Reimplement multiprocess architecture

[marksmith]

This change resolves several long-standing concerns with DRb, by replacing DRb for inter-process communication with an appropriate IPC and RPC mechanism; enabling the significant cleanup and simplification of the multiprocessor architecture.

The change begins by correcting another long-standing concern. Hash objects produced by #as_json and consumed by #from_json must have String keys. This is addressed first order to remove sources of errors, since the RPC mechanism uses JSON encoding.

The IPC mechanism uses an ephemeral port and an in-memory cryptographically secure random secret that are inherited by child processes at fork and used to restrict connection to real child processes using a mutual challenge-response protocol (built on HMAC-SHA256 and constant time comparison from OpenSSL).

The RPC mechanism is built on top of the IPC mechanism and is similar conceptually JSONRPC-2.0.

The multiprocessor architecture now consists of two parts.Aikido::Zen::WorkerProcess::Agent::Server runs in the parent process and is started at startup, and Aikido::Zen::WorkerProcess::Agent::Client runs in the child process and is started when a child process detected and handles the processes forking (on the first request after forking). The client in the child process makes requests of the server in the parent process. Two kinds of request are supported:

• synchronous requests, issued using invoke, which return a result
• asynchronous requests, issued using notify, which do not return a result

The parent processes no longer issues local requests using IPC. Aikido::Zen::Agent operates independently of the worker process server running in same processes or worker processes clients running in the child processes.

When the agent requests data from the API it caches the results. When the worker process requests data from the parent process no serialization is performed. The server returns the already-serialized cached data from the API and the child process handles it using the same logic as the parent processes.

[marksmith]

Tests for IPC and RPC to follow.

[codecov]

Codecov Report

❌ Patch coverage is 92.30769% with 35 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
lib/aikido/zen.rb	48.38%	14 Missing and 2 partials ⚠️
lib/aikido/zen/worker_process/agent/client.rb	85.10%	6 Missing and 1 partial ⚠️
lib/aikido/zen/middleware/fork_detector.rb	0.00%	5 Missing ⚠️
lib/aikido/zen/worker_process/agent/server.rb	90.47%	2 Missing and 2 partials ⚠️
lib/aikido/zen/attack.rb	50.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[marksmith]

#notify has been removed, since it was only used in one place and that use case could be effectively replaced by responding early (before the handler has completed processing).

Tests have now been added for then IPC and RPC mechanisms. Removing #notify significantly reduced the number of tests that were required.