inspec-core 2.1.67

data/lib/resources/inetd_conf.rb

@@ -0,0 +1,54 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class InetdConf < Inspec.resource(1)
+    name 'inetd_conf'
+    supports platform: 'unix'
+    desc 'Use the inetd_conf InSpec audit resource to test if a service is enabled in the inetd.conf file on Linux and UNIX platforms. inetd---the Internet service daemon---listens on dedicated ports, and then loads the appropriate program based on a request. The inetd.conf file is typically located at /etc/inetd.conf and contains a list of Internet services associated to the ports on which that service will listen. Only enabled services may handle a request; only services that are required by the system should be enabled.'
+    example "
+      describe inetd_conf do
+        its('shell') { should eq nil }
+        its('login') { should eq nil }
+        its('exec') { should eq nil }
+      end
+    "
+
+    include FileReader
+
+    def initialize(path = nil)
+      @conf_path = path || '/etc/inetd.conf'
+      @content = read_file_content(@conf_path)
+    end
+
+    # overwrite exec to ensure it works with its
+    # TODO: this needs to be fixed in RSpec
+    def exec
+      read_params['exec']
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def read_params
+      return @params if defined?(@params)
+
+      # parse the file
+      conf = SimpleConfig.new(
+        @content,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
+        key_values: 6,
+        multiple_values: false,
+      )
+      @params = conf.params
+    end
+
+    def to_s
+      'inetd.conf'
+    end
+  end
+end

data/lib/resources/ini.rb

@@ -0,0 +1,29 @@
+# encoding: utf-8
+
+require 'utils/simpleconfig'
+
+module Inspec::Resources
+  class IniConfig < JsonConfig
+    name 'ini'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the ini InSpec audit resource to test data in a INI file.'
+    example "
+      descibe ini do
+        its('auth_protocol') { should eq 'https' }
+      end
+    "
+    # override file load and parse hash with simple config
+    def parse(content)
+      SimpleConfig.new(content).params
+    end
+
+    private
+
+    # used by JsonConfig to build up a full to_s method
+    # based on whether a file path, content, or command was supplied.
+    def resource_base_name
+      'INI'
+    end
+  end
+end

data/lib/resources/interface.rb

@@ -0,0 +1,129 @@
+# encoding: utf-8
+
+require 'utils/convert'
+
+module Inspec::Resources
+  class NetworkInterface < Inspec.resource(1)
+    name 'interface'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the interface InSpec audit resource to test basic network adapter properties, such as name, status, and link speed (in MB/sec).'
+    example "
+      describe interface('eth0') do
+        it { should exist }
+        it { should be_up }
+        its('speed') { should eq 1000 }
+      end
+    "
+    def initialize(iface)
+      @iface = iface
+
+      @interface_provider = nil
+      if inspec.os.linux?
+        @interface_provider = LinuxInterface.new(inspec)
+      elsif inspec.os.windows?
+        @interface_provider = WindowsInterface.new(inspec)
+      else
+        return skip_resource 'The `interface` resource is not supported on your OS yet.'
+      end
+    end
+
+    def exists?
+      !interface_info.nil? && !interface_info[:name].nil?
+    end
+
+    def up?
+      interface_info.nil? ? false : interface_info[:up]
+    end
+
+    # returns link speed in Mbits/sec
+    def speed
+      interface_info.nil? ? nil : interface_info[:speed]
+    end
+
+    def to_s
+      "Interface #{@iface}"
+    end
+
+    private
+
+    def interface_info
+      return @cache if defined?(@cache)
+      @cache = @interface_provider.interface_info(@iface) if !@interface_provider.nil?
+    end
+  end
+
+  class InterfaceInfo
+    include Converter
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+  end
+
+  class LinuxInterface < InterfaceInfo
+    def interface_info(iface)
+      # will return "[mtu]\n1500\n[type]\n1"
+      cmd = inspec.command("find /sys/class/net/#{iface}/ -maxdepth 1 -type f -exec sh -c 'echo \"[$(basename {})]\"; cat {} || echo -n' \\;")
+      return nil if cmd.exit_status.to_i != 0
+
+      # parse values, we only recieve values, therefore we threat them as keys
+      params = SimpleConfig.new(cmd.stdout.chomp).params
+
+      # abort if we got an empty result-set
+      return nil if params.empty?
+
+      # parse state
+      state = false
+      if params.key?('operstate')
+        operstate, _value = params['operstate'].first
+        state = operstate == 'up'
+      end
+
+      # parse speed
+      speed = nil
+      if params.key?('speed')
+        speed, _value = params['speed'].first
+        speed = convert_to_i(speed)
+      end
+
+      {
+        name: iface,
+        up: state,
+        speed: speed,
+      }
+    end
+  end
+
+  class WindowsInterface < InterfaceInfo
+    def interface_info(iface)
+      # gather all network interfaces
+      cmd = inspec.command('Get-NetAdapter | Select-Object -Property Name, InterfaceDescription, Status, State, MacAddress, LinkSpeed, ReceiveLinkSpeed, TransmitLinkSpeed, Virtual | ConvertTo-Json')
+
+      # filter network interface
+      begin
+        net_adapter = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      # ensure we have an array of groups
+      net_adapter = [net_adapter] if !net_adapter.is_a?(Array)
+
+      # select the requested interface
+      adapters = net_adapter.each_with_object([]) do |adapter, adapter_collection|
+        # map object
+        info = {
+          name: adapter['Name'],
+          up: adapter['State'] == 2,
+          speed: adapter['ReceiveLinkSpeed'] / 1000,
+        }
+        adapter_collection.push(info) if info[:name].casecmp(iface) == 0
+      end
+
+      return nil if adapters.empty?
+      warn "[Possible Error] detected multiple network interfaces with the name #{iface}" if adapters.size > 1
+      adapters[0]
+    end
+  end
+end

data/lib/resources/iptables.rb

@@ -0,0 +1,80 @@
+# encoding: utf-8
+
+# Usage:
+# describe iptables do
+#   it { should have_rule('-P INPUT ACCEPT') }
+# end
+#
+# The following serverspec sytax is not implemented:
+# describe iptables do
+#   it { should have_rule('-P INPUT ACCEPT').with_table('mangle').with_chain('INPUT') }
+# end
+# Please use the new sytax:
+# describe iptables(table:'mangle', chain: 'input') do
+#   it { should have_rule('-P INPUT ACCEPT') }
+# end
+#
+# Note: Docker containers normally do not have iptables installed
+#
+# @see http://ipset.netfilter.org/iptables.man.html
+# @see http://ipset.netfilter.org/iptables.man.html
+# @see https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
+module Inspec::Resources
+  class IpTables < Inspec.resource(1)
+    name 'iptables'
+    supports platform: 'linux'
+    desc 'Use the iptables InSpec audit resource to test rules that are defined in iptables, which maintains tables of IP packet filtering rules. There may be more than one table. Each table contains one (or more) chains (both built-in and custom). A chain is a list of rules that match packets. When the rule matches, the rule defines what target to assign to the packet.'
+    example "
+      describe iptables do
+        it { should have_rule('-P INPUT ACCEPT') }
+      end
+    "
+
+    def initialize(params = {})
+      @table = params[:table]
+      @chain = params[:chain]
+
+      # we're done if we are on linux
+      return if inspec.os.linux?
+
+      # ensures, all calls are aborted for non-supported os
+      @iptables_cache = []
+      skip_resource 'The `iptables` resource is not supported on your OS yet.'
+    end
+
+    def has_rule?(rule = nil, _table = nil, _chain = nil)
+      # checks if the rule is part of the ruleset
+      # for now, we expect an exact match
+      retrieve_rules.any? { |line| line.casecmp(rule) == 0 }
+    end
+
+    def retrieve_rules
+      return @iptables_cache if defined?(@iptables_cache)
+
+      # construct iptables command to read all rules
+      bin = find_iptables_or_error
+      table_cmd = "-t #{@table}" if @table
+      iptables_cmd = format('%s %s -S %s', bin, table_cmd, @chain).strip
+
+      cmd = inspec.command(iptables_cmd)
+      return [] if cmd.exit_status.to_i != 0
+
+      # split rules, returns array or rules
+      @iptables_cache = cmd.stdout.split("\n").map(&:strip)
+    end
+
+    def to_s
+      format('Iptables %s %s', @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
+    end
+
+    private
+
+    def find_iptables_or_error
+      %w{/usr/sbin/iptables /sbin/iptables iptables}.each do |cmd|
+        return cmd if inspec.command(cmd).exist?
+      end
+
+      raise Inspec::Exceptions::ResourceFailed, 'Could not find `iptables`'
+    end
+  end
+end

data/lib/resources/json.rb

@@ -0,0 +1,111 @@
+# encoding: utf-8
+
+require 'utils/object_traversal'
+require 'utils/enumerable_delegation'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class JsonConfig < Inspec.resource(1)
+    name 'json'
+    desc 'Use the json InSpec audit resource to test data in a JSON file.'
+    example "
+      describe json('policyfile.lock.json') do
+        its(['cookbook_locks','omnibus','version']) { should eq('2.2.0') }
+      end
+
+      describe json({ command: 'retrieve_data.py --json' }) do
+        its('state') { should eq('open') }
+      end
+
+      describe json({ content: '{\"item1\": { \"status\": \"available\" } }' }) do
+        its(['item1', 'status']) { should cmp 'available' }
+      end
+
+    "
+
+    include ObjectTraverser
+    include FileReader
+
+    # make params readable
+    attr_reader :params, :raw_content
+
+    def initialize(opts)
+      # pre-initialize @params to an empty hash. In the event that reading/parsing the data
+      # throws an exception, this allows the resource to still be called outside of a
+      # describe/test and not throw errors when a caller attempts to fetch a value from the params.
+      @params = {}
+
+      # load the raw content from the source, and then parse it
+      @raw_content = load_raw_content(opts)
+      @params = parse(@raw_content)
+
+      # If the JSON content is enumerable, make this object enumerable too
+      extend EnumerableDelegation if @params.respond_to?(:each)
+    end
+
+    # Shorthand to retrieve a parameter name via `#its`.
+    # Example: describe json('file') { its('paramX') { should eq 'Y' } }
+    #
+    # @param [String] name name of the field to retrieve
+    # @return [Object] the value stored at this position
+    def method_missing(*keys)
+      # catch bahavior of rspec its implementation
+      # @see https://github.com/rspec/rspec-its/blob/master/lib/rspec/its.rb#L110
+      keys.shift if keys.is_a?(Array) && keys[0] == :[]
+      value(keys)
+    end
+
+    def value(key)
+      # uses ObjectTraverser.extract_value to walk the hash looking for the key,
+      # which may be an Array of keys for a nested Hash.
+      extract_value(key, params)
+    end
+
+    def to_s
+      "#{resource_base_name} #{@resource_name_supplement || 'content'}"
+    end
+
+    private
+
+    def parse(content)
+      require 'json'
+      JSON.parse(content)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse JSON: #{e.message}"
+    end
+
+    def load_raw_content(opts)
+      # if the opts isn't a hash, we assume it's a path to a file
+      unless opts.is_a?(Hash)
+        @resource_name_supplement = opts
+        return load_raw_from_file(opts)
+      end
+
+      if opts.key?(:command)
+        @resource_name_supplement = "from command: #{opts[:command]}"
+        load_raw_from_command(opts[:command])
+      elsif opts.key?(:content)
+        opts[:content]
+      else
+        raise Inspec::Exceptions::ResourceFailed, 'No JSON content; must specify a file, command, or raw JSON content'
+      end
+    end
+
+    def load_raw_from_file(path)
+      read_file_content(path)
+    end
+
+    def load_raw_from_command(command)
+      command_output = inspec.command(command).stdout
+      raise Inspec::Exceptions::ResourceSkipped, "No output from command: #{command}" if command_output.nil? || command_output.empty?
+
+      command_output
+    end
+
+    # for resources the subclass JsonConfig, this allows specification of the resource
+    # base name in each subclass so we can build a good to_s method
+    def resource_base_name
+      'JSON'
+    end
+  end
+end

data/lib/resources/kernel_module.rb

@@ -0,0 +1,107 @@
+# encoding: utf-8
+
+module Inspec::Resources
+  class KernelModule < Inspec.resource(1)
+    name 'kernel_module'
+    supports platform: 'unix'
+    desc 'Use the kernel_module InSpec audit resource to test kernel modules on
+    Linux platforms. These parameters are located under /lib/modules. Any submodule
+    may be tested using this resource.
+
+    The `kernel_module` resource can also verify if a kernel module is `blacklisted`
+    or if a module is disabled via a fake install using the `bin_true` or `bin_false`
+    method.'
+
+    example "
+
+    describe kernel_module('video') do
+      it { should be_loaded }
+      it { should_not be_disabled }
+      it { should_not be_blacklisted }
+    end
+
+    describe kernel_module('sstfb') do
+      it { should_not be_loaded }
+      it { should be_disabled }
+    end
+
+    describe kernel_module('floppy') do
+      it { should be_blacklisted }
+    end
+
+    describe kernel_module('dhcp') do
+      it { should_not be_loaded }
+    end
+    "
+
+    def initialize(modulename = nil)
+      @module = modulename
+      # this resource is only supported on Linux
+      return skip_resource 'The `kernel_parameter` resource is not supported on your OS.' if !inspec.os.linux?
+    end
+
+    def loaded?
+      if inspec.os.redhat? || inspec.os.name == 'fedora'
+        lsmod_cmd = '/sbin/lsmod'
+      else
+        lsmod_cmd = 'lsmod'
+      end
+
+      # get list of all modules
+      cmd = inspec.command(lsmod_cmd)
+      return false if cmd.exit_status != 0
+
+      # check if module is loaded
+      re = Regexp.new('^'+Regexp.quote(@module)+'\s')
+      found = cmd.stdout.match(re)
+      !found.nil?
+    end
+
+    def disabled?
+      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/(true|false)}).nil?
+    end
+
+    def blacklisted?
+      !modprobe_output.match(/^blacklist\s+#{@module}/).nil? || disabled_via_bin_true? || disabled_via_bin_false?
+    end
+
+    def version
+      cmd = inspec.command("#{modinfo_cmd_for_os} -F version #{@module}")
+      cmd.exit_status.zero? ? cmd.stdout.delete("\n") : nil
+    end
+
+    def to_s
+      "Kernel Module #{@module}"
+    end
+
+    private
+
+    def modprobe_output
+      @modprobe_output ||= inspec.command("#{modprobe_cmd_for_os} --showconfig").stdout
+    end
+
+    def modinfo_cmd_for_os
+      if inspec.os.redhat? || inspec.os.name == 'fedora'
+        '/sbin/modinfo'
+      else
+        'modinfo'
+      end
+    end
+
+    def modprobe_cmd_for_os
+      if inspec.os.redhat? || inspec.os.name == 'fedora'
+        '/sbin/modprobe'
+      else
+        'modprobe'
+      end
+    end
+
+    def disabled_via_bin_true?
+      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/true}).nil?
+    end
+
+    def disabled_via_bin_false?
+      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/false}).nil?
+    end
+  end
+end