inspec-core 2.1.67

data/lib/resources/zfs_dataset.rb

@@ -0,0 +1,60 @@
+# encoding: utf-8
+
+module Inspec::Resources
+  class ZfsDataset < Inspec.resource(1)
+    name 'zfs_dataset'
+    supports platform: 'unix'
+    desc "
+      Use the zfs_dataset InSpec audit resource to test if the named
+      ZFS Dataset is present and/or has certain properties.
+    "
+    example "
+      describe zfs_dataset('tank/tmp') do
+        its('exec') { should eq('off') }
+        its('setuid') { should eq('off') }
+      end
+    "
+
+    def initialize(zfs_dataset)
+      return skip_resource 'The `zfs_dataset` resource is not supported on your OS yet.' if !inspec.os.bsd?
+      @zfs_dataset = zfs_dataset
+
+      @params = gather
+    end
+
+    # method called by 'it { should exist }'
+    def exists?
+      inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}").exit_status == 0
+    end
+
+    def mounted?
+      return false if !exists?
+      inspec.mount(@params['mountpoint']).mounted?
+    end
+
+    def to_s
+      "ZFS Dataset #{@zfs_dataset}"
+    end
+
+    def gather
+      cmd = inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}")
+      return nil if cmd.exit_status.to_i != 0
+
+      # parse data
+      cmd.stdout.chomp.split("\n").each_with_object(Hash.new(0)) do |line, h|
+        t = line.split("\t")
+        h[t[1].to_s] = t[2].to_s
+      end
+    end
+
+    # override method
+    def exec
+      @params['exec']
+    end
+
+    # expose all parameters
+    def method_missing(name)
+      @params[name.to_s]
+    end
+  end
+end

data/lib/resources/zfs_pool.rb

@@ -0,0 +1,49 @@
+# encoding: utf-8
+
+module Inspec::Resources
+  class ZfsPool < Inspec.resource(1)
+    name 'zfs_pool'
+    supports platform: 'unix'
+    desc "
+      Use the zfs_pool InSpec audit resource to test if the named
+      ZFS Pool is present and/or has certain properties.
+    "
+    example "
+      describe zfs_pool('tank') do
+        its('failmode') { should eq('continue') }
+      end
+    "
+
+    def initialize(zfs_pool)
+      return skip_resource 'The `zfs_pool` resource is not supported on your OS yet.' if !inspec.os.bsd?
+      @zfs_pool = zfs_pool
+
+      @params = gather
+    end
+
+    # method called by 'it { should exist }'
+    def exists?
+      inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}").exit_status == 0
+    end
+
+    def to_s
+      "ZFS Pool #{@zfs_pool}"
+    end
+
+    def gather
+      cmd = inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}")
+      return nil if cmd.exit_status.to_i != 0
+
+      # parse data
+      cmd.stdout.chomp.split("\n").each_with_object(Hash.new(0)) do |line, h|
+        t = line.split("\t")
+        h[t[1].to_s] = t[2].to_s
+      end
+    end
+
+    # expose all parameters
+    def method_missing(name)
+      @params[name.to_s]
+    end
+  end
+end

data/lib/source_readers/flat.rb

@@ -0,0 +1,39 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'inspec/fetcher'
+require 'inspec/metadata'
+
+module SourceReaders
+  class Flat < Inspec.source_reader(1)
+    name 'flat'
+    priority 5
+
+    def self.resolve(target)
+      # TODO: eventually remove the metadata.rb exception here
+      # when we have fully phased out metadata.rb in 1.0
+      files = target.files.find_all { |x|
+        x.end_with?('.rb') && !x.include?('/') && x != 'metadata.rb'
+      }
+      return nil if files.empty?
+      new(target, files)
+    end
+
+    attr_reader :metadata, :tests, :libraries, :data_files
+
+    def initialize(target, files)
+      @target = target
+      @metadata = ::Inspec::Metadata.new(nil)
+      @tests = load_tests(files)
+      @libraries = {}
+      @data_files = {}
+    end
+
+    private
+
+    def load_tests(files)
+      Hash[files.map { |x| [x, @target.read(x)] }]
+    end
+  end
+end

data/lib/source_readers/inspec.rb

@@ -0,0 +1,75 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'inspec/fetcher'
+require 'inspec/metadata'
+
+module SourceReaders
+  class InspecReader < Inspec.source_reader(1)
+    name 'inspec'
+    priority 10
+
+    def self.resolve(target)
+      return new(target, 'inspec.yml') if target.files.include?('inspec.yml')
+      # TODO: deprecated for 1.0.0 release
+      if target.files.include?('metadata.rb') &&
+         (
+           target.files.include?('controls') ||
+           target.files.include?('test')
+         )
+        return new(target, 'metadata.rb')
+      end
+      nil
+    end
+
+    attr_reader :metadata, :tests, :libraries, :data_files
+
+    # This create a new instance of an InSpec profile source reader
+    #
+    # @param [FileProvider] target An instance of a FileProvider object that can list files and read them
+    # @param [String] metadata_source eg. inspec.yml or metadata.rb
+    def initialize(target, metadata_source)
+      @target     = target
+      @metadata   = load_metadata(metadata_source)
+      @tests      = load_tests
+      @libraries  = load_libs
+      @data_files = load_data_files
+    end
+
+    private
+
+    def load_metadata(metadata_source)
+      Inspec::Metadata.from_ref(
+        metadata_source,
+        @target.read(metadata_source),
+        nil,
+      )
+    rescue Psych::SyntaxError => e
+      raise "Unable to parse inspec.yml: line #{e.line}, #{e.problem} #{e.context}"
+    rescue => e
+      raise "Unable to parse #{metadata_source}: #{e.class} -- #{e.message}"
+    end
+
+    def load_tests
+      tests = @target.files.find_all do |path|
+        path.start_with?('controls') && path.end_with?('.rb')
+      end
+      Hash[tests.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
+    end
+
+    def load_libs
+      tests = @target.files.find_all do |path|
+        path.start_with?('libraries') && path.end_with?('.rb')
+      end
+      Hash[tests.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
+    end
+
+    def load_data_files
+      files = @target.files.find_all do |path|
+        path.start_with?('files' + File::SEPARATOR)
+      end
+      Hash[files.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
+    end
+  end
+end

data/lib/utils/command_wrapper.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'shellwords'
+
+class CommandWrapper
+  UNIX_SHELLS = %w{sh bash zsh}.freeze
+
+  def self.wrap(cmd, options)
+    unless options.is_a?(Hash)
+      raise 'All options for the command wrapper must be provided as a hash. '\
+        "You entered: #{options.inspect}. Please consult the documentation."
+    end
+
+    wrap = options[:wrap]
+    raise "Called command wrapper with wrap: #{wrap.inspect}. It must be called with a Proc." if !wrap.nil? && !wrap.is_a?(Proc)
+    return wrap.call(cmd) unless wrap.nil?
+
+    shell = options[:shell]
+    raise "Don't know how to wrap commands for shell: #{shell.inspect}." unless UNIX_SHELLS.include?(shell)
+
+    path = options[:path] || shell
+    args = options[:args] || '-c'
+    path.to_s + ' ' + args + ' ' + Shellwords.escape(cmd)
+  end
+end

data/lib/utils/convert.rb

@@ -0,0 +1,12 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Converter
+  # convert the value to an integer if we have numbers only
+  # otherwise we return the string
+  def convert_to_i(val)
+    val = val.to_i if val =~ /^\d+$/
+    val
+  end
+end

data/lib/utils/database_helpers.rb

@@ -0,0 +1,77 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+module DatabaseHelper
+  class SQLColumn
+    def initialize(row, name)
+      @row = row
+      @name = name
+    end
+
+    def value
+      @row.nil? ? '' : @row[@name.downcase]
+    end
+
+    def to_s
+      'SQL Column'
+    end
+  end
+
+  class SQLRow
+    def initialize(query, row)
+      @query = query
+      @row = row
+    end
+
+    def column(column)
+      SQLColumn.new(@row, column)
+    end
+
+    def to_s
+      'SQL Row'
+    end
+  end
+
+  class SQLQueryResult
+    attr_reader :error
+    def initialize(cmd, results)
+      @cmd = cmd
+      @results = results
+    end
+
+    def empty?
+      @results.empty?
+    end
+
+    def successful?
+      @cmd.exit_status == 0 && @error.nil?
+    end
+
+    def row(id)
+      SQLRow.new(self, @results[id])
+    end
+
+    def size
+      @results.size
+    end
+
+    def stdout
+      warn '[DEPRECATION] The `stdout` method is deprecated. Use `row` instead.'
+      @cmd.stdout
+    end
+
+    def stderr
+      warn '[DEPRECATION] The `stderr` method is deprecated. Use `successful?` instead.'
+      @cmd.stderr
+    end
+
+    def inspect
+      to_s
+    end
+
+    def to_s
+      'SQL ResultSet'
+    end
+  end
+end

data/lib/utils/enumerable_delegation.rb

@@ -0,0 +1,9 @@
+# encoding: utf-8
+
+module EnumerableDelegation
+  include Enumerable
+
+  def each(&block)
+    @params.each(&block)
+  end
+end

data/lib/utils/erlang_parser.rb

@@ -0,0 +1,192 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'parslet'
+
+class ErlangParser < Parslet::Parser
+  root :outermost
+  # only designed for rabbitmq config files for now:
+  rule(:outermost) { filler? >> array.maybe >> dot.maybe }
+
+  rule(:exp) {
+    (tuple | array | binary | string | bool | identifier | float | integer) >> filler?
+  }
+
+  rule(:array) {
+    str('[') >> filler? >> (
+      exp.repeat(1) >>
+      (comma >> exp).repeat
+    ).maybe.as(:array) >> str(']') >> filler?
+  }
+
+  rule(:tuple) {
+    str('{') >> filler? >> (
+      exp.repeat(1) >> filler? >>
+      (comma >> exp).repeat
+    ).maybe.as(:tuple) >> str('}') >> filler?
+  }
+
+  rule(:filler?) { space.repeat }
+  rule(:space)   { match('\s+') | match["\n"] | comment }
+
+  rule(:comment) { str('%') >> (match["\n\r"].absent? >> any).repeat }
+  rule(:comma) { str(',') >> filler? }
+  rule(:dot) { str('.') >> filler? }
+  rule(:bool) { str('true').as(:bool) | str('false').as(:bool) }
+
+  rule(:identifier) {
+    (match('[a-zA-Z]') >> match('[a-zA-Z0-9_]').repeat).as(:identifier) >> filler?
+  }
+
+  rule(:float) {
+    (
+      integer >> (
+        str('.') >> match('[0-9]').repeat(1) |
+        str('e') >> match('[0-9]').repeat(1)
+      ).as(:e)
+    ).as(:float) >> filler?
+  }
+
+  rule(:integer) {
+    ((str('+') | str('-')).maybe >> match('[0-9]').repeat(1)).as(:integer) >> filler?
+  }
+
+  rule(:string) { stringS | stringD }
+
+  rule(:stringS) {
+    str("'") >> (
+      str('\\') >> any | str("'").absent? >> any
+    ).repeat.as(:string) >> str("'") >> filler?
+  }
+
+  rule(:stringD) {
+    str('"') >> (
+      str('\\') >> any | str('"').absent? >> any
+    ).repeat.as(:string) >> str('"') >> filler?
+  }
+
+  rule(:binary_item) {
+    (string | integer) >>
+      (str(':') >> integer).maybe.as(:size) >>
+      (str('/') >> identifier).maybe.as(:type) >>
+      filler?
+  }
+
+  rule(:binary) {
+    str('<<') >> filler? >> (
+      binary_item.repeat(1) >>
+      (comma >> binary_item).repeat
+    ).maybe.as(:binary) >> str('>>') >> filler?
+  }
+end
+
+class ErlangBitstream
+  def initialize
+    @data = []     # a stream of 8-bit numbers
+    @cur_bits = '' # a string of binary bits 10010010...
+  end
+
+  TYPES = {
+    'integer' => 8,
+    'float'   => 8*8,
+    'utf8'    => 8,
+    'utf16'   => 8*2,
+    'utf32'   => 8*4,
+  }.freeze
+
+  def bit_size(size, type)
+    raise 'Cannot specify size and type at the same time.' if !type.nil? && !size.nil?
+    return (size || 8).to_i if type.nil?
+    TYPES[type] || raise("Cannot handle binary-stream type #{type}")
+  end
+
+  def add(i)
+    if i[:integer].nil? && i[:string].nil?
+      raise 'No data provided, internal error for binary-stream processing!'
+    end
+    s = bit_size(i[:size], i[:type])
+    unless i[:string].nil?
+      str2int(i[:string].to_s, i[:type]).map { |e| add_bits(int2bits(e, 8)) }
+    else
+      add_int(i[:integer], s)
+    end
+  rescue RuntimeError => e
+    raise 'Error processing Erlang bit string '\
+          "'#{i[:string] || i[:integer]}:#{i[:size]}/#{i[:type]}'. #{e.message}"
+  end
+
+  def str2int(s, type)
+    case type
+    when 'utf8' then s.encode('utf-8').unpack('C*')
+    when 'utf16' then s.encode('utf-16').unpack('C*').drop(2)
+    when 'utf32' then s.encode('utf-32').unpack('C*').drop(4)
+    when 'integer', 'float' then raise "Cannot handle bit string as type #{type}"
+    else s.split('').map { |x| x.ord & 0xff }
+    end
+  end
+
+  def int2bits(i, len)
+    format("%0#{len}b", i)
+  end
+
+  def add_int(v, size)
+    x = v.to_i & (2**size - 1) # only get the bits specified in size
+    add_bits(int2bits(x, size))
+  end
+
+  def add_bits(s)
+    b = (@cur_bits + s).scan(/.{1,8}/)
+    @data += b[0..-2].map { |x| x.to_i(2) }
+    @cur_bits = b.last
+  end
+
+  def value(encoding = 'utf-8')
+    # fill in the rest
+    rest = '0' * (8 - @cur_bits.length) + @cur_bits
+    arr = @data + [rest.to_i(2)]
+    s = arr.pack('C*')
+    s.force_encoding(encoding) unless encoding.nil?
+    s
+  end
+end
+
+class ErlangTransform < Parslet::Transform
+  class Tuple < Array; end
+  class Identifier < String; end
+
+  def self.assemble_binary(seq)
+    b = ErlangBitstream.new
+    seq.each { |i| b.add(i) }
+    b.value
+  end
+
+  rule(string: simple(:x)) { x.to_s }
+  rule(string: []) { '' }
+  rule(integer: simple(:x)) { x.to_i }
+  rule(float: { integer: simple(:a), e: simple(:b) }) { (a+b).to_f }
+  rule(bool: 'true') { true }
+  rule(bool: 'false') { false }
+  rule(binary: subtree(:x)) { x.nil? ? '' : ErlangTransform.assemble_binary(x) }
+  rule(identifier: simple(:x)) { Identifier.new(x.to_s) }
+  rule(array: subtree(:x)) { Array(x) }
+  rule(tuple: subtree(:x)) {
+    x.nil? ? Tuple.new : Tuple.new(x)
+  }
+end
+
+class ErlangConfigFile
+  def self.parse(content)
+    lex = ErlangParser.new.parse(content)
+    tree = ErlangTransform.new.apply(lex)
+    turn_to_hash(tree)
+  end
+
+  def self.turn_to_hash(t)
+    if t.is_a?(Array) && t.all? { |x| x.class == ErlangTransform::Tuple && x.length == 2 }
+      Hash[t.map { |i| [i[0], turn_to_hash(i[1])] }]
+    else
+      t
+    end
+  end
+end