inspec-core 2.1.67

data/lib/resources/dh_params.rb

@@ -0,0 +1,77 @@
+# encoding: utf-8
+
+require 'openssl'
+require 'utils/file_reader'
+
+class DhParams < Inspec.resource(1)
+  name 'dh_params'
+  supports platform: 'unix'
+  desc '
+    Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH)
+    parameters.
+  '
+
+  example "
+    describe dh_params('/path/to/file.dh_pem') do
+      it { should be_dh_params }
+      it { should be_valid }
+      its('generator') { should eq 2 }
+      its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+      its('prime_length') { should eq 2048 }
+      its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+      its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
+    end
+  "
+
+  include FileReader
+
+  def initialize(filename)
+    @dh_params_path = filename
+    @dh_params = OpenSSL::PKey::DH.new read_file_content(@dh_params_path)
+  end
+
+  # it { should be_dh_params }
+  def dh_params?
+    !@dh_params.nil?
+  end
+
+  # its('generator') { should eq 2 }
+  def generator
+    return if @dh_params.nil?
+    @dh_params.g.to_i
+  end
+
+  # its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+  def modulus
+    return if @dh_params.nil?
+    '00:' + @dh_params.p.to_s(16).downcase.scan(/.{2}/).join(':')
+  end
+
+  # its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+  def pem
+    return if @dh_params.nil?
+    @dh_params.to_pem
+  end
+
+  # its('prime_length') { should be 2048 }
+  def prime_length
+    return if @dh_params.nil?
+    @dh_params.p.num_bits
+  end
+
+  # its('text') { should eq 'human-readable-text' }
+  def text
+    return if @dh_params.nil?
+    @dh_params.to_text
+  end
+
+  # it { should be_valid }
+  def valid?
+    return if @dh_params.nil?
+    @dh_params.params_ok?
+  end
+
+  def to_s
+    "dh_params #{@dh_params_path}"
+  end
+end

data/lib/resources/directory.rb

@@ -0,0 +1,25 @@
+# encoding: utf-8
+
+require 'resources/file'
+
+module Inspec::Resources
+  class Directory < FileResource
+    name 'directory'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the directory InSpec audit resource to test if the file type is a directory. This is equivalent to using the file InSpec audit resource and the be_directory matcher, but provides a simpler and more direct way to test directories. All of the matchers available to file may be used with directory.'
+    example "
+      describe directory('path') do
+        it { should be_directory }
+      end
+    "
+
+    def exist?
+      file.exist? && file.directory?
+    end
+
+    def to_s
+      "Directory #{source_path}"
+    end
+  end
+end

data/lib/resources/docker.rb

@@ -0,0 +1,236 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+#
+
+require 'utils/filter'
+require 'hashie/mash'
+
+module Inspec::Resources
+  class DockerContainerFilter
+    # use filtertable for containers
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:commands,       field: 'command')
+          .add(:ids,            field: 'id')
+          .add(:images,         field: 'image')
+          .add(:labels,         field: 'labels')
+          .add(:local_volumes,  field: 'localvolumes')
+          .add(:mounts,         field: 'mounts')
+          .add(:names,          field: 'names')
+          .add(:networks,       field: 'networks')
+          .add(:ports,          field: 'ports')
+          .add(:running_for,    field: 'runningfor')
+          .add(:sizes,          field: 'size')
+          .add(:status,         field: 'status')
+          .add(:exists?) { |x| !x.entries.empty? }
+          .add(:running?) { |x|
+            x.where { status.downcase.start_with?('up') }
+          }
+    filter.connect(self, :containers)
+
+    attr_reader :containers
+    def initialize(containers)
+      @containers = containers
+    end
+  end
+
+  class DockerImageFilter
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:ids,              field: 'id')
+          .add(:repositories,     field: 'repository')
+          .add(:tags,             field: 'tag')
+          .add(:sizes,            field: 'size')
+          .add(:digests,          field: 'digest')
+          .add(:created,          field: 'createdat')
+          .add(:created_since,    field: 'createdsize')
+          .add(:exists?) { |x| !x.entries.empty? }
+    filter.connect(self, :images)
+
+    attr_reader :images
+    def initialize(images)
+      @images = images
+    end
+  end
+
+  class DockerServiceFilter
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:ids,              field: 'id')
+          .add(:names,            field: 'name')
+          .add(:modes,            field: 'mode')
+          .add(:replicas,         field: 'replicas')
+          .add(:images,           field: 'image')
+          .add(:ports,            field: 'ports')
+          .add(:exists?) { |x| !x.entries.empty? }
+    filter.connect(self, :services)
+
+    attr_reader :services
+    def initialize(services)
+      @services = services
+    end
+  end
+
+  # This resource helps to parse information from the docker host
+  # For compatability with Serverspec we also offer the following resouses:
+  # - docker_container
+  # - docker_image
+  class Docker < Inspec.resource(1)
+    name 'docker'
+    supports platform: 'unix'
+    desc "
+      A resource to retrieve information about docker
+    "
+
+    example "
+      describe docker.containers do
+        its('images') { should_not include 'u12:latest' }
+      end
+
+      describe docker.images do
+        its('repositories') { should_not include 'inssecure_image' }
+      end
+
+      describe docker.services do
+        its('images') { should_not include 'inssecure_image' }
+      end
+
+      describe docker.version do
+        its('Server.Version') { should cmp >= '1.12'}
+        its('Client.Version') { should cmp >= '1.12'}
+      end
+
+      describe docker.object(id) do
+        its('Configuration.Path') { should eq 'value' }
+      end
+
+      docker.containers.ids.each do |id|
+        # call docker inspect for a specific container id
+        describe docker.object(id) do
+          its(%w(HostConfig Privileged)) { should cmp false }
+          its(%w(HostConfig Privileged)) { should_not cmp true }
+        end
+      end
+    "
+
+    def containers
+      DockerContainerFilter.new(parse_containers)
+    end
+
+    def images
+      DockerImageFilter.new(parse_images)
+    end
+
+    def services
+      DockerServiceFilter.new(parse_services)
+    end
+
+    def version
+      return @version if defined?(@version)
+      data = {}
+      cmd = inspec.command('docker version --format \'{{ json . }}\'')
+      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
+      @version = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    def info
+      return @info if defined?(@info)
+      data = {}
+      # docke info format is only supported for Docker 17.03+
+      cmd = inspec.command('docker info --format \'{{ json . }}\'')
+      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
+      @info = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    # returns information about docker objects
+    def object(id)
+      return @inspect if defined?(@inspect)
+      data = JSON.parse(inspec.command("docker inspect #{id}").stdout)
+      data = data[0] if data.is_a?(Array)
+      @inspect = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    def to_s
+      'Docker Host'
+    end
+
+    private
+
+    def parse_json_command(labels, subcommand)
+      # build command
+      format = labels.map { |label| "\"#{label}\": {{json .#{label}}}" }
+      raw = inspec.command("docker #{subcommand} --format '{#{format.join(', ')}}'").stdout
+      output = []
+      # since docker is not outputting valid json, we need to parse each row
+      raw.each_line { |entry|
+        # convert all keys to lower_case to work well with ruby and filter table
+        j = JSON.parse(entry).map { |k, v|
+          [k.downcase, v]
+        }.to_h
+
+        # ensure all keys are there
+        j = ensure_keys(j, labels)
+
+        # strip off any linked container names
+        # Depending on how it was linked, the actual container name may come before
+        # or after the link information, so we'll just look for the first name that
+        # does not include a slash since that is not a valid character in a container name
+        j['names'] = j['names'].split(',').find { |c| !c.include?('/') } if j.key?('names')
+
+        output.push(j)
+      }
+      output
+    rescue JSON::ParserError => _e
+      warn "Could not parse `docker #{subcommand}` output"
+      []
+    end
+
+    def parse_containers
+      # @see https://github.com/moby/moby/issues/20625, works for docker 1.13+
+      # raw_containers = inspec.command('docker ps -a --no-trunc --format \'{{ json . }}\'').stdout
+      # therefore we stick with older approach
+      labels = %w{Command CreatedAt ID Image Labels Mounts Names Ports RunningFor Size Status}
+
+      # Networks LocalVolumes work with 1.13+ only
+      if !version.empty? && Gem::Version.new(version['Client']['Version']) >= Gem::Version.new('1.13')
+        labels.push('Networks')
+        labels.push('LocalVolumes')
+      end
+      parse_json_command(labels, 'ps -a --no-trunc')
+    end
+
+    def parse_services
+      parse_json_command(%w{ID Name Mode Replicas Image Ports}, 'service ls')
+    end
+
+    def ensure_keys(entry, labels)
+      labels.each { |key|
+        entry[key.downcase] = nil if !entry.key?(key.downcase)
+      }
+      entry
+    end
+
+    def parse_images
+      # docker does not support the `json .` function here, therefore we need to emulate that behavior.
+      raw_images = inspec.command('docker images -a --no-trunc --format \'{ "id": {{json .ID}}, "repository": {{json .Repository}}, "tag": {{json .Tag}}, "size": {{json .Size}}, "digest": {{json .Digest}}, "createdat": {{json .CreatedAt}}, "createdsize": {{json .CreatedSince}} }\'').stdout
+      c_images = []
+      raw_images.each_line { |entry|
+        c_images.push(JSON.parse(entry))
+      }
+      c_images
+    rescue JSON::ParserError => _e
+      warn 'Could not parse `docker images` output'
+      []
+    end
+  end
+end

data/lib/resources/docker_container.rb

@@ -0,0 +1,89 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+
+require_relative 'docker_object'
+
+module Inspec::Resources
+  class DockerContainer < Inspec.resource(1)
+    include Inspec::Resources::DockerObject
+
+    name 'docker_container'
+    supports platform: 'unix'
+    desc ''
+    example "
+      describe docker_container('an-echo-server') do
+        it { should exist }
+        it { should be_running }
+        its('id') { should_not eq '' }
+        its('image') { should eq 'busybox:latest' }
+        its('repo') { should eq 'busybox' }
+        its('tag') { should eq 'latest' }
+        its('ports') { should eq [] }
+        its('command') { should eq 'nc -ll -p 1234 -e /bin/cat' }
+      end
+
+      describe docker_container(id: 'e2c52a183358') do
+        it { should exist }
+        it { should be_running }
+      end
+    "
+
+    def initialize(opts = {})
+      # if a string is provided, we expect it is the name
+      if opts.is_a?(String)
+        @opts = { name: opts }
+      else
+        @opts = opts
+      end
+    end
+
+    def running?
+      status.downcase.start_with?('up') if object_info.entries.length == 1
+    end
+
+    def status
+      object_info.status[0] if object_info.entries.length == 1
+    end
+
+    def labels
+      object_info.labels[0] if object_info.entries.length == 1
+    end
+
+    def ports
+      object_info.ports[0] if object_info.entries.length == 1
+    end
+
+    def command
+      return unless object_info.entries.length == 1
+
+      cmd = object_info.commands[0]
+      cmd.slice(1, cmd.length - 2)
+    end
+
+    def image
+      object_info.images[0] if object_info.entries.length == 1
+    end
+
+    def repo
+      parse_components_from_image(image)[:repo] if object_info.entries.size == 1
+    end
+
+    def tag
+      parse_components_from_image(image)[:tag] if object_info.entries.size == 1
+    end
+
+    def to_s
+      name = @opts[:name] || @opts[:id]
+      "Docker Container #{name}"
+    end
+
+    private
+
+    def object_info
+      return @info if defined?(@info)
+      opts = @opts
+      @info = inspec.docker.containers.where { names == opts[:name] || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id]))) }
+    end
+  end
+end

data/lib/resources/docker_image.rb

@@ -0,0 +1,83 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+
+require_relative 'docker_object'
+
+module Inspec::Resources
+  class DockerImage < Inspec.resource(1)
+    include Inspec::Resources::DockerObject
+
+    name 'docker_image'
+    supports platform: 'unix'
+    desc ''
+    example "
+      describe docker_image('alpine:latest') do
+        it { should exist }
+        its('id') { should_not eq '' }
+        its('image') { should eq 'alpine:latest' }
+        its('repo') { should eq 'alpine' }
+        its('tag') { should eq 'latest' }
+      end
+
+      describe docker_image('alpine:latest') do
+        it { should exist }
+      end
+
+      describe docker_image(id: '4a415e366388') do
+        it { should exist }
+      end
+    "
+
+    def initialize(opts = {})
+      # do sanitizion of input values
+      o = opts.dup
+      o = { image: opts } if opts.is_a?(String)
+      @opts = sanitize_options(o)
+    end
+
+    def image
+      "#{repo}:#{tag}" if object_info.entries.size == 1
+    end
+
+    def repo
+      object_info.repositories[0] if object_info.entries.size == 1
+    end
+
+    def tag
+      object_info.tags[0] if object_info.entries.size == 1
+    end
+
+    def to_s
+      img = @opts[:image] || @opts[:id]
+      "Docker Image #{img}"
+    end
+
+    private
+
+    def sanitize_options(opts)
+      opts.merge!(parse_components_from_image(opts[:image]))
+
+      # assume a "latest" tag if we don't have one
+      opts[:tag] ||= 'latest'
+
+      # if the ID isn't nil and doesn't contain a hash indicator (indicated by the presence
+      # of a colon, which separates the indicator from the actual hash), we assume it's sha256.
+      opts[:id] = 'sha256:' + opts[:id] unless opts[:id].nil? || opts[:id].include?(':')
+
+      # Assemble/reassemble the image from the repo and tag
+      opts[:image] = "#{opts[:repo]}:#{opts[:tag]}" unless opts[:repo].nil?
+
+      # return the santized opts back to the caller
+      opts
+    end
+
+    def object_info
+      return @info if defined?(@info)
+      opts = @opts
+      @info = inspec.docker.images.where {
+        (repository == opts[:repo] && tag == opts[:tag]) || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id])))
+      }
+    end
+  end
+end