[SOLVED] CLI import images failed with SSLHandshakeException

[dwj]

Hi Omero users and developers,
I updated our server from 5.2.7 to 5.4.10. We use CentOS 7 (centos-release-7-6.1810.2.el7.centos.x86_64). The update was trouble-free and the Omero server seems to work without problems except the following.
If I try to import an image with the CLI importer I got an SSLHandshakeException.

Code: Select all

Created session for XXXX@XXXX:4064. Idle timeout: 10 min. Current group: Developer
2019-04-04 09:42:08,044 557        [      main] INFO          ome.formats.importer.ImportConfig - OMERO Version: 5.4.10-ice36
2019-04-04 09:42:08,070 583        [      main] INFO          ome.formats.importer.ImportConfig - Bioformats version: 5.9.2 revision: 9fc607f85b8900be786813296f1eee75cc1ed883 date: 31 August 2018
2019-04-04 09:42:08,138 651        [      main] INFO   formats.importer.cli.CommandLineImporter - Log levels -- Bio-Formats: ERROR OMERO.importer: INFO
2019-04-04 09:42:08,629 1142       [      main] INFO      ome.formats.importer.ImportCandidates - Depth: 4 Metadata Level: MINIMUM
2019-04-04 09:42:08,915 1428       [      main] INFO      ome.formats.importer.ImportCandidates - 1 file(s) parsed into 1 group(s) with 1 call(s) to setId in 282ms. (286ms total) [0 unknowns]
2019-04-04 09:42:10,094 2607       [      main] INFO       ome.formats.OMEROMetadataStoreClient - Attempting initial SSL connection to localhost:4064
2019-04-04 09:42:10,477 2990       [      main] ERROR  formats.importer.cli.CommandLineImporter - Error during import process.
Ice.SecurityException: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at IceInternal.AsyncResultI.__wait(AsyncResultI.java:276) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.end_ice_isA(ObjectPrxHelperBase.java:310) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.ice_isA(ObjectPrxHelperBase.java:92) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.ice_isA(ObjectPrxHelperBase.java:69) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.checkedCastImpl(ObjectPrxHelperBase.java:2810) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.checkedCastImpl(ObjectPrxHelperBase.java:2770) ~[ice.jar:na]
        at Glacier2.RouterPrxHelper.checkedCast(RouterPrxHelper.java:1787) ~[glacier2.jar:na]
        at omero.client.getRouter(client.java:826) ~[blitz.jar:na]
        at omero.client.createSession(client.java:747) ~[blitz.jar:na]
        at omero.client.joinSession(client.java:682) ~[blitz.jar:na]
        at ome.formats.OMEROMetadataStoreClient.initialize(OMEROMetadataStoreClient.java:700) ~[blitz.jar:na]
        at ome.formats.importer.ImportConfig.createStore(ImportConfig.java:380) ~[blitz.jar:na]
        at ome.formats.importer.cli.CommandLineImporter.<init>(CommandLineImporter.java:170) ~[blitz.jar:na]
        at ome.formats.importer.cli.CommandLineImporter.main(CommandLineImporter.java:991) ~[blitz.jar:na]
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at sun.security.ssl.Handshaker.activate(Handshaker.java:509) ~[na:1.8.0_201]
        at sun.security.ssl.SSLEngineImpl.kickstartHandshake(SSLEngineImpl.java:714) ~[na:1.8.0_201]
        at sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:741) ~[na:1.8.0_201]
        at IceSSL.SSLEngine.createSSLEngine(SSLEngine.java:856) ~[ice.jar:na]
        at IceSSL.Instance.createSSLEngine(Instance.java:42) ~[ice.jar:na]
        at IceSSL.ConnectorI.connect(ConnectorI.java:30) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.nextConnector(OutgoingConnectionFactory.java:1101) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.access$100(OutgoingConnectionFactory.java:868) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory.getConnection(OutgoingConnectionFactory.java:569) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory.access$800(OutgoingConnectionFactory.java:14) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.getConnection(OutgoingConnectionFactory.java:1048) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.connectors(OutgoingConnectionFactory.java:932) ~[ice.jar:na]
        at IceInternal.EndpointHostResolver$1.run(EndpointHostResolver.java:103) ~[ice.jar:na]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_201]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_201]
        at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_201]


At https://docs.openmicroscopy.org/omero/5.4.10/sysadmins/troubleshooting.html I found a possible workaround by calling

Code: Select all

sed -i 's/\("IceSSL.Ciphers".*ADH\)/\1:@SECLEVEL=0/' OMERO.server/lib/python/omero/clients.py OMERO.server/etc/templates/grid/templates.xml
and
python -m py_compile OMERO.server/lib/python/omero/clients.py


After doing that and restart the OMERO server I got a other error:

Code: Select all

InternalException: Failed to connect: exception ::Ice::PluginInitializationException
{
    reason = IceSSL: unable to set ciphers using `ADH:@SECLEVEL=0': invalid command
}


What did I have to change to import images vai CLI.

Thank,
Daniel

[mtbc]

Dear Daniel,

It looks like you'll be fine to revert the SECLEVEL=0 fix until you have a later OpenSSL, maybe in new CentOS or something. In the meantime, recent OpenJDK updates may be catching up with us. This will be fixed in OMERO 5.5.0 but in the meantime if you try doing CLI import with the "--skip upgrade" option does that fix the problem for you?

Cheers,
Mark

[dwj]

Dear Mark,

I revert the SECLEVEL=0 fix and use the "--skip upgrade" and IT WORKS!

Thank you very much!

Daniel

[mtbc]

Wonderful, thank you very much for letting us know, Daniel. Sorry you have to use this workaround for the meantime!

Cheers,
Mark

[dwj]

Dear Mark,

Your approach for importing images via CLI works very well.
Now, I create a web plugin, which allowed me to import images from the web client.
When I run the following python script for importing the image, I got the error 'importer-cli: unrecognized option '---skip upgrade''

Code: Select all

...
with tempfile.NamedTemporaryFile(suffix=".stdout") as stdout:
   with tempfile.NamedTemporaryFile(suffix=".stderr") as stderr:
      cli = omero.cli.CLI()
      cli.loadplugins()
      cli._client = conn.c
      cli.invoke(["import", "---errs", stderr.name, "---file", stdout.name, "---skip upgrade", path, "-d", datasetId])
      ret_code = cli.rv
      imgID = stdout.readline()
...


If I remove the "---skip upgrade" part of the command, I again got the SSLHandshakeExcep error.
(The python scripts works at our second server which is at version 5.2.7)

Is there any workaraound to use the 'import' command inside a python script calling by a web plugin?

Thanks,
Daniel

[mtbc]

Dear Daniel,

Prefix the long-format options with only two "-", not three.

Cheers,
Mark

[dwj]

Dear Mark,

I try that. But I still got the same error. In the 'Optional arguments' list, there is the 'skip' option not listed (see error-output below).

Code: Select all

2019-04-08 15:39:09,426 243        [      main] INFO          ome.formats.importer.ImportConfig - OMERO Version: 5.4.10-ice36
2019-04-08 15:39:09,439 256        [      main] INFO          ome.formats.importer.ImportConfig - Bioformats version: 5.9.2 revision: 9fc607f85b8900be786813296f1eee75cc1ed883 date: 31 August 2018
importer-cli: unrecognized option '--skip upgrade'

Usage:  importer-cli [OPTION]... [path [path ...]]...
   or:   importer-cli [OPTION]... -

Import any number of files into an OMERO instance.
If "-" is the only path, a list of files or directories
is read from standard in. Directories will be searched for
all valid imports.

Session arguments:
  Mandatory arguments for creating a session are 1- either the OMERO server hostname,
username and password or 2- the OMERO server hostname and a valid session key.
  -s SERVER   OMERO server hostname
  -u USER   OMERO username
  -w PASSWORD   OMERO password
  -k KEY   OMERO session key (UUID of an active session)
  -p PORT   OMERO server port (default: 4064)

Naming arguments:
All naming arguments are optional
  -n NAME            Image or plate name to use
  -x DESCRIPTION         Image or plate description to use
  --name NAME            Image or plate name to use
  --description DESCRIPTION      Image or plate description to use

Optional arguments:
  -h               Display this help and exit
  -f               Display the used files and exit
  -c               Continue importing after errors
  -l READER_FILE         Use the list of readers rather than the default
  -d DATASET_ID            OMERO dataset ID to import image into
  -r SCREEN_ID            OMERO screen ID to import plate into
  -T TARGET            target for imports
  --report            Report errors to the OME team
  --upload            Upload broken files and log file (if any) with report. Required --report
  --logs            Upload log file (if any) with report. Required --report
  --email EMAIL            Email for reported errors. Required --report
  --debug LEVEL            Turn debug logging on (optional level)
  --annotation-ns ANNOTATION_NS      Namespace to use for subsequent annotation
  --annotation-text ANNOTATION_TEXT   Content for a text annotation
  --annotation-link ANNOTATION_LINK   Comment annotation ID to link all images to

Examples:

  $ importer-cli -s localhost -u user -w password -d 50 foo.tiff
  $ importer-cli -s localhost -u user -w password -d Dataset:50 foo.tiff
  $ importer-cli -f foo.tiff
  $ importer-cli -s localhost -u username -w password -d 50 --debug ALL foo.tiff

For additional information, see:
https://docs.openmicroscopy.org/latest/omero/users/cli/import.html
Report bugs to <ome-users@lists.openmicroscopy.org.uk>



Thanks,
Daniel

[mtbc]

Dear Daniel,

Aha, do you have better luck with --no-upgrade-check ?

Cheers,
Mark

[dwj]

Dear Mark,

That's what I'm looking for! It works! Thanks a lot!

Daniel