inspec-chef 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f13512640633f549c0a190e61f94cc2044c9d551401ccb4371e8f1cd37cd102b
-  data.tar.gz: a47a60292470aad2385de9697c024f7457883fc64eedff78b455a79f7406b367
+  metadata.gz: e3689a6a012e43692366a808c0b50e67e7ef4cb35b303593f84ca0d0cd485fd9
+  data.tar.gz: 9c21ced8d8c706daf806553c6317b8ff375b3f5d40b0a6ac06573a33c6cb5df4
 SHA512:
-  metadata.gz: e848365caa7f68c3a0f4509284a530f62095274540787201a458c39fdd077862765261b46d95acc9267874580c0f9045914172f5a53da284114e889831639936
-  data.tar.gz: 4ff246d1449d0266ebb3c8bb9774f7f77f0ff209f04cb9263defb492bc628d0ba964740c8fcd803a011507dca113a842a15e8797496b7319ff76cceaef8f91ce
+  metadata.gz: b2f09ae34094154758c65afa303f4311ab2a4ea85f70b0a9e96a4cf58791c03cf74b33efce3f9477c26464de24027ce36c80fed92b3902949a7ecbef0219db62
+  data.tar.gz: a71465e35f0ed3a99b5ce1e61f8252669b8a4544d1bddac24c447bdfbf55d66a58598bc4644b412975c50fdf8c8ca5a5ca269255d46a7552030b094459385dae

data/README.md

@@ -53,10 +53,10 @@ This plugin supports the following options:
 
 ## Configuration for TestKitchen
 
-To allow dev/prod parity, this input plugin detects if it is called from within
-TestKitchen. As these tests should not access the Chef Server (to provide the
-needed test data instead of live data), it will then revert on using the
-`data_bags_path` and `attributes` from kitchen's `provisioner` section:
+To allow for more dev/prod parity, this input plugin detects if it is called
+from within TestKitchen. As these tests should not access the Chef Server (to
+provide the needed test data instead of live data), it will then revert on using
+the `data_bags_path` and `attributes` from kitchen's `provisioner` section:
 
 ```yaml
 suites:
@@ -78,34 +78,32 @@ and below of the `kitchen-inspec` verifier plugin. Please check
 When this plugin is loaded, you can use databag items as inputs:
 
 ```ruby
-hostname = input('databag://name/item/some/nested/value')
+hostname = input('databag://databag_name/item/some/nested/value')
 
 describe host(hostname, port: 80, protocol: 'tcp') do
   it { should be_reachable }
 end
 ```
 
-In the same way, you can also add attributes of arbitary nodes:
+In the same way, you can also add attributes of arbitrary nodes:
 
 ```ruby
-hostname = input('node://name/attributes/some/nested/attribute')
+hostname = input('node://node_name/attributes/some/nested/attribute')
 
 describe host(hostname, port: 80, protocol: 'tcp') do
   it { should be_reachable }
 end
 ```
 
-InSpec will go through all loaded input plugins by priority and determine the value.
+It is possible to skip the node name, in which case the plugin will try to look up
+the Chef client name of the node being scanned. This will, depending on the address
+passed to InSpec, check via `ipaddress:`, `hostname:` or `fqdn:` queries. If this
+fails, another lookup will be tried for Amazon EC2 via `ec2_public_ipv4` and
+`ec2_public_hostname`.
 
-Keep in mind, that the node executing your InSpec runs needs to be
-registered with the chef server to be able to access the data. Lookup
-is __not__ done on the clients tested, but the executing workstation.
-
-## Example
+## Databags Example
 
-With this plugin, the input names consist of the name of the databag,
-the item and a path getting a specific value within an item.
-This way, you can have a databag "configuration" with an item "database" like:
+If you have a databag "configuration" with an item "database" like:
 
 ```json
 {
@@ -115,10 +113,20 @@ This way, you can have a databag "configuration" with an item "database" like:
 }
 ```
 
-and then use `input('databag://configuration/database/SQL/Type')` to get the
-"SQL2019" value out.
+you can use `input('databag://configuration/database/SQL/Type')` to get the
+"SQL2019" value.
+
+### Important Note
+
+Keep in mind, that the node executing your InSpec runs needs to be
+registered with the Chef Infra Server to be able to access the data. Lookup
+is __not__ done on the clients tested, but the workstation executing InSpec.
 
 ## Limitations
 
-There currently is no support for arrays or more complex expressions within
-the query, but support via JMESPath expressions is planned.
+- There currently is no support for arrays or more complex expressions within
+  the query, but support via JMESPath expressions is planned.
+- Automatic Chef node name lookup will fail for addresses not searchable in the
+  `ipaddress`, `hostname` or `fqdn` fields. One case would be IPv6 target
+  nodes. Trying to resolve will result in error "Unable too lookup remote Chef
+  client name"

data/lib/inspec-chef/input.rb

@@ -1,12 +1,13 @@
 require "chef-api"
 require "jmespath"
+require "resolv"
 require "uri"
 
 module InspecPlugins::Chef
   class Input < Inspec.plugin(2, :input)
     VALID_PATTERNS = [
       Regexp.new("^databag://[^/]+/[^/]+/.+$"),
-      Regexp.new("^node://[^/]+/attributes/.+$"),
+      Regexp.new("^node://[^/]*/attributes/.+$"),
     ].freeze
 
     attr_reader :plugin_conf, :chef_endpoint, :chef_client, :chef_api_key
@@ -16,7 +17,7 @@ module InspecPlugins::Chef
     def initialize
       @plugin_conf = Inspec::Config.cached.fetch_plugin_config("inspec-chef")
 
-      unless Inspec::Config.cached.final_options.logger.is_a?(Kitchen::Logger)
+      unless defined?(Kitchen)
         @chef_endpoint = fetch_plugin_setting("endpoint")
         @chef_client   = fetch_plugin_setting("client")
         @chef_api_key  = fetch_plugin_setting("key")
@@ -41,7 +42,10 @@ module InspecPlugins::Chef
         data = get_attributes(input[:object]) if input[:item] == "attributes"
       end
 
-      JMESPath.search(input[:query].join("."), data)
+      result = JMESPath.search(input[:query].join("."), data)
+      raise format("Could not resolve value for %s, check if databag/item or attribute exist", input_uri) if result.nil?
+
+      result
     end
 
     private
@@ -51,10 +55,24 @@ module InspecPlugins::Chef
       !! defined?(::Kitchen::Logger)
     end
 
+    # Check if this is an IP
+    def ip?(ip_or_name)
+      # Get address always returns an IP, so if nothing changes this was one
+      Resolv.getaddress(ip_or_name) == ip_or_name
+    rescue Resolv::ResolvError
+      false
+    end
+
+    # Check if this is an FQDN
+    def fqdn?(ip_or_name)
+      # If it is not an IP but contains a Dot, it is an FQDN
+      !ip?(ip_or_name) && ip_or_name.include?(".")
+    end
+
     # Reach for Kitchen data and return its evaluated config
     def kitchen_provisioner_config
-      require 'binding_of_caller'
-      kitchen = binding.callers.find { |b| b.frame_description == 'verify' }.receiver
+      require "binding_of_caller"
+      kitchen = binding.callers.find { |b| b.frame_description == "verify" }.receiver
 
       kitchen.provisioner.send(:provided_config)
     end
@@ -66,6 +84,12 @@ module InspecPlugins::Chef
       ENV[env_var_name] || plugin_conf[config_name] || default
     end
 
+    # Get remote address for this scan from InSpec
+    def inspec_target
+      target = Inspec::Config.cached.final_options["target"]
+      URI.parse(target)&.host
+    end
+
     # Establish a Chef Server connection
     def connect_to_chef_server
       @chef_api ||= ChefAPI::Connection.new(
@@ -73,6 +97,8 @@ module InspecPlugins::Chef
         client:   chef_client,
         key:      chef_api_key
       )
+
+      Inspec::Log.debug format("Connected to %s as client %s", chef_endpoint, chef_client)
     end
 
     # Retrieve a Databag item from Chef Server
@@ -85,12 +111,12 @@ module InspecPlugins::Chef
         chef_api.data_bag_item.fetch(item, bag: databag).data
       else
         config = kitchen_provisioner_config
-        filename = File.join(config[:data_bags_path], databag, item + '.json')
+        filename = File.join(config[:data_bags_path], databag, item + ".json")
 
         begin
-          contents = JSON.load(File.read(filename))
+          return JSON.load(File.read(filename))
         rescue
-          raise format('Error accessing databag file %s, check TestKitchen configuration', filename)
+          raise format("Error accessing databag file %s, check TestKitchen configuration", filename)
         end
       end
     end
@@ -106,9 +132,30 @@ module InspecPlugins::Chef
       end
     end
 
+    # Try to look up Chef Client name by the address requested
+    def get_clientname(ip_or_name)
+      query = "hostname:%<address>s"
+      query = "ipaddress:%<address>s" if ip?(ip_or_name)
+      query = "fqdn:%<address>s" if fqdn?(ip_or_name)
+      result = get_search(:node, format(query, address: ip_or_name))
+      Inspec::Log.debug format("Automatic lookup of node name (IPv4 or hostname) returned: %s", result&.fetch("name") || "(nothing)")
+
+      # Try EC2 lookup, if nothing found (assuming public IP)
+      if result.nil?
+        query = "ec2_public_ipv4:%<address>s OR ec2_public_hostname:%<address>s"
+        result = get_search(:node, format(query, address: ip_or_name))
+        Inspec::Log.debug format("Automatic lookup of node name (EC2 public IPv4 or hostname) returned: %s", result&.fetch("name"))
+      end
+
+      # This will fail for cases like trying to connect to IPv6, so it will
+      # need extension in the future
+
+      result&.fetch("name") || raise(format("Unable too lookup remote Chef client name from %s", ip_or_name))
+    end
+
     # Low-level Chef search expression
     def get_search(index, expression)
-      chef_api.search.query(index, expression).rows.first
+      chef_api.search.query(index, expression, rows: 1).rows.first
     end
 
     # Merge attributes in hierarchy like Chef
@@ -128,7 +175,7 @@ module InspecPlugins::Chef
 
       {
         type: uri.scheme.to_sym,
-        object: uri.host,
+        object: uri.host || get_clientname(inspec_target),
         item: item,
         query: components,
       }

data/lib/inspec-chef/version.rb

@@ -5,6 +5,6 @@
 # to learn the current version.
 module InspecPlugins
   module Chef
-    VERSION = "0.2.0".freeze
+    VERSION = "0.3.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-chef
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Thomas Heinen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-10 00:00:00.000000000 Z
+date: 2020-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-api