704990 - sslportal.ipoc.btservices.fr is intolerant to TLS 1/n-1 record splitting

Status: RESOLVED WORKSFORME

(Tech Evangelism Graveyard :: French, defect)

Description

[Matp75]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0) Gecko/20100101 Firefox/9.0
Build ID: 20111116091359

Steps to reproduce:

Try to access https://sslportal.ipoc.btservices.fr 
Try to access https://212.121.161.50
both are vpn ssl site
first one has a valid certificate (verisign)
second one a self-signed.



Actual results:

firefox has successfully established at least part of the ssl connection as I can see in the url bar that the connection has been encrypted

I have an error message (translated from french) in both case : 
connection to server has been reinitialized while loading


Expected results:

access the real website

I've done additional tests : 
same test from several locations : doesn't change
restart firefox, shift-reload 
same machine : IE 7 -> access ok
other machine, same network, firefox 8 -> access ok
other machine, linux os, fx 9.0b3 downloaded from mozilla, fresh profile -> same pb

I can acces other ssl sites.
I could access these sites before with firefox on the same computer.
I know both sites are vpn ssl with Fortinet technology.
Did something changed with firefox 9 and ssl which could explain this ?

This look like a firefox 9 regression to me.

Comment 1

[Matthias Versen [:Matti]]

looks like bug 702111

Comment 2

[Boris Zbarsky [:bzbarsky]]

Shouldn't this be an evangelism bug, then?

Especially for Fortinet?

Comment 3

[Matp75]

hello,

I've had a support ticket opened at Fortinet.
They asked to upgrade to last version (25nov2011 version), which was done yesterday on https://212.121.161.50/
it hasn't changed the pb.
I'm replicating now with Fx10 (aurora) as the patch has been backouted from Fx9 beta if I understand well what's in bug 702111

Comment 4

[Matp75]

This has been fixed by Fortinet with version Fortios 4.0MR3patch 5 on 1st February.
Upgrade to this version fix the problem. Connection With Fx10 to vpnssl is ok.