inspec 2.1.0 → 2.1.10

data/lib/resources/x509_certificate.rb

@@ -1,143 +1,137 @@
-# encoding: utf-8
-
-require 'openssl'
-require 'hashie/mash'
-
-module Inspec::Resources
-  class X509CertificateResource < Inspec.resource(1)
-    name 'x509_certificate'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Used to test x.509 certificates'
-    example "
-      describe x509_certificate('/etc/pki/www.mywebsite.com.pem') do
-        its('subject') { should match /CN=My Website/ }
-        its('validity_in_days') { should be > 30 }
-      end
-
-      describe x509_certificate('trials/x509/cert.pem') do
-        it { should be_certificate }
-        it { should be_valid }
-        its('fingerprint') { should eq '62b137bdf427e7273dc2e487877b3033e4c8ce17' }
-        its('signature_algorithm') { should eq 'sha1WithRSAEncryption' }
-        its('validity_in_days') { should_not be < 100 }
-        its('validity_in_days') { should be >= 100 }
-        its('subject_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
-        its('subject.C') { should eq 'DE' }
-        its('subject.emailAddress') { should_not be_empty }
-        its('subject.emailAddress') { should eq 'support@chef.io' }
-        its('issuer_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
-        its('key_length') { should be >= 2048 }
-        its('extensions.subjectKeyIdentifier') { should cmp 'A5:16:0B:12:F4:48:0F:06:6C:32:29:67:98:12:DF:3D:0D:75:9D:5C' }
-      end
-    "
-
-    # @see https://tools.ietf.org/html/rfc5280#page-23
-    def initialize(filename)
-      @certpath = filename
-      @issuer = nil
-      @parsed_subject = nil
-      @parsed_issuer = nil
-      @extensions = nil
-
-      file = inspec.file(@certpath)
-      return skip_resource "Unable to find certificate file #{@certpath}" unless file.exist?
-
-      begin
-        @cert = OpenSSL::X509::Certificate.new file.content
-      rescue OpenSSL::X509::CertificateError
-        @cert = nil
-        return skip_resource "Unable to load certificate #{@certpath}"
-      end
-    end
-
-    # Forward these methods directly to OpenSSL::X509::Certificate instance
-    %w{version not_before not_after signature_algorithm public_key}.each do |m|
-      define_method m.to_sym do |*args|
-        @cert.method(m.to_sym).call(*args)
-      end
-    end
-
-    def certificate?
-      !@cert.nil?
-    end
-
-    def fingerprint
-      return if @cert.nil?
-      OpenSSL::Digest::SHA1.new(@cert.to_der).to_s
-    end
-
-    def serial
-      return if @cert.nil?
-      @cert.serial.to_i
-    end
-
-    def subject_dn
-      return if @cert.nil?
-      @cert.subject.to_s
-    end
-
-    def subject
-      return if @cert.nil?
-      # Return cached subject if we have already parsed it
-      return @parsed_subject if @parsed_subject
-      # Use a Mash to make it easier to access hash elements in "its('subject') {should ...}"
-      @parsed_subject = Hashie::Mash.new(Hash[@cert.subject.to_a.map { |k, v, _| [k, v] }])
-    end
-
-    def issuer_dn
-      return if @cert.nil?
-      @cert.issuer.to_s
-    end
-
-    def issuer
-      return if @cert.nil?
-      # Return cached subject if we have already parsed it
-      return @parsed_issuer if @parsed_issuer
-      # Use a Mash to make it easier to access hash elements in "its('issuer') {should ...}"
-      @parsed_issuer = Hashie::Mash.new(Hash[@cert.issuer.to_a.map { |k, v, _| [k, v] }])
-    end
-
-    def key_length
-      return if @cert.nil?
-      @cert.public_key.n.num_bytes * 8
-    end
-
-    def validity_in_days
-      (not_after - Time.now.utc) / 86400
-    end
-
-    def valid?
-      now = Time.now
-      certificate? && (now >= not_before && now <= not_after)
-    end
-
-    def extensions
-      # Return cached Mash if we already parsed the certificate extensions
-      return @extensions if @extensions
-      # Return the exception class if we failed to instantiate a Cert from file
-      return @cert unless @cert.respond_to? :extensions
-      # Use a Mash to make it easier to access hash elements in "its('entensions') {should ...}"
-      @extensions = Hashie::Mash.new({})
-      # Make sure standard extensions exist so we don't get nil for nil:NilClass
-      # when the user tests for extensions which aren't present
-      %w{
-        keyUsage extendedKeyUsage basicConstraints subjectKeyIdentifier
-        authorityKeyIdentifier subjectAltName issuerAltName authorityInfoAccess
-        crlDistributionPoints issuingDistributionPoint certificatePolicies
-        policyConstraints nameConstraints noCheck tlsfeature nsComment
-      }.each { |extension| @extensions[extension] ||= [] }
-      # Now parse the extensions into the Mash
-      extension_array = @cert.extensions.map(&:to_s)
-      extension_array.each do |extension|
-        kv = extension.split(/ *= */, 2)
-        @extensions[kv.first] = kv.last.split(/ *, */)
-      end
-      @extensions
-    end
-
-    def to_s
-      "x509_certificate #{@certpath}"
-    end
-  end
-end
+# encoding: utf-8
+
+require 'openssl'
+require 'hashie/mash'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class X509CertificateResource < Inspec.resource(1)
+    name 'x509_certificate'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Used to test x.509 certificates'
+    example "
+      describe x509_certificate('/etc/pki/www.mywebsite.com.pem') do
+        its('subject') { should match /CN=My Website/ }
+        its('validity_in_days') { should be > 30 }
+      end
+
+      describe x509_certificate('trials/x509/cert.pem') do
+        it { should be_certificate }
+        it { should be_valid }
+        its('fingerprint') { should eq '62b137bdf427e7273dc2e487877b3033e4c8ce17' }
+        its('signature_algorithm') { should eq 'sha1WithRSAEncryption' }
+        its('validity_in_days') { should_not be < 100 }
+        its('validity_in_days') { should be >= 100 }
+        its('subject_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
+        its('subject.C') { should eq 'DE' }
+        its('subject.emailAddress') { should_not be_empty }
+        its('subject.emailAddress') { should eq 'support@chef.io' }
+        its('issuer_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
+        its('key_length') { should be >= 2048 }
+        its('extensions.subjectKeyIdentifier') { should cmp 'A5:16:0B:12:F4:48:0F:06:6C:32:29:67:98:12:DF:3D:0D:75:9D:5C' }
+      end
+    "
+
+    include FileReader
+
+    # @see https://tools.ietf.org/html/rfc5280#page-23
+    def initialize(filename)
+      @certpath = filename
+      @issuer = nil
+      @parsed_subject = nil
+      @parsed_issuer = nil
+      @extensions = nil
+      @cert = OpenSSL::X509::Certificate.new read_file_content(@certpath)
+    end
+
+    # Forward these methods directly to OpenSSL::X509::Certificate instance
+    %w{version not_before not_after signature_algorithm public_key}.each do |m|
+      define_method m.to_sym do |*args|
+        @cert.method(m.to_sym).call(*args)
+      end
+    end
+
+    def certificate?
+      !@cert.nil?
+    end
+
+    def fingerprint
+      return if @cert.nil?
+      OpenSSL::Digest::SHA1.new(@cert.to_der).to_s
+    end
+
+    def serial
+      return if @cert.nil?
+      @cert.serial.to_i
+    end
+
+    def subject_dn
+      return if @cert.nil?
+      @cert.subject.to_s
+    end
+
+    def subject
+      return if @cert.nil?
+      # Return cached subject if we have already parsed it
+      return @parsed_subject if @parsed_subject
+      # Use a Mash to make it easier to access hash elements in "its('subject') {should ...}"
+      @parsed_subject = Hashie::Mash.new(Hash[@cert.subject.to_a.map { |k, v, _| [k, v] }])
+    end
+
+    def issuer_dn
+      return if @cert.nil?
+      @cert.issuer.to_s
+    end
+
+    def issuer
+      return if @cert.nil?
+      # Return cached subject if we have already parsed it
+      return @parsed_issuer if @parsed_issuer
+      # Use a Mash to make it easier to access hash elements in "its('issuer') {should ...}"
+      @parsed_issuer = Hashie::Mash.new(Hash[@cert.issuer.to_a.map { |k, v, _| [k, v] }])
+    end
+
+    def key_length
+      return if @cert.nil?
+      @cert.public_key.n.num_bytes * 8
+    end
+
+    def validity_in_days
+      (not_after - Time.now.utc) / 86400
+    end
+
+    def valid?
+      now = Time.now
+      certificate? && (now >= not_before && now <= not_after)
+    end
+
+    def extensions
+      # Return cached Mash if we already parsed the certificate extensions
+      return @extensions if @extensions
+      # Return the exception class if we failed to instantiate a Cert from file
+      return @cert unless @cert.respond_to? :extensions
+      # Use a Mash to make it easier to access hash elements in "its('entensions') {should ...}"
+      @extensions = Hashie::Mash.new({})
+      # Make sure standard extensions exist so we don't get nil for nil:NilClass
+      # when the user tests for extensions which aren't present
+      %w{
+        keyUsage extendedKeyUsage basicConstraints subjectKeyIdentifier
+        authorityKeyIdentifier subjectAltName issuerAltName authorityInfoAccess
+        crlDistributionPoints issuingDistributionPoint certificatePolicies
+        policyConstraints nameConstraints noCheck tlsfeature nsComment
+      }.each { |extension| @extensions[extension] ||= [] }
+      # Now parse the extensions into the Mash
+      extension_array = @cert.extensions.map(&:to_s)
+      extension_array.each do |extension|
+        kv = extension.split(/ *= */, 2)
+        @extensions[kv.first] = kv.last.split(/ *, */)
+      end
+      @extensions
+    end
+
+    def to_s
+      "x509_certificate #{@certpath}"
+    end
+  end
+end

data/lib/resources/xinetd.rb

@@ -1,111 +1,106 @@
-# encoding: utf-8
-
-require 'utils/parser'
-require 'utils/filter'
-
-module Inspec::Resources
-  class XinetdConf < Inspec.resource(1)
-    name 'xinetd_conf'
-    supports platform: 'unix'
-    desc 'Xinetd services configuration.'
-    example "
-      describe xinetd_conf.services('chargen') do
-        its('socket_types') { should include 'dgram' }
-      end
-
-      describe xinetd_conf.services('chargen').socket_types('dgram') do
-        it { should be_disabled }
-      end
-    "
-
-    include XinetdParser
-
-    def initialize(conf_path = '/etc/xinetd.conf')
-      @conf_path = conf_path
-      @contents = {}
-    end
-
-    def to_s
-      "Xinetd config #{@conf_path}#{@filters}"
-    end
-
-    def params
-      @params ||= read_params
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:services,     field: 'service')
-          .add(:ids,          field: 'id')
-          .add(:socket_types, field: 'socket_type')
-          .add(:types,        field: 'type')
-          .add(:protocols,    field: 'protocol')
-          .add(:wait,         field: 'wait')
-          .add(:disabled?) { |x| x.where('disable' => 'no').services.empty? }
-          .add(:enabled?) { |x| x.where('disable' => 'yes').services.empty? }
-          .connect(self, :service_lines)
-
-    private
-
-    def read_content(path = @conf_path)
-      return @contents[path] if @contents.key?(path)
-      file = inspec.file(path)
-      if !file.file?
-        raise Inspec::Exceptions::ResourceSkipped, "Can't find file: #{path}"
-      end
-
-      if file.content.nil? || file.content.empty?
-        raise Inspec::Exceptions::ResourceSkipped, "Can't read file: #{path}"
-      end
-
-      @contents[path] = file.content
-    end
-
-    def read_params
-      return {} if read_content.nil?
-      flat_params = parse_xinetd(read_content)
-      # we need to map service data in order to use it with filtertable
-      params = { 'services' => {} }
-      # map services that were defined and map it to the service hash
-      flat_params.each do |k, v|
-        name = k[/^service (.+)$/, 1]
-        # its not a service, no change required
-        if name.nil?
-          params[k] = v
-        # handle service entries
-        else
-          # store service
-          params['services'][name] = v
-
-          # add the service identifier to its parameters
-          if v.is_a?(Array)
-            v.each { |service| service.params['service'] = name }
-          else
-            v.params['service'] = name
-          end
-        end
-      end
-      params
-    end
-
-    # Method used to derive the default protocol used from the socket_type
-    def default_protocol(type)
-      case type
-      when 'stream'
-        'tcp'
-      when 'dgram'
-        'udp'
-      else
-        'unknown'
-      end
-    end
-
-    def service_lines
-      @services ||= params['services'].values.flatten.map { |service|
-        service.params['protocol'] ||= default_protocol(service.params['socket_type'])
-        service.params
-      }
-    end
-  end
-end
+# encoding: utf-8
+
+require 'utils/parser'
+require 'utils/filter'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class XinetdConf < Inspec.resource(1)
+    name 'xinetd_conf'
+    supports platform: 'unix'
+    desc 'Xinetd services configuration.'
+    example "
+      describe xinetd_conf.services('chargen') do
+        its('socket_types') { should include 'dgram' }
+      end
+
+      describe xinetd_conf.services('chargen').socket_types('dgram') do
+        it { should be_disabled }
+      end
+    "
+
+    include XinetdParser
+    include FileReader
+
+    def initialize(conf_path = '/etc/xinetd.conf')
+      @conf_path = conf_path
+      @contents = {}
+      read_content(@conf_path)
+    end
+
+    def to_s
+      "Xinetd config #{@conf_path}#{@filters}"
+    end
+
+    def params
+      @params ||= read_params
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:services,     field: 'service')
+          .add(:ids,          field: 'id')
+          .add(:socket_types, field: 'socket_type')
+          .add(:types,        field: 'type')
+          .add(:protocols,    field: 'protocol')
+          .add(:wait,         field: 'wait')
+          .add(:disabled?) { |x| x.where('disable' => 'no').services.empty? }
+          .add(:enabled?) { |x| x.where('disable' => 'yes').services.empty? }
+          .connect(self, :service_lines)
+
+    private
+
+    def read_content(path = @conf_path)
+      return @contents[path] if @contents.key?(path)
+
+      @contents[path] = read_file_content(path)
+    end
+
+    def read_params
+      return {} if read_content.nil?
+      flat_params = parse_xinetd(read_content)
+      # we need to map service data in order to use it with filtertable
+      params = { 'services' => {} }
+      # map services that were defined and map it to the service hash
+      flat_params.each do |k, v|
+        name = k[/^service (.+)$/, 1]
+        # its not a service, no change required
+        if name.nil?
+          params[k] = v
+        # handle service entries
+        else
+          # store service
+          params['services'][name] = v
+
+          # add the service identifier to its parameters
+          if v.is_a?(Array)
+            v.each { |service| service.params['service'] = name }
+          else
+            v.params['service'] = name
+          end
+        end
+      end
+      params
+    end
+
+    # Method used to derive the default protocol used from the socket_type
+    def default_protocol(type)
+      case type
+      when 'stream'
+        'tcp'
+      when 'dgram'
+        'udp'
+      else
+        'unknown'
+      end
+    end
+
+    def service_lines
+      @services ||= params['services'].values.flatten.map { |service|
+        service.params['protocol'] ||= default_protocol(service.params['socket_type'])
+        service.params
+      }
+    end
+  end
+end