Filebot r3881 CLI fails with handshake failure

All your suggestions, requests and ideas for future development
Post Reply
tacoloco
Posts: 8
Joined: 09 Apr 2016, 01:03

Filebot r3881 CLI fails with handshake failure

Post by tacoloco »

I'm not sure what's going on here, other than an SSL issue. r3574 works fine.

Java is java-1.8.0-openjdk-headless-1.8.0.77-1.b03.fc23.x86_64

I hope you can shed some light on this issue!

Thanks!

Code: Select all

 java -jar filebot-r3881.jar  -rename /storage/videos/samba/TV/ --action symlink --output /storage/videos/plex/ --db TheTVDB --format "TV/{n}/Season {s}/{n} - {s00e00} - {t}" -non-strict -r
Rename episodes using [TheTVDB]
Fetch failed: Received fatal alert: handshake_failure
Failed to load clutter file filter: Received fatal alert: handshake_failure
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
        at net.filebot.web.WebRequest.fetch(WebRequest.java:139)
        at net.filebot.web.WebRequest.fetchIfModified(WebRequest.java:110)
        at net.filebot.CachedResource.lambda$fetchIfModified$8(CachedResource.java:175)
        at net.filebot.CachedResource.lambda$null$0(CachedResource.java:80)
        at net.filebot.CachedResource.retry(CachedResource.java:105)
        at net.filebot.CachedResource.lambda$get$1(CachedResource.java:80)
        at net.filebot.Cache.computeIf(Cache.java:75)
        at net.filebot.CachedResource.get(CachedResource.java:75)
        at net.filebot.media.ReleaseInfo.lambda$resource$18(ReleaseInfo.java:481)
        at net.filebot.MemoizedResource.get(Resource.java:36)
        at net.filebot.media.ReleaseInfo.getExcludePattern(ReleaseInfo.java:350)
        at net.filebot.media.ReleaseInfo.getClutterFileFilter(ReleaseInfo.java:399)
        at net.filebot.media.MediaDetection.getClutterFileFilter(MediaDetection.java:86)
        at net.filebot.cli.CmdlineOperations.renameSeries(CmdlineOperations.java:162)
        at net.filebot.cli.CmdlineOperations.rename(CmdlineOperations.java:106)
        at net.filebot.cli.ArgumentProcessor.runCommand(ArgumentProcessor.java:90)
        at net.filebot.cli.ArgumentProcessor.run(ArgumentProcessor.java:26)
        at net.filebot.Main.main(Main.java:123)
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
        at net.filebot.web.WebRequest.fetch(WebRequest.java:136)
        ... 17 more
User avatar
rednoah
The Source
Posts: 22923
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: Filebot r3881 CLI fails with handshake failure

Post by rednoah »

Looks like a generic JRE configuration issue. Nothing FileBot can do about that.

You'll probably find some help if you google the error message:
http://stackoverflow.com/a/6353956/1514467
:idea: Please read the FAQ and How to Request Help.
kim
Power User
Posts: 1251
Joined: 15 May 2014, 16:17

Re: Filebot r3881 CLI fails with handshake failure

Post by kim »

I'm pretty sure filebot don't work with that java version, you need

sudo apt-add-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer
http://askubuntu.com/questions/521145/h ... untu-14-04
StrangelyTyped
Posts: 2
Joined: 30 May 2016, 18:26

Re: Filebot r3881 CLI fails with handshake failure

Post by StrangelyTyped »

As someone who has just run into this exact issue, these answers were really not what I was hoping to find. Before I get too rant-y I will say that the Oracle JRE 8 *does* appear to work fine, so thanks for at least pointing us at a working solution kim.

Unfortunately I don't know enough about the intricacies of SSL/TLS to delve into the problem and identify what's actually wrong, but given that this behaviour is visible only in one JRE (specifically the common linux default JRE at that) suggests that someone somewhere is doing something wrong. I did not interfere in any way with the configuration of either JRE after installation which suggests that either the application is doing something nonportable, or OpenJDK is doing something different by default.

If it's the latter then an issue needs to be opened against OpenJDK for behaving differently to the standard JRE. If it's an application issue *or if there is something that can be done to mitigate it from the application* then I would expect to see effort go into dealing with it. Either way some level of looking into the underlying problem is warranted, especially since the original poster reported it worked fine in an earlier version.

Regardless, an issue where a user reports application X cannot connect to application X's website (because that handshake failure appears to be from attempting to connect to app.filebot.net) resulting in the user being told "not our problem, here's a SO post on the exception my code threw" is not helpful to anybody.
User avatar
rednoah
The Source
Posts: 22923
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: Filebot r3881 CLI fails with handshake failure

Post by rednoah »

Works fine with OpenJDK 8 on Ubuntu 16.04 over here.

If you prefer "nothing I can do" over "you may find a solution online because this issue is not filebot-specific" as an answer then so be it. If you find an answer though, please share it here. ;)

The original poster never reported back. There's not enough information to file a useful bug report. I don't even know what Linux distribution or which package maintainer I'd report this to. :D
:idea: Please read the FAQ and How to Request Help.
StrangelyTyped
Posts: 2
Joined: 30 May 2016, 18:26

Re: Filebot r3881 CLI fails with handshake failure

Post by StrangelyTyped »

I've done some further digging around, and before I get into specifics I want to apologise for getting a little annoyed, had you done any investigation I imagine you'd come to the same conclusion I did which is there's a well-documented issue in OpenJDK that's responsible. That said, I maintain that providing no help other than 'here's a stackoverflow link I found while googling your problem' is not a helpful way to go.

After digging into the problem what I've found is that OpenJDK on RHEL-like distributions is missing an entire TLS cipher suite - specifically the Elliptic Curve ciphers which are the only ones accepted by the Cloudflare proxy you have in front of app.filebot.net. This is due to the sun.security.ec.SunEC security provider being disabled in OpenJDK due to some issue with fedora. I tried chasing the bugs around the redhat bugzilla but just ended up going in circles through piles of bugs, all of which appear to be closed. Here's one such example.

On to the important issue - workarounds for anybody else that stumbles across this thread as I did. As kim stated previously switching to the Oracle JVM is one such solution, though since it isn't available in the CentOS/RHEL repositories it's a bit inconvenient. The other workaround if you want to stick with OpenJDK is to install the BouncyCastle provider into the JVM which will re-enable the missing cipher suites. There is a bouncycastle package in the EPEL repo but that doesn't seem to cut the mustard, the instructions available in this StackOverflow answer explain how to install the provider. You also need to remove 'EC, ECDHE, ECDH' from the jdk.tls.disabledAlgorithms definition in that same java.security file. That resolved the problem for me.

As for why older FileBot versions work fine, I suspect this commit is responsible.
User avatar
rednoah
The Source
Posts: 22923
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: Filebot r3881 CLI fails with handshake failure

Post by rednoah »

Thanks for looking into this more closely. So EC is broken in all RHEL OpenJDK packages... mmmhhhh... strange that it hasn't come up more often. Maybe it only affects older versions?

Strange SSL issues come and go when CF is tinkering with their stuff, but this one really is an OpenJDK issue then.
:idea: Please read the FAQ and How to Request Help.
lordfiSh
Posts: 5
Joined: 16 Oct 2016, 08:22

Re: Filebot r3881 CLI fails with handshake failure

Post by lordfiSh »

Just a Info. same problem with Synology Java 8

Code: Select all

...
Fetch failed: Try again in 5 seconds (2 more) => javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failur                                                         e
Fetch failed: Try again in 10 seconds (1 more) => javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
Fetch failed: https://app.filebot.net/scripts/m1.jar.xz
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
...
ash-4.3# java -version
openjdk version "1.8.0_121"
OpenJDK Runtime Environment (IcedTea 3.3.0) (linux-gnu build 1.8.0_121-b13)
OpenJDK 64-Bit Server VM (build 25.121-b13, mixed mod
ash-4.3# filebot
FileBot 4.7.9 (r4984) / OpenJDK Runtime Environment 1.8.0_121 (headless)
Solution for Synology: Using the Unoffical Java Installer from pcloadletter.co.uk
Post Reply