inspec-core 2.1.67

data/lib/resources/http.rb

@@ -0,0 +1,253 @@
+# encoding: utf-8
+# copyright: 2017, Criteo
+# copyright: 2017, Chef Software Inc
+# license: Apache v2
+
+require 'faraday'
+require 'hashie'
+
+module Inspec::Resources
+  class Http < Inspec.resource(1)
+    name 'http'
+    supports platform: 'unix'
+    desc 'Use the http InSpec audit resource to test http call.'
+    example "
+      describe http('http://localhost:8080/ping', auth: {user: 'user', pass: 'test'}, params: {format: 'html'}) do
+        its('status') { should cmp 200 }
+        its('body') { should cmp 'pong' }
+        its('headers.Content-Type') { should cmp 'text/html' }
+      end
+
+      describe http('http://example.com/ping').headers do
+        its('Content-Length') { should cmp 258 }
+        its('Content-Type') { should cmp 'text/html; charset=UTF-8' }
+      end
+    "
+
+    def initialize(url, opts = {})
+      @url = url
+      @opts = opts
+
+      # Prior to InSpec 2.0 the HTTP test had to be instructed to run on the
+      # remote target machine. This warning will be removed after a few months
+      # to give users an opportunity to remove the unused option from their
+      # profiles.
+      if opts.key?(:enable_remote_worker) && !inspec.local_transport?
+        warn 'Ignoring `enable_remote_worker` option, the `http` resource ',
+             'remote worker is enabled by default for remote targets and ',
+             'cannot be disabled'
+      end
+
+      # Run locally if InSpec is ran locally and remotely if ran remotely
+      if inspec.local_transport?
+        @worker = Worker::Local.new(http_method, url, opts)
+      else
+        @worker = Worker::Remote.new(inspec, http_method, url, opts)
+      end
+    end
+
+    def status
+      @worker.status
+    end
+
+    def headers
+      @headers ||= Inspec::Resources::Http::Headers.create(@worker.response_headers)
+    end
+
+    def body
+      @worker.body
+    end
+
+    def http_method
+      @opts.fetch(:method, 'GET')
+    end
+
+    def to_s
+      "http #{http_method} on #{@url}"
+    end
+
+    class Worker
+      class Base
+        attr_reader :http_method, :opts, :url
+
+        def initialize(http_method, url, opts)
+          @http_method = http_method
+          @url = url
+          @opts = opts
+          @response = nil
+        end
+
+        private
+
+        def params
+          opts.fetch(:params, nil)
+        end
+
+        def username
+          opts.fetch(:auth, {})[:user]
+        end
+
+        def password
+          opts.fetch(:auth, {})[:pass]
+        end
+
+        def request_headers
+          opts.fetch(:headers, {})
+        end
+
+        def request_body
+          opts[:data]
+        end
+
+        def open_timeout
+          opts.fetch(:open_timeout, 60)
+        end
+
+        def read_timeout
+          opts.fetch(:read_timeout, 60)
+        end
+
+        def ssl_verify?
+          opts.fetch(:ssl_verify, true)
+        end
+      end
+
+      class Local < Base
+        def status
+          response.status
+        end
+
+        def body
+          response.body
+        end
+
+        def response_headers
+          response.headers.to_h
+        end
+
+        private
+
+        def response
+          return @response if @response
+          conn = Faraday.new url: url, headers: request_headers, params: params, ssl: { verify: ssl_verify? }
+
+          # set basic authentication
+          conn.basic_auth username, password unless username.nil? || password.nil?
+
+          # set default timeout
+          conn.options.timeout      = read_timeout  # open/read timeout in seconds
+          conn.options.open_timeout = open_timeout  # connection open timeout in seconds
+
+          @response = conn.run_request(http_method.downcase.to_sym, nil, nil, nil) do |req|
+            req.body = request_body
+          end
+        end
+      end
+
+      class Remote < Base
+        attr_reader :inspec
+
+        def initialize(inspec, http_method, url, opts)
+          unless inspec.command('curl').exist?
+            raise Inspec::Exceptions::ResourceSkipped,
+                  'curl is not available on the target machine'
+          end
+
+          @ran_curl = false
+          @inspec = inspec
+          super(http_method, url, opts)
+        end
+
+        def status
+          run_curl
+          @status
+        end
+
+        def body
+          run_curl
+          @body&.strip
+        end
+
+        def response_headers
+          run_curl
+          @response_headers
+        end
+
+        private
+
+        def run_curl
+          return if @ran_curl
+
+          cmd_result = inspec.command(curl_command)
+          response = cmd_result.stdout
+          @ran_curl = true
+          return if response.nil? || cmd_result.exit_status != 0
+
+          # strip any carriage returns to normalize output
+          response.delete!("\r")
+
+          # split the prelude (status line and headers) and the body
+          prelude, @body = response.split("\n\n", 2)
+          prelude = prelude.lines
+
+          # grab the status off of the first line of the prelude
+          status_line = prelude.shift
+          @status = status_line.split(' ', 3)[1].to_i
+
+          # parse the rest of the prelude which will be all the HTTP headers
+          @response_headers = {}
+          prelude.each do |line|
+            line.strip!
+            key, value = line.split(':', 2)
+            @response_headers[key] = value.strip
+          end
+        end
+
+        def curl_command # rubocop:disable Metrics/AbcSize
+          cmd = ['curl -i']
+
+          # Use curl's --head option when the method requested is HEAD. Otherwise,
+          # the user may experience a timeout when curl does not properly close
+          # the connection after the response is received.
+          if http_method.casecmp('HEAD') == 0
+            cmd << '--head'
+          else
+            cmd << "-X #{http_method}"
+          end
+
+          cmd << "--connect-timeout #{open_timeout}"
+          cmd << "--max-time #{open_timeout+read_timeout}"
+          cmd << "--user \'#{username}:#{password}\'" unless username.nil? || password.nil?
+          cmd << '--insecure' unless ssl_verify?
+          cmd << "--data #{Shellwords.shellescape(request_body)}" unless request_body.nil?
+
+          request_headers.each do |k, v|
+            cmd << "-H '#{k}: #{v}'"
+          end
+
+          if params.nil?
+            cmd << "'#{url}'"
+          else
+            cmd << "'#{url}?#{params.map { |e| e.join('=') }.join('&')}'"
+          end
+
+          cmd.join(' ')
+        end
+      end
+    end
+
+    class Headers < Hash
+      def self.create(header_data)
+        header_data.each_with_object(new) { |(k, v), memo| memo[k.to_s.downcase] = v }
+      end
+
+      def [](requested_key)
+        fetch(requested_key.downcase, nil)
+      end
+
+      def method_missing(requested_key)
+        fetch(requested_key.to_s.downcase, nil)
+      end
+    end
+  end
+end

data/lib/resources/iis_app.rb

@@ -0,0 +1,101 @@
+# encoding: utf-8
+# frozen_string_literal: true
+# check for web applications in IIS
+# Note: this is only supported in windows 2012 and later
+module Inspec::Resources
+  class IisApp < Inspec.resource(1)
+    name 'iis_app'
+    supports platform: 'windows'
+    desc 'Tests IIS application configuration on windows. Supported in server 2012+ only'
+    example "
+      describe iis_app('/myapp', 'Default Web Site') do
+        it { should exist }
+        it { should have_application_pool('MyAppPool') }
+        it { should have_protocols('http') }
+        it { should have_site_name('Default Web Site') }
+        it { should have_physical_path('C:\\inetpub\\wwwroot\\myapp') }
+        it { should have_path('\\My Application') }
+      end
+    "
+
+    def initialize(path, site_name)
+      @path = path
+      @site_name = site_name
+      @cache = nil
+      @inspec = inspec
+    end
+
+    def application_pool
+      iis_app[:application_pool]
+    end
+
+    def protocols
+      iis_app[:protocols]
+    end
+
+    def site_name
+      iis_app[:site_name]
+    end
+
+    def path
+      iis_app[:path]
+    end
+
+    def physical_path
+      iis_app[:physical_path]
+    end
+
+    def exists?
+      !iis_app[:path].empty?
+    end
+
+    def has_site_name?(site_name)
+      iis_app[:site_name] == site_name
+    end
+
+    def has_application_pool?(application_pool)
+      iis_app[:application_pool] == application_pool
+    end
+
+    def has_path?(path)
+      iis_app[:path] == path
+    end
+
+    def has_physical_path?(physical_path)
+      iis_app[:physical_path] == physical_path
+    end
+
+    def has_protocol?(protocol)
+      iis_app[:protocols].include?(protocol)
+    end
+
+    def to_s
+      "iis_app '#{@site_name}#{@path}'"
+    end
+
+    private
+
+    def iis_app
+      return @cache unless @cache.nil?
+      command = "Import-Module WebAdministration; Get-WebApplication -Name '#{@path}' -Site '#{@site_name}' | Select-Object * | ConvertTo-Json"
+      cmd = @inspec.command(command)
+
+      begin
+        app = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return {}
+      end
+
+      # map our values to a hash table
+      info = {
+        site_name: @site_name,
+        path: @path,
+        application_pool: app['applicationPool'],
+        physical_path: app['PhysicalPath'],
+        protocols: app['enabledProtocols'],
+      }
+
+      @cache = info unless info.nil?
+    end
+  end
+end

data/lib/resources/iis_site.rb

@@ -0,0 +1,148 @@
+# encoding: utf-8
+# frozen_string_literal: true
+# check for site in IIS
+# Usage:
+# describe iis_site('Default Web Site') do
+#   it{ should exist }
+#   it{ should be_running }
+#   it{ should be_in_app_pool('Default App Pool') }
+#   it{ should have_path('C:\\inetpub\wwwroot\\DefaultWebSite') }
+#   it{ should have_binding('https :443:www.contoso.com sslFlags=0') }
+#   it{ should have_binding('net.pipe *') }
+# end
+#
+# Note: this is only supported in windows 2012 and later
+
+module Inspec::Resources
+  class IisSite < Inspec.resource(1)
+    name 'iis_site'
+    supports platform: 'windows'
+    desc 'Tests IIS site configuration on windows. Supported in server 2012+ only'
+    example "
+      describe iis_site('Default Web Site') do
+        it { should exist }
+        it { should be_running }
+        it { should have_app_pool('DefaultAppPool') }
+        it { should have_binding('https :443:www.contoso.com sslFlags=0') }
+        it { should have_binding('net.pipe *') }
+        it { should have_path('C:\\inetpub\\wwwroot') }
+      end
+    "
+
+    def initialize(site_name)
+      @site_name = site_name
+      @cache = nil
+
+      @site_provider = SiteProvider.new(inspec)
+
+      # verify that this resource is only supported on Windows
+      return skip_resource 'The `iis_site` resource is not supported on your OS.' if inspec.os[:family] != 'windows'
+    end
+
+    def app_pool
+      iis_site[:app_pool]
+    end
+
+    def bindings
+      iis_site[:bindings]
+    end
+
+    def state
+      iis_site[:state]
+    end
+
+    def path
+      iis_site[:path]
+    end
+
+    def exists?
+      !iis_site.nil? && !iis_site[:name].nil?
+    end
+
+    def running?
+      iis_site.nil? ? false : (iis_site[:state] == 'Started')
+    end
+
+    def has_app_pool?(app_pool)
+      iis_site.nil? ? false : iis_site[:app_pool] == app_pool
+    end
+
+    def has_path?(path)
+      iis_site.nil? ? false : iis_site[:path] == path
+    end
+
+    def has_binding?(binding)
+      iis_site.nil? ? false : (iis_site[:bindings].include? binding)
+    end
+
+    def to_s
+      "iis_site '#{@site_name}'"
+    end
+
+    def iis_site
+      return @cache if !@cache.nil?
+      @cache = @site_provider.iis_site(@site_name) if !@site_provider.nil?
+    end
+  end
+
+  class SiteProvider
+    attr_reader :inspec
+
+    def initialize(inspec)
+      @inspec = inspec
+    end
+
+    # want to populate everything using one powershell command here and spit it out as json
+    def iis_site(name)
+      command = "Get-Website '#{name}' | select-object -Property Name,State,PhysicalPath,bindings,ApplicationPool | ConvertTo-Json"
+      cmd = @inspec.command(command)
+
+      begin
+        site = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      bindings_array = site['bindings']['Collection'].map { |k, _str|
+        k['protocol'] <<
+          ' ' <<
+          k['bindingInformation'] <<
+          (k['protocol'] == 'https' ? ' sslFlags=' << flags : '')
+      }
+
+      # map our values to a hash table
+      info = {
+        name: site['name'],
+        state: site['state'],
+        path: site['physicalPath'],
+        bindings: bindings_array,
+        app_pool: site['applicationPool'],
+      }
+
+      info
+    end
+  end
+
+  # for compatability with serverspec
+  # this is deprecated syntax and will be removed in future versions
+  class IisSiteServerSpec < IisSite
+    name 'iis_website'
+    desc 'Tests IIS site configuration on windows. Deprecated, use `iis_site` instead.'
+    example "
+      describe iis_website('Default Website') do
+        it{ should exist }
+        it{ should be_running }
+        it{ should be_in_app_pool('Default App Pool') }
+      end
+    "
+
+    def initialize(site_name)
+      super(site_name)
+      warn '[DEPRECATION] `iis_website(site_name)` is deprecated.  Please use `iis_site(site_name)` instead.'
+    end
+
+    def in_app_pool?(app_pool)
+      has_app_pool?(app_pool)
+    end
+  end
+end