Few oddities querying iDrac 8, inconsistent HTTP/HTTPS and paths that exist but not being used

[spacelama]

Suspect these two symptoms are related:

Let's start with what we're trying to do:

> redfishtool -r $rhost -u root -p $pw UpdateService
   redfishtool: Invalid SubCommand: UpdateService

I can go to the raw path though:

> redfishtool -r $rhost -u root -p $pw raw GET /redfish/v1/UpdateService
{
    "@odata.context": "/redfish/v1/$metadata#UpdateService.UpdateService",
    "@odata.id": "/redfish/v1/UpdateService",
...

OK, so no root:

> redfishtool -r $rhost -u root -p $pw root
   redfishtool: Transport: Response Error: status_code: 404 -- Not Found

Odd, /redfish/ exists, and redfishtool raw correctly queries https to get it:

redfishtool -r $rhost -u root -p $pw -vvvvv raw GET /redfish/
#DB5: Main: subcmd: raw, subCmdArgs:['raw', 'GET', '/redfish/']
#DB5: Main: verbose=5, status=0, user=root, password=..., rhost=...
#DB5: Main: token=None, RedfishVersion=v1, Auth=Basic, Timeout=10, NonBlocking=False
#DB5: Main: prop=None, Id=None, Match=None:None, First=False, -1=False, Link=None
#DB5: Main: gotIdOptn=False, IdOptnCount=0, gotPropOptn=False, gotMatchOptn=False, gotEntriesOptn=False
#DB5: Main: 2nd-Level Collection Member reference options: -i=None, -m=None:None, -l=None -all=False
#DB5: Main: 2nd-level Collection Member parsing: gotIdLevel2Optn=False, gotMatchLevel2Optn=False, IdLevel2OptnCount=0
#DB5: Main: configFile=, Secure=IfLoginOrAuthenticatedApi, waitNum:waitTime=1:3, Degug=00000000
#DB5: Main: Headers=None
#DB5: Main: options parsed. Now lookup subcommand and execute it
#DB5: runSubCmd: subcmd: raw
#DB5: runSubCmd: argvs: ['raw', 'GET', '/redfish/']
#DB5: runSubCmd: found SubCmd: raw in table. executing
#DB4: RawMain: subcommand: raw
#DB5: raw: operation=GET, args=['GET', '/redfish/']
#DB5: raw: runOperation: operation: GET
#DB5: raw:runOperation: args: ['GET', '/redfish/']
#DB5: raw:runOperation: found Oper: raw in table. executing
#DB4: raw:GET: in raw
#DB4: raw: GET: method:GET path:/redfish/
#DB5: Transport.rftProcessRequest: method=GET, baseUrl=https://192.168.1.11/redfish, rpath=/redfish/
#DB5: Transport.rftProcessRequest: apiType=2
#DB5: Transport.ProcessRequest: url=https://192.168.1.11/redfish/
#REQUEST: Transport:SendRecv: GET https://192.168.1.11/redfish/

raw GET:

#DB5: raw: operation exited OK
#DB5: Main: subcommand exited OK.
#DB5: Status code:200
{
"v1": "/redfish/v1/"
}
#DB5: rfCleanup:Cleaningup session: None
#DB5: Main: Done

But it falls back to HTTP, incorrectly, without trying HTTPS for /redfish/v1/:

> redfishtool -r $rhost -u root -p $pw -vvvvv raw GET /redfish/v1/
#DB5: Main: subcmd: raw, subCmdArgs:['raw', 'GET', '/redfish/v1/']
#DB5: Main: verbose=5, status=0, user=root, password=..., rhost=...
#DB5: Main: token=None, RedfishVersion=v1, Auth=Basic, Timeout=10, NonBlocking=False
#DB5: Main: prop=None, Id=None, Match=None:None, First=False, -1=False, Link=None
#DB5: Main: gotIdOptn=False, IdOptnCount=0, gotPropOptn=False, gotMatchOptn=False, gotEntriesOptn=False
#DB5: Main: 2nd-Level Collection Member reference options: -i<id>=None, -m<match>=None:None, -l<link>=None -all=False
#DB5: Main: 2nd-level Collection Member parsing: gotIdLevel2Optn=False, gotMatchLevel2Optn=False, IdLevel2OptnCount=0
#DB5: Main: configFile=, Secure=IfLoginOrAuthenticatedApi, waitNum:waitTime=1:3, Degug=00000000
#DB5: Main: Headers=None
#DB5: Main: options parsed.  Now lookup subcommand and execute it
#DB5: runSubCmd: subcmd: raw
#DB5: runSubCmd: argvs:  ['raw', 'GET', '/redfish/v1/']
#DB5: runSubCmd: found SubCmd: raw in table. executing
#DB4: RawMain:  subcommand: raw
#DB5: raw: operation=GET, args=['GET', '/redfish/v1/']
#DB5: raw: runOperation: operation: GET
#DB5: raw:runOperation:  args:  ['GET', '/redfish/v1/']
#DB5: raw:runOperation: found Oper: raw in table. executing
#DB4: raw:GET: in raw
#DB4: raw: GET: method:GET path:/redfish/v1/
#DB5: Transport.rftProcessRequest: method=GET, baseUrl=http://192.168.1.11/redfish, rpath=/redfish/v1/
#DB5: Transport.rftProcessRequest: apiType=1
#DB5: Transport.ProcessRequest: url=http://192.168.1.11/redfish/v1/
#REQUEST: Transport:SendRecv:    GET http://192.168.1.11/redfish/v1/
   redfishtool: Transport: Response Error: status_code: 404 -- Not Found
   redfishtool: raw: Error getting response
#DB5: raw: operation returned with error: rc=5
#DB5: #DB4:Main: subcommand returned with error: rc=5
# Main: Error: rc=5
#DB5:    Response status code:404
#DB5:    Response headers: {'Vary': 'Accept-Encoding', 'X-Frame-Options': 'SAMEORIGIN', 'Content-Type': 'text/html', 'Date': 'Sat, 01 Mar 2025 06:32:23 GMT', 'Cache-Control': 'no-cache', 'Content-Length': '223', 'Connection': 'close', 'Accept-Ranges': 'bytes'}
#DB5: rfCleanup:Cleaningup session: None

OK, let's force SSL:

> redfishtool -r $rhost -u root -p $pw -S Always root
{
    "@odata.context": "/redfish/v1/$metadata#ServiceRoot.ServiceRoot",
    "@odata.id": "/redfish/v1",
    "@odata.type": "#ServiceRoot.v1_3_0.ServiceRoot",
...

That's an improvement, so why is redfishtool falling back to HTTPS for just /redfish/v1/ ?

But boo, UpdateService still doesn't work:

> redfishtool -r $rhost -u root -p $pw -S Always UpdateService
   redfishtool: Invalid SubCommand: UpdateService

> redfishtool -r $rhost -u root -p $pw -vvvvv -S Always UpdateService
#DB5: Main: subcmd: UpdateService, subCmdArgs:['UpdateService']
#DB5: Main: verbose=5, status=0, user=root, password=..., rhost=...
#DB5: Main: token=None, RedfishVersion=v1, Auth=Basic, Timeout=10, NonBlocking=False
#DB5: Main: prop=None, Id=None, Match=None:None, First=False, -1=False, Link=None
#DB5: Main: gotIdOptn=False, IdOptnCount=0, gotPropOptn=False, gotMatchOptn=False, gotEntriesOptn=False
#DB5: Main: 2nd-Level Collection Member reference options: -i<id>=None, -m<match>=None:None, -l<link>=None -all=False
#DB5: Main: 2nd-level Collection Member parsing: gotIdLevel2Optn=False, gotMatchLevel2Optn=False, IdLevel2OptnCount=0
#DB5: Main: configFile=, Secure=Always, waitNum:waitTime=1:3, Degug=00000000
#DB5: Main: Headers=None
#DB5: Main: options parsed.  Now lookup subcommand and execute it
#DB5: runSubCmd: subcmd: UpdateService
#DB5: runSubCmd: argvs:  ['UpdateService']
   redfishtool: Invalid SubCommand: UpdateService
#DB5: #DB4:Main: subcommand returned with error: rc=1
# Main: Error: rc=1
#DB5: rfCleanup:Cleaningup session: None

(same output with or without -S Always -- can't tell from the output whether it's actually trying to use HTTPS though)

Raw works as it did at the top, but full output is:

> redfishtool -r $rhost -u root -p $pw -S Always -vvvvv raw GET /redfish/v1/UpdateService
#DB5: Main: subcmd: raw, subCmdArgs:['raw', 'GET', '/redfish/v1/UpdateService']
#DB5: Main: verbose=5, status=0, user=root, password=..., rhost=...
#DB5: Main: token=None, RedfishVersion=v1, Auth=Basic, Timeout=10, NonBlocking=False
#DB5: Main: prop=None, Id=None, Match=None:None, First=False, -1=False, Link=None
#DB5: Main: gotIdOptn=False, IdOptnCount=0, gotPropOptn=False, gotMatchOptn=False, gotEntriesOptn=False
#DB5: Main: 2nd-Level Collection Member reference options: -i<id>=None, -m<match>=None:None, -l<link>=None -all=False
#DB5: Main: 2nd-level Collection Member parsing: gotIdLevel2Optn=False, gotMatchLevel2Optn=False, IdLevel2OptnCount=0
#DB5: Main: configFile=, Secure=Always, waitNum:waitTime=1:3, Degug=00000000
#DB5: Main: Headers=None
#DB5: Main: options parsed.  Now lookup subcommand and execute it
#DB5: runSubCmd: subcmd: raw
#DB5: runSubCmd: argvs:  ['raw', 'GET', '/redfish/v1/UpdateService']
#DB5: runSubCmd: found SubCmd: raw in table. executing
#DB4: RawMain:  subcommand: raw
#DB5: raw: operation=GET, args=['GET', '/redfish/v1/UpdateService']
#DB5: raw: runOperation: operation: GET
#DB5: raw:runOperation:  args:  ['GET', '/redfish/v1/UpdateService']
#DB5: raw:runOperation: found Oper: raw in table. executing
#DB4: raw:GET: in raw
#DB4: raw: GET: method:GET path:/redfish/v1/UpdateService
#DB5: Transport.rftProcessRequest: method=GET, baseUrl=https://192.168.1.11/redfish, rpath=/redfish/v1/UpdateService
#DB5: Transport.rftProcessRequest: apiType=2
#DB5: Transport.ProcessRequest: url=https://192.168.1.11/redfish/v1/UpdateService
#REQUEST: Transport:SendRecv:    GET https://192.168.1.11/redfish/v1/UpdateService
#
#  raw GET:
#DB5: raw: operation exited OK
#DB5: Main: subcommand exited OK.
#DB5:     Status code:200
{
    "@odata.context": "/redfish/v1/$metadata#UpdateService.UpdateService",
    "@odata.id": "/redfish/v1/UpdateService",
    "@odata.type": "#UpdateService.v1_2_0.UpdateService",
    "Actions": {
        "#UpdateService.SimpleUpdate": {
            "TransferProtocol@Redfish.AllowableValues": [
                "HTTP"
            ],
            "target": "/redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate"
        },
        "Oem": {
            "DellUpdateService.v1_0_0#DellUpdateService.Install": {
                "InstallUpon@Redfish.AllowableValues": [
                    "Now",
                    "NowAndReboot",
                    "NextReboot"
                ],
                "target": "/redfish/v1/UpdateService/Actions/Oem/DellUpdateService.Install"
            }
        }
    },
    "Description": "Represents the properties for the Update Service",
    "FirmwareInventory": {
        "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory"
    },
    "HttpPushUri": "/redfish/v1/UpdateService/FirmwareInventory",
    "Id": "UpdateService",
    "Name": "Update Service",
    "ServiceEnabled": true,
    "Status": {
        "Health": "OK",
        "State": "Enabled"
    }
}
#DB5: rfCleanup:Cleaningup session: None
#DB5: Main: Done

[mraineri]

That's an improvement, so why is redfishtool falling back to HTTPS for just /redfish/v1/ ?

If I remember correctly, redfishtool starts with HTTP for initial discovery and then transitions to HTTPS on its own when it attempts to pass credentials. Many systems will always redirect from HTTP to HTTPS prior to this point. However, I know iDRAC specifically does not support HTTP to HTTPS redirection, and any attempt to use HTTP will result in a 404. There are security implications with HTTP to HTTPS redirection (but the specific reasons escape me at the moment).

But boo, UpdateService still doesn't work:

UpdateService is not a supported sub command in redfishtool at this time. redfishtool does not dynamically produce sub commands from the service root; each of the sub commands are specifically coded in the tool. There is an open issue (#62) and would welcome a pull request for this. However, DMTF has been promoting other client tools like Redfish Tacklebox, which does support for performing updates via the UpdateService.