One Agent to rule them all #298

tudor-timcu · 2025-10-13T15:58:11Z

Added support for only one Aikido Agent that will be spawned for each machine
- The request processor instances check on startup if an agent is already running and connect to that socket
- Checking is done using the socket file on the disk and by checking the running PID
- Fallbacks are in place if the PID is not running, but sockets still on disk
The new Agent support any number of different servers being hosted on the same machine (virtual hosts, multiple php servers with different versions)
- This works by having a global map in the Aikido Agent that stores each different server instance with it's correspoding data
- On the first request of a new server, the request processor registers into the Agent by providing the token
- The agent creates a new entry in the global map, spawns necessary goroutines for that server, initializes it's custom global data and it's live from now on
- The agent won't even register that server if a token it's not provided, it will do so only after the first successful token registration by the request processor
This also fixes various crashes and inconsistencies on the restart mechanisms of apache / php-fpm, as the agent is not unloaded anymore and just re-used across restarts.
The agent is stopped only on uninstall
The E2E tests were updated to use this exact same mechanism, each test has it's own mock token that registers into one Agent that all the 60+ tests use on a single machine
This is more in line with industry standards of having only one Agent per machine and allows us to further optimize things in the future by having all the PHP-related servers report through only one agent

aikido-pr-checks · 2025-10-16T11:27:40Z

lib/request-processor/attack/attack.go

 /* Construct the AttackDetected protobuf structure to be sent via gRPC to the Agent */
 func GetAttackDetectedProto(res utils.InterceptorResult) *protos.AttackDetected {
 	return &protos.AttackDetected{
+		Token: globals.AikidoConfig.Token,


GetAttackDetectedProto now reads globals.AikidoConfig.Token (hidden global dependency), mixing configuration access into message construction.

Feedback

Post a comment with the following structure to provide feedback on this finding:

@AikidoSec feedback: [FEEDBACK]

Aikido will process this feedback into learnings to give better review comments in the future.
More info

lib/agent/grpc/domain.go

…ocket file management in the PHP extension.

lib/php-extension/include/Agent.h

lib/php-extension/Agent.cpp

lib/agent/machine/machine.go

lib/request-processor/utils/iplists.go

lib/agent/config/config.go

lib/agent/log/log.go

lib/agent/aikido_types/init_data.go

lib/agent/grpc/server.go

aikido-pr-checks · 2025-10-20T10:16:33Z

lib/agent/main.go

+
+func serversCleanupRoutine(server *ServerData) {
+	for _, token := range globals.GetServersTokens() {
+		server := globals.GetServer(token)


Function parameter 'server' is shadowed by local declaration 'server := globals.GetServer(token)'.

Feedback

Post a comment with the following structure to provide feedback on this finding:

@AikidoSec feedback: [FEEDBACK]

Aikido will process this feedback into learnings to give better review comments in the future.
More info

seems a good one to fix? ^^

lib/agent/aikido_types/init_data.go

lib/agent/cloud/cloud.go

lib/agent/globals/globals.go

package/rpm/aikido.spec

aikido-pr-checks · 2025-10-20T12:45:34Z

lib/php-extension/Agent.cpp

+    return agentPID;
+}
+
+bool Agent::RemoveSocketFiles() {


Function RemoveSocketFiles returns a boolean named 'failed' (true on failure), making the return semantics ambiguous/inverted and prone to incorrect usage.

Feedback

Post a comment with the following structure to provide feedback on this finding:

@AikidoSec feedback: [FEEDBACK]

Aikido will process this feedback into learnings to give better review comments in the future.
More info

Seems valid, see:

if (!this->RemoveSocketFiles()) { AIKIDO_LOG_WARN("Failed to remove some socket files, will try to re-spawn Aikido Agent...\n"); } else { AIKIDO_LOG_INFO("Successfully removed old socket files!\n"); }

lib/agent/aikido_types/constants.go

lib/agent/server_utils/server.go

hansott · 2025-10-20T12:56:07Z

lib/agent/main.go

+		if now-lastConnectionTime > MinServerInactivityForCleanup {
+			// Server has been inactive for more than 10 minutes
+			log.Infof("Server has been inactive for more than 10 minutes, unregistering...")
+			server_utils.Unregister(token)


There's a brief chance that we might delete a just created server because LastConnectionTime is 0 until GetCloudConfig is called? Should we set LastConnectionTime on creation of a server?

very good point, thanks for this

lib/agent/cloud/config.go

hansott · 2025-10-20T13:11:42Z

lib/php-extension/Agent.cpp

+        while ((ent = readdir(dir)) != NULL) {
+            std::string filename(ent->d_name);
+            if (filename.find(".sock") != std::string::npos) {
+                socketPath = aikidoRunFolder + "/" + filename;


Prob good idea to test connection? ping / pong on gRPC?

Do we need to grab latest one? readdir sorting might be random?

in theory there should be only one there, but indeed we might end up with 2 sockets. Not sure how I would test the grpc connection over the socket, but will look to make this more robust.

lib/agent/utils/utils.go

lib/request-processor/main.go

lib/agent/main.go

lib/agent/cloud/config.go

aikido-pr-checks · 2025-10-20T14:54:11Z

lib/php-extension/Agent.cpp

-    if (this->agentPid != 0) {
-        AIKIDO_LOG_WARN("Aikido Agent already running!\n");
-        return true;
+std::string Agent::GetSocketPath() {


Class Agent now mixes filesystem discovery, /proc parsing, and process spawning responsibilities (single responsibility violation).

Feedback

Post a comment with the following structure to provide feedback on this finding:

@AikidoSec feedback: [FEEDBACK]

Aikido will process this feedback into learnings to give better review comments in the future.
More info

aikido-pr-checks · 2025-10-20T14:54:18Z

lib/php-extension/Agent.cpp

-    if (this->agentPid == 0) {
-        AIKIDO_LOG_WARN("Aikido Agent not running!\n");
-        return;
+bool Agent::SpawnDetached(std::string aikidoAgentPath, std::string initData, std::string token) {


Function SpawnDetached performs forking and daemonization without explanatory comments.

Feedback

Post a comment with the following structure to provide feedback on this finding:

@AikidoSec feedback: [FEEDBACK]

Aikido will process this feedback into learnings to give better review comments in the future.
More info

tudor-timcu added 6 commits October 13, 2025 15:54

Aikido Agent standalone

58af860

1.3.7

b03c31b

Agent support multiple servers

54eb2b8

Fix

2aa8b05

Fix

4f08c60

Using mutex guards to sync access to servers map

42e3b92

aikido-pr-checks bot reviewed Oct 16, 2025

View reviewed changes

lib/agent/grpc/domain.go Outdated Show resolved Hide resolved

tudor-timcu added 7 commits October 17, 2025 08:19

Partial commit

7eaf13b

Fixes

9183f50

Fix

153da6f

Fixes

29da8f6

Fix

c43db43

f

777ee67

Refactor gRPC server methods to handle nil server cases and improve s…

6635cf7

…ocket file management in the PHP extension.

tudor-timcu changed the title ~~Aikido Agent standalone~~ One Agent to rule them all Oct 20, 2025

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/php-extension/include/Agent.h Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/php-extension/Agent.cpp Show resolved Hide resolved

tudor-timcu added 5 commits October 20, 2025 08:27

Version 2.0.1

6641e37

Run tests

ca14a7c

Remove token prints

f73feac

Cleaner diff

dc88606

Rename

d90c271

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/machine/machine.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/request-processor/utils/iplists.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/config/config.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/log/log.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/aikido_types/init_data.go Show resolved Hide resolved

tudor-timcu added 2 commits October 20, 2025 09:09

Remove unused

1e060e1

Cleanup

c2c66f9

Improvements

d55f597

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/grpc/server.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/grpc/server.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/aikido_types/init_data.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/cloud/cloud.go Show resolved Hide resolved

hansott reviewed Oct 20, 2025

View reviewed changes

lib/agent/globals/globals.go Outdated Show resolved Hide resolved

Stop all running Aikido Agents

1e6f199

hansott reviewed Oct 20, 2025

View reviewed changes

package/rpm/aikido.spec Show resolved Hide resolved

1.4.0

9cc58c4

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

willem-delbare reviewed Oct 20, 2025

View reviewed changes

lib/agent/aikido_types/constants.go Outdated Show resolved Hide resolved

willem-delbare reviewed Oct 20, 2025

View reviewed changes

lib/agent/server_utils/server.go Outdated Show resolved Hide resolved

hansott reviewed Oct 20, 2025

View reviewed changes

lib/agent/cloud/config.go Outdated Show resolved Hide resolved

hansott reviewed Oct 20, 2025

View reviewed changes

lib/agent/utils/utils.go Show resolved Hide resolved

tudor-timcu added 2 commits October 20, 2025 13:23

Fixes

6734c8b

Fixes

4bdaf6a

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/request-processor/main.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/main.go Show resolved Hide resolved

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/main.go Show resolved Hide resolved

tudor-timcu added 3 commits October 20, 2025 13:33

Fixes

a1518cb

Fixes

d4e0a64

Fixed sync

53d2236

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

lib/agent/cloud/config.go Show resolved Hide resolved

tudor-timcu added 2 commits October 20, 2025 14:24

Check faster

7daa188

Sigterm

ccca106

aikido-pr-checks bot reviewed Oct 20, 2025

View reviewed changes

One Agent to rule them all #298

Are you sure you want to change the base?

One Agent to rule them all #298

Uh oh!

Conversation

tudor-timcu commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aikido-pr-checks bot Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aikido-pr-checks bot Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hansott Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aikido-pr-checks bot Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

hansott Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

hansott Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tudor-timcu Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

tudor-timcu Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hansott Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

hansott Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tudor-timcu Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aikido-pr-checks bot Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

tudor-timcu commented Oct 13, 2025 •

edited

Loading

aikido-pr-checks bot Oct 16, 2025 •

edited

Loading

aikido-pr-checks bot Oct 20, 2025 •

edited

Loading

hansott Oct 20, 2025 •

edited

Loading

hansott Oct 20, 2025 •

edited

Loading