aikido-zen 1.7.2 → 1.9.0.beta.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41f1982e134a806c513cc166247059c3f290f6bbc88ff32dcf4bdc65da9f377d
-  data.tar.gz: d97dac2f830555239836a143b815ca3c85c4993776183ce73bc5dc392fed9618
+  metadata.gz: d41298c1b3dc0135c211b4beade2a723603cef96372b5526447e5a0d792d1bb9
+  data.tar.gz: 247dea5c7895db42823c445ce7e0f32995ba833cecbcf7430ad09f33c897c179
 SHA512:
-  metadata.gz: 526140c45a47c29f4f36e1508bc3305bafe535e92479c877deeb92a1f74c618fa19d7c46a7d67183310fbc414f05912b93c88f2cdb109730d04c0b4b6a54b301
-  data.tar.gz: 6c43bc7461a52ded8331b6ba2188afd9d273e1b012f5912b2d9786c439e2890380003779925bd3f37fdd4422f4b34aefe13af6d29d0a6a7f3b4e351c5019dca1
+  metadata.gz: ada3f8112966d020346b164380a2cbff9e1ba7c68cfdde2ab2a440d41e1c241c6ef73c9214597fd004e408b61c00ecc9b78294bfd73bef0effd1ca91dbdee5b4
+  data.tar.gz: 7f61d126b05f54339ca7633e8058e36d298dcd0a4b0abf93eebe4abb96a5c66edbf0e56cc3e6457ed92f8cf46231d6f00f60dc5b8487bdd014532db48ef52dba

data/README.md

@@ -39,6 +39,12 @@ Zen for Ruby 2.7+ is compatible with:
 
 * ✅ [Ruby on Rails](docs/rails.md) 7.x, 8.x
 
+### Application servers
+
+* ✅ [Puma](https://puma.io/)
+
+Our test suite only covers Puma. If you use another Rack server, [contact us](docs/troubleshooting.md#contact-support) and we'll help check whether Zen is compatible.
+
 ### Database drivers
 
 * ✅ [`sqlite3`](https://github.com/sparklemotion/sqlite3-ruby) 1.x, 2.x
@@ -117,7 +123,8 @@ See [Reporting to Aikido](#reporting-to-your-aikido-security-dashboard) to learn
 
 ## Additional configuration
 
-[Configure Zen using environment variables for authentication, mode settings, debugging, and more.](https://help.aikido.dev/doc/configuration-via-env-vars/docrSItUkeR9)
+* [Configure Zen using environment variables for authentication, mode settings, debugging, and more](https://help.aikido.dev/doc/configuration-via-env-vars/docrSItUkeR9)
+* [Track custom events](docs/custom-event-tracking.md): trigger events that Playbooks can act on
 
 ## License
 

data/benchmarks/ip_list/benchmark.rb

@@ -24,7 +24,7 @@ end
 if __FILE__ == $0
   ip_ranges = random_ip_ranges.take(1000)
 
-  ip_list = Aikido::Zen::RuntimeSettings::IPList.from_json({
+  ip_list = Aikido::Zen::Firewall::IPList.from_json({
     "key" => "key",
     "source" => "source",
     "description" => "description",

data/docs/custom-event-tracking.md

@@ -0,0 +1,33 @@
+# Track custom events
+
+Use `Aikido::Zen.track_custom_event` to report events that only your application knows about, such as failed logins. [Playbooks](https://help.aikido.dev/zen-firewall/zen-features/playbooks) can act when an event occurs repeatedly, for example by blocking an IP after three failed logins in five minutes.
+
+```ruby
+# app/controllers/application_controller.rb
+class ApplicationController < ActionController::Base
+  private
+
+  def authenticate_user!
+    # Your authentication logic here
+    # ...
+
+    unless current_user
+        Aikido::Zen.track_custom_event("user.login_failed")
+        return
+    end
+
+    Aikido::Zen.set_user(
+      id: current_user.id,
+      name: current_user.name
+    )
+
+    Aikido::Zen.track_custom_event("user.login_succeeded")
+  end
+end
+```
+
+After adding `Aikido::Zen.track_custom_event`, trigger the event at least once. It will then appear on the Playbooks page in the Aikido dashboard. From there, you can create a playbook and choose what should happen when the event occurs. Calling `Aikido::Zen.track_custom_event` by itself does not create a playbook or block anything.
+
+Call `Aikido::Zen.track_custom_event` while handling an HTTP request. Zen associates the event with the request's IP address. Playbook counts are per IP, not across your whole app. If you call [`Aikido::Zen.set_user`](./rails.md#rate-limiting-and-user-blocking) before tracking the event, Zen also includes the current user. `Aikido::Zen.set_user` is optional. Events without a user are still tracked.
+
+Event names can use any format. We recommend lowercase, dot-separated names such as `user.login_failed`.

data/docs/request-bypassing.md

@@ -1,11 +1,23 @@
 # Bypass Zen for a specific request
 
-To disable Zen for a specific request, call `Aikido::Zen.request_bypassed!` from a Rack middleware. This bypasses Zen's security checks and stats collection for that request.
+Call `Aikido::Zen.request_bypassed!` from a Rack middleware to bypass Zen for this request. A bypassed request is fully excluded from Zen inspection and enforcement: Zen will not analyze the request, generate findings, or apply blocking rules for that traffic. Your application handles the request normally.
 
 > [!NOTE]
-> Zen already has a built-in feature for bypassing specific IP addresses. This feature offers more flexibility, letting you bypass Zen for a request based on any criteria you choose.
+> Zen's built-in [Bypassed IPs](https://help.aikido.dev/zen-firewall/zen-features/bypassed-ips) feature uses request bypassing internally, triggered by a matching IP/CIDR. `Aikido::Zen.request_bypassed!` lets you bypass requests using your custom logic.
 
-`Aikido::Zen.request_bypassed!` needs the request's context to already be set up, so your middleware must run after Zen's `ContextSetter` middleware. The following example shows how to bypass a specific request in a Rails application:
+## What gets bypassed
+
+* **Attack protection** — SQL injection, path traversal, command injection, and SSRF attacks are not blocked or reported
+* **Rate limiting** — never triggered.
+* **IP blocking** — Known Threat Actors, Tor traffic blocking/monitoring, country blocking, and custom IP allow/block lists are not checked.
+* **Bot traffic blocking** — not checked.
+* **User blocking** — blocked users are not blocked.
+* **Statistics** — the request isn't counted, and doesn't count against your monitored request quota.
+* **Attack wave protection** — the request doesn't count towards wave detection.
+
+## Usage
+
+Insert your middleware directly after `Aikido::Zen::Middleware::ContextSetter`, so it runs after the request context is set up but before Zen's other middleware:
 
 ```ruby
 # config/application.rb
@@ -35,4 +47,4 @@ end
 ```
 
 > [!WARNING]
-> Use this feature with caution, as it can potentially expose your application to security risks if not used properly.
+> A bypassed request gets zero protection from Zen — no attack detection, no rate limiting, no blocking, no tracking. Ensure that your custom logic only bypasses requests that you fully trust.

data/lib/aikido/zen/agent.rb

@@ -68,27 +68,22 @@ module Aikido::Zen
       # :nocov:
 
       report(Events::Started.new(time: @started_at)) do |response|
-        if update_settings_from_runtime_config!(response, reason: "after start")
-          updated_settings!
-
-          if @config.realtime_settings_updates_enabled? || @settings.realtime_settings_updates_enabled?
-            @api_stream.handle("config-updated") do |event|
-              @config.logger.debug("Received server-sent event: config-updated")
-              settings_updated(event)
-            end
+        update_settings_from_runtime_config!(response, reason: "after start")
+        updated_settings!
 
-            @api_stream.start!
+        if @config.realtime_settings_updates_enabled? || @settings.realtime_settings_updates_enabled?
+          @api_stream.handle("config-updated") do |event|
+            @config.logger.debug("Received server-sent event: config-updated")
+            settings_updated(event)
           end
-        # :nocov:
-        else
-          # empty
+
+          @api_stream.start!
         end
-        # :nocov:
       rescue => err
         @config.logger.error(err.message)
       end
 
-      begin
+      @worker.perform do
         update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after start")
       rescue => err
         @config.logger.error(err.message)
@@ -165,6 +160,15 @@ module Aikido::Zen
       end
     end
 
+    # Reports a custom event tracked via Aikido::Zen.track_custom_event, if
+    # reporting is enabled.
+    #
+    # @param event [Aikido::Zen::Events::Custom]
+    # @return [void]
+    def report_custom_event(event)
+      report(event) if @api_client.can_make_requests?
+    end
+
     # @api private
     #
     # Atomically flushes all the stats stored by the agent, and sends a
@@ -220,6 +224,8 @@ module Aikido::Zen
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 
       if should_fetch_settings?(updated_at)
+        return if realtime_settings_updates_too_fast?
+
         if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after server-sent event")
           updated_settings!
 
@@ -239,6 +245,19 @@ module Aikido::Zen
       updated_at > last_updated_at
     end
 
+    def realtime_settings_updates_too_fast?
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+
+      last_updated_at = @realtime_settings_updates_last_updated_at
+      if last_updated_at && now - last_updated_at < @config.realtime_settings_updates_min_time_between_events
+        return true
+      end
+
+      @realtime_settings_updates_last_updated_at = now
+
+      false
+    end
+
     def heartbeats
       @heartbeats ||= Aikido::Zen::Agent::HeartbeatsManager.new(
         config: @config,
@@ -257,7 +276,7 @@ module Aikido::Zen
       begin
         return false unless Aikido::Zen.api_cache.update_runtime_config(data)
 
-        if Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+        if Aikido::Zen.runtime_settings.update_from_json(data)
           @config.logger.info("Updated runtime settings #{reason}")
           true
         else
@@ -279,7 +298,7 @@ module Aikido::Zen
       begin
         return false unless Aikido::Zen.api_cache.update_runtime_firewall_lists(data)
 
-        if Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+        if Aikido::Zen.firewall.update_from_json(data)
           @config.logger.info("Updated runtime firewall list #{reason}")
           true
         else

data/lib/aikido/zen/api_client.rb

@@ -133,6 +133,8 @@ module Aikido::Zen
         response = http.request(request)
 
         case response
+        when Net::HTTPNoContent
+          # empty
         when Net::HTTPSuccess
           begin
             body = decode(response.body, response["Content-Encoding"])

data/lib/aikido/zen/attack_wave/helpers.rb

@@ -447,7 +447,6 @@ module Aikido::Zen
         "smb.conf",
         "iis.log",
         "pom.xml",
-        "openapi.json",
         "vim_settings.xml",
         "winscp.ini",
         "ws_ftp.ini"

data/lib/aikido/zen/collector/event.rb

@@ -157,14 +157,16 @@ module Aikido::Zen
         def self.from_json(data)
           new(
             data["sink_name"],
+            data["sink_kind"],
             data["duration"],
             has_errors: data["has_errors"]
           )
         end
 
-        def initialize(sink_name, duration, has_errors:)
+        def initialize(sink_name, sink_kind, duration, has_errors:)
           super()
           @sink_name = sink_name
+          @sink_kind = sink_kind
           @duration = duration
           @has_errors = has_errors
         end
@@ -172,17 +174,18 @@ module Aikido::Zen
         def as_json
           super.update({
             "sink_name" => @sink_name,
+            "sink_kind" => @sink_kind,
             "duration" => @duration,
             "has_errors" => @has_errors
           })
         end
 
         def handle(collector)
-          collector.handle_track_scan(@sink_name, @duration, has_errors: @has_errors)
+          collector.handle_track_scan(@sink_name, @sink_kind, @duration, has_errors: @has_errors)
         end
 
         def inspect
-          "#<#{self.class.name} #{@sink_name} #{format "%0.6f", @duration} #{@has_errors}>"
+          "#<#{self.class.name} #{@sink_name} #{@sink_kind} #{format "%0.6f", @duration} #{@has_errors}>"
         end
       end
 
@@ -192,29 +195,32 @@ module Aikido::Zen
         def self.from_json(data)
           new(
             data["sink_name"],
+            data["sink_kind"],
             being_blocked: data["being_blocked"]
           )
         end
 
-        def initialize(sink_name, being_blocked:)
+        def initialize(sink_name, sink_kind, being_blocked:)
           super()
           @sink_name = sink_name
+          @sink_kind = sink_kind
           @being_blocked = being_blocked
         end
 
         def as_json
           super.update({
             "sink_name" => @sink_name,
+            "sink_kind" => @sink_kind,
             "being_blocked" => @being_blocked
           })
         end
 
         def handle(collector)
-          collector.handle_track_attack(@sink_name, being_blocked: @being_blocked)
+          collector.handle_track_attack(@sink_name, @sink_kind, being_blocked: @being_blocked)
         end
 
         def inspect
-          "#<#{self.class.name} #{@sink_name} #{@being_blocked}>"
+          "#<#{self.class.name} #{@sink_name} #{@sink_kind} #{@being_blocked}>"
         end
       end
 

data/lib/aikido/zen/collector/sink_stats.rb

@@ -7,6 +7,9 @@ module Aikido::Zen
   #
   # Tracks data specific to a single Sink.
   class Collector::SinkStats
+    # @return [String] category of operation this sink represents.
+    attr_accessor :kind
+
     # @return [Integer] number of total calls to Sink#scan.
     attr_accessor :scans
 
@@ -62,6 +65,7 @@ module Aikido::Zen
 
     def as_json
       {
+        "kind" => @kind,
         "total" => @scans,
         "interceptorThrewError" => @errors,
         "withoutContext" => 0,

data/lib/aikido/zen/collector/stats.rb

@@ -94,21 +94,25 @@ module Aikido::Zen
     end
 
     # @param sink_name [String] the name of the sink
+    # @param sink_kind [String] the category of operation the sink represents
     # @param duration [Float] the length the scan in seconds
     # @param has_errors [Boolean] whether errors occurred during the scan
     # @return [void]
-    def add_scan(sink_name, duration, has_errors:)
+    def add_scan(sink_name, sink_kind, duration, has_errors:)
       stats = @sinks[sink_name]
+      stats.kind = sink_kind
       stats.scans += 1
       stats.errors += 1 if has_errors
       stats.add_timing(duration)
     end
 
     # @param sink_name [String] the name of the sink
+    # @param sink_kind [String] the category of operation the sink represents
     # @param being_blocked [Boolean] whether the Agent blocked the request
     # @return [void]
-    def add_attack(sink_name, being_blocked:)
+    def add_attack(sink_name, sink_kind, being_blocked:)
       stats = @sinks[sink_name]
+      stats.kind = sink_kind
       stats.attacks += 1
       stats.blocked_attacks += 1 if being_blocked
     end

data/lib/aikido/zen/collector.rb

@@ -146,12 +146,12 @@ module Aikido::Zen
     # @param scan [Aikido::Zen::Scan]
     # @return [void]
     def track_scan(scan)
-      add_event(Events::TrackScan.new(scan.sink.name, scan.duration, has_errors: scan.errors?))
+      add_event(Events::TrackScan.new(scan.sink.name, scan.sink.kind, scan.duration, has_errors: scan.errors?))
     end
 
-    def handle_track_scan(sink_name, duration, has_errors:)
+    def handle_track_scan(sink_name, sink_kind, duration, has_errors:)
       synchronize(@stats) do |stats|
-        stats.add_scan(sink_name, duration, has_errors: has_errors)
+        stats.add_scan(sink_name, sink_kind, duration, has_errors: has_errors)
       end
     end
 
@@ -160,12 +160,12 @@ module Aikido::Zen
     # @param attack [Aikido::Zen::Attack]
     # @return [void]
     def track_attack(attack)
-      add_event(Events::TrackAttack.new(attack.sink.name, being_blocked: attack.blocked?))
+      add_event(Events::TrackAttack.new(attack.sink.name, attack.sink.kind, being_blocked: attack.blocked?))
     end
 
-    def handle_track_attack(sink_name, being_blocked:)
+    def handle_track_attack(sink_name, sink_kind, being_blocked:)
       synchronize(@stats) do |stats|
-        stats.add_attack(sink_name, being_blocked: being_blocked)
+        stats.add_attack(sink_name, sink_kind, being_blocked: being_blocked)
       end
     end
 

data/lib/aikido/zen/config.rb

@@ -42,7 +42,7 @@ module Aikido::Zen
     attr_reader :api_endpoint
 
     # @return [URI] The HTTP host for the Aikido Runtime API. Defaults to
-    #   +https://runtime.aikido.dev+.
+    #   +https://guard.aikido.dev+.
     attr_reader :realtime_endpoint
 
     # @return [Hash] HTTP timeouts for communicating with the API.
@@ -56,6 +56,10 @@ module Aikido::Zen
     #   each initial heartbeat event.
     attr_accessor :initial_heartbeat_delays
 
+    # @return [Symbol] the agent mode for forked worker processes. Can be set
+    #   through the AIKIDO_AGENT_MODE environment variable.
+    attr_reader :agent_mode
+
     # @return [Integer] the interval in seconds at which forked worker processes
     #   poll the parent process for updated runtime settings. Defaults to 10 seconds.
     attr_accessor :worker_process_polling_interval
@@ -229,6 +233,11 @@ module Aikido::Zen
     attr_accessor :realtime_settings_updates_enabled
     alias_method :realtime_settings_updates_enabled?, :realtime_settings_updates_enabled
 
+    # @return [Integer] the minimum time in milliseconds between realtime
+    #   settings updates.
+    #   Defaults to 9 seconds in milliseconds.
+    attr_accessor :realtime_settings_updates_min_time_between_events
+
     def initialize
       self.insert_middleware_after = ::ActionDispatch::RemoteIp
       self.disabled = read_boolean_from_env(ENV.fetch("AIKIDO_DISABLE", false)) || read_boolean_from_env(ENV.fetch("AIKIDO_DISABLED", false))
@@ -236,10 +245,11 @@ module Aikido::Zen
       self.debugging = read_boolean_from_env(ENV.fetch("AIKIDO_DEBUG", false))
       self.api_token = ENV.fetch("AIKIDO_TOKEN", nil)
       self.api_endpoint = ENV.fetch("AIKIDO_ENDPOINT") { regional_api_endpoint(api_token) }
-      self.realtime_endpoint = ENV.fetch("AIKIDO_REALTIME_ENDPOINT", DEFAULT_RUNTIME_BASE_URL)
+      self.realtime_endpoint = api_endpoint
       self.api_timeouts = 10
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
+      self.agent_mode = ENV.fetch("AIKIDO_AGENT_MODE", "shared")
       self.worker_process_polling_interval = 10
       self.worker_process_polling_jitter = 10
       self.worker_process_heartbeat_interval = 10
@@ -277,6 +287,7 @@ module Aikido::Zen
       self.idor_excluded_table_names = []
       self.idor_max_cache_entries = 1000
       self.realtime_settings_updates_enabled = false
+      self.realtime_settings_updates_min_time_between_events = 9 * 1000 # 9 sec (ms)
     end
 
     # Set the base URL for API requests.
@@ -293,6 +304,17 @@ module Aikido::Zen
       @realtime_endpoint = URI(url)
     end
 
+    # @param mode [Symbol, String] a supported agent mode.
+    # @raise [ArgumentError]
+    def agent_mode=(mode)
+      mode = mode.to_sym
+      unless AGENT_MODES.include?(mode)
+        raise ArgumentError, "agent_mode must be one of #{AGENT_MODES.join(", ")}, got #{mode}"
+      end
+
+      @agent_mode = mode
+    end
+
     # Set the logger and configure its severity level according to agent's debug mode
     # @param logger [::Logger]
     def logger=(logger)
@@ -364,6 +386,9 @@ module Aikido::Zen
       end
     end
 
+    # @!visibility private
+    AGENT_MODES = [:shared, :per_worker].freeze
+
     # @!visibility private
     DEFAULT_AIKIDO_ENDPOINT = "https://guard.aikido.dev"
 
@@ -377,9 +402,6 @@ module Aikido::Zen
       "AU" => "https://guard.au.aikido.dev"
     }.freeze
 
-    # @!visibility private
-    DEFAULT_RUNTIME_BASE_URL = "https://runtime.aikido.dev"
-
     # @!visibility private
     DEFAULT_JSON_ENCODER = JSON.method(:dump)
 

data/lib/aikido/zen/event.rb

@@ -95,5 +95,31 @@ module Aikido::Zen
         )
       end
     end
+
+    # Event sent by Aikido::Zen.track_custom_event to record a custom,
+    # user-named event happening during an HTTP request.
+    class Custom < Event
+      # @param name [String] the name of the tracked event.
+      # @param request [Aikido::Zen::Request]
+      # @param user [Aikido::Zen::Actor, nil]
+      # @param opts [Hash<Symbol, Object>] any other options to pass to
+      #   the superclass initializer.
+      def initialize(name:, request:, user: nil, **opts)
+        super(type: "custom", **opts)
+        @name = name
+        @request = request
+        @user = user
+      end
+
+      def as_json
+        super.update(
+          {
+            name: @name,
+            request: @request.as_json,
+            user: @user && {id: @user.id, name: @user.name}.compact
+          }.compact
+        )
+      end
+    end
   end
 end

data/lib/aikido/zen/{runtime_settings → firewall}/ip_list.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Aikido::Zen
-  class RuntimeSettings::IPList
+  class Firewall::IPList
     attr_reader :key
     attr_reader :source
     attr_reader :description

data/lib/aikido/zen/firewall.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  class Firewall
+    # @return [Regexp, nil]
+    attr_accessor :blocked_user_agent_regexp
+
+    # @return [Regexp, nil]
+    attr_accessor :monitored_user_agent_regexp
+
+    # @return [Array<Hash>, nil]
+    attr_accessor :user_agent_details
+
+    # @return [Array<Aikido::Zen::Firewall::IPList>]
+    attr_accessor :blocked_ip_lists
+
+    # @return [Array<Aikido::Zen::Firewall::IPList>]
+    attr_accessor :allowed_ip_lists
+
+    # @return [Array<Aikido::Zen::Firewall::IPList>]
+    attr_accessor :monitored_ip_lists
+
+    def initialize
+      self.blocked_ip_lists = []
+      self.allowed_ip_lists = []
+      self.monitored_ip_lists = []
+    end
+
+    # @param data [Hash] the decoded JSON payload from /api/runtime/firewall/lists
+    # @return [Boolean]
+    def update_from_json(data)
+      self.blocked_user_agent_regexp = pattern(data["blockedUserAgents"])
+
+      self.monitored_user_agent_regexp = pattern(data["monitoredUserAgents"])
+
+      self.user_agent_details = []
+
+      data["userAgentDetails"]&.each do |record|
+        key = record["key"]
+        pattern = pattern(record["pattern"])
+
+        next if key.nil? || pattern.nil?
+
+        user_agent_details << {
+          key: key,
+          pattern: pattern
+        }
+      end
+
+      self.blocked_ip_lists = []
+
+      data["blockedIPAddresses"]&.each do |ip_list|
+        blocked_ip_lists << Firewall::IPList.from_json(ip_list)
+      end
+
+      self.allowed_ip_lists = []
+
+      data["allowedIPAddresses"]&.each do |ip_list|
+        allowed_ip_lists << Firewall::IPList.from_json(ip_list)
+      end
+
+      self.monitored_ip_lists = []
+
+      data["monitoredIPAddresses"]&.each do |ip_list|
+        monitored_ip_lists << Firewall::IPList.from_json(ip_list)
+      end
+
+      true
+    end
+
+    # Construct a regular expression from the non-nil and non-empty string,
+    # otherwise return nil.
+    #
+    # The resulting regular expression is case insensitive.
+    #
+    # @param string [String, nil]
+    # @return [Regexp, nil]
+    private def pattern(string)
+      return nil if string.nil? || string.empty?
+
+      begin
+        /#{string}/i
+      rescue RegexpError
+        nil
+      end
+    end
+
+    # @param user_agent [String] the user agent
+    # @return [Boolean] whether the user agent should be blocked
+    def blocked_user_agent?(user_agent)
+      return false if blocked_user_agent_regexp.nil?
+
+      blocked_user_agent_regexp.match?(user_agent)
+    end
+
+    # @param user_agent [String] the user agent
+    # @return [Boolean] whether the user agent should be monitored
+    def monitored_user_agent?(user_agent)
+      return false if monitored_user_agent_regexp.nil?
+
+      monitored_user_agent_regexp.match?(user_agent)
+    end
+
+    # @param user_agent [String] the user agent
+    # @return [Array<String>] the matching user agent keys
+    def user_agent_keys(user_agent)
+      return [] if user_agent_details.nil?
+
+      user_agent_details.filter_map { |record| record[:key] if record[:pattern].match?(user_agent) }
+    end
+
+    def allowed_ip?(ip)
+      allowed_ip_lists.empty? || allowed_ip_lists.any? { |ip_list| ip_list.include?(ip) }
+    end
+
+    def blocked_ip?(ip)
+      blocked_ip_lists.any? { |ip_list| ip_list.include?(ip) }
+    end
+
+    def monitored_ip?(ip)
+      monitored_ip_lists.any? { |ip_list| ip_list.include?(ip) }
+    end
+
+    def monitored_ip_list_keys(ip)
+      return [] if ip.nil?
+
+      monitored_ip_lists.filter_map { |ip_list| ip_list.key if ip_list.include?(ip) }
+    end
+  end
+end
+
+require_relative "firewall/ip_list"

data/lib/aikido/zen/middleware/fork_detector.rb

@@ -11,14 +11,20 @@ module Aikido
           @app = app
 
           @pid = Concurrent::AtomicFixnum.new(Process.pid)
+          @fork_mutex = Mutex.new
         end
 
         def call(env)
-          new_pid = Process.pid
-          old_pid = @pid.value
+          pid = Process.pid
 
-          if new_pid != old_pid && @pid.compare_and_set(old_pid, new_pid)
-            Aikido::Zen.fork!
+          if pid != @pid.value
+            @fork_mutex.synchronize do
+              if pid != @pid.value
+                Aikido::Zen.fork!
+
+                @pid.value = pid
+              end
+            end
           end
 
           @app.call(env)