbio, sbio);

-        /* wait for multi-line response to end from SMTP */

+        /* Wait for multi-line response to end from LMTP or SMTP */

         do {

             mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);

         }

         while (mbuf_len > 3 && mbuf[3] == '-');

-        /* STARTTLS command requires EHLO... */

-        BIO_printf(fbio, "EHLO openssl.client.net\r\n");

+        if (starttls_proto == PROTO_LMTP)

+            BIO_printf(fbio, "LHLO %s\r\n", ehlo);

+        else

+            BIO_printf(fbio, "EHLO %s\r\n", ehlo);

         (void)BIO_flush(fbio);

-        /* wait for multi-line response to end EHLO SMTP response */

+        /*

+         * Wait for multi-line response to end LHLO LMTP or EHLO SMTP

+         * response.

+         */

         do {

             mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);

             if (strstr(mbuf, "STARTTLS"))

@@ -1630,10 +1678,15 @@ int MAIN(int argc, char **argv)

     } else if (starttls_proto == PROTO_POP3) {

         BIO_read(sbio, mbuf, BUFSIZZ);

         BIO_printf(sbio, "STLS\r\n");

-        BIO_read(sbio, sbuf, BUFSIZZ);

+        mbuf_len = BIO_read(sbio, sbuf, BUFSIZZ);

+        if (mbuf_len < 0) {

+            BIO_printf(bio_err, "BIO_read failed\n");

+            goto end;

+        }

     } else if (starttls_proto == PROTO_IMAP) {

         int foundit = 0;

         BIO *fbio = BIO_new(BIO_f_buffer());

+

         BIO_push(fbio, sbio);

         BIO_gets(fbio, mbuf, BUFSIZZ);

         /* STARTTLS command requires CAPABILITY... */

@@ -1669,27 +1722,287 @@ int MAIN(int argc, char **argv)

         BIO_printf(sbio, "AUTH TLS\r\n");

         BIO_read(sbio, sbuf, BUFSIZZ);

     }

-    if (starttls_proto == PROTO_XMPP) {

+    else if (starttls_proto == PROTO_XMPP || starttls_proto == PROTO_XMPP_SERVER) {

         int seen = 0;

         BIO_printf(sbio, "

                    "xmlns:stream='http://etherx.jabber.org/streams' "

-                   "xmlns='jabber:client' to='%s' version='1.0'>", host);

+                   "xmlns='jabber:%s' to='%s' version='1.0'>",

+                   starttls_proto == PROTO_XMPP ? "client" : "server",

+                   xmpphost ? xmpphost : host);

         seen = BIO_read(sbio, mbuf, BUFSIZZ);

+        if (seen < 0) {

+            BIO_printf(bio_err, "BIO_read failed\n");

+            goto end;

+        }

         mbuf[seen] = 0;

-        while (!strstr

-               (mbuf, "

-            if (strstr(mbuf, "/stream:features>"))

-                goto shut;

+        while (!strcasestr

+               (mbuf, "

+               && !strcasestr(mbuf,

+                              "

+        {

             seen = BIO_read(sbio, mbuf, BUFSIZZ);

+

+            if (seen <= 0)

+               goto shut;

+

             mbuf[seen] = 0;

         }

         BIO_printf(sbio,

                    "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");

         seen = BIO_read(sbio, sbuf, BUFSIZZ);

+        if (seen < 0) {

+            BIO_printf(bio_err, "BIO_read failed\n");

+            goto shut;

+        }

         sbuf[seen] = 0;

         if (!strstr(sbuf, "

             goto shut;

         mbuf[0] = 0;

+    } else if (starttls_proto == PROTO_TELNET) {

+        static const unsigned char tls_do[] = {

+            /* IAC    DO   START_TLS */

+               255,   253, 46

+        };

+        static const unsigned char tls_will[] = {

+            /* IAC  WILL START_TLS */

+               255, 251, 46

+        };

+        static const unsigned char tls_follows[] = {

+            /* IAC  SB   START_TLS FOLLOWS IAC  SE */

+               255, 250, 46,       1,      255, 240

+        };

+        int bytes;

+

+        /* Telnet server should demand we issue START_TLS */

+        bytes = BIO_read(sbio, mbuf, BUFSIZZ);

+        if (bytes != 3 || memcmp(mbuf, tls_do, 3) != 0)

+            goto shut;

+        /* Agree to issue START_TLS and send the FOLLOWS sub-command */

+        BIO_write(sbio, tls_will, 3);

+        BIO_write(sbio, tls_follows, 6);

+        (void)BIO_flush(sbio);

+        /* Telnet server also sent the FOLLOWS sub-command */

+        bytes = BIO_read(sbio, mbuf, BUFSIZZ);

+        if (bytes != 6 || memcmp(mbuf, tls_follows, 6) != 0)

+            goto shut;

+    } else if (starttls_proto == PROTO_IRC) {

+        int numeric;

+        BIO *fbio = BIO_new(BIO_f_buffer());

+

+        BIO_push(fbio, sbio);

+        BIO_printf(fbio, "STARTTLS\r\n");

+        (void)BIO_flush(fbio);

+        width = SSL_get_fd(con) + 1;

+

+        do {

+            numeric = 0;

+

+            FD_ZERO(&readfds);

+            openssl_fdset(SSL_get_fd(con), &readfds);

+            timeout.tv_sec = S_CLIENT_IRC_READ_TIMEOUT;

+            timeout.tv_usec = 0;

+            /*

+             * If the IRCd doesn't respond within

+             * S_CLIENT_IRC_READ_TIMEOUT seconds, assume

+             * it doesn't support STARTTLS. Many IRCds

+             * will not give _any_ sort of response to a

+             * STARTTLS command when it's not supported.

+             */

+            if (!BIO_get_buffer_num_lines(fbio)

+                && !BIO_pending(fbio)

+                && !BIO_pending(sbio)

+                && select(width, (void *)&readfds, NULL, NULL,

+                          &timeout) < 1) {

+                BIO_printf(bio_err,

+                           "Timeout waiting for response (%d seconds).\n",

+                           S_CLIENT_IRC_READ_TIMEOUT);

+                break;

+            }

+

+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);

+            if (mbuf_len < 1 || sscanf(mbuf, "%*s %d", &numeric) != 1)

+                break;

+            /* :example.net 451 STARTTLS :You have not registered */

+            /* :example.net 421 STARTTLS :Unknown command */

+            if ((numeric == 451 || numeric == 421)

+                && strstr(mbuf, "STARTTLS") != NULL) {

+                BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);

+                break;

+            }

+            if (numeric == 691) {

+                BIO_printf(bio_err, "STARTTLS negotiation failed: ");

+                ERR_print_errors(bio_err);

+                break;

+            }

+        } while (numeric != 670);

+

+        (void)BIO_flush(fbio);

+        BIO_pop(fbio);

+        BIO_free(fbio);

+        if (numeric != 670) {

+            BIO_printf(bio_err, "Server does not support STARTTLS.\n");

+            ret = 1;

+            goto shut;

+        }

+    } else if (starttls_proto == PROTO_POSTGRES) {

+        static const unsigned char ssl_request[] = {

+            /* Length        SSLRequest */

+               0, 0, 0, 8,   4, 210, 22, 47

+        };

+        int bytes;

+

+        /* Send SSLRequest packet */

+        BIO_write(sbio, ssl_request, 8);

+        (void)BIO_flush(sbio);

+

+        /* Reply will be a single S if SSL is enabled */

+        bytes = BIO_read(sbio, sbuf, BUFSIZZ);

+        if (bytes != 1 || sbuf[0] != 'S')

+            goto shut;

+    } else if (starttls_proto == PROTO_NNTP) {

+        int foundit = 0;

+        BIO *fbio = BIO_new(BIO_f_buffer());

+

+        BIO_push(fbio, sbio);

+        BIO_gets(fbio, mbuf, BUFSIZZ);

+        /* STARTTLS command requires CAPABILITIES... */

+        BIO_printf(fbio, "CAPABILITIES\r\n");

+        (void)BIO_flush(fbio);

+        /* wait for multi-line CAPABILITIES response */

+        do {

+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);

+            if (strstr(mbuf, "STARTTLS"))

+                foundit = 1;

+        } while (mbuf_len > 1 && mbuf[0] != '.');

+        (void)BIO_flush(fbio);

+        BIO_pop(fbio);

+        BIO_free(fbio);

+        if (!foundit)

+            BIO_printf(bio_err,

+                       "Didn't find STARTTLS in server response,"

+                       " trying anyway...\n");

+        BIO_printf(sbio, "STARTTLS\r\n");

+        mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);

+        if (mbuf_len < 0) {

+            BIO_printf(bio_err, "BIO_read failed\n");

+            goto end;

+        }

+        mbuf[mbuf_len] = '\0';

+        if (strstr(mbuf, "382") == NULL) {

+            BIO_printf(bio_err, "STARTTLS failed: %s", mbuf);

+            goto shut;

+        }

+    } else if (starttls_proto == PROTO_SIEVE) {

+        int foundit = 0;

+        BIO *fbio = BIO_new(BIO_f_buffer());

+

+        BIO_push(fbio, sbio);

+        /* wait for multi-line response to end from Sieve */

+        do {

+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);

+            /*

+             * According to RFC 5804 ยง 1.7, capability

+             * is case-insensitive, make it uppercase

+             */

+            if (mbuf_len > 1 && mbuf[0] == '"') {

+                make_uppercase(mbuf);

+                if (strncmp(mbuf, "\"STARTTLS\"", 10) == 0)

+                    foundit = 1;

+            }

+        } while (mbuf_len > 1 && mbuf[0] == '"');

+        (void)BIO_flush(fbio);

+        BIO_pop(fbio);

+        BIO_free(fbio);

+        if (!foundit)

+            BIO_printf(bio_err,

+                       "Didn't find STARTTLS in server response,"

+                       " trying anyway...\n");

+        BIO_printf(sbio, "STARTTLS\r\n");

+        mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);

+        if (mbuf_len < 0) {

+            BIO_printf(bio_err, "BIO_read failed\n");

+            goto end;

+        }

+        mbuf[mbuf_len] = '\0';

+        if (mbuf_len < 2) {

+            BIO_printf(bio_err, "STARTTLS failed: %s", mbuf);

+            goto shut;

+        }

+        /*

+         * According to RFC 5804 ยง 2.2, response codes are case-

+         * insensitive, make it uppercase but preserve the response.

+         */

+        strncpy(sbuf, mbuf, 2);

+        make_uppercase(sbuf);

+        if (strncmp(sbuf, "OK", 2) != 0) {

+            BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);

+            goto shut;

+        }

+    } else if (starttls_proto == PROTO_LDAP) {

+        /* StartTLS Operation according to RFC 4511 */

+        static char ldap_tls_genconf[] = "asn1=SEQUENCE:LDAPMessage\n"

+            "[LDAPMessage]\n"

+            "messageID=INTEGER:1\n"

+            "extendedReq=EXPLICIT:23A,IMPLICIT:0C,"

+            "FORMAT:ASCII,OCT:1.3.6.1.4.1.1466.20037\n";

+        long errline = -1;

+        char *genstr = NULL;

+        int result = -1;

+        ASN1_TYPE *atyp = NULL;

+        BIO *ldapbio = BIO_new(BIO_s_mem());

+        CONF *cnf = NCONF_new(NULL);

+

+        if (cnf == NULL) {

+            BIO_free(ldapbio);

+            goto end;

+        }

+        BIO_puts(ldapbio, ldap_tls_genconf);

+        if (NCONF_load_bio(cnf, ldapbio, &errline) <= 0) {

+            BIO_free(ldapbio);

+            NCONF_free(cnf);

+            if (errline <= 0) {

+                BIO_printf(bio_err, "NCONF_load_bio failed\n");

+                goto end;

+            } else {

+                BIO_printf(bio_err, "Error on line %ld\n", errline);

+                goto end;

+            }

+        }

+        BIO_free(ldapbio);

+        genstr = NCONF_get_string(cnf, "default", "asn1");

+        if (genstr == NULL) {

+            NCONF_free(cnf);

+            BIO_printf(bio_err, "NCONF_get_string failed\n");

+            goto end;

+        }

+        atyp = ASN1_generate_nconf(genstr, cnf);

+        if (atyp == NULL) {

+            NCONF_free(cnf);

+            BIO_printf(bio_err, "ASN1_generate_nconf failed\n");

+            goto end;

+        }

+        NCONF_free(cnf);

+        /* Send SSLRequest packet */

+        BIO_write(sbio, atyp->value.sequence->data,

+                  atyp->value.sequence->length);

+        (void)BIO_flush(sbio);

+        ASN1_TYPE_free(atyp);

+

+        mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);

+        if (mbuf_len < 0) {

+            BIO_printf(bio_err, "BIO_read failed\n");

+            goto end;

+        }

+        result = ldap_ExtendedResponse_parse(mbuf, mbuf_len);

+        if (result < 0) {

+            BIO_printf(bio_err, "ldap_ExtendedResponse_parse failed\n");

+            goto shut;

+        } else if (result > 0) {

+            BIO_printf(bio_err, "STARTTLS failed, LDAP Result Code: %i\n",

+                       result);

+            goto shut;

+        }

+        mbuf_len = 0;

     }

     for (;;) {

@@ -1738,7 +2051,7 @@ int MAIN(int argc, char **argv)

                     full_log--;

                 if (starttls_proto) {

-                    BIO_printf(bio_err, "%s", mbuf);

+                    BIO_write(bio_err, mbuf, mbuf_len);

                     /* We don't need to know any more */

                     starttls_proto = PROTO_OFF;

                 }

@@ -2372,3 +2685,87 @@ static int ocsp_resp_cb(SSL *s, void *ar

 }

 #endif

+

+static int ldap_ExtendedResponse_parse(const char *buf, long rem)

+{

+    const unsigned char *cur, *end;

+    long len;

+    int tag, xclass, inf, ret = -1;

+

+    cur = (const unsigned char *)buf;

+    end = cur + rem;

+

+    /*

+     * From RFC 4511:

+     *

+     *    LDAPMessage ::= SEQUENCE {

+     *         messageID       MessageID,

+     *         protocolOp      CHOICE {

+     *              ...

+     *              extendedResp          ExtendedResponse,

+     *              ... },

+     *         controls       [0] Controls OPTIONAL }

+     *

+     *    ExtendedResponse ::= [APPLICATION 24] SEQUENCE {

+     *         COMPONENTS OF LDAPResult,

+     *         responseName     [10] LDAPOID OPTIONAL,

+     *         responseValue    [11] OCTET STRING OPTIONAL }

+     *

+     *    LDAPResult ::= SEQUENCE {

+     *         resultCode         ENUMERATED {

+     *              success                      (0),

+     *              ...

+     *              other                        (80),

+     *              ...  },

+     *         matchedDN          LDAPDN,

+     *         diagnosticMessage  LDAPString,

+     *         referral           [3] Referral OPTIONAL }

+     */

+

+    /* pull SEQUENCE */

+    inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);

+    if (inf != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE ||

+        (rem = end - cur, len > rem)) {

+        BIO_printf(bio_err, "Unexpected LDAP response\n");

+        goto end;

+    }

+

+    rem = len;  /* ensure that we don't overstep the SEQUENCE */

+

+    /* pull MessageID */

+    inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);

+    if (inf != V_ASN1_UNIVERSAL || tag != V_ASN1_INTEGER ||

+        (rem = end - cur, len > rem)) {

+        BIO_printf(bio_err, "No MessageID\n");

+        goto end;

+    }

+

+    cur += len; /* shall we check for MessageId match or just skip? */

+

+    /* pull [APPLICATION 24] */

+    rem = end - cur;

+    inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);

+    if (inf != V_ASN1_CONSTRUCTED || xclass != V_ASN1_APPLICATION ||

+        tag != 24) {

+        BIO_printf(bio_err, "Not ExtendedResponse\n");

+        goto end;

+    }

+

+    /* pull resultCode */

+    rem = end - cur;

+    inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);

+    if (inf != V_ASN1_UNIVERSAL || tag != V_ASN1_ENUMERATED || len == 0 ||

+        (rem = end - cur, len > rem)) {

+        BIO_printf(bio_err, "Not LDAPResult\n");

+        goto end;

+    }

+

+    /* len should always be one, but just in case... */

+    for (ret = 0, inf = 0; inf < len; inf++) {

+        ret <<= 8;

+        ret |= cur[inf];

+    }

+    /* There is more data, but we don't care... */

+ end:

+    return ret;

+}

diff -up openssl-1.0.2k/doc/apps/s_client.pod.starttls openssl-1.0.2k/doc/apps/s_client.pod

--- openssl-1.0.2k/doc/apps/s_client.pod.starttls	2017-03-09 17:35:28.684605455 +0100

+++ openssl-1.0.2k/doc/apps/s_client.pod	2017-03-09 17:42:54.455070967 +0100

@@ -46,6 +46,8 @@ B<openssl> B<s_client>

 [B<-krb5svc service>]

 [B<-serverpref>]

 [B<-starttls protocol>]

+[B<-xmpphost hostname>]

+[B<-name hostname>]

 [B<-engine id>]

 [B<-tlsextdebug>]

 [B<-no_ticket>]

@@ -239,7 +241,20 @@ need keys for that principal in its keyt

 send the protocol-specific message(s) to switch to TLS for communication.

 B<protocol> is a keyword for the intended protocol.  Currently, the only

-supported keywords are "smtp", "pop3", "imap", and "ftp".

+supported keywords are "smtp", "pop3", "imap", "ftp", "xmpp", "xmpp-server",

+"irc", "postgres", "lmtp", "nntp", "sieve" and "ldap".

+

+=item B<-xmpphost hostname>

+

+This option, when used with "-starttls xmpp" or "-starttls xmpp-server",

+specifies the host for the "to" attribute of the stream element.

+If this option is not specified, then the host specified with "-connect"

+will be used.

+

+=item B<-name hostname>

+

+the host name to use with "-starttls smtp".

+If this option is not specified, the default "openssl.client.net" will be used.

 =item B<-tlsextdebug>