inspec 2.1.21 → 2.1.30

data/lib/resources/mssql_session.rb

@@ -1,101 +1,101 @@
-# encoding: utf-8
-
-require 'hashie/mash'
-require 'utils/database_helpers'
-
-module Inspec::Resources
-  # STABILITY: Experimental
-  # This resource needs further testing and refinement
-  #
-  # This requires the `sqlcmd` tool available on platform
-  # @see https://docs.microsoft.com/en-us/sql/relational-databases/scripting/sqlcmd-use-the-utility
-  # @see https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-connect-and-query-sqlcmd
-  class MssqlSession < Inspec.resource(1)
-    name 'mssql_session'
-    supports platform: 'windows'
-    desc 'Use the mssql_session InSpec audit resource to test SQL commands run against a MS Sql Server database.'
-    example "
-      # Using SQL authentication
-      sql = mssql_session(user: 'myuser', pass: 'mypassword')
-      describe sql.query('SELECT * FROM table').row(0).column('columnname') do
-        its('value') { should cmp == 1 }
-      end
-
-      # Passing no credentials to mssql_session forces it to use Windows authentication
-      sql_windows_auth = mssql_session
-      describe sql_windows_auth.query(\"SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') as \\\"login_mode\\\";\").row(0).column('login_mode') do
-        its('value') { should_not be_empty }
-        its('value') { should cmp == 1 }
-      end
-    "
-
-    attr_reader :user, :password, :host, :port, :instance
-    def initialize(opts = {})
-      @user = opts[:user]
-      @password = opts[:password] || opts[:pass]
-      if opts[:pass]
-        warn '[DEPRECATED] use `password` option to supply password instead of `pass`'
-      end
-      @host = opts[:host] || 'localhost'
-      @port = opts[:port] || '1433'
-      @instance = opts[:instance]
-
-      # check if sqlcmd is available
-      raise Inspec::Exceptions::ResourceSkipped, 'sqlcmd is missing' unless inspec.command('sqlcmd').exist?
-      # check that database is reachable
-      raise Inspec::Exceptions::ResourceSkipped, "Can't connect to the MS SQL Server." unless test_connection
-    end
-
-    def query(q)
-      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
-      # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
-      cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
-      cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
-      if @instance.nil?
-        cmd_string += " -S '#{@host},#{@port}'"
-      else
-        cmd_string += " -S '#{@host},#{@port}\\#{@instance}'"
-      end
-      cmd = inspec.command(cmd_string)
-      out = cmd.stdout + "\n" + cmd.stderr
-      if cmd.exit_status != 0 || out =~ /Sqlcmd: Error/
-        # TODO: we need to throw an exception here
-        # change once https://github.com/chef/inspec/issues/1205 is in
-        warn "Could not execute the sql query #{out}"
-        DatabaseHelper::SQLQueryResult.new(cmd, Hashie::Mash.new({}))
-      else
-        DatabaseHelper::SQLQueryResult.new(cmd, parse_csv_result(cmd))
-      end
-    end
-
-    def to_s
-      'MSSQL session'
-    end
-
-    private
-
-    def test_connection
-      !query('select getdate()').empty?
-    end
-
-    def parse_csv_result(cmd)
-      require 'csv'
-      table = CSV.parse(cmd.stdout, { headers: true })
-
-      # remove first row, since it will be a seperator line
-      table.delete(0)
-
-      # convert to hash
-      headers = table.headers
-
-      results = table.map { |row|
-        res = {}
-        headers.each { |header|
-          res[header.downcase] = row[header]
-        }
-        Hashie::Mash.new(res)
-      }
-      results
-    end
-  end
-end
+# encoding: utf-8
+
+require 'hashie/mash'
+require 'utils/database_helpers'
+
+module Inspec::Resources
+  # STABILITY: Experimental
+  # This resource needs further testing and refinement
+  #
+  # This requires the `sqlcmd` tool available on platform
+  # @see https://docs.microsoft.com/en-us/sql/relational-databases/scripting/sqlcmd-use-the-utility
+  # @see https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-connect-and-query-sqlcmd
+  class MssqlSession < Inspec.resource(1)
+    name 'mssql_session'
+    supports platform: 'windows'
+    desc 'Use the mssql_session InSpec audit resource to test SQL commands run against a MS Sql Server database.'
+    example "
+      # Using SQL authentication
+      sql = mssql_session(user: 'myuser', pass: 'mypassword')
+      describe sql.query('SELECT * FROM table').row(0).column('columnname') do
+        its('value') { should cmp == 1 }
+      end
+
+      # Passing no credentials to mssql_session forces it to use Windows authentication
+      sql_windows_auth = mssql_session
+      describe sql_windows_auth.query(\"SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') as \\\"login_mode\\\";\").row(0).column('login_mode') do
+        its('value') { should_not be_empty }
+        its('value') { should cmp == 1 }
+      end
+    "
+
+    attr_reader :user, :password, :host, :port, :instance
+    def initialize(opts = {})
+      @user = opts[:user]
+      @password = opts[:password] || opts[:pass]
+      if opts[:pass]
+        warn '[DEPRECATED] use `password` option to supply password instead of `pass`'
+      end
+      @host = opts[:host] || 'localhost'
+      @port = opts[:port] || '1433'
+      @instance = opts[:instance]
+
+      # check if sqlcmd is available
+      raise Inspec::Exceptions::ResourceSkipped, 'sqlcmd is missing' unless inspec.command('sqlcmd').exist?
+      # check that database is reachable
+      raise Inspec::Exceptions::ResourceSkipped, "Can't connect to the MS SQL Server." unless test_connection
+    end
+
+    def query(q)
+      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
+      # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
+      cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
+      cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
+      if @instance.nil?
+        cmd_string += " -S '#{@host},#{@port}'"
+      else
+        cmd_string += " -S '#{@host},#{@port}\\#{@instance}'"
+      end
+      cmd = inspec.command(cmd_string)
+      out = cmd.stdout + "\n" + cmd.stderr
+      if cmd.exit_status != 0 || out =~ /Sqlcmd: Error/
+        # TODO: we need to throw an exception here
+        # change once https://github.com/chef/inspec/issues/1205 is in
+        warn "Could not execute the sql query #{out}"
+        DatabaseHelper::SQLQueryResult.new(cmd, Hashie::Mash.new({}))
+      else
+        DatabaseHelper::SQLQueryResult.new(cmd, parse_csv_result(cmd))
+      end
+    end
+
+    def to_s
+      'MSSQL session'
+    end
+
+    private
+
+    def test_connection
+      !query('select getdate()').empty?
+    end
+
+    def parse_csv_result(cmd)
+      require 'csv'
+      table = CSV.parse(cmd.stdout, { headers: true })
+
+      # remove first row, since it will be a seperator line
+      table.delete(0)
+
+      # convert to hash
+      headers = table.headers
+
+      results = table.map { |row|
+        res = {}
+        headers.each { |header|
+          res[header.downcase] = row[header]
+        }
+        Hashie::Mash.new(res)
+      }
+      results
+    end
+  end
+end

data/lib/resources/mysql.rb

@@ -1,81 +1,82 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-module Inspec::Resources
-  class Mysql < Inspec.resource(1)
-    name 'mysql'
-    supports platform: 'unix'
-
-    attr_reader :package, :service, :conf_dir, :conf_path, :data_dir, :log_dir, :log_path, :log_group, :log_dir_group
-    def initialize
-      # set OS-dependent filenames and paths
-      case inspec.os[:family]
-      when 'debian'
-        init_ubuntu
-      when 'redhat', 'fedora'
-        init_redhat
-      when 'arch'
-        init_arch
-      else
-        # TODO: could not detect
-        init_default
-      end
-    end
-
-    def init_ubuntu
-      @package = 'mysql-server'
-      @service = 'mysql'
-      @conf_path = '/etc/mysql/my.cnf'
-      @conf_dir = '/etc/mysql/'
-      @data_dir = '/var/lib/mysql/'
-      @log_dir = '/var/log/'
-      @log_path = '/var/log/mysql.log'
-      @log_group = 'adm'
-      case inspec.os[:release]
-      when '14.04'
-        @log_dir_group = 'syslog'
-      else
-        @log_dir_group = 'root'
-      end
-    end
-
-    def init_redhat
-      @package = 'mysql-server'
-      @service = 'mysqld'
-      @conf_path = '/etc/my.cnf'
-      @conf_dir = '/etc/'
-      @data_dir = '/var/lib/mysql/'
-      @log_dir = '/var/log/'
-      @log_path = '/var/log/mysqld.log'
-      @log_group = 'mysql'
-      @log_dir_group = 'root'
-    end
-
-    def init_arch
-      @package = 'mariadb'
-      @service = 'mysql'
-      @conf_path = '/etc/mysql/my.cnf'
-      @conf_dir = '/etc/mysql/'
-      @data_dir = '/var/lib/mysql/'
-      @log_dir = '/var/log/'
-      @log_path = '/var/log/mysql.log'
-      @log_group = 'mysql'
-      @log_dir_group = 'root'
-    end
-
-    def init_default
-      @service = 'mysqld'
-      @conf_path = '/etc/my.cnf'
-      @conf_dir = '/etc/'
-      @data_dir = '/var/lib/mysql/'
-      @log_dir = '/var/log/'
-      @log_path = '/var/log/mysqld.log'
-      @log_group = 'mysql'
-      @log_dir_group = 'root'
-    end
-
-    def to_s
-      'MySQL'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+module Inspec::Resources
+  class Mysql < Inspec.resource(1)
+    name 'mysql'
+    supports platform: 'unix'
+    desc 'The \'mysql\' resource is a helper for the \'mysql_conf\' & \'mysql_session\' resources.  Please use those instead.'
+
+    attr_reader :package, :service, :conf_dir, :conf_path, :data_dir, :log_dir, :log_path, :log_group, :log_dir_group
+    def initialize
+      # set OS-dependent filenames and paths
+      case inspec.os[:family]
+      when 'debian'
+        init_ubuntu
+      when 'redhat', 'fedora'
+        init_redhat
+      when 'arch'
+        init_arch
+      else
+        # TODO: could not detect
+        init_default
+      end
+    end
+
+    def init_ubuntu
+      @package = 'mysql-server'
+      @service = 'mysql'
+      @conf_path = '/etc/mysql/my.cnf'
+      @conf_dir = '/etc/mysql/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysql.log'
+      @log_group = 'adm'
+      case inspec.os[:release]
+      when '14.04'
+        @log_dir_group = 'syslog'
+      else
+        @log_dir_group = 'root'
+      end
+    end
+
+    def init_redhat
+      @package = 'mysql-server'
+      @service = 'mysqld'
+      @conf_path = '/etc/my.cnf'
+      @conf_dir = '/etc/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysqld.log'
+      @log_group = 'mysql'
+      @log_dir_group = 'root'
+    end
+
+    def init_arch
+      @package = 'mariadb'
+      @service = 'mysql'
+      @conf_path = '/etc/mysql/my.cnf'
+      @conf_dir = '/etc/mysql/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysql.log'
+      @log_group = 'mysql'
+      @log_dir_group = 'root'
+    end
+
+    def init_default
+      @service = 'mysqld'
+      @conf_path = '/etc/my.cnf'
+      @conf_dir = '/etc/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysqld.log'
+      @log_group = 'mysql'
+      @log_dir_group = 'root'
+    end
+
+    def to_s
+      'MySQL'
+    end
+  end
+end

data/lib/resources/mysql_conf.rb

@@ -1,127 +1,127 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-require 'utils/simpleconfig'
-require 'utils/find_files'
-require 'utils/file_reader'
-require 'utils/hash'
-require 'resources/mysql'
-
-module Inspec::Resources
-  class MysqlConfEntry
-    def initialize(path, params)
-      @params = params
-      @path = path
-    end
-
-    def method_missing(name, *_)
-      k = name.to_s
-      res = @params[k]
-      return true if res.nil? && @params.key?(k)
-      @params[k]
-    end
-
-    def to_s
-      "MySQL Config entry [#{@path.join(' ')}]"
-    end
-  end
-
-  class MysqlConf < Inspec.resource(1)
-    name 'mysql_conf'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the mysql_conf InSpec audit resource to test the contents of the configuration file for MySQL, typically located at /etc/mysql/my.cnf or /etc/my.cnf.'
-    example "
-      describe mysql_conf('path') do
-        its('setting') { should eq 'value' }
-      end
-
-      # Test a parameter set within the [mysqld] section
-      describe mysql_conf do
-        its('mysqld.port') { should cmp 3306 }
-      end
-
-      # Test a parameter set within the [mariadb] section using array notation
-      describe mysql_conf do
-        its(['mariadb', 'max-connections']) { should_not be_nil }
-      end
-    "
-
-    include FindFiles
-    include FileReader
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || inspec.mysql.conf_path
-      @files_contents = {}
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    def content
-      @content ||= read_content
-    end
-
-    def params(*opts)
-      @params || read_content
-      res = @params
-      opts.each do |opt|
-        res = res[opt] unless res.nil?
-      end
-      MysqlConfEntry.new(opts, res)
-    end
-
-    def method_missing(name)
-      @params || read_content
-      @params[name.to_s]
-    end
-
-    def read_content
-      @content = ''
-      @params = {}
-
-      to_read = [@conf_path]
-      until to_read.empty?
-        cur_file = to_read[0]
-        raw_conf = read_file(cur_file)
-        @content += raw_conf
-
-        params = SimpleConfig.new(raw_conf).params
-        @params = @params.deep_merge(params)
-
-        to_read = to_read.drop(1)
-        # see if there is more stuff to include
-
-        dir = File.dirname(cur_file)
-        to_read += include_files(dir, raw_conf).find_all do |fp|
-          not @files_contents.key? fp
-        end
-      end
-      #
-      @content
-    end
-
-    def include_files(reldir, conf)
-      files = conf.scan(/^!include\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
-      dirs = conf.scan(/^!includedir\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
-      dirs.map do |dir|
-        # @TODO: non local glob
-        files += find_files(dir, depth: 1, type: 'file')
-      end
-      files
-    end
-
-    def abs_path(dir, f)
-      return f if f.start_with? '/'
-      File.join(dir, f)
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= read_file_content(path)
-    end
-
-    def to_s
-      'MySQL Configuration'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/find_files'
+require 'utils/file_reader'
+require 'utils/hash'
+require 'resources/mysql'
+
+module Inspec::Resources
+  class MysqlConfEntry
+    def initialize(path, params)
+      @params = params
+      @path = path
+    end
+
+    def method_missing(name, *_)
+      k = name.to_s
+      res = @params[k]
+      return true if res.nil? && @params.key?(k)
+      @params[k]
+    end
+
+    def to_s
+      "MySQL Config entry [#{@path.join(' ')}]"
+    end
+  end
+
+  class MysqlConf < Inspec.resource(1)
+    name 'mysql_conf'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the mysql_conf InSpec audit resource to test the contents of the configuration file for MySQL, typically located at /etc/mysql/my.cnf or /etc/my.cnf.'
+    example "
+      describe mysql_conf('path') do
+        its('setting') { should eq 'value' }
+      end
+
+      # Test a parameter set within the [mysqld] section
+      describe mysql_conf do
+        its('mysqld.port') { should cmp 3306 }
+      end
+
+      # Test a parameter set within the [mariadb] section using array notation
+      describe mysql_conf do
+        its(['mariadb', 'max-connections']) { should_not be_nil }
+      end
+    "
+
+    include FindFiles
+    include FileReader
+
+    def initialize(conf_path = nil)
+      @conf_path = conf_path || inspec.mysql.conf_path
+      @files_contents = {}
+      @content = nil
+      @params = nil
+      read_content
+    end
+
+    def content
+      @content ||= read_content
+    end
+
+    def params(*opts)
+      @params || read_content
+      res = @params
+      opts.each do |opt|
+        res = res[opt] unless res.nil?
+      end
+      MysqlConfEntry.new(opts, res)
+    end
+
+    def method_missing(name)
+      @params || read_content
+      @params[name.to_s]
+    end
+
+    def read_content
+      @content = ''
+      @params = {}
+
+      to_read = [@conf_path]
+      until to_read.empty?
+        cur_file = to_read[0]
+        raw_conf = read_file(cur_file)
+        @content += raw_conf
+
+        params = SimpleConfig.new(raw_conf).params
+        @params = @params.deep_merge(params)
+
+        to_read = to_read.drop(1)
+        # see if there is more stuff to include
+
+        dir = File.dirname(cur_file)
+        to_read += include_files(dir, raw_conf).find_all do |fp|
+          not @files_contents.key? fp
+        end
+      end
+      #
+      @content
+    end
+
+    def include_files(reldir, conf)
+      files = conf.scan(/^!include\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
+      dirs = conf.scan(/^!includedir\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
+      dirs.map do |dir|
+        # @TODO: non local glob
+        files += find_files(dir, depth: 1, type: 'file')
+      end
+      files
+    end
+
+    def abs_path(dir, f)
+      return f if f.start_with? '/'
+      File.join(dir, f)
+    end
+
+    def read_file(path)
+      @files_contents[path] ||= read_file_content(path)
+    end
+
+    def to_s
+      'MySQL Configuration'
+    end
+  end
+end