aikido-zen 1.7.1 → 1.7.2.beta.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ddee51760626c0c9d7af69137f88286d0b49ac9d5aab02d17bebbff71136bb0f
-  data.tar.gz: 7b5ea9701c89111b1423c99750495b7a4d85b725e78008d93b110e4a2be9007c
+  metadata.gz: aedfb64ca08c10194c0483138460f984e086ad2ac95250d3ce570b4c08b48263
+  data.tar.gz: 6332c4155469c35483394a76683169e973feea9ba417fb4c4f434f8df3231b2e
 SHA512:
-  metadata.gz: edada0391a4cc9f6982dddedd67e6972a13ddb60fad9c723cd1c369e36c3ba5699637dbfacce686c1472e6009e9927f69dcb16945ae7c41c65745e110cff614d
-  data.tar.gz: aa43771cf0fb387c55d35fc1f26b3e765ce0c36ed29764ad677fca7d4f69459310a3115088f73a2df65e35d2bc145dc6a6e2294d20ec4aed35cc81fce96de80a
+  metadata.gz: 97a1b03ca7b5b92d944793c650f11791f7a36794e5ebcc85c6c41e6a93f71c1fbab3a5e32f0beeae6254c89ea06f23535275f20cc3732f18c8db722e4b6ec482
+  data.tar.gz: 35ba0d4afe57aba7dac30c89294a875779fba9f36413c1c335d97efb62a47b5d3beaa8c5b96d31a9dda491d89b2dd0a78851a4d5ca83dd34071732c981d92b56

data/lib/aikido/zen/attack_wave/helpers.rb

@@ -13,10 +13,39 @@ module Aikido::Zen
         false
       end
 
+      # Builds the sample for a request that has been classified as suspicious.
+      #
+      # @param context [Aikido::Zen::Context]
+      # @return [Aikido::Zen::AttackWave::Sample]
+      def self.sample_for(context)
+        request = context.request
+
+        Sample.new(verb: request.request_method, path: original_fullpath(request))
+      end
+
       def self.suspicious_request?(context, status_code)
         request = context.request
 
-        suspicious_method?(request.request_method) || suspicious_path?(request.path_info, status_code)
+        suspicious_method?(request.request_method) || suspicious_path?(original_path(request), status_code)
+      end
+
+      # Rails rewrites PATH_INFO to /status before invoking an exceptions_app.
+      # Returns the path that Rails rewrote.
+      # @param request [Aikido::Zen::Request]
+      # @return [String]
+      def self.original_path(request)
+        request.env["action_dispatch.original_path"] || request.path_info
+      end
+
+      # Rails rewrites PATH_INFO to /status before invoking an exceptions_app.
+      # Returns the path that Rails rewrote, including the same query string.
+      # @param request [Aikido::Zen::Request]
+      # @return [String]
+      def self.original_fullpath(request)
+        path = original_path(request)
+        query = request.query_string
+
+        query.empty? ? path : "#{path}?#{query}"
       end
 
       def self.suspicious_method?(method)

data/lib/aikido/zen/attack_wave.rb

@@ -5,6 +5,11 @@ require_relative "attack_wave/helpers"
 
 module Aikido::Zen
   module AttackWave
+    # Tracks per-client-IP attack wave state.
+    #
+    # In multiprocess deployments, the main process has a single instance
+    # that may be accessed concurrently from each forked worker process's
+    # Aikido::Zen::RPC::Server connection thread.
     class Detector
       # @return [Aikido::Zen::CappedSet]
       attr_reader :samples
@@ -12,6 +17,8 @@ module Aikido::Zen
       def initialize(config: Aikido::Zen.config, clock: nil)
         @config = config
 
+        @mutex = Mutex.new
+
         @event_times = Cache.new(@config.attack_wave_max_cache_entries, ttl: @config.attack_wave_min_time_between_events, clock: clock)
 
         @request_counts = Cache.new(@config.attack_wave_max_cache_entries, 0, ttl: @config.attack_wave_min_time_between_requests, clock: clock)
@@ -21,29 +28,54 @@ module Aikido::Zen
         end
       end
 
-      def attack_wave?(context, status_code = nil)
-        client_ip = context.request.client_ip
-
-        return false unless client_ip
+      # @api private
+      # @note Visible for testing.
+      #
+      # Whether the client IP is within the cooldown period after triggering
+      # an attack wave.
+      #
+      # @param client_ip [String]
+      # @return [Boolean]
+      def flagged?(client_ip)
+        !!@event_times[client_ip]
+      end
 
-        return false if @event_times[client_ip]
+      # @api private
+      # @note Visible for testing.
+      #
+      # Flags the client IP as having triggered an attack wave for the
+      # cooldown period.
+      #
+      # @param client_ip [String]
+      # @return [void]
+      def flag!(client_ip)
+        @event_times[client_ip] = Time.now.utc
+      end
 
-        return false unless AttackWave::Helpers.web_scanner?(context, status_code)
+      # Records a suspicious sample and, if it crosses the threshold for
+      # triggering an attack wave, flags the client IP as having just
+      # triggered an attack wave.
+      #
+      # This method is synchronized to prevent concurrent calls for the
+      # same client IP from crossing the threshold in the same instant.
+      #
+      # @param client_ip [String]
+      # @param sample [Aikido::Zen::AttackWave::Sample]
+      # @return [Array<Aikido::Zen::AttackWave::Sample>, nil]
+      def record(client_ip, sample)
+        @mutex.synchronize do
+          return nil if flagged?(client_ip)
 
-        request_count = @request_counts[client_ip] += 1
+          request_count = @request_counts[client_ip] += 1
 
-        context.request.then do |request|
-          @samples[client_ip] <<= Sample.new(
-            verb: request.request_method,
-            path: request.fullpath
-          )
-        end
+          @samples[client_ip] <<= sample
 
-        return false if request_count < @config.attack_wave_threshold
+          return nil if request_count < @config.attack_wave_threshold
 
-        @event_times[client_ip] = Time.now.utc
+          flag!(client_ip)
 
-        true
+          @samples[client_ip].to_a
+        end
       end
     end
 
@@ -117,6 +149,10 @@ module Aikido::Zen
     end
 
     class Sample
+      def self.from_json(data)
+        new(verb: data["method"], path: data["url"])
+      end
+
       # @return [String]
       attr_reader :verb
 

data/lib/aikido/zen/cache.rb

@@ -5,7 +5,7 @@ module Aikido::Zen
     extend Forwardable
 
     # @api private
-    # Visible for testing.
+    # @note Visible for testing.
     def_delegators :@data,
       :size, :empty?
 
@@ -54,13 +54,13 @@ module Aikido::Zen
     end
 
     # @api private
-    # Visible for testing.
+    # @note Visible for testing.
     def to_a
       @data.map { |key, entry| [key, entry.value] }
     end
 
     # @api private
-    # Visible for testing.
+    # @note Visible for testing.
     def to_h
       to_a.to_h
     end

data/lib/aikido/zen/collector/routes.rb

@@ -8,7 +8,7 @@ module Aikido::Zen
   # Keeps track of the visited routes.
   class Collector::Routes
     # @api private
-    # Visible for testing.
+    # @note Visible for testing.
     attr_reader :visits
 
     def initialize(config = Aikido::Zen.config)
@@ -35,7 +35,7 @@ module Aikido::Zen
     end
 
     # @api private
-    # Visible for testing.
+    # @note Visible for testing.
     def [](route)
       @visits[route]
     end

data/lib/aikido/zen/collector.rb

@@ -210,7 +210,6 @@ module Aikido::Zen
     end
 
     # @api private
-    #
     # @note Visible for testing.
     def stats
       handle
@@ -218,7 +217,6 @@ module Aikido::Zen
     end
 
     # @api private
-    #
     # @note Visible for testing.
     def users
       handle
@@ -226,7 +224,6 @@ module Aikido::Zen
     end
 
     # @api private
-    #
     # @note Visible for testing.
     def hosts
       handle
@@ -234,7 +231,6 @@ module Aikido::Zen
     end
 
     # @api private
-    #
     # @note Visible for testing.
     def routes
       handle
@@ -242,7 +238,6 @@ module Aikido::Zen
     end
 
     # @api private
-    #
     # @note Visible for testing.
     def middleware_installed?
       @middleware_installed.true?

data/lib/aikido/zen/idor/protector.rb

@@ -7,7 +7,7 @@ module Aikido::Zen
 
     class Protector
       # @api private
-      # Visible for testing.
+      # @note Visible for testing.
       attr_accessor :cache
 
       def initialize(config: Aikido::Zen.config)

data/lib/aikido/zen/middleware/attack_wave_protector.rb

@@ -21,43 +21,46 @@ module Aikido
         end
 
         # @api private
-        # Visible for testing.
-        def attack_wave?(context, status_code = nil)
+        # @note Visible for testing.
+        #
+        # @param context [Aikido::Zen::Context]
+        # @param status_code [Integer, nil]
+        # @return [Array<Aikido::Zen::AttackWave::Sample>, nil]
+        def detect_attack_wave(context, status_code = nil)
           request = context.request
-          return false if request.nil?
+          return nil if request.nil?
 
-          return false if @settings.bypassed_ips.include?(request.client_ip)
+          return nil if @settings.bypassed_ips.include?(request.client_ip)
 
-          @zen.attack_wave_detector.attack_wave?(context, status_code)
+          @zen.detect_attack_wave(context, status_code)
         end
 
         # @api private
-        # Visible for testing.
+        # @note Visible for testing.
         def protect(context, status_code = nil)
-          if attack_wave?(context, status_code)
-            client_ip = context.request.client_ip
+          samples = detect_attack_wave(context, status_code)
+          return unless samples
 
-            request = Aikido::Zen::AttackWave::Request.new(
-              ip_address: client_ip,
-              user_agent: context.request.user_agent,
-              source: context.request.framework
-            )
+          client_ip = context.request.client_ip
 
-            samples = @zen.attack_wave_detector.samples[client_ip].to_a
+          request = Aikido::Zen::AttackWave::Request.new(
+            ip_address: client_ip,
+            user_agent: context.request.user_agent,
+            source: context.request.framework
+          )
 
-            attack = Aikido::Zen::AttackWave::Attack.new(
-              samples: samples,
-              user: context.request.actor
-            )
+          attack = Aikido::Zen::AttackWave::Attack.new(
+            samples: samples,
+            user: context.request.actor
+          )
 
-            attack_wave = Aikido::Zen::Events::AttackWave.new(
-              request: request,
-              attack: attack
-            )
+          attack_wave = Aikido::Zen::Events::AttackWave.new(
+            request: request,
+            attack: attack
+          )
 
-            @zen.track_attack_wave(attack_wave)
-            @zen.agent.report(attack_wave)
-          end
+          @zen.track_attack_wave(attack_wave)
+          @zen.agent.report(attack_wave)
         end
       end
     end

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.7.1"
+    VERSION = "1.7.2.beta.2"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen/worker_process/agent/client.rb

@@ -8,6 +8,11 @@ module Aikido::Zen::WorkerProcess
       # The keepalive interval must be less than the RPC server read timeout.
       KEEPALIVE_INTERVAL = 4
 
+      # This read timeout should be kept short because attackers can trigger
+      # attack wave detection checks at will, to limit how much latency an
+      # attacker can introduce per request.
+      ATTACK_WAVE_TIMEOUT = 1.0
+
       def initialize(
         host,
         port,
@@ -68,6 +73,20 @@ module Aikido::Zen::WorkerProcess
         raise
       end
 
+      # @param client_ip [String]
+      # @param sample [Aikido::Zen::AttackWave::Sample]
+      # @return [Array<Aikido::Zen::AttackWave::Sample>, nil]
+      def record_attack_wave(client_ip, sample)
+        result = @rpc_client.invoke(
+          "record_attack_wave", ATTACK_WAVE_TIMEOUT,
+          client_ip, sample.verb, sample.path
+        )
+        result&.map { |data| Aikido::Zen::AttackWave::Sample.from_json(data) }
+      rescue => err
+        @config.logger.error("Forked worker process #{Process.pid}: failed to record attack wave sample with parent: #{err.message}")
+        raise
+      end
+
       private
 
       def updated_settings

data/lib/aikido/zen/worker_process/agent/server.rb

@@ -3,8 +3,9 @@
 module Aikido::Zen::WorkerProcess
   module Agent
     class Server
-      def initialize(config: Aikido::Zen.config)
+      def initialize(config: Aikido::Zen.config, detector: Aikido::Zen.attack_wave_detector)
         @config = config
+        @detector = detector
 
         @rpc_server = Aikido::Zen::RPC::Server.new(Aikido::Zen.secret)
 
@@ -25,6 +26,10 @@ module Aikido::Zen::WorkerProcess
           result = calculate_rate_limits(route_data, ip, actor_data)
           respond.call(result&.as_json)
         end
+
+        @rpc_server.handle("record_attack_wave") do |respond, client_ip, verb, path|
+          respond.call(record_attack_wave(client_ip, verb, path))
+        end
       end
 
       def host
@@ -60,8 +65,7 @@ module Aikido::Zen::WorkerProcess
       end
 
       # @api private
-      #
-      # Visible for testing.
+      # @note Visible for testing.
       RequestKind = Struct.new(:route, :schema, :client_ip, :actor)
 
       def updated_settings(known_config_generation = nil, known_firewall_lists_generation = nil)
@@ -92,6 +96,13 @@ module Aikido::Zen::WorkerProcess
         route = Aikido::Zen::Route.from_json(route_data)
         Aikido::Zen.rate_limiter.calculate_rate_limits(RequestKind.new(route, nil, ip, actor))
       end
+
+      # @return [Array<Hash>, nil]
+      def record_attack_wave(client_ip, verb, path)
+        sample = Aikido::Zen::AttackWave::Sample.new(verb: verb, path: path)
+        samples = @detector.record(client_ip, sample)
+        samples&.map(&:as_json)
+      end
     end
   end
 end

data/lib/aikido/zen.rb

@@ -249,6 +249,49 @@ module Aikido
       @attack_wave_detector ||= AttackWave::Detector.new
     end
 
+    # Classifies the current request and, if it is classified as suspicious,
+    # records a sample against the attack wave detector.
+    #
+    # @param context [Aikido::Zen::Context]
+    # @param status_code [Integer, nil]
+    # @return [Array<Aikido::Zen::AttackWave::Sample>, nil]
+    def self.detect_attack_wave(context, status_code = nil)
+      client_ip = context.request.client_ip
+      return nil unless client_ip
+
+      return nil unless AttackWave::Helpers.web_scanner?(context, status_code)
+
+      record_attack_wave(client_ip, AttackWave::Helpers.sample_for(context))
+    end
+
+    # Records a suspicious sample and, if the threshold for triggering
+    # an attack wave has been crossed, flags the client IP as having
+    # just triggered an attack wave.
+    #
+    # In multiprocess deployments, on RPC failure, the worker process
+    # records against its local detector.
+    #
+    # If RPC failures are intermittent, it is possible that an attack
+    # wave may be missed or duplicated, because state is split between
+    # the global and local detectors.
+    #
+    # @param client_ip [String]
+    # @param sample [Aikido::Zen::AttackWave::Sample]
+    # @return [Array<Aikido::Zen::AttackWave::Sample>, nil]
+    def self.record_attack_wave(client_ip, sample)
+      worker_process_client = @worker_process_client
+
+      if worker_process_client
+        begin
+          worker_process_client.record_attack_wave(client_ip, sample)
+        rescue
+          attack_wave_detector.record(client_ip, sample)
+        end
+      else
+        attack_wave_detector.record(client_ip, sample)
+      end
+    end
+
     # @return [Aikido::Zen::IDOR::Protector]
     def self.idor_protector
       @idor_protector ||= IDOR::Protector.new

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.7.1
+  version: 1.7.2.beta.2
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-10 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby