feat: Add Lambda-Runtime-Invocation-Id support for cross-wiring protection - #214
feat: Add Lambda-Runtime-Invocation-Id support for cross-wiring protection#214vip-amzn wants to merge 1 commit into
Conversation
39f026b to
b132afb
Compare
09c0624 to
c14cbf5
Compare
| @@ -927,6 +928,7 @@ def test_binary_with_application_json(self): | |||
| invoke_id, | |||
| error_result, | |||
| xray_fault, | |||
| invocation_id, | |||
There was a problem hiding this comment.
This is probably working by chance because nothing is passed at line 909 and we are defaulting to none.
In general I think we should have a stack of test checking that the value is wired from the bootstrap to the client.
There was a problem hiding this comment.
added test_invocation_id_wired_to_post_invocation_result and test_invocation_id_wired_to_post_invocation_error. There we pass an actual invocation_id through handle_event_request and assert it reaches the client call.
There was a problem hiding this comment.
Thanks this was the most important change I wanted.
| runtime_client.post_invocation_result(invoke_id, response_data) | ||
|
|
||
| mock_runtime_client.post_invocation_result.assert_called_once_with( | ||
| invoke_id, response_data.encode("utf-8"), "application/json" |
There was a problem hiding this comment.
Can we default to a value instead of None for the these tests.
There was a problem hiding this comment.
The existing tests validate other behavior and explicitly test the None default path (backward compat). The positive invocation_id path is covered by dedicated tests (test_post_invocation_result_with_invocation_id, test_post_invocation_error_with_invocation_id).
Let me know if you still prefer to add the default value, don't want to mix the concern of the tests here.
There was a problem hiding this comment.
This was more of a nit. Rethinking it it's fine.
c14cbf5 to
1fea904
Compare
…ction Echo the invocation ID received from RAPID on /next back on /response and /error, enabling RAPID to detect and reject stale responses from timed-out invocations. Fully backward compatible — header only sent when received.
1fea904 to
a5775f7
Compare
2 participants
Summary
Add
Lambda-Runtime-Invocation-Idheader support for cross-wiring protection.The RIC now echoes the invocation ID received from RAPID on
/nextback on/responseand/error, enabling RAPID to detect and reject stale responses from timed-out invocations.Problem
On Lambda Managed Instances (LMI) and On-Demand (OD), when an invoke times out, the runtime process continues running in the background. If a new invoke arrives with the same
requestId, RAPID accepts it. The still-running old invocation eventually posts its response, and RAPID matches it to the new invoke — delivering the wrong response (cross-wiring).Solution
RAPID sends a unique per-invoke nonce via
Lambda-Runtime-Invocation-Idheader on/next. The runtime echoes it back on/responseand/error. RAPID validates the match before accepting the response.Changes
runtime_client.cpp: ParseLambda-Runtime-Invocation-Idfrom/nextresponse, pass topost_success/post_failureviazformat (acceptsNone→nullptr)lambda_runtime_client.py: Threadinvocation_idthrough to native clientbootstrap.py: Passinvocation_idfrom event request to response/error postingdeps/patches/aws-lambda-cpp-add-invocation-id.patch: Patchaws-lambda-cppto supportinvocation_idinget_next/do_postdeps/patches/aws-lambda-cpp-musl-no-execinfo.patch: Extracted Alpine/musl fix from d3e9632 into a proper patch file soupdate_deps.shcan reproduce the tarball from scratch (previously baked directly into the tarball without a patch — see d3e9632)Backward Compatibility
Fully backward compatible in both directions:
Testing