robgjertsen1
commented
1 year ago Yes, there is an issue with both fix_check and also group_fix_check modules getting the HTTP 403 error from the IBM service site. I will put out a patch for these files so that the request is not rejected by the HTTP server. The code is using the default python urllib header for the http/https requests and this no longer works with the web server(s) for the IBM service site; I assume an upgrade occurred with web server code that now blocks this default python request header.
I have reproduced the issue myself and also verified an initial fix that resolves the problem.
There may also be an issue with validate_certs set to true that I can look into later where we may need to refresh the certificate.
K2701
I am running Ansible on an IBMi partition at V7R3 as the central "Control Node". The versions of software on the IBMi partition are:
ibmi_module_version = "1.9.1"
-bash-5.1$ ansible --version ansible 2.9.10 python version = 3.6.15 (default, Dec 17 2021, 09:57:34) [GCC 6.3.0] ===============================================
When running the example IBM playbook named "ibmi-fix-check.yml" in Ansible on the IBMi partition, with the "validate_certs=False" all of the YAML tasks return ("error": "HTTP Error 403: Forbidden",).
However, from the same partition we can use "curl" and successfully access each of the web pages and the data returns as expected.
Code Snippet: =========================
hosts: LOCALHOST connection: local gather_facts: false collections:
tasks:
name: query_two_ptf ibmi_fix_check: ptfs:
name: display_two_ptf debug: msg: "{{ two_ptf }}" =========================
Results from the above: ======================= <127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: xxxxxx <127.0.0.1> EXEC /bin/sh -c '/QOpensys/pkgs/bin/python3.6 && sleep 0' ok: [127.0.0.1] => { "certs": false, "changed": false, "count": 0, "elapsed_time": "0:00:03.347611", "end": "2023-06-05 09:11:52.503603", "expanded_requisites": false, "group_info": [], "invocation": { "module_args": { "expanded_requisites": false, "groups": null, "ptfs": [ "SI71691", "SI74112" ], "timeout": 30, "validate_certs": false } }, "ptf_info": [ { "ptf_id": "SI71691", "req_list": [ { "error": "HTTP Error 403: Forbidden", "url": "https://www.ibm.com/support/pages/ptf/SI71691" } ] }, { "ptf_id": "SI74112", "req_list": [ { "error": "HTTP Error 403: Forbidden", "url": "https://www.ibm.com/support/pages/ptf/SI74112" } ] } ], "rc": 0, "start": "2023-06-05 09:11:49.155992", "stderr": "", "stderr_lines": [], "timeout": 30 } =======================
However, if I run the same ibmi-fix-check.yml file with the "validate_certs=True" the results still fail but with a different error. Code Snippet of Results from "validate_certs=True". ================================ <127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: enskdr <127.0.0.1> EXEC /bin/sh -c '/QOpensys/pkgs/bin/python3.6 && sleep 0' ok: [127.0.0.1] => { "certs": true, "changed": false, "count": 0, "elapsed_time": "0:00:02.500378", "end": "2023-06-05 09:09:58.616488", "expanded_requisites": false, "group_info": [], "invocation": { "module_args": { "expanded_requisites": false, "groups": null, "ptfs": [ "SI71691", "SI74112" ], "timeout": 10, "validate_certs": true } }, "ptf_info": [ { "ptf_id": "SI74112", "req_list": [ { "error": "'int' object is not callable", "url": "https://www.ibm.com/support/pages/ptf/SI74112" } ] }, { "ptf_id": "SI71691", "req_list": [ { "error": "'int' object is not callable", "url": "https://www.ibm.com/support/pages/ptf/SI71691" } ] } ], "rc": 0, "start": "2023-06-05 09:09:56.116110", "stderr": "", "stderr_lines": [], "timeout": 10 }
================================
As per the documentation I have the ca-certficates-mozilla installed. Since this is running (delegated) to an IBM i server....... ================================= notes:
================================= Installed Packages
Name : ca-certificates-mozilla
Arch : noarch
Version : 2022.2.58
Release : 1
Size : 1.0 M
Repo : installed
From repo : ibmi-base
Summary : The Mozilla CA root certificate bundle
License : MPL-2.0
Description : This package contains the set of CA certificates chosen by the : Mozilla Foundation for use with the Internet PKI.
=================================
That package installs under /QOpenSys/pkgs/share/pki/trust and it is named mozilla.p11-kit. ============================================== Work with Object Links
Directory . . . . : /QOpenSys/pkgs/share/pki/trust
Type options, press Enter.
2=Edit 3=Copy 4=Remove 5=Display 7=Rename 8=Display attributes 11=Change current directory ...
Opt Object link Type Attribute Text
. DIR
.. DIR
anchors DIR
blacklist DIR
mozilla.p11-kit STMF
==============================================
Why with "validate_certs=False" does a Error 403: Forbidden get returned? Why with "validate_certs=True" does the "error": "'int' object is not callable"" get returned?
In the urls.py module the certs path only gets resolved to the following locations ================= /etc/ansible /QOpenSys/etc/ssl/certs ================= So, based on the path that resolves in the code is would "appear" this module is not searched.
Is it possible that the IBM changes to secure the Fix Central servers in August of 2022 is related? (** Fix Central unsecured and anonymous FTP downloads have been disabled as of 31 August 2022.) https://www.ibm.com/support/pages/node/6475697
Perhaps the required CA certificate from IBM for the PSP site is NOT in the certs list or bundles on V7R3 since the restrictions went into place in August 2022, and would this be affecting the results when "validate_certs=True" ?
Thank You, { End }