Closed darkphoenix closed 4 years ago
I do see the same behavior in my installation as well. Worked fine with Firefox 79.
With my installation using master commit https://github.com/mozilla-services/syncserver/commit/e1aab54cbcb6e570979835789f7b4624eebdc875 as of July 3rd sync is working fine with Firefox 80.
Yes, this is definitely broken! See https://github.com/mozilla-services/syncserver/issues/218 and https://github.com/mozilla-services/syncserver/issues/224
I think this probably makes this a duplicate of #224, but I feel like that one was prematurely closed because they got it working - which, given that it still doesn't work with the defaults, doesn't seem like a fix to me.
Same here. I get signed in but I am signed out again after a couple of minutes.
This probably doesn't belong here but Mozilla makes avoiding their cloud complicated enough by requiring users to configure custom sync servers in about:config
rather than simply offering a "custom sync server" option in the GUI for those of us who are (for good reason) paranoid about cloud services.
This new issue makes me worry that syncserver
is somewhat "out of date", seeing that disabling the about:config
options mentioned in #224 appears to "turn off" a set of new features which the latest version of "sync" requires.
I'm worried that I may be forced to either trust Mozilla's cloud or stop syncing my Firefox instances at some point in the near future simply because syncserver
is no longer compatible.
Unfortunately my installation is a quite outdated. On June 1st I tried to upgrade / re-install my virtualenv and then got the following errors:
[Mon Jun 01 17:45:54.277069 2020] [wsgi:error] [pid 53988] [remote 192.0.2.23:50325] from cryptography.hazmat.bindings._openssl import ffi, lib
[Mon Jun 01 17:45:54.277331 2020] [wsgi:error] [pid 53988] [remote 192.0.2.23:50325] ImportError: /opt/mozilla/syncserver/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/_openssl.so: Undefined symbol "OPENSSL_no_config"
Back then the system was running FreeBSD 11.3 with python 3.7 as default (2.7 still installed). In the meantime I did upgrade FreeBSD to 11.4 and just once tried again to re-install the virtualenv from scratch and get some different errors with this long traceback:
[Fri Aug 28 21:33:04.667785 2020] [wsgi:error] [pid 64609] /opt/mozilla/syncserver/local/lib/python2.7/site-packages/pymysql/_auth.py:10: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in a future release.
[Fri Aug 28 21:33:04.667864 2020] [wsgi:error] [pid 64609] from cryptography.hazmat.backends import default_backend
[Fri Aug 28 21:33:06.606492 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] mod_wsgi (pid=64609): Failed to exec Python script file '/opt/mozilla/syncserver/ffsync.wsgi'.
[Fri Aug 28 21:33:06.606560 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] mod_wsgi (pid=64609): Exception occurred processing WSGI script '/opt/mozilla/syncserver/ffsync.wsgi'.
[Fri Aug 28 21:33:06.606637 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] Traceback (most recent call last):
[Fri Aug 28 21:33:06.606696 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/ffsync.wsgi", line 40, in <module>
[Fri Aug 28 21:33:06.606907 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] application = loadapp('config:%s'% ini_file)
[Fri Aug 28 21:33:06.606942 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 253, in loadapp
[Fri Aug 28 21:33:06.607817 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return loadobj(APP, uri, name=name, **kw)
[Fri Aug 28 21:33:06.607871 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 278, in loadobj
[Fri Aug 28 21:33:06.607956 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return context.create()
[Fri Aug 28 21:33:06.607984 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 715, in create
[Fri Aug 28 21:33:06.608041 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return self.object_type.invoke(self)
[Fri Aug 28 21:33:06.608068 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 152, in invoke
[Fri Aug 28 21:33:06.608123 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return fix_call(context.object, context.global_conf, **context.local_conf)
[Fri Aug 28 21:33:06.608158 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/paste/deploy/util.py", line 55, in fix_call
[Fri Aug 28 21:33:06.608397 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] val = callable(*args, **kw)
[Fri Aug 28 21:33:06.608431 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/syncserver/__init__.py", line 275, in main
[Fri Aug 28 21:33:06.608491 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] config = get_configurator(global_config, **settings)
[Fri Aug 28 21:33:06.608528 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/syncserver/__init__.py", line 267, in get_configurator
[Fri Aug 28 21:33:06.608579 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] config.include(includeme)
[Fri Aug 28 21:33:06.608700 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/config/__init__.py", line 755, in include
[Fri Aug 28 21:33:06.608768 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] c(configurator)
[Fri Aug 28 21:33:06.608797 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/syncserver/__init__.py", line 156, in includeme
[Fri Aug 28 21:33:06.608846 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] config.include("tokenserver", route_prefix="/token")
[Fri Aug 28 21:33:06.608873 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/config/__init__.py", line 755, in include
[Fri Aug 28 21:33:06.608929 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] c(configurator)
[Fri Aug 28 21:33:06.608955 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/tokenserver/__init__.py", line 35, in includeme
[Fri Aug 28 21:33:06.609389 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] config.scan("tokenserver.views")
[Fri Aug 28 21:33:06.609453 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/config/__init__.py", line 920, in scan
[Fri Aug 28 21:33:06.609535 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] package = self.maybe_dotted(package)
[Fri Aug 28 21:33:06.609565 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/config/__init__.py", line 825, in maybe_dotted
[Fri Aug 28 21:33:06.609622 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return self.name_resolver.maybe_resolve(dotted)
[Fri Aug 28 21:33:06.609650 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/path.py", line 320, in maybe_resolve
[Fri Aug 28 21:33:06.610099 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return self._resolve(dotted, package)
[Fri Aug 28 21:33:06.610156 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/path.py", line 327, in _resolve
[Fri Aug 28 21:33:06.610278 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] return self._zope_dottedname_style(dotted, package)
[Fri Aug 28 21:33:06.610306 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/pyramid/path.py", line 382, in _zope_dottedname_style
[Fri Aug 28 21:33:06.610360 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] __import__(used)
[Fri Aug 28 21:33:06.610388 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/tokenserver/views.py", line 17, in <module>
[Fri Aug 28 21:33:06.611069 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] from tokenserver.verifiers import (
[Fri Aug 28 21:33:06.611118 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/tokenserver/verifiers.py", line 18, in <module>
[Fri Aug 28 21:33:06.611567 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] import fxa.oauth
[Fri Aug 28 21:33:06.611611 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/fxa/oauth.py", line 16, in <module>
[Fri Aug 28 21:33:06.612049 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] from fxa._utils import APIClient, scope_matches, get_hmac
[Fri Aug 28 21:33:06.612087 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/fxa/_utils.py", line 35, in <module>
[Fri Aug 28 21:33:06.612656 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] import fxa.crypto
[Fri Aug 28 21:33:06.612701 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/fxa/crypto.py", line 10, in <module>
[Fri Aug 28 21:33:06.613002 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] from cryptography.hazmat.backends.openssl import backend
[Fri Aug 28 21:33:06.613039 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/__init__.py", line 7, in <module>
[Fri Aug 28 21:33:06.613199 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] from cryptography.hazmat.backends.openssl.backend import backend
[Fri Aug 28 21:33:06.613231 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 117, in <module>
[Fri Aug 28 21:33:06.615430 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] from cryptography.hazmat.bindings.openssl import binding
[Fri Aug 28 21:33:06.615494 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] File "/opt/mozilla/syncserver/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module>
[Fri Aug 28 21:33:06.615786 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] from cryptography.hazmat.bindings._openssl import ffi, lib
[Fri Aug 28 21:33:06.615858 2020] [wsgi:error] [pid 64609] [remote 192.0.2.23:1670] ImportError: /opt/mozilla/syncserver/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/_openssl.so: Undefined symbol "OPENSSL_no_config"
OpenSSL from FreeBSD Ports is at 1.1.1g Any idea what could be wrong with my setup / configs?
In the meantime all your comments arrived, and I did revert back to the old working (with FF 79) virtualenv and then also set identity.fxaccounts.useSessionTokensForOAuth and identity.sync.useOAuthForSyncToken to false in FF 80, and so far it is at least syncing.
OpenSSL is super finicky, greatly complicated by the cryptography package. FWIW, the way I got around this problem was to run the syncserver inside of a docker image so that it can bring in the older OpenSSL version, and not cause all sorts of trouble on my main system. I've found that the pypy:2.7-jessie
base has the right versions of OpenSSL. (Which means we can probably update the syncserver Dockerfile to use it.)
Is it a great solution? No. It's not. But we're open source and quite happily accept PRs until we've got syncstorage-rs stand alone ready to go. We also happily take PRs for that as well.
If you do choose to run docker, be sure to prune after you build your docker image. (I learned that one the hard way.)
Setting identity.sync.useOAuthForSyncToken to False worked for me. #218 provided solution at the time.
The solution of setting that flag did fix it for me, but that's arguably not the point. This is still the officially "recommended" version of running your own sync server, and until the Rust version is "done" enough they recommend that instead, it should work by default. So I'd like to have one of three things: a) implement the new auth mechanism in this repo, or b) implement an automatic fallback in Firefox in case the OAuth mechanism fails, or c) if all else fails at least put a conspicuous note on top of the README for this repo because honestly, it took me way too long to figure this out.
Also this temporary solution is not applicable in Android. I can't find a way to set identity.sync.useOAuthForSyncToken to False in Android.
Which Firefox version on Android? Because version before 79 works without it. And 79 appears to no longer support using custom sync server. At least for me it logged me out of Firefox account on version upgrade and when I logged in again, it no longer connected my sync server.
Hi,
you can add the syncserver with enabling debug in Firefox 79 on Android. Own syncserver with Firefox 80 (79 on Android)
Regards Alex
Hi,
you can add the syncserver with enabling debug in Firefox 79 on Android. Own syncserver with Firefox 80 (79 on Android)
Regards Alex
Yes. That's how I enabled custom sync server in Android FF 79. But no way to set identity.sync.useOAuthForSyncToken to False.
Yes, for me it works without setting identity.sync.useOAuthForSyncToken to False on android.
Yes, for me it works without setting identity.sync.useOAuthForSyncToken to False on android.
Can confirm I didn't have issues with the new Firefox for Android - well, I had plenty of issues, and I got signed out during the update, but I didn't have any problems signing in again and making it sync.
Ok, did not know, how to configure the url on Firefox 79 at Android. But after configuring URL and login into Firefox account tapping Syncronise now does nothing (there is no connection to sync server, status remains Syncronise now, never synced). Same url opens with JSON error, when just opening in browser.
Hey all, thanks for digging into this issue, I just wanted to not that I'm taking a look at it today to try to figure out what's going on. I'm hopeful that we can make it work with a small fix to the syncserver
repo.
The solution of setting that flag did fix it for me, but that's arguably not the point.
I agree with this, we need a solution that doesn't rely on setting that flag back to false; not least because that flag was designed for a slow feature rollout and we intend to remove it entirely in a future release of Firefox! (But just to be clear, I consider getting self-hosting working in the default config to be a blocker for us actually removing that flag, and have no intention of removing the useOAuthForSyncToken
flag before fixing this bug!)
Can I ask, folks running into this issue, are you using a self-hosted account server as well, or using the syncserver
repo with the default Mozilla-hosted account service?
I tried to reproduce this using a fresh build of syncserver
running locally and a fresh firefox profile, but I wasn't able to - it synced successfully first try with useOAuthForSyncToken=true
. This makes me suspect it may be an issue for existing accounts only.
I tried to reproduce this using a fresh build of
syncserver
running locally and a fresh firefox profile, but I wasn't able to - it synced successfully first try withuseOAuthForSyncToken=true
. This makes me suspect it may be an issue for existing accounts only.
No is not, with my syncserver
setup useOAuthForSyncToken=true
and existing accounts on official Firefox Accounts it's working like a charm. I only had issues with Firefox 79 for Android, but that's not the issue here.
My one coin would point into direction of syncserver
version itself. I'm using most current master branch commit https://github.com/mozilla-services/syncserver/commit/e1aab54cbcb6e570979835789f7b4624eebdc875 because last release 1.8.0 wasn't working with Ubuntu 18.04 LTS.
This makes me suspect it may be an issue for existing accounts only.
To clarify, I meant "accounts with an existing record in the syncserver database".
If this is an issue specifically with the upgrade path for existing accounts, then you may find that dropping and re-creating the users
table in your syncserver db allows you to get back up and running. This would cause all your clients to re-upload a full copy of their sync data to your server, so it's not a very good solution, but just mentioning it as a potential option.
My one coin would point into direction of syncserver version itself.
Indeed - for folks running into this issue, if you could also please confirm what commit of syncserver
you are current running, that would be helpful. So far I haven't been able to reproduce the issue.
I use the mozilla/syncserver
image.
digest sha256:53687d50617e2df45eaed2e381d9664f1da9fc9fcd75a4b4c4f13d1639aa8178
, this is the latest pushed version on docker hub.
In the image is no label for the used git commit.
Indeed - for folks running into this issue, if you could also please confirm what commit of
syncserver
you are current running, that would be helpful. So far I haven't been able to reproduce the issue.
I just realized that I was stuck on a 3 years old commit 4f4787eadf729be5dd92d27b25c4317784ce00a7 without me realizing. I now updated to e1aab54cbcb6e570979835789f7b4624eebdc875 and after going through the questionable "upgrade path" of manually adding new fields to the MySQL tables (see #214), the sync logs now say everything is fine.
So at least for me, the issue appears to be fixed now.
However, I think the "upgrade path" is an issue all by itself which needs to be looked into in the future to avoid issues like this popping up again. I created a new issue #226 to write down my thoughts on this.
My setup is the same as described by @JackGruber (docker).
Updating Firefox from 79 to 80 triggered the issue. Currently I use identity.sync.useOAuthForSyncToken=false
as workaround.
I use the normal firefox account service. Only the sync server is self hosted.
The account is "old", meaning that the account exists now for at least a year on that sync server. I remember having to do some manual update with MySQL somewhen last year or so...
Edit: fixed wrong workaround setting
I'm running 516807e natively - no Docker. I know it's not the most recent comment, but as far as I can tell nothing has changed in the actual code since, just the delete user data thing and something in CONTRIBUTING.md. This is actually the version I started off with, it never got updated. My FxA account is a few years old, though - but I've only been using Sync for a few months.
Running current HEAD (e1aab54) natively, with normal Firefox account service, (pretty) old database (2017?). I upgraded from a much older version of sync in July. Had no issues with Android, but desktop running most recent beta only works with the flag set to false.
dropping and re-creating the users table
@rfk I removed the whole database to start fresh and it still fails. I'm using the same image as @JackGruber
INFO:mozsvc.metrics:{"token.oauth.verify_failure": 1, "code": 401,…
EDIT: I just checked the image, it contains the git folder and is apparently up-to-date (i.e. commit e1aab54cbcb6e570979835789f7b4624eebdc875).
Same here, 403, latest Docker image
$ docker image list | grep syncserver
mozilla/syncserver latest c724aed9e2b4 2 months ago 155MB
~/docker/ffsync$ docker-compose pull
Pulling ffsync (mozilla/syncserver:latest)...
latest: Pulling from mozilla/syncserver
Digest: sha256:53687d50617e2df45eaed2e381d9664f1da9fc9fcd75a4b4c4f13d1639aa8178
Status: Image is up to date for mozilla/syncserver:latest
EDIT: and I tried with an existing and fresh database, didn't work with either. Using Mozilla-hosted auth.
a workaround for those who are using docker version of syncserver
docker-compose exec -u root syncserver /bin/sh -c "sed -i -e 's|tokenserver/archive/1.4.5.zip|tokenserver/archive/1.5.11.zip|' -e 's|server-syncstorage/archive/1.6.14.zip|server-syncstorage/archive/1.8.0.zip|' requirements.txt && apk add musl-dev gcc mysql-dev && pip install --upgrade --no-cache-dir -r requirements.txt"
docker-compose restart syncserver
the first line will result in error which is caused by fail to build readline
and just ignore it.
reference:https://github.com/mozilla-services/syncserver/issues/218#issuecomment-685720102
Update: Just simply update PyFxA which also works:
docker-compose exec -u root syncserver pip install --upgrade PyFxA==0.7.7
docker-compose restart syncserver
For folks who are using Docker, the merge of https://github.com/mozilla-services/syncserver/pull/227 should shortly trigger the build of a new docker image with the bug resolved. Please ping me in this issue if that doesn't seem to have happened within the next hour or so and I will investigate.
For folks running their own build, please try upgrading PyFxA as suggested in the comment above, something like ./local/bin/pip install --upgrade PyFxA==0.7.7
.
Thanks to @jackyzy823 for tracking this down, and @sbraz for the PR to pull in the necessary updates!
Something isn't right with the latest docker image. I'm getting this:
mozilla_sync | /usr/local/lib/python2.7/site-packages/requests/__init__.py:91: RequestsDependencyWarning: urllib3 (1.25.2) or chardet (3.0.4) doesn't match a supported version!
mozilla_sync | RequestsDependencyWarning)
mozilla_sync | ERROR:syncstorage.storage:Error while scanning package 'syncstorage.storage.spanner'
mozilla_sync | Traceback (most recent call last):
mozilla_sync | File "/usr/local/lib/python2.7/site-packages/venusian/__init__.py", line 230, in scan
mozilla_sync | __import__(modname)
mozilla_sync | File "/usr/local/lib/python2.7/site-packages/syncstorage/storage/spanner.py", line 19, in <module>
mozilla_sync | from google.api_core.exceptions import Aborted, AlreadyExists
mozilla_sync | ImportError: No module named google.api_core.exceptions
@mike2307 these are just warnings related to spanner backend (there's one for memcached too). I don't think the doc mentions them so I don't think they're worth adding to the image.
EDIT: I see the memcached warning was fixed on merge.
@sbraz Yes, I think it would be better to fix all of those warnings/errors. Otherwise it might be rather misleading when someone tries to track down other issues in the future....
@mike2307 it is caused by hard-coded requirements in server-syncstorage
's setup.py which is not track with requirements.txt
see https://github.com/mozilla-services/server-syncstorage/blob/d370a488155adeb80ee6f1bc016a4aa9d009f181/setup.py#L7
@rfk would you please make this setup.py like tokenserver
's one which reads from requirements.txt. Thanks.
@rfk would you please make this setup.py like tokenserver's one which reads from requirements.txt.
Ack, good idea; https://github.com/mozilla-services/server-syncstorage/pull/153
Is it possible that this setup with a custom sync server just breaks in FF 80? I have it working on older installs, but as soon as I update it keeps asking me to sign in again and according to the sync logs it gets a 401 from my token server.