inspec 1.0.0 → 1.35.1

data/lib/resources/windows_task.rb

@@ -0,0 +1,106 @@
+# encoding: utf-8
+# author: Gary Bright @username-is-already-taken2
+# author: Chris Beard @cdbeard2016
+module Inspec::Resources
+  class WindowsTasks < Inspec.resource(1)
+    name 'windows_task'
+    desc 'Use the windows_task InSpec audit resource to test task schedules on Microsoft Windows.'
+    example "
+      describe windows_task('\\Microsoft\\Windows\\Time Synchronization\\SynchronizeTime') do
+        it { should be_enabled }
+      end
+
+      describe windows_task('\\Microsoft\\Windows\\AppID\\PolicyConverter') do
+        it { should be_disabled }
+      end
+
+      describe windows_task('\\Microsoft\\Windows\\Defrag\\ScheduledDefrag') do
+        it { should exist }
+      end
+
+      describe windows_task('\\Microsoft\\Windows\\AppID\\PolicyConverter') do
+        its('logon_mode') { should eq 'Interactive/Background' }
+        its('last_result') { should eq '1' }
+        its('task_to_run') { should cmp '%Windir%\\system32\\appidpolicyconverter.exe' }
+        its('run_as_user') { should eq 'LOCAL SERVICE' }
+      end
+    "
+
+    def initialize(taskuri)
+      @taskuri = taskuri
+      @cache = nil
+
+      # verify that this resource is only supported on Windows
+      return skip_resource 'The `windows_task` resource is not supported on your OS.' unless inspec.os.windows?
+    end
+
+    def exists?
+      return true unless info.nil? || info[:uri].nil?
+      false
+    end
+
+    # rubocop:disable Style/WordArray
+    def enabled?
+      return false if info.nil? || info[:state].nil?
+      ['Ready', 'Running'].include?(info[:state])
+    end
+
+    def disabled?
+      return false if info.nil? || info[:state].nil?
+      info[:scheduled_task_state] == 'Disabled' || info[:state] == 'Disabled'
+    end
+
+    def logon_mode
+      info[:logon_mode]
+    end
+
+    def last_result
+      info[:last_result]
+    end
+
+    def task_to_run
+      info[:task_to_run].to_s.strip
+    end
+
+    def run_as_user
+      info[:run_as_user]
+    end
+
+    def type
+      info[:type] unless info.nil?
+    end
+
+    def info
+      return @cache unless @cache.nil?
+      # PowerShell v5 has Get-ScheduledTask cmdlet,
+      # _using something with backward support to v3_
+      # script = "Get-ScheduledTask | ? { $_.URI -eq '#{@taskuri}' } | Select-Object URI,@{N='State';E={$_.State.ToString()}} | ConvertTo-Json"
+
+      # Using schtasks as suggested by @modille but aligning property names to match cmdlet to future proof.
+      script = "schtasks /query /v /fo csv /tn '#{@taskuri}' | ConvertFrom-Csv | Select @{N='URI';E={$_.TaskName}},@{N='State';E={$_.Status.ToString()}},'Logon Mode','Last Result','Task To Run','Run As User','Scheduled Task State' | ConvertTo-Json -Compress"
+
+      cmd = inspec.powershell(script)
+
+      begin
+        params = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      @cache = {
+        uri: params['URI'],
+        state: params['State'],
+        logon_mode: params['Logon Mode'],
+        last_result: params['Last Result'],
+        task_to_run: params['Task To Run'],
+        run_as_user: params['Run As User'],
+        scheduled_task_state: params['Scheduled Task State'],
+        type: 'windows-task',
+      }
+    end
+
+    def to_s
+      "Windows Task '#{@taskuri}'"
+    end
+  end
+end

data/lib/resources/x509_certificate.rb

@@ -0,0 +1,143 @@
+# encoding: utf-8
+# author: Richard Nixon
+# author: Christoph Hartmann
+
+require 'openssl'
+require 'hashie/mash'
+
+module Inspec::Resources
+  class X509CertificateResource < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
+    name 'x509_certificate'
+    desc 'Used to test x.509 certificates'
+    example "
+      describe x509_certificate('/etc/pki/www.mywebsite.com.pem') do
+        its('subject') { should match /CN=My Website/ }
+        its('validity_in_days') { should be > 30 }
+      end
+
+      describe x509_certificate('trials/x509/cert.pem') do
+        it { should be_certificate }
+        it { should be_valid }
+        its('fingerprint') { should eq '62b137bdf427e7273dc2e487877b3033e4c8ce17' }
+        its('signature_algorithm') { should eq 'sha1WithRSAEncryption' }
+        its('validity_in_days') { should_not be < 100 }
+        its('validity_in_days') { should be >= 100 }
+        its('subject_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
+        its('subject.C') { should eq 'DE' }
+        its('subject.emailAddress') { should_not be_empty }
+        its('subject.emailAddress') { should eq 'support@chef.io' }
+        its('issuer_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
+        its('key_length') { should be >= 2048 }
+        its('extensions.subjectKeyIdentifier') { should cmp 'A5:16:0B:12:F4:48:0F:06:6C:32:29:67:98:12:DF:3D:0D:75:9D:5C' }
+      end
+    "
+
+    # @see https://tools.ietf.org/html/rfc5280#page-23
+    def initialize(filename)
+      @certpath = filename
+      @issuer = nil
+      @parsed_subject = nil
+      @parsed_issuer = nil
+      @extensions = nil
+
+      file = inspec.file(@certpath)
+      return skip_resource "Unable to find certificate file #{@certpath}" unless file.exist?
+
+      begin
+        @cert = OpenSSL::X509::Certificate.new file.content
+      rescue OpenSSL::X509::CertificateError
+        @cert = nil
+        return skip_resource "Unable to load certificate #{@certpath}"
+      end
+    end
+
+    # Forward these methods directly to OpenSSL::X509::Certificate instance
+    %w{version not_before not_after signature_algorithm public_key }.each do |m|
+      define_method m.to_sym do |*args|
+        @cert.method(m.to_sym).call(*args)
+      end
+    end
+
+    def certificate?
+      !@cert.nil?
+    end
+
+    def fingerprint
+      return if @cert.nil?
+      OpenSSL::Digest::SHA1.new(@cert.to_der).to_s
+    end
+
+    def serial
+      return if @cert.nil?
+      @cert.serial.to_i
+    end
+
+    def subject_dn
+      return if @cert.nil?
+      @cert.subject.to_s
+    end
+
+    def subject
+      return if @cert.nil?
+      # Return cached subject if we have already parsed it
+      return @parsed_subject if @parsed_subject
+      # Use a Mash to make it easier to access hash elements in "its('subject') {should ...}"
+      @parsed_subject = Hashie::Mash.new(Hash[@cert.subject.to_a.map { |k, v, _| [k, v] }])
+    end
+
+    def issuer_dn
+      return if @cert.nil?
+      @cert.issuer.to_s
+    end
+
+    def issuer
+      return if @cert.nil?
+      # Return cached subject if we have already parsed it
+      return @parsed_issuer if @parsed_issuer
+      # Use a Mash to make it easier to access hash elements in "its('issuer') {should ...}"
+      @parsed_issuer = Hashie::Mash.new(Hash[@cert.issuer.to_a.map { |k, v, _| [k, v] }])
+    end
+
+    def key_length
+      return if @cert.nil?
+      @cert.public_key.n.num_bytes * 8
+    end
+
+    def validity_in_days
+      (not_after - Time.now.utc) / 86400
+    end
+
+    def valid?
+      now = Time.now
+      certificate? && (now >= not_before && now <= not_after)
+    end
+
+    def extensions
+      # Return cached Mash if we already parsed the certificate extensions
+      return @extensions if @extensions
+      # Return the exception class if we failed to instantiate a Cert from file
+      return @cert unless @cert.respond_to? :extensions
+      # Use a Mash to make it easier to access hash elements in "its('entensions') {should ...}"
+      @extensions = Hashie::Mash.new({})
+      # Make sure standard extensions exist so we don't get nil for nil:NilClass
+      # when the user tests for extensions which aren't present
+      %w{
+        keyUsage extendedKeyUsage basicConstraints subjectKeyIdentifier
+        authorityKeyIdentifier subjectAltName issuerAltName authorityInfoAccess
+        crlDistributionPoints issuingDistributionPoint certificatePolicies
+        policyConstraints nameConstraints noCheck tlsfeature nsComment
+      }.each { |extension| @extensions[extension] ||= [] }
+      # Now parse the extensions into the Mash
+      extension_array = @cert.extensions.map(&:to_s)
+      extension_array.each do |extension|
+        kv = extension.split(/ *= */, 2)
+        @extensions[kv.first] = kv.last.split(/ *, */)
+      end
+      @extensions
+    end
+
+    def to_s
+      "x509_certificate #{@certpath}"
+    end
+  end
+end

data/lib/resources/xinetd.rb

@@ -41,6 +41,7 @@ module Inspec::Resources
           .add(:ids,          field: 'id')
           .add(:socket_types, field: 'socket_type')
           .add(:types,        field: 'type')
+          .add(:protocols,    field: 'protocol')
           .add(:wait,         field: 'wait')
           .add(:disabled?) { |x| x.where('disable' => 'no').services.empty? }
           .add(:enabled?) { |x| x.where('disable' => 'yes').services.empty? }
@@ -56,7 +57,7 @@ module Inspec::Resources
       end
 
       @contents[path] = file.content
-      if @contents[path].empty? && file.size > 0
+      if @contents[path].nil? || @contents[path].empty?
         return skip_resource "Can't read file \"#{path}\""
       end
 
@@ -91,8 +92,23 @@ module Inspec::Resources
       params
     end
 
+    # Method used to derive the default protocol used from the socket_type
+    def default_protocol(type)
+      case type
+      when 'stream'
+        'tcp'
+      when 'dgram'
+        'udp'
+      else
+        'unknown'
+      end
+    end
+
     def service_lines
-      @services ||= params['services'].values.flatten.map(&:params)
+      @services ||= params['services'].values.flatten.map { |service|
+        service.params['protocol'] ||= default_protocol(service.params['socket_type'])
+        service.params
+      }
     end
   end
 end

data/lib/resources/xml.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+# author: Jonathan Morley
+
+module Inspec::Resources
+  class XmlConfig < JsonConfig
+    name 'xml'
+    desc 'Use the xml InSpec resource to test configuration data in an XML file'
+    example "
+      describe xml('default.xml') do
+        its('key/sub_key') { should eq(['value']) }
+      end
+    "
+
+    def parse(content)
+      require 'rexml/document'
+      REXML::Document.new(content)
+    end
+
+    def value(key)
+      REXML::XPath.each(@params, key.first.to_s).map(&:text)
+    end
+
+    def to_s
+      "XML #{@path}"
+    end
+  end
+end

data/lib/resources/yaml.rb

@@ -14,8 +14,16 @@ module Inspec::Resources
     name 'yaml'
     desc 'Use the yaml InSpec audit resource to test configuration data in a YAML file.'
     example "
-      describe yaml do
-        its('name') { should eq 'foo' }
+      describe yaml('config.yaml') do
+        its(['driver', 'name']) { should eq 'vagrant' }
+      end
+
+      describe yaml({ command: 'retrieve_data.py --yaml' }) do
+        its('state') { should eq 'open' }
+      end
+
+      describe yaml({ content: \"key1: value1\nkey2: value2\" }) do
+        its('key2') { should cmp 'value2' }
       end
     "
 

data/lib/resources/yum.rb

@@ -2,8 +2,6 @@
 # author: Christoph Hartmann
 # author: Dominik Richter
 
-require 'resources/file'
-
 # Usage:
 # describe yum do
 #   its('repos') { should exist }
@@ -22,6 +20,7 @@ require 'resources/file'
 # describe yum.repo('epel') do
 #   it { should exist }
 #   it { should be_enabled }
+#   its('baseurl') { should include 'mycompany.biz' }
 # end
 #
 # deprecated:
@@ -33,7 +32,7 @@ require 'resources/file'
 module Inspec::Resources
   class Yum < Inspec.resource(1)
     name 'yum'
-    desc 'Use the yum InSpec audit resource to test packages in the Yum repository.'
+    desc 'Use the yum InSpec audit resource to test the configuration of Yum repositories.'
     example "
       describe yum.repo('name') do
         it { should exist }
@@ -121,19 +120,38 @@ module Inspec::Resources
     def info
       return @cache if defined?(@cache)
       selection = @yum.repositories.select { |e| e['id'] == @reponame || shortname(e['id']) == @reponame }
-      @cache = selection[0] if !selection.nil? && selection.length == 1
+      @cache = selection.empty? ? {} : selection.first
       @cache
     end
 
     def exist?
-      !info.nil?
+      !info.empty?
     end
 
     def enabled?
-      repo = info
-      return false if repo.nil?
+      return false unless exist?
       info['status'] == 'enabled'
     end
+
+    # provide a method for each of the repo metadata items we know about
+    [
+      :baseurl,
+      :expire,
+      :filename,
+      :mirrors,
+      :pkgs,
+      :size,
+      :status,
+      :updated,
+    ].each do |key|
+      define_method key do
+        info[key.to_s]
+      end
+    end
+
+    def to_s
+      "YumRepo #{@reponame}"
+    end
   end
 
   # for compatability with serverspec

data/lib/resources/zfs_dataset.rb

@@ -0,0 +1,60 @@
+# encoding: utf-8
+# author: Joseph Benden
+
+module Inspec::Resources
+  class ZfsDataset < Inspec.resource(1)
+    name 'zfs_dataset'
+    desc "
+      Use the zfs_dataset InSpec audit resource to test if the named
+      ZFS Dataset is present and/or has certain properties.
+    "
+    example "
+      describe zfs_dataset('tank/tmp') do
+        its('exec') { should eq('off') }
+        its('setuid') { should eq('off') }
+      end
+    "
+
+    def initialize(zfs_dataset)
+      return skip_resource 'The `zfs_dataset` resource is not supported on your OS yet.' if !inspec.os.bsd?
+      @zfs_dataset = zfs_dataset
+
+      @params = gather
+    end
+
+    # method called by 'it { should exist }'
+    def exists?
+      inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}").exit_status == 0
+    end
+
+    def mounted?
+      return false if !exists?
+      inspec.mount(@params['mountpoint']).mounted?
+    end
+
+    def to_s
+      "ZFS Dataset #{@zfs_dataset}"
+    end
+
+    def gather
+      cmd = inspec.command("/sbin/zfs get -Hp all #{@zfs_dataset}")
+      return nil if cmd.exit_status.to_i != 0
+
+      # parse data
+      cmd.stdout.chomp.split("\n").each_with_object(Hash.new(0)) do |line, h|
+        t = line.split("\t")
+        h[t[1].to_s] = t[2].to_s
+      end
+    end
+
+    # override method
+    def exec
+      @params['exec']
+    end
+
+    # expose all parameters
+    def method_missing(name)
+      @params[name.to_s]
+    end
+  end
+end

data/lib/resources/zfs_pool.rb

@@ -0,0 +1,49 @@
+# encoding: utf-8
+# author: Joseph Benden
+
+module Inspec::Resources
+  class ZfsPool < Inspec.resource(1)
+    name 'zfs_pool'
+    desc "
+      Use the zfs_pool InSpec audit resource to test if the named
+      ZFS Pool is present and/or has certain properties.
+    "
+    example "
+      describe zfs_pool('tank') do
+        its('failmode') { should eq('continue') }
+      end
+    "
+
+    def initialize(zfs_pool)
+      return skip_resource 'The `zfs_pool` resource is not supported on your OS yet.' if !inspec.os.bsd?
+      @zfs_pool = zfs_pool
+
+      @params = gather
+    end
+
+    # method called by 'it { should exist }'
+    def exists?
+      inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}").exit_status == 0
+    end
+
+    def to_s
+      "ZFS Pool #{@zfs_pool}"
+    end
+
+    def gather
+      cmd = inspec.command("/sbin/zpool get -Hp all #{@zfs_pool}")
+      return nil if cmd.exit_status.to_i != 0
+
+      # parse data
+      cmd.stdout.chomp.split("\n").each_with_object(Hash.new(0)) do |line, h|
+        t = line.split("\t")
+        h[t[1].to_s] = t[2].to_s
+      end
+    end
+
+    # expose all parameters
+    def method_missing(name)
+      @params[name.to_s]
+    end
+  end
+end

data/lib/source_readers/flat.rb

@@ -20,13 +20,14 @@ module SourceReaders
       new(target, files)
     end
 
-    attr_reader :metadata, :tests, :libraries
+    attr_reader :metadata, :tests, :libraries, :data_files
 
     def initialize(target, files)
       @target = target
       @metadata = ::Inspec::Metadata.new(nil)
       @tests = load_tests(files)
       @libraries = {}
+      @data_files = {}
     end
 
     private

data/lib/source_readers/inspec.rb

@@ -23,33 +23,52 @@ module SourceReaders
       nil
     end
 
-    attr_reader :metadata, :tests, :libraries
+    attr_reader :metadata, :tests, :libraries, :data_files
 
+    # This create a new instance of an InSpec profile source reader
+    #
+    # @param [FileProvider] target An instance of a FileProvider object that can list files and read them
+    # @param [String] metadata_source eg. inspec.yml or metadata.rb
     def initialize(target, metadata_source)
-      @target = target
-      @metadata = Inspec::Metadata.from_ref(
+      @target     = target
+      @metadata   = load_metadata(metadata_source)
+      @tests      = load_tests
+      @libraries  = load_libs
+      @data_files = load_data_files
+    end
+
+    private
+
+    def load_metadata(metadata_source)
+      Inspec::Metadata.from_ref(
         metadata_source,
         @target.read(metadata_source),
         nil)
-
-      @tests = load_tests
-      @libraries = load_libs
+    rescue Psych::SyntaxError => e
+      raise "Unable to parse inspec.yml: line #{e.line}, #{e.problem} #{e.context}"
+    rescue => e
+      raise "Unable to parse #{metadata_source}: #{e.class} -- #{e.message}"
     end
 
-    private
-
     def load_tests
       tests = @target.files.find_all do |path|
-        path.start_with?('controls', 'test') && path.end_with?('.rb')
+        path.start_with?('controls') && path.end_with?('.rb')
       end
-      Hash[tests.map { |x| [x, @target.read(x)] }]
+      Hash[tests.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
     end
 
     def load_libs
       tests = @target.files.find_all do |path|
         path.start_with?('libraries') && path.end_with?('.rb')
       end
-      Hash[tests.map { |x| [x, @target.read(x)] }]
+      Hash[tests.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
+    end
+
+    def load_data_files
+      files = @target.files.find_all do |path|
+        path.start_with?('files' + File::SEPARATOR)
+      end
+      Hash[files.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
     end
   end
 end

data/lib/utils/command_wrapper.rb

@@ -9,20 +9,20 @@ class CommandWrapper
 
   def self.wrap(cmd, options)
     unless options.is_a?(Hash)
-      fail 'All options for the command wrapper must be provided as a hash. '\
+      raise 'All options for the command wrapper must be provided as a hash. '\
         "You entered: #{options.inspect}. Please consult the documentation."
     end
 
     wrap = options[:wrap]
     if !wrap.nil? && !wrap.is_a?(Proc)
-      fail "Called command wrapper with wrap: #{wrap.inspect}. It must be called with a Proc."
+      raise "Called command wrapper with wrap: #{wrap.inspect}. It must be called with a Proc."
     elsif !wrap.nil?
       return wrap.call(cmd)
     end
 
     shell = options[:shell]
     unless UNIX_SHELLS.include?(shell)
-      fail "Don't know how to wrap commands for shell: #{shell.inspect}."
+      raise "Don't know how to wrap commands for shell: #{shell.inspect}."
     end
 
     path = options[:path] || shell