inspec 0.9.0

data/lib/inspec/targets.rb

@@ -0,0 +1,9 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'inspec/targets/core'
+require 'inspec/targets/file'
+require 'inspec/targets/folder'
+require 'inspec/targets/url'
+require 'inspec/targets/dir'

data/lib/inspec/targets/core.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'utils/modulator'
+
+module Inspec
+  module Targets
+    extend Modulator
+
+    def self.__resolve(items)
+      items.map do |_|
+        # @TODO
+      end.flatten
+    end
+
+    def self.resolve(targets)
+      Array(targets).map do |target|
+        handler = modules.values.find { |m| m.handles?(target) }
+        if handler.nil?
+          fail "Don't know how to handle target: #{target}"
+        end
+        handler.resolve(target)
+      end.flatten
+    end
+  end
+end

data/lib/inspec/targets/dir.rb

@@ -0,0 +1,67 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec::Targets
+  module DirsHelper
+    class ProfileDir
+      def handles?(paths)
+        paths.include?('test') && paths.include?('metadata.rb')
+      end
+
+      def get_libraries(paths)
+        paths.find_all do |path|
+          path.start_with?('libraries') && path.end_with?('.rb')
+        end
+      end
+
+      def get_filenames(paths)
+        paths.find_all do |path|
+          path.start_with?('test') && path.end_with?('.rb')
+        end
+      end
+    end
+
+    class ChefAuditDir
+      def handles?(paths)
+        paths.include?('recipes') and paths.include?('metadata.rb')
+      end
+
+      def get_filenames(paths)
+        paths.find_all do |x|
+          x.start_with? 'recipes/' and x.end_with? '.rb'
+        end
+      end
+    end
+
+    class ServerspecDir
+      def handles?(paths)
+        paths.include?('spec')
+      end
+
+      def get_filenames(paths)
+        paths.find_all do |path|
+          path.start_with? 'spec' and path.end_with? '_spec.rb'
+        end
+      end
+    end
+
+    class FlatDir
+      def handles?(paths)
+        get_filenames(paths).empty? == false
+      end
+
+      def get_filenames(paths)
+        paths.find_all { |x| x.end_with?('.rb') and !x.include?('/') }
+      end
+    end
+
+    HANDLERS = [
+      ProfileDir, ChefAuditDir, ServerspecDir, FlatDir
+    ].map(&:new)
+
+    def self.get_handler(paths)
+      HANDLERS.find { |x| x.handles? paths }
+    end
+  end
+end

data/lib/inspec/targets/file.rb

@@ -0,0 +1,29 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec::Targets
+  class FileHelper
+    def handles?(target)
+      File.file?(target) and target.end_with?('.rb')
+    end
+
+    def resolve(target, opts = {})
+      base = opts[:base_folder]
+      path = base.nil? ? target : File.join(base, target)
+      {
+        content: File.read(path),
+        type: opts[:as] || :test,
+        ref: path,
+      }
+    end
+
+    def resolve_all(targets, opts = {})
+      Array(targets).map do |target|
+        resolve(target, opts)
+      end
+    end
+  end
+
+  Inspec::Targets.add_module('file', FileHelper.new)
+end

data/lib/inspec/targets/folder.rb

@@ -0,0 +1,43 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'inspec/targets/dir'
+require 'inspec/targets/file'
+
+module Inspec::Targets
+  class FolderHelper
+    def handles?(target)
+      File.directory?(target)
+    end
+
+    def resolve(target)
+      # find all files in the folder
+      files = Dir[File.join(target, '**', '*')]
+      # remove the prefix
+      prefix = File.join(target, '')
+      files = files.map { |x| x.sub(prefix, '') }
+      # get the dirs helper
+      helper = DirsHelper.get_handler(files)
+      if helper.nil?
+        fail "Don't know how to handle folder #{target}"
+      end
+
+      # get all test file contents
+      file_handler = Inspec::Targets.modules['file']
+      raw_files = helper.get_filenames(files)
+      tests = file_handler.resolve_all(raw_files, base_folder: target)
+
+      libs = []
+      if helper.respond_to? :get_libraries
+        raw_libs = helper.get_libraries(files)
+        libs = file_handler.resolve_all(raw_libs,
+                                        base_folder: target, as: :library)
+      end
+
+      libs + tests
+    end
+  end
+
+  Inspec::Targets.add_module('folder', FolderHelper.new)
+end

data/lib/inspec/targets/tar.rb

@@ -0,0 +1,34 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'rubygems/package'
+require 'zlib'
+
+module Inspec::Targets
+  class TarHelper
+    def structure(input)
+      files = []
+      Gem::Package::TarReader.new(Zlib::GzipReader.open input) do |tar|
+        files = tar.map(&:full_name)
+      end
+      files
+    end
+
+    def content(input)
+      content = {}
+      Gem::Package::TarReader.new(Zlib::GzipReader.open input) do |tar|
+        tar.each do |entry|
+          if entry.directory?
+            # nothing to do
+          elsif entry.file?
+            content[entry.full_name] = entry.read
+          elsif entry.header.typeflag == '2'
+            # ignore symlinks for now
+          end
+        end
+      end
+      content
+    end
+  end
+end

data/lib/inspec/targets/url.rb

@@ -0,0 +1,39 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'uri'
+require 'tempfile'
+require 'open-uri'
+require 'inspec/targets/zip'
+
+module Inspec::Targets
+  class UrlHelper
+    def handles?(target)
+      uri = URI.parse(target)
+      return false if uri.nil? or uri.scheme.nil?
+      %{ http https }.include? uri.scheme
+    end
+
+    def resolve(target)
+      return nil unless target.start_with? 'https://github.com' and
+                        target.end_with? '.git'
+
+      url = target.sub(/.git$/, '') + '/archive/master.zip'
+      resolve_zip(url)
+    end
+
+    def resolve_zip(url)
+      zipfile = Tempfile.new('inspec-dl-')
+      zipfile.binmode
+      zipfile.write(open(url).read)
+      zipfile.rewind
+      content = ZipHelper.new.resolve(zipfile.path)
+      zipfile.close
+      zipfile.unlink
+      content
+    end
+  end
+
+  Inspec::Targets.add_module('url', UrlHelper.new)
+end

data/lib/inspec/targets/zip.rb

@@ -0,0 +1,47 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'zip'
+require 'inspec/targets/dir'
+
+module Inspec::Targets
+  class ZipHelper
+    def content(input, _filter)
+      content = []
+      ::Zip::InputStream.open(input) do |io|
+        while (entry = io.get_next_entry)
+          h = {
+            content: io.read,
+            ref: File.join(input, entry.name),
+          }
+          content.push(h)
+        end
+      end
+      content
+    end
+
+    def structure(input)
+      files = []
+      ::Zip::InputStream.open(input) do |io|
+        while (entry = io.get_next_entry)
+          files.push(entry.name)
+        end
+      end
+      files
+    end
+
+    def resolve(path)
+      files = structure(path)
+      helper = DirsHelper.get_handler(files)
+      if helper.nil?
+        fail "Don't know how to handle folder #{path}"
+      end
+      # get all file contents
+      # @TODO
+      _file_handler = Inspec::Targets.modules['file']
+      test_files = helper.get_filenames(files)
+      content(path, test_files)
+    end
+  end
+end

data/lib/inspec/version.rb

@@ -0,0 +1,7 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+module Inspec
+  VERSION = '0.9.0'
+end

data/lib/matchers/matchers.rb

@@ -0,0 +1,221 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# author: Christoph Hartmann
+# license: All rights reserved
+
+RSpec::Matchers.define :be_readable do
+  match do |file|
+    file.readable?(@by, @by_user)
+  end
+
+  chain :by do |by|
+    @by = by
+  end
+
+  chain :by_user do |by_user|
+    @by_user = by_user
+  end
+
+  description do
+    res = 'be readable'
+    res += " by #{@by}" unless @by.nil?
+    res += " by user #{@by_user}" unless @by_user.nil?
+    res
+  end
+end
+
+RSpec::Matchers.define :be_writable do
+  match do |file|
+    file.writable?(@by, @by_user)
+  end
+
+  chain :by do |by|
+    @by = by
+  end
+
+  chain :by_user do |by_user|
+    @by_user = by_user
+  end
+
+  description do
+    res = 'be writable'
+    res += " by #{@by}" unless @by.nil?
+    res += " by user #{@by_user}" unless @by_user.nil?
+    res
+  end
+end
+
+RSpec::Matchers.define :be_executable do
+  match do |file|
+    file.executable?(@by, @by_user)
+  end
+
+  chain :by do |by|
+    @by = by
+  end
+
+  chain :by_user do |by_user|
+    @by_user = by_user
+  end
+
+  description do
+    res = 'be executable'
+    res += " by #{@by}" unless @by.nil?
+    res += " by user #{@by_user}" unless @by_user.nil?
+    res
+  end
+end
+
+# matcher to check /etc/passwd, /etc/shadow and /etc/group
+RSpec::Matchers.define :contain_legacy_plus do
+  match do |file|
+    file.content.match(/^\+:/)
+  end
+end
+
+# verifies that no entry in an array contains a value
+RSpec::Matchers.define :contain_match do |regex|
+  match do |arr|
+    arr.inject { |result, i|
+      result = i.match(regex)
+      result || i.match(/$/)
+    }
+  end
+end
+
+RSpec::Matchers.define :contain_duplicates do
+  match do |arr|
+    dup = arr.select { |element| arr.count(element) > 1 }
+    !dup.uniq.empty?
+  end
+end
+
+# for packages
+RSpec::Matchers.define :be_installed do
+  match do |package|
+    package.installed? == true
+  end
+
+  failure_message do |package|
+    "expected that `#{package}` is installed"
+  end
+
+  chain :by do
+    fail "[UNSUPPORTED] Please use the new resources 'gem', 'npm' or 'pip'."
+  end
+
+  chain :with_version do |version|
+    warn "[DEPRECATION] `with_version` is deprecated.  Please use `its(:version) { should eq '1.4.1' }` instead."
+    @version = version
+  end
+end
+
+# for services
+RSpec::Matchers.define :be_enabled do
+  match do |service|
+    service.enabled? == true
+  end
+
+  chain :with_level do |_level|
+    fail '[UNSUPPORTED] with level is not supported'
+  end
+
+  failure_message do |service|
+    "expected that `#{service}` is enabled"
+  end
+end
+
+# service resource matcher for serverspec compatibility
+# Deprecated: You should not use this matcher anymore
+RSpec::Matchers.define :be_running do
+  match do |service|
+    service.running? == true
+  end
+
+  chain :under do |_under|
+    fail '[UNSUPPORTED] under is not supported'
+  end
+
+  failure_message do |service|
+    "expected that `#{service}` is running"
+  end
+end
+
+# user resource matcher for serverspec compatibility
+# Deprecated: You should not use this matcher anymore
+RSpec::Matchers.define :belong_to_group do |compare_group|
+  match do |user|
+    warn "[DEPRECATION] `belong_to_group` is deprecated.  Please use `its(:groups) { should include('root') }` instead."
+    user.groups.include?(compare_group)
+  end
+
+  failure_message do |group|
+    "expected that the user belongs to group `#{group}`"
+  end
+end
+
+# user resource matcher for serverspec compatibility
+# Deprecated: You should not use this matcher anymore
+RSpec::Matchers.define :belong_to_primary_group do |compare_group|
+  match do |user|
+    warn "[DEPRECATION] `belong_to_primary_group` is deprecated.  Please use `its(:group) { should eq 'root' }` instead."
+    user.group == compare_group
+  end
+
+  failure_message do |group|
+    "expected that the user belongs to primary group `#{group}`"
+  end
+end
+
+# matcher to check if host is reachable
+RSpec::Matchers.define :be_reachable do
+  match do |host|
+    host.reachable? == true
+  end
+
+  chain :with do |_attr|
+    fail '[UNSUPPORTED] `with` is not supported in combination with `be_reachable`'
+  end
+
+  failure_message do |host|
+    "expected that host #{host} is reachable"
+  end
+end
+
+# matcher to check if host is resolvable
+RSpec::Matchers.define :be_resolvable do
+  match do |host|
+    host.resolvable? == true
+  end
+
+  chain :by do |_type|
+    fail "[UNSUPPORTED] `by` is not supported in combination with `be_resolvable`. Please use the following syntax `host('example.com', port: 53, proto: 'udp')`."
+  end
+
+  failure_message do |host|
+    "expected that host #{host} is resolvable"
+  end
+end
+
+# matcher for iptables
+RSpec::Matchers.define :have_rule do |rule|
+  match do |tables|
+    tables.has_rule?(rule)
+  end
+
+  chain :with_table do |_table|
+    fail "[UNSUPPORTED] `with_table` is not supported in combination with `have_rule`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
+  end
+
+  chain :with_chain do |_chain|
+    fail "[UNSUPPORTED] `with_table` is not supported in combination with `with_chain`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
+  end
+end
+
+# unsupported
+RSpec::Matchers.define :contain do |_rule|
+  match do |_resource|
+    fail "[UNSUPPORTED] `contain` matcher. Please use the following syntax `its('content') { should match('value') }`."
+  end
+end