[BUG] v2.0.0. ALPHA: Module execution results in error when Deny SSL Renegotiation is enabled. When using WSL2.

[krausi24]

Describe the bug
Module execution results in error when Deny SSL Renegotiation is enabled.
"'Request failed: <urlopen error [SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabled (_ssl.c:997)>'}"

To Reproduce

1. Install the Alpha Modules
2. Create any Task with any module like netscaler.adc.nsip

• name: Create SNIP
  tags: nsip
  delegate_to: localhost
  netscaler.adc.nsip:
  nsip: "{{ ansible_host }}"
  nitro_user: "{{ nitro_user }}"
  nitro_pass: "{{ nitro_pass }}"
  validate_certs: no
  state: "present"
  ipaddress: "{{ NSIP_ipaddress }}"
  netmask: "{{ NSIP_netmask }}"
  type: "{{ NSIP_type }}"

Expected behaviour
Connection and Task execution

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

• Python version python --version output
  Python 3.10.6
• Ansible version ansible --version output
  ansible [core 2.14.6]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/dkr/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /home/dkr/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.10.6 (main, Mar 10 2023, 10:55:28) [GCC 11.3.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True

Additional context
When setting the value of "Deny SSL Renegotiation" to "No" in Netscaler SSL Profile and binding it to the internal service "nshttps-127.0.0.1-443" the error is gone!

[sumanth-lingappa]

Thank you @krausi24 for this issue. I will look into this and get back here soon

[krausi24]

I need to mention that this issue applies only to Ansible running in WSL2!

[QTjstahl]

I hit the exact same issue here, but not in a WSL2 environment as @krausi24 experienced. Running Ubuntu 22.04.3 w/ ansible [core 2.15.4] and NS13.1 37.38.nc. As a workaround, I followed the suggestion above of modifying the SSL profile on my NSIP.

[fa-elepape]

Just FYI, this is not specific to the Ansible modules. The "ALL" option to "Deny SSL Renegotiation" is improperly implemented in Netscaler and leads to a total absence of the Renegotiation Indication Extension (RFC 5746) in the ServerHello.

A quick analysis of what happens during a handshake with a Netscaler where "Deny SSL Renegotiation" is "ALL":

1. Client sends ClientHello with TLS_EMPTY_RENEGOCIATION_INFO_SCSV
   From RFC 5746 § 3.4: Client Behavior: Initial Handshake:

The client MUST include either an empty "renegotiation_info"
extension, or the TLS_EMPTY_RENEGOTIATION_INFO_SCSV signaling
cipher suite value in the ClientHello. Including both is NOT
RECOMMENDED.

2. Netscaler sends ServerHello without renegotiation_info extension
   From RFC 5746 § 3.6: Server Behavior: Initial Handshake:

o When a ClientHello is received, the server MUST check if it
includes the TLS_EMPTY_RENEGOTIATION_INFO_SCSV SCSV. If it does,
set the secure_renegotiation flag to TRUE.
[...]
o If the secure_renegotiation flag is set to TRUE, the server MUST
include an empty "renegotiation_info" extension in the ServerHello
message.

3. Client terminates handshake because of insecure server
   From RFC 5746 § 3.4: Client Behavior: Initial Handshake:

If the extension is not present, the server does not support
secure renegotiation; set secure_renegotiation flag to FALSE.
In this case, some clients may want to terminate the handshake
instead of continuing; [...]

OpenSSL 3.0 switched to rejecting legacy (pre-2010) TLS implementations ; sadly Netscaler identifies as one when "Deny SSL Renegotiation" is "ALL" (the default). The Netscaler TLS stack needs fixing, there is nothing the netscaler.adc collection can do for you except maybe offer a way to bypass proper security checks.

[fa-elepape]

Side note: DO NOT set "Deny SSL Renegotiation" to "NO".
This leads to legacy renegotiation being globally enabled, secure or not (again, insecure TLS renegociation is 14-years old at this time).

"NONSECURE" or "FRONTEND_CLIENT" are much better options though they remain workarounds for a non RFC5746 compliant TLS stack.