inspec 1.31.0 → 1.45.9

data/lib/resources/file.rb

@@ -84,6 +84,13 @@ module Inspec::Resources
       file_permission_granted?('execute', by_usergroup, by_specific_user)
     end
 
+    def allowed?(permission, opts = {})
+      return false unless exist?
+      return skip_resource '`allowed?` is not supported on your OS yet.' if @perms_provider.nil?
+
+      file_permission_granted?(permission, opts[:by], opts[:by_user])
+    end
+
     def mounted?(expected_options = nil, identical = false)
       mounted = file.mounted
 
@@ -112,14 +119,20 @@ module Inspec::Resources
       (mode & 04000) > 0
     end
 
+    alias setuid? suid
+
     def sgid
       (mode & 02000) > 0
     end
 
+    alias setgid? sgid
+
     def sticky
       (mode & 01000) > 0
     end
 
+    alias sticky? sticky
+
     def to_s
       "File #{source_path}"
     end
@@ -200,18 +213,82 @@ module Inspec::Resources
     end
 
     def check_file_permission_by_user(access_type, user, path)
-      access_rule = case access_type
-                    when 'read'
-                      '@(\'FullControl\', \'Modify\', \'ReadAndExecute\', \'Read\', \'ListDirectory\')'
-                    when 'write'
-                      '@(\'FullControl\', \'Modify\', \'Write\')'
-                    when 'execute'
-                      '@(\'FullControl\', \'Modify\', \'ReadAndExecute\', \'ExecuteFile\')'
-                    else
-                      raise 'Invalid access_type provided'
-                    end
+      access_rule = translate_perm_names(access_type)
+      access_rule = convert_to_powershell_array(access_rule)
+
       cmd = inspec.command("@(@((Get-Acl '#{path}').access | Where-Object {$_.AccessControlType -eq 'Allow' -and $_.IdentityReference -eq '#{user}' }) | Where-Object {($_.FileSystemRights.ToString().Split(',') | % {$_.trim()} | ? {#{access_rule} -contains $_}) -ne $null}) | measure | % { $_.Count }")
       cmd.stdout.chomp == '0' ? false : true
     end
+
+    private
+
+    def convert_to_powershell_array(arr)
+      if arr.empty?
+        '@()'
+      else
+        %{@('#{arr.join("', '")}')}
+      end
+    end
+
+    # Translates a developer-friendly string into a list of acceptable
+    # FileSystemRights that match it, because Windows has a fun heirarchy
+    # of permissions that are able to be noted in multiple ways.
+    #
+    # See also: https://www.codeproject.com/Reference/871338/AccessControl-FileSystemRights-Permissions-Table
+    def translate_perm_names(access_type)
+      names = translate_common_perms(access_type)
+      names ||= translate_granular_perms(access_type)
+      names ||= translate_uncommon_perms(access_type)
+      raise 'Invalid access_type provided' unless names
+    end
+
+    def translate_common_perms(access_type)
+      case access_type
+      when 'full-control'
+        %w{FullControl}
+      when 'modify'
+        translate_perm_names('full-control') + %w{Modify}
+      when 'read'
+        translate_perm_names('modify') + %w{ReadAndExecute Read}
+      when 'write'
+        translate_perm_names('modify') + %w{Write}
+      when 'execute'
+        translate_perm_names('modify') + %w{ReadAndExecute ExecuteFile Traverse}
+      when 'delete'
+        translate_perm_names('modify') + %w{Delete}
+      end
+    end
+
+    def translate_uncommon_perms(access_type)
+      case access_type
+      when 'delete-subdirectories-and-files'
+        translate_perm_names('full-control') + %w{DeleteSubdirectoriesAndFiles}
+      when 'change-permissions'
+        translate_perm_names('full-control') + %w{ChangePermissions}
+      when 'take-ownership'
+        translate_perm_names('full-control') + %w{TakeOwnership}
+      end
+    end
+
+    def translate_granular_perms(access_type)
+      case access_type
+      when 'write-data', 'create-files'
+        translate_perm_names('write') + %w{WriteData CreateFiles}
+      when 'append-data', 'create-directories'
+        translate_perm_names('write') + %w{CreateDirectories AppendData}
+      when 'write-extended-attributes'
+        translate_perm_names('write') + %w{WriteExtendedAttributes}
+      when 'write-attributes'
+        translate_perm_names('write') + %w{WriteAttributes}
+      when 'read-data', 'list-directory'
+        translate_perm_names('read') + %w{ReadData ListDirectory}
+      when 'read-attributes'
+        translate_perm_names('read') + %w{ReadAttributes}
+      when 'read-extended-attributes'
+        translate_perm_names('read') + %w{ReadExtendedAttributes}
+      when 'read-permissions'
+        translate_perm_names('read') + %w{ReadPermissions}
+      end
+    end
   end
 end

data/lib/resources/firewalld.rb

@@ -0,0 +1,144 @@
+# encoding: utf-8
+# author: Matthew
+
+module Inspec::Resources
+  class FirewallD < Inspec.resource(1)
+    ###
+    #  This recourse assumes that the file sudo vim /etc/polkit-1/rules.d/49-nopasswd_global.rules has been
+    #  set to allow users in group "wheel" to perform any commands without authentication.
+    ###
+
+    name 'firewalld'
+    desc 'Use the firewalld resource to check and see if firewalld is configured to grand or deny access to specific hosts or services'
+    example "
+      describe firewalld do
+        it { should be_running }
+        its('default_zone') { should eq 'public' }
+        it { should have_service_enabled_in_zone('ssh', 'public') }
+        it { should have_rule_enabled('rule family=ipv4 source address=192.168.0.14 accept', 'public') }
+      end
+
+      describe firewalld.where { zone == 'public' } do
+        its('interfaces') { should cmp ['enp0s3', 'eno2'] }
+        its('sources') { should cmp ['ssh', 'icmp'] }
+        its('services') { should cmp ['192.168.1.0/24', '192.168.1.2'] }
+      end
+    "
+
+    attr_reader :params
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:zone,       field: 'zone')
+          .add(:interfaces, field: 'interfaces')
+          .add(:sources,    field: 'sources')
+          .add(:services,   field: 'services')
+
+    filter.connect(self, :params)
+
+    def initialize
+      return skip_resource 'The `etc_hosts_deny` resource is not supported on your OS.' unless inspec.os.linux?
+      @params = parse_active_zones(active_zones)
+    end
+
+    def installed?
+      inspec.command('firewall-cmd').exist?
+    end
+
+    def has_zone?(query_zone)
+      return false unless installed?
+      result = firewalld_command('--get-zones').split(' ')
+      result.include?(query_zone)
+    end
+
+    def running?
+      return false unless installed?
+      result = firewalld_command('--state')
+      result =~ /^running/ ? true : false
+    end
+
+    def default_zone
+      # return: word associated with the name of the default zone
+      # example: 'public'
+      firewalld_command('--get-default-zone')
+    end
+
+    def has_service_enabled_in_zone?(query_service, query_zone = default_zone)
+      firewalld_command("--zone=#{query_zone} --query-service=#{query_service}") == 'yes'
+    end
+
+    def service_ports_enabled_in_zone(query_service, query_zone = default_zone)
+      # return: String of ports open
+      # example: ['22/tcp', '4722/tcp']
+      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-ports --permanent").split(' ')
+    end
+
+    def service_protocols_enabled_in_zone(query_service, query_zone = default_zone)
+      # return: String of protocoals open
+      # example: ['icmp', 'ipv4', 'igmp']
+      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-protocols --permanent").split(' ')
+    end
+
+    def has_port_enabled_in_zone?(query_port, query_zone = default_zone)
+      firewalld_command("--zone=#{query_zone} --query-port=#{query_port}") == 'yes'
+    end
+
+    def has_rule_enabled?(rule, query_zone = default_zone)
+      rule = 'rule ' + rule
+      firewalld_command("--zone=#{query_zone} --query-rich-rule=#{rule}") == 'yes'
+    end
+
+    private
+
+    def active_zones
+      # return syntax:
+      #   [default-zone-name]
+      #       interfaces: [open interfases]
+      #
+      # example:
+      #   public
+      #       interfaces: enp0s3
+      firewalld_command('--get-active-zones')
+    end
+
+    def parse_active_zones(content)
+      # Split by every second line, which contains the zone and the interfaces.
+      content = content.split(/\n/).each_slice(2).map { |slice| slice.join("\n") }
+      content.map do |line|
+        parse_line(line)
+      end.compact
+    end
+
+    def parse_line(line)
+      zone = line.split("\n")[0]
+      {
+        'zone' => zone,
+        'interfaces' => line.split(':')[1].split(' '),
+        'services' =>   services_bound(zone),
+        'sources' =>    sources_bound(zone),
+      }
+    end
+
+    def sources_bound(query_zone)
+      # result: a list containing either an ip address or ip address with a mask, or a ipset or an ipset with the ipset prefix.
+      # example: ['192.168.0.4', '192.168.0.0/16', '2111:DB28:ABC:12::', '2111:db89:ab3d:0112::0/64']
+      firewalld_command("--zone=#{query_zone} --list-sources").split(' ')
+    end
+
+    def services_bound(query_zone)
+      # result: a list of services bound to a zone.
+      # example: ['ssh', 'dhcpv6-client']
+      firewalld_command("--zone=#{query_zone} --list-services").split(' ')
+    end
+
+    def firewalld_command(command)
+      command = "firewall-cmd #{command}"
+      result = inspec.command(command)
+      if result.stderr != ''
+        return "Error on command #{command}: #{result.stderr}"
+      end
+      result.stdout.strip
+    end
+  end
+end

data/lib/resources/groups.rb

@@ -90,7 +90,6 @@ module Inspec::Resources
 
     def initialize(groupname)
       @group = groupname
-      @group = @group.downcase unless inspec.os.windows?
 
       # select group manager
       @group_provider = select_group_manager(inspec.os)

data/lib/resources/host.rb

@@ -113,7 +113,10 @@ module Inspec::Resources
     end
 
     def to_s
-      "Host #{hostname}"
+      resource_name = "Host #{hostname}"
+      resource_name += " port #{port} proto #{protocol}" if port
+
+      resource_name
     end
 
     private
@@ -148,17 +151,17 @@ module Inspec::Resources
     def resolve_with_dig(hostname)
       addresses = []
 
-      # look for IPv6 addresses
-      cmd = inspec.command("dig +short AAAA #{hostname}")
+      # look for IPv4 addresses
+      cmd = inspec.command("dig +short A #{hostname}")
       cmd.stdout.lines.each do |line|
-        matched = line.chomp.match(Resolv::IPv6::Regex)
+        matched = line.chomp.match(Resolv::IPv4::Regex)
         addresses << matched.to_s unless matched.nil?
       end
 
-      # look for IPv4 addresses
-      cmd = inspec.command("dig +short A #{hostname}")
+      # look for IPv6 addresses
+      cmd = inspec.command("dig +short AAAA #{hostname}")
       cmd.stdout.lines.each do |line|
-        matched = line.chomp.match(Resolv::IPv4::Regex)
+        matched = line.chomp.match(Resolv::IPv6::Regex)
         addresses << matched.to_s unless matched.nil?
       end
 
@@ -166,13 +169,25 @@ module Inspec::Resources
     end
 
     def resolve_with_getent(hostname)
-      # TODO: we rely on getent hosts for now, but it prefers to return IPv6, only then IPv4
-      cmd = inspec.command("getent hosts #{hostname}")
-      return nil if cmd.exit_status.to_i != 0
+      cmd = inspec.command("getent ahosts #{hostname}")
+      return nil unless cmd.exit_status.to_i.zero?
+
+      # getent ahosts output is formatted like so:
+      # $ getent ahosts www.google.com
+      # 172.217.8.4     STREAM www.google.com
+      # 172.217.8.4     DGRAM
+      # 172.217.8.4     RAW
+      # 2607:f8b0:4004:803::2004 STREAM
+      # 2607:f8b0:4004:803::2004 DGRAM
+      # 2607:f8b0:4004:803::2004 RAW
+      addresses = []
+      cmd.stdout.lines.each do |line|
+        ip, = line.split(/\s+/, 2)
+        next unless ip.match(Resolv::IPv4::Regex) || ip.match(Resolv::IPv6::Regex)
+        addresses << ip unless addresses.include?(ip)
+      end
 
-      # extract ip adress
-      resolve = /^\s*(?<ip>\S+)\s+(.*)\s*$/.match(cmd.stdout.chomp)
-      [resolve[1]] if resolve
+      addresses
     end
   end
 
@@ -210,7 +225,7 @@ module Inspec::Resources
     def missing_requirements(protocol)
       missing = []
 
-      if protocol == 'tcp' && (!inspec.command('nc').exist? || !inspec.command('ncat').exist?)
+      if protocol == 'tcp' && (!inspec.command('nc').exist? && !inspec.command('ncat').exist?)
         missing << 'netcat must be installed'
       end
 
@@ -245,7 +260,7 @@ module Inspec::Resources
     end
 
     def resolve(hostname)
-      inspec.command('dig').exist? ? resolve_with_dig(hostname) : resolve_with_getent(hostname)
+      resolve_with_getent(hostname)
     end
   end
 

data/lib/resources/http.rb

@@ -22,50 +22,206 @@ module Inspec::Resources
         its('Content-Length') { should cmp 258 }
         its('Content-Type') { should cmp 'text/html; charset=UTF-8' }
       end
+
+      # properly execute the HTTP call on the scanned machine instead of the
+      # machine executing InSpec. This will be the default behavior in InSpec 2.0.
+      describe http('http://localhost:8080', enable_remote_worker: true) do
+        its('body') { should cmp 'local web server on target machine' }
+      end
     "
 
     def initialize(url, opts = {})
       @url = url
-      @method = opts.fetch(:method, 'GET')
-      @params = opts.fetch(:params, nil)
-      @auth = opts.fetch(:auth, {})
-      @headers = opts.fetch(:headers, {})
-      @data = opts.fetch(:data, nil)
-      @open_timeout = opts.fetch(:open_timeout, 60)
-      @read_timeout = opts.fetch(:read_timeout, 60)
-      @ssl_verify = opts.fetch(:ssl_verify, true)
+      @opts = opts
+
+      if use_remote_worker?
+        return skip_resource 'curl is not available on the target machine' unless inspec.command('curl').exist?
+        @worker = Worker::Remote.new(inspec, http_method, url, opts)
+      else
+        @worker = Worker::Local.new(http_method, url, opts)
+      end
     end
 
     def status
-      response.status
+      @worker.status
+    end
+
+    def headers
+      Hashie::Mash.new(@worker.response_headers)
     end
 
     def body
-      response.body
+      @worker.body
     end
 
-    def headers
-      Hashie::Mash.new(response.headers.to_h)
+    def http_method
+      @opts.fetch(:method, 'GET')
     end
 
     def to_s
-      "http #{@method} on #{@url}"
+      "http #{http_method} on #{@url}"
     end
 
     private
 
-    def response
-      conn = Faraday.new url: @url, headers: @headers, params: @params, ssl: { verify: @ssl_verify }
+    def use_remote_worker?
+      return false if inspec.local_transport?
+      return true if @opts[:enable_remote_worker]
+
+      warn "[DEPRECATION] #{self} will execute locally instead of the target machine. To execute remotely, add `enable_remote_worker: true`."
+      warn '[DEPRECATION] `enable_remote_worker: true` will be the default behavior in InSpec 2.0.'
+      false
+    end
+
+    class Worker
+      class Base
+        attr_reader :http_method, :opts, :url
+
+        def initialize(http_method, url, opts)
+          @http_method = http_method
+          @url = url
+          @opts = opts
+        end
+
+        private
+
+        def params
+          opts.fetch(:params, nil)
+        end
+
+        def username
+          opts.fetch(:auth, {})[:user]
+        end
+
+        def password
+          opts.fetch(:auth, {})[:pass]
+        end
+
+        def request_headers
+          opts.fetch(:headers, {})
+        end
+
+        def request_body
+          opts[:data]
+        end
+
+        def open_timeout
+          opts.fetch(:open_timeout, 60)
+        end
+
+        def read_timeout
+          opts.fetch(:read_timeout, 60)
+        end
+
+        def ssl_verify?
+          opts.fetch(:ssl_verify, true)
+        end
+      end
+
+      class Local < Base
+        def status
+          response.status
+        end
+
+        def body
+          response.body
+        end
+
+        def response_headers
+          response.headers.to_h
+        end
+
+        private
+
+        def response
+          return @response if @response
+          conn = Faraday.new url: url, headers: request_headers, params: params, ssl: { verify: ssl_verify? }
+
+          # set basic authentication
+          conn.basic_auth username, password unless username.nil? || password.nil?
+
+          # set default timeout
+          conn.options.timeout      = read_timeout  # open/read timeout in seconds
+          conn.options.open_timeout = open_timeout  # connection open timeout in seconds
+
+          @response = conn.send(http_method.downcase) do |req|
+            req.body = request_body
+          end
+        end
+      end
+
+      class Remote < Base
+        attr_reader :inspec
+
+        def initialize(inspec, http_method, url, opts)
+          @inspec = inspec
+          super(http_method, url, opts)
+        end
+
+        def status
+          run_curl
+          @status
+        end
+
+        def body
+          run_curl
+          @body&.strip
+        end
+
+        def response_headers
+          run_curl
+          @response_headers
+        end
+
+        private
+
+        def run_curl
+          return if @ran_curl
+
+          response = inspec.command(curl_command).stdout
+          @ran_curl = true
+          return if response.nil?
+
+          # strip any carriage returns to normalize output
+          response.delete!("\r")
+
+          # split the prelude (status line and headers) and the body
+          prelude, @body = response.split("\n\n", 2)
+          prelude = prelude.lines
+
+          # grab the status off of the first line of the prelude
+          status_line = prelude.shift
+          @status = status_line.split(' ', 3)[1].to_i
+
+          # parse the rest of the prelude which will be all the HTTP headers
+          @response_headers = {}
+          prelude.each do |line|
+            line.strip!
+            key, value = line.split(':', 2)
+            @response_headers[key] = value.strip
+          end
+        end
+
+        def curl_command # rubocop:disable Metrics/AbcSize
+          cmd = ["curl -i -X #{http_method}"]
+          cmd << "--connect-timeout #{open_timeout}"
+          cmd << "--max-time #{open_timeout+read_timeout}"
+          cmd << "--user \'#{username}:#{password}\'" unless username.nil? || password.nil?
+          cmd << '--insecure' unless ssl_verify?
+          cmd << "--data #{Shellwords.shellescape(request_body)}" unless request_body.nil?
 
-      # set basic authentication
-      conn.basic_auth @auth[:user], @auth[:pass] unless @auth.empty?
+          request_headers.each do |k, v|
+            cmd << "-H '#{k}: #{v}'"
+          end
 
-      # set default timeout
-      conn.options.timeout      = @read_timeout  # open/read timeout in seconds
-      conn.options.open_timeout = @open_timeout  # connection open timeout in seconds
+          if params.nil?
+            cmd << "'#{url}'"
+          else
+            cmd << "'#{url}?#{params.map { |e| e.join('=') }.join('&')}'"
+          end
 
-      @response = conn.send(@method.downcase) do |req|
-        req.body = @data
+          cmd.join(' ')
+        end
       end
     end
   end

data/lib/resources/mssql_session.rb

@@ -51,11 +51,11 @@ module Inspec::Resources
       escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
       # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
       cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
-      cmd_string += " -U #{@user} -P '#{@password}'" unless @user.nil? || @password.nil?
+      cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
       if @instance.nil?
-        cmd_string += " -S #{@host}"
+        cmd_string += " -S '#{@host}'"
       else
-        cmd_string += " -S #{@host}\\#{@instance}"
+        cmd_string += " -S '#{@host}\\#{@instance}'"
       end
       cmd = inspec.command(cmd_string)
       out = cmd.stdout + "\n" + cmd.stderr

data/lib/resources/mysql_conf.rb

@@ -33,6 +33,16 @@ module Inspec::Resources
       describe mysql_conf('path') do
         its('setting') { should eq 'value' }
       end
+
+      # Test a parameter set within the [mysqld] section
+      describe mysql_conf do
+        its('mysqld.port') { should cmp 3306 }
+      end
+
+      # Test a parameter set within the [mariadb] section using array notation
+      describe mysql_conf do
+        its(['mariadb', 'max-connections']) { should_not be_nil }
+      end
     "
 
     include FindFiles

data/lib/resources/mysql_session.rb

@@ -38,7 +38,7 @@ module Inspec::Resources
         command += " -h #{@host}"
       end
       command += " --port #{@port}" unless @port.nil?
-      command += " #{db} -s -S #{@socket} -e \"#{escaped_query}\""
+      command += " #{db} -s -e \"#{escaped_query}\""
 
       cmd = inspec.command(command)
       out = cmd.stdout + "\n" + cmd.stderr