inspec 1.0.0 → 1.35.1

data/lib/resources/dh_params.rb

@@ -0,0 +1,84 @@
+# encoding: utf-8
+# author: Doc Walker
+
+require 'openssl'
+
+class DhParams < Inspec.resource(1)
+  name 'dh_params'
+
+  desc '
+    Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH)
+    parameters.
+  '
+
+  example "
+    describe dh_params('/path/to/file.dh_pem') do
+      it { should be_dh_params }
+      it { should be_valid }
+      its('generator') { should eq 2 }
+      its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+      its('prime_length') { should eq 2048 }
+      its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+      its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
+    end
+  "
+
+  def initialize(filename)
+    @dh_params_path = filename
+    file = inspec.file(@dh_params_path)
+    return skip_resource 'Unable to find DH parameters file ' \
+      "#{@dh_params_path}" unless file.exist?
+
+    begin
+      @dh_params = OpenSSL::PKey::DH.new file.content
+    rescue
+      @dh_params = nil
+      return skip_resource "Unable to load DH parameters #{@dh_params_path}"
+    end
+  end
+
+  # it { should be_dh_params }
+  def dh_params?
+    !@dh_params.nil?
+  end
+
+  # its('generator') { should eq 2 }
+  def generator
+    return if @dh_params.nil?
+    @dh_params.g.to_i
+  end
+
+  # its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+  def modulus
+    return if @dh_params.nil?
+    '00:' + @dh_params.p.to_s(16).downcase.scan(/.{2}/).join(':')
+  end
+
+  # its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+  def pem
+    return if @dh_params.nil?
+    @dh_params.to_pem
+  end
+
+  # its('prime_length') { should be 2048 }
+  def prime_length
+    return if @dh_params.nil?
+    @dh_params.p.num_bits
+  end
+
+  # its('text') { should eq 'human-readable-text' }
+  def text
+    return if @dh_params.nil?
+    @dh_params.to_text
+  end
+
+  # it { should be_valid }
+  def valid?
+    return if @dh_params.nil?
+    @dh_params.params_ok?
+  end
+
+  def to_s
+    "dh_params #{@dh_params_path}"
+  end
+end

data/lib/resources/directory.rb

@@ -13,9 +13,13 @@ module Inspec::Resources
         it { should be_directory }
       end
     "
-  end
 
-  def to_s
-    "Directory #{@path}"
+    def exist?
+      file.exist? && file.directory?
+    end
+
+    def to_s
+      "Directory #{source_path}"
+    end
   end
 end

data/lib/resources/docker.rb

@@ -0,0 +1,198 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+#
+# author: Christoph Hartmann
+# author: Patrick Muench
+# author: Dominik Richter
+
+require 'utils/filter'
+require 'hashie/mash'
+
+module Inspec::Resources
+  class DockerContainerFilter
+    # use filtertable for containers
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:commands,       field: 'command')
+          .add(:ids,            field: 'id')
+          .add(:images,         field: 'image')
+          .add(:labels,         field: 'labels')
+          .add(:local_volumes,  field: 'localvolumes')
+          .add(:mounts,         field: 'mounts')
+          .add(:names,          field: 'names')
+          .add(:networks,       field: 'networks')
+          .add(:ports,          field: 'ports')
+          .add(:running_for,    field: 'runningfor')
+          .add(:sizes,          field: 'size')
+          .add(:status,         field: 'status')
+          .add(:exists?) { |x| !x.entries.empty? }
+          .add(:running?) { |x|
+            x.where { status.downcase.start_with?('up') }
+          }
+    filter.connect(self, :containers)
+
+    attr_reader :containers
+    def initialize(containers)
+      @containers = containers
+    end
+  end
+
+  class DockerImageFilter
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:ids,              field: 'id')
+          .add(:repositories,     field: 'repository')
+          .add(:tags,             field: 'tag')
+          .add(:sizes,            field: 'size')
+          .add(:digests,          field: 'digest')
+          .add(:created,          field: 'createdat')
+          .add(:created_since,    field: 'createdsize')
+          .add(:exists?) { |x| !x.entries.empty? }
+    filter.connect(self, :images)
+
+    attr_reader :images
+    def initialize(images)
+      @images = images
+    end
+  end
+
+  # This resource helps to parse information from the docker host
+  # For compatability with Serverspec we also offer the following resouses:
+  # - docker_container
+  # - docker_image
+  class Docker < Inspec.resource(1)
+    name 'docker'
+
+    desc "
+      A resource to retrieve information about docker
+    "
+
+    example "
+      describe docker.containers do
+        its('images') { should_not include 'u12:latest' }
+      end
+
+      describe docker.images do
+        its('repositories') { should_not include 'inssecure_image' }
+      end
+
+      describe docker.version do
+        its('Server.Version') { should cmp >= '1.12'}
+        its('Client.Version') { should cmp >= '1.12'}
+      end
+
+      describe docker.object(id) do
+        its('Configuration.Path') { should eq 'value' }
+      end
+
+      docker.containers.ids.each do |id|
+        # call docker inspect for a specific container id
+        describe docker.object(id) do
+          its(%w(HostConfig Privileged)) { should cmp false }
+          its(%w(HostConfig Privileged)) { should_not cmp true }
+        end
+      end
+    "
+
+    def containers
+      DockerContainerFilter.new(parse_containers)
+    end
+
+    def images
+      DockerImageFilter.new(parse_images)
+    end
+
+    def version
+      return @version if defined?(@version)
+      data = {}
+      cmd = inspec.command('docker version --format \'{{ json . }}\'')
+      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
+      @version = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    def info
+      return @info if defined?(@info)
+      data = {}
+      # docke info format is only supported for Docker 17.03+
+      cmd = inspec.command('docker info --format \'{{ json . }}\'')
+      data = JSON.parse(cmd.stdout) if cmd.exit_status == 0
+      @info = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    # returns information about docker objects
+    def object(id)
+      return @inspect if defined?(@inspect)
+      data = JSON.parse(inspec.command("docker inspect #{id}").stdout)
+      data = data[0] if data.is_a?(Array)
+      @inspect = Hashie::Mash.new(data)
+    rescue JSON::ParserError => _e
+      return Hashie::Mash.new({})
+    end
+
+    def to_s
+      'Docker Host'
+    end
+
+    private
+
+    def parse_containers
+      # @see https://github.com/moby/moby/issues/20625, works for docker 1.13+
+      # raw_containers = inspec.command('docker ps -a --no-trunc --format \'{{ json . }}\'').stdout
+      # therefore we stick with older approach
+      labels = %w{Command CreatedAt ID Image Labels  Mounts Names Ports RunningFor Size Status}
+
+      # Networks LocalVolumes work with 1.13+ only
+      if !version.empty? && Gem::Version.new(version['Client']['Version']) >= Gem::Version.new('1.13')
+        labels.push('Networks')
+        labels.push('LocalVolumes')
+      end
+      # build command
+      format = labels.map { |label| "\"#{label}\": {{json .#{label}}}" }
+      raw_containers = inspec.command("docker ps -a --no-trunc --format '{#{format.join(', ')}}'").stdout
+      ps = []
+      # since docker is not outputting valid json, we need to parse each row
+      raw_containers.each_line { |entry|
+        j = JSON.parse(entry)
+        # convert all keys to lower_case to work well with ruby and filter table
+        j = j.map { |k, v|
+          [k.downcase, v]
+        }.to_h
+
+        # ensure all keys are there
+        j = ensure_container_keys(j)
+        ps.push(j)
+      }
+      ps
+    rescue JSON::ParserError => _e
+      warn 'Could not parse `docker ps` output'
+      []
+    end
+
+    def ensure_container_keys(entry)
+      %w{Command CreatedAt ID Image Labels  Mounts Names Ports RunningFor Size Status Networks LocalVolumes}.each { |key|
+        entry[key.downcase] = nil if !entry.key?(key.downcase)
+      }
+      entry
+    end
+
+    def parse_images
+      # docker does not support the `json .` function here, therefore we need to emulate that behavior.
+      raw_images = inspec.command('docker images -a --no-trunc --format \'{ "id": {{json .ID}}, "repository": {{json .Repository}}, "tag": {{json .Tag}}, "size": {{json .Size}}, "digest": {{json .Digest}}, "createdat": {{json .CreatedAt}}, "createdsize": {{json .CreatedSince}} }\'').stdout
+      c_images = []
+      raw_images.each_line { |entry|
+        c_images.push(JSON.parse(entry))
+      }
+      c_images
+    rescue JSON::ParserError => _e
+      warn 'Could not parse `docker images` output'
+      []
+    end
+  end
+end

data/lib/resources/docker_container.rb

@@ -0,0 +1,114 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+#
+# author: Christoph Hartmann
+# author: Patrick Muench
+# author: Dominik Richter
+
+module Inspec::Resources
+  class DockerContainer < Inspec.resource(1)
+    name 'docker_container'
+    desc ''
+    example "
+      describe docker_container('an-echo-server') do
+        it { should exist }
+        it { should be_running }
+        its('id') { should_not eq '' }
+        its('image') { should eq 'busybox:latest' }
+        its('repo') { should eq 'busybox' }
+        its('tag') { should eq 'latest' }
+        its('ports') { should eq [] }
+        its('command') { should eq 'nc -ll -p 1234 -e /bin/cat' }
+      end
+
+      describe docker_container(id: 'e2c52a183358') do
+        it { should exist }
+        it { should be_running }
+      end
+    "
+
+    def initialize(opts = {})
+      # if a string is provided, we expect it is the name
+      if opts.is_a?(String)
+        @opts = { name: opts }
+      else
+        @opts = opts
+      end
+    end
+
+    def exist?
+      container_info.exists?
+    end
+
+    # is allways returning the full id
+    def id
+      container_info.ids[0] if container_info.entries.length == 1
+    end
+
+    def running?
+      status.downcase.start_with?('up') if container_info.entries.length == 1
+    end
+
+    def status
+      container_info.status[0] if container_info.entries.length == 1
+    end
+
+    def labels
+      container_info.labels[0] if container_info.entries.length == 1
+    end
+
+    def ports
+      container_info.ports[0] if container_info.entries.length == 1
+    end
+
+    def command
+      if container_info.entries.length == 1
+        cmd = container_info.commands[0]
+        cmd.slice(1, cmd.length - 2)
+      end
+    end
+
+    def image
+      container_info.images[0] if container_info.entries.length == 1
+    end
+
+    def repo
+      return if image.nil? || image_name_from_image.nil?
+      if image.include?('/')                       # host:port/ubuntu:latest
+        repo_part, image_part = image.split('/')   # host:port, ubuntu:latest
+        repo_part + '/' + image_part.split(':')[0] # host:port + / + ubuntu
+      else
+        image_name_from_image.split(':')[0]
+      end
+    end
+
+    def tag
+      return if image_name_from_image.nil?
+      image_name_from_image.split(':')[1]
+    end
+
+    def to_s
+      name = @opts[:name] || @opts[:id]
+      "Docker Container #{name}"
+    end
+
+    private
+
+    def image_name_from_image
+      return if image.nil?
+      # possible image names include:
+      #   alpine
+      #   ubuntu:14.04
+      #   repo.example.com:5000/ubuntu
+      #   repo.example.com:5000/ubuntu:1404
+      image.include?('/') ? image.split('/')[1] : image
+    end
+
+    def container_info
+      return @info if defined?(@info)
+      opts = @opts
+      @info = inspec.docker.containers.where { names == opts[:name] || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id]))) }
+    end
+  end
+end

data/lib/resources/docker_image.rb

@@ -0,0 +1,96 @@
+# encoding: utf-8
+#
+# Copyright 2017, Christoph Hartmann
+#
+# author: Christoph Hartmann
+# author: Patrick Muench
+# author: Dominik Richter
+
+module Inspec::Resources
+  class DockerImage < Inspec.resource(1)
+    name 'docker_image'
+    desc ''
+    example "
+      describe docker_image('alpine:latest') do
+        it { should exist }
+        its('id') { should_not eq '' }
+        its('image') { should eq 'alpine:latest' }
+        its('repo') { should eq 'alpine' }
+        its('tag') { should eq 'latest' }
+      end
+
+      describe docker_image('alpine:latest') do
+        it { should exist }
+      end
+
+      describe docker_image(id: '4a415e366388') do
+        it { should exist }
+      end
+    "
+
+    def initialize(opts = {})
+      # do sanitizion of input values
+      o = opts.dup
+      o = { image: opts } if opts.is_a?(String)
+      @opts = sanitize_options(o)
+    end
+
+    def exist?
+      image_info.exists?
+    end
+
+    def id
+      image_info.ids[0] if image_info.entries.size == 1
+    end
+
+    def image
+      "#{repo}:#{tag}" if image_info.entries.size == 1
+    end
+
+    def repo
+      image_info.repositories[0] if image_info.entries.size == 1
+    end
+
+    def tag
+      image_info.tags[0] if image_info.entries.size == 1
+    end
+
+    def to_s
+      img = @opts[:image] || @opts[:id]
+      "Docker Image #{img}"
+    end
+
+    private
+
+    def sanitize_options(opts)
+      if !opts[:image].nil?
+        if !opts[:image].index(':').nil?
+          repo, tag = opts[:image].split(':')
+        else
+          opts[:repo] = opts[:image]
+          opts[:image] = nil
+        end
+        opts[:repo] ||= repo
+        opts[:tag] ||= tag
+      end
+
+      if !opts[:id].nil?
+        if opts[:id].index(':').nil?
+          opts[:id] = 'sha256:' + opts[:id]
+        end
+      end
+
+      opts[:tag] ||= 'latest'
+      opts[:image] ||= "#{opts[:repo]}:#{opts[:tag]}" unless opts[:repo].nil?
+      opts
+    end
+
+    def image_info
+      return @info if defined?(@info)
+      opts = @opts
+      @info = inspec.docker.images.where {
+        (repository == opts[:repo] && tag == opts[:tag]) || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id])))
+      }
+    end
+  end
+end

data/lib/resources/etc_group.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 # The file format consists of
 # - group name
@@ -107,7 +106,7 @@ module Inspec::Resources
       # iterate over each line and filter comments
       @content.split("\n").each_with_object([]) do |line, lines|
         grp_info = parse_group_line(line)
-        lines.push(grp_info) if !grp_info.nil? && grp_info.size > 0
+        lines.push(grp_info) if !grp_info.nil? && !grp_info.empty?
       end
     end
 
@@ -119,7 +118,7 @@ module Inspec::Resources
       line, _idx_nl = parse_comment_line(line, opts)
       x = line.split(':')
       # abort if we have an empty or comment line
-      return nil if x.size == 0
+      return nil if x.empty?
       # map data
       {
         'name' => x.at(0), # Name of the group.

data/lib/resources/etc_hosts.rb

@@ -0,0 +1,81 @@
+# encoding: utf-8
+# author: Matthew Dromazos
+
+require 'utils/parser'
+
+class EtcHosts < Inspec.resource(1)
+  name 'etc_hosts'
+  desc 'Use the etc_hosts InSpec audit resource to find an
+    ip_address and its associated hosts'
+  example "
+    describe etc_hosts.where { ip_address == '127.0.0.1' } do
+      its('ip_address') { should cmp '127.0.0.1' }
+      its('primary_name') { should cmp 'localhost' }
+      its('all_host_names') { should eq [['localhost', 'localhost.localdomain', 'localhost4', 'localhost4.localdomain4']] }
+    end
+  "
+
+  attr_reader :params
+
+  include CommentParser
+
+  def initialize(hosts_path = nil)
+    return skip_resource 'The `etc_hosts` resource is not supported on your OS.' unless inspec.os.linux? || inspec.os.windows?
+    @conf_path      = hosts_path || default_hosts_file_path
+    @content        = nil
+    @params         = nil
+    read_content
+  end
+
+  filter = FilterTable.create
+  filter.add_accessor(:where)
+        .add_accessor(:entries)
+        .add(:ip_address,     field: 'ip_address')
+        .add(:primary_name,   field: 'primary_name')
+        .add(:all_host_names, field: 'all_host_names')
+
+  filter.connect(self, :params)
+
+  private
+
+  def default_hosts_file_path
+    inspec.os.windows? ? 'C:\windows\system32\drivers\etc\hosts' : '/etc/hosts'
+  end
+
+  def read_content
+    @content = ''
+    @params  = {}
+    @content = read_file(@conf_path)
+    @params  = parse_conf(@content)
+  end
+
+  def parse_conf(content)
+    content.map do |line|
+      data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+      parse_line(data) unless data == ''
+    end.compact
+  end
+
+  def parse_line(line)
+    line_parts = line.split
+    return nil unless line_parts.length >= 2
+    {
+      'ip_address'     => line_parts[0],
+      'primary_name'   => line_parts[1],
+      'all_host_names' => line_parts[1..-1],
+    }
+  end
+
+  def read_file(conf_path = @conf_path)
+    file = inspec.file(conf_path)
+    if !file.file?
+      return skip_resource "Can't find file. \"#{@conf_path}\""
+    end
+
+    raw_conf = file.content
+    if raw_conf.empty? && !file.empty?
+      return skip_resource("Could not read file contents\" #{@conf_path}\"")
+    end
+    raw_conf.lines
+  end
+end