fix: bypass proxy for Runtime API calls

The Runtime API client used Net::HTTP.post and Net::HTTP.new(host, port),
both of which default to :ENV proxy resolution and honor HTTP(S)_PROXY. A
customer-configured proxy then routed calls to the API endpoint through the
proxy, so a proxy in the environment could break function init and result
delivery even though it should never affect communication with the API.

Route the invocation poll and the three write-backs through a single client
built with a nil proxy argument, which disables Net::HTTP's default proxy
resolution so the link-local API endpoint is never proxied.

Author: benrkia

lib/aws_lambda_ric/lambda_server.rb

@@ -20,7 +20,7 @@ def initialize(server_address, user_agent)
   def next_invocation
     next_invocation_uri = URI(@server_address + '/runtime/invocation/next')
     begin
-      http = Net::HTTP.new(next_invocation_uri.host, next_invocation_uri.port)
+      http = build_client(next_invocation_uri)
       http.read_timeout = LONG_TIMEOUT_MS
       resp = http.start do |connection|
         connection.get(next_invocation_uri.path, { 'User-Agent' => @user_agent })
@@ -49,7 +49,7 @@ def send_response(request_id:, response_object:, content_type: 'application/json
       if content_type == 'application/unknown'
         response_object = response_object.read
       end
-      Net::HTTP.post(
+      post(
         response_uri,
         response_object,
         { 'Content-Type' => content_type, 'User-Agent' => @user_agent }
@@ -64,7 +64,7 @@ def send_error_response(request_id:, error_object:, error:, xray_cause:)
     begin
       headers = { 'Lambda-Runtime-Function-Error-Type' => error.runtime_error_type, 'User-Agent' => @user_agent }
       headers['Lambda-Runtime-Function-XRay-Error-Cause'] = xray_cause if xray_cause.bytesize < MAX_HEADER_SIZE_BYTES
-      Net::HTTP.post(
+      post(
         response_uri,
         error_object.to_json,
         headers
@@ -77,7 +77,7 @@ def send_error_response(request_id:, error_object:, error:, xray_cause:)
   def send_init_error(error_object:, error:)
     uri = URI("#{@server_address}/runtime/init/error")
     begin
-      Net::HTTP.post(
+      post(
         uri,
         error_object.to_json,
         { 'Lambda-Runtime-Function-Error-Type' => error.runtime_error_type, 'User-Agent' => @user_agent }
@@ -86,4 +86,18 @@ def send_init_error(error_object:, error:)
       raise LambdaErrors::LambdaRuntimeInitError.new(e)
     end
   end
+
+  private
+
+  # The Runtime API is can be a link-local endpoint that must never be proxied. The nil
+  # proxy argument disables Net::HTTP's default :ENV proxy resolution.
+  def build_client(uri)
+    Net::HTTP.new(uri.host, uri.port, nil)
+  end
+
+  def post(uri, body, headers)
+    build_client(uri).start do |connection|
+      connection.post(uri.path, body, headers)
+    end
+  end
 end

test/unit/lambda_server_test.rb

@@ -3,6 +3,7 @@
 require_relative '../../lib/aws_lambda_ric/lambda_errors'
 require_relative '../../lib/aws_lambda_ric/lambda_server'
 require 'net/http'
+require 'socket'
 require 'minitest/autorun'
 
 class LambdaServerTest < Minitest::Test
@@ -37,10 +38,9 @@ def test_post_invocation_error_with_large_xray_cause
     headers = {'Lambda-Runtime-Function-Error-Type' => @error.runtime_error_type,
                'Lambda-Runtime-Function-XRay-Error-Cause' => large_xray_cause,
                'User-Agent' => @mock_user_agent}
-    post_mock = Minitest::Mock.new
-    post_mock.expect :call, nil, [@error_uri, @error.to_lambda_response.to_json, headers]
+    conn_mock = mock_post_connection(@error_uri.path, @error.to_lambda_response.to_json, headers)
 
-    Net::HTTP.stub(:post, post_mock) do
+    Net::HTTP.stub(:new, conn_mock, [@error_uri.host, @error_uri.port]) do
       @under_test.send_error_response(
         request_id: @request_id,
         error_object: @error.to_lambda_response,
@@ -49,17 +49,16 @@ def test_post_invocation_error_with_large_xray_cause
       )
     end
 
-    assert_mock post_mock
+    assert_mock conn_mock
   end
 
   def test_post_invocation_error_with_too_large_xray_cause
     too_large_xray_cause = 'a' * 1024 * 1024
     headers = {'Lambda-Runtime-Function-Error-Type' => @error.runtime_error_type,
                'User-Agent' => @mock_user_agent}
-    post_mock = Minitest::Mock.new
-    post_mock.expect :call, nil, [@error_uri, @error.to_lambda_response.to_json, headers]
+    conn_mock = mock_post_connection(@error_uri.path, @error.to_lambda_response.to_json, headers)
 
-    Net::HTTP.stub(:post, post_mock) do
+    Net::HTTP.stub(:new, conn_mock, [@error_uri.host, @error_uri.port]) do
       @under_test.send_error_response(
         request_id: @request_id,
         error_object: @error.to_lambda_response,
@@ -68,7 +67,44 @@ def test_post_invocation_error_with_too_large_xray_cause
       )
     end
 
-    assert_mock post_mock
+    assert_mock conn_mock
+  end
+
+  # Regression: with a proxy in the environment, the response must still reach
+  # the Runtime API directly
+  def test_send_response_reaches_api_and_not_proxy_when_proxy_is_set
+    api = RecordingServer.new
+    proxy = RecordingServer.new
+
+    ['HTTP_PROXY', 'http_proxy'].each do |var|
+      api.reset
+      proxy.reset
+      env_stub(var, "http://#{proxy.address}") do
+        client = RapidClient.new(api.address, @mock_user_agent)
+        client.send_response(request_id: @request_id, response_object: 'response')
+
+        assert_equal 1, api.hits, 'response should reach the Runtime API'
+        assert_equal 0, proxy.hits, "response must not be routed through #{var}"
+      end
+    end
+  ensure
+    api&.close
+    proxy&.close
+  end
+
+  def mock_post_connection(path, body, headers)
+    conn_mock = Minitest::Mock.new
+    conn_mock.expect(:start, nil) { |&block| block.call(conn_mock) }
+    conn_mock.expect(:post, nil, [path, body, headers])
+    conn_mock
+  end
+
+  def env_stub(name, value)
+    previous = ENV[name]
+    ENV[name] = value
+    yield
+  ensure
+    ENV[name] = previous
   end
 
   def mock_next_invocation_response()
@@ -129,3 +165,49 @@ def test_next_invocation_with_null_tenant_id_header
     assert_mock get_mock
   end
 end
+
+# A minimal HTTP server that binds to a non-loopback address and counts the
+# requests it receives. Non-loopback matters: Net::HTTP never proxies loopback,
+# so a 127.0.0.1 target would bypass the proxy.
+class RecordingServer
+  def initialize
+    ip = Socket.ip_address_list.find { |a| a.ipv4? && !a.ipv4_loopback? && !a.ipv4_multicast? }
+    raise 'no non-loopback IPv4 interface available' unless ip
+
+    @server = TCPServer.new(ip.ip_address, 0)
+    @hits = 0
+    @lock = Mutex.new
+    @thread = Thread.new { accept_loop }
+  end
+
+  def address
+    "#{@server.addr[3]}:#{@server.addr[1]}"
+  end
+
+  def hits
+    @lock.synchronize { @hits }
+  end
+
+  def reset
+    @lock.synchronize { @hits = 0 }
+  end
+
+  def close
+    @thread&.kill
+    @server&.close
+  end
+
+  private
+
+  def accept_loop
+    loop do
+      client = @server.accept
+      @lock.synchronize { @hits += 1 }
+      client.gets
+      client.write("HTTP/1.1 202 Accepted\r\nContent-Length: 0\r\n\r\n")
+      client.close
+    end
+  rescue IOError, Errno::EBADF
+    # server closed
+  end
+end