Special characters in RABBITMQ_DEFAULT_PASS triggers error

[deargonaut]

As issue mentions, while setting a harder password on DEFAULT_PASS with special characters it will trigger this error on startup.

{"could not start kernel pid",application_controller,"error in config file \"/etc/rabbitmq/rabbitmq.config\" (6): syntax error before: RmkUkNsgRdg"}

Would be nice to have safer password.

[michaelklishin]

@deargonaut you have provided no specific examples but I'm quite sure it's a shell escaping problem. As long as this image uses ENV variables heavily, there will be issues like that.

Use definitions import with which values won't go through shell interpretation.

[tianon]

Indeed -- definitions import is a much safer bet. However, if there's a specific example which causes problems (a full docker run line to reproduce would be best), I'd be keen to try debugging and fixing it.

@michaelklishin I suppose issues like this are probably a good answer to the question I've postulated in #197 about whether to still support so many envs in 3.7+ or whether to trim things down 😄

[michaelklishin]

@tianon I support the interest to switch away from ENV variables and promote definition import along the way, even though it doesn't cover every area. I think definition import fits the immutable container as a unit of deployment idea very well.

Happy to discuss what options are available wherever you prefer (#197, a mailing list, on Slack or Zoom).

[tianon]

I think discussing that over on #197 would probably be preferable, but can do something else if you'd rather. We like to keep the chat in GitHub as much as possible so that we can refer back to it later when we inevitably forget. 😅

[deargonaut]

I am sorry, I should have added some example :)

I used in a docker-compose.yml like this:

version: '3'
services:
  rabbitMQ:
    image: rabbitmq:3.6-management
    volumes:
      - "./rabbitmq_data:/var/lib/rabbitmq"
    deploy:
      labels:
        [...]
    ports:
      [...]
    environment:
      - RABBITMQ_DEFAULT_USER=default
      - RABBITMQ_DEFAULT_PASS='9%QDEBvp@W!jA@n#EWVW'
      - RABBITMQ_ERLANG_COOKIE=xgFDbPJCqUumsBdqc
    networks:
      - frontend
      - backend

networks:
  backend:
    external:
      name: rabbitmq-network
  frontend:
    external:
      name: frontend

This gave the error I mentioned before:

{"could not start kernel pid",application_controller,"error in config file "/etc/rabbitmq/rabbitmq.config" (6): syntax error before: [password until special character]"}

So this is probably indeed an issue with escaping, despite the single (or double) quotes around the password.

[tianon]

Heh, the single quotes are probably what's causing your issue -- since that's YAML, the single quotes have to be around the entire string or else they'll be part of the value, so you're literally asking for '9%QDEBvp@W!jA@n#EWVW' as your password there, which is why the entrypoint chokes. So, we should probably take a two-pronged approach here -- you can fix your example by removing the quotes (or moving them around the entire value, ala - 'RABBITMQ_DEFAULT_PASS=9%QDEBvp@W!jA@n#EWVW'), and we should fix our RabbitMQ 3.6 entrypoint to escape single quotes in string values (which I'm surprised we haven't run into officially before now).

I thought I'd be able to easily reproduce via the following, but it actually seems to work fine:

$ docker run -dit --name test \
    -e RABBITMQ_DEFAULT_USER=default \
    -e RABBITMQ_DEFAULT_PASS=\''9%QDEBvp@W!jA@n#EWVW'\' \
    -e RABBITMQ_ERLANG_COOKIE=xgFDbPJCqUumsBdqc \
    rabbitmq:3.6-management
$ docker exec -it test cat /etc/rabbitmq/rabbitmq.config
[
	{ rabbit, [
		{ loopback_users, [ ] },
		{ tcp_listeners, [ 5672 ] },
		{ ssl_listeners, [ ] },
		{ default_pass, <<"'9%QDEBvp@W!jA@n#EWVW'">> },
		{ default_user, <<"default">> },
		{ hipe_compile, false }
	] },
	{ rabbitmq_management, [ { listener, [
		{ port, 15672 },
		{ ssl, false }
	] } ] }
].
$ docker logs --tail=10 test
 completed with 6 plugins.

=INFO REPORT==== 12-Oct-2017::17:13:45 ===
Server startup complete; 6 plugins started.
 * rabbitmq_management
 * rabbitmq_management_agent
 * rabbitmq_web_dispatch
 * cowboy
 * amqp_client
 * cowlib

[tianon]

Now, if I use double quotes instead, I can reproduce a failure immediately:

$ docker run -it --rm -e RABBITMQ_DEFAULT_USER=default -e RABBITMQ_DEFAULT_PASS='"9%QDEBvp@W!jA@n#EWVW"' -e RABBITMQ_ERLANG_COOKIE=xgFDbPJCqUumsBdqc rabbitmq:3.6-management
{"could not start kernel pid",application_controller,"error in config file \"/etc/rabbitmq/rabbitmq.config\" (6): syntax error before: 9"}
could not start kernel pid (application_controller) (error in config file "/etc/rabbitmq/rabbitmq.config" (6): syntax error before: 9)

Crash dump is being written to: erl_crash.dump...