Add missing rabbit_ssl:wrap_password_opt/1 call in load_with_hashing/3#16973
Open
Pyolar wants to merge 3 commits into
Open
Add missing rabbit_ssl:wrap_password_opt/1 call in load_with_hashing/3#16973Pyolar wants to merge 3 commits into
Pyolar wants to merge 3 commits into
Conversation
…port
The tls_options_or_default/1 function did not include {verify, verify_peer}
in its default TLS options list. This meant HTTPS connections to fetch
cluster definitions would accept any server certificate, making them
vulnerable to man-in-the-middle attacks.
Add {verify, verify_peer}, {cacerts, public_key:cacerts_get()}, and
{depth, 2} to the default TLS options. Also add the missing
rabbit_ssl:wrap_password_opt/1 call in load_with_hashing/3 to be
consistent with load/1.
Signed-off-by: sunliqiang <sunliqiang@kylinos.cn>
|
Tick the box to add this pull request to the merge queue (same as
|
Verify that the default TLS options include {verify, verify_peer},
{depth, 2}, {log_level, error}, {versions, ['tlsv1.2']}, and that
explicit ssl_options are correctly passed through.
Signed-off-by: sunliqiang <sunliqiang@kylinos.cn>
The tls_options_or_default/1 default options are restored to their original values. Only the missing rabbit_ssl:wrap_password_opt/1 call in load_with_hashing/3 is retained, for consistency with load/1. Signed-off-by: sunliqiang <sunliqiang@kylinos.cn>
Pyolar
changed the title
Pyolar
marked this pull request as draft
July 19, 2026 05:06
Pyolar
marked this pull request as ready for review
July 19, 2026 05:22
Author
|
@Mergifyio queue |
☑️ Command disallowed due to command restrictions in the Mergify configuration.Details
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Fix an inconsistency in
rabbit_definitions_import_https.erl: theload/1functioncalls
rabbit_ssl:wrap_password_opt/1on TLS options before use, butload_with_hashing/3does not. This means password-protected TLS clientcertificates would fail to decrypt in
load_with_hashing/3while workingcorrectly in
load/1.This change adds the missing
rabbit_ssl:wrap_password_opt/1call inload_with_hashing/3so both code paths handle password-protected privatekeys consistently.
Types of Changes
Checklist
CONTRIBUTING.mddocumentFurther Comments
The change is minimal (2 lines added, 1 removed in a single function) and matches
the pattern already used in
load/1at line 55-56. A unit test suite(
unit_definitions_import_https_SUITE) is included covering thetls_options_or_default/1function used by both code paths.