1740972 - Edgewave/Iprism firewall server causes Firefox to think it's always behind a captive portal

Status: NEW

(Firefox :: Sync, defect, P3)

Description

[Abel]

Attachment: error-sync-1636756459210.txt

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0

Steps to reproduce:

1. Log in to windows 10 workstation
2. Launch Firefox
3. Log in to sync with [e-mail]
4. Nothing loads. No bookmarks, no addins, no history, nothing.

---

Sign out completely from all devices. (no mobile, only windows)
Repeat steps 1-4 on two more workstations.
Same results.

Actual results:

Nothing synced. It's as if I logged in as a blank, new profile.
1636756459210 Sync.LogManager DEBUG Flushing file log
1636756459214 FirefoxAccounts TRACE FxAccountsPush registerPushEndpoint
1636756459216 FirefoxAccounts DEBUG FxAccountsPush got subscription
1636756459216 Sync.BulkKeyBundle INFO BulkKeyBundle being created for undefined
1636756459217 FirefoxAccounts INFO registering with available commands: ["https://identity.mozilla.com/cmd/open-uri"]
1636756459217 FirefoxAccounts DEBUG registering new device details
1636756459218 Services.Common.RESTRequest DEBUG POST request to https://api.accounts.firefox.com/v1/account/device
1636756459218 Services.Common.RESTRequest DEBUG POST Length: 854
1636756459224 FirefoxAccounts TRACE finished write of json user data - took: 29
1636756459225 FirefoxAccounts DEBUG writing secure storage: ["scopedKeys","kSync","kXCS","kExtSync","kExtKbHash"]
1636756459225 FirefoxAccounts TRACE starting write of user data to the login manager
1636756459236 FirefoxAccounts TRACE finished write of user data to the login manager
1636756459244 Sync.LogManager DEBUG Log cleanup threshold time: 1635892459244
1636756459250 Sync.LogManager DEBUG Done deleting files.
1636756459316 Services.Common.RESTRequest DEBUG POST https://api.accounts.firefox.com/v1/account/device 200
1636756459316 Hawk DEBUG (Response) /account/device: code: 200 - Status text: OK
1636756459316 Hawk DEBUG Clock offset vs https://api.accounts.firefox.com/v1: -316
1636756459317 FirefoxAccounts DEBUG _updateAccountData with items: ["device"]
1636756459317 FirefoxAccounts DEBUG writing plain storage: ["email","sessionToken","uid","verified","device","oauthTokens","profileCache"]
1636756459317 FirefoxAccounts TRACE starting write of json user data: ["email","sessionToken","uid","verified","device","oauthTokens","profileCache"]
1636756459317 Sync.BulkKeyBundle INFO BulkKeyBundle being created for undefined
1636756459323 FirefoxAccounts TRACE finished write of json user data - took: 6
1636756459323 FirefoxAccounts DEBUG writing secure storage: ["scopedKeys","kSync","kXCS","kExtSync","kExtKbHash"]
1636756459323 FirefoxAccounts TRACE starting write of user data to the login manager
1636756459332 FirefoxAccounts TRACE finished write of user data to the login manager
1636756459418 Sync.SyncScheduler DEBUG Clearing sync triggers and the global score.
1636756465670 Sync.RemoteTabs INFO Doing a tab sync.
1636756465670 Sync.Service DEBUG User-Agent: Firefox/94.0.1 (Windows NT 10.0; Win64; x64) FxSync/1.96.0.20211103134640.desktop
1636756465670 Sync.Service INFO Starting sync at 2021-11-12 14:34:25 in browser session mLdxTOZTa5la
1636756465670 Sync.SyncScheduler DEBUG Clearing sync triggers and the global score.
1636756465671 Sync.Status INFO Resetting Status.
1636756465671 Sync.Status DEBUG Status.service: error.sync.failed => success.status_ok
1636756465671 Sync.Status DEBUG Status.sync: success.sync => error.login.reason.network
1636756465671 Sync.Status DEBUG Status.service: success.status_ok => error.sync.failed
1636756465671 Sync.RemoteTabs INFO Generating tab list with filter
1636756465671 Sync.RemoteTabs INFO Final tab list has 0 clients with 0 tabs.
1636756465671 Sync.ErrorHandler ERROR Sync encountered an error: Error: Can't sync: Network is offline(resource://services-sync/stages/enginesync.js:59:13) JS Stack trace: [e-mail]:59:13
[e-mail]:1351:28
[e-mail]:210:32
[e-mail]:166:27
[e-mail]:1370:6
sync/<@service.js:1334:18
[e-mail]:133:27
[e-mail]:1335:7
1636756465671 Sync.SyncScheduler DEBUG Sync error count has exceeded 3; enforcing backoff.
1636756465671 Sync.SyncScheduler DEBUG Starting client-initiated backoff. Next sync in 6418782 ms.
1636756465671 Sync.SyncScheduler DEBUG Next sync in 6418782 ms. (why=client-backoff-schedule)
1636756465711 Sync.Service DEBUG Exception calling anonymous function: Error: Can't sync: Network is offline(resource://services-sync/stages/enginesync.js:59:13) JS Stack trace: [e-mail]:59:13
[e-mail]:1351:28
[e-mail]:210:32
[e-mail]:166:27
[e-mail]:1370:6
sync/<@service.js:1334:18
[e-mail]:133:27
[e-mail]:1335:7

Expected results:

Bookmarks, history, etc should have loaded when logging in.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Sync' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Mark Hammond [:markh] [:mhammond]]

Firefox thinks it isn't connected to the network, even though it clearly is! Or it thinks it is behind a "captive portal". Do you see any UI from Firefox telling you that you should login to the network?

Comment 3

[Abel]

We sure do. Just below the bookmarks tool bar on the top of the window, we'll often see this:
"You must log in to this network before you can access the internet." There's a button to the right that says "Open network login page" and then an X on the far right.
We've been disregarding it since it has had no noticeable effect on webpage access, and we've understood it to be connected to our Edgewave/Iprism firewall server. We then get a message that says "browser not configured for single sign on." I get the message using IT credentials. Could this be connected to the broken sync?

Comment 4

[Abel]

Attachment: image.png

This is message many users see in their firefox. It is related to our Firewall though.
Could this lead us to what is breaking the sync?

Comment 5

[Mark Hammond [:markh] [:mhammond]]

Yes, that is the core problem - sync disables itself when it detects the browser is in this state. See also https://support.mozilla.org/en-US/kb/captive-portal - can you configure your firewall to allow access to http://detectportal.firefox.com/canonical.html?

There's some info from another bug that might be useful:

• You might be able to fix this by setting network.captive-portal-service.enabled to false in about:config
• Instructions at https://firefox-source-docs.mozilla.org/networking/http/logging.html show how you can capture some networking logs which would be useful in working out what is going wrong.

Comment 6

[Kershaw Chang [:kershaw]]

Nihanth, could you comment on this?
Thanks.

Comment 7

[(inactive) Nihanth Subramanya [:nhnt11]]

Sorry, I didn't get a chance to look at this yet and I don't think I will get a chance in the immediate future.

Comment 8

[Valentin Gosu [:valentin] (he/him) {{ FYI: OOO 14 June - 4 August }}]

While there could be a bunch of reasons why captive portal detection might fail, I think sync should eventually try to sync even though a CP is still detected.

Comment 9

[Mark Hammond [:markh] [:mhammond]]

(In reply to Valentin Gosu [:valentin] (he/him) from comment #8)

While there could be a bunch of reasons why captive portal detection might fail, I think sync should eventually try to sync even though a CP is still detected.

I don't agree with that, but regardless, you still want a bug for captive portal detection being broken in this very specific case, right?

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:lougenia, could you have a look please?

For more information, please visit auto_nag documentation.