inspec 1.51.25 → 2.0.16

data/lib/inspec/resource.rb

@@ -74,6 +74,17 @@ module Inspec
   end
 end
 
+# Many resources use FilterTable.
+require 'utils/filter'
+
+# AWS resources are included via their own file.
+require 'resource_support/aws'
+
+require 'resources/azure/azure_backend.rb'
+require 'resources/azure/azure_generic_resource.rb'
+require 'resources/azure/azure_resource_group.rb'
+require 'resources/azure/azure_virtual_machine.rb'
+require 'resources/azure/azure_virtual_machine_data_disk.rb'
 require 'resources/aide_conf'
 require 'resources/apache'
 require 'resources/apache_conf'
@@ -81,7 +92,6 @@ require 'resources/apt'
 require 'resources/audit_policy'
 require 'resources/auditd'
 require 'resources/auditd_conf'
-require 'resources/auditd_rules'
 require 'resources/bash'
 require 'resources/bond'
 require 'resources/bridge'

data/lib/inspec/runner.rb

@@ -129,10 +129,9 @@ module Inspec
     end
 
     def run_tests(with = nil)
-      status, @run_data = @test_collector.run(with)
-      # dont output anything if we want a report
-      render_output(@run_data) unless @conf['report']
-      status
+      run_data = @test_collector.run(with)
+      render_output(run_data)
+      @test_collector.exit_code
     end
 
     # determine all attributes before the execution, fetch data from secrets backend
@@ -259,12 +258,15 @@ module Inspec
 
       return nil if arg.empty?
 
-      if arg[0].respond_to?(:resource_skipped?) && arg[0].resource_skipped?
-        return rspec_skipped_block(arg, opts, arg[0].resource_exception_message)
+      resource = arg[0]
+      # check to see if we are using a filtertable object
+      resource = arg[0].resource if arg[0].class.superclass == FilterTable::Table
+      if resource.respond_to?(:resource_skipped?) && resource.resource_skipped?
+        return rspec_skipped_block(arg, opts, resource.resource_exception_message)
       end
 
-      if arg[0].respond_to?(:resource_failed?) && arg[0].resource_failed?
-        return rspec_failed_block(arg, opts, arg[0].resource_exception_message)
+      if resource.respond_to?(:resource_failed?) && resource.resource_failed?
+        return rspec_failed_block(arg, opts, resource.resource_exception_message)
       end
 
       # If neither skipped nor failed then add the resource

data/lib/inspec/runner_rspec.rb

@@ -74,8 +74,24 @@ module Inspec
     # @return [int] 0 if all went well; otherwise nonzero
     def run(with = nil)
       with ||= RSpec::Core::Runner.new(nil)
-      status = with.run_specs(tests)
-      [status, @formatter.run_data]
+      @rspec_exit_code = with.run_specs(tests)
+      @formatter.results
+    end
+
+    # Return a proper exit code to the runner
+    #
+    # @return [int] exit code
+    def exit_code
+      stats = @formatter.results[:statistics][:controls]
+      if stats[:failed][:total] == 0 && stats[:skipped][:total] == 0
+        0
+      elsif stats[:failed][:total] > 0
+        100
+      elsif stats[:skipped][:total] > 0
+        101
+      else
+        @rspec_exit_code
+      end
     end
 
     # Empty the list of registered tests.

data/lib/inspec/schema.rb

@@ -8,6 +8,31 @@ module Inspec
       'additionalProperties' => false,
       'properties' => {
         'duration' => { 'type' => 'number' },
+        'controls' => {
+          'type' => 'object',
+          'optional' => true,
+          'properties' => {
+            'total' => { 'type' => 'number' },
+            'passed' => {
+              'type' => 'object',
+              'properties' => {
+                'total' => { 'type' => 'number' },
+              },
+            },
+            'skipped' => {
+              'type' => 'object',
+              'properties' => {
+                'total' => { 'type' => 'number' },
+              },
+            },
+            'failed' => {
+              'type' => 'object',
+              'properties' => {
+                'total' => { 'type' => 'number' },
+              },
+            },
+          },
+        },
       },
     }.freeze
 
@@ -137,10 +162,6 @@ module Inspec
         },
         'statistics' => STATISTICS,
         'version' => { 'type' => 'string' },
-
-        # DEPRECATED PROPERTIES!! These will be removed with the next major version bump
-        'controls' => 'array',
-        'other_checks' => 'array',
       },
     }.freeze
 

data/lib/inspec/version.rb

@@ -4,5 +4,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '1.51.25'
+  VERSION = '2.0.16'
 end

data/lib/matchers/matchers.rb

@@ -66,25 +66,6 @@ RSpec::Matchers.define :be_executable do
   end
 end
 
-# matcher to check /etc/passwd, /etc/shadow and /etc/group
-RSpec::Matchers.define :contain_legacy_plus do
-  match do |file|
-    warn '[DEPRECATION] `contain_legacy_plus` is deprecated and will be removed in the next major version. Please use `describe file(\'/etc/passwd\') do its(\'content\') { should_not match /^\+:/ } end`'
-    file.content =~ /^\+:/
-  end
-end
-
-# verifies that no entry in an array contains a value
-RSpec::Matchers.define :contain_match do |regex|
-  match do |arr|
-    warn '[DEPRECATION] `contain_match` is deprecated and will be removed in the next major version. See https://github.com/chef/inspec/issues/738 for more details'
-    arr.inject { |result, i|
-      result = i.match(regex)
-      result || i.match(/$/)
-    }
-  end
-end
-
 RSpec::Matchers.define :contain_duplicates do
   match do |arr|
     dup = arr.select { |element| arr.count(element) > 1 }
@@ -105,11 +86,6 @@ RSpec::Matchers.define :be_installed do
   chain :by do
     raise "[UNSUPPORTED] Please use the new resources 'gem', 'npm' or 'pip'."
   end
-
-  chain :with_version do |version|
-    warn "[DEPRECATION] `with_version` is deprecated.  Please use `its('version') { should eq '1.4.1' }` instead."
-    @version = version
-  end
 end
 
 # for services
@@ -143,32 +119,6 @@ RSpec::Matchers.define :be_running do
   end
 end
 
-# user resource matcher for serverspec compatibility
-# Deprecated: You should not use this matcher anymore
-RSpec::Matchers.define :belong_to_group do |compare_group|
-  match do |user|
-    warn "[DEPRECATION] `belong_to_group` is deprecated.  Please use `its('groups') { should include('root') }` instead."
-    user.groups.include?(compare_group)
-  end
-
-  failure_message do |group|
-    "expected that the user belongs to group `#{group}`"
-  end
-end
-
-# user resource matcher for serverspec compatibility
-# Deprecated: You should not use this matcher anymore
-RSpec::Matchers.define :belong_to_primary_group do |compare_group|
-  match do |user|
-    warn "[DEPRECATION] `belong_to_primary_group` is deprecated.  Please use `its('group') { should eq 'root' }` instead."
-    user.group == compare_group
-  end
-
-  failure_message do |group|
-    "expected that the user belongs to primary group `#{group}`"
-  end
-end
-
 # matcher to check if host is reachable
 RSpec::Matchers.define :be_reachable do
   match do |host|
@@ -214,14 +164,6 @@ RSpec::Matchers.define :have_rule do |rule|
   end
 end
 
-# deprecated
-RSpec::Matchers.define :contain do |rule|
-  match do |resource|
-    warn "[DEPRECATION] `contain` matcher. Please use the following syntax `its('content') { should include('value') }`."
-    expect(resource).to include(rule)
-  end
-end
-
 # `be_in` matcher
 # You can use it in the following cases:
 # - check if an item or array is included in a given array
@@ -269,7 +211,7 @@ end
 RSpec::Matchers.define :cmp do |first_expected| # rubocop:disable Metrics/BlockLength
 
   def integer?(value)
-    !(value =~ /\A-?0+\Z|\A-?[1-9]\d*\Z/).nil?
+    !(value =~ /\A0+\Z|\A[1-9]\d*\Z/).nil?
   end
 
   def float?(value)

data/lib/resource_support/aws.rb

@@ -0,0 +1,40 @@
+# Main AWS loader file.  The intent is for this to be
+# loaded only if AWS resources are needed.
+
+require 'aws-sdk' # TODO: split once ADK v3 is in use
+
+require 'resource_support/aws/aws_backend_factory_mixin'
+require 'resource_support/aws/aws_resource_mixin'
+require 'resource_support/aws/aws_singular_resource_mixin'
+require 'resource_support/aws/aws_plural_resource_mixin'
+require 'resource_support/aws/aws_backend_base'
+
+# Load all AWS resources
+# TODO: loop over and load entire directory
+# for f in ls lib/resources/aws/*; do t=$(echo $f | cut -c 5- | cut -f1 -d. ); echo "require '${t}'"; done
+require 'resources/aws/aws_cloudtrail_trail'
+require 'resources/aws/aws_cloudtrail_trails'
+require 'resources/aws/aws_cloudwatch_alarm'
+require 'resources/aws/aws_cloudwatch_log_metric_filter'
+require 'resources/aws/aws_ec2_instance'
+require 'resources/aws/aws_iam_access_key'
+require 'resources/aws/aws_iam_access_keys'
+require 'resources/aws/aws_iam_group'
+require 'resources/aws/aws_iam_groups'
+require 'resources/aws/aws_iam_password_policy'
+require 'resources/aws/aws_iam_policies'
+require 'resources/aws/aws_iam_policy'
+require 'resources/aws/aws_iam_role'
+require 'resources/aws/aws_iam_root_user'
+require 'resources/aws/aws_iam_user'
+require 'resources/aws/aws_iam_users'
+require 'resources/aws/aws_kms_keys'
+require 'resources/aws/aws_route_table'
+require 'resources/aws/aws_s3_bucket'
+require 'resources/aws/aws_security_group'
+require 'resources/aws/aws_security_groups'
+require 'resources/aws/aws_sns_topic'
+require 'resources/aws/aws_subnet'
+require 'resources/aws/aws_subnets'
+require 'resources/aws/aws_vpc'
+require 'resources/aws/aws_vpcs'

data/lib/resource_support/aws/aws_backend_base.rb

@@ -0,0 +1,12 @@
+class AwsBackendBase
+  attr_reader :aws_transport
+  class << self; attr_accessor :aws_client_class end
+
+  def initialize(inspec = nil)
+    @aws_transport = inspec ? inspec.backend : nil
+  end
+
+  def aws_service_client
+    aws_transport.aws_client(self.class.aws_client_class)
+  end
+end

data/lib/resource_support/aws/aws_backend_factory_mixin.rb

@@ -0,0 +1,12 @@
+# Intended to be pulled in via extend, not include
+module AwsBackendFactoryMixin
+  def create(inspec)
+    @selected_backend.new(inspec)
+  end
+
+  def select(klass)
+    @selected_backend = klass
+  end
+
+  alias set_default_backend select
+end

data/lib/resource_support/aws/aws_plural_resource_mixin.rb

@@ -0,0 +1,21 @@
+module AwsPluralResourceMixin
+  include AwsResourceMixin
+  attr_reader :table
+
+  # This sets up a class, AwsSomeResource::BackendFactory, that
+  # provides a mechanism to create and use backends without
+  # having to know which is selected.  This is mainly used for
+  # unit testing.
+  # TODO: DRY up.  This code exists in both the Singular and Plural mixins.
+  # We'd like to put it in AwsResourceMixin, but included only sees the
+  # directly-including class - we can't see second-order includers.
+  def self.included(base)
+    # Create a new class, whose body is simply to extend the
+    # backend factory mixin
+    resource_backend_factory_class = Class.new(Object) do
+      extend AwsBackendFactoryMixin
+    end
+    # Name that class
+    base.const_set('BackendFactory', resource_backend_factory_class)
+  end
+end

data/lib/resource_support/aws/aws_resource_mixin.rb

@@ -0,0 +1,66 @@
+module AwsResourceMixin
+  def initialize(resource_params = {})
+    validate_params(resource_params).each do |param, value|
+      instance_variable_set(:"@#{param}", value)
+    end
+    catch_aws_errors do
+      fetch_from_api
+    end
+  rescue ArgumentError => e
+    # continue with ArgumentError if testing
+    raise unless respond_to?(:inspec)
+    raise Inspec::Exceptions::ResourceFailed, e.message
+  end
+
+  # Default implementation of validate params accepts everything.
+  def validate_params(resource_params)
+    resource_params
+  end
+
+  def check_resource_param_names(raw_params: {}, allowed_params: [], allowed_scalar_name: nil, allowed_scalar_type: nil)
+    # Some resources allow passing in a single ID value.  Check and convert to hash if so.
+    if allowed_scalar_name && !raw_params.is_a?(Hash)
+      value_seen = raw_params
+      if value_seen.is_a?(allowed_scalar_type)
+        raw_params = { allowed_scalar_name => value_seen }
+      else
+        raise ArgumentError, 'If you pass a single value to the resource, it must ' \
+                             "be a #{allowed_scalar_type}, not an #{value_seen.class}."
+      end
+    end
+
+    # Remove all expected params from the raw param hash
+    recognized_params = {}
+    allowed_params.each do |expected_param|
+      recognized_params[expected_param] = raw_params.delete(expected_param) if raw_params.key?(expected_param)
+    end
+
+    # Any leftovers are unwelcome
+    unless raw_params.empty?
+      raise ArgumentError, "Unrecognized resource param '#{raw_params.keys.first}'. Expected parameters: #{allowed_params.join(', ')}"
+    end
+
+    recognized_params
+  end
+
+  def inspec_runner
+    # When running under inspec-cli, we have an 'inspec' method that
+    # returns the runner. When running under unit tests, we don't
+    # have that, but we still have to call this to pass something
+    # (nil is OK) to the backend.
+    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
+    inspec if respond_to?(:inspec)
+  end
+
+  # Intercept AWS exceptions
+  def catch_aws_errors
+    yield
+  rescue Aws::Errors::MissingCredentialsError
+    # The AWS error here is unhelpful:
+    # "unable to sign request without credentials set"
+    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
+    fail_resource('No AWS credentials available')
+  rescue Aws::Errors::ServiceError => e
+    fail_resource e.message
+  end
+end

data/lib/resource_support/aws/aws_singular_resource_mixin.rb

@@ -0,0 +1,24 @@
+module AwsSingularResourceMixin
+  include AwsResourceMixin
+
+  def exists?
+    @exists
+  end
+
+  # This sets up a class, AwsSomeResource::BackendFactory, that
+  # provides a mechanism to create and use backends without
+  # having to know which is selected.  This is mainly used for
+  # unit testing.
+  # TODO: DRY up.  This code exists in both the Singular and Plural mixins.
+  # We'd like to put it in AwsResourceMixin, but included only sees the
+  # directly-including class - we can't see second-order includers.
+  def self.included(base)
+    # Create a new class, whose body is simply to extend the
+    # backend factory mixin
+    resource_backend_factory_class = Class.new(Object) do
+      extend AwsBackendFactoryMixin
+    end
+    # Name that class
+    base.const_set('BackendFactory', resource_backend_factory_class)
+  end
+end

data/lib/resources/aide_conf.rb

@@ -1,11 +1,11 @@
 # encoding: utf-8
-# author: Jen Burns, burnsjennifere@gmail.com
 
 require 'utils/filter'
 require 'utils/parser'
 module Inspec::Resources
   class AideConf < Inspec.resource(1)
     name 'aide_conf'
+    supports platform: 'unix'
     desc 'Use the aide_conf InSpec audit resource to test the rules established for
       the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.'
     example "