inspec-core 2.1.67

data/lib/resources/wmi.rb

@@ -0,0 +1,110 @@
+# encoding: utf-8
+
+require 'utils/object_traversal'
+
+module Inspec::Resources
+  # This resource simplifies the access to wmi
+  # on CLI you would use:
+  # WMIC /NAMESPACE:\\root\rsop\computer PATH RSOP_SecuritySettingNumeric WHERE "KeyName = 'MinimumPasswordAge' And precedence=1" GET Setting
+  # We use Get-WmiObject via Powershell to retrieve all values.
+  class WMI < Inspec.resource(1)
+    name 'wmi'
+    supports platform: 'windows'
+    desc 'request wmi information'
+    example "
+      describe wmi({
+        class: 'RSOP_SecuritySettingNumeric',
+        namespace: 'root\\rsop\\computer',
+        filter: 'KeyName = \'MinimumPasswordAge\' And precedence=1'
+      }) do
+         its('Setting') { should eq true }
+      end
+    "
+
+    include ObjectTraverser
+    attr_accessor :content
+
+    def initialize(wmiclass = nil, opts = nil)
+      @options = opts || {}
+      # if wmiclass is not a hash, we have to handle deprecation behavior
+      if wmiclass.is_a?(Hash)
+        @options.merge!(wmiclass)
+      else
+        warn '[DEPRECATION] `wmi(\'wmiclass\')` is deprecated.  Please use `wmi({class: \'wmiclass\'})` instead.'
+        @options[:class] = wmiclass
+      end
+    end
+
+    # returns nil, if not existant or value
+    def method_missing(*keys)
+      # catch behavior of rspec its implementation
+      # @see https://github.com/rspec/rspec-its/blob/master/lib/rspec/its.rb#L110
+      keys.shift if keys.is_a?(Array) && keys[0] == :[]
+
+      # map all symbols to strings
+      keys = keys.map { |x| x.to_s.downcase } if keys.is_a?(Array)
+
+      value(keys)
+    end
+
+    def value(key)
+      extract_value(key, params)
+    end
+
+    def params
+      return @content if defined?(@content)
+      @content = {}
+
+      # abort if no options are available
+      return @content unless defined?(@options)
+
+      # filter for supported options
+      args = @options.select { |key, _value| [:class, :namespace, :query, :filter].include?(key) }
+
+      # convert to Get-WmiObject arguments
+      params = ''
+      args.each { |key, value| params += " -#{key} \"#{value.gsub('"', '`"')}\"" }
+
+      # run wmi command and filter empty wmi
+      script = <<-EOH
+      Filter Aggregate
+      {
+          $arr = @{}
+          $_.properties | % {
+              $arr.Add($_.name, $_.value)
+          }
+          $arr
+      }
+      Get-WmiObject #{params} | Aggregate | ConvertTo-Json
+      EOH
+
+      # run wmi command
+      cmd = inspec.powershell(script)
+      @content = JSON.parse(cmd.stdout)
+
+      # make all keys case-insensitive
+      @content = lowercase_keys(@content)
+    rescue JSON::ParserError => _e
+      @content
+    end
+
+    def to_s
+      "WMI with #{@options}"
+    end
+
+    private
+
+    def lowercase_keys(content)
+      if content.is_a?(Hash)
+        content.keys.each do |key|
+          new_key = key.to_s.downcase
+          content[new_key] = content.delete(key)
+          lowercase_keys(content[new_key])
+        end
+      elsif content.respond_to?(:each)
+        content.each { |item| lowercase_keys(item) }
+      end
+      content
+    end
+  end
+end

data/lib/resources/x509_certificate.rb

@@ -0,0 +1,137 @@
+# encoding: utf-8
+
+require 'openssl'
+require 'hashie/mash'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class X509CertificateResource < Inspec.resource(1)
+    name 'x509_certificate'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Used to test x.509 certificates'
+    example "
+      describe x509_certificate('/etc/pki/www.mywebsite.com.pem') do
+        its('subject') { should match /CN=My Website/ }
+        its('validity_in_days') { should be > 30 }
+      end
+
+      describe x509_certificate('trials/x509/cert.pem') do
+        it { should be_certificate }
+        it { should be_valid }
+        its('fingerprint') { should eq '62b137bdf427e7273dc2e487877b3033e4c8ce17' }
+        its('signature_algorithm') { should eq 'sha1WithRSAEncryption' }
+        its('validity_in_days') { should_not be < 100 }
+        its('validity_in_days') { should be >= 100 }
+        its('subject_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
+        its('subject.C') { should eq 'DE' }
+        its('subject.emailAddress') { should_not be_empty }
+        its('subject.emailAddress') { should eq 'support@chef.io' }
+        its('issuer_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
+        its('key_length') { should be >= 2048 }
+        its('extensions.subjectKeyIdentifier') { should cmp 'A5:16:0B:12:F4:48:0F:06:6C:32:29:67:98:12:DF:3D:0D:75:9D:5C' }
+      end
+    "
+
+    include FileReader
+
+    # @see https://tools.ietf.org/html/rfc5280#page-23
+    def initialize(filename)
+      @certpath = filename
+      @issuer = nil
+      @parsed_subject = nil
+      @parsed_issuer = nil
+      @extensions = nil
+      @cert = OpenSSL::X509::Certificate.new read_file_content(@certpath)
+    end
+
+    # Forward these methods directly to OpenSSL::X509::Certificate instance
+    %w{version not_before not_after signature_algorithm public_key}.each do |m|
+      define_method m.to_sym do |*args|
+        @cert.method(m.to_sym).call(*args)
+      end
+    end
+
+    def certificate?
+      !@cert.nil?
+    end
+
+    def fingerprint
+      return if @cert.nil?
+      OpenSSL::Digest::SHA1.new(@cert.to_der).to_s
+    end
+
+    def serial
+      return if @cert.nil?
+      @cert.serial.to_i
+    end
+
+    def subject_dn
+      return if @cert.nil?
+      @cert.subject.to_s
+    end
+
+    def subject
+      return if @cert.nil?
+      # Return cached subject if we have already parsed it
+      return @parsed_subject if @parsed_subject
+      # Use a Mash to make it easier to access hash elements in "its('subject') {should ...}"
+      @parsed_subject = Hashie::Mash.new(Hash[@cert.subject.to_a.map { |k, v, _| [k, v] }])
+    end
+
+    def issuer_dn
+      return if @cert.nil?
+      @cert.issuer.to_s
+    end
+
+    def issuer
+      return if @cert.nil?
+      # Return cached subject if we have already parsed it
+      return @parsed_issuer if @parsed_issuer
+      # Use a Mash to make it easier to access hash elements in "its('issuer') {should ...}"
+      @parsed_issuer = Hashie::Mash.new(Hash[@cert.issuer.to_a.map { |k, v, _| [k, v] }])
+    end
+
+    def key_length
+      return if @cert.nil?
+      @cert.public_key.n.num_bytes * 8
+    end
+
+    def validity_in_days
+      (not_after - Time.now.utc) / 86400
+    end
+
+    def valid?
+      now = Time.now
+      certificate? && (now >= not_before && now <= not_after)
+    end
+
+    def extensions
+      # Return cached Mash if we already parsed the certificate extensions
+      return @extensions if @extensions
+      # Return the exception class if we failed to instantiate a Cert from file
+      return @cert unless @cert.respond_to? :extensions
+      # Use a Mash to make it easier to access hash elements in "its('entensions') {should ...}"
+      @extensions = Hashie::Mash.new({})
+      # Make sure standard extensions exist so we don't get nil for nil:NilClass
+      # when the user tests for extensions which aren't present
+      %w{
+        keyUsage extendedKeyUsage basicConstraints subjectKeyIdentifier
+        authorityKeyIdentifier subjectAltName issuerAltName authorityInfoAccess
+        crlDistributionPoints issuingDistributionPoint certificatePolicies
+        policyConstraints nameConstraints noCheck tlsfeature nsComment
+      }.each { |extension| @extensions[extension] ||= [] }
+      # Now parse the extensions into the Mash
+      extension_array = @cert.extensions.map(&:to_s)
+      extension_array.each do |extension|
+        kv = extension.split(/ *= */, 2)
+        @extensions[kv.first] = kv.last.split(/ *, */)
+      end
+      @extensions
+    end
+
+    def to_s
+      "x509_certificate #{@certpath}"
+    end
+  end
+end

data/lib/resources/xinetd.rb

@@ -0,0 +1,106 @@
+# encoding: utf-8
+
+require 'utils/parser'
+require 'utils/filter'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class XinetdConf < Inspec.resource(1)
+    name 'xinetd_conf'
+    supports platform: 'unix'
+    desc 'Xinetd services configuration.'
+    example "
+      describe xinetd_conf.services('chargen') do
+        its('socket_types') { should include 'dgram' }
+      end
+
+      describe xinetd_conf.services('chargen').socket_types('dgram') do
+        it { should be_disabled }
+      end
+    "
+
+    include XinetdParser
+    include FileReader
+
+    def initialize(conf_path = '/etc/xinetd.conf')
+      @conf_path = conf_path
+      @contents = {}
+      read_content(@conf_path)
+    end
+
+    def to_s
+      "Xinetd config #{@conf_path}#{@filters}"
+    end
+
+    def params
+      @params ||= read_params
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:services,     field: 'service')
+          .add(:ids,          field: 'id')
+          .add(:socket_types, field: 'socket_type')
+          .add(:types,        field: 'type')
+          .add(:protocols,    field: 'protocol')
+          .add(:wait,         field: 'wait')
+          .add(:disabled?) { |x| x.where('disable' => 'no').services.empty? }
+          .add(:enabled?) { |x| x.where('disable' => 'yes').services.empty? }
+          .connect(self, :service_lines)
+
+    private
+
+    def read_content(path = @conf_path)
+      return @contents[path] if @contents.key?(path)
+
+      @contents[path] = read_file_content(path)
+    end
+
+    def read_params
+      return {} if read_content.nil?
+      flat_params = parse_xinetd(read_content)
+      # we need to map service data in order to use it with filtertable
+      params = { 'services' => {} }
+      # map services that were defined and map it to the service hash
+      flat_params.each do |k, v|
+        name = k[/^service (.+)$/, 1]
+        # its not a service, no change required
+        if name.nil?
+          params[k] = v
+        # handle service entries
+        else
+          # store service
+          params['services'][name] = v
+
+          # add the service identifier to its parameters
+          if v.is_a?(Array)
+            v.each { |service| service.params['service'] = name }
+          else
+            v.params['service'] = name
+          end
+        end
+      end
+      params
+    end
+
+    # Method used to derive the default protocol used from the socket_type
+    def default_protocol(type)
+      case type
+      when 'stream'
+        'tcp'
+      when 'dgram'
+        'udp'
+      else
+        'unknown'
+      end
+    end
+
+    def service_lines
+      @services ||= params['services'].values.flatten.map { |service|
+        service.params['protocol'] ||= default_protocol(service.params['socket_type'])
+        service.params
+      }
+    end
+  end
+end

data/lib/resources/xml.rb

@@ -0,0 +1,46 @@
+# encoding: utf-8
+
+module Inspec::Resources
+  class XmlConfig < JsonConfig
+    name 'xml'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the xml InSpec resource to test configuration data in an XML file'
+    example "
+      describe xml('default.xml') do
+        its('key/sub_key') { should eq(['value']) }
+        its(['root/name.with.a.period']) { should cmp 'so_many_dots' }
+      end
+    "
+
+    def parse(content)
+      require 'rexml/document'
+      REXML::Document.new(content)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse XML: #{e.message}"
+    end
+
+    def value(key)
+      output = []
+      REXML::XPath.each(@params, key.first.to_s) do |element|
+        if element.is_a?(REXML::Attribute)
+          output.push(element.to_s)
+        elsif element.is_a?(REXML::Element)
+          output.push(element.text)
+        else
+          raise Inspec::Exceptions::ResourceFailed, "Unknown XML object received (#{element.class}): #{element}"
+        end
+      end
+
+      output
+    end
+
+    private
+
+    # used by JsonConfig to build up a full to_s method
+    # based on whether a file path, content, or command was supplied.
+    def resource_base_name
+      'XML'
+    end
+  end
+end

data/lib/resources/yaml.rb

@@ -0,0 +1,43 @@
+# encoding: utf-8
+
+require 'yaml'
+
+# Parses a yaml document
+# Usage:
+# describe yaml('.kitchen.yaml') do
+#   its('driver.name') { should eq('vagrant') }
+# end
+module Inspec::Resources
+  class YamlConfig < JsonConfig
+    name 'yaml'
+    desc 'Use the yaml InSpec audit resource to test configuration data in a YAML file.'
+    example "
+      describe yaml('config.yaml') do
+        its(['driver', 'name']) { should eq 'vagrant' }
+      end
+
+      describe yaml({ command: 'retrieve_data.py --yaml' }) do
+        its('state') { should eq 'open' }
+      end
+
+      describe yaml({ content: \"key1: value1\nkey2: value2\" }) do
+        its('key2') { should cmp 'value2' }
+      end
+    "
+
+    # override file load and parse hash from yaml
+    def parse(content)
+      YAML.load(content)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse YAML: #{e.message}"
+    end
+
+    private
+
+    # used by JsonConfig to build up a full to_s method
+    # based on whether a file path, content, or command was supplied.
+    def resource_base_name
+      'YAML'
+    end
+  end
+end

data/lib/resources/yum.rb

@@ -0,0 +1,180 @@
+# encoding: utf-8
+
+# Usage:
+# describe yum do
+#   its('repos') { should exist }
+# end
+#
+# describe yum do
+#   its('repos') { should include 'base/7/x86_64' }
+#   its('epel') { should exist }
+#   its('epel') { should be_enabled }
+# end
+#
+# Filter for a specific repo by name
+# - use full identifier e.g. 'updates/7/x86_64'
+# - use short identifier e.g. 'updates'
+#
+# describe yum.repo('epel') do
+#   it { should exist }
+#   it { should be_enabled }
+#   its('baseurl') { should include 'mycompany.biz' }
+# end
+#
+# deprecated:
+# describe yumrepo('epel') do
+#   it { should exist }
+#   it { should be_enabled }
+# end
+
+module Inspec::Resources
+  class Yum < Inspec.resource(1)
+    name 'yum'
+    supports platform: 'unix'
+    desc 'Use the yum InSpec audit resource to test the configuration of Yum repositories.'
+    example "
+      describe yum.repo('name') do
+        it { should exist }
+        it { should be_enabled }
+      end
+    "
+
+    # returns all repositories
+    # works as following:
+    # search for Repo-id
+    #   parse data in hashmap
+    #   store data in object
+    # until \n
+    def repositories
+      return @cache if defined?(@cache)
+      # parse the repository data from yum
+      # we cannot use -C, because this is not reliable and may lead to errors
+      @command_result = inspec.command('yum -v repolist all')
+      @content = @command_result.stdout
+      @cache = []
+      repo = {}
+      in_repo = false
+      @content.each_line do |line|
+        # detect repo start
+        in_repo = true if line =~ /^\s*Repo-id\s*:\s*(.*)\b/
+        # detect repo end
+        if line == "\n" && in_repo
+          in_repo = false
+          @cache.push(repo)
+          repo = {}
+        end
+        # parse repo content
+        if in_repo == true
+          val = /^\s*([^:]*?)\s*:\s*(.*?)\s*$/.match(line)
+          repo[repo_key(strip(val[1]))] = strip(val[2])
+        end
+      end
+      @cache
+    end
+
+    def repos
+      repositories.map { |repo| repo['id'] }
+    end
+
+    def repo(repo)
+      YumRepo.new(self, repo)
+    end
+
+    # alias for yum.repo('reponame')
+    def method_missing(name)
+      repo(name.to_s) if !name.nil?
+    end
+
+    def to_s
+      'Yum Repository'
+    end
+
+    private
+
+    # Removes lefthand and righthand whitespace
+    def strip(value)
+      value&.strip
+    end
+
+    # Optimize the key value
+    def repo_key(key)
+      return key if key.nil?
+      key.gsub('Repo-', '').downcase
+    end
+  end
+
+  class YumRepo
+    def initialize(yum, reponame)
+      @yum = yum
+      @reponame = reponame
+    end
+
+    # extracts the shortname from a repo id
+    # e.g. extras/7/x86_64 -> extras
+    def shortname(id)
+      val = %r{^\s*([^/]*?)/(.*?)\s*$}.match(id)
+      val.nil? ? nil : val[1]
+    end
+
+    def info
+      return @cache if defined?(@cache)
+      selection = @yum.repositories.select { |e| e['id'] == @reponame || shortname(e['id']) == @reponame }
+      @cache = selection.empty? ? {} : selection.first
+      @cache
+    end
+
+    def exist?
+      !info.empty?
+    end
+
+    def enabled?
+      return false unless exist?
+      info['status'] == 'enabled'
+    end
+
+    # provide a method for each of the repo metadata items we know about
+    [
+      :baseurl,
+      :expire,
+      :filename,
+      :mirrors,
+      :pkgs,
+      :size,
+      :status,
+      :updated,
+    ].each do |key|
+      define_method key do
+        info[key.to_s]
+      end
+    end
+
+    def to_s
+      "YumRepo #{@reponame}"
+    end
+  end
+
+  # for compatability with serverspec
+  # this is deprecated syntax and will be removed in future versions
+  class YumRepoLegacy < Yum
+    name 'yumrepo'
+
+    def initialize(name)
+      super()
+      @repository = repo(name)
+    end
+
+    def exists?
+      deprecated
+      @repository.exist?
+    end
+
+    def enabled?
+      deprecated
+      @repository.enabled?
+    end
+
+    def deprecated
+      warn '[DEPRECATION] `yumrepo(reponame)` is deprecated.  Please use `yum.repo(reponame)` instead.'
+    end
+  end
+end