aikido-zen 1.8.0 → 1.9.0.beta.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c01eda1d0ea486bf41d00d6efc05f064ad13b3ae71e112af02b1c01e3d164592
-  data.tar.gz: 222be5ac12985a6f855335a3433d32632704d6ebb1c0f7249fe9bb85492554f2
+  metadata.gz: d41298c1b3dc0135c211b4beade2a723603cef96372b5526447e5a0d792d1bb9
+  data.tar.gz: 247dea5c7895db42823c445ce7e0f32995ba833cecbcf7430ad09f33c897c179
 SHA512:
-  metadata.gz: 4645441dc4301bccc6c09347f864149b071f9cdcd16811309dd7a7e9650848ff90a559ebc576338e7bc8bc41fc3f4d4c2deaa096112628da02bf71619e69ad77
-  data.tar.gz: 8e7e3717a0a38dcb0d0c38abaf2142569404917f0fff5da720fcd4d180eebb27799d7b836a5222389a33a1a963e431f2459fe2299ab1d6e0c85234b615ce997d
+  metadata.gz: ada3f8112966d020346b164380a2cbff9e1ba7c68cfdde2ab2a440d41e1c241c6ef73c9214597fd004e408b61c00ecc9b78294bfd73bef0effd1ca91dbdee5b4
+  data.tar.gz: 7f61d126b05f54339ca7633e8058e36d298dcd0a4b0abf93eebe4abb96a5c66edbf0e56cc3e6457ed92f8cf46231d6f00f60dc5b8487bdd014532db48ef52dba

data/README.md

@@ -39,6 +39,12 @@ Zen for Ruby 2.7+ is compatible with:
 
 * ✅ [Ruby on Rails](docs/rails.md) 7.x, 8.x
 
+### Application servers
+
+* ✅ [Puma](https://puma.io/)
+
+Our test suite only covers Puma. If you use another Rack server, [contact us](docs/troubleshooting.md#contact-support) and we'll help check whether Zen is compatible.
+
 ### Database drivers
 
 * ✅ [`sqlite3`](https://github.com/sparklemotion/sqlite3-ruby) 1.x, 2.x
@@ -117,7 +123,8 @@ See [Reporting to Aikido](#reporting-to-your-aikido-security-dashboard) to learn
 
 ## Additional configuration
 
-[Configure Zen using environment variables for authentication, mode settings, debugging, and more.](https://help.aikido.dev/doc/configuration-via-env-vars/docrSItUkeR9)
+* [Configure Zen using environment variables for authentication, mode settings, debugging, and more](https://help.aikido.dev/doc/configuration-via-env-vars/docrSItUkeR9)
+* [Track custom events](docs/custom-event-tracking.md): trigger events that Playbooks can act on
 
 ## License
 

data/benchmarks/ip_list/benchmark.rb

@@ -24,7 +24,7 @@ end
 if __FILE__ == $0
   ip_ranges = random_ip_ranges.take(1000)
 
-  ip_list = Aikido::Zen::RuntimeSettings::IPList.from_json({
+  ip_list = Aikido::Zen::Firewall::IPList.from_json({
     "key" => "key",
     "source" => "source",
     "description" => "description",

data/docs/custom-event-tracking.md

@@ -0,0 +1,33 @@
+# Track custom events
+
+Use `Aikido::Zen.track_custom_event` to report events that only your application knows about, such as failed logins. [Playbooks](https://help.aikido.dev/zen-firewall/zen-features/playbooks) can act when an event occurs repeatedly, for example by blocking an IP after three failed logins in five minutes.
+
+```ruby
+# app/controllers/application_controller.rb
+class ApplicationController < ActionController::Base
+  private
+
+  def authenticate_user!
+    # Your authentication logic here
+    # ...
+
+    unless current_user
+        Aikido::Zen.track_custom_event("user.login_failed")
+        return
+    end
+
+    Aikido::Zen.set_user(
+      id: current_user.id,
+      name: current_user.name
+    )
+
+    Aikido::Zen.track_custom_event("user.login_succeeded")
+  end
+end
+```
+
+After adding `Aikido::Zen.track_custom_event`, trigger the event at least once. It will then appear on the Playbooks page in the Aikido dashboard. From there, you can create a playbook and choose what should happen when the event occurs. Calling `Aikido::Zen.track_custom_event` by itself does not create a playbook or block anything.
+
+Call `Aikido::Zen.track_custom_event` while handling an HTTP request. Zen associates the event with the request's IP address. Playbook counts are per IP, not across your whole app. If you call [`Aikido::Zen.set_user`](./rails.md#rate-limiting-and-user-blocking) before tracking the event, Zen also includes the current user. `Aikido::Zen.set_user` is optional. Events without a user are still tracked.
+
+Event names can use any format. We recommend lowercase, dot-separated names such as `user.login_failed`.

data/lib/aikido/zen/agent.rb

@@ -68,27 +68,22 @@ module Aikido::Zen
       # :nocov:
 
       report(Events::Started.new(time: @started_at)) do |response|
-        if update_settings_from_runtime_config!(response, reason: "after start")
-          updated_settings!
-
-          if @config.realtime_settings_updates_enabled? || @settings.realtime_settings_updates_enabled?
-            @api_stream.handle("config-updated") do |event|
-              @config.logger.debug("Received server-sent event: config-updated")
-              settings_updated(event)
-            end
+        update_settings_from_runtime_config!(response, reason: "after start")
+        updated_settings!
 
-            @api_stream.start!
+        if @config.realtime_settings_updates_enabled? || @settings.realtime_settings_updates_enabled?
+          @api_stream.handle("config-updated") do |event|
+            @config.logger.debug("Received server-sent event: config-updated")
+            settings_updated(event)
           end
-        # :nocov:
-        else
-          # empty
+
+          @api_stream.start!
         end
-        # :nocov:
       rescue => err
         @config.logger.error(err.message)
       end
 
-      begin
+      @worker.perform do
         update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after start")
       rescue => err
         @config.logger.error(err.message)
@@ -165,6 +160,15 @@ module Aikido::Zen
       end
     end
 
+    # Reports a custom event tracked via Aikido::Zen.track_custom_event, if
+    # reporting is enabled.
+    #
+    # @param event [Aikido::Zen::Events::Custom]
+    # @return [void]
+    def report_custom_event(event)
+      report(event) if @api_client.can_make_requests?
+    end
+
     # @api private
     #
     # Atomically flushes all the stats stored by the agent, and sends a
@@ -272,7 +276,7 @@ module Aikido::Zen
       begin
         return false unless Aikido::Zen.api_cache.update_runtime_config(data)
 
-        if Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+        if Aikido::Zen.runtime_settings.update_from_json(data)
           @config.logger.info("Updated runtime settings #{reason}")
           true
         else
@@ -294,7 +298,7 @@ module Aikido::Zen
       begin
         return false unless Aikido::Zen.api_cache.update_runtime_firewall_lists(data)
 
-        if Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+        if Aikido::Zen.firewall.update_from_json(data)
           @config.logger.info("Updated runtime firewall list #{reason}")
           true
         else

data/lib/aikido/zen/api_client.rb

@@ -133,6 +133,8 @@ module Aikido::Zen
         response = http.request(request)
 
         case response
+        when Net::HTTPNoContent
+          # empty
         when Net::HTTPSuccess
           begin
             body = decode(response.body, response["Content-Encoding"])

data/lib/aikido/zen/attack_wave/helpers.rb

@@ -447,7 +447,6 @@ module Aikido::Zen
         "smb.conf",
         "iis.log",
         "pom.xml",
-        "openapi.json",
         "vim_settings.xml",
         "winscp.ini",
         "ws_ftp.ini"

data/lib/aikido/zen/config.rb

@@ -56,6 +56,10 @@ module Aikido::Zen
     #   each initial heartbeat event.
     attr_accessor :initial_heartbeat_delays
 
+    # @return [Symbol] the agent mode for forked worker processes. Can be set
+    #   through the AIKIDO_AGENT_MODE environment variable.
+    attr_reader :agent_mode
+
     # @return [Integer] the interval in seconds at which forked worker processes
     #   poll the parent process for updated runtime settings. Defaults to 10 seconds.
     attr_accessor :worker_process_polling_interval
@@ -245,6 +249,7 @@ module Aikido::Zen
       self.api_timeouts = 10
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
+      self.agent_mode = ENV.fetch("AIKIDO_AGENT_MODE", "shared")
       self.worker_process_polling_interval = 10
       self.worker_process_polling_jitter = 10
       self.worker_process_heartbeat_interval = 10
@@ -299,6 +304,17 @@ module Aikido::Zen
       @realtime_endpoint = URI(url)
     end
 
+    # @param mode [Symbol, String] a supported agent mode.
+    # @raise [ArgumentError]
+    def agent_mode=(mode)
+      mode = mode.to_sym
+      unless AGENT_MODES.include?(mode)
+        raise ArgumentError, "agent_mode must be one of #{AGENT_MODES.join(", ")}, got #{mode}"
+      end
+
+      @agent_mode = mode
+    end
+
     # Set the logger and configure its severity level according to agent's debug mode
     # @param logger [::Logger]
     def logger=(logger)
@@ -370,6 +386,9 @@ module Aikido::Zen
       end
     end
 
+    # @!visibility private
+    AGENT_MODES = [:shared, :per_worker].freeze
+
     # @!visibility private
     DEFAULT_AIKIDO_ENDPOINT = "https://guard.aikido.dev"
 

data/lib/aikido/zen/event.rb

@@ -95,5 +95,31 @@ module Aikido::Zen
         )
       end
     end
+
+    # Event sent by Aikido::Zen.track_custom_event to record a custom,
+    # user-named event happening during an HTTP request.
+    class Custom < Event
+      # @param name [String] the name of the tracked event.
+      # @param request [Aikido::Zen::Request]
+      # @param user [Aikido::Zen::Actor, nil]
+      # @param opts [Hash<Symbol, Object>] any other options to pass to
+      #   the superclass initializer.
+      def initialize(name:, request:, user: nil, **opts)
+        super(type: "custom", **opts)
+        @name = name
+        @request = request
+        @user = user
+      end
+
+      def as_json
+        super.update(
+          {
+            name: @name,
+            request: @request.as_json,
+            user: @user && {id: @user.id, name: @user.name}.compact
+          }.compact
+        )
+      end
+    end
   end
 end

data/lib/aikido/zen/{runtime_settings → firewall}/ip_list.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Aikido::Zen
-  class RuntimeSettings::IPList
+  class Firewall::IPList
     attr_reader :key
     attr_reader :source
     attr_reader :description

data/lib/aikido/zen/firewall.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  class Firewall
+    # @return [Regexp, nil]
+    attr_accessor :blocked_user_agent_regexp
+
+    # @return [Regexp, nil]
+    attr_accessor :monitored_user_agent_regexp
+
+    # @return [Array<Hash>, nil]
+    attr_accessor :user_agent_details
+
+    # @return [Array<Aikido::Zen::Firewall::IPList>]
+    attr_accessor :blocked_ip_lists
+
+    # @return [Array<Aikido::Zen::Firewall::IPList>]
+    attr_accessor :allowed_ip_lists
+
+    # @return [Array<Aikido::Zen::Firewall::IPList>]
+    attr_accessor :monitored_ip_lists
+
+    def initialize
+      self.blocked_ip_lists = []
+      self.allowed_ip_lists = []
+      self.monitored_ip_lists = []
+    end
+
+    # @param data [Hash] the decoded JSON payload from /api/runtime/firewall/lists
+    # @return [Boolean]
+    def update_from_json(data)
+      self.blocked_user_agent_regexp = pattern(data["blockedUserAgents"])
+
+      self.monitored_user_agent_regexp = pattern(data["monitoredUserAgents"])
+
+      self.user_agent_details = []
+
+      data["userAgentDetails"]&.each do |record|
+        key = record["key"]
+        pattern = pattern(record["pattern"])
+
+        next if key.nil? || pattern.nil?
+
+        user_agent_details << {
+          key: key,
+          pattern: pattern
+        }
+      end
+
+      self.blocked_ip_lists = []
+
+      data["blockedIPAddresses"]&.each do |ip_list|
+        blocked_ip_lists << Firewall::IPList.from_json(ip_list)
+      end
+
+      self.allowed_ip_lists = []
+
+      data["allowedIPAddresses"]&.each do |ip_list|
+        allowed_ip_lists << Firewall::IPList.from_json(ip_list)
+      end
+
+      self.monitored_ip_lists = []
+
+      data["monitoredIPAddresses"]&.each do |ip_list|
+        monitored_ip_lists << Firewall::IPList.from_json(ip_list)
+      end
+
+      true
+    end
+
+    # Construct a regular expression from the non-nil and non-empty string,
+    # otherwise return nil.
+    #
+    # The resulting regular expression is case insensitive.
+    #
+    # @param string [String, nil]
+    # @return [Regexp, nil]
+    private def pattern(string)
+      return nil if string.nil? || string.empty?
+
+      begin
+        /#{string}/i
+      rescue RegexpError
+        nil
+      end
+    end
+
+    # @param user_agent [String] the user agent
+    # @return [Boolean] whether the user agent should be blocked
+    def blocked_user_agent?(user_agent)
+      return false if blocked_user_agent_regexp.nil?
+
+      blocked_user_agent_regexp.match?(user_agent)
+    end
+
+    # @param user_agent [String] the user agent
+    # @return [Boolean] whether the user agent should be monitored
+    def monitored_user_agent?(user_agent)
+      return false if monitored_user_agent_regexp.nil?
+
+      monitored_user_agent_regexp.match?(user_agent)
+    end
+
+    # @param user_agent [String] the user agent
+    # @return [Array<String>] the matching user agent keys
+    def user_agent_keys(user_agent)
+      return [] if user_agent_details.nil?
+
+      user_agent_details.filter_map { |record| record[:key] if record[:pattern].match?(user_agent) }
+    end
+
+    def allowed_ip?(ip)
+      allowed_ip_lists.empty? || allowed_ip_lists.any? { |ip_list| ip_list.include?(ip) }
+    end
+
+    def blocked_ip?(ip)
+      blocked_ip_lists.any? { |ip_list| ip_list.include?(ip) }
+    end
+
+    def monitored_ip?(ip)
+      monitored_ip_lists.any? { |ip_list| ip_list.include?(ip) }
+    end
+
+    def monitored_ip_list_keys(ip)
+      return [] if ip.nil?
+
+      monitored_ip_lists.filter_map { |ip_list| ip_list.key if ip_list.include?(ip) }
+    end
+  end
+end
+
+require_relative "firewall/ip_list"

data/lib/aikido/zen/middleware/fork_detector.rb

@@ -11,14 +11,20 @@ module Aikido
           @app = app
 
           @pid = Concurrent::AtomicFixnum.new(Process.pid)
+          @fork_mutex = Mutex.new
         end
 
         def call(env)
-          new_pid = Process.pid
-          old_pid = @pid.value
+          pid = Process.pid
 
-          if new_pid != old_pid && @pid.compare_and_set(old_pid, new_pid)
-            Aikido::Zen.fork!
+          if pid != @pid.value
+            @fork_mutex.synchronize do
+              if pid != @pid.value
+                Aikido::Zen.fork!
+
+                @pid.value = pid
+              end
+            end
           end
 
           @app.call(env)

data/lib/aikido/zen/middleware/ip_list_checker.rb

@@ -3,11 +3,11 @@
 module Aikido::Zen
   module Middleware
     class IPListChecker
-      def initialize(app, zen: Aikido::Zen, config: zen.config, settings: zen.runtime_settings)
+      def initialize(app, zen: Aikido::Zen, config: zen.config, firewall: zen.firewall)
         @app = app
         @zen = zen
         @config = config
-        @settings = settings
+        @firewall = firewall
       end
 
       def call(env)
@@ -17,14 +17,14 @@ module Aikido::Zen
 
         return @app.call(env) if @zen.request_bypassed?
 
-        if !@settings.allowed_ip?(client_ip)
+        if !@firewall.allowed_ip?(client_ip)
           return @config.blocked_responder.call(request, :ip_allowed_list)
         end
 
-        monitored_ip_list_keys = @settings.monitored_ip_list_keys(client_ip)
+        monitored_ip_list_keys = @firewall.monitored_ip_list_keys(client_ip)
         @zen.track_ip_list(monitored_ip_list_keys)
 
-        blocked_ip_lists = @settings.blocked_ip_lists.filter { |ip_list| ip_list.include?(client_ip) }
+        blocked_ip_lists = @firewall.blocked_ip_lists.filter { |ip_list| ip_list.include?(client_ip) }
 
         if !blocked_ip_lists.empty?
           @zen.track_ip_list(blocked_ip_lists.map(&:key))

data/lib/aikido/zen/middleware/user_agent_checker.rb

@@ -3,11 +3,11 @@
 module Aikido::Zen
   module Middleware
     class UserAgentChecker
-      def initialize(app, zen: Aikido::Zen, config: zen.config, settings: zen.runtime_settings)
+      def initialize(app, zen: Aikido::Zen, config: zen.config, firewall: zen.firewall)
         @app = app
         @zen = zen
         @config = config
-        @settings = settings
+        @firewall = firewall
       end
 
       def call(env)
@@ -17,15 +17,15 @@ module Aikido::Zen
 
         user_agent = request.user_agent
 
-        if @settings.blocked_user_agent?(user_agent)
-          user_agent_keys = @settings.user_agent_keys(user_agent)
+        if @firewall.blocked_user_agent?(user_agent)
+          user_agent_keys = @firewall.user_agent_keys(user_agent)
           @zen.track_user_agent(user_agent_keys)
 
           return @config.blocked_responder.call(request, :user_agent)
         end
 
-        if @settings.monitored_user_agent?(user_agent)
-          user_agent_keys = @settings.user_agent_keys(user_agent)
+        if @firewall.monitored_user_agent?(user_agent)
+          user_agent_keys = @firewall.user_agent_keys(user_agent)
           @zen.track_user_agent(user_agent_keys)
         end
 

data/lib/aikido/zen/runtime_settings.rb

@@ -3,16 +3,6 @@
 require "set"
 
 module Aikido::Zen
-  # Stores the firewall configuration sourced from the Aikido dashboard. This
-  # object is updated by the Agent regularly.
-  #
-  # Because the RuntimeSettings object can be modified in runtime, it implements
-  # the {Observable} API, allowing you to subscribe to updates. These are
-  # triggered whenever #update_from_runtime_settings_json makes a change
-  # (i.e. if the settings don't change, no update is triggered).
-  #
-  # You can subscribe to changes with +#add_observer(object, func_name)+, which
-  # will call the function passing the settings as an argument
   RuntimeSettings = Struct.new(
     :updated_at,
     :heartbeat_interval,
@@ -21,12 +11,6 @@ module Aikido::Zen
     :bypassed_ips,
     :received_any_stats,
     :blocking_mode,
-    :blocked_user_agent_regexp,
-    :monitored_user_agent_regexp,
-    :user_agent_details,
-    :blocked_ip_lists,
-    :allowed_ip_lists,
-    :monitored_ip_lists,
     :block_new_outbound,
     :domains,
     :excluded_user_ids_from_rate_limiting,
@@ -36,9 +20,6 @@ module Aikido::Zen
       super
       self.endpoints ||= RuntimeSettings::Endpoints.new
       self.bypassed_ips ||= RuntimeSettings::IPSet.new
-      self.blocked_ip_lists ||= []
-      self.allowed_ip_lists ||= []
-      self.monitored_ip_lists ||= []
       self.domains ||= RuntimeSettings::Domains.new
       self.enabled_features ||= Set.new
     end
@@ -66,24 +47,6 @@ module Aikido::Zen
     # @!attribute [rw] blocking_mode
     #   @return [Boolean]
 
-    # @!attribute [rw] blocked_ip_lists
-    #   @return [Array<Aikido::Zen::RuntimeSettings::IPList>]
-
-    # @!attribute [rw] allowed_ip_lists
-    #   @return [Array<Aikido::Zen::RuntimeSettings::IPList>]
-
-    # @!attribute [rw] monitored_ip_lists
-    #   @return [Array<Aikido::Zen::RuntimeSettings::IPList>]
-
-    # @!attribute [rw] blocked_user_agent_regexp
-    #   @return [Regexp]
-
-    # @!attribute [rw] monitored_user_agent_regexp
-    #   @return [Regexp]
-
-    # @!attribute [rw] user_agent_details
-    #   @return [Regexp]
-
     # @!attribute [rw] block_new_outbound
     #   @return [Boolean]
 
@@ -97,15 +60,9 @@ module Aikido::Zen
     # @!attribute [rw] enabled_features
     #   @return [Set<String>]
 
-    # Parse and interpret the JSON response from the core API with updated
-    # runtime settings, and apply the changes.
-    #
-    # This will also notify any subscriber to updates.
-    #
     # @param data [Hash] the decoded JSON payload from the /api/runtime/config
-    #   API endpoint.
     # @return [Boolean]
-    def update_from_runtime_config_json(data)
+    def update_from_json(data)
       last_updated_at = updated_at
 
       self.updated_at = Time.at(data["configUpdatedAt"].to_i)
@@ -126,69 +83,6 @@ module Aikido::Zen
       updated_at != last_updated_at
     end
 
-    # Parse and interpret the JSON response from the core API with updated
-    # runtime firewall lists, and apply the changes.
-    #
-    # @param data [Hash] the decoded JSON payload from the /api/runtime/firewall/lists
-    #   API endpoint.
-    # @return [Boolean]
-    def update_from_runtime_firewall_lists_json(data)
-      self.blocked_user_agent_regexp = pattern(data["blockedUserAgents"])
-
-      self.monitored_user_agent_regexp = pattern(data["monitoredUserAgents"])
-
-      self.user_agent_details = []
-
-      data["userAgentDetails"]&.each do |record|
-        key = record["key"]
-        pattern = pattern(record["pattern"])
-
-        next if key.nil? || pattern.nil?
-
-        user_agent_details << {
-          key: key,
-          pattern: pattern
-        }
-      end
-
-      self.blocked_ip_lists = []
-
-      data["blockedIPAddresses"]&.each do |ip_list|
-        blocked_ip_lists << RuntimeSettings::IPList.from_json(ip_list)
-      end
-
-      self.allowed_ip_lists = []
-
-      data["allowedIPAddresses"]&.each do |ip_list|
-        allowed_ip_lists << RuntimeSettings::IPList.from_json(ip_list)
-      end
-
-      self.monitored_ip_lists = []
-
-      data["monitoredIPAddresses"]&.each do |ip_list|
-        monitored_ip_lists << RuntimeSettings::IPList.from_json(ip_list)
-      end
-
-      true
-    end
-
-    # Construct a regular expression from the non-nil and non-empty string,
-    # otherwise return nil.
-    #
-    # The resulting regular expression is case insensitive.
-    #
-    # @param string [String, nil]
-    # @return [Regexp, nil]
-    private def pattern(string)
-      return nil if string.nil? || string.empty?
-
-      begin
-        /#{string}/i
-      rescue RegexpError
-        nil
-      end
-    end
-
     # @param ip [String]
     # @return [Boolean] Whether the IP is included in the bypassed IPs set.
     def bypassed_ip?(ip)
@@ -202,48 +96,6 @@ module Aikido::Zen
       excluded_user_ids_from_rate_limiting&.include?(user_id.to_s) || false
     end
 
-    # @param user_agent [String] the user agent
-    # @return [Boolean] whether the user agent should be blocked
-    def blocked_user_agent?(user_agent)
-      return false if blocked_user_agent_regexp.nil?
-
-      blocked_user_agent_regexp.match?(user_agent)
-    end
-
-    # @param user_agent [String] the user agent
-    # @return [Boolean] whether the user agent should be monitored
-    def monitored_user_agent?(user_agent)
-      return false if monitored_user_agent_regexp.nil?
-
-      monitored_user_agent_regexp.match?(user_agent)
-    end
-
-    # @param user_agent [String] the user agent
-    # @return [Array<String>] the matching user agent keys
-    def user_agent_keys(user_agent)
-      return [] if user_agent_details.nil?
-
-      user_agent_details.filter_map { |record| record[:key] if record[:pattern].match?(user_agent) }
-    end
-
-    def allowed_ip?(ip)
-      allowed_ip_lists.empty? || allowed_ip_lists.any? { |ip_list| ip_list.include?(ip) }
-    end
-
-    def blocked_ip?(ip)
-      blocked_ip_lists.any? { |ip_list| ip_list.include?(ip) }
-    end
-
-    def monitored_ip?(ip)
-      monitored_ip_lists.any? { |ip_list| ip_list.include?(ip) }
-    end
-
-    def monitored_ip_list_keys(ip)
-      return [] if ip.nil?
-
-      monitored_ip_lists.filter_map { |ip_list| ip_list.key if ip_list.include?(ip) }
-    end
-
     def block_outbound?(connection)
       domain = domains[connection.host]
 
@@ -261,6 +113,5 @@ module Aikido::Zen
 end
 
 require_relative "runtime_settings/ip_set"
-require_relative "runtime_settings/ip_list"
 require_relative "runtime_settings/endpoints"
 require_relative "runtime_settings/domains"

data/lib/aikido/zen/scanners/path_traversal/helpers.rb

@@ -27,7 +27,11 @@ module Aikido::Zen
         "/var/",
         # Common container/cloud directories
         "/app/",
-        "/code/"
+        "/code/",
+        "/data/",
+        "/rails/",
+        "/workspace/",
+        "/workspaces/"
       ]
 
       MACOS_PATH_STARTS = [

data/lib/aikido/zen/scanners/ssrf/private_ip_checker.rb

@@ -2,6 +2,7 @@
 
 require "resolv"
 require "ipaddr"
+require "socket"
 
 module Aikido::Zen
   module Scanners
@@ -72,17 +73,51 @@ module Aikido::Zen
 
         PRIVATE_RANGES = PRIVATE_IPV4_RANGES + PRIVATE_IPV6_RANGES + PRIVATE_IPV4_RANGES.map(&:ipv4_mapped)
 
+        # DNS lookups already performed for this request, keyed by hostname.
+        #
+        # @return [Aikido::Zen::Scanners::SSRF::DNSLookups, nil] nil outside
+        #   of a request
         def resolved_in_current_context
           context = Aikido::Zen.current_context
           context && context["dns.lookups"]
         end
 
+        # Matches strings that contain only characters that appear in some
+        # form of IP address.
+        #
+        # Hostnames are not expected to match, allowing `parse_address` to
+        # skip the `Socket.getaddrinfo` call.
+        ADDRESS_REGEXP = /\A[0-9a-fx:.]+\z/i
+
+        # Parses `address` as an IP address, in any form that is accepted
+        # by `getaddrinfo`:
+        #
+        # * Standard IPv4/IPv6 notation (e.g. "127.0.0.1", "::1")
+        # * Plain integer IPv4 notation, in decimal, octal, or hexadecimal
+        #   (e.g. "2130706433", "017700000001", "0x7f000001")
+        # * Shorthand dotted IPv4 notation (e.g. "127.1")
+        #
+        # Delegates to `Socket.getaddrinfo` with the `AI_NUMERICHOST` flag,
+        # which never performs a DNS lookup.
+        #
+        # @param address [String]
+        # @return [Array<IPAddr>, nil] nil if `address` is not an address
+        def parse_address(address)
+          return nil unless address.is_a?(String) && ADDRESS_REGEXP.match?(address)
+
+          Socket.getaddrinfo(address, nil, :UNSPEC, :STREAM, nil, Socket::AI_NUMERICHOST)
+            .map { |info| IPAddr.new(info[3]) }
+        rescue SocketError
+          nil
+        end
+
         def resolve(hostname_or_address)
           return [] if hostname_or_address.nil?
 
+          addresses = parse_address(hostname_or_address)
+          return addresses if addresses
+
           case hostname_or_address
-          when Resolv::AddressRegex
-            [IPAddr.new(hostname_or_address)]
           when resolved_in_current_context
             resolved_in_current_context[hostname_or_address]
               .map { |address| IPAddr.new(address) }

data/lib/aikido/zen/sinks/socket.rb

@@ -6,9 +6,9 @@ require_relative "../scanners/ssrf_scanner"
 
 module Aikido::Zen
   module Sinks
-    # We intercept IPSocket.open to hook our DNS checks around it, since
-    # there's no way to access the internal DNS resolution that happens in C
-    # when using the socket primitives.
+    # We intercept TCPSocket#initialize to hook our DNS checks around it,
+    # since there's no way to access the internal DNS resolution that
+    # happens in C when using the socket primitives.
     module Socket
       SINK = Sinks.add("socket", "outgoing_http_op", scanners: [
         Scanners::StoredSSRFScanner,
@@ -17,7 +17,7 @@ module Aikido::Zen
 
       module Helpers
         def self.scan(hostname, socket, operation)
-          # We're patching IPSocket.open(..) method.
+          # We're patching TCPSocket#initialize.
           # The IPSocket class hierarchy is:
           #             IPSocket
           #            /        \
@@ -59,20 +59,22 @@ module Aikido::Zen
       end
 
       def self.load_sinks!
-        ::IPSocket.singleton_class.class_eval do
+        ::TCPSocket.class_eval do
           extend Sinks::DSL
 
-          sink_after :open do |socket, remote_host|
+          # This sink method covers both the `open` and the `new` class methods,
+          # since these methods call `initialize`.
+          sink_after :initialize do |_result, remote_host, *|
             # Code coverage is disabled here because the tests are contrived and
             # intentionally do not call open.
             # :nocov:
-            Helpers.scan(remote_host, socket, "open")
+            Helpers.scan(remote_host, self, "open")
             # :nocov:
           rescue Aikido::Zen::UnderAttackError, Aikido::Zen::Sinks::DSL::PresafeError
             # If the scan raises an exception that will escape the safe block,
             # the open socket must be closed because it will not be returned,
             # so the user cannot close it.
-            socket.close
+            close
 
             raise
           end

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.8.0"
+    VERSION = "1.9.0.beta.2"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen/worker_process/agent/client.rb

@@ -107,14 +107,14 @@ module Aikido::Zen::WorkerProcess
 
         if settings["config"]
           @config.logger.debug("Forked worker process #{Process.pid}: starting config update")
-          Aikido::Zen.runtime_settings.update_from_runtime_config_json(settings["config"])
+          Aikido::Zen.runtime_settings.update_from_json(settings["config"])
           @known_config_generation = settings["config_generation"]
           @config.logger.debug("Forked worker process #{Process.pid}: finished config update")
         end
 
         if settings["firewall_lists"]
           @config.logger.debug("Forked worker process #{Process.pid}: starting firewall_lists update")
-          Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(settings["firewall_lists"])
+          Aikido::Zen.firewall.update_from_json(settings["firewall_lists"])
           @known_firewall_lists_generation = settings["firewall_lists_generation"]
           @config.logger.debug("Forked worker process #{Process.pid}: finished firewall_lists update")
         end

data/lib/aikido/zen.rb

@@ -27,6 +27,7 @@ require_relative "zen/middleware/attack_wave_protector"
 require_relative "zen/middleware/request_tracker"
 require_relative "zen/outbound_connection"
 require_relative "zen/runtime_settings"
+require_relative "zen/firewall"
 require_relative "zen/rate_limiter"
 require_relative "zen/attack_wave"
 require_relative "zen/sql"
@@ -88,6 +89,14 @@ module Aikido
       @runtime_settings = settings
     end
 
+    def self.firewall
+      @firewall ||= Firewall.new
+    end
+
+    def self.firewall=(firewall)
+      @firewall = firewall
+    end
+
     def self.api_cache
       @api_cache ||= APICache.new
     end
@@ -269,6 +278,35 @@ module Aikido
       alias_method :set_user, :track_user
     end
 
+    # Track a custom event happening in your application, like a failed login or
+    # a password reset request. Zen automatically attaches the IP address, user
+    # agent, and current user (if you called .track_user) from the request.
+    #
+    # Only works inside an HTTP request; if called from a background job or
+    # script, nothing gets sent.
+    #
+    # @param name [String]
+    # @return [void]
+    def self.track_custom_event(name)
+      unless name.is_a?(String) && !name.empty?
+        config.logger.warn("track_custom_event expects a non-empty String as the event name")
+        return
+      end
+
+      return unless agent
+
+      context = current_context
+      return unless context
+
+      event = Events::Custom.new(
+        name: name,
+        request: context.request,
+        user: context.request.actor
+      )
+
+      agent.report_custom_event(event)
+    end
+
     # @return [Aikido::Zen::AttackWave::Detector] the attack wave detector.
     def self.attack_wave_detector
       @attack_wave_detector ||= AttackWave::Detector.new
@@ -411,10 +449,19 @@ module Aikido
     # @!visibility private
     # Stop any background threads.
     def self.stop!
-      @agent&.stop!
-      @worker_process_server&.stop
+      agent = @agent
+      @agent = nil
+      agent&.stop!
+
+      server = @worker_process_server
+      @worker_process_server = nil
+      server&.stop
 
-      @worker_process_client&.stop
+      client = @worker_process_client
+      @worker_process_client = nil
+      client&.stop
+
+      @running.make_false
     end
 
     def self.agent
@@ -425,13 +472,13 @@ module Aikido
       @worker_process_server
     end
 
-    @has_started = Concurrent::AtomicBoolean.new(false)
+    @running = Concurrent::AtomicBoolean.new(false)
 
     class << self
       def start!
         return unless start?
 
-        return unless @has_started.make_true
+        return unless @running.make_true
 
         @worker_process_server = WorkerProcess::Agent::Server.new
         @worker_process_server.start
@@ -446,9 +493,9 @@ module Aikido
       end
 
       def fork!
-        server = @worker_process_server
-        return unless server
+        return unless @running.true?
 
+        server = @worker_process_server
         @worker_process_server = nil
         server.close
 
@@ -456,11 +503,30 @@ module Aikido
         @worker_process_client = nil
         client&.close
 
+        case config.agent_mode
+        when :per_worker
+          start_per_worker_mode
+        when :shared
+          start_shared_mode(server)
+        end
+      rescue => err
+        config.logger.error("Forked worker process #{Process.pid}: failed to start: #{err.message}")
+      end
+
+      private
+
+      def start_per_worker_mode
+        agent = @agent
+        @agent = nil
+        agent&.stop!
+
+        @agent = Agent.start
+      end
+
+      def start_shared_mode(server)
         client = WorkerProcess::Agent::Client.new(server.host, server.port)
         client.start
         @worker_process_client = client
-      rescue => err
-        config.logger.error("Forked worker process #{Process.pid}: failed to start worker process client: #{err.message}")
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.9.0.beta.2
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-21 00:00:00.000000000 Z
+date: 2026-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -89,6 +89,7 @@ files:
 - benchmarks/rpc/benchmark.rb
 - docs/banner.svg
 - docs/config.md
+- docs/custom-event-tracking.md
 - docs/idor-protection.md
 - docs/invalid-sql-queries.md
 - docs/proxy.md
@@ -123,6 +124,8 @@ files:
 - lib/aikido/zen/current_context.rb
 - lib/aikido/zen/errors.rb
 - lib/aikido/zen/event.rb
+- lib/aikido/zen/firewall.rb
+- lib/aikido/zen/firewall/ip_list.rb
 - lib/aikido/zen/helpers.rb
 - lib/aikido/zen/idor.rb
 - lib/aikido/zen/idor/analysis_result.rb
@@ -163,7 +166,6 @@ files:
 - lib/aikido/zen/runtime_settings/domain_settings.rb
 - lib/aikido/zen/runtime_settings/domains.rb
 - lib/aikido/zen/runtime_settings/endpoints.rb
-- lib/aikido/zen/runtime_settings/ip_list.rb
 - lib/aikido/zen/runtime_settings/ip_set.rb
 - lib/aikido/zen/runtime_settings/protection_settings.rb
 - lib/aikido/zen/runtime_settings/rate_limit_settings.rb