inspec 0.9.0

data/lib/inspec/resource.rb

@@ -0,0 +1,76 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# license: All rights reserved
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'inspec/plugins'
+
+module Inspec
+  class Resource
+    def self.registry
+      @registry ||= {}
+    end
+  end
+
+  def self.resource(version)
+    if version != 1
+      fail 'Only resource version 1 is supported!'
+    end
+    Inspec::Plugins::Resource
+  end
+end
+
+require 'resources/apache'
+require 'resources/apache_conf'
+require 'resources/apt'
+require 'resources/audit_policy'
+require 'resources/auditd_conf'
+require 'resources/auditd_rules'
+require 'resources/bond'
+require 'resources/bridge'
+require 'resources/command'
+require 'resources/directory'
+require 'resources/etc_group'
+require 'resources/file'
+require 'resources/gem'
+require 'resources/group'
+require 'resources/host'
+require 'resources/inetd_conf'
+require 'resources/interface'
+require 'resources/iptables'
+require 'resources/json'
+require 'resources/kernel_module'
+require 'resources/kernel_parameter'
+require 'resources/limits_conf'
+require 'resources/login_def'
+require 'resources/mysql'
+require 'resources/mysql_conf'
+require 'resources/mysql_session'
+require 'resources/npm'
+require 'resources/ntp_conf'
+require 'resources/oneget'
+require 'resources/os'
+require 'resources/os_env'
+require 'resources/package'
+require 'resources/parse_config'
+require 'resources/passwd'
+require 'resources/pip'
+require 'resources/port'
+require 'resources/postgres'
+require 'resources/postgres_conf'
+require 'resources/postgres_session'
+require 'resources/processes'
+require 'resources/registry_key'
+require 'resources/script'
+require 'resources/security_policy'
+require 'resources/service'
+require 'resources/ssh_conf'
+require 'resources/user'
+require 'resources/windows_feature'
+require 'resources/yum'
+
+# file formats, depend on json implementation
+require 'resources/json'
+require 'resources/yaml'
+require 'resources/csv'

data/lib/inspec/rspec_json_formatter.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'rspec/core'
+
+# Extend the basic RSpec JSON Formatter
+# to give us an ID in its output
+# TODO: remove once RSpec has IDs in stable (probably v3.3/v4.0)
+module RSpec::Core::Formatters
+  class JsonFormatter
+    private
+
+    def format_example(example)
+      {
+        description: example.description,
+        full_description: example.full_description,
+        status: example.execution_result.status.to_s,
+        file_path: example.metadata['file_path'],
+        line_number: example.metadata['line_number'],
+        run_time: example.execution_result.run_time,
+        pending_message: example.execution_result.pending_message,
+        id: example.metadata[:id],
+      }
+    end
+  end
+end

data/lib/inspec/rule.rb

@@ -0,0 +1,170 @@
+# encoding: utf-8
+# copyright: 2015, Dominik Richter
+# license: All rights reserved
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'rspec/expectations'
+require 'method_source'
+
+module Inspec
+  class ExpectationTarget
+    attr_reader :calls, :value, :block
+    def initialize(value, &block)
+      @value = value
+      @block = block
+      @calls = []
+    end
+
+    def to(*args, &block)
+      @calls.push([:to, args, block, caller])
+    end
+
+    def not_to(*args, &block)
+      @calls.push([:not_to, args, block, caller])
+    end
+
+    def example_group
+      that = self
+
+      opts = { 'caller' => calls[0][3] }
+      if !calls[0][3].nil? && !calls[0][3].empty? &&
+         (m = calls[0][3][0].match(/^([^:]*):(\d+):/))
+        opts['file_path'] = m[0]
+        opts['line_number'] = m[1]
+      end
+
+      RSpec::Core::ExampleGroup.describe(that.value, opts) do
+        that.calls.each do |method, args, block, clr|
+          it(nil, caller: clr) do
+            x = expect(that.value, &that.block).method(method)
+            x.call(*args, &block)
+          end
+        end
+      end
+    end
+  end
+
+  class Rule
+    include ::RSpec::Matchers
+
+    def initialize(id, _opts, &block)
+      @id = id
+      @impact = nil
+      @__block = block
+      @__code = __get_block_source(&block)
+      @title = nil
+      @desc = nil
+      # not changeable by the user:
+      @profile_id = nil
+      @checks = []
+      # evaluate the given definition
+      instance_eval(&block) if block_given?
+    end
+
+    def id(*_)
+      # never overwrite the ID
+      @id
+    end
+
+    def impact(v = nil)
+      @impact = v unless v.nil?
+      @impact
+    end
+
+    def title(v = nil)
+      @title = v unless v.nil?
+      @title
+    end
+
+    def desc(v = nil)
+      @desc = unindent(v) unless v.nil?
+      @desc
+    end
+
+    def describe(value, &block)
+      @checks.push(['describe', [value], block])
+    end
+
+    def expect(value, &block)
+      target = ExpectationTarget.new(value, &block)
+      @checks.push(['expect', [value], target])
+      target
+    end
+
+    def self.merge(dst, src)
+      if src.id != dst.id
+        # TODO: register an error, this case should not happen
+        return
+      end
+      sp = src.instance_variable_get(:@profile_id)
+      dp = dst.instance_variable_get(:@profile_id)
+      if sp != dp
+        # TODO: register an error, this case should not happen
+        return
+      end
+      # merge all fields
+      dst.impact(src.impact) unless src.impact.nil?
+      dst.title(src.title)   unless src.title.nil?
+      dst.desc(src.desc)     unless src.desc.nil?
+      # merge indirect fields
+      # checks defined in the source will completely eliminate
+      # all checks that were defined in the destination
+      sc = src.instance_variable_get(:@checks)
+      unless sc.nil? || sc.empty?
+        dst.instance_variable_set(:@checks, sc)
+      end
+    end
+
+    # Get the full id consisting of profile id + rule id
+    # for the rule. If the rule's profile id is empty,
+    # the given profile_id will be used instead and also
+    # set for the rule.
+    def self.full_id(profile_id, rule)
+      if rule.is_a?(String) or rule.nil?
+        rid = rule
+      else
+        # As the profile context is exclusively pulled with a
+        # profile ID, attach it to the rule if necessary.
+        rid = rule.instance_variable_get(:@id)
+        if rid.nil?
+          # TODO: Message about skipping this rule
+          # due to missing ID
+          return nil
+        end
+      end
+      pid = rule.instance_variable_get(:@profile_id)
+      if pid.nil?
+        rule.instance_variable_set(:@profile_id, profile_id)
+        pid = profile_id
+      end
+      if pid.nil? or pid.empty?
+        return rid
+      else
+        return "#{pid}/#{rid}"
+      end
+    end
+
+    private
+
+    # Idio(ma)tic unindent
+    # TODO: replace this
+    #
+    # @param [String] text string which needs to be unindented
+    # @return [String] input with indentation removed
+    def unindent(text)
+      return '' if text.nil?
+      text.strip.split("\n").map(&:strip)
+        .map { |x| x.empty? ? "\n" : x }
+        .join(' ')
+    end
+
+    # get the rule's source code
+    def __get_block_source(&block)
+      return '' unless block_given?
+      block.source.to_s
+    rescue MethodSource::SourceNotFoundError
+      ''
+    end
+  end
+end

data/lib/inspec/runner.rb

@@ -0,0 +1,154 @@
+# encoding: utf-8
+# copyright: 2015, Dominik Richter
+# license: All rights reserved
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'uri'
+require 'inspec/backend'
+require 'inspec/profile_context'
+require 'inspec/targets'
+# spec requirements
+require 'rspec'
+require 'rspec/its'
+require 'inspec/rspec_json_formatter'
+
+module Inspec
+  class Runner # rubocop:disable Metrics/ClassLength
+    attr_reader :tests, :backend, :rules
+    def initialize(conf = {})
+      @rules = {}
+      @profile_id = conf[:id]
+      @conf = conf.dup
+      @conf[:logger] ||= Logger.new(nil)
+      @tests = RSpec::Core::World.new
+
+      configure_output
+      configure_transport
+    end
+
+    def normalize_map(hm)
+      res = {}
+      hm.each {|k, v|
+        res[k.to_s] = v
+      }
+      res
+    end
+
+    def configure_output
+      RSpec.configuration.add_formatter(@conf['format'] || 'progress')
+    end
+
+    def configure_transport
+      @backend = Inspec::Backend.create(@conf)
+    end
+
+    def add_tests(tests)
+      # retrieve the raw ruby code of all tests
+      items = tests.map do |test|
+        Inspec::Targets.resolve(test)
+      end.flatten
+
+      tests = items.find_all { |i| i[:type] == :test }
+      libs = items.find_all { |i| i[:type] == :library }
+
+      # add all tests (raw) to the runtime
+      tests.flatten.each do |test|
+        add_content(test, libs)
+      end
+    end
+
+    def create_context
+      Inspec::ProfileContext.new(@profile_id, @backend)
+    end
+
+    def add_content(test, libs)
+      content = test[:content]
+      return if content.nil? || content.empty?
+
+      # load all libraries
+      ctx = create_context
+      libs.each do |lib|
+        ctx.load(lib[:content].to_s, lib[:ref], lib[:line] || 1)
+      end
+
+      # evaluate the test content
+      ctx.load(content, test[:ref], test[:line] || 1)
+
+      # process the resulting rules
+      ctx.rules.each do |rule_id, rule|
+        register_rule(ctx, rule_id, rule)
+      end
+    end
+
+    def run
+      run_with(RSpec::Core::Runner.new(nil))
+    end
+
+    def run_with(rspec_runner)
+      rspec_runner.run_specs(@tests.ordered_example_groups)
+    end
+
+    private
+
+    def get_check_example(method_name, arg, block)
+      opts = {}
+      if !block.nil? && block.respond_to?(:source_location)
+        file_path, line = block.source_location
+        opts['file_path'] = file_path
+        opts['line_number'] = line
+      end
+
+      if !arg.empty? &&
+         arg[0].respond_to?(:resource_skipped) &&
+         !arg[0].resource_skipped.nil?
+        return RSpec::Core::ExampleGroup.describe(*arg, opts) do
+          it arg[0].resource_skipped
+        end
+      else
+        # add the resource
+        case method_name
+        when 'describe'
+          return RSpec::Core::ExampleGroup.describe(*arg, opts, &block)
+        when 'expect'
+          return block.example_group
+        else
+          fail "A rule was registered with #{method_name.inspect}, "\
+               "which isn't understood and cannot be processed."
+        end
+      end
+      nil
+    end
+
+    def register_rule(ctx, rule_id, rule)
+      @rules[rule_id] = rule
+      checks = rule.instance_variable_get(:@checks)
+      checks.each do |m, a, b|
+        # resource skipping
+        example = get_check_example(m, a, b)
+
+        # TODO: Remove this!! It is very dangerous to do this here.
+        # The goal of this is to make the audit DSL available to all
+        # describe blocks. Right now, these blocks are executed outside
+        # the scope of this run, thus not gaining ony of the DSL pieces.
+        # To circumvent this, the full DSL is attached to the example's
+        # scope.
+        dsl = ctx.method(:create_inner_dsl).call(backend)
+        example.send(:include, dsl)
+
+        set_rspec_ids(example, rule_id)
+        @tests.register(example)
+      end
+    end
+
+    def set_rspec_ids(example, id)
+      example.metadata[:id] = id
+      example.filtered_examples.each do |e|
+        e.metadata[:id] = id
+      end
+      example.children.each do |child|
+        set_rspec_ids(child, id)
+      end
+    end
+  end
+end

data/lib/inspec/shell.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec
+  class Shell
+    def initialize(runner)
+      @runner = runner
+      # load and configure pry
+      require 'pry'
+      configure_pry
+    end
+
+    def start
+      # store context to run commands in this context
+      @runner.add_content('binding.pry', __FILE__, __LINE__)
+      @runner.run
+    end
+
+    def configure_pry
+      # Remove all hooks and checks
+      Pry.hooks.clear_all
+      that = self
+
+      # Add the help command
+      Pry::Commands.block_command 'usage', 'Show examples' do
+        that.usage
+      end
+
+      # Add a help menu as the default intro
+      Pry.hooks.add_hook(:before_session, :intro) do
+        intro
+      end
+    end
+
+    def mark(x)
+      "\033[1m#{x}\033[0m"
+    end
+
+    def intro
+      puts 'Welcome to the interactive Inspec Shell'
+      puts "To find out how to use it, type: #{mark 'usage'}"
+      puts
+    end
+
+    def usage
+      ctx = @runner.backend
+      puts <<EOF
+
+Welcome to the interactive Inspec Shell.
+
+You can use resources in this environment to test the target machine.
+For example:
+
+    command('uname -a').stdout
+    file('/proc/cpuinfo').content
+
+You are currently running on:
+
+    OS family:  #{mark ctx.os[:family] || 'unknown'}
+    OS release: #{mark ctx.os[:release] || 'unknown'}
+
+EOF
+    end
+  end
+end