inspec 2.0.32 → 2.0.45

data/lib/resources/shadow.rb

@@ -1,140 +1,146 @@
-# encoding: utf-8
-# copyright: 2016, Chef Software Inc.
-
-require 'forwardable'
-
-# The file format consists of
-# - user
-# - password
-# - last_change
-# - min_days before password change
-# - max_days until password change
-# - warn_days before warning about expiry
-# - inactive_days before deactivating the account
-# - expiry_date when this account will expire
-
-module Inspec::Resources
-  class Shadow < Inspec.resource(1)
-    name 'shadow'
-    supports platform: 'unix'
-    desc 'Use the shadow InSpec resource to test the contents of /etc/shadow, '\
-         'which contains the following information for users that may log into '\
-         'the system and/or as users that own running processes.'
-    example "
-      describe shadow do
-        its('users') { should_not include 'forbidden_user' }
-      end
-
-      describe shadow.users('bin') do
-        its('passwords') { should cmp 'x' }
-        its('count') { should eq 1 }
-      end
-    "
-
-    extend Forwardable
-    attr_reader :params
-    attr_reader :content
-    attr_reader :lines
-
-    def initialize(path = '/etc/shadow', opts = nil)
-      opts ||= {}
-      @path = path || '/etc/shadow'
-      @content = opts[:content] || inspec.file(@path).content
-      @lines = @content.to_s.split("\n")
-      @filters = opts[:filters] || ''
-      @params = @lines.map { |l| parse_shadow_line(l) }
-    end
-
-    def filter(hm = {})
-      return self if hm.nil? || hm.empty?
-      res = @params
-      filters = ''
-      hm.each do |attr, condition|
-        condition = condition.to_s if condition.is_a? Integer
-        filters += " #{attr} = #{condition.inspect}"
-        res = res.find_all do |line|
-          case line[attr.to_s]
-          when condition
-            true
-          else
-            false
-          end
-        end
-      end
-      content = res.map { |x| x.values.join(':') }.join("\n")
-      Shadow.new(@path, content: content, filters: @filters + filters)
-    end
-
-    def entries
-      @lines.map do |line|
-        params = parse_shadow_line(line)
-        Shadow.new(@path, content: line,
-                   filters: "#{@filters} on entry user=#{params['user']}")
-      end
-    end
-
-    def users(name = nil)
-      name.nil? ? map_data('user') : filter(user: name)
-    end
-
-    def passwords(password = nil)
-      password.nil? ? map_data('password') : filter(password: password)
-    end
-
-    def last_changes(filter_by = nil)
-      filter_by.nil? ? map_data('last_change') : filter(last_change: filter_by)
-    end
-
-    def min_days(filter_by = nil)
-      filter_by.nil? ? map_data('min_days') : filter(min_days: filter_by)
-    end
-
-    def max_days(filter_by = nil)
-      filter_by.nil? ? map_data('max_days') : filter(max_days: filter_by)
-    end
-
-    def warn_days(filter_by = nil)
-      filter_by.nil? ? map_data('warn_days') : filter(warn_days: filter_by)
-    end
-
-    def inactive_days(filter_by = nil)
-      filter_by.nil? ? map_data('inactive_days') : filter(inactive_days: filter_by)
-    end
-
-    def expiry_dates(filter_by = nil)
-      filter_by.nil? ? map_data('expiry_date') : filter(expiry_date: filter_by)
-    end
-
-    def to_s
-      f = @filters.empty? ? '' : ' with'+@filters
-      "/etc/shadow#{f}"
-    end
-
-    def_delegator :@params, :length, :count
-
-    private
-
-    def map_data(id)
-      @params.map { |x| x[id] }
-    end
-
-    # Parse a line of /etc/shadow
-    #
-    # @param [String] line a line of /etc/shadow
-    # @return [Hash] Map of entries in this line
-    def parse_shadow_line(line)
-      x = line.split(':')
-      {
-        'user'          => x.at(0),
-        'password'      => x.at(1),
-        'last_change'   => x.at(2),
-        'min_days'      => x.at(3),
-        'max_days'      => x.at(4),
-        'warn_days'     => x.at(5),
-        'inactive_days' => x.at(6),
-        'expiry_date'   => x.at(7),
-        'reserved'      => x.at(8),
-      }
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2016, Chef Software Inc.
+
+require 'utils/filter'
+
+# The file format consists of
+# - user
+# - password
+# - last_change
+# - min_days before password change
+# - max_days until password change
+# - warn_days before warning about expiry
+# - inactive_days before deactivating the account
+# - expiry_date when this account will expire
+
+module Inspec::Resources
+  class Shadow < Inspec.resource(1)
+    name 'shadow'
+    supports platform: 'unix'
+    desc 'Use the shadow InSpec resource to test the contents of /etc/shadow, '\
+         'which contains information for users that may log into '\
+         'the system and/or as users that own running processes.'
+    example "
+      describe shadow do
+        its('user') { should_not include 'forbidden_user' }
+      end
+
+      describe shadow.user('bin') do
+        its('password') { should cmp 'x' }
+        its('count') { should eq 1 }
+      end
+    "
+
+    attr_reader :params
+    attr_reader :lines
+
+    def initialize(path = '/etc/shadow', opts = nil)
+      opts ||= {}
+      @path = path || '/etc/shadow'
+      @raw_content = opts[:content] || inspec.file(@path).content
+      @lines = @raw_content.to_s.split("\n")
+      @filters = opts[:filters] || ''
+      @params = @lines.map { |l| parse_shadow_line(l) }
+    end
+
+    filtertable = FilterTable.create
+    filtertable
+      .add_accessor(:where)
+      .add_accessor(:entries)
+      .add(:user, field: 'user')
+      .add(:password, field: 'password')
+      .add(:last_change, field: 'last_change')
+      .add(:min_days, field: 'min_days')
+      .add(:max_days, field: 'max_days')
+      .add(:warn_days, field: 'warn_days')
+      .add(:inactive_days, field: 'inactive_days')
+      .add(:expiry_date, field: 'expiry_date')
+      .add(:reserved, field: 'reserved')
+
+    filtertable.add(:content) { |t, _|
+      t.entries.map do |e|
+        [e.user, e.password, e.last_change, e.min_days, e.max_days, e.warn_days, e.inactive_days, e.expiry_date].compact.join(':')
+      end.join("\n")
+    }
+
+    filtertable.add(:count) { |i, _|
+      i.entries.length
+    }
+
+    filtertable.connect(self, :params)
+
+    def filter(query = {})
+      return self if query.nil? || query.empty?
+      res = @params
+      filters = ''
+      query.each do |attr, condition|
+        condition = condition.to_s if condition.is_a? Integer
+        filters += " #{attr} = #{condition.inspect}"
+        res = res.find_all do |line|
+          case line[attr.to_s]
+          when condition
+            true
+          else
+            false
+          end
+        end
+      end
+      content = res.map { |x| x.values.join(':') }.join("\n")
+      Shadow.new(@path, content: content, filters: @filters + filters)
+    end
+
+    def users(query = nil)
+      warn '[DEPRECATION] The shadow `users` property is deprecated and will be removed' \
+       ' in InSpec 3.0.  Please use `user` instead.'
+      query.nil? ? user : user(query)
+    end
+
+    def passwords(query = nil)
+      warn '[DEPRECATION] The shadow `passwords` property is deprecated and will be removed' \
+       ' in InSpec 3.0.  Please use `password` instead.'
+      query.nil? ? password : password(query)
+    end
+
+    def last_changes(query = nil)
+      warn '[DEPRECATION] The shadow `last_changes` property is deprecated and will be removed' \
+       ' in InSpec 3.0.  Please use `last_change` instead.'
+      query.nil? ? last_change : last_change(query)
+    end
+
+    def expiry_dates(query = nil)
+      warn '[DEPRECATION] The shadow `expiry_dates` property is deprecated and will be removed' \
+       ' in InSpec 3.0.  Please use `expiry_date` instead.'
+      query.nil? ? expiry_date : expiry_date(query)
+    end
+
+    def to_s
+      f = @filters.empty? ? '' : ' with'+@filters
+      "/etc/shadow#{f}"
+    end
+
+    private
+
+    def map_data(id)
+      @params.map { |x| x[id] }
+    end
+
+    # Parse a line of /etc/shadow
+    #
+    # @param [String] line a line of /etc/shadow
+    # @return [Hash] Map of entries in this line
+    def parse_shadow_line(line)
+      x = line.split(':')
+      {
+        'user'          => x.at(0),
+        'password'      => x.at(1),
+        'last_change'   => x.at(2),
+        'min_days'      => x.at(3),
+        'max_days'      => x.at(4),
+        'warn_days'     => x.at(5),
+        'inactive_days' => x.at(6),
+        'expiry_date'   => x.at(7),
+        'reserved'      => x.at(8),
+      }
+    end
+  end
+end

data/lib/resources/ssh_conf.rb

@@ -1,102 +1,102 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-require 'utils/simpleconfig'
-
-module Inspec::Resources
-  class SshConf < Inspec.resource(1)
-    name 'ssh_config'
-    supports platform: 'unix'
-    desc 'Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms.'
-    example "
-      describe ssh_config do
-        its('cipher') { should contain '3des' }
-        its('port') { should eq '22' }
-        its('hostname') { should include('example.com') }
-      end
-    "
-
-    def initialize(conf_path = nil, type = nil)
-      @conf_path = conf_path || '/etc/ssh/ssh_config'
-      typename = (@conf_path.include?('sshd') ? 'Server' : 'Client')
-      @type = type || "SSH #{typename} configuration #{conf_path}"
-    end
-
-    def content
-      read_content
-    end
-
-    def params(*opts)
-      opts.inject(read_params) do |res, nxt|
-        res.respond_to?(:key) ? res[nxt] : nil
-      end
-    end
-
-    def convert_hash(hash)
-      new_hash = {}
-      hash.each do |k, v|
-        new_hash[k.downcase] = v
-      end
-      new_hash
-    end
-
-    def method_missing(name)
-      param = read_params[name.to_s.downcase]
-      return nil if param.nil?
-      # extract first value if we have only one value in array
-      return param[0] if param.length == 1
-      param
-    end
-
-    def to_s
-      'SSH Configuration'
-    end
-
-    private
-
-    def read_content
-      return @content if defined?(@content)
-      file = inspec.file(@conf_path)
-      if !file.file?
-        return skip_resource "Can't find file \"#{@conf_path}\""
-      end
-
-      @content = file.content
-      if @content.nil? || (@content.empty? && !file.size.zero?)
-        return skip_resource "Can't read file \"#{@conf_path}\""
-      end
-
-      @content
-    end
-
-    def read_params
-      return @params if defined?(@params)
-      return @params = {} if read_content.nil?
-      conf = SimpleConfig.new(
-        read_content,
-        assignment_regex: /^\s*(\S+?)\s+(.*?)\s*$/,
-        multiple_values: true,
-      )
-      @params = convert_hash(conf.params)
-    end
-  end
-
-  class SshdConf < SshConf
-    name 'sshd_config'
-    supports platform: 'unix'
-    desc 'Use the sshd_config InSpec audit resource to test configuration data for the Open SSH daemon located at /etc/ssh/sshd_config on Linux and UNIX platforms. sshd---the Open SSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.'
-    example "
-      describe sshd_config do
-        its('Protocol') { should eq '2' }
-      end
-    "
-
-    def initialize(path = nil)
-      super(path || '/etc/ssh/sshd_config')
-    end
-
-    def to_s
-      'SSHD Configuration'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+
+module Inspec::Resources
+  class SshConf < Inspec.resource(1)
+    name 'ssh_config'
+    supports platform: 'unix'
+    desc 'Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms.'
+    example "
+      describe ssh_config do
+        its('cipher') { should contain '3des' }
+        its('port') { should eq '22' }
+        its('hostname') { should include('example.com') }
+      end
+    "
+
+    def initialize(conf_path = nil, type = nil)
+      @conf_path = conf_path || '/etc/ssh/ssh_config'
+      typename = (@conf_path.include?('sshd') ? 'Server' : 'Client')
+      @type = type || "SSH #{typename} configuration #{conf_path}"
+    end
+
+    def content
+      read_content
+    end
+
+    def params(*opts)
+      opts.inject(read_params) do |res, nxt|
+        res.respond_to?(:key) ? res[nxt] : nil
+      end
+    end
+
+    def convert_hash(hash)
+      new_hash = {}
+      hash.each do |k, v|
+        new_hash[k.downcase] = v
+      end
+      new_hash
+    end
+
+    def method_missing(name)
+      param = read_params[name.to_s.downcase]
+      return nil if param.nil?
+      # extract first value if we have only one value in array
+      return param[0] if param.length == 1
+      param
+    end
+
+    def to_s
+      'SSH Configuration'
+    end
+
+    private
+
+    def read_content
+      return @content if defined?(@content)
+      file = inspec.file(@conf_path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{@conf_path}\""
+      end
+
+      @content = file.content
+      if @content.nil? || (@content.empty? && !file.size.zero?)
+        return skip_resource "Can't read file \"#{@conf_path}\""
+      end
+
+      @content
+    end
+
+    def read_params
+      return @params if defined?(@params)
+      return @params = {} if read_content.nil?
+      conf = SimpleConfig.new(
+        read_content,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s*$/,
+        multiple_values: true,
+      )
+      @params = convert_hash(conf.params)
+    end
+  end
+
+  class SshdConf < SshConf
+    name 'sshd_config'
+    supports platform: 'unix'
+    desc 'Use the sshd_config InSpec audit resource to test configuration data for the Open SSH daemon located at /etc/ssh/sshd_config on Linux and UNIX platforms. sshd---the Open SSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.'
+    example "
+      describe sshd_config do
+        its('Protocol') { should eq '2' }
+      end
+    "
+
+    def initialize(path = nil)
+      super(path || '/etc/ssh/sshd_config')
+    end
+
+    def to_s
+      'SSHD Configuration'
+    end
+  end
+end