inspec 1.0.0 → 1.35.1

data/lib/utils/database_helpers.rb

@@ -0,0 +1,77 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+module DatabaseHelper
+  class SQLColumn
+    def initialize(row, name)
+      @row = row
+      @name = name
+    end
+
+    def value
+      @row[@name.downcase]
+    end
+
+    def to_s
+      'SQL Column'
+    end
+  end
+
+  class SQLRow
+    def initialize(query, row)
+      @query = query
+      @row = row
+    end
+
+    def column(column)
+      SQLColumn.new(@row, column)
+    end
+
+    def to_s
+      'SQL Row'
+    end
+  end
+
+  class SQLQueryResult
+    attr_reader :error
+    def initialize(cmd, results)
+      @cmd = cmd
+      @results = results
+    end
+
+    def empty?
+      @results.empty?
+    end
+
+    def successful?
+      @cmd.exit_status == 0 && @error.nil?
+    end
+
+    def row(id)
+      SQLRow.new(self, @results[id])
+    end
+
+    def size
+      @results.size
+    end
+
+    def stdout
+      warn '[DEPRECATION] The `stdout` method is deprecated. Use `row` instead.'
+      @cmd.stdout
+    end
+
+    def stderr
+      warn '[DEPRECATION] The `stderr` method is deprecated. Use `successful?` instead.'
+      @cmd.stderr
+    end
+
+    def inspect
+      to_s
+    end
+
+    def to_s
+      'SQL ResultSet'
+    end
+  end
+end

data/lib/utils/erlang_parser.rb

@@ -0,0 +1,192 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'parslet'
+
+class ErlangParser < Parslet::Parser
+  root :outermost
+  # only designed for rabbitmq config files for now:
+  rule(:outermost) { filler? >> array.maybe >> dot.maybe }
+
+  rule(:exp) {
+    (tuple | array | binary | string | bool | identifier | float | integer) >> filler?
+  }
+
+  rule(:array) {
+    str('[') >> filler? >> (
+      exp.repeat(1) >>
+      (comma >> exp).repeat
+    ).maybe.as(:array) >> str(']') >> filler?
+  }
+
+  rule(:tuple) {
+    str('{') >> filler? >> (
+      exp.repeat(1) >> filler? >>
+      (comma >> exp).repeat
+    ).maybe.as(:tuple) >> str('}') >> filler?
+  }
+
+  rule(:filler?) { space.repeat }
+  rule(:space)   { match('\s+') | match["\n"] | comment }
+
+  rule(:comment) { str('%') >> (match["\n\r"].absent? >> any).repeat }
+  rule(:comma) { str(',') >> filler? }
+  rule(:dot) { str('.') >> filler? }
+  rule(:bool) { str('true').as(:bool) | str('false').as(:bool) }
+
+  rule(:identifier) {
+    (match('[a-zA-Z]') >> match('[a-zA-Z0-9_]').repeat).as(:identifier) >> filler?
+  }
+
+  rule(:float) {
+    (
+      integer >> (
+        str('.') >> match('[0-9]').repeat(1) |
+        str('e') >> match('[0-9]').repeat(1)
+      ).as(:e)
+    ).as(:float) >> filler?
+  }
+
+  rule(:integer) {
+    ((str('+') | str('-')).maybe >> match('[0-9]').repeat(1)).as(:integer) >> filler?
+  }
+
+  rule(:string) { stringS | stringD }
+
+  rule(:stringS) {
+    str("'") >> (
+      str('\\') >> any | str("'").absent? >> any
+    ).repeat.as(:string) >> str("'") >> filler?
+  }
+
+  rule(:stringD) {
+    str('"') >> (
+      str('\\') >> any | str('"').absent? >> any
+    ).repeat.as(:string) >> str('"') >> filler?
+  }
+
+  rule(:binary_item) {
+    (string | integer) >>
+      (str(':') >> integer).maybe.as(:size) >>
+      (str('/') >> identifier).maybe.as(:type) >>
+      filler?
+  }
+
+  rule(:binary) {
+    str('<<') >> filler? >> (
+      binary_item.repeat(1) >>
+      (comma >> binary_item).repeat
+    ).maybe.as(:binary) >> str('>>') >> filler?
+  }
+end
+
+class ErlangBitstream
+  def initialize
+    @data = []     # a stream of 8-bit numbers
+    @cur_bits = '' # a string of binary bits 10010010...
+  end
+
+  TYPES = {
+    'integer' => 8,
+    'float'   => 8*8,
+    'utf8'    => 8,
+    'utf16'   => 8*2,
+    'utf32'   => 8*4,
+  }.freeze
+
+  def bit_size(size, type)
+    raise 'Cannot specify size and type at the same time.' if !type.nil? && !size.nil?
+    return (size || 8).to_i if type.nil?
+    TYPES[type] || raise("Cannot handle binary-stream type #{type}")
+  end
+
+  def add(i)
+    if i[:integer].nil? && i[:string].nil?
+      raise 'No data provided, internal error for binary-stream processing!'
+    end
+    s = bit_size(i[:size], i[:type])
+    unless i[:string].nil?
+      str2int(i[:string].to_s, i[:type]).map { |e| add_bits(int2bits(e, 8)) }
+    else
+      add_int(i[:integer], s)
+    end
+  rescue RuntimeError => e
+    raise 'Error processing Erlang bit string '\
+          "'#{i[:string] || i[:integer]}:#{i[:size]}/#{i[:type]}'. #{e.message}"
+  end
+
+  def str2int(s, type)
+    case type
+    when 'utf8' then s.encode('utf-8').unpack('C*')
+    when 'utf16' then s.encode('utf-16').unpack('C*').drop(2)
+    when 'utf32' then s.encode('utf-32').unpack('C*').drop(4)
+    when 'integer', 'float' then raise "Cannot handle bit string as type #{type}"
+    else s.split('').map { |x| x.ord & 0xff }
+    end
+  end
+
+  def int2bits(i, len)
+    format("%0#{len}b", i)
+  end
+
+  def add_int(v, size)
+    x = v.to_i & (2**size - 1) # only get the bits specified in size
+    add_bits(int2bits(x, size))
+  end
+
+  def add_bits(s)
+    b = (@cur_bits + s).scan(/.{1,8}/)
+    @data += b[0..-2].map { |x| x.to_i(2) }
+    @cur_bits = b.last
+  end
+
+  def value(encoding = 'utf-8')
+    # fill in the rest
+    rest = '0' * (8 - @cur_bits.length) + @cur_bits
+    arr = @data + [rest.to_i(2)]
+    s = arr.pack('C*')
+    s.force_encoding(encoding) unless encoding.nil?
+    s
+  end
+end
+
+class ErlangTransform < Parslet::Transform
+  class Tuple < Array; end
+  class Identifier < String; end
+
+  def self.assemble_binary(seq)
+    b = ErlangBitstream.new
+    seq.each { |i| b.add(i) }
+    b.value
+  end
+
+  rule(string: simple(:x)) { x.to_s }
+  rule(string: []) { '' }
+  rule(integer: simple(:x)) { x.to_i }
+  rule(float: { integer: simple(:a), e: simple(:b) }) { (a+b).to_f }
+  rule(bool: 'true') { true }
+  rule(bool: 'false') { false }
+  rule(binary: subtree(:x)) { x.nil? ? '' : ErlangTransform.assemble_binary(x) }
+  rule(identifier: simple(:x)) { Identifier.new(x.to_s) }
+  rule(array: subtree(:x)) { Array(x) }
+  rule(tuple: subtree(:x)) {
+    x.nil? ? Tuple.new : Tuple.new(x)
+  }
+end
+
+class ErlangConfigFile
+  def self.parse(content)
+    lex = ErlangParser.new.parse(content)
+    tree = ErlangTransform.new.apply(lex)
+    turn_to_hash(tree)
+  end
+
+  def self.turn_to_hash(t)
+    if t.is_a?(Array) && t.all? { |x| x.class == ErlangTransform::Tuple && x.length == 2 }
+      Hash[t.map { |i| [i[0], turn_to_hash(i[1])] }]
+    else
+      t
+    end
+  end
+end

data/lib/utils/filter.rb

@@ -44,6 +44,7 @@ module FilterTable
     def initialize(resource, params, filters)
       @resource = resource
       @params = params
+      @params = [] if @params.nil?
       @filters = filters
     end
 
@@ -69,7 +70,7 @@ module FilterTable
     end
 
     def new_entry(*_)
-      fail "#{self.class} must not be used on its own. It must be inherited "\
+      raise "#{self.class} must not be used on its own. It must be inherited "\
            'and the #new_entry method must be implemented. This is an internal '\
            'error and should not happen.'
     end

data/lib/utils/filter_array.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Chef Software, Inc.
-# license: All rights reserved
 # author: Stephan Renatus
 
 class FilterArray

data/lib/utils/find_files.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -26,8 +25,8 @@ module FindFiles
     type = TYPES[opts[:type].to_sym] if opts[:type]
 
     cmd = "find #{path}"
-    cmd += " -maxdepth #{depth.to_i}" if depth.to_i > 0
     cmd += " -type #{type}" unless type.nil?
+    cmd += " -maxdepth #{depth.to_i}" if depth.to_i > 0
 
     result = inspec.command(cmd)
     exit_status = result.exit_status

data/lib/utils/latest_version.rb

@@ -0,0 +1,21 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+
+require 'json'
+require 'net/http'
+
+class LatestInSpecVersion
+  # fetches the latest version from rubygems server
+  def latest
+    uri = URI('https://rubygems.org/api/v1/gems/inspec.json')
+    res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https',
+                          open_timeout: 0.5, read_timeout: 0.5
+                         ) {|http|
+      http.get(uri.path)
+    }
+    inspec_info = JSON.parse(res.body)
+    inspec_info['version']
+  rescue Exception # rubocop:disable Lint/RescueException
+    nil
+  end
+end

data/lib/utils/nginx_parser.rb

@@ -0,0 +1,76 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'parslet'
+
+class NginxParser < Parslet::Parser
+  root :outermost
+  # only designed for rabbitmq config files for now:
+  rule(:outermost) { filler? >> exp.repeat }
+
+  rule(:filler?) { one_filler.repeat }
+  rule(:one_filler) { match('\s+') | match["\n"] | comment }
+  rule(:space)   { match('\s+') }
+  rule(:comment) { str('#') >> (match["\n\r"].absent? >> any).repeat }
+
+  rule(:exp) {
+    section | assignment
+  }
+  rule(:assignment) {
+    (identifier >> values.maybe.as(:args)).as(:assignment) >> str(';') >> filler?
+  }
+
+  rule(:identifier) {
+    (match('[a-zA-Z]') >> match('\S').repeat).as(:identifier) >> space >> space.repeat
+  }
+
+  rule(:value) {
+    ((match('[#;{]').absent? >> any) >> (
+      str('\\') >> any | match('[#;{]|\s').absent? >> any
+    ).repeat).as(:value) >> space.repeat
+  }
+  rule(:values) {
+    value.repeat >> space.maybe
+  }
+
+  rule(:section) {
+    identifier.as(:section) >> values.maybe.as(:args) >> str('{') >> filler? >> exp.repeat.as(:expressions) >> str('}') >> filler?
+  }
+end
+
+class NginxTransform < Parslet::Transform
+  Group = Struct.new(:id, :args, :body)
+  Exp = Struct.new(:key, :vals)
+
+  def self.assemble_binary(seq)
+    b = ErlangBitstream.new
+    seq.each { |i| b.add(i) }
+    b.value
+  end
+
+  rule(section: { identifier: simple(:x) }, args: subtree(:y), expressions: subtree(:z)) { Group.new(x.to_s, y, z) }
+  rule(assignment: { identifier: simple(:x), args: subtree(:y) }) { Exp.new(x.to_s, y) }
+  rule(value: simple(:x)) { x.to_s }
+end
+
+class NginxConfig
+  def self.parse(content)
+    lex = NginxParser.new.parse(content)
+    tree = NginxTransform.new.apply(lex)
+    gtree = NginxTransform::Group.new(nil, '', tree)
+    read_nginx_group(gtree)
+  rescue Parslet::ParseFailed => err
+    raise "Failed to parse NginX config: #{err}"
+  end
+
+  def self.read_nginx_group(t)
+    agg_conf = Hash.new([])
+    agg_conf['_'] = t.args unless t.args == ''
+
+    groups, conf = t.body.partition { |i| i.is_a? NginxTransform::Group }
+    conf.each { |x| agg_conf[x.key] += [x.vals] }
+    groups.each { |x| agg_conf[x.id] += [read_nginx_group(x)] }
+    agg_conf
+  end
+end

data/lib/utils/object_traversal.rb

@@ -6,11 +6,12 @@ module ObjectTraverser
     key = keys.shift
     return nil if key.nil? || value.nil?
 
-    # if value is an array, iterate over each child
     if value.is_a?(Array)
-      value = value.map { |i|
-        extract_value([key], i)
-      }
+      value = if key.is_a?(Fixnum)
+                value[key]
+              elsif value.respond_to?(key.to_sym)
+                value.send(key.to_sym)
+              end
     else
       value = value[key.to_s].nil? ? nil : value[key.to_s]
     end

data/lib/utils/parser.rb

@@ -63,7 +63,7 @@ module CommentParser
   end
 end
 
-module MountParser
+module LinuxMountParser
   # this parses the output of mount command (only tested on linux)
   # this method expects only one line of the mount output
   def parse_mount_options(mount_line, compatibility = false)
@@ -94,6 +94,20 @@ module MountParser
   end
 end
 
+module BsdMountParser
+  # this parses the output of mount command (only tested on freebsd)
+  # this method expects only one line of the mount output
+  def parse_mount_options(mount_line, _compatibility = false)
+    return {} if mount_line.nil? || mount_line.empty?
+
+    mount = mount_line.chomp.split(' ', 4)
+    options = mount[3].tr('()', '').split(', ')
+
+    # parse device and type
+    { device: mount[0], type: options.shift, options: options }
+  end
+end
+
 module SolarisNetstatParser
   # takes this as a input and parses the values
   # UDP: IPv4
@@ -197,7 +211,7 @@ module XinetdParser
     res = {}
     cur_group = nil
     simple_conf = []
-    rest = raw
+    rest = raw + "\n"
     until rest.empty?
       # extract content line
       nl = rest.index("\n") || (rest.length-1)
@@ -209,7 +223,12 @@ module XinetdParser
       next if inner_line.empty?
 
       if inner_line == '}'
-        res[cur_group] = SimpleConfig.new(simple_conf.join("\n"))
+        if cur_group == 'defaults'
+          res[cur_group] = SimpleConfig.new(simple_conf.join("\n"))
+        else
+          res[cur_group] ||= []
+          res[cur_group].push(SimpleConfig.new(simple_conf.join("\n")))
+        end
         cur_group = nil
       elsif rest.lstrip[0] == '{'
         cur_group = inner_line
@@ -224,7 +243,7 @@ module XinetdParser
         others.each { |ores|
           ores.each { |k, v|
             res[k] ||= []
-            res[k].push(v)
+            res[k].concat(v)
           }
         }
       else

data/lib/utils/plugin_registry.rb

@@ -39,7 +39,7 @@ class PluginRegistry
     #
     # @return [PluginRegistry] plugin registry for this plugin
     def self.plugin_registry
-      fail "Plugin #{self} does not implement `self.plugin_registry()`. This method is required"
+      raise "Plugin #{self} does not implement `self.plugin_registry()`. This method is required"
     end
 
     # Register a new plugin by name
@@ -47,7 +47,7 @@ class PluginRegistry
     # @param [String] the unique name of this plugin
     # @return [nil] disregard
     def self.name(name)
-      fail "Trying to register #{self} with name == nil" if name.nil?
+      raise "Trying to register #{self} with name == nil" if name.nil?
       @name = name
       plugin_registry.registry[name] = self
     end
@@ -72,7 +72,7 @@ class PluginRegistry
     # @param [String] target to try to resolve
     # @return [Plugin] instance if it can be resolved, nil otherwise
     def self.resolve(_target)
-      fail "Plugin #{self} does not implement `self.resolve(target)`. This method is required"
+      raise "Plugin #{self} does not implement `self.resolve(target)`. This method is required"
     end
 
     # When a plugin's resolve doesn't lead to the final state, it can

data/lib/utils/simpleconfig.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Dominik Richter
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -33,7 +32,7 @@ class SimpleConfig
       raw_data = raw_data.tr(options[:line_separator], "\n")
     end
     rest = raw_data
-    rest = parse_rest(rest, options) while rest.length > 0
+    rest = parse_rest(rest, options) until rest.empty?
   end
 
   private
@@ -55,16 +54,28 @@ class SimpleConfig
   end
 
   def parse_params_line(line, opts)
+    # Deprecation handling
+    if opts.key?(:assignment_re)
+      warn '[DEPRECATION] `:assignment_re` is deprecated in favor of `:assignment_regex` '\
+           'and will be removed in the next major version. See: https://github.com/chef/inspec/issues/1709'
+      opts[:assignment_regex] = opts[:assignment_re]
+    end
+    if opts.key?(:key_vals)
+      warn '[DEPRECATION] `:key_vals` is deprecated in favor of `:key_values` '\
+           'and will be removed in the next major version. See: https://github.com/chef/inspec/issues/1709'
+      opts[:key_values] = opts[:key_vals]
+    end
+
     # now line contains what we are interested in parsing
     # check if it is an assignment
-    m = opts[:assignment_re].match(line)
+    m = opts[:assignment_regex].match(line)
     return nil if m.nil?
 
     if opts[:multiple_values]
       @vals[m[1]] ||= []
-      @vals[m[1]].push(parse_values(m, opts[:key_vals]))
+      @vals[m[1]].push(parse_values(m, opts[:key_values]))
     else
-      @vals[m[1]] = parse_values(m, opts[:key_vals])
+      @vals[m[1]] = parse_values(m, opts[:key_values])
     end
   end
 
@@ -73,7 +84,13 @@ class SimpleConfig
     m = opts[:group_re].match(line)
     return nil if m.nil?
     @groups.push(m[1])
-    @vals = @params[m[1]] = {}
+
+    # We use a Hashie::Mash to provide method syntax for retrieving
+    # values. For configs that have keys whose values may be hashes
+    # (such as a mysql config that has [sections]), providing
+    # a hash whose values are accessible via methods provide
+    # a better user experience with `its` blocks.
+    @vals = @params[m[1]] = Hashie::Mash.new
   end
 
   def parse_implicit_assignment_line(line, opts)
@@ -105,9 +122,9 @@ class SimpleConfig
       multiline: false,
       comment_char: '#',
       line_separator: nil, # uses this char to seperate lines before parsing
-      assignment_re: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
+      assignment_regex: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
       group_re: /\[([^\]]+)\]\s*$/,
-      key_vals: 1, # default for key=value, may require for 'key val1 val2 val3'
+      key_values: 1, # default for key=value, may require for 'key val1 val2 val3'
       standalone_comments: false,
       multiple_values: false,
     }

data/lib/utils/spdx.rb

@@ -0,0 +1,13 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+class Spdx
+  def self.licenses
+    spdx_file = File.join(File.dirname(__FILE__), 'spdx.txt').freeze
+    File.read(spdx_file).split("\n")
+  end
+
+  def self.valid_license?(license)
+    licenses.include?(license)
+  end
+end