inspec-core 2.1.67

data/lib/inspec/secrets.rb

@@ -0,0 +1,19 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'inspec/plugins'
+require 'utils/plugin_registry'
+
+module Inspec
+  SecretsBackend = PluginRegistry.new
+
+  def self.secrets(version)
+    if version != 1
+      raise 'Only secrets version 1 is supported!'
+    end
+    Inspec::Plugins::Secret
+  end
+end
+
+require 'inspec/secrets/yaml'

data/lib/inspec/secrets/yaml.rb

@@ -0,0 +1,30 @@
+# encoding: utf-8
+
+require 'yaml'
+
+module Secrets
+  class YAML < Inspec.secrets(1)
+    name 'yaml'
+
+    attr_reader :attributes
+
+    def self.resolve(target)
+      unless target.is_a?(String) && File.file?(target) && ['.yml', '.yaml'].include?(File.extname(target).downcase)
+        return nil
+      end
+      new(target)
+    end
+
+    # array of yaml file paths
+    def initialize(target)
+      @attributes = ::YAML.load_file(target)
+
+      if @attributes == false || !@attributes.is_a?(Hash)
+        Inspec::Log.warn("#{self.class} unable to parse #{target}: invalid YAML or contents is not a Hash")
+        @attributes = nil
+      end
+    rescue => e
+      raise "Error reading Inspec attributes: #{e}"
+    end
+  end
+end

data/lib/inspec/shell.rb

@@ -0,0 +1,220 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'pry'
+
+module Inspec
+  # A pry based shell for inspec. Given a runner (with a configured backend and
+  # all that jazz), this shell will produce a pry shell from which you can run
+  # inspec/ruby commands that will be run within the context of the runner.
+  class Shell
+    def initialize(runner)
+      @runner = runner
+    end
+
+    def start
+      # This will hold a single evaluation binding context as opened within
+      # the instance_eval context of the anonymous class that the profile
+      # context creates to evaluate each individual test file. We want to
+      # pretend like we are constantly appending to the same file and want
+      # to capture the local variable context from inside said class.
+      @ctx_binding = @runner.eval_with_virtual_profile('binding')
+      configure_pry
+      @ctx_binding.pry
+    end
+
+    def configure_pry # rubocop:disable Metrics/AbcSize
+      # Delete any before_session, before_eval, and after_eval hooks so we can
+      # replace them with our own. Pry 0.10 used to have a single method to clear
+      # all hooks, but this was removed in Pry 0.11.
+      [:before_session, :before_eval, :after_eval].each do |event|
+        Pry.hooks.get_hooks(event).keys.map { |hook| Pry.hooks.delete_hook(event, hook) }
+      end
+
+      that = self
+
+      # Add the help command
+      Pry::Commands.block_command 'help', 'Show examples' do |resource|
+        that.help(resource)
+      end
+
+      # configure pry shell prompt
+      Pry.config.prompt_name = 'inspec'
+      Pry.prompt = [proc { "#{readline_ignore("\e[1m\e[32m")}#{Pry.config.prompt_name}> #{readline_ignore("\e[0m")}" }]
+
+      # Add a help menu as the default intro
+      Pry.hooks.add_hook(:before_session, 'inspec_intro') do
+        intro
+        print_target_info
+      end
+
+      # Track the rules currently registered and what their merge count is.
+      Pry.hooks.add_hook(:before_eval, 'inspec_before_eval') do
+        @runner.reset
+      end
+
+      # After pry has evaluated a commanding within the binding context of a
+      # test file, register all the rules it discovered.
+      Pry.hooks.add_hook(:after_eval, 'inspec_after_eval') do
+        @runner.load
+        @runner.run_tests if !@runner.all_rules.empty?
+      end
+
+      # Don't print out control class inspection when the user uses DSL methods.
+      # Instead produce a result of evaluating their control.
+      Pry.config.print = proc do |_output_, value, pry|
+        next if !@runner.all_rules.empty?
+        pry.pager.open do |pager|
+          pager.print pry.config.output_prefix
+          Pry::ColorPrinter.pp(value, pager, Pry::Terminal.width! - 1)
+        end
+      end
+    end
+
+    def readline_ignore(code)
+      "\001#{code}\002"
+    end
+
+    def mark(x)
+      "\e[1m\e[39m#{x}\e[0m"
+    end
+
+    def print_example(example)
+      # determine min whitespace that can be removed
+      min = nil
+      example.lines.each do |line|
+        if !line.strip.empty? # ignore empty lines
+          line_whitespace = line.length - line.lstrip.length
+          min = line_whitespace if min.nil? || line_whitespace < min
+        end
+      end
+      # remove whitespace from each line
+      example.gsub(/\n\s{#{min}}/, "\n")
+    end
+
+    def intro
+      puts 'Welcome to the interactive InSpec Shell'
+      puts "To find out how to use it, type: #{mark 'help'}"
+      puts
+    end
+
+    def print_target_info
+      ctx = @runner.backend
+      puts <<~EOF
+        You are currently running on:
+
+        #{Inspec::BaseCLI.detect(params: ctx.platform.params, indent: 4, color: 39)}
+      EOF
+    end
+
+    def help(topic = nil)
+      if topic.nil?
+
+        puts <<~EOF
+          Available commands:
+
+              `[resource]` - run resource on target machine
+              `help resources` - show all available resources that can be used as commands
+              `help [resource]` - information about a specific resource
+              `help matchers` - show information about common matchers
+              `exit` - exit the InSpec shell
+
+          You can use resources in this environment to test the target machine. For example:
+
+              command('uname -a').stdout
+              file('/proc/cpuinfo').content => "value"
+
+          #{print_target_info}
+        EOF
+      elsif topic == 'resources'
+        resources.sort.each do |resource|
+          puts " - #{resource}"
+        end
+      elsif topic == 'matchers'
+        print_matchers_help
+      elsif !Inspec::Resource.registry[topic].nil?
+        topic_info = Inspec::Resource.registry[topic]
+        info = "#{mark 'Name:'} #{topic}\n\n"
+        unless topic_info.desc.nil?
+          info += "#{mark 'Description:'}\n\n"
+          info += "#{topic_info.desc}\n\n"
+        end
+
+        unless topic_info.example.nil?
+          info += "#{mark 'Example:'}\n"
+          info += "#{print_example(topic_info.example)}\n\n"
+        end
+
+        info += "#{mark 'Web Reference:'}\n\n"
+        info += "https://www.inspec.io/docs/reference/resources/#{topic}\n\n"
+        puts info
+      else
+        puts "The resource #{topic} does not exist. For a list of valid resources, type: help resources"
+      end
+    end
+
+    def resources
+      Inspec::Resource.registry.keys
+    end
+
+    def print_matchers_help
+      puts <<~EOL
+        Matchers are used to compare resource values to expectations. While some
+        resources implement their own custom matchers, the following matchers are
+        common amongst all resources:
+
+        #{mark 'be'}
+
+        The #{mark 'be'} matcher can be used to compare numeric values.
+
+          its('size') { should be >= 10 }
+
+        #{mark 'cmp'}
+
+        The #{mark 'cmp'} matcher is like #{mark 'eq'} but less restrictive. It will try
+        to fit the resource value to the expectation.
+
+        "Protocol" likely returns a string, but cmp will ensure it's a number before
+        comparing:
+
+          its('Protocol') { should cmp 2 }
+          its('Protocol') { should cmp '2' }
+
+        "users" may return an array, but if it contains only one item, cmp will compare
+        it as a string or number as needed:
+
+          its('users') { should cmp 'root' }
+
+        cmp is not case-sensitive:
+
+          its('log_format') { should cmp 'raw' }
+          its('log_format') { should cmp 'RAW' }
+
+        #{mark 'eq'}
+
+        The #{mark 'eq'} matcher tests for exact equality of two values. Value type
+        (string, number, etc.) is important and must be the same. For a less-restrictive
+        comparison matcher, use the #{mark 'cmp'} matcher.
+
+          its('RSAAuthentication') { should_not eq 'no' }
+
+        #{mark 'include'}
+
+        The #{mark 'include'} matcher tests to see if a value is included in a list.
+
+          its('users') { should include 'my_user' }
+
+        #{mark 'match'}
+
+        The #{mark 'match'} matcher can be used to test a string for a match using a
+        regular expression.
+
+          its('content') { should_not match /^MyKey:\\s+some value/ }
+
+        For more examples, see: https://www.inspec.io/docs/reference/matchers/
+
+      EOL
+    end
+  end
+end

data/lib/inspec/shell_detector.rb

@@ -0,0 +1,90 @@
+# encoding: utf-8
+require 'etc'
+require 'rbconfig'
+
+module Inspec
+  #
+  # ShellDetector attempts to detect the shell the invoking user is
+  # running by checking:
+  #
+  #  - The command of our parent
+  #  - The SHELL environment variable
+  #  - The shell returned by getpwuid for our process UID
+  #
+  # Since none of these methods is fullproof, the detected shell is
+  # verified against a list of known shells before being returned to
+  # the caller.
+  #
+  class ShellDetector
+    NOT_DETECTED = Object.new.freeze
+    KNOWN_SHELLS = %w{bash zsh ksh csh sh fish}.freeze
+
+    def initialize
+      @shell = NOT_DETECTED
+    end
+
+    def shell
+      @shell = detect if !detected?(@shell)
+      @shell
+    end
+
+    def shell!
+      @shell = detect
+    end
+
+    private
+
+    def detect
+      # Most of our detection code assumes a unix-like environment
+      return nil if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
+
+      shellpath = detect_by_ppid
+
+      if shellpath.nil? || shellpath.empty? || !known_shell?(shellpath)
+        shellpath = detect_by_env
+      end
+
+      if shellpath.nil? || shellpath.empty? || !known_shell?(shellpath)
+        shellpath = detect_by_getpwuid
+      end
+
+      shellname(shellpath) if known_shell?(shellpath)
+    end
+
+    def detected?(arg)
+      arg != NOT_DETECTED
+    end
+
+    def detect_by_ppid
+      ppid = Process.ppid
+      if Dir.exist?('/proc')
+        File.readlink("/proc/#{ppid}/exe")
+      else
+        `ps -cp #{ppid} -o command=`.chomp
+      end
+    end
+
+    def detect_by_env
+      ENV['SHELL']
+    end
+
+    def detect_by_getpwuid
+      Etc.getpwuid(Process.uid).shell
+    end
+
+    #
+    # Strip any leading path elements
+    #
+    def shellname(shellpath)
+      shellpath.split('/').last
+    end
+
+    #
+    # Only return shells that we know about, just to be sure we never
+    # do anything very silly.
+    #
+    def known_shell?(shell)
+      KNOWN_SHELLS.include?(shellname(shell))
+    end
+  end
+end

data/lib/inspec/source_reader.rb

@@ -0,0 +1,29 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'inspec/plugins'
+require 'utils/plugin_registry'
+
+module Inspec
+  # Pre-checking of target resolution. Make sure that SourceReader plugins
+  # always receive a fetcher.
+  class SourceReaderRegistry < PluginRegistry
+    def resolve(target)
+      return nil if target.nil?
+      super(target)
+    end
+  end
+
+  SourceReader = SourceReaderRegistry.new
+
+  def self.source_reader(version)
+    if version != 1
+      raise 'Only source readers version 1 is supported!'
+    end
+    Inspec::Plugins::SourceReader
+  end
+end
+
+require 'source_readers/inspec'
+require 'source_readers/flat'

data/lib/inspec/version.rb

@@ -0,0 +1,8 @@
+# encoding: utf-8
+# frozen_string_literal: true
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec
+  VERSION = '2.1.67'
+end

data/lib/matchers/matchers.rb

@@ -0,0 +1,339 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+RSpec::Matchers.define :be_readable do
+  match do |file|
+    file.readable?(@by, @by_user)
+  end
+
+  chain :by do |by|
+    @by = by
+  end
+
+  chain :by_user do |by_user|
+    @by_user = by_user
+  end
+
+  description do
+    res = 'be readable'
+    res += " by #{@by}" unless @by.nil?
+    res += " by user #{@by_user}" unless @by_user.nil?
+    res
+  end
+end
+
+RSpec::Matchers.define :be_writable do
+  match do |file|
+    file.writable?(@by, @by_user)
+  end
+
+  chain :by do |by|
+    @by = by
+  end
+
+  chain :by_user do |by_user|
+    @by_user = by_user
+  end
+
+  description do
+    res = 'be writable'
+    res += " by #{@by}" unless @by.nil?
+    res += " by user #{@by_user}" unless @by_user.nil?
+    res
+  end
+end
+
+RSpec::Matchers.define :be_executable do
+  match do |file|
+    file.executable?(@by, @by_user)
+  end
+
+  chain :by do |by|
+    @by = by
+  end
+
+  chain :by_user do |by_user|
+    @by_user = by_user
+  end
+
+  description do
+    res = 'be executable'
+    res += " by #{@by}" unless @by.nil?
+    res += " by user #{@by_user}" unless @by_user.nil?
+    res
+  end
+end
+
+RSpec::Matchers.define :contain_duplicates do
+  match do |arr|
+    dup = arr.select { |element| arr.count(element) > 1 }
+    !dup.uniq.empty?
+  end
+end
+
+# for packages
+RSpec::Matchers.define :be_installed do
+  match do |package|
+    package.installed? == true
+  end
+
+  failure_message do |package|
+    "expected that `#{package}` is installed"
+  end
+
+  chain :by do
+    raise "[UNSUPPORTED] Please use the new resources 'gem', 'npm' or 'pip'."
+  end
+end
+
+# for services
+RSpec::Matchers.define :be_enabled do
+  match do |service|
+    service.enabled? == true
+  end
+
+  chain :with_level do |_level|
+    raise '[UNSUPPORTED] with level is not supported'
+  end
+
+  failure_message do |service|
+    "expected that `#{service}` is enabled"
+  end
+end
+
+# service resource matcher for serverspec compatibility
+# Deprecated: You should not use this matcher anymore
+RSpec::Matchers.define :be_running do
+  match do |service|
+    service.running? == true
+  end
+
+  chain :under do |_under|
+    raise '[UNSUPPORTED] under is not supported'
+  end
+
+  failure_message do |service|
+    "expected that `#{service}` is running"
+  end
+end
+
+# matcher to check if host is reachable
+RSpec::Matchers.define :be_reachable do
+  match do |host|
+    host.reachable? == true
+  end
+
+  chain :with do |_attr|
+    raise '[UNSUPPORTED] `with` is not supported in combination with `be_reachable`'
+  end
+
+  failure_message do |host|
+    "expected that host #{host} is reachable"
+  end
+end
+
+# matcher to check if host is resolvable
+RSpec::Matchers.define :be_resolvable do
+  match do |host|
+    host.resolvable? == true
+  end
+
+  chain :by do |_type|
+    raise "[UNSUPPORTED] `by` is not supported in combination with `be_resolvable`. Please use the following syntax `host('example.com', port: 53, proto: 'udp')`."
+  end
+
+  failure_message do |host|
+    "expected that host #{host} is resolvable"
+  end
+end
+
+# matcher for iptables
+RSpec::Matchers.define :have_rule do |rule|
+  match do |tables|
+    tables.has_rule?(rule)
+  end
+
+  chain :with_table do |_table|
+    raise "[UNSUPPORTED] `with_table` is not supported in combination with `have_rule`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
+  end
+
+  chain :with_chain do |_chain|
+    raise "[UNSUPPORTED] `with_table` is not supported in combination with `with_chain`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
+  end
+end
+
+# `be_in` matcher
+# You can use it in the following cases:
+# - check if an item or array is included in a given array
+# eg:
+# describe nginx do
+#   its('user') { should be_in AUTHORIZED_USER_LIST }
+# end
+# describe nginx do
+#   its('module_list') { should be_in AUTHORIZED_MODULE_LIST }
+# end
+RSpec::Matchers.define :be_in do |list|
+  match do |item|
+    # Handle both single item and array
+    item.is_a?(Array) ? (item - list).empty? : list.include?(item)
+  end
+
+  match_when_negated do |item|
+    # Handle both single item and array
+    item.is_a?(Array) ? (item & list).empty? : !list.include?(item)
+  end
+
+  failure_message do |item|
+    if item.is_a?(Array)
+      "expected `#{item}` to be in the list: `#{list}` \nDiff:\n #{(item - list)}"
+    else
+      "expected `#{item}` to be in the list: `#{list}`"
+    end
+  end
+
+  failure_message_when_negated do |item|
+    if item.is_a?(Array)
+      "expected `#{item}` not to be in the list: `#{list}` \nComm:\n #{(item & list)}"
+    else
+      "expected `#{item}` not to be in the list: `#{list}`"
+    end
+  end
+end
+
+# This matcher implements a compare feature that cannot be covered by the default
+# `eq` matcher
+# You can use it in the following cases:
+# - compare strings case-insensitive
+# - you expect a number (strings will be converted if possible)
+#
+RSpec::Matchers.define :cmp do |first_expected| # rubocop:disable Metrics/BlockLength
+
+  def integer?(value)
+    !(value =~ /\A-?0+\Z|\A-?[1-9]\d*\Z/).nil?
+  end
+
+  def float?(value)
+    Float(value)
+    true
+  rescue ArgumentError => _ex
+    false
+  end
+
+  def octal?(value)
+    return false unless value.is_a?(String)
+    !(value =~ /\A0+\d+\Z/).nil?
+  end
+
+  def boolean?(value)
+    %w{true false}.include?(value.downcase)
+  end
+
+  def version?(value)
+    Gem::Version.new(value)
+    true
+  rescue ArgumentError => _ex
+    false
+  end
+
+  # expects that the values have been checked with boolean?
+  def to_boolean(value)
+    value.casecmp('true') == 0
+  end
+
+  def try_match(actual, op, expected) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+    # if actual and expected are strings
+    if expected.is_a?(String) && actual.is_a?(String)
+      return actual.casecmp(expected) == 0 if op == :==
+      return Gem::Version.new(actual).method(op).call(Gem::Version.new(expected)) if
+        version?(expected) && version?(actual)
+    elsif expected.is_a?(Regexp) && (actual.is_a?(String) || actual.is_a?(Integer))
+      return !actual.to_s.match(expected).nil?
+    elsif expected.is_a?(String) && integer?(expected) && actual.is_a?(Integer)
+      return actual.method(op).call(expected.to_i)
+    elsif expected.is_a?(String) && boolean?(expected) && [true, false].include?(actual)
+      return actual.method(op).call(to_boolean(expected))
+    elsif expected.is_a?(Integer) && integer?(actual)
+      return actual.to_i.method(op).call(expected)
+    elsif expected.is_a?(Float) && float?(actual)
+      return actual.to_f.method(op).call(expected)
+    elsif actual.is_a?(Symbol) && expected.is_a?(String)
+      return actual.to_s.method(op).call(expected)
+    elsif octal?(expected) && actual.is_a?(Integer)
+      return actual.method(op).call(expected.to_i(8))
+    end
+
+    # fallback to simple operation
+    actual.method(op).call(expected)
+  rescue NameError => _
+    false
+  rescue ArgumentError
+    false
+  end
+
+  match do |actual|
+    @operation ||= :==
+    @expected ||= first_expected
+    return actual === @expected if @operation == :=== # rubocop:disable Style/CaseEquality
+    actual = actual[0] if actual.is_a?(Array) && !@expected.is_a?(Array) && actual.length == 1
+    try_match(actual, @operation, @expected)
+  end
+
+  [:==, :'!=', :<, :<=, :>=, :>, :===, :=~].each do |op|
+    chain(op) do |x|
+      @operation = op
+      @expected = x
+    end
+  end
+
+  def format_expectation(negate)
+    return 'expected: '+@expected.inspect if @operation == :== && !negate
+    negate_str = negate ? 'not ' : ''
+    "expected it #{negate_str}to be #{@operation} #{@expected.inspect}"
+  end
+
+  failure_message do |actual|
+    actual = ('0' + actual.to_s(8)).inspect if octal?(@expected)
+    "\n" + format_expectation(false) + "\n     got: #{actual}\n\n(compared using `cmp` matcher)\n"
+  end
+
+  failure_message_when_negated do |actual|
+    actual = ('0' + actual.to_s(8)).inspect if octal?(@expected)
+    "\n" + format_expectation(true) + "\n     got: #{actual}\n\n(compared using `cmp` matcher)\n"
+  end
+
+  description do
+    "cmp #{@operation} #{@expected.inspect}"
+  end
+end
+
+# user resource matcher for serverspec compatibility
+# This matcher will be deprecated in future
+RSpec::Matchers.define :be_mounted do
+  match do |path|
+    if !@options.nil?
+      path.mounted?(@options, @identical)
+    else
+      path.mounted?
+    end
+  end
+
+  chain :with do |attr|
+    @options = attr
+    @identical = false
+  end
+
+  chain :only_with do |attr|
+    @options = attr
+    @identical = true
+  end
+
+  failure_message do |path|
+    if !@options.nil?
+      "\n#{path} is not mounted with the options\n     expected: #{@options}\n     got: #{path.mount_options}\n"
+    else
+      "\n#{path} is not mounted\n"
+    end
+  end
+end