inspec-core 2.1.67

data/lib/resources/grub_conf.rb

@@ -0,0 +1,227 @@
+# encoding: utf-8
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+class GrubConfig < Inspec.resource(1)
+  name 'grub_conf'
+  supports platform: 'unix'
+  desc 'Use the grub_conf InSpec audit resource to test the boot config of Linux systems that use Grub.'
+  example "
+    describe grub_conf('/etc/grub.conf',  'default') do
+      its('kernel') { should include '/vmlinuz-2.6.32-573.7.1.el6.x86_64' }
+      its('initrd') { should include '/initramfs-2.6.32-573.el6.x86_64.img=1' }
+      its('default') { should_not eq '1' }
+      its('timeout') { should eq '5' }
+    end
+
+    also check specific kernels
+    describe grub_conf('/etc/grub.conf',  'CentOS (2.6.32-573.12.1.el6.x86_64)') do
+      its('kernel') { should include 'audit=1' }
+    end
+  "
+
+  include FileReader
+
+  class UnknownGrubConfig < StandardError; end
+
+  def initialize(path = nil, kernel = nil)
+    config_for_platform(path)
+    @content = read_file(@conf_path)
+    @kernel = kernel || 'default'
+  rescue UnknownGrubConfig
+    return skip_resource 'The `grub_config` resource is not supported on your OS yet.'
+  end
+
+  def config_for_platform(path)
+    os = inspec.os
+    if os.redhat? || os[:name] == 'fedora'
+      config_for_redhatish(path)
+    elsif os.debian?
+      @conf_path = path || '/boot/grub/grub.cfg'
+      @defaults_path = '/etc/default/grub'
+      @grubenv_path = '/boot/grub2/grubenv'
+      @version = 'grub2'
+    elsif os[:name] == 'amazon'
+      @conf_path = path || '/etc/grub.conf'
+      @version = 'legacy'
+    else
+      raise UnknownGrubConfig
+    end
+  end
+
+  def config_for_redhatish(path)
+    if inspec.os[:release].to_f < 7
+      @conf_path = path || '/etc/grub.conf'
+      @version = 'legacy'
+    else
+      @conf_path = path || '/boot/grub2/grub.cfg'
+      @defaults_path = '/etc/default/grub'
+      @grubenv_path = '/boot/grub2/grubenv'
+      @version = 'grub2'
+    end
+  end
+
+  def method_missing(name)
+    read_params[name.to_s]
+  end
+
+  def to_s
+    'Grub Config'
+  end
+
+  private
+
+  ######################################################################
+  # Grub2 This is used by all supported versions of Ubuntu and Rhel 7+ #
+  ######################################################################
+
+  def grub2_parse_kernel_lines(content, conf)
+    menu_entries = extract_menu_entries(content)
+
+    if @kernel == 'default'
+      default_menu_entry(menu_entries, conf['GRUB_DEFAULT'])
+    else
+      menu_entries.find { |entry| entry['name'] == @kernel }
+    end
+  end
+
+  def extract_menu_entries(content)
+    menu_entries = []
+
+    lines = content.split("\n")
+    lines.each_with_index do |line, index|
+      next unless line =~ /^menuentry\s+.*/
+      entry = {}
+      entry['insmod'] = []
+
+      # Extract name from menuentry line
+      capture_data = line.match(/(?:^|\s+).*menuentry\s*['|"](.*)['|"]\s*--/)
+      if capture_data.nil? || capture_data.captures[0].nil?
+        raise Inspec::Exceptions::ResourceFailed "Failed to extract menuentry name from #{line}"
+      end
+
+      entry['name'] = capture_data.captures[0]
+
+      # Begin processing from index forward until a `}` line is met
+      lines.drop(index+1).each do |mline|
+        break if mline =~ /^\s*}\s*$/
+        case mline
+        when /(?:^|\s*)initrd.*/
+          entry['initrd'] = mline.split(' ')[1]
+        when /(?:^|\s*)linux.*/
+          entry['kernel'] = mline.split
+        when /(?:^|\s*)set root=.*/
+          entry['root'] = mline.split('=')[1].tr('\'', '')
+        when /(?:^|\s*)insmod.*/
+          entry['insmod'] << mline.split(' ')[1]
+        end
+      end
+
+      menu_entries << entry
+    end
+
+    menu_entries
+  end
+
+  def default_menu_entry(menu_entries, default)
+    # If the default entry isn't `saved` then a number is used as an index.
+    # By default this is `0`, which would be the first item in the list.
+    return menu_entries[default.to_i] unless default == 'saved'
+
+    grubenv_contents = inspec.file(@grubenv_path).content
+
+    # The location of the grubenv file is not guaranteed. In the case that
+    # the file does not exist this will return the 0th entry. This will also
+    # return the 0th entry if InSpec lacks permission to read the file. Both
+    # of these reflect the default Grub2 behavior.
+    return menu_entries[0] if grubenv_contents.nil?
+
+    default_name = SimpleConfig.new(grubenv_contents).params['saved_entry']
+    default_entry = menu_entries.select { |k| k['name'] == default_name }[0]
+    return default_entry unless default_entry.nil?
+
+    # It is possible for the saved entry to not be valid . For example, grubenv
+    # not being up to date. If so, the 0th entry is the default.
+    menu_entries[0]
+  end
+
+  ###################################################################
+  # Grub1 aka legacy-grub config. Primarily used by Centos/Rhel 6.x #
+  ###################################################################
+
+  def parse_kernel_lines(content, conf)
+    # Find all "title" lines and then parse them into arrays
+    menu_entry = 0
+    lines = content.split("\n")
+    kernel_opts = {}
+    lines.each_with_index do |file_line, index|
+      next unless file_line =~ /^title.*/
+      current_kernel = file_line.split(' ', 2)[1]
+      lines.drop(index+1).each do |kernel_line|
+        if kernel_line =~ /^\s.*/
+          option_type = kernel_line.split(' ')[0]
+          line_options = kernel_line.split(' ').drop(1)
+          if (menu_entry == conf['default'].to_i && @kernel == 'default') || current_kernel == @kernel
+            if option_type == 'kernel'
+              kernel_opts['kernel'] = line_options
+            else
+              kernel_opts[option_type] = line_options[0]
+            end
+          end
+        else
+          menu_entry += 1
+          break
+        end
+      end
+    end
+    kernel_opts
+  end
+
+  def read_file(config_file)
+    read_file_content(config_file)
+  end
+
+  def read_params
+    return @params if defined?(@params)
+
+    content = read_file(@conf_path)
+
+    if @version == 'legacy'
+      # parse the file
+      conf = SimpleConfig.new(
+        content,
+        multiple_values: true,
+      ).params
+      # convert single entry arrays into strings
+      conf.each do |key, value|
+        if value.size == 1
+          conf[key] = conf[key][0].to_s
+        end
+      end
+      kernel_opts = parse_kernel_lines(content, conf)
+      @params = conf.merge(kernel_opts)
+    end
+
+    if @version == 'grub2'
+      # read defaults
+      defaults = read_file(@defaults_path)
+
+      conf = SimpleConfig.new(
+        defaults,
+        multiple_values: true,
+      ).params
+
+      # convert single entry arrays into strings
+      conf.each do |key, value|
+        if value.size == 1
+          conf[key] = conf[key][0].to_s
+        end
+      end
+
+      kernel_opts = grub2_parse_kernel_lines(content, conf)
+      @params = conf.merge(kernel_opts)
+    end
+    @params
+  end
+end

data/lib/resources/host.rb

@@ -0,0 +1,306 @@
+# encoding: utf-8
+
+# Usage:
+# describe host('example.com') do
+#   it { should be_resolvable }
+#   it { should be_reachable }
+#   its('ipaddress') { should include '93.184.216.34' }
+# end
+#
+# To verify a hostname with protocol and port
+# describe host('example.com', port: 443, protocol: 'tcp') do
+#   it { should be_reachable }
+# end
+#
+# We do not support the following serverspec syntax:
+# describe host('example.com') do
+#   it { should be_reachable.with( :port => 22 ) }
+#   it { should be_reachable.with( :port => 22, :proto => 'tcp' ) }
+#   it { should be_reachable.with( :port => 53, :proto => 'udp' ) }
+#
+#   it { should be_resolvable.by('hosts') }
+#   it { should be_resolvable.by('dns') }
+# end
+
+require 'resolv'
+
+module Inspec::Resources
+  class Host < Inspec.resource(1)
+    name 'host'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the host InSpec audit resource to test the name used to refer to a specific host and its availability, including the Internet protocols and ports over which that host name should be available.'
+    example "
+      describe host('example.com') do
+        it { should be_reachable }
+        it { should be_resolvable }
+        its('ipaddress') { should include '12.34.56.78' }
+      end
+
+      describe host('example.com', port: '80', protocol: 'tcp') do
+        it { should be_reachable }
+      end
+    "
+
+    attr_reader :hostname, :port, :protocol
+
+    def initialize(hostname, params = {})
+      @hostname = hostname
+      @port = params[:port]
+
+      if params[:proto]
+        warn '[DEPRECATION] The `proto` parameter is deprecated. Use `protocol` instead.'
+        @protocol = params[:proto]
+      else
+        @protocol = params.fetch(:protocol, 'icmp')
+      end
+
+      @host_provider = nil
+      if inspec.os.linux?
+        @host_provider = LinuxHostProvider.new(inspec)
+      elsif inspec.os.windows?
+        return skip_resource 'Invalid protocol: only `tcp` and `icmp` protocols are support for the `host` resource on your OS.' unless
+          %w{icmp tcp}.include?(@protocol)
+
+        @host_provider = WindowsHostProvider.new(inspec)
+      elsif inspec.os.darwin?
+        @host_provider = DarwinHostProvider.new(inspec)
+      else
+        return skip_resource 'The `host` resource is not supported on your OS yet.'
+      end
+
+      missing_requirements = @host_provider.missing_requirements(protocol)
+      return skip_resource 'The following requirements are not met for this resource: ' \
+        "#{missing_requirements.join(', ')}" unless missing_requirements.empty?
+    end
+
+    def proto
+      warn '[DEPRECATION] The `proto` method is deprecated. Use `protocol` instead.'
+      protocol
+    end
+
+    # if we get the IP address, the host is resolvable
+    def resolvable?(type = nil)
+      warn "The `host` resource ignores #{type} parameters. Continue to resolve host." if !type.nil?
+      resolve.nil? || resolve.empty? ? false : true
+    end
+
+    def reachable?
+      # ping checks do not require port or protocol
+      return ping.fetch(:success, false) if protocol == 'icmp'
+
+      # if either port or protocol are specified but not both, we cannot proceed.
+      if port.nil? || protocol.nil?
+        raise "Protocol required with port. Use `host` resource with host('#{hostname}', port: 1234, proto: 'tcp') parameters." if port.nil? || protocol.nil?
+      end
+
+      # perform the protocol-specific reachability test
+      ping.fetch(:success, false)
+    end
+
+    def connection
+      ping[:connection]
+    end
+
+    def socket
+      ping[:socket]
+    end
+
+    # returns all A records of the IP address, will return an array
+    def ipaddress
+      resolve.nil? || resolve.empty? ? nil : resolve
+    end
+
+    def to_s
+      resource_name = "Host #{hostname}"
+      resource_name += " port #{port} proto #{protocol}" if port
+
+      resource_name
+    end
+
+    private
+
+    def ping
+      return @ping_cache if defined?(@ping_cache)
+      return {} if @host_provider.nil?
+
+      @ping_cache = @host_provider.ping(hostname, port, protocol)
+    end
+
+    def resolve
+      return @ip_cache if defined?(@ip_cache)
+      @ip_cache = @host_provider.resolve(hostname) if !@host_provider.nil?
+    end
+  end
+
+  class HostProvider
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+
+    def missing_requirements(_protocol)
+      # each provider can return an array of missing requirements that can
+      # be enumerated in a skip_resource message
+      []
+    end
+  end
+
+  class UnixHostProvider < HostProvider
+    def initialize(inspec)
+      super
+
+      @has_nc = inspec.command('nc').exist?
+      @has_ncat = inspec.command('ncat').exist?
+      @has_net_redirections = inspec.command("strings `which bash` | grep -qE '/dev/(tcp|udp)/'").exit_status == 0
+    end
+
+    def missing_requirements(protocol)
+      missing = []
+
+      if %w{tcp udp}.include?(protocol) && !@has_nc && !@has_ncat
+        if @has_net_redirections
+          missing << "#{timeout} (part of coreutils) or netcat must be installed" unless inspec.command(timeout).exist?
+        else
+          missing << 'netcat must be installed'
+        end
+      end
+
+      missing
+    end
+
+    def ping(hostname, port, protocol)
+      if %w{tcp udp}.include?(protocol)
+        if @has_nc || @has_ncat
+          resp = inspec.command(netcat_check_command(hostname, port, protocol))
+        else
+          resp = inspec.command("#{timeout} 1 bash -c \"< /dev/#{protocol}/#{hostname}/#{port}\"")
+        end
+      else
+        # fall back to ping, but we can only test ICMP packages with ping
+        resp = inspec.command("ping -w 1 -c 1 #{hostname}")
+      end
+
+      {
+        success: resp.exit_status.to_i.zero?,
+        connection: resp.stderr,
+        socket: resp.stdout,
+      }
+    end
+
+    def netcat_check_command(hostname, port, protocol)
+      if @has_nc
+        base_cmd = 'nc'
+      elsif @has_ncat
+        base_cmd = 'ncat'
+      else
+        return
+      end
+
+      if protocol == 'udp'
+        extra_flags = '-u'
+      else
+        extra_flags = ''
+      end
+
+      "echo | #{base_cmd} -v -w 1 #{extra_flags} #{hostname} #{port}"
+    end
+
+    def timeout
+      'timeout'
+    end
+
+    def resolve_with_dig(hostname)
+      addresses = []
+
+      # look for IPv4 addresses
+      cmd = inspec.command("dig +short A #{hostname}")
+      cmd.stdout.lines.each do |line|
+        matched = line.chomp.match(Resolv::IPv4::Regex)
+        addresses << matched.to_s unless matched.nil?
+      end
+
+      # look for IPv6 addresses
+      cmd = inspec.command("dig +short AAAA #{hostname}")
+      cmd.stdout.lines.each do |line|
+        matched = line.chomp.match(Resolv::IPv6::Regex)
+        addresses << matched.to_s unless matched.nil?
+      end
+
+      addresses.empty? ? nil : addresses
+    end
+
+    def resolve_with_getent(hostname)
+      cmd = inspec.command("getent ahosts #{hostname}")
+      return nil unless cmd.exit_status.to_i.zero?
+
+      # getent ahosts output is formatted like so:
+      # $ getent ahosts www.google.com
+      # 172.217.8.4     STREAM www.google.com
+      # 172.217.8.4     DGRAM
+      # 172.217.8.4     RAW
+      # 2607:f8b0:4004:803::2004 STREAM
+      # 2607:f8b0:4004:803::2004 DGRAM
+      # 2607:f8b0:4004:803::2004 RAW
+      addresses = []
+      cmd.stdout.lines.each do |line|
+        ip, = line.split(/\s+/, 2)
+        next unless ip.match(Resolv::IPv4::Regex) || ip.match(Resolv::IPv6::Regex)
+        addresses << ip unless addresses.include?(ip)
+      end
+
+      addresses
+    end
+  end
+
+  class DarwinHostProvider < UnixHostProvider
+    def timeout
+      'gtimeout'
+    end
+
+    def resolve(hostname)
+      resolve_with_dig(hostname)
+    end
+  end
+
+  class LinuxHostProvider < UnixHostProvider
+    def resolve(hostname)
+      resolve_with_getent(hostname)
+    end
+  end
+
+  # Windows
+  # TODO: UDP is not supported yey, we need a custom ps1 script to add udp support
+  # @see http://blogs.technet.com/b/josebda/archive/2015/04/18/windows-powershell-equivalents-for-common-networking-commands-ipconfig-ping-nslookup.aspx
+  # @see http://blogs.technet.com/b/heyscriptingguy/archive/2014/03/19/creating-a-port-scanner-with-windows-powershell.aspx
+  class WindowsHostProvider < HostProvider
+    def ping(hostname, port = nil, _proto = nil)
+      # ICMP: Test-NetConnection www.microsoft.com
+      # TCP and port: Test-NetConnection -ComputerName www.microsoft.com -RemotePort 80
+      request = "Test-NetConnection -ComputerName #{hostname} -WarningAction SilentlyContinue"
+      request += " -RemotePort #{port}" unless port.nil?
+      request += '| Select-Object -Property ComputerName, TcpTestSucceeded, PingSucceeded | ConvertTo-Json'
+      cmd = inspec.command(request)
+
+      begin
+        ping = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return {}
+      end
+
+      { success: port.nil? ? ping['PingSucceeded'] : ping['TcpTestSucceeded'] }
+    end
+
+    def resolve(hostname)
+      cmd = inspec.command("Resolve-DnsName –Type A #{hostname} | ConvertTo-Json")
+      begin
+        resolv = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      resolv = [resolv] unless resolv.is_a?(Array)
+      resolv.map { |entry| entry['IPAddress'] }
+    end
+  end
+end