inspec-core 5.12.2 → 5.18.14

data/lib/inspec/resources/bond.rb

@@ -63,6 +63,10 @@ module Inspec::Resources
       params["Bonding Mode"].first
     end
 
+    def resource_id
+      @path || "bond"
+    end
+
     def to_s
       "Bond #{@bond}"
     end

data/lib/inspec/resources/bridge.rb

@@ -45,6 +45,10 @@ module Inspec::Resources
       bridge_info.nil? ? nil : bridge_info[:interfaces]
     end
 
+    def resource_id
+      @bridge_name || "bridge"
+    end
+
     def to_s
       "Bridge #{@bridge_name}"
     end

data/lib/inspec/resources/cassandradb_conf.rb

@@ -31,6 +31,11 @@ module Inspec::Resources
       super(@conf_path)
     end
 
+    # if system unables to determine the cassandra conf path the @conf_path can be nil so in that case sending "" string as resource_id
+    def resource_id
+      @conf_path || "cassandradb_conf"
+    end
+
     private
 
     def parse(content)

data/lib/inspec/resources/cassandradb_session.rb

@@ -1,10 +1,11 @@
 module Inspec::Resources
   class Lines
-    attr_reader :output
+    attr_reader :output, :exit_status
 
-    def initialize(raw, desc)
+    def initialize(raw, desc, exit_status)
       @output = raw
       @desc = desc
+      @exit_status = exit_status
     end
 
     def to_s
@@ -40,10 +41,14 @@ module Inspec::Resources
       if cmd.exit_status != 0 || out =~ /Unable to connect to any servers/ || out.downcase =~ /^error:.*/
         raise Inspec::Exceptions::ResourceFailed, "Cassandra query with errors: #{out}"
       else
-        Lines.new(cmd.stdout.strip, "Cassandra query: #{q}")
+        Lines.new(cmd.stdout.strip, "Cassandra query: #{q}", cmd.exit_status)
       end
     end
 
+    def resource_id
+      "cassandradb_session:User:#{@user}:Host:#{host}"
+    end
+
     def to_s
       "Cassandra DB Session"
     end

data/lib/inspec/resources/chocolatey_package.rb

@@ -45,6 +45,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      @package_name || "chocolatey_package"
+    end
+
     def to_s
       "Chocolatey package #{package_name}"
     end

data/lib/inspec/resources/chrony_conf.rb

@@ -34,6 +34,10 @@ module Inspec::Resources
       param
     end
 
+    def resource_id
+      @conf_path || "chrony_conf"
+    end
+
     def to_s
       "chrony.conf"
     end

data/lib/inspec/resources/command.rb

@@ -93,6 +93,11 @@ module Inspec::Resources
       res.exit_status.to_i == 0
     end
 
+    # to_s method outputs the command which we are using here as UUID to identify resource and also it take cares of Redact output
+    def resource_id
+      to_s || "command"
+    end
+
     def to_s
       output = "Command: `#{@command}`"
       # Redact output if the `redact_regex` option is passed

data/lib/inspec/resources/cpan.rb

@@ -51,6 +51,10 @@ module Inspec::Resources
       info[:version]
     end
 
+    def resource_id
+      @package_name || "cpan"
+    end
+
     def to_s
       "Perl Module #{@package_name}"
     end

data/lib/inspec/resources/cran.rb

@@ -57,6 +57,10 @@ module Inspec::Resources
       info[:version]
     end
 
+    def resource_id
+      @package_name || "cran"
+    end
+
     def to_s
       "R Module #{@package_name}"
     end

data/lib/inspec/resources/cron.rb

@@ -38,6 +38,11 @@ module Inspec::Resources
       @params.include?(rule)
     end
 
+    def resource_id
+      user = @user || "current user"
+      "cron #{user}"
+    end
+
     def to_s
       if is_user_crontab?
         "cron for user #{@user}"

data/lib/inspec/resources/csv.rb

@@ -19,7 +19,8 @@ module Inspec::Resources
 
     def initialize(path, headers = true)
       @headers = headers
-      super(path)
+      @path = path
+      super(@path)
     end
 
     # override the parse method from JsonConfig
@@ -68,6 +69,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      @path || "csv"
+    end
+
     private
 
     # used by JsonConfig to build up a full to_s method

data/lib/inspec/resources/default_gateway.rb

@@ -0,0 +1,61 @@
+require "inspec/resources/command"
+require_relative "routing_table"
+
+module Inspec::Resources
+  class Defaultgateway < Routingtable
+    # resource internal name.
+    name "default_gateway"
+
+    # Restrict to only run on the below platforms (if none were given,
+    # all OS's and cloud API's supported)
+    supports platform: "unix"
+    supports platform: "windows"
+
+    desc "Use the `default_gateway` Chef InSpec audit resource to test the assigned ip address and interface for the default route."
+
+    example <<~EXAMPLE
+      describe default_gateway do
+        its(:ipaddress) { should eq '172.31.80.1' }
+      end
+      describe default_gateway do
+        its("interface") { should eq 'eth0' }
+      end
+    EXAMPLE
+
+    def initialize
+      skip_resource "The `default_gateway` resource is not yet available on your OS." unless inspec.os.unix? || inspec.os.windows?
+      # invoke the routing_table initialize; which populates the @routing_info
+      super()
+    end
+
+    # resource appearance in test reports.
+    def to_s
+      "default_gateway"
+    end
+
+    # fetches the ipaddress assigned to the default gateway
+    # default gateway's destination is either `default` or `0.0.0.0`
+    def ipaddress
+      # @routing_info is the hash populated in routing_table resource
+      # @routing_info contain values as:
+      # {
+      #   destination1: [ [gateway1x, interface1x], [gateway1y, interface1y] ],
+      #   destination2: [gateway2, interface2]
+      # }
+      %w{default 0.0.0.0}.each do |destination|
+        return @routing_info[destination][0][0] if @routing_info.key?(destination)
+      end
+      # raise exception because no destination with value default or 0.0.0.0 is found in the routing table
+      raise Inspec::Exceptions::ResourceFailed, "No routing found as part of default gateway"
+    end
+
+    # fetches the interface assigned to the default gateway
+    def interface
+      %w{default 0.0.0.0}.each do |destination|
+        return @routing_info[destination][0][1] if @routing_info.key?(destination)
+      end
+      # raise exception because no destination with value default or 0.0.0.0 is found in the routing table
+      raise Inspec::Exceptions::ResourceFailed, "No routing found as part of default gateway"
+    end
+  end
+end

data/lib/inspec/resources/dh_params.rb

@@ -76,6 +76,10 @@ module Inspec::Resources
       @dh_params.params_ok?
     end
 
+    def resource_id
+      @dh_params_path || "dh_params"
+    end
+
     def to_s
       "dh_params #{@dh_params_path}"
     end

data/lib/inspec/resources/docker_container.rb

@@ -92,6 +92,10 @@ module Inspec::Resources
       "Docker Container #{name}"
     end
 
+    def resource_id
+      object_info.ids[0] || @opts[:id] || @opts[:name] || ""
+    end
+
     private
 
     def object_info

data/lib/inspec/resources/docker_image.rb

@@ -72,6 +72,10 @@ module Inspec::Resources
       "Docker Image #{img}"
     end
 
+    def resource_id
+      object_info.ids[0] || @opts[:id] || @opts[:image] || ""
+    end
+
     private
 
     def sanitize_options(opts)

data/lib/inspec/resources/docker_plugin.rb

@@ -50,6 +50,10 @@ module Inspec::Resources
       "Docker plugin #{plugin}"
     end
 
+    def resource_id
+      id || @opts[:id] || @opts[:name] || ""
+    end
+
     private
 
     def object_info

data/lib/inspec/resources/docker_service.rb

@@ -73,6 +73,10 @@ module Inspec::Resources
       "Docker Service #{service}"
     end
 
+    def resource_id
+      object_info.ids[0] || @opts[:id] || @opts[:name] || ""
+    end
+
     private
 
     def sanitize_options(opts)

data/lib/inspec/resources/etc_group.rb

@@ -95,6 +95,10 @@ module Inspec::Resources
       "/etc/group"
     end
 
+    def resource_id
+      @path
+    end
+
     private
 
     def parse_group(path)

data/lib/inspec/resources/etc_hosts_allow_deny.rb

@@ -37,6 +37,10 @@ module Inspec::Resources
       "hosts.allow Configuration"
     end
 
+    def resource_id
+      @conf_path
+    end
+
     private
 
     def read_content
@@ -110,5 +114,6 @@ module Inspec::Resources
     def to_s
       "hosts.deny Configuration"
     end
+
   end
 end

data/lib/inspec/resources/file.rb

@@ -35,11 +35,12 @@ module Inspec::Resources
       end
     EXAMPLE
 
-    attr_reader :file, :mount_options
+    attr_reader :file, :mount_options, :path
     def initialize(path)
       # select permissions style
       @perms_provider = select_file_perms_style(inspec.os)
       @file = inspec.backend.file(path)
+      @path = path
     end
 
     %w{
@@ -181,6 +182,34 @@ module Inspec::Resources
       inv_mode & file.mode != 0
     end
 
+    def immutable?
+      raise Inspec::Exceptions::ResourceSkipped, "The `be_immutable` matcher is not supported on your OS yet." unless inspec.os.unix?
+
+      if inspec.os.linux?
+        file_info = LinuxImmutableFlagCheck.new(inspec, file)
+      else
+        file_info = UnixImmutableFlagCheck.new(inspec, file)
+      end
+
+      file_info.is_immutable?
+    end
+
+    # parse the json file content and returns the content
+    def content_as_json
+      require "json" unless defined?(JSON)
+      JSON.parse(file.content)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse the given JSON file: #{e.message}"
+    end
+
+    # parse the yaml file content and returns the content
+    def content_as_yaml
+      require "yaml" unless defined?(YAML)
+      YAML.load(file.content)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse the given YAML file: #{e.message}"
+    end
+
     def to_s
       if file
         "File #{source_path}"
@@ -189,6 +218,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      path
+    end
+
     private
 
     def file_permission_granted?(access_type, by_usergroup, by_specific_user)
@@ -373,4 +406,67 @@ module Inspec::Resources
       end
     end
   end
+
+  # Helper class for immutable matcher.
+  class ImmutableFlagCheck
+    attr_reader :inspec, :file_path
+    def initialize(inspec, file)
+      @inspec = inspec
+      @file_path = file.path
+    end
+
+    def find_utility_or_error(utility_name)
+      [
+        "/usr/sbin/#{utility_name}",
+        "/sbin/#{utility_name}",
+        "/usr/bin/#{utility_name}",
+        "/bin/#{utility_name}",
+        "#{utility_name}",
+      ].each do |cmd|
+        return cmd if inspec.command(cmd).exist?
+      end
+
+      raise Inspec::Exceptions::ResourceFailed, "Could not find `#{utility_name}`"
+    end
+  end
+
+  class LinuxImmutableFlagCheck < ImmutableFlagCheck
+    def is_immutable?
+      # Check if lsattr is available. In general, all linux system has lsattr & chattr
+      # This logic check is valid for immutable flag set with chattr
+      utility = find_utility_or_error("lsattr")
+      utility_cmd = inspec.command("#{utility} #{file_path}")
+
+      raise Inspec::Exceptions::ResourceFailed, "Executing #{utility} #{file_path} failed: #{utility_cmd.stderr}" if utility_cmd.exit_status.to_i != 0
+
+      # General output for lsattr file_name is:
+      # ----i---------e----- file_name
+      # The fifth char resembles the immutable flag. Total 20 flags are allowed.
+      lsattr_info = utility_cmd.stdout.strip.squeeze(" ")
+      lsattr_info =~ /^.{4}i.{15} .*/
+    end
+  end
+
+  class UnixImmutableFlagCheck < ImmutableFlagCheck
+    def is_immutable?
+      # Check if chflags is available on the system. Most unix-like system comes with chflags.
+      # This logic check is valid for immutable flag set with chflags
+      find_utility_or_error("chflags")
+
+      # In general ls -lO is used to check immutable flag set by chflags
+      utility_cmd = inspec.command("ls -lO #{file_path}")
+
+      # But on some bsd system (eg: freebsd) ls -lo is used instead of ls -lO
+      utility_cmd = inspec.command("ls -lo #{file_path}") if utility_cmd.exit_status.to_i != 0
+
+      raise Inspec::Exceptions::ResourceFailed, "Executing ls -lo #{file_path} and ls -lO #{file_path} failed: #{utility_cmd.stderr}" if utility_cmd.exit_status.to_i != 0
+
+      # General output for ls -lO file_name is:
+      # -rw-r--r--  1 current_user  1083951318  uchg 0 Apr  6 12:45 file_name
+      # The schg flag and the uchg flag represents the immutable flags
+      # uchg => user immutable flag, schg => system immutable flag.
+      file_info = utility_cmd.stdout.strip.split
+      file_info.include?("uchg") || file_info.include?("schg")
+    end
+  end
 end

data/lib/inspec/resources/filesystem.rb

@@ -84,6 +84,10 @@ module Inspec::Resources
       info = @fsman.info(@partition)
       info[:name]
     end
+
+    def resource_id
+      partition
+    end
   end
 
   class FsManagement

data/lib/inspec/resources/gem.rb

@@ -76,5 +76,9 @@ module Inspec::Resources
     def to_s
       "gem package #{@package_name}"
     end
+
+    def resource_id
+      "#{@package_name}-#{version}"
+    end
   end
 end

data/lib/inspec/resources/groups.rb

@@ -145,10 +145,19 @@ module Inspec::Resources
       true
     end
 
+    # matcher equivalent to gid property.
+    def has_gid?(gid_value)
+      gid_value == gid
+    end
+
     def to_s
       "Group #{@group}"
     end
 
+    def resource_id
+      gid ? "#{@group}-#{gid}" : ""
+    end
+
     private
 
     def flatten_entry(group_info, prop)

data/lib/inspec/resources/grub_conf.rb

@@ -69,6 +69,10 @@ module Inspec::Resources
       "Grub Config"
     end
 
+    def resource_id
+      @conf_path
+    end
+
     private
 
     ######################################################################

data/lib/inspec/resources/host.rb

@@ -113,6 +113,16 @@ module Inspec::Resources
       resolve.nil? || resolve.empty? ? nil : resolve
     end
 
+    # returns an array of the ipv4 addresses
+    def ipv4_address
+      ipaddress.select { |ip| ip.match(Resolv::IPv4::Regex) }
+    end
+
+    # returns an array of the ipv6 addresses
+    def ipv6_address
+      ipaddress.select { |ip| ip.match(Resolv::IPv6::Regex) }
+    end
+
     def to_s
       resource_name = "Host #{hostname}"
       resource_name += " port #{port} proto #{protocol}" if port
@@ -120,6 +130,10 @@ module Inspec::Resources
       resource_name
     end
 
+    def resource_id
+      port ? "#{hostname}-#{port}-#{protocol}" : hostname
+    end
+
     private
 
     def ping
@@ -296,15 +310,44 @@ module Inspec::Resources
     end
 
     def resolve(hostname)
+      addresses = []
+      # -Type A is the DNS query for IPv4 server Address.
       cmd = inspec.command("Resolve-DnsName –Type A #{hostname} | ConvertTo-Json")
       begin
-        resolv = JSON.parse(cmd.stdout)
+        resolve_ipv4 = JSON.parse(cmd.stdout)
       rescue JSON::ParserError => _e
         return nil
       end
 
-      resolv = [resolv] unless resolv.is_a?(Array)
-      resolv.map { |entry| entry["IPAddress"] }
+      resolve_ipv4 = resolve_ipv4.inject(:merge) if resolve_ipv4.is_a?(Array)
+
+      # Append the ipv4 addresses
+      resolve_ipv4.each_value do |ip|
+        matched = ip.to_s.chomp.match(Resolv::IPv4::Regex)
+        next if matched.nil? || addresses.include?(matched.to_s)
+
+        addresses << matched.to_s
+      end
+
+      # -Type AAAA is the DNS query for IPv6 server Address.
+      cmd = inspec.command("Resolve-DnsName –Type AAAA #{hostname} | ConvertTo-Json")
+      begin
+        resolve_ipv6 = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      resolve_ipv6 = resolve_ipv6.inject(:merge) if resolve_ipv6.is_a?(Array)
+
+      # Append the ipv6 addresses
+      resolve_ipv6.each_value do |ip|
+        matched = ip.to_s.chomp.match(Resolv::IPv6::Regex)
+        next if matched.nil? || addresses.include?(matched.to_s)
+
+        addresses << matched.to_s
+      end
+
+      addresses
     end
   end
 end

data/lib/inspec/resources/http.rb

@@ -83,6 +83,10 @@ module Inspec::Resources
           @response = nil
         end
 
+        def resource_id
+          @url
+        end
+
         private
 
         def params

data/lib/inspec/resources/ibmdb2_conf.rb

@@ -24,6 +24,14 @@ module Inspec::Resources
       @output = run_command
     end
 
+    def resource_id
+      if inspec.os.platform?("windows")
+        "ibmdb2_conf"
+      else
+        "ibmdb2_conf:DatabaseInstance:#{@db_instance}"
+      end
+    end
+
     def to_s
       "IBM Db2 Conf"
     end

data/lib/inspec/resources/ibmdb2_session.rb

@@ -1,10 +1,11 @@
 module Inspec::Resources
   class Lines
-    attr_reader :output
+    attr_reader :output, :exit_status
 
-    def initialize(raw, desc)
+    def initialize(raw, desc, exit_status)
       @output = raw
       @desc = desc
+      @exit_status = exit_status
     end
 
     def to_s
@@ -58,7 +59,15 @@ module Inspec::Resources
       if cmd.exit_status != 0 || out =~ /Can't connect to IBM Db2 / || out.downcase =~ /^error:.*/
         raise Inspec::Exceptions::ResourceFailed, "IBM Db2 connection error: #{out}"
       else
-        Lines.new(cmd.stdout.strip, "IBM Db2 Query: #{q}")
+        Lines.new(cmd.stdout.strip, "IBM Db2 Query: #{q}", cmd.exit_status)
+      end
+    end
+
+    def resource_id
+      if inspec.os.platform?("windows")
+        "ibmdb2_session:DatabaseName#{@db_name}"
+      else
+        "ibmdb2_session:DatabaseInstance:#{@db_instance}:DatabaseName#{@db_name}"
       end
     end
 

data/lib/inspec/resources/iis_app.rb

@@ -72,6 +72,10 @@ module Inspec::Resources
       "iis_app '#{@site_name}#{@path}'"
     end
 
+    def resource_id
+      @path
+    end
+
     private
 
     def iis_app

data/lib/inspec/resources/iis_app_pool.rb

@@ -80,6 +80,10 @@ module Inspec::Resources
       "IIS App Pool '#{@pool_name}'"
     end
 
+    def resource_id
+      @pool_name
+    end
+
     private
 
     def iis_app_pool

data/lib/inspec/resources/iis_site.rb

@@ -77,6 +77,10 @@ module Inspec::Resources
       iis_site.nil? ? false : (iis_site[:bindings].include? binding)
     end
 
+    def resource_id
+      @site_name || "IIS Site"
+    end
+
     def to_s
       "iis_site '#{@site_name}'"
     end

data/lib/inspec/resources/inetd_conf.rb

@@ -46,6 +46,10 @@ module Inspec::Resources
       @params = conf.params
     end
 
+    def resource_id
+      @conf_path || "inetd.conf"
+    end
+
     def to_s
       "inetd.conf"
     end