inspec 1.31.0 → 1.45.9

data/lib/resources/nginx.rb

@@ -0,0 +1,97 @@
+# encoding: utf-8
+# author: Aaron Lippold, lippold@gmail.com
+# author: Rony Xavier, rx294@gmail.com
+
+require 'pathname'
+require 'hashie/mash'
+
+module Inspec::Resources
+  class Nginx < Inspec.resource(1)
+    name 'nginx'
+    desc 'Use the nginx InSpec audit resource to test information about your NGINX instance.'
+    example "
+      describe nginx do
+        its('conf_path') { should cmp '/etc/nginx/nginx.conf' }
+      end
+      describe nginx('/etc/sbin/') do
+        its('version') { should be >= '1.0.0' }
+      end
+      describe nginx do
+        its('modules') { should include 'my_module' }
+      end
+    "
+    attr_reader :params, :bin_dir
+
+    def initialize(nginx_path = '/usr/sbin/nginx')
+      return skip_resource 'The `nginx` resource is not yet available on your OS.' if inspec.os.windows?
+      return skip_resource 'The `nginx` binary not found in the path provided.' unless inspec.command(nginx_path).exist?
+
+      cmd = inspec.command("#{nginx_path} -V 2>&1")
+      if !cmd.exit_status.zero?
+        return skip_resource 'Error using the command nginx -V'
+      end
+      @data = cmd.stdout
+      @params = {}
+      read_content
+    end
+
+    %w{compiler_info error_log_path http_client_body_temp_path http_fastcgi_temp_path http_log_path http_proxy_temp_path http_scgi_temp_path http_uwsgi_temp_path lock_path modules_path openssl_version prefix sbin_path service support_info version}.each do |property|
+      define_method(property.to_sym) do
+        @params[property.to_sym]
+      end
+    end
+
+    def openssl_version
+      result = @data.scan(/built with OpenSSL\s(\S+)\s(\d+\s\S+\s\d{4})/).flatten
+      Hashie::Mash.new({ 'version' => result[0], 'date' => result[1] })
+    end
+
+    def compiler_info
+      result = @data.scan(/built by (\S+)\s(\S+)\s(\S+)/).flatten
+      Hashie::Mash.new({ 'compiler' => result[0], 'version' => result[1], 'date' => result[2] })
+    end
+
+    def support_info
+      support_info = @data.scan(/(.*\S+) support enabled/).flatten
+      support_info.empty? ? nil : support_info.join(' ')
+    end
+
+    def modules
+      @data.scan(/--with-(\S+)_module/).flatten
+    end
+
+    def to_s
+      'Nginx Environment'
+    end
+
+    private
+
+    def read_content
+      parse_config
+      parse_path
+      parse_http_path
+    end
+
+    def parse_config
+      @params[:prefix] = @data.scan(/--prefix=(\S+)\s/).flatten.first
+      @params[:service] = 'nginx'
+      @params[:version] = @data.scan(%r{nginx version: nginx\/(\S+)\s}).flatten.first
+    end
+
+    def parse_path
+      @params[:sbin_path] = @data.scan(/--sbin-path=(\S+)\s/).flatten.first
+      @params[:modules_path] = @data.scan(/--modules-path=(\S+)\s/).flatten.first
+      @params[:error_log_path] = @data.scan(/--error-log-path=(\S+)\s/).flatten.first
+      @params[:http_log_path] = @data.scan(/--http-log-path=(\S+)\s/).flatten.first
+      @params[:lock_path] = @data.scan(/--lock-path=(\S+)\s/).flatten.first
+    end
+
+    def parse_http_path
+      @params[:http_client_body_temp_path] = @data.scan(/--http-client-body-temp-path=(\S+)\s/).flatten.first
+      @params[:http_proxy_temp_path] = @data.scan(/--http-proxy-temp-path=(\S+)\s/).flatten.first
+      @params[:http_fastcgi_temp_path] = @data.scan(/--http-fastcgi-temp-path=(\S+)\s/).flatten.first
+      @params[:http_uwsgi_temp_path] = @data.scan(/--http-uwsgi-temp-path=(\S+)\s/).flatten.first
+      @params[:http_scgi_temp_path] = @data.scan(/--http-scgi-temp-path=(\S+)\s/).flatten.first
+    end
+  end
+end

data/lib/resources/nginx_conf.rb

@@ -3,6 +3,8 @@
 # author: Christoph Hartmann
 
 require 'utils/nginx_parser'
+require 'utils/find_files'
+require 'forwardable'
 
 # STABILITY: Experimental
 # This resouce needs a proper interace to the underlying data, which is currently missing.
@@ -22,6 +24,10 @@ module Inspec::Resources
       describe nginx_conf('/path/to/my/nginx.conf').params ...
     "
 
+    extend Forwardable
+
+    include FindFiles
+
     attr_reader :contents
 
     def initialize(conf_path = nil)
@@ -37,6 +43,12 @@ module Inspec::Resources
       @params = {}
     end
 
+    def http
+      NginxConfHttp.new(params['http'], self)
+    end
+
+    def_delegators :http, :servers, :locations
+
     def to_s
       "nginx_conf #{@conf_path}"
     end
@@ -84,12 +96,133 @@ module Inspec::Resources
       if data.key?('include')
         data.delete('include').flatten
             .map { |x| File.expand_path(x, rel_path) }
+            .map { |x| find_files(x) }.flatten
             .map { |path| parse_nginx(path) }
-            .map { |e| data.merge!(e) }
+            .each { |conf| merge_config!(data, conf) }
       end
 
       # Walk through the remaining hash fields to find more references
       Hash[data.map { |k, v| [k, resolve_references(v, rel_path)] }]
     end
+
+    # Deep merge fields from NginxConfig.parse.
+    # A regular merge would overwrite values so a deep merge is needed.
+    # @param data [Hash] data structure from NginxConfig.parse
+    # @param conf [Hash] data structure to be deep merged into data
+    # @return [Hash] data structure with conf and data deep merged
+    def merge_config!(data, conf)
+      # Catch edge-cases
+      return if data.nil? || conf.nil?
+      # Step through all conf items and create combined return value
+      data.merge!(conf) do |_, v1, v2|
+        if v1.is_a?(Array) && v2.is_a?(Array)
+          # If both the data field and the conf field are arrays, then combine them
+          v1 + v2
+        elsif v1.is_a?(Hash) && v2.is_a?(Hash)
+          # If both the data field and the conf field are maps, then deep merge them
+          merge_config!(v1, v2)
+        else
+          # All other cases, just use the new value (regular merge behavior)
+          v2
+        end
+      end
+    end
+  end
+
+  class NginxConfHttp
+    attr_reader :entries
+    def initialize(params, parent)
+      @parent = parent
+      @entries = (params || []).map { |x| NginxConfHttpEntry.new(x, parent) }
+    end
+
+    def servers
+      @entries.map(&:servers).flatten
+    end
+
+    def locations
+      servers.map(&:locations).flatten
+    end
+
+    def to_s
+      @parent.to_s + ', http entries'
+    end
+    alias inspect to_s
+  end
+
+  class NginxConfHttpEntry
+    attr_reader :params, :parent
+    def initialize(params, parent)
+      @params = params || {}
+      @parent = parent
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add(:servers, field: 'server')
+          .connect(self, :server_table)
+
+    def locations
+      servers.map(&:locations).flatten
+    end
+
+    def to_s
+      @parent.to_s + ', http entry'
+    end
+    alias inspect to_s
+
+    private
+
+    def server_table
+      @server_table ||= (params['server'] || []).map { |x| { 'server' => NginxConfServer.new(x, self) } }
+    end
+  end
+
+  class NginxConfServer
+    attr_reader :params, :parent
+    def initialize(params, parent)
+      @parent = parent
+      @params = params || {}
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add(:locations, field: 'location')
+          .connect(self, :location_table)
+
+    def to_s
+      server = ''
+      name = Array(params['server_name']).flatten.first
+      unless name.nil?
+        server += name
+        listen = Array(params['listen']).flatten.first
+        server += ":#{listen}" unless listen.nil?
+      end
+
+      # go two levels up: 1. to the http entry and 2. to the root nginx conf
+      @parent.parent.to_s + ", server #{server}"
+    end
+    alias inspect to_s
+
+    private
+
+    def location_table
+      @location_table ||= (params['location'] || []).map { |x| { 'location' => NginxConfLocation.new(x, self) } }
+    end
+  end
+
+  class NginxConfLocation
+    attr_reader :params, :parent
+    def initialize(params, parent)
+      @parent = parent
+      @params = params || {}
+    end
+
+    def to_s
+      location = Array(params['_']).join(' ')
+      # go three levels up: 1. to the server entry, 2. http entry and 3. to the root nginx conf
+      @parent.parent.parent.to_s + ", location #{location.inspect}"
+    end
+    alias inspect to_s
   end
 end

data/lib/resources/oracledb_session.rb

@@ -49,19 +49,20 @@ module Inspec::Resources
       escaped_query = escaped_query.gsub('$', '\\$')
 
       p = nil
-      # check if sqlplus is available and prefer that
-      if inspec.command(@sqlplus_bin).exist?
-        bin = @sqlplus_bin
-        opts = "SET MARKUP HTML ON\nSET FEEDBACK OFF"
-        p = :parse_html_result
-      elsif inspec.command(@sqlcl_bin).exist?
+      # use sqlplus if sqlcl is not available
+      if inspec.command(@sqlcl_bin).exist?
         bin = @sqlcl_bin
         opts = "set sqlformat csv\nSET FEEDBACK OFF"
         p = :parse_csv_result
+      else
+        bin = @sqlplus_bin
+        opts = "SET MARKUP HTML ON\nSET FEEDBACK OFF"
+        p = :parse_html_result
       end
 
-      return skip_resource("Can't find suitable Oracle CLI") if p.nil?
-      command = "echo \"#{opts}\n#{verify_query(escaped_query)}\nEXIT\" | #{bin} -s #{@user}/#{@password}@//#{@host}:#{@port}/#{@service}"
+      query = verify_query(escaped_query)
+      query += ';' unless query.end_with?(';')
+      command = %{echo "#{opts}\n#{query}\nEXIT" | #{bin} "#{@user}"/"#{@password}"@#{@host}:#{@port}/#{@service}}
       cmd = inspec.command(command)
 
       out = cmd.stdout + "\n" + cmd.stderr

data/lib/resources/os_env.rb

@@ -25,8 +25,6 @@ module Inspec::Resources
     attr_reader :content
     def initialize(env = nil)
       @osenv = env
-      @content = nil
-      @content = value_for(env) unless env.nil?
     end
 
     def split
@@ -35,7 +33,12 @@ module Inspec::Resources
       path_separator = inspec.os.windows? ? ';' : ':'
       # -1 is required to catch cases like dir1::dir2:
       # where we have a trailing :
-      @content.nil? ? [] : @content.split(path_separator, -1)
+      content.nil? ? [] : content.split(path_separator, -1)
+    end
+
+    def content
+      return @content if defined?(@content)
+      @content = value_for(@osenv) unless @osenv.nil?
     end
 
     def to_s
@@ -58,7 +61,7 @@ module Inspec::Resources
       out = inspec.command(command)
 
       unless out.exit_status == 0
-        skip_resource "Can't read environment variables on #{os[:name]}. "\
+        skip_resource "Can't read environment variables on #{inspec.os.name}. "\
           "Tried `#{command}` which returned #{out.exit_status}"
       end
 

data/lib/resources/package.rb

@@ -15,6 +15,7 @@ module Inspec::Resources
     example "
       describe package('nginx') do
         it { should be_installed }
+        it { should_not be_held } # for dpkg platforms that support holding a version from being upgraded
         its('version') { should eq 1.9.5 }
       end
     "
@@ -56,6 +57,13 @@ module Inspec::Resources
       info[:installed] == true
     end
 
+    # returns true it the package is held (if the OS supports it)
+    def held?(_provider = nil, _version = nil)
+      return false if info.nil?
+      return false unless info.key?(:held)
+      info[:held] == true
+    end
+
     # returns the package description
     def info
       return @cache if !@cache.nil?
@@ -107,11 +115,14 @@ module Inspec::Resources
         assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
+      # If the package is installed, Status is "install ok installed"
+      # If the package is installed and marked hold, Status is "hold ok installed"
       # If the package is removed and not purged, Status is "deinstall ok config-files" with exit_status 0
       # If the package is purged cmd fails with non-zero exit status
       {
         name: params['Package'],
-        installed: params['Status'].split(' ').first == 'install',
+        installed: params['Status'].split(' ')[2] == 'installed',
+        held: params['Status'].split(' ')[0] == 'hold',
         version: params['Version'],
         type: 'deb',
       }
@@ -182,7 +193,8 @@ module Inspec::Resources
   # MacOS / Darwin implementation
   class Brew < PkgManagement
     def info(package_name)
-      cmd = inspec.command("brew info --json=v1 #{package_name}")
+      brew_path = inspec.command('brew').exist? ? 'brew' : '/usr/local/bin/brew'
+      cmd = inspec.command("#{brew_path} info --json=v1 #{package_name}")
       return nil if cmd.exit_status.to_i != 0
       # parse data
       pkg = JSON.parse(cmd.stdout)[0]

data/lib/resources/packages.rb

@@ -63,7 +63,7 @@ module Inspec::Resources
     end
 
     def filtered_packages
-      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped
+      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped?
       @list
     end
   end

data/lib/resources/pip.rb

@@ -7,6 +7,7 @@
 #   it { should be_installed }
 # end
 #
+
 module Inspec::Resources
   class PipPackage < Inspec.resource(1)
     name 'pip'
@@ -15,10 +16,17 @@ module Inspec::Resources
       describe pip('Jinja2') do
         it { should be_installed }
       end
+
+      describe pip('django', '/path/to/virtualenv/bin/pip') do
+        it { should be_installed }
+        its('version') { should eq('1.11.4')}
+      end
     "
 
-    def initialize(package_name)
+    def initialize(package_name, pip_path = nil)
       @package_name = package_name
+      @pip_cmd = pip_path || default_pip_path
+      return skip_resource 'pip not found' unless inspec.command(@pip_cmd).exist?
     end
 
     def info
@@ -26,7 +34,7 @@ module Inspec::Resources
 
       @info = {}
       @info[:type] = 'pip'
-      cmd = inspec.command("#{pip_cmd} show #{@package_name}")
+      cmd = inspec.command("#{@pip_cmd} show #{@package_name}")
       return @info if cmd.exit_status != 0
 
       params = SimpleConfig.new(
@@ -54,28 +62,28 @@ module Inspec::Resources
 
     private
 
-    def pip_cmd
+    def default_pip_path
+      return 'pip' unless inspec.os.windows?
+
       # Pip is not on the default path for Windows, therefore we do some logic
       # to find the binary on Windows
-      if inspec.os.windows?
-        # we need to detect the pip command on Windows
-        cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
-        begin
-          paths = JSON.parse(cmd.stdout)
-          # use pip if it on system path
-          pipcmd = paths['Pip']
-          # calculate path on windows
-          if defined?(paths['Python']) && pipcmd.nil?
-            pipdir = paths['Python'].split('\\')
-            # remove python.exe
-            pipdir.pop
-            pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
-          end
-        rescue JSON::ParserError => _e
-          return nil
+      cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
+      begin
+        paths = JSON.parse(cmd.stdout)
+        # use pip if it on system path
+        pipcmd = paths['Pip']
+        # calculate path on windows
+        if defined?(paths['Python']) && pipcmd.nil?
+          pipdir = paths['Python'].split('\\')
+          # remove python.exe
+          pipdir.pop
+          pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
         end
+      rescue JSON::ParserError => _e
+        return nil
       end
-      pipcmd || 'pip'
+
+      pipcmd
     end
   end
 end