inspec-core 4.6.9 → 4.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a36d31d9a7cd2c45ff3bb9d4ac89eb91f8ce0c9604819b48e27a300b00614f7
-  data.tar.gz: 0f063d8f8c1d02310c9188fd3fb9bdbb8027aaf7c8bf19d975f6a5730a5af723
+  metadata.gz: d3f9a9b00cc2ce6cc3be695589b41cdeecdc988c00d6f0636024fc35b739ffac
+  data.tar.gz: 385c7be34679985f6e6541bba865277f42b64cc6d14ed6d69c9430b3472b6d60
 SHA512:
-  metadata.gz: bf4d30d1c1514bd164be327a15f04f100502b83e07b06e132ff80b81a8d8b61d1972909d12b778e7fbd2d8f22778cc2e0f5554eb22a86f804af242d32b6bbec4
-  data.tar.gz: 8d70d967677ba4186edb18f02036e87b8b1aa16cd9e4d8e82f5d7786a8ff08875f3e5fa8b73c565ee1e811dd26adb848ae1f16d3a9cb5897aa78c32b66b109a8
+  metadata.gz: 47250251654358a3f822c058c7babce2d2d17dcd31c7ca78feef1832ce459c919f4a979550bf39af6ea419119314176ff6649b1df38bf2cdc08132707ea2305f
+  data.tar.gz: d2d2ee9b16a474021a92f546b266e518bc37da3c98034007a7810171a6741ff3bacbb901e9857d417f173fc34a3e45371c6a0be62de0da4286aa991f727c48e1

data/README.md

@@ -31,15 +31,18 @@ Chef InSpec makes it easy to run your tests wherever you need. More options are
 # run test locally
 inspec exec test.rb
 
-# run test on remote host on SSH
+# run test on remote host via SSH
 inspec exec test.rb -t ssh://user@hostname -i /path/to/key
 
 # run test on remote host using SSH agent private key authentication. Requires Chef InSpec 1.7.1
 inspec exec test.rb -t ssh://user@hostname
 
-# run test on remote windows host on WinRM
+# run test on remote windows host via WinRM
 inspec exec test.rb -t winrm://Administrator@windowshost --password 'your-password'
 
+# run test on remote windows host via WinRM as a domain user
+inspec exec test.rb -t winrm://windowshost --user 'UserName@domain' --password 'your-password'
+
 # run test on docker container
 inspec exec test.rb -t docker://container_id
 ```

data/lib/inspec/config.rb

@@ -295,19 +295,19 @@ module Inspec
     def validate_reporters!(reporters)
       return if reporters.nil?
       # TODO: move this into a reporter plugin type system
-      valid_types = [
-        "automate",
-        "cli",
-        "documentation",
-        "html",
-        "json",
-        "json-automate",
-        "json-min",
-        "json-rspec",
-        "junit",
-        "progress",
-        "yaml",
-      ]
+      valid_types = %w{
+        automate
+        cli
+        documentation
+        html
+        json
+        json-automate
+        json-min
+        json-rspec
+        junit
+        progress
+        yaml
+      }
 
       reporters.each do |reporter_name, reporter_config|
         raise NotImplementedError, "'#{reporter_name}' is not a valid reporter type." unless valid_types.include?(reporter_name)

data/lib/inspec/plugin/v2/installer.rb

@@ -461,9 +461,9 @@ module Inspec::Plugin::V2
 
       # Combine the Sets, so the resolver has one composite place to look
       Gem::Resolver.compose_sets(
-        installed_plugins_gem_set,     # The gems that are in the plugin gem path directory tree
+        installed_plugins_gem_set, # The gems that are in the plugin gem path directory tree
         InstalledVendorSet.new,
-        *extra_request_sets,           # Anything else our caller wanted to include
+        *extra_request_sets # Anything else our caller wanted to include
       )
     end
 

data/lib/inspec/plugin/v2/status.rb

@@ -14,7 +14,7 @@ module Inspec::Plugin::V2
     :loaded,                  # true, false False could mean not attempted or failed
     :load_exception,          # Exception class if it failed to load
     :name,                    # String name
-    :version,                 # three-digit version.  Core / bundled plugins use InSpec version here.
+    :version # three-digit version.  Core / bundled plugins use InSpec version here.
   ) do
     def initialize(*)
       super

data/lib/inspec/profile.rb

@@ -127,7 +127,7 @@ module Inspec
         cli_input_files: options[:runner_conf][:input_file], # From CLI --input-file
         profile_metadata: metadata,
         # TODO: deprecation checks here
-        runner_api: options[:runner_conf][:attributes], # This is the route the audit_cookbook and kitchen-inspec take
+        runner_api: options[:runner_conf][:attributes] # This is the route the audit_cookbook and kitchen-inspec take
       )
 
       @runner_context =

data/lib/inspec/resources.rb

@@ -56,6 +56,7 @@ require "inspec/resources/iis_app_pool"
 require "inspec/resources/iis_site"
 require "inspec/resources/inetd_conf"
 require "inspec/resources/interface"
+require "inspec/resources/ip6tables"
 require "inspec/resources/iptables"
 require "inspec/resources/kernel_module"
 require "inspec/resources/kernel_parameter"

data/lib/inspec/resources/apt.rb

@@ -102,7 +102,7 @@ module Inspec::Resources
           components: parse_repo[4].chomp.split(" "),
           active: active,
         }
-        next unless ["deb", "deb-src"].include? repo[:type]
+        next unless %w{deb deb-src}.include? repo[:type]
 
         lines.push(repo)
       end

data/lib/inspec/resources/ip6tables.rb

@@ -0,0 +1,79 @@
+require "inspec/resources/command"
+
+# Usage:
+# describe ip6tables do
+#   it { should have_rule('-P INPUT ACCEPT') }
+# end
+#
+# The following serverspec sytax is not implemented:
+# describe ip6tables do
+#   it { should have_rule('-P INPUT ACCEPT').with_table('mangle').with_chain('INPUT') }
+# end
+# Please use the new sytax:
+# describe ip6tables(table:'mangle', chain: 'input') do
+#   it { should have_rule('-P INPUT ACCEPT') }
+# end
+#
+# Note: Docker containers normally do not have ip6tables installed
+#
+# @see http://ipset.netfilter.org/ip6tables.man.html
+# @see http://ipset.netfilter.org/ip6tables.man.html
+module Inspec::Resources
+  class Ip6Tables < Inspec.resource(1)
+    name "ip6tables"
+    supports platform: "linux"
+    desc "Use the ip6tables InSpec audit resource to test rules that are defined in ip6tables, which maintains tables of IP packet filtering rules. There may be more than one table. Each table contains one (or more) chains (both built-in and custom). A chain is a list of rules that match packets. When the rule matches, the rule defines what target to assign to the packet."
+    example <<~EXAMPLE
+      describe ip6tables do
+        it { should have_rule('-P INPUT ACCEPT') }
+      end
+    EXAMPLE
+
+    def initialize(params = {})
+      @table = params[:table]
+      @chain = params[:chain]
+
+      # we're done if we are on linux
+      return if inspec.os.linux?
+
+      # ensures, all calls are aborted for non-supported os
+      @ip6tables_cache = []
+      skip_resource "The `ip6tables` resource is not supported on your OS yet."
+    end
+
+    def has_rule?(rule = nil, _table = nil, _chain = nil)
+      # checks if the rule is part of the ruleset
+      # for now, we expect an exact match
+      retrieve_rules.any? { |line| line.casecmp(rule) == 0 }
+    end
+
+    def retrieve_rules
+      return @ip6tables_cache if defined?(@ip6tables_cache)
+
+      # construct ip6tables command to read all rules
+      bin = find_ip6tables_or_error
+      table_cmd = "-t #{@table}" if @table
+      ip6tables_cmd = format("%s %s -S %s", bin, table_cmd, @chain).strip
+
+      cmd = inspec.command(ip6tables_cmd)
+      return [] if cmd.exit_status.to_i != 0
+
+      # split rules, returns array or rules
+      @ip6tables_cache = cmd.stdout.split("\n").map(&:strip)
+    end
+
+    def to_s
+      format("Ip6tables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
+    end
+
+    private
+
+    def find_ip6tables_or_error
+      %w{/usr/sbin/ip6tables /sbin/ip6tables ip6tables}.each do |cmd|
+        return cmd if inspec.command(cmd).exist?
+      end
+
+      raise Inspec::Exceptions::ResourceFailed, "Could not find `ip6tables`"
+    end
+  end
+end

data/lib/inspec/resources/service.rb

@@ -127,10 +127,14 @@ module Inspec::Resources
           Systemd.new(inspec, service_ctl)
         end
       elsif %w{debian}.include?(platform)
-        version = os[:release].to_i
+        if os[:release] == "buster/sid"
+          version = 10
+        else
+          version = os[:release].to_i
+        end
         if version > 7
           Systemd.new(inspec, service_ctl)
-        else
+        elsif version > 0
           SysV.new(inspec, service_ctl || "/usr/sbin/service")
         end
       elsif %w{redhat fedora centos oracle cloudlinux}.include?(platform)

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "4.6.9".freeze
+  VERSION = "4.7.3".freeze
 end

data/lib/matchers/matchers.rb

@@ -147,7 +147,7 @@ RSpec::Matchers.define :be_resolvable do
   end
 end
 
-# matcher for iptables
+# matcher for iptables and ip6tables
 RSpec::Matchers.define :have_rule do |rule|
   match do |tables|
     tables.has_rule?(rule)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 4.6.9
+  version: 4.7.3
 platform: ruby
 authors:
 - Dominik Richter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-07-01 00:00:00.000000000 Z
+date: 2019-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: train-core
@@ -507,6 +507,7 @@ files:
 - lib/inspec/resources/inetd_conf.rb
 - lib/inspec/resources/ini.rb
 - lib/inspec/resources/interface.rb
+- lib/inspec/resources/ip6tables.rb
 - lib/inspec/resources/iptables.rb
 - lib/inspec/resources/json.rb
 - lib/inspec/resources/kernel_module.rb