inspec 1.0.0 → 1.35.1

data/lib/resources/postgres_conf.rb

@@ -2,7 +2,7 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
+# author: Aaron Lippold
 
 require 'utils/simpleconfig'
 require 'utils/find_files'
@@ -19,9 +19,13 @@ module Inspec::Resources
     "
 
     include FindFiles
+    include ObjectTraverser
 
     def initialize(conf_path = nil)
       @conf_path = conf_path || inspec.postgres.conf_path
+      if @conf_path.nil?
+        return skip_resource 'PostgreSQL conf path is not set'
+      end
       @conf_dir = File.expand_path(File.dirname(@conf_path))
       @files_contents = {}
       @content = nil
@@ -42,6 +46,25 @@ module Inspec::Resources
       res
     end
 
+    def value(key)
+      extract_value(key, @params)
+    end
+
+    def method_missing(*keys)
+      keys.shift if keys.is_a?(Array) && keys[0] == :[]
+      param = value(keys)
+      return nil if param.nil?
+      # extract first value if we have only one value in array
+      return param[0] if param.length == 1
+      param
+    end
+
+    def to_s
+      'PostgreSQL Configuration'
+    end
+
+    private
+
     def read_content
       @content = ''
       @params = {}
@@ -51,34 +74,42 @@ module Inspec::Resources
         return skip_resource "Can't find file \"#{@conf_path}\""
       end
       raw_conf = read_file(@conf_path)
-      if raw_conf.empty? && inspec.file(@conf_path).size > 0
+      if raw_conf.empty? && !inspec.file(@conf_path).empty?
         return skip_resource("Can't read file \"#{@conf_path}\"")
       end
 
       to_read = [@conf_path]
       until to_read.empty?
+        base_dir = File.dirname(to_read[0])
         raw_conf = read_file(to_read[0])
         @content += raw_conf
 
-        params = SimpleConfig.new(raw_conf).params
+        opts = {
+          assignment_regex: /^\s*([^=]*?)\s*=\s*[']?\s*(.*?)\s*[']?\s*$/,
+        }
+        params = SimpleConfig.new(raw_conf, opts).params
         @params.merge!(params)
 
         to_read = to_read.drop(1)
         # see if there is more config files to include
 
-        to_read += include_files(params).find_all do |fp|
+        to_read += include_files(params, base_dir).find_all do |fp|
           not @files_contents.key? fp
         end
       end
       @content
     end
 
-    def include_files(params)
-      include_files = params['include'] || []
-      include_files += params['include_if_exists'] || []
-      dirs = params['include_dir'] || []
+    def include_files(params, base_dir)
+      include_files = Array(params['include']) || []
+      include_files += Array(params['include_if_exists']) || []
+      include_files.map! do |f|
+        Pathname.new(f).absolute? ? f : File.join(base_dir, f)
+      end
+
+      dirs = Array(params['include_dir']) || []
       dirs.each do |dir|
-        dir = File.join(@conf_dir, dir) if dir[0] != '/'
+        dir = File.join(base_dir, dir) if dir[0] != '/'
         include_files += find_files(dir, depth: 1, type: 'file')
       end
       include_files
@@ -87,9 +118,5 @@ module Inspec::Resources
     def read_file(path)
       @files_contents[path] ||= inspec.file(path).content
     end
-
-    def to_s
-      'PostgreSQL Configuration'
-    end
   end
 end

data/lib/resources/postgres_hba_conf.rb

@@ -0,0 +1,101 @@
+# encoding: utf-8
+# author: Rony Xavier,rx294@nyu.edu
+# author: Aaron Lippold, lippold@gmail.com
+
+require 'resources/postgres'
+
+module Inspec::Resources
+  class PostgresHbaConf < Inspec.resource(1)
+    name 'postgres_hba_conf'
+    desc 'Use the `postgres_hba_conf` InSpec audit resource to test the client
+          authentication data defined in the pg_hba.conf file.'
+    example "
+      describe postgres_hba_conf.where { type == 'local' } do
+        its('auth_method') { should eq ['peer'] }
+      end
+    "
+
+    attr_reader :conf_file, :params
+
+    # @todo add checks to ensure that we have data in our file
+    def initialize(hba_conf_path = nil)
+      return skip_resource 'The `postgres_hba_conf` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_file = hba_conf_path || File.expand_path('pg_hba.conf', inspec.postgres.conf_dir)
+      @content = ''
+      @params = {}
+      read_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:type,     field: 'type')
+          .add(:database, field: 'database')
+          .add(:user,     field: 'user')
+          .add(:address,  field: 'address')
+          .add(:auth_method, field: 'auth_method')
+          .add(:auth_params, field: 'auth_params')
+
+    filter.connect(self, :params)
+
+    def to_s
+      "Postgres Hba Config #{@conf_file}"
+    end
+
+    private
+
+    def clean_conf_file(conf_file = @conf_file)
+      data = inspec.file(conf_file).content.to_s.lines
+      content = []
+      data.each do |line|
+        line.chomp!
+        content << line unless line.match(/^\s*#/) || line.empty?
+      end
+      content
+    end
+
+    def read_content(config_file = @conf_file)
+      file = inspec.file(config_file)
+
+      if !file.file?
+        return skip_resource "Can't find file \"#{@conf_file}\""
+      end
+
+      raw_conf = file.content
+
+      if raw_conf.empty? && !file.empty?
+        return skip_resource("Can't read the contents of \"#{@conf_file}\"")
+      end
+
+      # @todo use SimpleConfig here if we can
+      # ^\s*(\S+)\s+(\S+)\s+(\S+)\s(?:(\d*.\d*.\d*.\d*\/\d*)|(::\/\d+))\s+(\S+)\s*(.*)?\s*$
+
+      @content = clean_conf_file(@conf_file)
+      @params = parse_conf(@content)
+      @params.each do |line|
+        if line['type'] == 'local'
+          line['auth_method'] = line['address']
+          line['address'] = ''
+        end
+      end
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        parse_line(line)
+      end.compact
+    end
+
+    def parse_line(line)
+      x = line.split(/\s+/)
+      {
+        'type' => x[0],
+        'database' => x[1],
+        'user' => x[2],
+        'address' => x[3],
+        'auth_method' => x[4],
+        'auth_params' =>  ('' if x.length == 4) || x[5..-1].join(' '),
+      }
+    end
+  end
+end

data/lib/resources/postgres_ident_conf.rb

@@ -0,0 +1,79 @@
+# encoding: utf-8
+# author: Rony Xavier,  rx294@nyu.edu
+# author: Aaron Lippold, lippold@gmail.com
+
+require 'resources/postgres'
+
+module Inspec::Resources
+  class PostgresIdentConf < Inspec.resource(1)
+    name 'postgres_ident_conf'
+    desc 'Use the postgres_ident_conf InSpec audit resource to test the client
+          authentication data is controlled by a pg_ident.conf file.'
+    example "
+      describe postgres_ident_conf.where { pg_username == 'acme_user' } do
+        its('map_name') { should eq ['ssl-test'] }
+      end
+    "
+
+    attr_reader :params, :conf_file
+
+    def initialize(ident_conf_path = nil)
+      return skip_resource 'The `postgres_ident_conf` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_file = ident_conf_path || File.expand_path('pg_ident.conf', inspec.postgres.conf_dir)
+      @content = nil
+      @params = nil
+      read_content
+      return skip_resource '`pg_ident_conf` is not yet supported on your OS' if inspec.os.windows?
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:map_name,        field: 'map_name')
+          .add(:system_username, field: 'system_username')
+          .add(:pg_username,     field: 'pg_username')
+
+    filter.connect(self, :params)
+
+    def to_s
+      "PostgreSQL Ident Config #{@conf_file}"
+    end
+
+    private
+
+    def filter_comments(data)
+      content = []
+      data.each do |line|
+        line.chomp!
+        content << line unless line.match(/^\s*#/) || line.empty?
+      end
+      content
+    end
+
+    def read_content
+      @content = ''
+      @params = {}
+      @content = filter_comments(read_file(@conf_file))
+      @params = parse_conf(@content)
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        parse_line(line)
+      end.compact
+    end
+
+    def parse_line(line)
+      x = line.split(/\s+/)
+      {
+        'map_name' => x[0],
+        'system_username' => x[1],
+        'pg_username' => x[2],
+      }
+    end
+
+    def read_file(conf_file = @conf_file)
+      inspec.file(conf_file).content.lines
+    end
+  end
+end

data/lib/resources/postgres_session.rb

@@ -2,7 +2,9 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
+# author: Aaron Lippold
+
+require 'shellwords'
 
 module Inspec::Resources
   class Lines
@@ -26,39 +28,45 @@ module Inspec::Resources
     name 'postgres_session'
     desc 'Use the postgres_session InSpec audit resource to test SQL commands run against a PostgreSQL database.'
     example "
-      sql = postgres_session('username', 'password')
+      sql = postgres_session('username', 'password', 'host')
+      query('sql_query', ['database_name'])` contains the query and (optional) database to execute
+
+      # default values:
+      # username: 'postgres'
+      # host: 'localhost'
+      # db: databse == db_user running the sql query
 
       describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;') do
-        its('output') { should eq('') }
+        its('output') { should eq '' }
       end
     "
 
-    def initialize(user, pass)
+    def initialize(user, pass, host = nil)
       @user = user || 'postgres'
       @pass = pass
+      @host = host || 'localhost'
     end
 
     def query(query, db = [])
-      dbs = db.map { |x| "-d #{x}" }.join(' ')
-      # TODO: simple escape, must be handled by a library
-      # that does this securely
-      escaped_query = query.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
-      # run the query
-      cmd = inspec.command("PGPASSWORD='#{@pass}' psql -U #{@user} #{dbs} -h localhost -c \"#{escaped_query}\"")
+      psql_cmd = create_psql_cmd(query, db)
+      cmd = inspec.command(psql_cmd)
       out = cmd.stdout + "\n" + cmd.stderr
-      if cmd.exit_status != 0 or
-         out =~ /could not connect to .*/ or
-         out.downcase =~ /^error/
-        # skip this test if the server can't run the query
+      if cmd.exit_status != 0 || out =~ /could not connect to .*/ || out.downcase =~ /^error:.*/
         skip_resource "Can't read run query #{query.inspect} on postgres_session: #{out}"
       else
-        # remove the whole header (i.e. up to the first ^-----+------+------$)
-        # remove the tail
-        lines = cmd.stdout
-                   .sub(/(.*\n)+([-]+[+])*[-]+\n/, '')
-                   .sub(/\n[^\n]*\n\n$/, '')
-        Lines.new(lines.strip, "PostgreSQL query: #{query}")
+        Lines.new(cmd.stdout.strip, "PostgreSQL query: #{query}")
       end
     end
+
+    private
+
+    def escaped_query(query)
+      Shellwords.escape(query)
+    end
+
+    def create_psql_cmd(query, db = [])
+      dbs = db.map { |x| "-d #{x}" }.join(' ')
+      "PGPASSWORD='#{@pass}' psql -U #{@user} #{dbs} -h #{@host} -A -t -c #{escaped_query(query)}"
+    end
   end
 end

data/lib/resources/powershell.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 module Inspec::Resources
   class PowershellScript < Cmd
@@ -10,7 +9,7 @@ module Inspec::Resources
     desc 'Use the powershell InSpec audit resource to test a Windows PowerShell script on the Microsoft Windows platform.'
     example "
       script = <<-EOH
-        # you powershell script
+        # your powershell script
       EOH
 
       describe powershell(script) do
@@ -20,6 +19,7 @@ module Inspec::Resources
 
     def initialize(script)
       unless inspec.os.windows?
+        super('')
         return skip_resource 'The `script` resource is not supported on your OS yet.'
       end
       # since WinRM 2.0 and the default use of powershell for local execution in

data/lib/resources/processes.rb

@@ -2,7 +2,8 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
+
+require 'utils/filter'
 
 module Inspec::Resources
   class Processes < Inspec.resource(1)
@@ -10,72 +11,106 @@ module Inspec::Resources
     desc 'Use the processes InSpec audit resource to test properties for programs that are running on the system.'
     example "
       describe processes('mysqld') do
-        its('list.length') { should eq 1 }
+        its('entries.length') { should eq 1 }
         its('users') { should eq ['mysql'] }
         its('states') { should include 'S' }
       end
+      describe processes(/.+/).where { label != 'unconfined' && pid < 1000 } do
+        its('users') { should cmp [] }
+      end
     "
 
-    attr_reader :list,
-                :users,
-                :states
-
     def initialize(grep)
+      @grep = grep
       # turn into a regexp if it isn't one yet
       if grep.class == String
-        grep = '(/[^/]*)*'+grep if grep[0] != '/'
-        grep = Regexp.new('^' + grep + '(\s|$)')
+        # if windows ignore case as we can't make up our minds
+        if inspec.os.windows?
+          grep = '(?i)' + grep
+        else
+          grep = '(/[^/]*)*' + grep unless grep[0] == '/'
+          grep = '^' + grep + '(\s|$)'
+        end
+        grep = Regexp.new(grep)
       end
-      all_cmds = ps_aux
+
+      all_cmds = ps_axo
       @list = all_cmds.find_all do |hm|
         hm[:command] =~ grep
       end
+    end
 
-      { users: :user,
-        states: :stat }.each do |var, key|
-        instance_variable_set("@#{var}", @list.map { |l| l[key] }.uniq)
-      end
+    def exists?
+      !@list.empty?
     end
 
     def to_s
-      'Processes'
+      "Processes #{@grep.class == String ? @grep : @grep.inspect}"
     end
 
+    def list
+      warn '[DEPRECATION] `processes.list` is deprecated. Please use `processes.entries` instead. It will be removed in version 2.0.0.'
+      @list
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:labels,   field: 'label')
+          .add(:pids,     field: 'pid')
+          .add(:cpus,     field: 'cpu')
+          .add(:mem,      field: 'mem')
+          .add(:vsz,      field: 'vsz')
+          .add(:rss,      field: 'rss')
+          .add(:tty,      field: 'tty')
+          .add(:states,   field: 'stat')
+          .add(:start,    field: 'start')
+          .add(:time,     field: 'time')
+          .add(:users,    field: 'user')
+          .add(:commands, field: 'command')
+          .connect(self, :filtered_processes)
+
     private
 
-    def ps_aux
+    def filtered_processes
+      @list
+    end
+
+    def ps_axo
       os = inspec.os
 
       if os.linux?
-        command = 'ps auxZ'
-        regex = /^([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+(.*)$/
+        command = 'ps axo label,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,user:32,command'
+        regex = /^([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+(\w{3} \d{2}|\d{2}:\d{2}:\d{2})\s+([^ ]+)\s+([^ ]+)\s+(.*)$/
+      elsif os.windows?
+        command = '$Proc = Get-Process -IncludeUserName | Where-Object {$_.Path -ne $null } | Select-Object PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path | ConvertTo-Csv -NoTypeInformation;$Proc.Replace("""","").Replace("`r`n","`n")'
+        # Wanted to use /(?:^|,)([^,]*)/; works on rubular.com not sure why here?
+        regex = /^(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+)$/
       else
-        command = 'ps aux'
-        regex = /^([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+(.*)$/
+        command = 'ps axo pid,pcpu,pmem,vsz,rss,tty,stat,start,time,user,command'
+        regex = /^\s*([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+([^ ]+)\s+(.*)$/
       end
       build_process_list(command, regex, os)
     end
 
-    Process = Struct.new(:label, :user, :pid,
+    Process = Struct.new(:label, :pid,
                          :cpu, :mem, :vsz,
                          :rss, :tty, :stat,
-                         :start, :time, :command)
+                         :start, :time, :user, :command)
 
     def build_process_list(command, regex, os)
       cmd = inspec.command(command)
       all = cmd.stdout.split("\n")[1..-1]
       return [] if all.nil?
-
       lines = all.map do |line|
         line.match(regex)
       end.compact
-
       lines.map do |m|
         a = m.to_a[1..-1] # grab all matching groups
-        a.unshift(nil) unless os.linux?
-        a[2] = a[2].to_i
+        a.unshift(nil) unless os.linux? || os.windows?
+        a[1] = a[1].to_i
+        a[4] = a[4].to_i
         a[5] = a[5].to_i
-        a[6] = a[6].to_i
         Process.new(*a)
       end
     end

data/lib/resources/rabbitmq_conf.rb

@@ -0,0 +1,53 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'utils/erlang_parser'
+
+module Inspec::Resources
+  class RabbitmqConf < Inspec.resource(1)
+    name 'rabbitmq_config'
+    desc 'Use the rabbitmq_config InSpec resource to test configuration data '\
+         'for the RabbitMQ service located in /etc/rabbitmq/rabbitmq.config on '\
+         'Linux and UNIX platforms.'
+    example "
+      describe rabbitmq_config.params('rabbit', 'ssl_listeners') do
+        it { should cmp 5671 }
+      end
+    "
+
+    def initialize(conf_path = nil)
+      @conf_path = conf_path || '/etc/rabbitmq/rabbitmq.config'
+    end
+
+    def params(*opts)
+      opts.inject(read_params) do |res, nxt|
+        res.respond_to?(:key) ? res[nxt] : nil
+      end
+    end
+
+    def to_s
+      "rabbitmq_config #{@conf_path}"
+    end
+
+    private
+
+    def read_content
+      return @content if defined?(@content)
+      file = inspec.file(@conf_path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{@conf_path}\""
+      end
+
+      @content = file.content
+    end
+
+    def read_params
+      return @params if defined?(@params)
+      return @params = {} if read_content.nil?
+      @params = ErlangConfigFile.parse(read_content)
+    rescue Parslet::ParseFailed
+      raise "Cannot parse RabbitMQ config: \"#{read_content}\""
+    end
+  end
+end

data/lib/resources/registry_key.rb

@@ -1,7 +1,6 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
-# license: All rights reserved
 
 require 'json'
 
@@ -20,7 +19,7 @@ require 'json'
 # describe registry_key({
 #            name: 'Task Scheduler',
 #            hive: 'HKEY_LOCAL_MACHINE',
-#            key: ''\SYSTEM\CurrentControlSet\services\Schedule'
+#            key: '\SYSTEM\CurrentControlSet\services\Schedule'
 # }) do
 #   its('Start') { should eq 2 }
 # end
@@ -63,15 +62,15 @@ module Inspec::Resources
       @options = {}
       if reg_key && reg_key.is_a?(Hash)
         @options = @options.merge!(reg_key)
+
         # generate registry_key if we do not have a regular expression
-        @options[:path] = @options[:hive]
-        # add optional key path
-        @options[:path] += '\\' + @options[:key] if @options[:key]
+        @options[:path] = generate_registry_key_path_from_options
         @options[:name] ||= @options[:path]
       else
         @options[:name] = name
         @options[:path] = reg_key
       end
+
       return skip_resource 'The `registry_key` resource is not supported on your OS yet.' if !inspec.os.windows?
     end
 
@@ -147,6 +146,11 @@ module Inspec::Resources
       script = <<-EOH
       Function InSpec-GetRegistryKey($path) {
         $reg = Get-Item ('Registry::' + $path)
+        if ($reg -eq $null) {
+          Write-Error "InSpec: Failed to find registry key"
+          exit 1001
+        }
+
         $properties = New-Object -Type PSObject
         $reg.Property | ForEach-Object {
             $key = $_
@@ -160,18 +164,23 @@ module Inspec::Resources
         $properties
       }
       $path = '#{path}'
-      InSpec-GetRegistryKey($path) | ConvertTo-Json
+      InSpec-GetRegistryKey($path) | ConvertTo-Json -Compress
       EOH
 
       cmd = inspec.powershell(script)
       # cannot rely on exit code for now, successful command returns exit code 1
       # return nil if cmd.exit_status != 0, try to parse json
       begin
-        @registry_cache = JSON.parse(cmd.stdout)
-        # convert keys to lower case
-        @registry_cache = Hash[@registry_cache.map do |key, value|
-          [key.downcase, value]
-        end]
+        if cmd.exit_status == 1001 && cmd.stderr =~ /InSpec: Failed to find registry key/
+          # TODO: provide the stderr output
+          @registry_cache = nil
+        else
+          @registry_cache = JSON.parse(cmd.stdout)
+          # convert keys to lower case
+          @registry_cache = Hash[@registry_cache.map do |key, value|
+            [key.downcase, value]
+          end]
+        end
       rescue JSON::ParserError => _e
         @registry_cache = nil
       end
@@ -245,6 +254,20 @@ module Inspec::Resources
 
       options[symbol]
     end
+
+    def generate_registry_key_path_from_options
+      path = @options[:hive]
+      path += format_key_from_options
+
+      path
+    end
+
+    def format_key_from_options
+      key = @options[:key]
+      return '' unless key
+
+      key.start_with?('\\') ? key : "\\#{key}"
+    end
   end
 
   # for compatability with serverspec