ldap timeouts not enforced for ldaps protocol

[trtan]

Description

According to site: https://bugs.php.net/bug.php?id=69574
I added LDAP_OPT_TIMEOUT to enforce bind operation time out. This worked for ldap protocol. But not for ldaps protocol.
steps to reproduce:

In one ssh session, I am running the following command to simulate a socket listener:
nc -l 636

And run following code:

<?php
$ldap = ldap_connect('ldaps://127.0.0.1:636');

ldap_set_option($ldap, LDAP_OPT_NETWORK_TIMEOUT, 3);
ldap_set_option($ldap, LDAP_OPT_TIMELIMIT, 3);
ldap_set_option($ldap, LDAP_OPT_TIMEOUT, 3);

ldap_bind($ldap);
?>

Resulted in this output:

This never times out

But I expected this output instead:

times out in 3 seconds. 

PHP Version

PHP 7.4.30

Operating System

Windows 10

[heiglandreas]

And did you try the recommended solution from the referenced bug?

Connection timeouts must be set before connecting.
Set LDAP_OPT_NETWORK_TIMEOUT globally before calling ldap_connect() by passing null in place of a connection.

ldap_set_option(null, LDAP_OPT_NETWORK_TIMEOUT, 3);
$ldap = ldap_connect('127.0.0.1:1234');
ldap_bind($ldap);

[heiglandreas]

And BTW: You are not testing the actual bind operation to time out but the tls connection to time out. Otherwise you'd need an LDAP-server to terminate the bind (the login credential verification and LDAP session creation process) process. Which doesn't work by simulating a disruption to any traffic on port 636.

[trtan]

Yes, I did try the recommended solution from the referenced bug. Still didn't work.
ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, 3);
ldap_set_option(NULL, LDAP_OPT_TIMELIMIT, 3);
ldap_set_option(NULL, LDAP_OPT_TIMEOUT, 3);
$ldap = ldap_connect('127.0.0.1:1234');
ldap_bind($ldap);

[trtan]

No matter which call gives timeout, should we get a timeout for the code? But we didn't get timeout. Is this a bug for PHP LDAP extension?

[valentinoeval]

For PHP Developers, We need a timeout for LDAP connection if the connection to the server can't be established.
Basic

[mjt0k]

This is a bug in OpenLDAP client, see https://bugs.openldap.org/show_bug.cgi?id=8047 https://git.openldap.org/openldap/openldap/-/merge_requests/727 and the fix is https://git.openldap.org/openldap/openldap/-/commit/5645e37044e77c72f8868ecf62b6c7983c0afc2b