to exhaust all protocol units received from the transport layer.
I think this is the necessary fix for the TLS-data-ready/
socket-not-ready issue, but I have not experimented that problem
yet, so I am unsure about its effectiveness.
Now, do we need something like that for connection_write?  How would
we go about implementing it?

connection_init so that we get into the select() logic.
Make use of new flags in the connection.
BTW, and before I forget, it sort of works.  I have connected with
a Netscape client using a secure connection and did a failed
search (my test database is empty), but the trace looked correct.
Make sure you have your CA certificate in your Netscape preinstalled.
Otherwise, the connection fails with error 0xFFFFFFFF that is rather
uninformative.

Set flags without relying on errno (this change may be gratuitous
or wrong).

section (that is, not SASL).  The second to indicate that we need to
do SSL_accept on this connection.

former is a pseudo attribute type used internally by slapd to represent
the distinguished name of an entry and its existance should not be
visible.  The latter is an "abstract" attribute type that is not meant
to exist in practice except as supertype of other dn-valued types.
So, the definition of attribute type 2.5.4.49 has been changed to be
just distinguishedName.  Work on the OPENLDAP_DEVEL_SCHEMA branch will
treat pseudo attributes especially and will not be visible to the
clients.

Remove server side controls.
Add Digest-MD5 project.

Includes support for update referral for each replicated backend.
	Reworked replication test to use update referral.
Includes major rewrite of response encoding codes (result.c).
Includes reworked alias support and eliminates old suffix alias codes
(can be emulated using named alias).
Includes (untested) support for the Manage DSA IT control.
Works in LDAPv2 world.  Still testing in LDAPv3 world.
Added default referral (test009) test.

More error checking and reporting.
Slowly getting there, SSL_accept succeeds now, but connection breaks
immediately after that (my glue logic with slapd is broken).

the default context is initialized before the config file is read,
so the locations are not know at context initialization.

Change temporarily the default protocol from TLSv1 to SSLv3 with
fallback to SSLv2.  This seems necessary for slapd to accept connections
from Netscape.
Try to set the cipher list in the default context.  Does not semm to
work yet.

taken care of.  The second, however, on remove_old_locks is unclear.

Init the TLS environment if necessary.  Lots of things needed here,
in particular, preparing properly the default context.

use TLS right away or not on that connection.

Only bind on TLS port if explicitly requested with -T, otherwise all
kind of conflicts happen when running tests.

Bind and listen on TLS port too

Extend slapd_args with TLS info

Define LDAP_TLS_PORT as 636, the default port for LDAP over raw TLS

Fix detection of socklen_t
Rebuild configure to reflect that