inspec 2.1.0 → 2.1.10

data/lib/resources/postgres_hba_conf.rb

@@ -1,99 +1,90 @@
-# encoding: utf-8
-
-require 'resources/postgres'
-
-module Inspec::Resources
-  class PostgresHbaConf < Inspec.resource(1)
-    name 'postgres_hba_conf'
-    supports platform: 'unix'
-    desc 'Use the `postgres_hba_conf` InSpec audit resource to test the client
-          authentication data defined in the pg_hba.conf file.'
-    example "
-      describe postgres_hba_conf.where { type == 'local' } do
-        its('auth_method') { should eq ['peer'] }
-      end
-    "
-
-    attr_reader :conf_file, :params
-
-    # @todo add checks to ensure that we have data in our file
-    def initialize(hba_conf_path = nil)
-      @conf_file = hba_conf_path || File.expand_path('pg_hba.conf', inspec.postgres.conf_dir)
-      @content = ''
-      @params = {}
-      read_content
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:type,     field: 'type')
-          .add(:database, field: 'database')
-          .add(:user,     field: 'user')
-          .add(:address,  field: 'address')
-          .add(:auth_method, field: 'auth_method')
-          .add(:auth_params, field: 'auth_params')
-
-    filter.connect(self, :params)
-
-    def to_s
-      "Postgres Hba Config #{@conf_file}"
-    end
-
-    private
-
-    def clean_conf_file(conf_file = @conf_file)
-      data = inspec.file(conf_file).content.to_s.lines
-      content = []
-      data.each do |line|
-        line.chomp!
-        content << line unless line.match(/^\s*#/) || line.empty?
-      end
-      content
-    end
-
-    def read_content(config_file = @conf_file)
-      file = inspec.file(config_file)
-
-      if !file.file?
-        return skip_resource "Can't find file \"#{@conf_file}\""
-      end
-
-      raw_conf = file.content
-
-      if raw_conf.empty? && !file.empty?
-        return skip_resource("Can't read the contents of \"#{@conf_file}\"")
-      end
-
-      # @todo use SimpleConfig here if we can
-      # ^\s*(\S+)\s+(\S+)\s+(\S+)\s(?:(\d*.\d*.\d*.\d*\/\d*)|(::\/\d+))\s+(\S+)\s*(.*)?\s*$
-
-      @content = clean_conf_file(@conf_file)
-      @params = parse_conf(@content)
-      @params.each do |line|
-        if line['type'] == 'local'
-          line['auth_method'] = line['address']
-          line['address'] = ''
-        end
-      end
-    end
-
-    def parse_conf(content)
-      content.map do |line|
-        parse_line(line)
-      end.compact
-    end
-
-    def parse_line(line)
-      x = line.split(/\s+/)
-      {
-        'type' => x[0],
-        'database' => x[1],
-        'user' => x[2],
-        'address' => x[3],
-        'auth_method' => x[4],
-        'auth_params' =>  ('' if x.length == 4) || x[5..-1].join(' '),
-      }
-    end
-  end
-end
+# encoding: utf-8
+
+require 'resources/postgres'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class PostgresHbaConf < Inspec.resource(1)
+    name 'postgres_hba_conf'
+    supports platform: 'unix'
+    desc 'Use the `postgres_hba_conf` InSpec audit resource to test the client
+          authentication data defined in the pg_hba.conf file.'
+    example "
+      describe postgres_hba_conf.where { type == 'local' } do
+        its('auth_method') { should eq ['peer'] }
+      end
+    "
+
+    include FileReader
+
+    attr_reader :conf_file, :params
+
+    # @todo add checks to ensure that we have data in our file
+    def initialize(hba_conf_path = nil)
+      @conf_file = hba_conf_path || File.expand_path('pg_hba.conf', inspec.postgres.conf_dir)
+      @content = ''
+      @params = {}
+      read_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:type,     field: 'type')
+          .add(:database, field: 'database')
+          .add(:user,     field: 'user')
+          .add(:address,  field: 'address')
+          .add(:auth_method, field: 'auth_method')
+          .add(:auth_params, field: 'auth_params')
+
+    filter.connect(self, :params)
+
+    def to_s
+      "Postgres Hba Config #{@conf_file}"
+    end
+
+    private
+
+    def clean_conf_file(conf_file = @conf_file)
+      data = read_file_content(conf_file).to_s.lines
+      content = []
+      data.each do |line|
+        line.chomp!
+        content << line unless line.match(/^\s*#/) || line.empty?
+      end
+      content
+    end
+
+    def read_content(config_file = @conf_file)
+      # @todo use SimpleConfig here if we can
+      # ^\s*(\S+)\s+(\S+)\s+(\S+)\s(?:(\d*.\d*.\d*.\d*\/\d*)|(::\/\d+))\s+(\S+)\s*(.*)?\s*$
+
+      @content = clean_conf_file(config_file)
+      @params = parse_conf(@content)
+      @params.each do |line|
+        if line['type'] == 'local'
+          line['auth_method'] = line['address']
+          line['address'] = ''
+        end
+      end
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        parse_line(line)
+      end.compact
+    end
+
+    def parse_line(line)
+      x = line.split(/\s+/)
+      {
+        'type' => x[0],
+        'database' => x[1],
+        'user' => x[2],
+        'address' => x[3],
+        'auth_method' => x[4],
+        'auth_params' =>  ('' if x.length == 4) || x[5..-1].join(' '),
+      }
+    end
+  end
+end

data/lib/resources/postgres_ident_conf.rb

@@ -1,76 +1,79 @@
-# encoding: utf-8
-
-require 'resources/postgres'
-
-module Inspec::Resources
-  class PostgresIdentConf < Inspec.resource(1)
-    name 'postgres_ident_conf'
-    supports platform: 'unix'
-    desc 'Use the postgres_ident_conf InSpec audit resource to test the client
-          authentication data is controlled by a pg_ident.conf file.'
-    example "
-      describe postgres_ident_conf.where { pg_username == 'acme_user' } do
-        its('map_name') { should eq ['ssl-test'] }
-      end
-    "
-
-    attr_reader :params, :conf_file
-
-    def initialize(ident_conf_path = nil)
-      @conf_file = ident_conf_path || File.expand_path('pg_ident.conf', inspec.postgres.conf_dir)
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:map_name,        field: 'map_name')
-          .add(:system_username, field: 'system_username')
-          .add(:pg_username,     field: 'pg_username')
-
-    filter.connect(self, :params)
-
-    def to_s
-      "PostgreSQL Ident Config #{@conf_file}"
-    end
-
-    private
-
-    def filter_comments(data)
-      content = []
-      data.each do |line|
-        line.chomp!
-        content << line unless line.match(/^\s*#/) || line.empty?
-      end
-      content
-    end
-
-    def read_content
-      @content = ''
-      @params = {}
-      @content = filter_comments(read_file(@conf_file))
-      @params = parse_conf(@content)
-    end
-
-    def parse_conf(content)
-      content.map do |line|
-        parse_line(line)
-      end.compact
-    end
-
-    def parse_line(line)
-      x = line.split(/\s+/)
-      {
-        'map_name' => x[0],
-        'system_username' => x[1],
-        'pg_username' => x[2],
-      }
-    end
-
-    def read_file(conf_file = @conf_file)
-      inspec.file(conf_file).content.lines
-    end
-  end
-end
+# encoding: utf-8
+
+require 'utils/file_reader'
+require 'resources/postgres'
+
+module Inspec::Resources
+  class PostgresIdentConf < Inspec.resource(1)
+    name 'postgres_ident_conf'
+    supports platform: 'unix'
+    desc 'Use the postgres_ident_conf InSpec audit resource to test the client
+          authentication data is controlled by a pg_ident.conf file.'
+    example "
+      describe postgres_ident_conf.where { pg_username == 'acme_user' } do
+        its('map_name') { should eq ['ssl-test'] }
+      end
+    "
+
+    include FileReader
+
+    attr_reader :params, :conf_file
+
+    def initialize(ident_conf_path = nil)
+      @conf_file = ident_conf_path || File.expand_path('pg_ident.conf', inspec.postgres.conf_dir)
+      @content = nil
+      @params = nil
+      read_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:map_name,        field: 'map_name')
+          .add(:system_username, field: 'system_username')
+          .add(:pg_username,     field: 'pg_username')
+
+    filter.connect(self, :params)
+
+    def to_s
+      "PostgreSQL Ident Config #{@conf_file}"
+    end
+
+    private
+
+    def filter_comments(data)
+      content = []
+      data.each do |line|
+        line.chomp!
+        content << line unless line.match(/^\s*#/) || line.empty?
+      end
+      content
+    end
+
+    def read_content
+      @content = ''
+      @params = {}
+      @content = filter_comments(read_file(@conf_file))
+      @params = parse_conf(@content)
+    end
+
+    def parse_conf(content)
+      content.map do |line|
+        parse_line(line)
+      end.compact
+    end
+
+    def parse_line(line)
+      x = line.split(/\s+/)
+      {
+        'map_name' => x[0],
+        'system_username' => x[1],
+        'pg_username' => x[2],
+      }
+    end
+
+    def read_file(conf_file = @conf_file)
+      read_file_content(conf_file, allow_empty: true).lines
+    end
+  end
+end

data/lib/resources/postgres_session.rb

@@ -1,71 +1,71 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-require 'shellwords'
-
-module Inspec::Resources
-  class Lines
-    attr_reader :output
-
-    def initialize(raw, desc)
-      @output = raw
-      @desc = desc
-    end
-
-    def lines
-      output.split("\n")
-    end
-
-    def to_s
-      @desc
-    end
-  end
-
-  class PostgresSession < Inspec.resource(1)
-    name 'postgres_session'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the postgres_session InSpec audit resource to test SQL commands run against a PostgreSQL database.'
-    example "
-      sql = postgres_session('username', 'password', 'host')
-      query('sql_query', ['database_name'])` contains the query and (optional) database to execute
-
-      # default values:
-      # username: 'postgres'
-      # host: 'localhost'
-      # db: databse == db_user running the sql query
-
-      describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;') do
-        its('output') { should eq '' }
-      end
-    "
-
-    def initialize(user, pass, host = nil)
-      @user = user || 'postgres'
-      @pass = pass
-      @host = host || 'localhost'
-    end
-
-    def query(query, db = [])
-      psql_cmd = create_psql_cmd(query, db)
-      cmd = inspec.command(psql_cmd)
-      out = cmd.stdout + "\n" + cmd.stderr
-      if cmd.exit_status != 0 || out =~ /could not connect to .*/ || out.downcase =~ /^error:.*/
-        Lines.new(out, "PostgreSQL query with errors: #{query}")
-      else
-        Lines.new(cmd.stdout.strip, "PostgreSQL query: #{query}")
-      end
-    end
-
-    private
-
-    def escaped_query(query)
-      Shellwords.escape(query)
-    end
-
-    def create_psql_cmd(query, db = [])
-      dbs = db.map { |x| "-d #{x}" }.join(' ')
-      "PGPASSWORD='#{@pass}' psql -U #{@user} #{dbs} -h #{@host} -A -t -c #{escaped_query(query)}"
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'shellwords'
+
+module Inspec::Resources
+  class Lines
+    attr_reader :output
+
+    def initialize(raw, desc)
+      @output = raw
+      @desc = desc
+    end
+
+    def lines
+      output.split("\n")
+    end
+
+    def to_s
+      @desc
+    end
+  end
+
+  class PostgresSession < Inspec.resource(1)
+    name 'postgres_session'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the postgres_session InSpec audit resource to test SQL commands run against a PostgreSQL database.'
+    example "
+      sql = postgres_session('username', 'password', 'host')
+      query('sql_query', ['database_name'])` contains the query and (optional) database to execute
+
+      # default values:
+      # username: 'postgres'
+      # host: 'localhost'
+      # db: databse == db_user running the sql query
+
+      describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;') do
+        its('output') { should eq '' }
+      end
+    "
+
+    def initialize(user, pass, host = nil)
+      @user = user || 'postgres'
+      @pass = pass
+      @host = host || 'localhost'
+    end
+
+    def query(query, db = [])
+      psql_cmd = create_psql_cmd(query, db)
+      cmd = inspec.command(psql_cmd)
+      out = cmd.stdout + "\n" + cmd.stderr
+      if cmd.exit_status != 0 || out =~ /could not connect to .*/ || out.downcase =~ /^error:.*/
+        Lines.new(out, "PostgreSQL query with errors: #{query}")
+      else
+        Lines.new(cmd.stdout.strip, "PostgreSQL query: #{query}")
+      end
+    end
+
+    private
+
+    def escaped_query(query)
+      Shellwords.escape(query)
+    end
+
+    def create_psql_cmd(query, db = [])
+      dbs = db.map { |x| "-d #{x}" }.join(' ')
+      "PGPASSWORD='#{@pass}' psql -U #{@user} #{dbs} -h #{@host} -A -t -c #{escaped_query(query)}"
+    end
+  end
+end