Skip to content

Bref serverless support #414

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ioaniftimesei wants to merge 16 commits into
base: main
Choose a base branch
from
Open

Bref serverless support #414

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
f3dc999
Added support for additional PHP installation paths and improved hand…
ioaniftimesei Apr 15, 2026
b8dfdc6
Add workflow to build Lambda layers for multiple PHP versions and upd…
ioaniftimesei Apr 15, 2026
396bd46
Refactor Lambda layer build process to utilize artifact paths for ext…
ioaniftimesei Apr 16, 2026
b7bd588
Refactor socket and PID path initialization to use dynamic runtime di…
ioaniftimesei Apr 16, 2026
01ef84c
Update Lambda layer build process to correct directory structure and …
ioaniftimesei Apr 16, 2026
af20dda
debug
ioaniftimesei Apr 16, 2026
c520bd4
Refactor runtime directory initialization to check for writable run d…
ioaniftimesei Apr 16, 2026
4cf396a
Update isRunDirWritable function to use os.WriteFile for checking wri…
ioaniftimesei Apr 16, 2026
d5c523c
test
ioaniftimesei Apr 16, 2026
7399dc8
Pass IsLambda to go modules
ioaniftimesei Apr 17, 2026
2fc8720
5s max loop for socket check
ioaniftimesei Apr 17, 2026
4b2df34
+
ioaniftimesei Apr 17, 2026
d87d11f
Merge branch 'main' into bref_serverless_support
ioaniftimesei Apr 17, 2026
0c3250e
+
ioaniftimesei Apr 17, 2026
35a1bf2
+
ioaniftimesei Apr 17, 2026
48726f1
Apply suggestions from code review
ioaniftimesei Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 70 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,76 @@ jobs:
path: |
~/rpmbuild/RPMS/${{ env.ARCH }}/${{ env.AIKIDO_ARTIFACT_RELEASE }}

build_lambda_layers:
name: Build Lambda layers php-${{ matrix.php_version }}
runs-on: ubuntu-24.04
needs: [ build_libs, build_php_extension_nts ]
strategy:
matrix:
php_version: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
fail-fast: false

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Get Aikido version
run: |
AIKIDO_VERSION=$(grep '#define PHP_AIKIDO_VERSION' lib/php-extension/include/php_aikido.h | awk -F'"' '{print $2}')
echo "AIKIDO_VERSION=$AIKIDO_VERSION" >> $GITHUB_ENV
echo "AIKIDO_LIBZEN_VERSION=0.1.60" >> $GITHUB_ENV

- name: Download NTS extension
uses: actions/download-artifact@v4
with:
name: aikido-extension-php-${{ matrix.php_version }}-nts-x86_64
path: artifacts/extension

- name: Download agent
uses: actions/download-artifact@v4
with:
name: aikido-agent-x86_64
path: artifacts/agent

- name: Download request processor
uses: actions/download-artifact@v4
with:
name: aikido-request-processor-x86_64
path: artifacts/request-processor

- name: Download Aikido Zen Internals Lib
run: |
curl -L -O https://github.com/AikidoSec/zen-internals/releases/download/v${{ env.AIKIDO_LIBZEN_VERSION }}/libzen_internals_x86_64-unknown-linux-gnu.so

- name: Build Lambda layer zip
run: |
LAYER_DIR=lambda-layer
AIKIDO_DIR=$LAYER_DIR/aikido-${{ env.AIKIDO_VERSION }}
BREF_CONF_DIR=$LAYER_DIR/bref/etc/php/conf.d

mkdir -p $AIKIDO_DIR $BREF_CONF_DIR

find artifacts/extension -name "aikido-extension-php-${{ matrix.php_version }}-nts.so" -exec cp {} $AIKIDO_DIR/ \;
find artifacts/agent -name "aikido-agent" -exec cp {} $AIKIDO_DIR/ \;
find artifacts/request-processor -name "aikido-request-processor.so" -exec cp {} $AIKIDO_DIR/ \;
cp libzen_internals_x86_64-unknown-linux-gnu.so $AIKIDO_DIR/
chmod +x $AIKIDO_DIR/aikido-agent

echo "extension=/opt/aikido-${{ env.AIKIDO_VERSION }}/aikido-extension-php-${{ matrix.php_version }}-nts.so" > $BREF_CONF_DIR/ext-aikido.ini

ls -la $AIKIDO_DIR/

cd $LAYER_DIR
zip -r ../aikido-firewall-bref-lambda-layer-php-${{ matrix.php_version }}-x86_64.zip .

- name: Archive Lambda layer
uses: actions/upload-artifact@v4
with:
name: aikido-firewall-bref-lambda-layer-php-${{ matrix.php_version }}-x86_64
if-no-files-found: error
path: |
aikido-firewall-bref-lambda-layer-php-${{ matrix.php_version }}-x86_64.zip

build_deb:
name: Build deb ${{ matrix.arch == '' && 'x86_64' || 'arm' }}
runs-on: ubuntu-24.04${{ matrix.arch }}
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,16 @@ jobs:
with:
pattern: |
aikido-php-firewall*

- name: Download Lambda layer artifacts
uses: actions/download-artifact@v4
with:
pattern: |
aikido-firewall-bref-lambda-layer-*

- name: List Artifacts
run: |
ls -l
ls -lR
pwd

- name: Deploy to GitHub Release (draft)
Expand All @@ -38,3 +44,4 @@ jobs:
draft: true
files: |
./**/aikido-php-firewall*
./**/aikido-firewall-bref-lambda-layer-*
23 changes: 20 additions & 3 deletions lib/agent/constants/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,26 @@
package constants

import "os"

const Version = "1.5.4"

var SocketPath string
var PidPath string

func isRunDirWritable() bool {
return os.MkdirAll("/run/aikido-writetest", 0777) == nil && os.Remove("/run/aikido-writetest") == nil
Copy link
Copy Markdown
Contributor

@aikido-pr-checks aikido-pr-checks Bot Apr 16, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isRunDirWritable combines os.MkdirAll and os.Remove in one boolean expression; separate the operations and handle errors explicitly to improve readability and debuggability.

Show fix
Suggested change
return os.MkdirAll("/run/aikido-writetest", 0777) == nil && os.Remove("/run/aikido-writetest") == nil
mkdirErr := os.MkdirAll("/run/aikido-writetest", 0777)
if mkdirErr != nil {
return false
}
removeErr := os.Remove("/run/aikido-writetest")
return removeErr == nil
Details

✨ AI Reasoning
​A new utility function returns the combined result of directory creation and removal in one expression. This compresses two IO operations into one line, making failure modes harder to inspect and increasing reasoning complexity for future maintainers.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

}

func init() {
runDir := "/run/aikido-" + Version
if !isRunDirWritable() {
runDir = "/tmp/aikido-" + Version
}
SocketPath = runDir + "/aikido-agent.sock"
PidPath = runDir + "/aikido-agent.pid"
}

const (
Version = "1.5.4"
SocketPath = "/run/aikido-" + Version + "/aikido-agent.sock"
PidPath = "/run/aikido-" + Version + "/aikido-agent.pid"
ConfigUpdatedAtMethod = "GET"
ConfigUpdatedAtAPI = "/config"
ConfigAPIMethod = "GET"
Expand Down
12 changes: 10 additions & 2 deletions lib/php-extension/Agent.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
#include "Includes.h"

static std::string GetRuntimeDir() {
if (getenv("AWS_LAMBDA_FUNCTION_NAME") != nullptr) {
return "/tmp/aikido-" + std::string(PHP_AIKIDO_VERSION);
}
return "/run/aikido-" + std::string(PHP_AIKIDO_VERSION);
}

vector<pid_t> Agent::GetPIDsFromRunningProcesses(const std::string& aikidoAgentPath) {
vector<pid_t> agentPIDs;

Expand Down Expand Up @@ -105,7 +112,7 @@ bool Agent::IsRunning(const std::string& aikidoAgentPath, const std::string& aik

AIKIDO_LOG_INFO("Found socket file \"%s\" on disk! Checking if Aikido Agent process is running...\n", aikidoAgentSocketPath.c_str());

std::string aikidoAgentPidPath = "/run/aikido-" + std::string(PHP_AIKIDO_VERSION) + "/aikido-agent.pid";
std::string aikidoAgentPidPath = GetRuntimeDir() + "/aikido-agent.pid";
pid_t agentPIDFromFile = this->GetPIDFromFile(aikidoAgentPidPath);
vector<pid_t> agentPIDsFromRunningProcesses = this->GetPIDsFromRunningProcesses(aikidoAgentPath);
if (agentPIDFromFile == -1 ||
Expand All @@ -126,7 +133,8 @@ bool Agent::IsRunning(const std::string& aikidoAgentPath, const std::string& aik

bool Agent::Init() {
std::string aikidoAgentPath = "/opt/aikido-" + std::string(PHP_AIKIDO_VERSION) + "/aikido-agent";
std::string aikidoAgentSocketPath = "/run/aikido-" + std::string(PHP_AIKIDO_VERSION) + "/aikido-agent.sock";
std::string runtimeDir = GetRuntimeDir();
std::string aikidoAgentSocketPath = runtimeDir + "/aikido-agent.sock";

if (this->IsRunning(aikidoAgentPath, aikidoAgentSocketPath)) {
AIKIDO_LOG_INFO("Aikido Agent is already running! Skipping init...\n");
Expand Down
19 changes: 15 additions & 4 deletions lib/request-processor/globals/globals.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,18 @@ func CreateServer(token string) *ServerData {
return Servers[token]
}

const (
Version = "1.5.4"
SocketPath = "/run/aikido-" + Version + "/aikido-agent.sock"
)
const Version = "1.5.4"

var SocketPath string

func isRunDirWritable() bool {
return os.MkdirAll("/run/aikido-writetest", 0777) == nil && os.Remove("/run/aikido-writetest") == nil
Copy link
Copy Markdown
Contributor

@aikido-pr-checks aikido-pr-checks Bot Apr 16, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isRunDirWritable combines two filesystem operations with && on one line; split the MkdirAll and Remove calls into separate statements with explicit error handling for clarity.

Show fix
Suggested change
return os.MkdirAll("/run/aikido-writetest", 0777) == nil && os.Remove("/run/aikido-writetest") == nil
if err := os.MkdirAll("/run/aikido-writetest", 0777); err != nil {
return false
}
if err := os.Remove("/run/aikido-writetest"); err != nil {
return false
}
return true
Details

✨ AI Reasoning
​A single function returns the boolean result of two filesystem operations combined with &&. This bundles IO side effects into one-line logic, increasing cognitive load and hiding partial failure details. Separating the calls improves readability and error handling.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

}

func init() {
runDir := "/run/aikido-" + Version
if !isRunDirWritable() {
runDir = "/tmp/aikido-" + Version
}
SocketPath = runDir + "/aikido-agent.sock"
}
20 changes: 11 additions & 9 deletions package/rpm/aikido.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ if command -v php -v >/dev/null 2>&1; then
fi

# Check common PHP installation paths
for php_path in /usr/bin/php* /usr/local/bin/php*; do
for php_path in /usr/bin/php* /usr/local/bin/php* /opt/bin/php*; do
if [[ -x "$php_path" && "$php_path" =~ php([0-9]+\.[0-9]+)$ ]]; then
version=$("$php_path" -v | grep -oP 'PHP \K\d+\.\d+' | head -n 1)
if [[ ! " ${PHP_VERSIONS[@]} " =~ " ${version} " ]]; then
Expand Down Expand Up @@ -133,9 +133,10 @@ for PHP_VERSION in "${PHP_VERSIONS[@]}"; do
fi
else
# RedHat-based system
if [ -d "$PHP_MOD_DIR" ]; then
echo "Installing new Aikido mod in $PHP_MOD_DIR/zz-aikido-%{version}.ini..."
ln -sf /opt/aikido-%{version}/aikido.ini $PHP_MOD_DIR/zz-aikido-%{version}.ini
PHP_MOD_DIR_FIRST="${PHP_MOD_DIR%%:*}"
if [ -d "$PHP_MOD_DIR_FIRST" ]; then
echo "Installing new Aikido mod in $PHP_MOD_DIR_FIRST/zz-aikido-%{version}.ini..."
ln -sf /opt/aikido-%{version}/aikido.ini $PHP_MOD_DIR_FIRST/zz-aikido-%{version}.ini
else
echo "No mod dir for PHP $PHP_VERSION! Skipping..."
continue
Expand Down Expand Up @@ -198,7 +199,7 @@ if command -v php -v >/dev/null 2>&1; then
fi

# Check common PHP installation paths
for php_path in /usr/bin/php* /usr/local/bin/php*; do
for php_path in /usr/bin/php* /usr/local/bin/php* /opt/bin/php*; do
if [[ -x "$php_path" && "$php_path" =~ php([0-9]+\.[0-9]+)$ ]]; then
version=$("$php_path" -v | grep -oP 'PHP \K\d+\.\d+' | head -n 1)
if [[ ! " ${PHP_VERSIONS[@]} " =~ " ${version} " ]]; then
Expand Down Expand Up @@ -252,10 +253,11 @@ for PHP_VERSION in "${PHP_VERSIONS[@]}"; do
rm -f $PHP_DEBIAN_MOD_DIR_APACHE2/zz-aikido-%{version}.ini
fi
else
# RedHat-based system
if [ -d "$PHP_MOD_DIR" ]; then
echo "Uninstalling Aikido mod from $PHP_MOD_DIR/zz-aikido-%{version}.ini..."
rm -f $PHP_MOD_DIR/zz-aikido-%{version}.ini
# RedHat-based system (take first dir if colon-separated)
PHP_MOD_DIR_FIRST="${PHP_MOD_DIR%%:*}"
if [ -f "$PHP_MOD_DIR_FIRST/zz-aikido-%{version}.ini" ]; then
echo "Uninstalling Aikido mod from $PHP_MOD_DIR_FIRST/zz-aikido-%{version}.ini..."
rm -f $PHP_MOD_DIR_FIRST/zz-aikido-%{version}.ini
fi
fi

Expand Down
Loading