inspec 1.0.0 → 1.35.1

data/lib/resources/packages.rb

@@ -0,0 +1,111 @@
+# encoding: utf-8
+# copyright: 2017, Chef Software, Inc. <legal@chef.io>
+# author: Joshua Timberman
+# author: Alex Pop
+
+require 'utils/filter'
+
+module Inspec::Resources
+  class Packages < Inspec.resource(1)
+    name 'packages'
+    desc 'Use the packages InSpec audit resource to test properties for multiple packages installed on the system'
+    example "
+      describe packages(/xserver-xorg.*/) do
+        its('entries') { should be_empty }
+      end
+      describe packages('vim').entries.length do
+        it { should be > 1 }
+      end
+      describe packages(/vi.+/).where { status != 'installed' } do
+        its('statuses') { should be_empty }
+      end
+    "
+
+    def initialize(pattern)
+      os = inspec.os
+      if os.debian?
+        @pkgs = Debs.new(inspec)
+      elsif os.redhat? || %w{suse amazon fedora}.include?(os[:family])
+        @pkgs = Rpms.new(inspec)
+      else
+        return skip_resource "The packages resource is not yet supported on OS #{inspec.os.name}"
+      end
+
+      @pattern = pattern_regexp(pattern)
+      all_pkgs = @pkgs.build_package_list
+      @list = all_pkgs.find_all do |hm|
+        hm[:name] =~ @pattern
+      end
+    end
+
+    def to_s
+      "Packages #{@pattern.class == String ? @pattern : @pattern.inspect}"
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:statuses,  field: 'status', style: :simple)
+          .add(:names,     field: 'name')
+          .add(:versions,  field: 'version')
+          .connect(self, :filtered_packages)
+
+    private
+
+    def pattern_regexp(p)
+      if p.class == String
+        Regexp.new(Regexp.escape(p))
+      elsif p.class == Regexp
+        p
+      else
+        raise 'Invalid name argument to packages resource, please use a "string" or /regexp/'
+      end
+    end
+
+    def filtered_packages
+      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped
+      @list
+    end
+  end
+
+  class PkgsManagement
+    PackageStruct = Struct.new(:status, :name, :version)
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+  end
+
+  # Debian / Ubuntu
+  class Debs < PkgsManagement
+    def build_package_list
+      # use two spaces as delimiter in case any of the fields has a space in it
+      command = "dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}\\n'"
+      cmd = inspec.command(command)
+      all = cmd.stdout.split("\n")
+      return [] if all.nil?
+      all.map do |m|
+        a = m.split(/ {2,}/)
+        a[0] = 'installed' if a[0] =~ /^.i/
+        a[2] = a[2].split(':').last
+        PackageStruct.new(*a)
+      end
+    end
+  end
+
+  # RedHat family
+  class Rpms < PkgsManagement
+    def build_package_list
+      # use two spaces as delimiter in case any of the fields has a space in it
+      command = "rpm -qa --queryformat '%{NAME}  %{VERSION}-%{RELEASE}\\n'"
+      cmd = inspec.command(command)
+      all = cmd.stdout.split("\n")
+      return [] if all.nil?
+      all.map do |m|
+        a = m.split('  ')
+        a.unshift('installed')
+        PackageStruct.new(*a)
+      end
+    end
+  end
+end

data/lib/resources/parse_config.rb

@@ -2,13 +2,12 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 # Usage example:
 #
 #  audit = command('/sbin/auditctl -l').stdout
 #  options = {
-#    assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+#    assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
 #    multiple_values: true
 #  }
 #  describe parse_config(audit, options ) do
@@ -26,7 +25,7 @@ module Inspec::Resources
       output2 = command('curl http://127.0.0.1/php_status').stdout
       # php status is in format 'key : value', and we do not allow for multiple values
       options2 = {
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false
       }
 
@@ -76,7 +75,7 @@ module Inspec::Resources
         return skip_resource "Can't find file \"#{conf_path}\""
       end
       @content = read_file(conf_path).to_s
-      if @content.empty? && inspec.file(conf_path).size > 0
+      if @content.empty? && !inspec.file(conf_path).empty?
         return skip_resource "Can't read file \"#{conf_path}\""
       end
 

data/lib/resources/passwd.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 # The file format consists of
 # - username
@@ -62,17 +61,17 @@ module Inspec::Resources
           .add(:shells,    field: 'shell')
 
     filter.add(:count) { |t, _|
-      warn '[DEPRECATION] `passwd.count` is deprecated. Please use `passwd.entries.length` instead. It will be removed in version 1.0.0.'
+      warn '[DEPRECATION] `passwd.count` is deprecated. Please use `passwd.entries.length` instead. It will be removed in the next major version.'
       t.entries.length
     }
 
     filter.add(:usernames) { |t, x|
-      warn '[DEPRECATION] `passwd.usernames` is deprecated. Please use `passwd.users` instead. It will be removed in version 1.0.0.'
+      warn '[DEPRECATION] `passwd.usernames` is deprecated. Please use `passwd.users` instead. It will be removed in the next major version.'
       t.users(x)
     }
 
     filter.add(:username) { |t, x|
-      warn '[DEPRECATION] `passwd.username` is deprecated. Please use `passwd.users` instead. It will be removed in version 1.0.0.'
+      warn '[DEPRECATION] `passwd.username` is deprecated. Please use `passwd.users` instead. It will be removed in the next major version.'
       t.users(x)[0]
     }
 
@@ -84,7 +83,7 @@ module Inspec::Resources
     }
 
     def uid(x)
-      warn '[DEPRECATION] `passwd.uid(arg)` is deprecated. Please use `passwd.uids(arg)` instead. It will be removed in version 1.0.0.'
+      warn '[DEPRECATION] `passwd.uid(arg)` is deprecated. Please use `passwd.uids(arg)` instead. It will be removed in the next major version.'
       uids(x)
     end
 

data/lib/resources/pip.rb

@@ -7,6 +7,7 @@
 #   it { should be_installed }
 # end
 #
+
 module Inspec::Resources
   class PipPackage < Inspec.resource(1)
     name 'pip'
@@ -15,10 +16,17 @@ module Inspec::Resources
       describe pip('Jinja2') do
         it { should be_installed }
       end
+
+      describe pip('django', '/path/to/virtualenv/bin/pip') do
+        it { should be_installed }
+        its('version') { should eq('1.11.4')}
+      end
     "
 
-    def initialize(package_name)
+    def initialize(package_name, pip_path = nil)
       @package_name = package_name
+      @pip_cmd = pip_path || default_pip_path
+      return skip_resource 'pip not found' unless inspec.command(@pip_cmd).exist?
     end
 
     def info
@@ -26,12 +34,12 @@ module Inspec::Resources
 
       @info = {}
       @info[:type] = 'pip'
-      cmd = inspec.command("#{pip_cmd} show #{@package_name}")
+      cmd = inspec.command("#{@pip_cmd} show #{@package_name}")
       return @info if cmd.exit_status != 0
 
       params = SimpleConfig.new(
         cmd.stdout,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
       @info[:name] = params['Name']
@@ -54,28 +62,28 @@ module Inspec::Resources
 
     private
 
-    def pip_cmd
+    def default_pip_path
+      return 'pip' unless inspec.os.windows?
+
       # Pip is not on the default path for Windows, therefore we do some logic
       # to find the binary on Windows
-      if inspec.os.windows?
-        # we need to detect the pip command on Windows
-        cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
-        begin
-          paths = JSON.parse(cmd.stdout)
-          # use pip if it on system path
-          pipcmd = paths['Pip']
-          # calculate path on windows
-          if defined?(paths['Python']) && pipcmd.nil?
-            pipdir = paths['Python'].split('\\')
-            # remove python.exe
-            pipdir.pop
-            pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
-          end
-        rescue JSON::ParserError => _e
-          return nil
+      cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
+      begin
+        paths = JSON.parse(cmd.stdout)
+        # use pip if it on system path
+        pipcmd = paths['Pip']
+        # calculate path on windows
+        if defined?(paths['Python']) && pipcmd.nil?
+          pipdir = paths['Python'].split('\\')
+          # remove python.exe
+          pipdir.pop
+          pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
         end
+      rescue JSON::ParserError => _e
+        return nil
       end
-      pipcmd || 'pip'
+
+      pipcmd
     end
   end
 end

data/lib/resources/port.rb

@@ -4,6 +4,7 @@
 
 require 'utils/parser'
 require 'utils/filter'
+require 'ipaddr'
 
 # TODO: currently we return local ip only
 # TODO: improve handling of same port on multiple interfaces
@@ -45,7 +46,7 @@ module Inspec::Resources
           .add(:protocols, field: 'protocol', style: :simple)
           .add(:processes, field: 'process', style: :simple)
           .add(:pids,      field: 'pid', style: :simple)
-          .add(:listening?) { |x| x.entries.length > 0 }
+          .add(:listening?) { |x| !x.entries.empty? }
     filter.connect(self, :info)
 
     def to_s
@@ -169,7 +170,7 @@ module Inspec::Resources
       ports = []
 
       # check that lsof is available, otherwise fail
-      fail 'Please ensure `lsof` is available on the machine.' if !inspec.command(@lsof.to_s).exist?
+      raise 'Please ensure `lsof` is available on the machine.' if !inspec.command(@lsof.to_s).exist?
 
       # -F p=pid, c=command, P=protocol name, t=type, n=internet addresses
       # see 'OUTPUT FOR OTHER PROGRAMS' in LSOF(8)
@@ -263,10 +264,34 @@ module Inspec::Resources
   end
 
   # extract port information from netstat
-  class LinuxPorts < PortsInfo
+  class LinuxPorts < PortsInfo # rubocop:disable Metrics/ClassLength
+    ALLOWED_PROTOCOLS = %w{tcp tcp6 udp udp6}.freeze
+
     def info
+      ports_via_ss || ports_via_netstat
+    end
+
+    def ports_via_ss
+      return nil unless inspec.command('ss').exist?
+
+      cmd = inspec.command('ss -tulpen')
+      return nil unless cmd.exit_status.to_i.zero?
+
+      ports = []
+
+      cmd.stdout.each_line do |line|
+        parsed_line = parse_ss_line(line)
+        ports << parsed_line unless parsed_line.nil?
+      end
+
+      ports
+    end
+
+    def ports_via_netstat
+      return nil unless inspec.command('netstat').exist?
+
       cmd = inspec.command('netstat -tulpen')
-      return nil if cmd.exit_status.to_i != 0
+      return nil unless cmd.exit_status.to_i.zero?
 
       ports = []
       # parse all lines
@@ -286,10 +311,38 @@ module Inspec::Resources
         ip6 = /^(\S+):(\d+)$/.match(net_addr)
         ip6addr = ip6[1]
         ip6addr = '::' if ip6addr =~ /^:::$/
-        # build uri
-        ip_addr = URI("addr://[#{ip6addr}]:#{ip6[2]}")
-        # replace []
-        host = ip_addr.host[1..ip_addr.host.size-2]
+
+        # v6 addresses need to end in a double-colon when using
+        # shorthand notation. netstat ends with a single colon.
+        # IPAddr will fail to properly parse an address unless it
+        # uses a double-colon for short-hand notation.
+        ip6addr += ':' if ip6addr =~ /\w:$/
+
+        begin
+          ip_parser = IPAddr.new(ip6addr)
+        rescue IPAddr::InvalidAddressError
+          # This IP is not parsable. There appears to be a bug in netstat
+          # output that truncates link-local IP addresses:
+          # example: udp6 0 0 fe80::42:acff:fe11::123 :::* 0 54550 3335/ntpd
+          # actual link address: inet6 fe80::42:acff:fe11:5/64 scope link
+          #
+          # in this example, the "5" is truncated making the netstat output
+          # an invalid IP address.
+          return [nil, nil]
+        end
+
+        # Check to see if this is a IPv4 address in a tcp6/udp6 line.
+        # If so, don't put brackets around the IP or URI won't know how
+        # to properly handle it.
+        # example: tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN
+        if ip_parser.ipv4?
+          ip_addr = URI("addr://#{ip6addr}:#{ip6[2]}")
+          host = ip_addr.host
+        else
+          ip_addr = URI("addr://[#{ip6addr}]:#{ip6[2]}")
+          # strip []
+          host = ip_addr.host[1..ip_addr.host.size-2]
+        end
       else
         ip_addr = URI('addr://'+net_addr)
         host = ip_addr.host
@@ -317,6 +370,7 @@ module Inspec::Resources
 
       # extract host and port information
       host, port = parse_net_address(parsed[4], protocol)
+      return {} if host.nil?
 
       # extract PID
       process = parsed[9].split('/')
@@ -332,6 +386,66 @@ module Inspec::Resources
         'pid'      => pid,
       }
     end
+
+    def parse_ss_line(line)
+      parsed = line.split(/\s+/, 7)
+
+      # ss only returns "tcp" and "udp" as the protocol. However, netstat would return
+      # "tcp6" and "udp6" as necessary. In order to maintain backward compatibility, we
+      # will manually modify the protocol value if the line we're parsing is an IPv6
+      # entry.
+      process_info = parsed[6]
+      protocol = parsed[0]
+      protocol += '6' if process_info.include?('v6only:1')
+      return nil unless ALLOWED_PROTOCOLS.include?(protocol)
+
+      # parse the Local Address:Port
+      # examples:
+      #   *:22
+      #   :::22
+      #   10.0.2.15:1234
+      #   ::ffff:10.0.2.15:9300
+      #   fe80::a00:27ff:fe32:ed09%enp0s3:9200
+      parsed_net_address = parsed[4].match(/(\S+):(\*|\d+)$/)
+      return nil if parsed_net_address.nil?
+      host = parsed_net_address[1]
+      port = parsed_net_address[2]
+      return nil if host.nil? && port.nil?
+
+      # For backward compatibility with the netstat output, ensure the
+      # port is stored as an integer
+      port = port.to_i
+
+      # for those "v4-but-listed-in-v6" entries, strip off the
+      # leading IPv6 value at the beginning
+      # example: ::ffff:10.0.2.15:9200
+      host.delete!('::ffff:') if host.start_with?('::ffff:')
+
+      # if there's an interface name in the local address, which is common for
+      # IPv6 listeners, strip that out too.
+      # example: fe80::a00:27ff:fe32:ed09%enp0s3
+      host = host.split('%').first
+
+      # if host is "*", replace with "0.0.0.0" to maintain backward compatibility with
+      # the netstat-provided data
+      host = '0.0.0.0' if host == '*'
+
+      # parse the process name from the processes information
+      process_match = parsed[6].match(/users:\(\(\"(\S+)\"/)
+      process = process_match.nil? ? nil : process_match[1]
+
+      # parse the PID from the processes information
+      pid_match = parsed[6].match(/pid=(\d+)/)
+      pid = pid_match.nil? ? nil : pid_match[1].to_i
+
+      {
+        'port'     => port,
+        'address'  => host,
+        'protocol' => protocol,
+        'process'  => process,
+        'pid'      => pid,
+      }
+    end
   end
 
   # extracts information from sockstat
@@ -434,13 +548,17 @@ module Inspec::Resources
         # the last . to :
         local_addr[local_addr.rindex('.')] = ':'
         host, port = parse_net_address(local_addr, protocol)
-        {
-          'port'     => port,
-          'address'  => host,
-          'protocol' => protocol,
-        }
+        if host.nil?
+          nil
+        else
+          {
+            'port'     => port,
+            'address'  => host,
+            'protocol' => protocol,
+          }
+        end
       }
-      ports
+      ports.compact
     end
   end
 
@@ -476,6 +594,7 @@ module Inspec::Resources
       local_addr[local_addr.rindex('.')] = ':'
       # extract host and port information
       host, port = parse_net_address(local_addr, protocol)
+      return {} if host.nil?
       # map data
       {
         'port'     => port,

data/lib/resources/postgres.rb

@@ -2,67 +2,50 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
+# author: Aaron Lippold
 
 module Inspec::Resources
   class Postgres < Inspec.resource(1)
     name 'postgres'
 
-    attr_reader :service, :data_dir, :conf_dir, :conf_path
+    attr_reader :service, :data_dir, :conf_dir, :conf_path, :version, :cluster
     def initialize
-      os = inspec.os
-      if os.debian?
+      if inspec.os.debian?
         #
         # https://wiki.debian.org/PostgreSql
         #
         # Debian allows multiple versions of postgresql to be
         # installed as well as multiple "clusters" to be configured.
         #
-        version = version_from_dir('/etc/postgresql')
-        cluster = cluster_from_dir("/etc/postgresql/#{version}")
-        @conf_dir = "/etc/postgresql/#{version}/#{cluster}"
-        @data_dir = "/var/lib/postgresql/#{version}/#{cluster}"
-      elsif os.redhat?
-        #
-        # /var/lib/pgsql/data is the default data directory on RHEL6
-        # and RHEL7. However, PR #824 explicitly added version-based
-        # directories. Thus, we call #version_from_dir unless it looks
-        # like we are using unversioned directories.
-        #
-        # TODO(ssd): This has the potential to be noisy because of the
-        # warning in version_from_dir. We should determine which case
-        # is more common and only warn in the less common case.
-        #
-        version = if inspec.directory('/var/lib/pgsql/data').exist?
-                    warn 'Found /var/lib/pgsql/data. Assuming postgresql install uses un-versioned directories.'
-                    nil
-                  else
-                    version_from_dir('/var/lib/pgsql/')
-                  end
-
-        @data_dir = File.join('/var/lib/pgsql/', version.to_s, 'data')
-      elsif os[:name] == 'arch'
-        #
-        # https://wiki.archlinux.org/index.php/PostgreSQL
-        #
-        # The archlinux wiki points to /var/lib/postgresql/data as the
-        # main data directory.
-        #
-        @data_dir = '/var/lib/postgres/data'
+        @version = version_from_psql || version_from_dir('/etc/postgresql')
+        @cluster = cluster_from_dir("/etc/postgresql/#{@version}")
+        @conf_dir = "/etc/postgresql/#{@version}/#{@cluster}"
+        @data_dir = "/var/lib/postgresql/#{@version}/#{@cluster}"
       else
-        #
-        # According to https://www.postgresql.org/docs/9.5/static/creating-cluster.html
-        #
-        # > There is no default, although locations such as
-        # > /usr/local/pgsql/data or /var/lib/pgsql/data are popular.
-        #
-        @data_dir = '/var/lib/pgsql/data'
+        @version = version_from_psql
+        if @version.nil?
+          if inspec.directory('/var/lib/pgsql/data').exist?
+            warn 'Unable to determine PostgreSQL version: psql did not return
+             a version number and unversioned data directories were found.'
+            nil
+          else
+            @version = version_from_dir('/var/lib/pgsql')
+          end
+        end
+        @data_dir = locate_data_dir_location_by_version(@version)
       end
 
       @service = 'postgresql'
+      @service += "-#{@version}" if @version.to_f >= 9.4
       @conf_dir ||= @data_dir
+
       verify_dirs
-      @conf_path = File.join @conf_dir, 'postgresql.conf'
+      if !@version.nil? && !@conf_dir.empty?
+        @conf_path = File.join @conf_dir, 'postgresql.conf'
+      else
+        @conf_path = nil
+        return skip_resource 'Seems like PostgreSQL is not installed on your system'
+      end
     end
 
     def to_s
@@ -81,6 +64,33 @@ module Inspec::Resources
       end
     end
 
+    def version_from_psql
+      return unless inspec.command('psql').exist?
+      inspec.command("psql --version | awk '{ print $NF }' | awk -F. '{ print $1\".\"$2 }'").stdout.strip
+    end
+
+    def locate_data_dir_location_by_version(ver = @version)
+      data_dir_loc = nil
+      dir_list = [
+        "/var/lib/pgsql/#{ver}/data",
+        '/var/lib/pgsql/data',
+        '/var/lib/postgres/data',
+        '/var/lib/postgresql/data',
+      ]
+
+      dir_list.each do |dir|
+        data_dir_loc = dir if inspec.directory(dir).exist?
+        break
+      end
+
+      if data_dir_loc.nil?
+        warn 'Unable to find the PostgreSQL data_dir in expected location(s), please
+        execute "psql -t -A -p <port> -h <host> -c "show hba_file";" as the PostgreSQL
+        DBA to find the non-starndard data_dir location.'
+      end
+      data_dir_loc
+    end
+
     def version_from_dir(dir)
       dirs = inspec.command("ls -d #{dir}/*/").stdout
       entries = dirs.lines.count