inspec 1.0.0 → 1.35.1

data/lib/resources/http.rb

@@ -0,0 +1,73 @@
+# encoding: utf-8
+# copyright: 2017, Criteo
+# copyright: 2017, Chef Software Inc
+# author: Guilhem Lettron, Christoph Hartmann
+# license: Apache v2
+
+require 'faraday'
+require 'hashie'
+
+module Inspec::Resources
+  class Http < Inspec.resource(1)
+    name 'http'
+    desc 'Use the http InSpec audit resource to test http call.'
+    example "
+      describe http('http://localhost:8080/ping', auth: {user: 'user', pass: 'test'}, params: {format: 'html'}) do
+        its('status') { should cmp 200 }
+        its('body') { should cmp 'pong' }
+        its('headers.Content-Type') { should cmp 'text/html' }
+      end
+
+      describe http('http://example.com/ping').headers do
+        its('Content-Length') { should cmp 258 }
+        its('Content-Type') { should cmp 'text/html; charset=UTF-8' }
+      end
+    "
+
+    def initialize(url, opts = {})
+      @url = url
+      @method = opts.fetch(:method, 'GET')
+      @params = opts.fetch(:params, nil)
+      @auth = opts.fetch(:auth, {})
+      @headers = opts.fetch(:headers, {})
+      @data = opts.fetch(:data, nil)
+      @open_timeout = opts.fetch(:open_timeout, 60)
+      @read_timeout = opts.fetch(:read_timeout, 60)
+      @ssl_verify = opts.fetch(:ssl_verify, true)
+    end
+
+    def status
+      response.status
+    end
+
+    def body
+      response.body
+    end
+
+    def headers
+      Hashie::Mash.new(response.headers.to_h)
+    end
+
+    def to_s
+      "http #{@method} on #{@url}"
+    end
+
+    private
+
+    def response
+      return @response if @response
+      conn = Faraday.new url: @url, headers: @headers, params: @params, ssl: { verify: @ssl_verify }
+
+      # set basic authentication
+      conn.basic_auth @auth[:user], @auth[:pass] unless @auth.empty?
+
+      # set default timeout
+      conn.options.timeout      = @read_timeout  # open/read timeout in seconds
+      conn.options.open_timeout = @open_timeout  # connection open timeout in seconds
+
+      @response = conn.send(@method.downcase) do |req|
+        req.body = @data
+      end
+    end
+  end
+end

data/lib/resources/iis_app.rb

@@ -0,0 +1,103 @@
+# encoding: utf-8
+# frozen_string_literal: true
+# check for web applications in IIS
+# Note: this is only supported in windows 2012 and later
+module Inspec::Resources
+  class IisApp < Inspec.resource(1)
+    name 'iis_app'
+    desc 'Tests IIS application configuration on windows. Supported in server 2012+ only'
+    example "
+      describe iis_app('/myapp', 'Default Web Site') do
+        it { should exist }
+        it { should have_application_pool('MyAppPool') }
+        it { should have_protocols('http') }
+        it { should have_site_name('Default Web Site') }
+        it { should have_physical_path('C:\\inetpub\\wwwroot\\myapp') }
+        it { should have_path('\\My Application') }
+      end
+    "
+
+    def initialize(path, site_name)
+      @path = path
+      @site_name = site_name
+      @cache = nil
+      @inspec = inspec
+
+      # verify that this resource is only supported on Windows
+      return skip_resource 'The `iis_app` resource is not supported on your OS.' unless inspec.os.windows?
+    end
+
+    def application_pool
+      iis_app[:application_pool]
+    end
+
+    def protocols
+      iis_app[:protocols]
+    end
+
+    def site_name
+      iis_app[:site_name]
+    end
+
+    def path
+      iis_app[:path]
+    end
+
+    def physical_path
+      iis_app[:physical_path]
+    end
+
+    def exists?
+      !iis_app[:path].empty?
+    end
+
+    def has_site_name?(site_name)
+      iis_app[:site_name] == site_name
+    end
+
+    def has_application_pool?(application_pool)
+      iis_app[:application_pool] == application_pool
+    end
+
+    def has_path?(path)
+      iis_app[:path] == path
+    end
+
+    def has_physical_path?(physical_path)
+      iis_app[:physical_path] == physical_path
+    end
+
+    def has_protocol?(protocol)
+      iis_app[:protocols].include?(protocol)
+    end
+
+    def to_s
+      "iis_app '#{@site_name}#{@path}'"
+    end
+
+    private
+
+    def iis_app
+      return @cache unless @cache.nil?
+      command = "Import-Module WebAdministration; Get-WebApplication -Name '#{@path}' -Site '#{@site_name}' | Select-Object * | ConvertTo-Json"
+      cmd = @inspec.command(command)
+
+      begin
+        app = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return {}
+      end
+
+      # map our values to a hash table
+      info = {
+        site_name: @site_name,
+        path: @path,
+        application_pool: app['applicationPool'],
+        physical_path: app['PhysicalPath'],
+        protocols: app['enabledProtocols'],
+      }
+
+      @cache = info unless info.nil?
+    end
+  end
+end

data/lib/resources/iis_site.rb

@@ -121,4 +121,27 @@ module Inspec::Resources
       info
     end
   end
+
+  # for compatability with serverspec
+  # this is deprecated syntax and will be removed in future versions
+  class IisSiteServerSpec < IisSite
+    name 'iis_website'
+    desc 'Tests IIS site configuration on windows. Deprecated, use `iis_site` instead.'
+    example "
+      describe iis_website('Default Website') do
+        it{ should exist }
+        it{ should be_running }
+        it{ should be_in_app_pool('Default App Pool') }
+      end
+    "
+
+    def initialize(site_name)
+      super(site_name)
+      warn '[DEPRECATION] `iis_website(site_name)` is deprecated.  Please use `iis_site(site_name)` instead.'
+    end
+
+    def in_app_pool?(app_pool)
+      has_app_pool?(app_pool)
+    end
+  end
 end

data/lib/resources/inetd_conf.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
@@ -22,6 +21,12 @@ module Inspec::Resources
       @conf_path = path || '/etc/inetd.conf'
     end
 
+    # overwrite exec to ensure it works with its
+    # TODO: this needs to be fixed in RSpec
+    def exec
+      read_params['exec']
+    end
+
     def method_missing(name)
       read_params[name.to_s]
     end
@@ -37,15 +42,15 @@ module Inspec::Resources
       end
 
       content = file.content
-      if content.empty? && file.size > 0
+      if content.empty? && !file.empty?
         skip_resource "Can't read file \"#{@conf_path}\""
         return @params = {}
       end
       # parse the file
       conf = SimpleConfig.new(
         content,
-        assignment_re: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
-        key_vals: 6,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
+        key_values: 6,
         multiple_values: false,
       )
       @params = conf.params

data/lib/resources/interface.rb

@@ -1,13 +1,14 @@
 # encoding: utf-8
 # author: Christoph Hartmann
 # author: Dominik Richter
+# author: Aaron Lippold
 
 require 'utils/convert'
 
 module Inspec::Resources
   class NetworkInterface < Inspec.resource(1)
     name 'interface'
-    desc 'Use the interface InSpec audit resource to test basic network adapter properties, such as name, status, state, address, and link speed (in MB/sec).'
+    desc 'Use the interface InSpec audit resource to test basic network adapter properties, such as name, status, and link speed (in MB/sec).'
     example "
       describe interface('eth0') do
         it { should exist }
@@ -64,7 +65,7 @@ module Inspec::Resources
   class LinuxInterface < InterfaceInfo
     def interface_info(iface)
       # will return "[mtu]\n1500\n[type]\n1"
-      cmd = inspec.command("find /sys/class/net/#{iface}/ -type f -maxdepth 1 -exec sh -c 'echo \"[$(basename {})]\"; cat {} || echo -n' \\;")
+      cmd = inspec.command("find /sys/class/net/#{iface}/ -maxdepth 1 -type f -exec sh -c 'echo \"[$(basename {})]\"; cat {} || echo -n' \\;")
       return nil if cmd.exit_status.to_i != 0
 
       # parse values, we only recieve values, therefore we threat them as keys
@@ -121,7 +122,7 @@ module Inspec::Resources
         adapter_collection.push(info) if info[:name].casecmp(iface) == 0
       end
 
-      return nil if adapters.size == 0
+      return nil if adapters.empty?
       warn "[Possible Error] detected multiple network interfaces with the name #{iface}" if adapters.size > 1
       adapters[0]
     end

data/lib/resources/json.rb

@@ -12,6 +12,15 @@ module Inspec::Resources
       describe json('policyfile.lock.json') do
         its(['cookbook_locks','omnibus','version']) { should eq('2.2.0') }
       end
+
+      describe json({ command: 'retrieve_data.py --json' }) do
+        its('state') { should eq('open') }
+      end
+
+      describe json({ content: '{\"item1\": { \"status\": \"available\" } }' }) do
+        its(['item1', 'status']) { should cmp 'available' }
+      end
+
     "
 
     include ObjectTraverser
@@ -19,21 +28,31 @@ module Inspec::Resources
     # make params readable
     attr_reader :params
 
-    def initialize(path)
-      @path = path
-      @file = inspec.file(@path)
-      @file_content = @file.content
+    def initialize(opts)
+      @opts = opts
+      if opts.is_a?(Hash)
+        if opts.key?(:content)
+          @file_content = opts[:content]
+        elsif opts.key?(:command)
+          @command = inspec.command(opts[:command])
+          @file_content = @command.stdout
+        end
+      else
+        @path = opts
+        @file = inspec.file(@opts)
+        @file_content = @file.content
 
-      # check if file is available
-      if !@file.file?
-        skip_resource "Can't find file \"#{@conf_path}\""
-        return @params = {}
-      end
+        # check if file is available
+        if !@file.file?
+          skip_resource "Can't find file \"#{@path}\""
+          return @params = {}
+        end
 
-      # check if file is readable
-      if @file_content.empty? && @file.size > 0
-        skip_resource "Can't read file \"#{@conf_path}\""
-        return @params = {}
+        # check if file is readable
+        if @file_content.nil? && !@file.empty?
+          skip_resource "Can't read file \"#{@path}\""
+          return @params = {}
+        end
       end
 
       @params = parse(@file_content)
@@ -61,7 +80,11 @@ module Inspec::Resources
     end
 
     def to_s
-      "Json #{@path}"
+      if @opts.is_a?(Hash) && @opts.key?(:content)
+        'Json content'
+      else
+        "Json #{@path}"
+      end
     end
   end
 end

data/lib/resources/kernel_module.rb

@@ -1,30 +1,54 @@
 # encoding: utf-8
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
+# author: Aaron Lippold
+# author: Adam Leff
 
 module Inspec::Resources
   class KernelModule < Inspec.resource(1)
     name 'kernel_module'
-    desc 'Use the kernel_module InSpec audit resource to test kernel modules on Linux platforms. These parameters are located under /lib/modules. Any submodule may be tested using this resource.'
+    desc 'Use the kernel_module InSpec audit resource to test kernel modules on
+    Linux platforms. These parameters are located under /lib/modules. Any submodule
+    may be tested using this resource.
+
+    The `kernel_module` resource can also verify if a kernel module is `blacklisted`
+    or if a module is disabled via a fake install using the `bin_true` or `bin_false`
+    method.'
+
     example "
-      describe kernel_module('bridge') do
-        it { should be_loaded }
-      end
+
+    describe kernel_module('video') do
+      it { should be_loaded }
+      it { should_not be_disabled }
+      it { should_not be_blacklisted }
+    end
+
+    describe kernel_module('sstfb') do
+      it { should_not be_loaded }
+      it { should be_disabled }
+    end
+
+    describe kernel_module('floppy') do
+      it { should be_blacklisted }
+    end
+
+    describe kernel_module('dhcp') do
+      it { should_not be_loaded }
+    end
     "
 
     def initialize(modulename = nil)
       @module = modulename
-
       # this resource is only supported on Linux
       return skip_resource 'The `kernel_parameter` resource is not supported on your OS.' if !inspec.os.linux?
     end
 
     def loaded?
-      # default lsmod command
-      lsmod_cmd = 'lsmod'
-      # special care for CentOS 5 and sudo
-      lsmod_cmd = '/sbin/lsmod' if inspec.os[:name] == 'centos' && inspec.os[:release].to_i == 5
+      if inspec.os.redhat? || inspec.os.name == 'fedora'
+        lsmod_cmd = '/sbin/lsmod'
+      else
+        lsmod_cmd = 'lsmod'
+      end
 
       # get list of all modules
       cmd = inspec.command(lsmod_cmd)
@@ -36,8 +60,51 @@ module Inspec::Resources
       !found.nil?
     end
 
+    def disabled?
+      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/(true|false)}).nil?
+    end
+
+    def blacklisted?
+      !modprobe_output.match(/^blacklist\s+#{@module}/).nil? || disabled_via_bin_true? || disabled_via_bin_false?
+    end
+
+    def version
+      cmd = inspec.command("#{modinfo_cmd_for_os} -F version #{@module}")
+      cmd.exit_status.zero? ? cmd.stdout.delete("\n") : nil
+    end
+
     def to_s
       "Kernel Module #{@module}"
     end
+
+    private
+
+    def modprobe_output
+      @modprobe_output ||= inspec.command("#{modprobe_cmd_for_os} --showconfig").stdout
+    end
+
+    def modinfo_cmd_for_os
+      if inspec.os.redhat? || inspec.os.name == 'fedora'
+        '/sbin/modinfo'
+      else
+        'modinfo'
+      end
+    end
+
+    def modprobe_cmd_for_os
+      if inspec.os.redhat? || inspec.os.name == 'fedora'
+        '/sbin/modprobe'
+      else
+        'modprobe'
+      end
+    end
+
+    def disabled_via_bin_true?
+      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/true}).nil?
+    end
+
+    def disabled_via_bin_false?
+      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/false}).nil?
+    end
   end
 end

data/lib/resources/kernel_parameter.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # author: Christoph Hartmann
-# license: All rights reserved
 
 module Inspec::Resources
   class KernelParameter < Inspec.resource(1)

data/lib/resources/key_rsa.rb

@@ -0,0 +1,67 @@
+# encoding: utf-8
+# author: Richard Nixon
+# author: Christoph Hartmann
+
+require 'openssl'
+require 'hashie/mash'
+
+module Inspec::Resources
+  class RsaKey < Inspec.resource(1)
+    name 'key_rsa'
+    desc 'public/private RSA key pair test'
+    example "
+      describe rsa_key('/etc/pki/www.mywebsite.com.key') do
+        its('public_key') { should match /BEGIN RSA PUBLIC KEY/ }
+      end
+
+      describe rsa_key('/etc/pki/www.mywebsite.com.key', 'passphrase') do
+        it { should be_private }
+        it { should be_public }
+      end
+    "
+
+    def initialize(keypath, passphrase = nil)
+      @key_path = keypath
+      @key_file = inspec.file(@key_path)
+      @key = nil
+      @passphrase = passphrase
+
+      return skip_resource "Unable to find key file #{@key_path}" unless @key_file.exist?
+
+      begin
+        @key = OpenSSL::PKey.read(@key_file.content, @passphrase)
+      rescue OpenSSL::PKey::RSAError => _
+        return skip_resource "Unable to load key file #{@key_path}"
+      end
+    end
+
+    def public?
+      return if @key.nil?
+      @key.public?
+    end
+
+    def public_key
+      return if @key.nil?
+      @key.public_key.to_s
+    end
+
+    def private?
+      return if @key.nil?
+      @key.private?
+    end
+
+    def private_key
+      return if @key.nil?
+      @key.to_s
+    end
+
+    def key_length
+      return if @key.nil?
+      @key.public_key.n.num_bytes * 8
+    end
+
+    def to_s
+      "rsa_key #{@key_path}"
+    end
+  end
+end

data/lib/resources/limits_conf.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
@@ -35,7 +34,7 @@ module Inspec::Resources
       end
 
       content = file.content
-      if content.empty? && file.size > 0
+      if content.empty? && !file.empty?
         skip_resource "Can't read file \"#{@conf_path}\""
         return @params = {}
       end
@@ -43,8 +42,8 @@ module Inspec::Resources
       # parse the file
       conf = SimpleConfig.new(
         content,
-        assignment_re: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
-        key_vals: 3,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
+        key_values: 3,
         multiple_values: true,
       )
       @params = conf.params

data/lib/resources/login_def.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
@@ -47,7 +46,7 @@ module Inspec::Resources
       end
 
       content = file.content
-      if content.empty? && file.size > 0
+      if content.empty? && !file.empty?
         skip_resource "Can't read file \"#{@conf_path}\""
         return @params = {}
       end
@@ -55,7 +54,7 @@ module Inspec::Resources
       # parse the file
       conf = SimpleConfig.new(
         content,
-        assignment_re: /^\s*(\S+)\s+(\S*)\s*$/,
+        assignment_regex: /^\s*(\S+)\s+(\S*)\s*$/,
         multiple_values: false,
       )
       @params = conf.params

data/lib/resources/mount.rb

@@ -1,6 +1,7 @@
 # encoding: utf-8
 # author: Christoph Hartmann
 # author: Dominik Richter
+# author: Joseph Benden
 
 require 'utils/simpleconfig'
 
@@ -18,13 +19,12 @@ module Inspec::Resources
         its('options') { should include 'nodev' }
       end
     "
-    include MountParser
-
     attr_reader :file
 
     def initialize(path)
       @path = path
-      return skip_resource 'The `mount` resource is not supported on your OS yet.' if !inspec.os.linux?
+      @mount_manager = mount_manager_for_os
+      return skip_resource 'The `mount` resource is not supported on your OS yet.' if @mount_manager.nil?
       @file = inspec.backend.file(@path)
     end
 
@@ -49,12 +49,42 @@ module Inspec::Resources
       line = mounted.stdout.lines.to_a.last if mounted.stdout.lines.count > 1
 
       # parse content if we are on linux
-      @mount_options ||= parse_mount_options(line)
+      @mount_options ||= @mount_manager.parse_mount_options(line)
       @mount_options[name]
     end
 
     def to_s
       "Mount #{@path}"
     end
+
+    private
+
+    def mount_manager_for_os
+      os = inspec.os
+      if os.linux?
+        LinuxMounts.new(inspec)
+      elsif ['freebsd'].include?(os[:family])
+        BsdMounts.new(inspec)
+      end
+    end
+  end
+
+  class MountsInfo
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+
+    def parse_mount_options(_mount_line, _compatibility = false)
+      raise NotImplementedError
+    end
+  end
+
+  class LinuxMounts < MountsInfo
+    include LinuxMountParser
+  end
+
+  class BsdMounts < MountsInfo
+    include BsdMountParser
   end
 end