Description of problem:
It is not possible to connect to the Oracle Internet Directory
(version 9.0.4) with OpenLDAP using LDAPs.

The problem is related to an security fix introduced in OpenSSL
version 0.9.6d. (see: Implement a countermeasure against a 
vulnerability recently found in CBC ciphersuites in SSL 3.0/TLS 1.0
by Bodo Moeller in the openssl changelog).

This fix seems not to be compliant with the SSL implementation
used by Oracle.

Solution would be to set the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
option within the SSL_CTX of the libldap code. (see the attached
patch).

This patch on the other side may cause security problems :-(.


Version-Release number of selected component (if applicable):
Fedora Core 1:
OpenLDAP 2.1.22-8
OpenSSL 0.9.7a-33.10

RHEL 3:
OpenLDAP 2.0.27-11
OpenSSL 0.9.7a-22.1

How reproducible:
always

Steps to Reproduce:
1. setup a custom configset for Oracle Internet Directory using 
   SSL Server Authentication
2. create $HOME/ldaprc with:
   ---
   TLS_CACERT /home/frank/oid-caroot.pem
   TLS_REQCERT allow
   TLS_CIPHERS SSLv3
   ssl on
   tls_checkpeer no
   ---
3. try to perform the following ldapsearch command:
---
ldapsearch -D "cn=orcladmin,cn=Users,dc=fm-berger,dc=de" -w password
-H ldaps://fm-berger.de:4055/ -d 7 -b "cn=Users,dc=fm-berger,dc=de" -x
"(objectclass=*)"
---
see the attached output of this command.
  
Actual results:
1. initial SSL handshake works
2. ldap-bind request is send
3. connection is terminated by OID lapsearch output:
---
TLS trace: SSL3 alert read:fatal:close notify
ldap_read: want=8, got=0
 
ldap_perror
ldap_bind: Can't contact LDAP server (-1)
---

Expected results:
successful ldaps connection with result.

Additional info:
This issue is also filed to Oracle Metalink under the TAR-ID:
3788414.996 (EL 5/20 MORE INFORMATION FOR OID/SSL / TLS SUPPORTED?)