inspec-core 2.1.67

data/lib/resources/docker_object.rb

@@ -0,0 +1,57 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+#
+# author: Christoph Hartmann
+# author: Patrick Muench
+# author: Dominik Richter
+# author: Matt Kulka
+
+module Inspec::Resources::DockerObject
+  def exist?
+    object_info.exists?
+  end
+
+  def id
+    object_info.ids[0] if object_info.entries.size == 1
+  end
+
+  private
+
+  def parse_components_from_image(image_string)
+    # if the user did not supply an image string, they likely supplied individual
+    # option parameters, such as repo and tag. Return empty data back to the caller.
+    return {} if image_string.nil?
+
+    first_colon = image_string.index(':') || -1
+    first_slash = image_string.index('/') || -1
+
+    if image_string.count(':') == 2
+      # If there are two colons in the image string, it contains a repo-with-port and a tag.
+      # example: localhost:5000/chef/inspec:1.46.3
+      partitioned_string = image_string.rpartition(':')
+      repo = partitioned_string.first
+      tag = partitioned_string.last
+      image_name = repo.split('/')[1..-1].join
+    elsif image_string.count(':') == 1 && first_colon < first_slash
+      # If there's one colon in the image string, and it comes before a forward-slash,
+      # it contains a repo-with-port but no tag.
+      # example: localhost:5000/ubuntu
+      repo = image_string
+      tag = nil
+      image_name = repo.split('/')[1..-1].join
+    else
+      # If there's one colon in the image string and it doesn't preceed a slash, or if
+      # there is no colon at all, then it separates the repo from the tag, if there is a tag.
+      # example: chef/inspec:1.46.3
+      # example: chef/inspec
+      # example: ubuntu:14.04
+      repo, tag = image_string.split(':')
+      image_name = repo
+    end
+
+    # return the repo, image_name and tag parsed from the string, which can be merged into
+    # the rest of the user-supplied options
+    { repo: repo, image_name: image_name, tag: tag }
+  end
+end

data/lib/resources/docker_service.rb

@@ -0,0 +1,90 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+
+require_relative 'docker_object'
+
+module Inspec::Resources
+  class DockerService < Inspec.resource(1)
+    include Inspec::Resources::DockerObject
+
+    name 'docker_service'
+    supports platform: 'unix'
+    desc 'Swarm-mode service'
+    example "
+      describe docker_service('service1') do
+        it { should exist }
+        its('id') { should_not eq '' }
+        its('image') { should eq 'alpine:latest' }
+        its('repo') { should eq 'alpine' }
+        its('tag') { should eq 'latest' }
+      end
+
+      describe docker_service(id: '4a415e366388') do
+        it { should exist }
+      end
+
+      describe docker_service(image: 'alpine:latest') do
+        it { should exist }
+      end
+    "
+
+    def initialize(opts = {})
+      # do sanitizion of input values
+      o = opts.dup
+      o = { name: opts } if opts.is_a?(String)
+      @opts = sanitize_options(o)
+    end
+
+    def name
+      object_info.names[0] if object_info.entries.size == 1
+    end
+
+    def image
+      object_info.images[0] if object_info.entries.size == 1
+    end
+
+    def image_name
+      parse_components_from_image(image)[:image_name] if object_info.entries.size == 1
+    end
+
+    def repo
+      parse_components_from_image(image)[:repo] if object_info.entries.size == 1
+    end
+
+    def tag
+      parse_components_from_image(image)[:tag] if object_info.entries.size == 1
+    end
+
+    def mode
+      object_info.modes[0] if object_info.entries.size == 1
+    end
+
+    def replicas
+      object_info.replicas[0] if object_info.entries.size == 1
+    end
+
+    def ports
+      object_info.ports[0] if object_info.entries.size == 1
+    end
+
+    def to_s
+      service = @opts[:name] || @opts[:id]
+      "Docker Service #{service}"
+    end
+
+    private
+
+    def sanitize_options(opts)
+      opts.merge(parse_components_from_image(opts[:image]))
+    end
+
+    def object_info
+      return @info if defined?(@info)
+      opts = @opts
+      @info = inspec.docker.services.where {
+        name == opts[:name] || image == opts[:image] || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id])))
+      }
+    end
+  end
+end

data/lib/resources/elasticsearch.rb

@@ -0,0 +1,169 @@
+# encoding: utf-8
+
+require 'utils/filter'
+require 'hashie/mash'
+require 'resources/package'
+
+module Inspec::Resources
+  class Elasticsearch < Inspec.resource(1)
+    name 'elasticsearch'
+    supports platform: 'unix'
+    desc "Use the Elasticsearch InSpec audit resource to test the status of nodes in
+      an Elasticsearch cluster."
+
+    example "
+      describe elasticsearch('http://eshost.mycompany.biz:9200/', username: 'elastic', password: 'changeme', ssl_verify: false) do
+        its('node_count') { should >= 3 }
+      end
+
+      describe elasticsearch do
+        its('node_name') { should include 'node1' }
+        its('os') { should_not include 'MacOS' }
+        its('version') { should cmp > 1.2.0 }
+      end
+    "
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:cluster_name,          field: 'cluster_name')
+          .add(:node_name,             field: 'name')
+          .add(:transport_address,     field: 'transport_address')
+          .add(:host,                  field: 'host')
+          .add(:ip,                    field: 'ip')
+          .add(:version,               field: 'version')
+          .add(:build_hash,            field: 'build_hash')
+          .add(:total_indexing_buffer, field: 'total_indexing_buffer')
+          .add(:roles,                 field: 'roles')
+          .add(:settings,              field: 'settings')
+          .add(:os,                    field: 'os')
+          .add(:process,               field: 'process')
+          .add(:jvm,                   field: 'jvm')
+          .add(:transport,             field: 'transport')
+          .add(:http,                  field: 'http')
+          .add(:plugins,               field: 'plugins')
+          .add(:plugin_list,           field: 'plugin_list')
+          .add(:modules,               field: 'modules')
+          .add(:module_list,           field: 'module_list')
+          .add(:node_id,               field: 'node_id')
+          .add(:ingest,                field: 'ingest')
+          .add(:exists?) { |x| !x.entries.empty? }
+          .add(:node_count) { |t, _|
+            t.entries.length
+          }
+
+    filter.connect(self, :nodes)
+
+    attr_reader :nodes, :url
+
+    def initialize(opts = {})
+      return skip_resource 'Package `curl` not avaiable on the host' unless inspec.command('curl').exist?
+
+      @url = opts.fetch(:url, 'http://localhost:9200')
+
+      username   = opts.fetch(:username, nil)
+      password   = opts.fetch(:password, nil)
+      ssl_verify = opts.fetch(:ssl_verify, true)
+
+      cmd = inspec.command(curl_command_string(username, password, ssl_verify))
+
+      # after implementation of PR #2235, this begin..rescue won't be necessary.
+      # The checks in verify_curl_success! can raise their own skip message exception.
+      begin
+        verify_curl_success!(cmd)
+      rescue => e
+        return skip_resource e.message
+      end
+
+      begin
+        content = JSON.parse(cmd.stdout)
+        # after implementation of PR #2235, this can be broken out of the begin..rescue
+        # clause. The checks in verify_json_payload! can raise their own skip message exception.
+        verify_json_payload!(content)
+      rescue JSON::ParserError => e
+        return skip_resource "Couldn't parse the Elasticsearch response: #{e.message}"
+      rescue => e
+        return skip_resource e.message
+      end
+
+      @nodes = parse_cluster(content)
+    end
+
+    def to_s
+      "Elasticsearch Cluster #{url}"
+    end
+
+    private
+
+    def parse_cluster(content)
+      return [] unless content['nodes']
+
+      nodes = []
+
+      content['nodes'].each do |node_id, node_data|
+        node_data = fix_mash_key_collision(node_data)
+
+        node = Hashie::Mash.new(node_data)
+        node.node_id = node_id
+        node.plugin_list = node.plugins.map(&:name)
+        node.module_list = node.modules.map(&:name)
+        node.cluster_name = node.settings.cluster.name
+        nodes << node
+      end
+
+      nodes
+    end
+
+    #
+    # Hashie::Mash will throw warnings if the Mash contains a key that is the same as a built-in
+    # method on a Hashie::Mash instance. This is a crude way of avoiding those warnings without
+    # hard-coding a bunch of key renames.
+    #
+    # Any key that is in conflict will be renamed "es_ORIGINALKEY"
+    #
+    def fix_mash_key_collision(data)
+      test_mash = Hashie::Mash.new
+
+      new_data = {}
+      data.each do |key, value|
+        new_key = test_mash.respond_to?(key.to_sym) ? "es_#{key}" : key
+        new_value = value.is_a?(Hash) ? fix_mash_key_collision(value) : value
+
+        new_data[new_key] = new_value
+      end
+
+      new_data
+    end
+
+    def curl_command_string(username, password, ssl_verify)
+      cmd_string = ['curl']
+      cmd_string << '-k' unless ssl_verify
+      cmd_string << "-H 'Content-Type: application/json'"
+      cmd_string << " -u #{username}:#{password}" unless username.nil? || password.nil?
+      cmd_string << URI.join(url, '_nodes')
+
+      cmd_string.join(' ')
+    end
+
+    def verify_curl_success!(cmd)
+      # the following lines captures known possible curl command errors and provides compact skip resource messeges
+      if cmd.stderr =~ /Failed to connect/
+        raise "Connection refused - please check the URL #{url} for accuracy"
+      end
+
+      if cmd.stderr =~ /Peer's Certificate issuer is not recognized/
+        raise 'Connection refused - peer certificate issuer is not recognized'
+      end
+
+      raise "Error fetching Elastcsearch data from curl #{url}: #{cmd.stderr}" unless cmd.exit_status.zero?
+    end
+
+    def verify_json_payload!(content)
+      unless content['error'].nil?
+        raise "#{content['error']['type']}: #{content['error']['reason']}"
+      end
+
+      raise 'No successful nodes available in cluster' if content['_nodes']['successful'].zero?
+    end
+  end
+end

data/lib/resources/etc_fstab.rb

@@ -0,0 +1,94 @@
+# encoding: utf-8
+# copyright:
+
+require 'utils/parser'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class EtcFstab < Inspec.resource(1)
+    name 'etc_fstab'
+    supports platform: 'unix'
+    desc 'Use the etc_fstab InSpec audit resource to check the configuration of the etc/fstab file.'
+    example "
+      nfs_systems = etc_fstab.nfs_file_systems.entries
+      nfs_systems.each do |file_system|
+        describe file_system do
+          its ('mount_options') { should include 'nosuid' }
+          its ('mount_options') { should include 'noexec' }
+          its ('mount_options') { should include 'sec=krb5:krb5i:krb5p }
+        end
+      end
+
+      describe etc_fstab do
+        its ('home_mount_options') { should include 'nosuid' }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+    include FileReader
+
+    def initialize(fstab_path = nil)
+      @conf_path      = fstab_path || '/etc/fstab'
+      @files_contents = {}
+      @content        = nil
+      @params         = nil
+      read_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:device_name,           field: 'device_name')
+          .add(:mount_point,           field: 'mount_point')
+          .add(:file_system_type,      field: 'file_system_type')
+          .add(:mount_options,         field: 'mount_options')
+          .add(:dump_options,          field: 'dump_options')
+          .add(:file_system_options,   field: 'file_system_options')
+          .add(:configured?) { |x| x.entries.any? }
+
+    filter.connect(self, :params)
+
+    def nfs_file_systems
+      where { file_system_type.match(/nfs/) }
+    end
+
+    def home_mount_options
+      return nil unless where { mount_point == '/home' }.configured?
+      where { mount_point == '/home' }.entries[0].mount_options
+    end
+
+    private
+
+    def read_content
+      @content = ''
+      @params  = {}
+      @content = read_file(@conf_path)
+      @params  = parse_conf(@content)
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        parse_line(data) unless data == ''
+      end.compact
+    end
+
+    def parse_line(line)
+      attributes = line.split
+      {
+        'device_name'         => attributes[0],
+        'mount_point'         => attributes[1],
+        'file_system_type'    => attributes[2],
+        'mount_options'       => attributes[3].split(','),
+        'dump_options'        => attributes[4].to_i,
+        'file_system_options' => attributes[5].to_i,
+      }
+    end
+
+    def read_file(conf_path = @conf_path)
+      read_file_content(conf_path).lines
+    end
+  end
+end

data/lib/resources/etc_group.rb

@@ -0,0 +1,154 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+# The file format consists of
+# - group name
+# - password - group's encrypted password
+# - gid - group's decimal ID
+# - member list - group members, comma seperated list
+#
+# Usage:
+# describe etc_group do
+#   its('gids') { should_not contain_duplicates }
+#   its('groups') { should include 'my_user' }
+#   its('users') { should include 'my_user' }
+# end
+#
+# describe etc_group.where(name: 'my_group') do
+#   its('users') { should include 'my_user' }
+# end
+
+require 'utils/convert'
+require 'utils/parser'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class EtcGroup < Inspec.resource(1)
+    include Converter
+    include CommentParser
+
+    name 'etc_group'
+    supports platform: 'unix'
+    desc 'Use the etc_group InSpec audit resource to test groups that are defined on Linux and UNIX platforms. The /etc/group file stores details about each group---group name, password, group identifier, along with a comma-separate list of users that belong to the group.'
+    example "
+      describe etc_group do
+        its('gids') { should_not contain_duplicates }
+        its('groups') { should include 'my_user' }
+        its('users') { should include 'my_user' }
+      end
+    "
+
+    include FileReader
+
+    attr_accessor :gid, :entries
+    def initialize(path = nil)
+      @path = path || '/etc/group'
+      @entries = parse_group(@path)
+    end
+
+    def groups(filter = nil)
+      (filter || @entries)&.map { |x| x['name'] }
+    end
+
+    def gids(filter = nil)
+      (filter || @entries)&.map { |x| x['gid'] }
+    end
+
+    def users(filter = nil)
+      entries = filter || @entries
+      return nil if entries.nil?
+      # filter the user entry
+      res = entries.map { |x|
+        x['members'].split(',') if !x.nil? && !x['members'].nil?
+      }.flatten
+      # filter nil elements
+      res.reject { |x| x.nil? || x.empty? }
+    end
+
+    def where(conditions = {})
+      return if conditions.empty?
+      fields = {
+        name: 'name',
+        group_name: 'name',
+        password: 'password',
+        gid: 'gid',
+        group_id: 'gid',
+        users: 'members',
+        members: 'members',
+      }
+      res = entries
+
+      unless res.nil?
+        conditions.each do |k, v|
+          idx = fields[k.to_sym]
+          next if idx.nil?
+          res = res.select { |x| x[idx].to_s == v.to_s }
+        end
+      end
+
+      EtcGroupView.new(self, res)
+    end
+
+    def to_s
+      '/etc/group'
+    end
+
+    private
+
+    def parse_group(path)
+      @content = read_file_content(path, allow_empty: true)
+
+      # iterate over each line and filter comments
+      @content.split("\n").each_with_object([]) do |line, lines|
+        grp_info = parse_group_line(line)
+        lines.push(grp_info) if !grp_info.nil? && !grp_info.empty?
+      end
+    end
+
+    def parse_group_line(line)
+      opts = {
+        comment_char: '#',
+        standalone_comments: false,
+      }
+      line, _idx_nl = parse_comment_line(line, opts)
+      x = line.split(':')
+      # abort if we have an empty or comment line
+      return nil if x.empty?
+      # map data
+      {
+        'name' => x.at(0), # Name of the group.
+        'password' => x.at(1), # Group's encrypted password.
+        'gid' => convert_to_i(x.at(2)), # The group's decimal ID.
+        'members' => x.at(3), # Group members.
+      }
+    end
+  end
+
+  # object that hold a specifc view on etc group
+  class EtcGroupView
+    def initialize(parent, filter)
+      @parent = parent
+      @filter = filter
+    end
+
+    # returns the group object
+    def entries
+      @filter
+    end
+
+    # only returns group name
+    def groups
+      @parent.groups(@filter)
+    end
+
+    # only return gids
+    def gids
+      @parent.gids(@filter)
+    end
+
+    # only returns users
+    def users
+      @parent.users(@filter)
+    end
+  end
+end