inspec 1.31.0 → 1.45.9

data/lib/resources/cpan.rb

@@ -0,0 +1,60 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+# author: Markus Grobelin
+
+# Usage:
+# describe cpan('DBD::Pg') do
+#   it { should be_installed }
+# end
+#
+
+module Inspec::Resources
+  class CpanPackage < Inspec.resource(1)
+    name 'cpan'
+    desc 'Use the `cpan` InSpec audit resource to test Perl modules that are installed by system packages or the CPAN installer.'
+    example "
+      describe cpan('DBD::Pg') do
+        it { should be_installed }
+      end
+    "
+
+    def initialize(package_name, perl_lib_path = nil)
+      @package_name = package_name
+      @perl_lib_path = perl_lib_path
+      @perl_cmd = 'perl'
+
+      # this resource is not supported on Windows
+      return skip_resource 'The `cpan` resource is not supported on your OS yet.' if inspec.os.windows?
+      return skip_resource 'perl not found' unless inspec.command(@perl_cmd).exist?
+    end
+
+    def info
+      return @info if defined?(@info)
+
+      @info = {}
+      @info[:type] = 'cpan'
+      @info[:name] = @package_name
+      # set PERL5LIB environment variable if a custom lib path is given
+      lib_path = @perl_lib_path.nil? ? '' : "PERL5LIB=#{@perl_lib_path} "
+      cmd = inspec.command("#{lib_path+@perl_cmd} -le 'eval \"require $ARGV[0]\" and print $ARGV[0]->VERSION or exit 1' #{@package_name}")
+      @info[:installed] = cmd.exit_status.zero?
+      return @info unless cmd.exit_status.zero?
+
+      @info[:version] = cmd.stdout.strip
+      @info
+    end
+
+    def installed?
+      info[:installed] == true
+    end
+
+    def version
+      info[:version]
+    end
+
+    def to_s
+      "Perl Module #{@package_name}"
+    end
+  end
+end

data/lib/resources/cran.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+# author: Markus Grobelin
+
+# Usage:
+# describe cran('DBI') do
+#   it { should be_installed }
+# end
+#
+
+module Inspec::Resources
+  class CranPackage < Inspec.resource(1)
+    name 'cran'
+    desc 'Use the `cran` InSpec audit resource to test R modules that are installed from CRAN package repository.'
+    example "
+      describe cran('DBI') do
+        it { should be_installed }
+      end
+    "
+
+    def initialize(package_name)
+      @package_name = package_name
+      @r_cmd = 'Rscript'
+
+      # this resource is not supported on Windows
+      return skip_resource 'The `cran` resource is not supported on your OS yet.' if inspec.os.windows?
+      return skip_resource 'Rscript not found' unless inspec.command(@r_cmd).exist?
+    end
+
+    def info
+      return @info if defined?(@info)
+
+      @info = {}
+      @info[:type] = 'cran'
+      @info[:name] = @package_name
+      cmd = inspec.command("#{@r_cmd} -e 'packageVersion(\"#{@package_name}\")'")
+      return @info unless cmd.exit_status.zero?
+
+      # Extract package version from Rscript output
+      # Output includes unicode punctuation (backticks) characters like so:
+      # [1] '0.5.1'
+      #
+      # So make sure command output is converted to unicode, as it returns ASCII-8BIT by default
+      utf8_stdout = cmd.stdout.chomp.force_encoding(Encoding::UTF_8)
+      params = /^\[\d+\]\s+(?:\p{Initial_Punctuation})(.+)(?:\p{Final_Punctuation})$/.match(utf8_stdout)
+      @info[:installed] = !params.nil?
+      return @info unless @info[:installed]
+
+      @info[:version] = params[1]
+      @info
+    end
+
+    def installed?
+      info[:installed] == true
+    end
+
+    def version
+      info[:version]
+    end
+
+    def to_s
+      "R Module #{@package_name}"
+    end
+  end
+end

data/lib/resources/docker.rb

@@ -63,7 +63,7 @@ module Inspec::Resources
   # For compatability with Serverspec we also offer the following resouses:
   # - docker_container
   # - docker_image
-  class Docker < Inspec.resource(1)
+  class Docker < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
     name 'docker'
 
     desc "
@@ -167,6 +167,13 @@ module Inspec::Resources
 
         # ensure all keys are there
         j = ensure_container_keys(j)
+
+        # strip off any linked container names
+        # Depending on how it was linked, the actual container name may come before
+        # or after the link information, so we'll just look for the first name that
+        # does not include a slash since that is not a valid character in a container name
+        j['names'] = j['names'].split(',').find { |c| !c.include?('/') }
+
         ps.push(j)
       }
       ps

data/lib/resources/docker_container.rb

@@ -74,11 +74,18 @@ module Inspec::Resources
     end
 
     def repo
-      image.split(':')[0] unless image.nil?
+      return if image.nil? || image_name_from_image.nil?
+      if image.include?('/')                       # host:port/ubuntu:latest
+        repo_part, image_part = image.split('/')   # host:port, ubuntu:latest
+        repo_part + '/' + image_part.split(':')[0] # host:port + / + ubuntu
+      else
+        image_name_from_image.split(':')[0]
+      end
     end
 
     def tag
-      image.split(':')[1] unless image.nil?
+      return if image_name_from_image.nil?
+      image_name_from_image.split(':')[1]
     end
 
     def to_s
@@ -88,6 +95,16 @@ module Inspec::Resources
 
     private
 
+    def image_name_from_image
+      return if image.nil?
+      # possible image names include:
+      #   alpine
+      #   ubuntu:14.04
+      #   repo.example.com:5000/ubuntu
+      #   repo.example.com:5000/ubuntu:1404
+      image.include?('/') ? image.split('/')[1] : image
+    end
+
     def container_info
       return @info if defined?(@info)
       opts = @opts

data/lib/resources/elasticsearch.rb

@@ -0,0 +1,172 @@
+# encoding: utf-8
+
+require 'utils/filter'
+require 'hashie/mash'
+require 'resources/package'
+
+module Inspec::Resources
+  class Elasticsearch < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
+    name 'elasticsearch'
+    desc "Use the Elasticsearch InSpec audit resource to test the status of nodes in
+      an Elasticsearch cluster."
+
+    example "
+      describe elasticsearch('http://eshost.mycompany.biz:9200/', username: 'elastic', password: 'changeme', ssl_verify: false) do
+        its('node_count') { should >= 3 }
+      end
+
+      describe elasticsearch do
+        its('node_name') { should include 'node1' }
+        its('os') { should_not include 'MacOS' }
+        its('version') { should cmp > 1.2.0 }
+      end
+    "
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:cluster_name,          field: 'cluster_name')
+          .add(:node_name,             field: 'name')
+          .add(:transport_address,     field: 'transport_address')
+          .add(:host,                  field: 'host')
+          .add(:ip,                    field: 'ip')
+          .add(:version,               field: 'version')
+          .add(:build_hash,            field: 'build_hash')
+          .add(:total_indexing_buffer, field: 'total_indexing_buffer')
+          .add(:roles,                 field: 'roles')
+          .add(:settings,              field: 'settings')
+          .add(:os,                    field: 'os')
+          .add(:process,               field: 'process')
+          .add(:jvm,                   field: 'jvm')
+          .add(:transport,             field: 'transport')
+          .add(:http,                  field: 'http')
+          .add(:plugins,               field: 'plugins')
+          .add(:plugin_list,           field: 'plugin_list')
+          .add(:modules,               field: 'modules')
+          .add(:module_list,           field: 'module_list')
+          .add(:node_id,               field: 'node_id')
+          .add(:ingest,                field: 'ingest')
+          .add(:exists?) { |x| !x.entries.empty? }
+          .add(:node_count) { |t, _|
+            t.entries.length
+          }
+
+    filter.connect(self, :nodes)
+
+    attr_reader :nodes, :url
+
+    def initialize(opts = {})
+      return skip_resource 'Package `curl` not avaiable on the host' unless inspec.command('curl').exist?
+
+      @url = opts.fetch(:url, 'http://localhost:9200')
+
+      username   = opts.fetch(:username, nil)
+      password   = opts.fetch(:password, nil)
+      ssl_verify = opts.fetch(:ssl_verify, true)
+
+      cmd = inspec.command(curl_command_string(username, password, ssl_verify))
+
+      # after implementation of PR #2235, this begin..rescue won't be necessary.
+      # The checks in verify_curl_success! can raise their own skip message exception.
+      begin
+        verify_curl_success!(cmd)
+      rescue => e
+        return skip_resource e.message
+      end
+
+      begin
+        content = JSON.parse(cmd.stdout)
+        # after implementation of PR #2235, this can be broken out of the begin..rescue
+        # clause. The checks in verify_json_payload! can raise their own skip message exception.
+        verify_json_payload!(content)
+      rescue JSON::ParserError => e
+        return skip_resource "Couldn't parse the Elasticsearch response: #{e.message}"
+      rescue => e
+        return skip_resource e.message
+      end
+
+      @nodes = parse_cluster(content)
+    end
+
+    def to_s
+      "Elasticsearch Cluster #{url}"
+    end
+
+    private
+
+    def parse_cluster(content)
+      return [] unless content['nodes']
+
+      nodes = []
+
+      content['nodes'].each do |node_id, node_data|
+        node_data = fix_mash_key_collision(node_data)
+
+        node = Hashie::Mash.new(node_data)
+        node.node_id = node_id
+        node.plugin_list = node.plugins.map(&:name)
+        node.module_list = node.modules.map(&:name)
+        node.cluster_name = node.settings.cluster.name
+        nodes << node
+      end
+
+      nodes
+    end
+
+    #
+    # Hashie::Mash will throw warnings if the Mash contains a key that is the same as a built-in
+    # method on a Hashie::Mash instance. This is a crude way of avoiding those warnings without
+    # hard-coding a bunch of key renames.
+    #
+    # Any key that is in conflict will be renamed "es_ORIGINALKEY"
+    #
+    def fix_mash_key_collision(data)
+      test_mash = Hashie::Mash.new
+
+      new_data = {}
+      data.each do |key, value|
+        new_key = test_mash.respond_to?(key.to_sym) ? "es_#{key}" : key
+        new_value = value.is_a?(Hash) ? fix_mash_key_collision(value) : value
+
+        new_data[new_key] = new_value
+      end
+
+      new_data
+    end
+
+    def curl_command_string(username, password, ssl_verify)
+      cmd_string = ['curl']
+      cmd_string << '-k' unless ssl_verify
+      cmd_string << "-H 'Content-Type: application/json'"
+      cmd_string << " -u #{username}:#{password}" unless username.nil? || password.nil?
+      cmd_string << URI.join(url, '_nodes')
+
+      cmd_string.join(' ')
+    end
+
+    def verify_curl_success!(cmd)
+      # the following lines captures known possible curl command errors and provides compact skip resource messeges
+      if cmd.stderr =~ /Failed to connect/
+        raise "Connection refused - please check the URL #{url} for accuracy"
+      end
+
+      if cmd.stderr =~ /Peer's Certificate issuer is not recognized/
+        raise 'Connection refused - peer certificate issuer is not recognized'
+      end
+
+      if !cmd.exit_status.zero?
+        raise "Error fetching Elastcsearch data from curl #{url}: #{cmd.stderr}"
+      end
+    end
+
+    def verify_json_payload!(content)
+      unless content['error'].nil?
+        raise "#{content['error']['type']}: #{content['error']['reason']}"
+      end
+
+      if content['_nodes']['successful'].zero?
+        raise 'No successful nodes available in cluster'
+      end
+    end
+  end
+end

data/lib/resources/etc_fstab.rb

@@ -0,0 +1,102 @@
+# encoding: utf-8
+# copyright:
+# author: Matthew Dromazos
+
+require 'utils/parser'
+
+module Inspec::Resources
+  class EtcFstab < Inspec.resource(1)
+    name 'etc_fstab'
+    desc 'Use the etc_fstab InSpec audit resource to check the configuration of the etc/fstab file.'
+    example "
+      nfs_systems = etc_fstab.nfs_file_systems.entries
+      nfs_systems.each do |file_system|
+        describe file_system do
+          its ('mount_options') { should include 'nosuid' }
+          its ('mount_options') { should include 'noexec' }
+          its ('mount_options') { should include 'sec=krb5:krb5i:krb5p }
+        end
+      end
+
+      describe etc_fstab do
+        its ('home_mount_options') { should include 'nosuid' }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(fstab_path = nil)
+      return skip_resource 'The `etc_fstab` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_path      = fstab_path || '/etc/fstab'
+      @files_contents = {}
+      @content        = nil
+      @params         = nil
+      read_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:device_name,           field: 'device_name')
+          .add(:mount_point,           field: 'mount_point')
+          .add(:file_system_type,      field: 'file_system_type')
+          .add(:mount_options,         field: 'mount_options')
+          .add(:dump_options,          field: 'dump_options')
+          .add(:file_system_options,   field: 'file_system_options')
+          .add(:configured?) { |x| x.entries.any? }
+
+    filter.connect(self, :params)
+
+    def nfs_file_systems
+      where { file_system_type.match(/nfs/) }
+    end
+
+    def home_mount_options
+      return nil unless where { mount_point == '/home' }.configured?
+      where { mount_point == '/home' }.entries[0].mount_options
+    end
+
+    private
+
+    def read_content
+      @content = ''
+      @params  = {}
+      @content = read_file(@conf_path)
+      @params  = parse_conf(@content)
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        parse_line(data) unless data == ''
+      end.compact
+    end
+
+    def parse_line(line)
+      attributes = line.split
+      {
+        'device_name'         => attributes[0],
+        'mount_point'         => attributes[1],
+        'file_system_type'    => attributes[2],
+        'mount_options'       => attributes[3].split(','),
+        'dump_options'        => attributes[4].to_i,
+        'file_system_options' => attributes[5].to_i,
+      }
+    end
+
+    def read_file(conf_path = @conf_path)
+      file = inspec.file(conf_path)
+      if !file.file?
+        return skip_resource "Can't find \"#{@conf_path}\""
+      end
+
+      raw_conf = file.content
+      if raw_conf.empty? && !file.empty?
+        return skip_resource("File is empty or unable to read file at path:\"#{@conf_path}\"")
+      end
+      raw_conf.lines
+    end
+  end
+end

data/lib/resources/etc_group.rb

@@ -85,7 +85,7 @@ module Inspec::Resources
       conditions.each do |k, v|
         idx = fields[k.to_sym]
         next if idx.nil?
-        res = res.select { |x| x[idx] == v.to_s }
+        res = res.select { |x| x[idx].to_s == v.to_s }
       end
 
       EtcGroupView.new(self, res)

data/lib/resources/etc_hosts.rb

@@ -0,0 +1,81 @@
+# encoding: utf-8
+# author: Matthew Dromazos
+
+require 'utils/parser'
+
+class EtcHosts < Inspec.resource(1)
+  name 'etc_hosts'
+  desc 'Use the etc_hosts InSpec audit resource to find an
+    ip_address and its associated hosts'
+  example "
+    describe etc_hosts.where { ip_address == '127.0.0.1' } do
+      its('ip_address') { should cmp '127.0.0.1' }
+      its('primary_name') { should cmp 'localhost' }
+      its('all_host_names') { should eq [['localhost', 'localhost.localdomain', 'localhost4', 'localhost4.localdomain4']] }
+    end
+  "
+
+  attr_reader :params
+
+  include CommentParser
+
+  def initialize(hosts_path = nil)
+    return skip_resource 'The `etc_hosts` resource is not supported on your OS.' unless inspec.os.bsd? || inspec.os.linux? || inspec.os.windows?
+    @conf_path      = hosts_path || default_hosts_file_path
+    @content        = nil
+    @params         = nil
+    read_content
+  end
+
+  filter = FilterTable.create
+  filter.add_accessor(:where)
+        .add_accessor(:entries)
+        .add(:ip_address,     field: 'ip_address')
+        .add(:primary_name,   field: 'primary_name')
+        .add(:all_host_names, field: 'all_host_names')
+
+  filter.connect(self, :params)
+
+  private
+
+  def default_hosts_file_path
+    inspec.os.windows? ? 'C:\windows\system32\drivers\etc\hosts' : '/etc/hosts'
+  end
+
+  def read_content
+    @content = ''
+    @params  = {}
+    @content = read_file(@conf_path)
+    @params  = parse_conf(@content)
+  end
+
+  def parse_conf(content)
+    content.map do |line|
+      data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+      parse_line(data) unless data == ''
+    end.compact
+  end
+
+  def parse_line(line)
+    line_parts = line.split
+    return nil unless line_parts.length >= 2
+    {
+      'ip_address'     => line_parts[0],
+      'primary_name'   => line_parts[1],
+      'all_host_names' => line_parts[1..-1],
+    }
+  end
+
+  def read_file(conf_path = @conf_path)
+    file = inspec.file(conf_path)
+    if !file.file?
+      return skip_resource "Can't find file. \"#{@conf_path}\""
+    end
+
+    raw_conf = file.content
+    if raw_conf.empty? && !file.empty?
+      return skip_resource("Could not read file contents\" #{@conf_path}\"")
+    end
+    raw_conf.lines
+  end
+end

data/lib/resources/etc_hosts_allow_deny.rb

@@ -0,0 +1,122 @@
+# encoding: utf-8
+# author: Matthew Dromazos
+
+require 'utils/parser'
+
+module Inspec::Resources
+  class EtcHostsAllow < Inspec.resource(1)
+    name 'etc_hosts_allow'
+    desc 'Use the etc_hosts_allow InSpec audit resource to test the connections
+          the client will allow. Controlled by the /etc/hosts.allow file.'
+    example "
+      describe etc_hosts_allow.where { daemon == 'ALL' } do
+        its('client_list') { should include ['127.0.0.1', '[::1]'] }
+        its('options') { should eq [[]] }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(hosts_allow_path = nil)
+      return skip_resource 'The `etc_hosts_allow` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_path      = hosts_allow_path || '/etc/hosts.allow'
+      @content        = nil
+      @params         = nil
+      read_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:daemon,      field: 'daemon')
+          .add(:client_list, field: 'client_list')
+          .add(:options,     field: 'options')
+
+    filter.connect(self, :params)
+
+    private
+
+    def read_content
+      @content = ''
+      @params  = {}
+      @content = split_daemons(read_file(@conf_path))
+      @params  = parse_conf(@content)
+    end
+
+    def split_daemons(content)
+      split_daemons_list = []
+      content.each do |line|
+        data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        next unless data != ''
+        data.split(':')[0].split(',').each do |daemon|
+          split_daemons_list.push("#{daemon} : " + line.split(':', 2)[1])
+        end
+      end
+      split_daemons_list
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        parse_line(data) unless data == ''
+      end.compact
+    end
+
+    def parse_line(line)
+      daemon, clients_and_options = line.split(/:\s+/, 2)
+      daemon = daemon.strip
+
+      clients_and_options ||= ''
+      clients, options = clients_and_options.split(/\s+:\s+/, 2)
+      client_list = clients.split(/,/).map(&:strip)
+
+      options ||= ''
+      options_list = options.split(/:\s+/).map(&:strip)
+
+      {
+        'daemon'      => daemon,
+        'client_list' => client_list,
+        'options'     => options_list,
+      }
+    end
+
+    def read_file(conf_path = @conf_path)
+      # Determine if the file exists and contains anything, if not
+      # then access control is turned off.
+      file = inspec.file(conf_path)
+      if !file.file?
+        return skip_resource "Can't find file at \"#{@conf_path}\""
+      end
+      raw_conf = file.content
+      if raw_conf.empty? && !file.empty?
+        return skip_resource("Unable to read file \"#{@conf_path}\"")
+      end
+
+      # If there is a file and it contains content, continue
+      raw_conf.lines
+    end
+  end
+
+  class EtcHostsDeny < EtcHostsAllow
+    name 'etc_hosts_deny'
+    desc 'Use the etc_hosts_deny InSpec audit resource to test the connections
+          the client will deny. Controlled by the /etc/hosts.deny file.'
+    example "
+      describe etc_hosts_deny.where { daemon_list == 'ALL' } do
+        its('client_list') { should eq [['127.0.0.1', '[::1]']] }
+        its('options') { should eq [] }
+      end
+    "
+
+    def initialize(path = nil)
+      return skip_resource '`etc_hosts_deny` is not supported on your OS' unless inspec.os.linux?
+      super(path || '/etc/hosts.deny')
+    end
+
+    def to_s
+      'hosts.deny Configuration'
+    end
+  end
+end