inspec 0.9.0

data/lib/resources/parse_config.rb

@@ -0,0 +1,75 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# author: Christoph Hartmann
+# license: All rights reserved
+
+# Usage example:
+#
+#  audit = command('/sbin/auditctl -l').stdout
+#  options = {
+#    assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+#    multiple_values: true
+#  }
+#  describe parse_config(audit, options ) do
+
+class PConfig < Inspec.resource(1)
+  name 'parse_config'
+
+  def initialize(content = nil, useropts = nil)
+    @opts = {}
+    @opts = useropts.dup unless useropts.nil?
+    @files_contents = {}
+    @params = nil
+
+    @content = content
+    read_content if @content.nil?
+  end
+
+  def method_missing(name)
+    @params || read_content
+    @params[name.to_s]
+  end
+
+  def parse_file(conf_path)
+    @conf_path = conf_path
+
+    # read the file
+    if !inspec.file(conf_path).file?
+      return skip_resource "Can't find file \"#{conf_path}\""
+    end
+    @content = read_file(conf_path)
+    if @content.empty? && inspec.file(conf_path).size > 0
+      return skip_resource "Can't read file \"#{conf_path}\""
+    end
+
+    read_content
+  end
+
+  def read_file(path)
+    @files_contents[path] ||= inspec.file(path).content
+  end
+
+  def read_content
+    # parse the file
+    @params = SimpleConfig.new(@content, @opts).params
+    @content
+  end
+
+  def to_s
+    "Parse Config #{@conf_path}"
+  end
+end
+
+class PConfigFile < PConfig
+  name 'parse_config_file'
+
+  def initialize(path, opts = nil)
+    super(nil, opts)
+    parse_file(path)
+  end
+
+  def to_s
+    "Parse Config File #{@conf_path}"
+  end
+end

data/lib/resources/passwd.rb

@@ -0,0 +1,93 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+# license: All rights reserved
+
+# The file format consists of
+# - username
+# - password
+# - userid
+# - groupid
+# - user id info
+# - home directory
+# - command
+
+# usage:
+#
+# describe passwd do
+#   its(:usernames) { should eq ['root'] }
+#   its(:uids) { should eq [0] }
+# end
+#
+# describe passwd.uid(0) do
+#   its(:username) { should eq 'root' }
+#   its(:count) { should eq 1 }
+# end
+
+require 'utils/parser'
+
+class Passwd < Inspec.resource(1)
+  name 'passwd'
+
+  include ContentParser
+
+  attr_reader :uid
+  attr_reader :parsed
+
+  def initialize(path = nil)
+    @path = path || '/etc/passwd'
+    @content = inspec.file(@path).content
+    @parsed = parse_passwd(@content)
+  end
+
+  # call passwd().uid(0)
+  # returns a seperate object with reference to this object
+  def uid(uid)
+    PasswdUid.new(self, uid)
+  end
+
+  def usernames
+    map_data('name')
+  end
+
+  def passwords
+    map_data('password')
+  end
+
+  def uids
+    map_data('uid')
+  end
+
+  def gids
+    map_data('gid')
+  end
+
+  def to_s
+    '/etc/passwd'
+  end
+
+  private
+
+  def map_data(id)
+    @parsed.map {|x|
+      x[id]
+    }
+  end
+end
+
+# object that hold a specifc uid view on passwd
+class PasswdUid
+  def initialize(passwd, uid)
+    @passwd = passwd
+    @users = @passwd.parsed.select { |x| x['uid'] == "#{uid}" }
+  end
+
+  def username
+    @users.at(0)['name']
+  end
+
+  def count
+    @users.size
+  end
+end

data/lib/resources/pip.rb

@@ -0,0 +1,75 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Usage:
+# describe pip('Jinja2') do
+#   it { should be_installed }
+# end
+#
+class PipPackage < Inspec.resource(1)
+  name 'pip'
+
+  def initialize(package_name)
+    @package_name = package_name
+  end
+
+  def info
+    return @info if defined?(@info)
+
+    @info = {}
+    @info[:type] = 'pip'
+    cmd = inspec.command("#{pip_cmd} show #{@package_name}")
+    return @info if cmd.exit_status != 0
+
+    params = SimpleConfig.new(
+      cmd.stdout,
+      assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+      multiple_values: false,
+    ).params
+    @info[:name] = params['Name']
+    @info[:version] = params['Version']
+    @info[:installed] = true
+    @info
+  end
+
+  def installed?
+    info[:installed] == true
+  end
+
+  def version
+    info[:version]
+  end
+
+  def to_s
+    "Pip Package  #{@package_name}"
+  end
+
+  private
+
+  def pip_cmd
+    # Pip is not on the default path for Windows, therefore we do some logic
+    # to find the binary on Windows
+    family = inspec.os[:family]
+    case family
+    when 'windows'
+      # we need to detect the pip command on Windows
+      cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
+      begin
+        paths = JSON.parse(cmd.stdout)
+        # use pip if it on system path
+        pipcmd = paths['Pip']
+        # calculate path on windows
+        if defined?(paths['Python']) && pipcmd.nil?
+          pipdir = paths['Python'].split('\\')
+          # remove python.exe
+          pipdir.pop
+          pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
+        end
+      rescue JSON::ParserError => _e
+        return nil
+      end
+    end
+    pipcmd || 'pip'
+  end
+end

data/lib/resources/port.rb

@@ -0,0 +1,296 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Usage:
+# describe port(80) do
+#   it { should be_listening }
+#   its('protocol') {should eq 'tcp'}
+# end
+#
+# not supported serverspec syntax
+# describe port(80) do
+#   it { should be_listening.with('tcp') }
+# end
+#
+# TODO: currently we return local ip only
+# TODO: improve handling of same port on multiple interfaces
+class Port < Inspec.resource(1)
+  name 'port'
+
+  def initialize(port)
+    @port = port
+    @port_manager = nil
+    @cache = nil
+
+    case inspec.os[:family]
+    when 'ubuntu', 'debian', 'redhat', 'fedora', 'arch'
+      @port_manager = LinuxPorts.new(inspec)
+    when 'darwin'
+      @port_manager = DarwinPorts.new(inspec)
+    when 'windows'
+      @port_manager = WindowsPorts.new(inspec)
+    when 'freebsd'
+      @port_manager = FreeBsdPorts.new(inspec)
+    else
+      return skip_resource 'The `port` resource is not supported on your OS yet.'
+    end
+  end
+
+  def listening?(_protocol = nil, _local_address = nil)
+    info.size > 0
+  end
+
+  def protocol
+    res = info.map { |x| x[:protocol] }.uniq.compact
+    res.size > 0 ? res : nil
+  end
+
+  def process
+    res = info.map { |x| x[:process] }.uniq.compact
+    res.size > 0 ? res : nil
+  end
+
+  def pid
+    res = info.map { |x| x[:pid] }.uniq.compact
+    res.size > 0 ? res : nil
+  end
+
+  def to_s
+    "Port  #{@port}"
+  end
+
+  private
+
+  def info
+    return @cache if !@cache.nil?
+    # abort if os detection has not worked
+    return @cache = [] if @port_manager.nil?
+    # query ports
+    ports = @port_manager.info || []
+    @cache = ports.select { |p| p[:port] == @port }
+  end
+end
+
+# implements an info method and returns all ip adresses and protocols for
+# each port
+# [{
+#   port: 80,
+#   address: [{
+#     ip: '0.0.0.0'
+#     protocol: 'tcp'
+#   }],
+# }]
+class PortsInfo
+  attr_reader :inspec
+  def initialize(inspec)
+    @inspec = inspec
+  end
+end
+
+# TODO: Add UDP infromation Get-NetUDPEndpoint
+# TODO: currently Windows only supports tcp ports
+# TODO: Get-NetTCPConnection does not return PIDs
+# TODO: double-check output with 'netstat -ano'
+# @see https://connect.microsoft.com/PowerShell/feedback/details/1349420/get-nettcpconnection-does-not-show-processid
+class WindowsPorts < PortsInfo
+  def info
+    # get all port information
+    cmd = inspec.command('Get-NetTCPConnection | Select-Object -Property State, Caption, Description, LocalAddress, LocalPort, RemoteAddress, RemotePort, DisplayName, Status | ConvertTo-Json')
+
+    begin
+      ports = JSON.parse(cmd.stdout)
+    rescue JSON::ParserError => _e
+      return nil
+    end
+
+    return nil if ports.nil?
+
+    ports.map { |x|
+      {
+        port: x['LocalPort'],
+        address: x['LocalAddress'],
+        protocol: 'tcp',
+        process: nil,
+        pid: nil,
+      }
+    }
+  end
+end
+
+# extracts udp and tcp ports from macos
+class DarwinPorts < PortsInfo
+  def info
+    # collects UDP and TCP information
+    cmd = inspec.command('lsof -nP -iTCP -iUDP -sTCP:LISTEN')
+    return nil if cmd.exit_status.to_i != 0
+
+    ports = []
+    # split on each newline
+    cmd.stdout.each_line do |line|
+      # parse each line
+      # 1 - COMMAND, 2 - PID, 3 - USER, 4 - FD, 5 - TYPE, 6 - DEVICE, 7 - SIZE/OFF, 8 - NODE, 9 - NAME
+      parsed = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+).*$/.match(line)
+      # extract network info
+      net_addr = parsed[9].split(':')
+      # convert to number if possible
+      net_port = net_addr[1]
+      net_port = net_port.to_i if /^\d+$/.match(net_port)
+      protocol = parsed[8].downcase
+
+      # add version to protocol
+      type = parsed[5].downcase
+      protocol += '6' if type == 'IPv6'
+
+      # map data
+      port_info = {
+        port: net_port,
+        address: net_addr[0],
+        protocol: protocol,
+        process: parsed[1],
+        pid: parsed[2].to_i,
+      }
+
+      # push data, if not headerfile
+      ports.push(port_info) if %w{tcp tcp6 udp udp6}.include?(protocol)
+    end
+    ports
+  end
+end
+
+# extract port information from netstat
+class LinuxPorts < PortsInfo
+  def info
+    cmd = inspec.command('netstat -tulpen')
+    return nil if cmd.exit_status.to_i != 0
+
+    ports = []
+    # parse all lines
+    cmd.stdout.each_line do |line|
+      port_info = parse_netstat_line(line)
+
+      # only push protocols we are interested in
+      next unless %w{tcp tcp6 udp udp6}.include?(port_info[:protocol])
+      ports.push(port_info)
+    end
+    ports
+  end
+
+  def parse_net_address(net_addr, protocol)
+    if protocol.eql?('tcp6') || protocol.eql?('udp6')
+      # prep for URI parsing, parse ip6 port
+      ip6 = /^(\S+:)(\d+)$/.match(net_addr)
+      ip6addr = ip6[1]
+      ip6addr = '::' if /^:::$/.match(ip6addr)
+      # build uri
+      ip_addr = URI("addr://[#{ip6addr}]:#{ip6[2]}")
+      # replace []
+      host = ip_addr.host[1..ip_addr.host.size-2]
+      port = ip_addr.port
+    else
+      ip_addr = URI('addr://'+net_addr)
+      host = ip_addr.host
+      port = ip_addr.port
+    end
+    [host, port]
+  end
+
+  def parse_netstat_line(line)
+    # parse each line
+    # 1 - Proto, 2 - Recv-Q, 3 - Send-Q, 4 - Local Address, 5 - Foreign Address, 6 - State, 7 - Inode, 8 - PID/Program name
+    parsed = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$/.match(line)
+    return {} if parsed.nil?
+
+    # parse ip4 and ip6 addresses
+    protocol = parsed[1].downcase
+    host, port = parse_net_address(parsed[4], protocol)
+
+    # extract PID
+    process = parsed[9].split('/')
+    pid = process[0]
+    pid = pid.to_i if /^\d+$/.match(pid)
+    process = process[1]
+
+    # map data
+    {
+      port: port,
+      address: host,
+      protocol: protocol,
+      process: process,
+      pid: pid,
+    }
+  end
+end
+
+# extracts information from sockstat
+class FreeBsdPorts < PortsInfo
+  def info
+    cmd = inspec.command('sockstat -46l')
+    return nil if cmd.exit_status.to_i != 0
+
+    ports = []
+    # split on each newline
+    cmd.stdout.each_line do |line|
+      port_info = parse_sockstat_line(line)
+
+      # push data, if not headerfile
+      next unless %w{tcp tcp6 udp udp6}.include?(port_info[:protocol])
+      ports.push(port_info)
+    end
+    ports
+  end
+
+  def parse_net_address(net_addr, protocol)
+    case protocol
+    when 'tcp4', 'udp4'
+      # replace * with 0.0.0.0
+      net_addr = net_addr.gsub(/^\*:/, '0.0.0.0:') if /^*:(\d+)$/.match(net_addr)
+      ip_addr = URI('addr://'+net_addr)
+      host = ip_addr.host
+      port = ip_addr.port
+    when 'tcp6', 'udp6'
+      return [] if net_addr == '*:*' # abort for now
+      # replace * with 0:0:0:0:0:0:0:0
+      net_addr = net_addr.gsub(/^\*:/, '0:0:0:0:0:0:0:0:') if /^*:(\d+)$/.match(net_addr)
+      # extract port
+      ip6 = /^(\S+):(\d+)$/.match(net_addr)
+      ip6addr = ip6[1]
+      ip_addr = URI("addr://[#{ip6addr}]:#{ip6[2]}")
+      # replace []
+      host = ip_addr.host[1..ip_addr.host.size-2]
+      port = ip_addr.port
+    end
+    [host, port]
+  end
+
+  def parse_sockstat_line(line)
+    # 1 - USER, 2 - COMMAND, 3 - PID, 4 - FD 5 - PROTO, 6 - LOCAL ADDRESS, 7 - FOREIGN ADDRESS
+    parsed = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$/.match(line)
+    return {} if parsed.nil?
+
+    # extract ip information
+    protocol = parsed[5].downcase
+    host, port = parse_net_address(parsed[6], protocol)
+    return {} if host.nil? or port.nil?
+
+    # extract process
+    process = parsed[2]
+
+    # extract PID
+    pid = parsed[3]
+    pid = pid.to_i if /^\d+$/.match(pid)
+
+    # map tcp4 and udp4
+    protocol = 'tcp' if protocol.eql?('tcp4')
+    protocol = 'udp' if protocol.eql?('udp4')
+
+    # map data
+    {
+      port: port,
+      address: host,
+      protocol: protocol,
+      process: process,
+      pid: pid,
+    }
+  end
+end