inspec 1.0.0 → 1.35.1

data/lib/resources/file.rb

@@ -2,12 +2,24 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 require 'shellwords'
 
 module Inspec::Resources
-  class FileResource < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
+  module FilePermissionsSelector
+    def select_file_perms_style(os)
+      if os.unix?
+        UnixFilePermissions.new(inspec)
+      elsif os.windows?
+        WindowsFilePermissions.new(inspec)
+      end
+    end
+  end
+
+  class FileResource < Inspec.resource(1)
+    include FilePermissionsSelector
+    include LinuxMountParser
+
     name 'file'
     desc 'Use the file InSpec audit resource to test all system file types, including files, directories, symbolic links, named pipes, sockets, character devices, block devices, and doors.'
     example "
@@ -16,14 +28,16 @@ module Inspec::Resources
         it { should be_file }
         it { should be_readable }
         it { should be_writable }
+        it { should be_executable.by_user('root') }
         it { should be_owned_by 'root' }
         its('mode') { should cmp '0644' }
       end
     "
-    include MountParser
 
     attr_reader :file, :mount_options
     def initialize(path)
+      # select permissions style
+      @perms_provider = select_file_perms_style(inspec.os)
       @file = inspec.backend.file(path)
     end
 
@@ -46,25 +60,28 @@ module Inspec::Resources
     end
 
     def contain(*_)
-      fail 'Contain is not supported. Please use standard RSpec matchers.'
+      raise 'Contain is not supported. Please use standard RSpec matchers.'
     end
 
     def readable?(by_usergroup, by_specific_user)
       return false unless exist?
+      return skip_resource '`readable?` is not supported on your OS yet.' if @perms_provider.nil?
 
-      file_permission_granted?('r', by_usergroup, by_specific_user)
+      file_permission_granted?('read', by_usergroup, by_specific_user)
     end
 
     def writable?(by_usergroup, by_specific_user)
       return false unless exist?
+      return skip_resource '`writable?` is not supported on your OS yet.' if @perms_provider.nil?
 
-      file_permission_granted?('w', by_usergroup, by_specific_user)
+      file_permission_granted?('write', by_usergroup, by_specific_user)
     end
 
     def executable?(by_usergroup, by_specific_user)
       return false unless exist?
+      return skip_resource '`executable?` is not supported on your OS yet.' if @perms_provider.nil?
 
-      file_permission_granted?('x', by_usergroup, by_specific_user)
+      file_permission_granted?('execute', by_usergroup, by_specific_user)
     end
 
     def mounted?(expected_options = nil, identical = false)
@@ -109,35 +126,65 @@ module Inspec::Resources
 
     private
 
-    def file_permission_granted?(flag, by_usergroup, by_specific_user)
-      unless inspec.os.unix?
-        fail 'Checking file permissions is not supported on your os'
+    def file_permission_granted?(access_type, by_usergroup, by_specific_user)
+      raise '`file_permission_granted?` is not supported on your OS' if @perms_provider.nil?
+      if by_specific_user.nil? || by_specific_user.empty?
+        @perms_provider.check_file_permission_by_mask(file, access_type, by_usergroup, by_specific_user)
+      else
+        @perms_provider.check_file_permission_by_user(access_type, by_specific_user, source_path)
       end
+    end
+  end
 
-      if by_specific_user.nil? || by_specific_user.empty?
-        usergroup = usergroup_for(by_usergroup, by_specific_user)
-        check_file_permission_by_mask(usergroup, flag)
+  class FilePermissions
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+  end
+
+  class UnixFilePermissions < FilePermissions
+    def permission_flag(access_type)
+      case access_type
+      when 'read'
+        'r'
+      when 'write'
+        'w'
+      when 'execute'
+        'x'
       else
-        check_file_permission_by_user(by_specific_user, flag)
+        raise 'Invalid access_type provided'
       end
     end
 
-    def check_file_permission_by_mask(usergroup, flag)
-      mask = file.unix_mode_mask(usergroup, flag)
-      fail 'Invalid usergroup/owner provided' if mask.nil?
+    def usergroup_for(usergroup, specific_user)
+      if usergroup == 'others'
+        'other'
+      elsif (usergroup.nil? || usergroup.empty?) && specific_user.nil?
+        'all'
+      else
+        usergroup
+      end
+    end
 
+    def check_file_permission_by_mask(file, access_type, usergroup, specific_user)
+      usergroup = usergroup_for(usergroup, specific_user)
+      flag = permission_flag(access_type)
+      mask = file.unix_mode_mask(usergroup, flag)
+      raise 'Invalid usergroup/owner provided' if mask.nil?
       (file.mode & mask) != 0
     end
 
-    def check_file_permission_by_user(user, flag)
+    def check_file_permission_by_user(access_type, user, path)
+      flag = permission_flag(access_type)
       if inspec.os.linux?
-        perm_cmd = "su -s /bin/sh -c \"test -#{flag} #{source_path}\" #{user}"
+        perm_cmd = "su -s /bin/sh -c \"test -#{flag} #{path}\" #{user}"
       elsif inspec.os.bsd? || inspec.os.solaris?
-        perm_cmd = "sudo -u #{user} test -#{flag} #{source_path}"
+        perm_cmd = "sudo -u #{user} test -#{flag} #{path}"
       elsif inspec.os.aix?
-        perm_cmd = "su #{user} -c test -#{flag} #{source_path}"
+        perm_cmd = "su #{user} -c test -#{flag} #{path}"
       elsif inspec.os.hpux?
-        perm_cmd = "su #{user} -c \"test -#{flag} #{source_path}\""
+        perm_cmd = "su #{user} -c \"test -#{flag} #{path}\""
       else
         return skip_resource 'The `file` resource does not support `by_user` on your OS.'
       end
@@ -145,15 +192,26 @@ module Inspec::Resources
       cmd = inspec.command(perm_cmd)
       cmd.exit_status == 0 ? true : false
     end
+  end
 
-    def usergroup_for(usergroup, specific_user)
-      if usergroup == 'others'
-        'other'
-      elsif (usergroup.nil? || usergroup.empty?) && specific_user.nil?
-        'all'
-      else
-        usergroup
-      end
+  class WindowsFilePermissions < FilePermissions
+    def check_file_permission_by_mask(_file, _access_type, _usergroup, _specific_user)
+      raise '`check_file_permission_by_mask` is not supported on Windows'
+    end
+
+    def check_file_permission_by_user(access_type, user, path)
+      access_rule = case access_type
+                    when 'read'
+                      '@(\'FullControl\', \'Modify\', \'ReadAndExecute\', \'Read\', \'ListDirectory\')'
+                    when 'write'
+                      '@(\'FullControl\', \'Modify\', \'Write\')'
+                    when 'execute'
+                      '@(\'FullControl\', \'Modify\', \'ReadAndExecute\', \'ExecuteFile\')'
+                    else
+                      raise 'Invalid access_type provided'
+                    end
+      cmd = inspec.command("@(@((Get-Acl '#{path}').access | Where-Object {$_.AccessControlType -eq 'Allow' -and $_.IdentityReference -eq '#{user}' }) | Where-Object {($_.FileSystemRights.ToString().Split(',') | % {$_.trim()} | ? {#{access_rule} -contains $_}) -ne $null}) | measure | % { $_.Count }")
+      cmd.stdout.chomp == '0' ? false : true
     end
   end
 end

data/lib/resources/gem.rb

@@ -1,6 +1,7 @@
 # encoding: utf-8
 # author: Christoph Hartmann
 # author: Dominik Richter
+# author: Joe Nuspl
 
 module Inspec::Resources
   class GemPackage < Inspec.resource(1)
@@ -13,23 +14,42 @@ module Inspec::Resources
       end
     "
 
-    def initialize(package_name)
+    attr_reader :gem_binary
+
+    def initialize(package_name, gem_binary = nil)
       @package_name = package_name
+      @gem_binary = case gem_binary
+                    when nil
+                      'gem'
+                    when :chef
+                      if inspec.os.windows?
+                        'c:\opscode\chef\embedded\bin\gem.bat'
+                      else
+                        '/opt/chef/embedded/bin/gem'
+                      end
+                    when :chef_server
+                      '/opt/opscode/embedded/bin/gem'
+                    else
+                      gem_binary
+                    end
+      skip_resource 'Unable to retrieve gem information' if info.empty?
     end
 
     def info
       return @info if defined?(@info)
 
-      cmd = inspec.command("gem list --local -a -q \^#{@package_name}\$")
+      cmd = inspec.command("#{@gem_binary} list --local -a -q \^#{@package_name}\$")
+      return {} unless cmd.exit_status.zero?
+
+      # extract package name and version
+      # parses data like winrm (1.3.4, 1.3.3)
+      params = /^\s*([^\(]*?)\s*\((.*?)\)\s*$/.match(cmd.stdout.chomp)
       @info = {
-        installed: cmd.exit_status == 0,
+        installed: !params.nil?,
         type: 'gem',
       }
       return @info unless @info[:installed]
 
-      # extract package name and version
-      # parses data like winrm (1.3.4, 1.3.3)
-      params = /^\s*([^\(]*?)\s*\((.*?)\)\s*$/.match(cmd.stdout.chomp)
       versions = params[2].split(',')
       @info[:name] = params[1]
       @info[:version] = versions[0]

data/lib/resources/groups.rb

@@ -90,7 +90,6 @@ module Inspec::Resources
 
     def initialize(groupname)
       @group = groupname
-      @group = @group.downcase unless inspec.os.windows?
 
       # select group manager
       @group_provider = select_group_manager(inspec.os)
@@ -99,18 +98,18 @@ module Inspec::Resources
 
     # verifies if a group exists
     def exists?
-      group_info.entries.size > 0
+      !group_info.entries.empty?
     end
 
     def gid
       gids = group_info.gids
-      if gids.size == 0
+      if gids.empty?
         nil
       # the default case should be one group
       elsif gids.size == 1
         gids.entries[0]
       else
-        fail 'found more than one group with the same name, please use `groups` resource'
+        raise 'found more than one group with the same name, please use `groups` resource'
       end
     end
 
@@ -144,7 +143,7 @@ module Inspec::Resources
     end
 
     def groups
-      fail 'group provider must implement the `groups` method'
+      raise 'group provider must implement the `groups` method'
     end
   end
 

data/lib/resources/grub_conf.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # author: Thomas Cate
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
@@ -38,11 +37,11 @@ class GrubConfig < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
       @conf_path = path || '/boot/grub/grub.cfg'
       @defaults_path = '/etc/default/grub'
       @version = 'grub2'
-    elsif os[:name] == 'amazon' # rubocop:disable Style/GuardClause
+    elsif os[:name] == 'amazon'
       @conf_path = path || '/etc/grub.conf'
       @version = 'legacy'
     else
-      fail UnknownGrubConfig
+      raise UnknownGrubConfig
     end
   end
 
@@ -145,7 +144,7 @@ class GrubConfig < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
 
     content = file.content
 
-    if content.empty? && file.size > 0
+    if content.empty? && !file.empty?
       skip_resource "Can't read file '#{@conf_path}'"
       return @params = {}
     end

data/lib/resources/host.rb

@@ -10,7 +10,7 @@
 # end
 #
 # To verify a hostname with protocol and port
-# describe host('example.com', port: 53, proto: 'udp') do
+# describe host('example.com', port: 443, protocol: 'tcp') do
 #   it { should be_reachable }
 # end
 #
@@ -24,6 +24,8 @@
 #   it { should be_resolvable.by('dns') }
 # end
 
+require 'resolv'
+
 module Inspec::Resources
   class Host < Inspec.resource(1)
     name 'host'
@@ -31,26 +33,51 @@ module Inspec::Resources
     example "
       describe host('example.com') do
         it { should be_reachable }
+        it { should be_resolvable }
+        its('ipaddress') { should include '12.34.56.78' }
       end
 
-      describe host('example.com', port: '80') do
+      describe host('example.com', port: '80', protocol: 'tcp') do
         it { should be_reachable }
       end
     "
 
+    attr_reader :hostname, :port, :protocol
+
     def initialize(hostname, params = {})
       @hostname = hostname
-      @port = params[:port]   || nil
-      @proto = params[:proto] || nil
+      @port = params[:port]
+
+      if params[:proto]
+        warn '[DEPRECATION] The `proto` parameter is deprecated. Use `protocol` instead.'
+        @protocol = params[:proto]
+      else
+        @protocol = params.fetch(:protocol, 'icmp')
+      end
+
+      return skip_resource 'Invalid protocol: only `tcp` and `icmp` protocols are support for the `host` resource.' unless
+        %w{icmp tcp}.include?(@protocol)
 
       @host_provider = nil
       if inspec.os.linux?
         @host_provider = LinuxHostProvider.new(inspec)
       elsif inspec.os.windows?
         @host_provider = WindowsHostProvider.new(inspec)
+      elsif inspec.os.darwin?
+        @host_provider = DarwinHostProvider.new(inspec)
       else
         return skip_resource 'The `host` resource is not supported on your OS yet.'
       end
+
+      missing_requirements = @host_provider.missing_requirements(protocol)
+      unless missing_requirements.empty?
+        return skip_resource "The following requirements are not met for this resource: #{missing_requirements.join(', ')}"
+      end
+    end
+
+    def proto
+      warn '[DEPRECATION] The `proto` method is deprecated. Use `protocol` instead.'
+      protocol
     end
 
     # if we get the IP address, the host is resolvable
@@ -59,9 +86,25 @@ module Inspec::Resources
       resolve.nil? || resolve.empty? ? false : true
     end
 
-    def reachable?(port = nil, proto = nil, timeout = nil)
-      fail "Use `host` resource with host('#{@hostname}', port: #{port}, proto: '#{proto}') parameters." if !port.nil? || !proto.nil? || !timeout.nil?
-      ping.nil? ? false : ping
+    def reachable?
+      # ping checks do not require port or protocol
+      return ping.fetch(:success, false) if protocol == 'icmp'
+
+      # if either port or protocol are specified but not both, we cannot proceed.
+      if port.nil? || protocol.nil?
+        raise "Protocol required with port. Use `host` resource with host('#{hostname}', port: 1234, proto: 'tcp') parameters." if port.nil? || protocol.nil?
+      end
+
+      # perform the protocol-specific reachability test
+      ping.fetch(:success, false)
+    end
+
+    def connection
+      ping[:connection]
+    end
+
+    def socket
+      ping[:socket]
     end
 
     # returns all A records of the IP address, will return an array
@@ -70,19 +113,21 @@ module Inspec::Resources
     end
 
     def to_s
-      "Host #{@hostname}"
+      "Host #{hostname}"
     end
 
     private
 
     def ping
       return @ping_cache if defined?(@ping_cache)
-      @ping_cache = @host_provider.ping(@hostname, @port, @proto) if !@host_provider.nil?
+      return {} if @host_provider.nil?
+
+      @ping_cache = @host_provider.ping(hostname, port, protocol)
     end
 
     def resolve
       return @ip_cache if defined?(@ip_cache)
-      @ip_cache = @host_provider.resolve(@hostname) if !@host_provider.nil?
+      @ip_cache = @host_provider.resolve(hostname) if !@host_provider.nil?
     end
   end
 
@@ -91,25 +136,128 @@ module Inspec::Resources
     def initialize(inspec)
       @inspec = inspec
     end
+
+    def missing_requirements(_protocol)
+      # each provider can return an array of missing requirements that can
+      # be enumerated in a skip_resource message
+      []
+    end
   end
 
-  class LinuxHostProvider < HostProvider
-    # ping is difficult to achieve, since we are not sure
-    def ping(hostname, _port = nil, _proto = nil)
-      # fall back to ping, but we can only test ICMP packages with ping
-      # therefore we have to skip the test, if we do not have everything on the node to run the test
-      ping = inspec.command("ping -w 1 -c 1 #{hostname}")
-      ping.exit_status.to_i != 0 ? false : true
+  class UnixHostProvider < HostProvider
+    def resolve_with_dig(hostname)
+      addresses = []
+
+      # look for IPv4 addresses
+      cmd = inspec.command("dig +short A #{hostname}")
+      cmd.stdout.lines.each do |line|
+        matched = line.chomp.match(Resolv::IPv4::Regex)
+        addresses << matched.to_s unless matched.nil?
+      end
+
+      # look for IPv6 addresses
+      cmd = inspec.command("dig +short AAAA #{hostname}")
+      cmd.stdout.lines.each do |line|
+        matched = line.chomp.match(Resolv::IPv6::Regex)
+        addresses << matched.to_s unless matched.nil?
+      end
+
+      addresses.empty? ? nil : addresses
+    end
+
+    def resolve_with_getent(hostname)
+      cmd = inspec.command("getent ahosts #{hostname}")
+      return nil unless cmd.exit_status.to_i.zero?
+
+      # getent ahosts output is formatted like so:
+      # $ getent ahosts www.google.com
+      # 172.217.8.4     STREAM www.google.com
+      # 172.217.8.4     DGRAM
+      # 172.217.8.4     RAW
+      # 2607:f8b0:4004:803::2004 STREAM
+      # 2607:f8b0:4004:803::2004 DGRAM
+      # 2607:f8b0:4004:803::2004 RAW
+      addresses = []
+      cmd.stdout.lines.each do |line|
+        ip, = line.split(/\s+/, 2)
+        next unless ip.match(Resolv::IPv4::Regex) || ip.match(Resolv::IPv6::Regex)
+        addresses << ip unless addresses.include?(ip)
+      end
+
+      addresses
+    end
+  end
+
+  class DarwinHostProvider < UnixHostProvider
+    def missing_requirements(protocol)
+      missing = []
+
+      if protocol == 'tcp'
+        missing << 'netcat must be installed' unless inspec.command('nc').exist?
+      end
+
+      missing
+    end
+
+    def ping(hostname, port, protocol)
+      if protocol == 'tcp'
+        resp = inspec.command("nc -vz -G 1 #{hostname} #{port}")
+      else
+        resp = inspec.command("ping -W 1 -c 1 #{hostname}")
+      end
+
+      {
+        success: resp.exit_status.to_i.zero?,
+        connection: resp.stderr,
+        socket: resp.stdout,
+      }
     end
 
     def resolve(hostname)
-      # TODO: we rely on getent hosts for now, but it prefers to return IPv6, only then IPv4
-      cmd = inspec.command("getent hosts #{hostname}")
-      return nil if cmd.exit_status.to_i != 0
+      resolve_with_dig(hostname)
+    end
+  end
+
+  class LinuxHostProvider < UnixHostProvider
+    def missing_requirements(protocol)
+      missing = []
 
-      # extract ip adress
-      resolve = /^\s*(?<ip>\S+)\s+(.*)\s*$/.match(cmd.stdout.chomp)
-      [resolve[1]] if resolve
+      if protocol == 'tcp' && (!inspec.command('nc').exist? && !inspec.command('ncat').exist?)
+        missing << 'netcat must be installed'
+      end
+
+      missing
+    end
+
+    def ping(hostname, port, protocol)
+      if protocol == 'tcp'
+        resp = inspec.command(tcp_check_command(hostname, port))
+      else
+        # fall back to ping, but we can only test ICMP packages with ping
+        resp = inspec.command("ping -w 1 -c 1 #{hostname}")
+      end
+
+      {
+        success: resp.exit_status.to_i.zero?,
+        connection: resp.stderr,
+        socket: resp.stdout,
+      }
+    end
+
+    def tcp_check_command(hostname, port)
+      if inspec.command('nc').exist?
+        base_cmd = 'nc'
+      elsif inspec.command('ncat').exist?
+        base_cmd = 'ncat'
+      else
+        return
+      end
+
+      "echo | #{base_cmd} -v -w 1 #{hostname} #{port}"
+    end
+
+    def resolve(hostname)
+      resolve_with_getent(hostname)
     end
   end
 
@@ -118,13 +266,10 @@ module Inspec::Resources
   # @see http://blogs.technet.com/b/josebda/archive/2015/04/18/windows-powershell-equivalents-for-common-networking-commands-ipconfig-ping-nslookup.aspx
   # @see http://blogs.technet.com/b/heyscriptingguy/archive/2014/03/19/creating-a-port-scanner-with-windows-powershell.aspx
   class WindowsHostProvider < HostProvider
-    def ping(hostname, port = nil, proto = nil)
-      # TODO: abort if we cannot run it via udp
-      return nil if proto == 'udp'
-
+    def ping(hostname, port = nil, _proto = nil)
       # ICMP: Test-NetConnection www.microsoft.com
       # TCP and port: Test-NetConnection -ComputerName www.microsoft.com -RemotePort 80
-      request = "Test-NetConnection -ComputerName #{hostname}"
+      request = "Test-NetConnection -ComputerName #{hostname} -WarningAction SilentlyContinue"
       request += " -RemotePort #{port}" unless port.nil?
       request += '| Select-Object -Property ComputerName, TcpTestSucceeded, PingSucceeded | ConvertTo-Json'
       cmd = inspec.command(request)
@@ -132,15 +277,10 @@ module Inspec::Resources
       begin
         ping = JSON.parse(cmd.stdout)
       rescue JSON::ParserError => _e
-        return nil
+        return {}
       end
 
-      # Logic being if you provided a port you wanted to check it was open
-      if port.nil?
-        ping['PingSucceeded']
-      else
-        ping['TcpTestSucceeded']
-      end
+      { success: port.nil? ? ping['PingSucceeded'] : ping['TcpTestSucceeded'] }
     end
 
     def resolve(hostname)