Skip to content

Fix double-wrapping of encrypted password in etcd client#15192

Merged
michaelklishin merged 2 commits intorabbitmq:mainfrom
amazon-mq:rabbitmq-server-15191
Dec 31, 2025
Merged

Fix double-wrapping of encrypted password in etcd client#15192
michaelklishin merged 2 commits intorabbitmq:mainfrom
amazon-mq:rabbitmq-server-15191

Conversation

@lukebakken
Copy link
Copy Markdown
Collaborator

Problem

The etcd peer discovery plugin crashes during startup when username and password authentication is configured. The crash occurs with a function_clause error in rabbit_data_coercion:to_list/1 when it receives a double-wrapped encrypted password structure.

The bug is in deobfuscate/1 which wraps an already-encrypted password with another {encrypted, ...} tuple, creating {encrypted, {encrypted, Binary}}. This double-wrapped structure causes to_list/1 to fail because it has no clause matching this pattern.

Solution

This PR removes the extra wrapping in deobfuscate/1. The password parameter is already in the correct format {encrypted, Binary} or {plaintext, Binary} from the obfuscate/1 call, so it passes directly to credentials_obfuscation:decrypt/1 without modification.

This matches the pattern used in other modules like rabbit_federation_util and amqp_direct_connection which call credentials_obfuscation:decrypt/1 directly on encrypted values.

Testing

Added authentication to the etcd test suite to reproduce and verify the fix. The test suite now starts etcd with authentication enabled, creates a rabbitmq user with password, and passes credentials to the etcd client. All tests pass with the fix applied.

Fixes #15191

The etcd peer discovery plugin crashes during startup when username and
password authentication is configured. The crash occurs with a
`function_clause` error in `rabbit_data_coercion:to_list/1` when it
receives a double-wrapped encrypted password structure like `{encrypted,
{plaintext, Binary}}`.

This change adds authentication to the etcd test suite to reproduce the
bug. The test suite now starts etcd with authentication enabled, creates
a `rabbitmq` user with password `s3kR37`, and passes these credentials
to the etcd client. The test also ensures the `credentials_obfuscation`
application starts before the etcd client to properly encrypt passwords.

The bug occurs in `deobfuscate/1` which wraps an already-encrypted
password with another `{encrypted, ...}` tuple, creating the
double-wrapped structure that causes `to_list/1` to fail.

Fixes rabbitmq#15191
The `deobfuscate/1` function wraps an already-encrypted password with
another `{encrypted, ...}` tuple, creating a double-wrapped structure
like `{encrypted, {encrypted, Binary}}`. This causes
`rabbit_data_coercion:to_list/1` to fail with a `function_clause` error
because it has no clause matching the double-wrapped structure.

This change removes the extra wrapping in `deobfuscate/1`. The password
parameter is already in the correct format `{encrypted, Binary}` or
`{plaintext, Binary}` from the `obfuscate/1` call, so it passes directly
to `credentials_obfuscation:decrypt/1` without modification.

This matches the pattern used in other modules like
`rabbit_federation_util` and `amqp_direct_connection` which call
`credentials_obfuscation:decrypt/1` directly on encrypted values.

Fixes rabbitmq#15191
Copy link
Copy Markdown
Collaborator

@michaelklishin michaelklishin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, looks like there are etcd peer discovery suite failures on CI.

@michaelklishin
Copy link
Copy Markdown
Collaborator

#15193

@michaelklishin michaelklishin merged commit b27de42 into rabbitmq:main Dec 31, 2025
570 of 575 checks passed
michaelklishin added a commit that referenced this pull request Dec 31, 2025
mergify bot pushed a commit that referenced this pull request Dec 31, 2025
michaelklishin added a commit that referenced this pull request Dec 31, 2025
mergify bot pushed a commit that referenced this pull request Dec 31, 2025
@lukebakken lukebakken deleted the rabbitmq-server-15191 branch December 31, 2025 15:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

etcd plugin not works with username and password

2 participants