Hi Stephen and Ansible People,
I am sorry, I am afraid my feedback was not correct enough.
The trick with the custom OpenSSL config file defined as an environment variable in the Ansible playbook helped me achieve the goal: to access the legacy devices with Ansible. However, to do so, I still used “curl” executed in “ansible.builtin.shell”. Initially, the default OpenSSL config did not work for some my devices using “curl” either as legacy TLS renegotiation (UnsafeLegacyRenegotiation) is disabled by default.
Therefore, I assumed, that the very same approach should work similarly for “ansible.builtin.uri”. However, today, once I started rewriting the playbook, to replace “curl” with “ansible.builtin.uri”, I learned that it is not the case. In fact, the handshake fails:
“msg”: “Status code was -1 and not [200]: Request failed: <urlopen error [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1000)>”,
“redirected”: false,
“status”: -1,
Below is my test playbook:
-----BEGIN PLAYBOOK-----
- name: Query legacy boxes
hosts: legacyboxes
gather_facts: false
connection: local
environment:
OPENSSL_CONF: /etc/ssl/openssl-unsafe.cnf
tasks:
- name: GET the home page
ansible.builtin.uri:
url: https://{{ ansible_host }}
-----END PLAYBOOK-----
And my custom OpenSSL config (/etc/ssl/openssl-unsafe.cnf) is defined as:
-----BEGIN OPENSSL_CONF-----
openssl_conf = openssl_init
[openssl_init]
ssl_conf = ssl_sect
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=0
Options = UnsafeLegacyRenegotiation
-----END OPENSSL_CONF-----
In the packet dumps I see that “ansible.builtin.uri” still announces only TLS versions 1.2 and 1.3:
-----BEGIN PACKET DUMP-----
Extension: supported_versions (len=5) TLS 1.3, TLS 1.2
Type: supported_versions (43)
Length: 5
Supported Versions length: 4
Supported Version: TLS 1.3 (0x0304)
Supported Version: TLS 1.2 (0x0303)
-----END PACKET DUMP-----
While “curl” expectedly sends the minimal TLS version 1.0:
-----BEGIN PACKET DUMP-----
Extension: supported_versions (len=9) TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0
Type: supported_versions (43)
Length: 9
Supported Versions length: 8
Supported Version: TLS 1.3 (0x0304)
Supported Version: TLS 1.2 (0x0303)
Supported Version: TLS 1.1 (0x0302)
Supported Version: TLS 1.0 (0x0301)
-----END PACKET DUMP-----
I am really sorry for the caused confusion.
Thank you.
Garri
