inspec 2.1.21 → 2.1.30

Sign up to get free protection for your applications and to get access to all the features.
Files changed (502) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +101 -101
  3. data/CHANGELOG.md +3062 -3045
  4. data/Gemfile +56 -56
  5. data/LICENSE +14 -14
  6. data/MAINTAINERS.md +33 -33
  7. data/MAINTAINERS.toml +52 -52
  8. data/README.md +447 -447
  9. data/Rakefile +322 -322
  10. data/bin/inspec +12 -12
  11. data/docs/.gitignore +2 -2
  12. data/docs/README.md +40 -40
  13. data/docs/dsl_inspec.md +258 -258
  14. data/docs/dsl_resource.md +100 -100
  15. data/docs/glossary.md +99 -99
  16. data/docs/habitat.md +191 -191
  17. data/docs/inspec_and_friends.md +114 -114
  18. data/docs/matchers.md +169 -169
  19. data/docs/migration.md +293 -293
  20. data/docs/platforms.md +118 -118
  21. data/docs/plugin_kitchen_inspec.md +50 -50
  22. data/docs/profiles.md +376 -376
  23. data/docs/reporters.md +105 -105
  24. data/docs/resources/aide_conf.md.erb +75 -75
  25. data/docs/resources/apache.md.erb +67 -67
  26. data/docs/resources/apache_conf.md.erb +68 -68
  27. data/docs/resources/apt.md.erb +71 -71
  28. data/docs/resources/audit_policy.md.erb +47 -47
  29. data/docs/resources/auditd.md.erb +79 -79
  30. data/docs/resources/auditd_conf.md.erb +68 -68
  31. data/docs/resources/aws_cloudtrail_trail.md.erb +140 -140
  32. data/docs/resources/aws_cloudtrail_trails.md.erb +81 -81
  33. data/docs/resources/aws_cloudwatch_alarm.md.erb +86 -86
  34. data/docs/resources/aws_cloudwatch_log_metric_filter.md.erb +151 -151
  35. data/docs/resources/aws_config_delivery_channel.md +79 -79
  36. data/docs/resources/aws_config_recorder.md.erb +71 -71
  37. data/docs/resources/aws_ec2_instance.md.erb +106 -106
  38. data/docs/resources/aws_iam_access_key.md.erb +123 -123
  39. data/docs/resources/aws_iam_access_keys.md.erb +198 -198
  40. data/docs/resources/aws_iam_group.md.erb +46 -46
  41. data/docs/resources/aws_iam_groups.md.erb +43 -43
  42. data/docs/resources/aws_iam_password_policy.md.erb +76 -76
  43. data/docs/resources/aws_iam_policies.md.erb +82 -82
  44. data/docs/resources/aws_iam_policy.md.erb +144 -144
  45. data/docs/resources/aws_iam_role.md.erb +63 -63
  46. data/docs/resources/aws_iam_root_user.md.erb +70 -58
  47. data/docs/resources/aws_iam_user.md.erb +64 -64
  48. data/docs/resources/aws_iam_users.md.erb +89 -89
  49. data/docs/resources/aws_kms_key.md.erb +171 -171
  50. data/docs/resources/aws_kms_keys.md.erb +84 -84
  51. data/docs/resources/aws_rds_instance.md.erb +60 -60
  52. data/docs/resources/aws_route_table.md.erb +47 -47
  53. data/docs/resources/aws_route_tables.md.erb +49 -0
  54. data/docs/resources/aws_s3_bucket.md.erb +134 -134
  55. data/docs/resources/aws_s3_bucket_object.md.erb +83 -83
  56. data/docs/resources/aws_s3_buckets.md.erb +53 -0
  57. data/docs/resources/aws_security_group.md.erb +151 -151
  58. data/docs/resources/aws_security_groups.md.erb +91 -91
  59. data/docs/resources/aws_sns_subscription.md.erb +124 -124
  60. data/docs/resources/aws_sns_topic.md.erb +63 -63
  61. data/docs/resources/aws_sns_topics.md.erb +52 -52
  62. data/docs/resources/aws_subnet.md.erb +134 -134
  63. data/docs/resources/aws_subnets.md.erb +126 -126
  64. data/docs/resources/aws_vpc.md.erb +120 -120
  65. data/docs/resources/aws_vpcs.md.erb +48 -48
  66. data/docs/resources/azure_generic_resource.md.erb +171 -171
  67. data/docs/resources/azure_resource_group.md.erb +284 -284
  68. data/docs/resources/azure_virtual_machine.md.erb +347 -347
  69. data/docs/resources/azure_virtual_machine_data_disk.md.erb +224 -224
  70. data/docs/resources/bash.md.erb +75 -75
  71. data/docs/resources/bond.md.erb +90 -90
  72. data/docs/resources/bridge.md.erb +57 -57
  73. data/docs/resources/bsd_service.md.erb +67 -67
  74. data/docs/resources/chocolatey_package.md.erb +58 -0
  75. data/docs/resources/command.md.erb +138 -138
  76. data/docs/resources/cpan.md.erb +79 -79
  77. data/docs/resources/cran.md.erb +64 -64
  78. data/docs/resources/crontab.md.erb +89 -89
  79. data/docs/resources/csv.md.erb +54 -54
  80. data/docs/resources/dh_params.md.erb +205 -205
  81. data/docs/resources/directory.md.erb +30 -30
  82. data/docs/resources/docker.md.erb +219 -219
  83. data/docs/resources/docker_container.md.erb +103 -103
  84. data/docs/resources/docker_image.md.erb +94 -94
  85. data/docs/resources/docker_service.md.erb +114 -114
  86. data/docs/resources/elasticsearch.md.erb +242 -242
  87. data/docs/resources/etc_fstab.md.erb +125 -125
  88. data/docs/resources/etc_group.md.erb +75 -75
  89. data/docs/resources/etc_hosts.md.erb +78 -78
  90. data/docs/resources/etc_hosts_allow.md.erb +74 -74
  91. data/docs/resources/etc_hosts_deny.md.erb +74 -74
  92. data/docs/resources/file.md.erb +526 -526
  93. data/docs/resources/filesystem.md.erb +41 -41
  94. data/docs/resources/firewalld.md.erb +107 -107
  95. data/docs/resources/gem.md.erb +79 -79
  96. data/docs/resources/group.md.erb +61 -61
  97. data/docs/resources/grub_conf.md.erb +101 -101
  98. data/docs/resources/host.md.erb +86 -86
  99. data/docs/resources/http.md.erb +196 -196
  100. data/docs/resources/iis_app.md.erb +122 -122
  101. data/docs/resources/iis_site.md.erb +135 -135
  102. data/docs/resources/inetd_conf.md.erb +94 -94
  103. data/docs/resources/ini.md.erb +76 -76
  104. data/docs/resources/interface.md.erb +58 -58
  105. data/docs/resources/iptables.md.erb +64 -64
  106. data/docs/resources/json.md.erb +63 -63
  107. data/docs/resources/kernel_module.md.erb +120 -120
  108. data/docs/resources/kernel_parameter.md.erb +53 -53
  109. data/docs/resources/key_rsa.md.erb +85 -85
  110. data/docs/resources/launchd_service.md.erb +57 -57
  111. data/docs/resources/limits_conf.md.erb +75 -75
  112. data/docs/resources/login_defs.md.erb +71 -71
  113. data/docs/resources/mount.md.erb +69 -69
  114. data/docs/resources/mssql_session.md.erb +60 -60
  115. data/docs/resources/mysql_conf.md.erb +99 -99
  116. data/docs/resources/mysql_session.md.erb +74 -74
  117. data/docs/resources/nginx.md.erb +79 -79
  118. data/docs/resources/nginx_conf.md.erb +138 -138
  119. data/docs/resources/npm.md.erb +60 -60
  120. data/docs/resources/ntp_conf.md.erb +60 -60
  121. data/docs/resources/oneget.md.erb +53 -53
  122. data/docs/resources/oracledb_session.md.erb +52 -52
  123. data/docs/resources/os.md.erb +141 -141
  124. data/docs/resources/os_env.md.erb +78 -78
  125. data/docs/resources/package.md.erb +120 -120
  126. data/docs/resources/packages.md.erb +67 -67
  127. data/docs/resources/parse_config.md.erb +103 -103
  128. data/docs/resources/parse_config_file.md.erb +138 -138
  129. data/docs/resources/passwd.md.erb +141 -141
  130. data/docs/resources/pip.md.erb +67 -67
  131. data/docs/resources/port.md.erb +137 -137
  132. data/docs/resources/postgres_conf.md.erb +79 -79
  133. data/docs/resources/postgres_hba_conf.md.erb +93 -93
  134. data/docs/resources/postgres_ident_conf.md.erb +76 -76
  135. data/docs/resources/postgres_session.md.erb +69 -69
  136. data/docs/resources/powershell.md.erb +102 -102
  137. data/docs/resources/processes.md.erb +109 -109
  138. data/docs/resources/rabbitmq_config.md.erb +41 -41
  139. data/docs/resources/registry_key.md.erb +158 -158
  140. data/docs/resources/runit_service.md.erb +57 -57
  141. data/docs/resources/security_policy.md.erb +47 -47
  142. data/docs/resources/service.md.erb +121 -121
  143. data/docs/resources/shadow.md.erb +146 -146
  144. data/docs/resources/ssh_config.md.erb +73 -73
  145. data/docs/resources/sshd_config.md.erb +83 -83
  146. data/docs/resources/ssl.md.erb +119 -119
  147. data/docs/resources/sys_info.md.erb +42 -42
  148. data/docs/resources/systemd_service.md.erb +57 -57
  149. data/docs/resources/sysv_service.md.erb +57 -57
  150. data/docs/resources/upstart_service.md.erb +57 -57
  151. data/docs/resources/user.md.erb +140 -140
  152. data/docs/resources/users.md.erb +127 -127
  153. data/docs/resources/vbscript.md.erb +55 -55
  154. data/docs/resources/virtualization.md.erb +57 -57
  155. data/docs/resources/windows_feature.md.erb +47 -47
  156. data/docs/resources/windows_hotfix.md.erb +53 -53
  157. data/docs/resources/windows_task.md.erb +95 -95
  158. data/docs/resources/wmi.md.erb +81 -81
  159. data/docs/resources/x509_certificate.md.erb +151 -151
  160. data/docs/resources/xinetd_conf.md.erb +156 -156
  161. data/docs/resources/xml.md.erb +85 -85
  162. data/docs/resources/yaml.md.erb +69 -69
  163. data/docs/resources/yum.md.erb +98 -98
  164. data/docs/resources/zfs_dataset.md.erb +53 -53
  165. data/docs/resources/zfs_pool.md.erb +47 -47
  166. data/docs/ruby_usage.md +203 -203
  167. data/docs/shared/matcher_be.md.erb +1 -1
  168. data/docs/shared/matcher_cmp.md.erb +43 -43
  169. data/docs/shared/matcher_eq.md.erb +3 -3
  170. data/docs/shared/matcher_include.md.erb +1 -1
  171. data/docs/shared/matcher_match.md.erb +1 -1
  172. data/docs/shell.md +217 -217
  173. data/examples/README.md +8 -8
  174. data/examples/inheritance/README.md +65 -65
  175. data/examples/inheritance/controls/example.rb +14 -14
  176. data/examples/inheritance/inspec.yml +15 -15
  177. data/examples/kitchen-ansible/.kitchen.yml +25 -25
  178. data/examples/kitchen-ansible/Gemfile +19 -19
  179. data/examples/kitchen-ansible/README.md +53 -53
  180. data/examples/kitchen-ansible/files/nginx.repo +6 -6
  181. data/examples/kitchen-ansible/tasks/main.yml +16 -16
  182. data/examples/kitchen-ansible/test/integration/default/default.yml +5 -5
  183. data/examples/kitchen-ansible/test/integration/default/web_spec.rb +28 -28
  184. data/examples/kitchen-chef/.kitchen.yml +20 -20
  185. data/examples/kitchen-chef/Berksfile +3 -3
  186. data/examples/kitchen-chef/Gemfile +19 -19
  187. data/examples/kitchen-chef/README.md +27 -27
  188. data/examples/kitchen-chef/metadata.rb +7 -7
  189. data/examples/kitchen-chef/recipes/default.rb +6 -6
  190. data/examples/kitchen-chef/recipes/nginx.rb +30 -30
  191. data/examples/kitchen-chef/test/integration/default/web_spec.rb +28 -28
  192. data/examples/kitchen-puppet/.kitchen.yml +22 -22
  193. data/examples/kitchen-puppet/Gemfile +20 -20
  194. data/examples/kitchen-puppet/Puppetfile +25 -25
  195. data/examples/kitchen-puppet/README.md +53 -53
  196. data/examples/kitchen-puppet/manifests/site.pp +33 -33
  197. data/examples/kitchen-puppet/metadata.json +11 -11
  198. data/examples/kitchen-puppet/test/integration/default/web_spec.rb +28 -28
  199. data/examples/meta-profile/README.md +37 -37
  200. data/examples/meta-profile/controls/example.rb +13 -13
  201. data/examples/meta-profile/inspec.yml +13 -13
  202. data/examples/profile-attribute.yml +2 -2
  203. data/examples/profile-attribute/README.md +14 -14
  204. data/examples/profile-attribute/controls/example.rb +11 -11
  205. data/examples/profile-attribute/inspec.yml +8 -8
  206. data/examples/profile-aws/controls/iam_password_policy_expiration.rb +8 -8
  207. data/examples/profile-aws/controls/iam_password_policy_max_age.rb +8 -8
  208. data/examples/profile-aws/controls/iam_root_user_mfa.rb +8 -8
  209. data/examples/profile-aws/controls/iam_users_access_key_age.rb +8 -8
  210. data/examples/profile-aws/controls/iam_users_console_users_mfa.rb +8 -8
  211. data/examples/profile-aws/inspec.yml +11 -11
  212. data/examples/profile-azure/controls/azure_resource_group_example.rb +24 -24
  213. data/examples/profile-azure/controls/azure_vm_example.rb +29 -29
  214. data/examples/profile-azure/inspec.yml +11 -11
  215. data/examples/profile-sensitive/README.md +29 -29
  216. data/examples/profile-sensitive/controls/sensitive-failures.rb +9 -9
  217. data/examples/profile-sensitive/controls/sensitive.rb +9 -9
  218. data/examples/profile-sensitive/inspec.yml +8 -8
  219. data/examples/profile/README.md +48 -48
  220. data/examples/profile/controls/example.rb +23 -23
  221. data/examples/profile/controls/gordon.rb +36 -36
  222. data/examples/profile/controls/meta.rb +34 -34
  223. data/examples/profile/inspec.yml +10 -10
  224. data/examples/profile/libraries/gordon_config.rb +59 -53
  225. data/inspec.gemspec +47 -47
  226. data/lib/bundles/README.md +3 -3
  227. data/lib/bundles/inspec-artifact.rb +7 -7
  228. data/lib/bundles/inspec-artifact/README.md +1 -1
  229. data/lib/bundles/inspec-artifact/cli.rb +277 -277
  230. data/lib/bundles/inspec-compliance.rb +16 -16
  231. data/lib/bundles/inspec-compliance/.kitchen.yml +20 -20
  232. data/lib/bundles/inspec-compliance/README.md +185 -185
  233. data/lib/bundles/inspec-compliance/api.rb +316 -316
  234. data/lib/bundles/inspec-compliance/api/login.rb +152 -152
  235. data/lib/bundles/inspec-compliance/bootstrap.sh +41 -41
  236. data/lib/bundles/inspec-compliance/cli.rb +254 -254
  237. data/lib/bundles/inspec-compliance/configuration.rb +103 -103
  238. data/lib/bundles/inspec-compliance/http.rb +86 -86
  239. data/lib/bundles/inspec-compliance/support.rb +36 -36
  240. data/lib/bundles/inspec-compliance/target.rb +98 -98
  241. data/lib/bundles/inspec-compliance/test/integration/default/cli.rb +93 -93
  242. data/lib/bundles/inspec-habitat.rb +12 -12
  243. data/lib/bundles/inspec-habitat/cli.rb +36 -36
  244. data/lib/bundles/inspec-habitat/log.rb +10 -10
  245. data/lib/bundles/inspec-habitat/profile.rb +391 -391
  246. data/lib/bundles/inspec-init.rb +8 -8
  247. data/lib/bundles/inspec-init/README.md +31 -31
  248. data/lib/bundles/inspec-init/cli.rb +97 -97
  249. data/lib/bundles/inspec-init/templates/profile/README.md +3 -3
  250. data/lib/bundles/inspec-init/templates/profile/controls/example.rb +19 -19
  251. data/lib/bundles/inspec-init/templates/profile/inspec.yml +8 -8
  252. data/lib/bundles/inspec-supermarket.rb +13 -13
  253. data/lib/bundles/inspec-supermarket/README.md +45 -45
  254. data/lib/bundles/inspec-supermarket/api.rb +84 -84
  255. data/lib/bundles/inspec-supermarket/cli.rb +73 -73
  256. data/lib/bundles/inspec-supermarket/target.rb +34 -34
  257. data/lib/fetchers/git.rb +163 -163
  258. data/lib/fetchers/local.rb +74 -74
  259. data/lib/fetchers/mock.rb +35 -35
  260. data/lib/fetchers/url.rb +204 -204
  261. data/lib/inspec.rb +24 -24
  262. data/lib/inspec/archive/tar.rb +29 -29
  263. data/lib/inspec/archive/zip.rb +19 -19
  264. data/lib/inspec/backend.rb +93 -93
  265. data/lib/inspec/base_cli.rb +363 -357
  266. data/lib/inspec/cached_fetcher.rb +66 -66
  267. data/lib/inspec/cli.rb +292 -292
  268. data/lib/inspec/completions/bash.sh.erb +45 -45
  269. data/lib/inspec/completions/fish.sh.erb +34 -34
  270. data/lib/inspec/completions/zsh.sh.erb +61 -61
  271. data/lib/inspec/control_eval_context.rb +179 -179
  272. data/lib/inspec/dependencies/cache.rb +72 -72
  273. data/lib/inspec/dependencies/dependency_set.rb +92 -92
  274. data/lib/inspec/dependencies/lockfile.rb +115 -115
  275. data/lib/inspec/dependencies/requirement.rb +123 -123
  276. data/lib/inspec/dependencies/resolver.rb +86 -86
  277. data/lib/inspec/describe.rb +27 -27
  278. data/lib/inspec/dsl.rb +66 -66
  279. data/lib/inspec/dsl_shared.rb +33 -33
  280. data/lib/inspec/env_printer.rb +157 -157
  281. data/lib/inspec/errors.rb +14 -13
  282. data/lib/inspec/exceptions.rb +12 -12
  283. data/lib/inspec/expect.rb +45 -45
  284. data/lib/inspec/fetcher.rb +45 -45
  285. data/lib/inspec/file_provider.rb +275 -275
  286. data/lib/inspec/formatters.rb +3 -3
  287. data/lib/inspec/formatters/base.rb +259 -250
  288. data/lib/inspec/formatters/json_rspec.rb +20 -20
  289. data/lib/inspec/formatters/show_progress.rb +12 -12
  290. data/lib/inspec/library_eval_context.rb +58 -58
  291. data/lib/inspec/log.rb +11 -11
  292. data/lib/inspec/metadata.rb +247 -247
  293. data/lib/inspec/method_source.rb +24 -24
  294. data/lib/inspec/objects.rb +14 -14
  295. data/lib/inspec/objects/attribute.rb +65 -65
  296. data/lib/inspec/objects/control.rb +61 -61
  297. data/lib/inspec/objects/describe.rb +92 -92
  298. data/lib/inspec/objects/each_loop.rb +36 -36
  299. data/lib/inspec/objects/list.rb +15 -15
  300. data/lib/inspec/objects/or_test.rb +40 -40
  301. data/lib/inspec/objects/ruby_helper.rb +15 -15
  302. data/lib/inspec/objects/tag.rb +27 -27
  303. data/lib/inspec/objects/test.rb +87 -87
  304. data/lib/inspec/objects/value.rb +27 -27
  305. data/lib/inspec/plugins.rb +60 -60
  306. data/lib/inspec/plugins/cli.rb +24 -24
  307. data/lib/inspec/plugins/fetcher.rb +86 -86
  308. data/lib/inspec/plugins/resource.rb +135 -135
  309. data/lib/inspec/plugins/secret.rb +15 -15
  310. data/lib/inspec/plugins/source_reader.rb +40 -40
  311. data/lib/inspec/polyfill.rb +12 -12
  312. data/lib/inspec/profile.rb +513 -513
  313. data/lib/inspec/profile_context.rb +208 -208
  314. data/lib/inspec/profile_vendor.rb +66 -66
  315. data/lib/inspec/reporters.rb +60 -54
  316. data/lib/inspec/reporters/automate.rb +76 -0
  317. data/lib/inspec/reporters/base.rb +25 -24
  318. data/lib/inspec/reporters/cli.rb +356 -356
  319. data/lib/inspec/reporters/json.rb +116 -116
  320. data/lib/inspec/reporters/json_min.rb +48 -48
  321. data/lib/inspec/reporters/junit.rb +77 -77
  322. data/lib/inspec/require_loader.rb +33 -33
  323. data/lib/inspec/resource.rb +187 -186
  324. data/lib/inspec/rule.rb +266 -266
  325. data/lib/inspec/runner.rb +345 -345
  326. data/lib/inspec/runner_mock.rb +41 -41
  327. data/lib/inspec/runner_rspec.rb +175 -175
  328. data/lib/inspec/runtime_profile.rb +26 -26
  329. data/lib/inspec/schema.rb +213 -213
  330. data/lib/inspec/secrets.rb +19 -19
  331. data/lib/inspec/secrets/yaml.rb +30 -30
  332. data/lib/inspec/shell.rb +220 -220
  333. data/lib/inspec/shell_detector.rb +90 -90
  334. data/lib/inspec/source_reader.rb +29 -29
  335. data/lib/inspec/version.rb +8 -8
  336. data/lib/matchers/matchers.rb +339 -339
  337. data/lib/resource_support/aws.rb +49 -47
  338. data/lib/resource_support/aws/aws_backend_base.rb +12 -12
  339. data/lib/resource_support/aws/aws_backend_factory_mixin.rb +12 -12
  340. data/lib/resource_support/aws/aws_plural_resource_mixin.rb +21 -21
  341. data/lib/resource_support/aws/aws_resource_mixin.rb +66 -66
  342. data/lib/resource_support/aws/aws_singular_resource_mixin.rb +24 -24
  343. data/lib/resources/aide_conf.rb +151 -151
  344. data/lib/resources/apache.rb +48 -48
  345. data/lib/resources/apache_conf.rb +149 -149
  346. data/lib/resources/apt.rb +149 -149
  347. data/lib/resources/audit_policy.rb +63 -63
  348. data/lib/resources/auditd.rb +231 -231
  349. data/lib/resources/auditd_conf.rb +46 -46
  350. data/lib/resources/aws/aws_cloudtrail_trail.rb +77 -77
  351. data/lib/resources/aws/aws_cloudtrail_trails.rb +47 -47
  352. data/lib/resources/aws/aws_cloudwatch_alarm.rb +62 -62
  353. data/lib/resources/aws/aws_cloudwatch_log_metric_filter.rb +100 -100
  354. data/lib/resources/aws/aws_config_delivery_channel.rb +76 -76
  355. data/lib/resources/aws/aws_config_recorder.rb +98 -98
  356. data/lib/resources/aws/aws_ec2_instance.rb +157 -157
  357. data/lib/resources/aws/aws_iam_access_key.rb +106 -106
  358. data/lib/resources/aws/aws_iam_access_keys.rb +149 -149
  359. data/lib/resources/aws/aws_iam_group.rb +56 -56
  360. data/lib/resources/aws/aws_iam_groups.rb +52 -52
  361. data/lib/resources/aws/aws_iam_password_policy.rb +116 -116
  362. data/lib/resources/aws/aws_iam_policies.rb +53 -53
  363. data/lib/resources/aws/aws_iam_policy.rb +125 -125
  364. data/lib/resources/aws/aws_iam_role.rb +51 -51
  365. data/lib/resources/aws/aws_iam_root_user.rb +78 -60
  366. data/lib/resources/aws/aws_iam_user.rb +111 -111
  367. data/lib/resources/aws/aws_iam_users.rb +108 -108
  368. data/lib/resources/aws/aws_kms_key.rb +96 -96
  369. data/lib/resources/aws/aws_kms_keys.rb +53 -53
  370. data/lib/resources/aws/aws_rds_instance.rb +71 -71
  371. data/lib/resources/aws/aws_route_table.rb +63 -63
  372. data/lib/resources/aws/aws_route_tables.rb +60 -0
  373. data/lib/resources/aws/aws_s3_bucket.rb +115 -115
  374. data/lib/resources/aws/aws_s3_bucket_object.rb +82 -82
  375. data/lib/resources/aws/aws_s3_buckets.rb +51 -0
  376. data/lib/resources/aws/aws_security_group.rb +93 -93
  377. data/lib/resources/aws/aws_security_groups.rb +68 -68
  378. data/lib/resources/aws/aws_sns_subscription.rb +78 -78
  379. data/lib/resources/aws/aws_sns_topic.rb +53 -53
  380. data/lib/resources/aws/aws_sns_topics.rb +56 -56
  381. data/lib/resources/aws/aws_subnet.rb +88 -88
  382. data/lib/resources/aws/aws_subnets.rb +53 -53
  383. data/lib/resources/aws/aws_vpc.rb +69 -69
  384. data/lib/resources/aws/aws_vpcs.rb +45 -45
  385. data/lib/resources/azure/azure_backend.rb +377 -377
  386. data/lib/resources/azure/azure_generic_resource.rb +59 -59
  387. data/lib/resources/azure/azure_resource_group.rb +152 -152
  388. data/lib/resources/azure/azure_virtual_machine.rb +264 -264
  389. data/lib/resources/azure/azure_virtual_machine_data_disk.rb +134 -134
  390. data/lib/resources/bash.rb +35 -35
  391. data/lib/resources/bond.rb +69 -69
  392. data/lib/resources/bridge.rb +122 -122
  393. data/lib/resources/chocolatey_package.rb +78 -0
  394. data/lib/resources/command.rb +73 -73
  395. data/lib/resources/cpan.rb +58 -58
  396. data/lib/resources/cran.rb +64 -64
  397. data/lib/resources/crontab.rb +169 -169
  398. data/lib/resources/csv.rb +56 -56
  399. data/lib/resources/dh_params.rb +77 -77
  400. data/lib/resources/directory.rb +25 -25
  401. data/lib/resources/docker.rb +236 -236
  402. data/lib/resources/docker_container.rb +89 -89
  403. data/lib/resources/docker_image.rb +83 -83
  404. data/lib/resources/docker_object.rb +57 -57
  405. data/lib/resources/docker_service.rb +90 -90
  406. data/lib/resources/elasticsearch.rb +169 -169
  407. data/lib/resources/etc_fstab.rb +94 -94
  408. data/lib/resources/etc_group.rb +152 -152
  409. data/lib/resources/etc_hosts.rb +66 -66
  410. data/lib/resources/etc_hosts_allow_deny.rb +112 -112
  411. data/lib/resources/file.rb +298 -298
  412. data/lib/resources/filesystem.rb +31 -31
  413. data/lib/resources/firewalld.rb +143 -143
  414. data/lib/resources/gem.rb +70 -70
  415. data/lib/resources/groups.rb +215 -215
  416. data/lib/resources/grub_conf.rb +227 -227
  417. data/lib/resources/host.rb +306 -306
  418. data/lib/resources/http.rb +253 -253
  419. data/lib/resources/iis_app.rb +101 -101
  420. data/lib/resources/iis_site.rb +148 -148
  421. data/lib/resources/inetd_conf.rb +54 -54
  422. data/lib/resources/ini.rb +29 -29
  423. data/lib/resources/interface.rb +129 -129
  424. data/lib/resources/iptables.rb +80 -80
  425. data/lib/resources/json.rb +107 -107
  426. data/lib/resources/kernel_module.rb +107 -107
  427. data/lib/resources/kernel_parameter.rb +58 -58
  428. data/lib/resources/key_rsa.rb +61 -61
  429. data/lib/resources/limits_conf.rb +46 -46
  430. data/lib/resources/login_def.rb +57 -57
  431. data/lib/resources/mount.rb +88 -88
  432. data/lib/resources/mssql_session.rb +101 -101
  433. data/lib/resources/mysql.rb +82 -81
  434. data/lib/resources/mysql_conf.rb +127 -127
  435. data/lib/resources/mysql_session.rb +85 -85
  436. data/lib/resources/nginx.rb +96 -96
  437. data/lib/resources/nginx_conf.rb +226 -226
  438. data/lib/resources/npm.rb +48 -48
  439. data/lib/resources/ntp_conf.rb +51 -51
  440. data/lib/resources/oneget.rb +71 -71
  441. data/lib/resources/oracledb_session.rb +139 -139
  442. data/lib/resources/os.rb +36 -36
  443. data/lib/resources/os_env.rb +75 -75
  444. data/lib/resources/package.rb +370 -370
  445. data/lib/resources/packages.rb +111 -111
  446. data/lib/resources/parse_config.rb +112 -112
  447. data/lib/resources/passwd.rb +76 -76
  448. data/lib/resources/pip.rb +130 -130
  449. data/lib/resources/platform.rb +109 -109
  450. data/lib/resources/port.rb +771 -771
  451. data/lib/resources/postgres.rb +131 -130
  452. data/lib/resources/postgres_conf.rb +114 -114
  453. data/lib/resources/postgres_hba_conf.rb +90 -90
  454. data/lib/resources/postgres_ident_conf.rb +79 -79
  455. data/lib/resources/postgres_session.rb +71 -71
  456. data/lib/resources/powershell.rb +66 -66
  457. data/lib/resources/processes.rb +204 -204
  458. data/lib/resources/rabbitmq_conf.rb +51 -51
  459. data/lib/resources/registry_key.rb +297 -297
  460. data/lib/resources/security_policy.rb +180 -180
  461. data/lib/resources/service.rb +794 -790
  462. data/lib/resources/shadow.rb +149 -149
  463. data/lib/resources/ssh_conf.rb +97 -97
  464. data/lib/resources/ssl.rb +99 -99
  465. data/lib/resources/sys_info.rb +28 -28
  466. data/lib/resources/toml.rb +32 -32
  467. data/lib/resources/users.rb +654 -654
  468. data/lib/resources/vbscript.rb +68 -68
  469. data/lib/resources/virtualization.rb +247 -247
  470. data/lib/resources/windows_feature.rb +84 -84
  471. data/lib/resources/windows_hotfix.rb +35 -35
  472. data/lib/resources/windows_task.rb +102 -102
  473. data/lib/resources/wmi.rb +110 -110
  474. data/lib/resources/x509_certificate.rb +137 -137
  475. data/lib/resources/xinetd.rb +106 -106
  476. data/lib/resources/xml.rb +46 -46
  477. data/lib/resources/yaml.rb +43 -43
  478. data/lib/resources/yum.rb +180 -180
  479. data/lib/resources/zfs_dataset.rb +60 -60
  480. data/lib/resources/zfs_pool.rb +49 -49
  481. data/lib/source_readers/flat.rb +39 -39
  482. data/lib/source_readers/inspec.rb +75 -75
  483. data/lib/utils/command_wrapper.rb +27 -27
  484. data/lib/utils/convert.rb +12 -12
  485. data/lib/utils/database_helpers.rb +77 -77
  486. data/lib/utils/erlang_parser.rb +192 -192
  487. data/lib/utils/file_reader.rb +25 -25
  488. data/lib/utils/filter.rb +273 -273
  489. data/lib/utils/filter_array.rb +27 -27
  490. data/lib/utils/find_files.rb +44 -44
  491. data/lib/utils/hash.rb +41 -41
  492. data/lib/utils/json_log.rb +18 -18
  493. data/lib/utils/latest_version.rb +22 -22
  494. data/lib/utils/modulator.rb +12 -12
  495. data/lib/utils/nginx_parser.rb +85 -85
  496. data/lib/utils/object_traversal.rb +49 -49
  497. data/lib/utils/parser.rb +274 -274
  498. data/lib/utils/plugin_registry.rb +93 -93
  499. data/lib/utils/simpleconfig.rb +120 -120
  500. data/lib/utils/spdx.rb +13 -13
  501. data/lib/utils/spdx.txt +343 -343
  502. metadata +9 -2
@@ -1,16 +1,16 @@
1
- # encoding: utf-8
2
- # author: Christoph Hartmann
3
- # author: Dominik Richter
4
-
5
- libdir = File.dirname(__FILE__)
6
- $LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
7
-
8
- module Compliance
9
- autoload :Configuration, 'inspec-compliance/configuration'
10
- autoload :HTTP, 'inspec-compliance/http'
11
- autoload :Support, 'inspec-compliance/support'
12
- autoload :API, 'inspec-compliance/api'
13
- end
14
-
15
- require 'inspec-compliance/cli'
16
- require 'inspec-compliance/target'
1
+ # encoding: utf-8
2
+ # author: Christoph Hartmann
3
+ # author: Dominik Richter
4
+
5
+ libdir = File.dirname(__FILE__)
6
+ $LOAD_PATH.unshift(libdir) unless $LOAD_PATH.include?(libdir)
7
+
8
+ module Compliance
9
+ autoload :Configuration, 'inspec-compliance/configuration'
10
+ autoload :HTTP, 'inspec-compliance/http'
11
+ autoload :Support, 'inspec-compliance/support'
12
+ autoload :API, 'inspec-compliance/api'
13
+ end
14
+
15
+ require 'inspec-compliance/cli'
16
+ require 'inspec-compliance/target'
@@ -1,20 +1,20 @@
1
- ---
2
- driver:
3
- name: vagrant
4
- synced_folders:
5
- - ['../../../', '/inspec']
6
- network:
7
- - ['private_network', {ip: '192.168.251.2'}]
8
-
9
- provisioner:
10
- name: shell
11
-
12
- verifier:
13
- name: inspec
14
-
15
- platforms:
16
- - name: ubuntu-14.04
17
- suites:
18
- - name: default
19
- run_list:
20
- attributes:
1
+ ---
2
+ driver:
3
+ name: vagrant
4
+ synced_folders:
5
+ - ['../../../', '/inspec']
6
+ network:
7
+ - ['private_network', {ip: '192.168.251.2'}]
8
+
9
+ provisioner:
10
+ name: shell
11
+
12
+ verifier:
13
+ name: inspec
14
+
15
+ platforms:
16
+ - name: ubuntu-14.04
17
+ suites:
18
+ - name: default
19
+ run_list:
20
+ attributes:
@@ -1,185 +1,185 @@
1
- # InSpec Extension for Chef Compliance
2
-
3
- This extensions offers the following features:
4
-
5
- - list available profiles in Chef Automate/Chef Compliance
6
- - execute profiles directly from Chef Automate/Chef Compliance locally
7
- - upload a local profile to Chef Automate/Chef Compliance
8
-
9
- To use the CLI, this InSpec add-on adds the following commands:
10
-
11
- * `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
12
- * `$ inspec compliance profiles` - list all available Compliance profiles
13
- * `$ inspec exec compliance://profile` - runs a Compliance profile
14
- * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
15
- * `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
16
-
17
- Compliance profiles can be executed in two ways:
18
-
19
- - via compliance exec: `inspec compliance exec profile`
20
- - via compliance scheme: `inspec exec compliance://profile`
21
-
22
-
23
- ## Usage
24
-
25
- ### Command options
26
-
27
- ```
28
- $ inspec compliance
29
- Commands:
30
- inspec compliance download PROFILE # downloads a profile from Chef Compliance
31
- inspec compliance exec PROFILE # executes a Chef Compliance profile
32
- inspec compliance help [COMMAND] # Describe subcommands or one specific subcommand
33
- inspec compliance login SERVER # Log in to a Chef Automate/Chef Compliance SERVER
34
- inspec compliance logout # user logout from Chef Compliance
35
- inspec compliance profiles # list all available profiles in Chef Compliance
36
- inspec compliance upload PATH # uploads a local profile to Chef Compliance
37
- inspec compliance version # displays the version of the Chef Compliance server
38
- ```
39
-
40
- ### Login with Chef Automate
41
-
42
- You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
43
-
44
- ```
45
- $ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
46
- ```
47
-
48
- ### Login with Chef Compliance
49
-
50
- You will need an access token for authentication. You can retrieve one via:
51
-
52
- ![Chef Compliance Token](images/cc-token.png)
53
-
54
- You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
55
-
56
- ```
57
- $ inspec compliance login https://compliance.test --user admin --insecure --token '...'
58
- ```
59
-
60
- ### List available profiles via Chef Compliance / Automate
61
-
62
- ```
63
- $ inspec compliance profiles
64
- Available profiles:
65
- -------------------
66
- * base/apache
67
- * base/linux
68
- * base/mysql
69
- * base/postgres
70
- * base/ssh
71
- * base/windows
72
- * cis/cis-centos6-level1
73
- * cis/cis-centos6-level2
74
- * cis/cis-centos7-level1
75
- * cis/cis-centos7-level2
76
- * cis/cis-rhel7-level1
77
- * cis/cis-rhel7-level2
78
- * cis/cis-ubuntu12.04lts-level1
79
- * cis/cis-ubuntu12.04lts-level2
80
- * cis/cis-ubuntu14.04lts-level1
81
- * cis/cis-ubuntu14.04lts-level2
82
- ```
83
-
84
- ### Upload a profile to Chef Compliance / Automate
85
-
86
- ```
87
- $ inspec compliance version
88
- Chef Compliance version: 1.0.11
89
- ➜ inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec compliance upload examples/profile
90
- I, [2016-05-06T14:27:20.907547 #37592] INFO -- : Checking profile in examples/profile
91
- I, [2016-05-06T14:27:20.907668 #37592] INFO -- : Metadata OK.
92
- I, [2016-05-06T14:27:20.968584 #37592] INFO -- : Found 4 controls.
93
- I, [2016-05-06T14:27:20.968638 #37592] INFO -- : Control definitions OK.
94
- Profile is valid
95
- Generate temporary profile archive at /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz
96
- I, [2016-05-06T14:27:21.020017 #37592] INFO -- : Generate archive /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz.
97
- I, [2016-05-06T14:27:21.024837 #37592] INFO -- : Finished archive generation.
98
- Start upload to admin/profile
99
- Uploading to Chef Compliance
100
- Successfully uploaded profile
101
-
102
- # display all profiles
103
- $ inspec compliance profiles
104
- Available profiles:
105
- -------------------
106
- * admin/profile
107
- * base/apache
108
- * base/linux
109
- * base/mysql
110
- * base/postgres
111
- * base/ssh
112
- * base/windows
113
- * cis/cis-centos6-level1
114
- * cis/cis-centos6-level2
115
- * cis/cis-centos7-level1
116
- * cis/cis-centos7-level2
117
- * cis/cis-rhel7-level1
118
- * cis/cis-rhel7-level2
119
- * cis/cis-ubuntu12.04lts-level1
120
- * cis/cis-ubuntu12.04lts-level2
121
- * cis/cis-ubuntu14.04lts-level1
122
- * cis/cis-ubuntu14.04lts-level2
123
- ```
124
-
125
- ### Run a profile from Chef Compliance / Chef Automate on Workstation
126
-
127
- ```
128
- $ inspec exec compliance://admin/profile
129
- .*...
130
-
131
- Pending: (Failures listed here are expected and do not affect your suite's status)
132
-
133
- 1) gordon_config Can't find file "/tmp/gordon/config.yaml"
134
- # Not yet implemented
135
- # ./lib/inspec/runner.rb:157
136
-
137
-
138
- Finished in 0.02862 seconds (files took 0.62628 seconds to load)
139
- 5 examples, 0 failures, 1 pending
140
- ```
141
-
142
- Exec a specific version(2.0.1) of a profile when logged in with Automate:
143
-
144
- ```
145
- $ inspec exec compliance://admin/apache-baseline#2.0.1
146
- ```
147
-
148
- Download a specific version(2.0.2) of a profile when logged in with Automate:
149
- ```
150
- $ inspec compliance download compliance://admin/apache-baseline#2.0.2
151
- ```
152
-
153
- ### To Logout from Chef Compliance
154
-
155
- ```
156
- $ inspec compliance logout
157
- Successfully logged out
158
- ```
159
-
160
- ## Integration Tests
161
-
162
- At this point of time, InSpec is not able to pick up the token directly, therefore the integration test is semi-automatic at this point of time:
163
-
164
- * run `kitchen converge`
165
- * open https://192.168.251.2 and log in with user `admin` and password `admin`
166
- * click on user->about and obtain the access token and the refresh token
167
- * run `kitchen verify` with the required env variables:
168
-
169
- ```
170
- # both token need to be set, since the test suite runs for each token type
171
- export COMPLIANCE_ACCESSTOKEN='mycompliancetoken'
172
- export COMPLIANCE_REFRESHTOKEN='myrefreshtoken'
173
- kitchen verify
174
- -----> Starting Kitchen (v1.7.3)
175
- -----> Verifying <default-ubuntu-1404>...
176
- Search `/Users/chartmann/Development/compliance/inspec/lib/bundles/inspec-compliance/test/integration/default` for tests
177
- ..................................
178
-
179
- Finished in 6.35 seconds (files took 0.40949 seconds to load)
180
- 34 examples, 0 failures
181
-
182
- Finished verifying <default-ubuntu-1404> (0m6.62s).
183
- -----> Kitchen is finished. (0m7.02s)
184
- zlib(finalizer): the stream was freed prematurely.
185
- ```
1
+ # InSpec Extension for Chef Compliance
2
+
3
+ This extensions offers the following features:
4
+
5
+ - list available profiles in Chef Automate/Chef Compliance
6
+ - execute profiles directly from Chef Automate/Chef Compliance locally
7
+ - upload a local profile to Chef Automate/Chef Compliance
8
+
9
+ To use the CLI, this InSpec add-on adds the following commands:
10
+
11
+ * `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
12
+ * `$ inspec compliance profiles` - list all available Compliance profiles
13
+ * `$ inspec exec compliance://profile` - runs a Compliance profile
14
+ * `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
15
+ * `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
16
+
17
+ Compliance profiles can be executed in two ways:
18
+
19
+ - via compliance exec: `inspec compliance exec profile`
20
+ - via compliance scheme: `inspec exec compliance://profile`
21
+
22
+
23
+ ## Usage
24
+
25
+ ### Command options
26
+
27
+ ```
28
+ $ inspec compliance
29
+ Commands:
30
+ inspec compliance download PROFILE # downloads a profile from Chef Compliance
31
+ inspec compliance exec PROFILE # executes a Chef Compliance profile
32
+ inspec compliance help [COMMAND] # Describe subcommands or one specific subcommand
33
+ inspec compliance login SERVER # Log in to a Chef Automate/Chef Compliance SERVER
34
+ inspec compliance logout # user logout from Chef Compliance
35
+ inspec compliance profiles # list all available profiles in Chef Compliance
36
+ inspec compliance upload PATH # uploads a local profile to Chef Compliance
37
+ inspec compliance version # displays the version of the Chef Compliance server
38
+ ```
39
+
40
+ ### Login with Chef Automate
41
+
42
+ You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
43
+
44
+ ```
45
+ $ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
46
+ ```
47
+
48
+ ### Login with Chef Compliance
49
+
50
+ You will need an access token for authentication. You can retrieve one via:
51
+
52
+ ![Chef Compliance Token](images/cc-token.png)
53
+
54
+ You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
55
+
56
+ ```
57
+ $ inspec compliance login https://compliance.test --user admin --insecure --token '...'
58
+ ```
59
+
60
+ ### List available profiles via Chef Compliance / Automate
61
+
62
+ ```
63
+ $ inspec compliance profiles
64
+ Available profiles:
65
+ -------------------
66
+ * base/apache
67
+ * base/linux
68
+ * base/mysql
69
+ * base/postgres
70
+ * base/ssh
71
+ * base/windows
72
+ * cis/cis-centos6-level1
73
+ * cis/cis-centos6-level2
74
+ * cis/cis-centos7-level1
75
+ * cis/cis-centos7-level2
76
+ * cis/cis-rhel7-level1
77
+ * cis/cis-rhel7-level2
78
+ * cis/cis-ubuntu12.04lts-level1
79
+ * cis/cis-ubuntu12.04lts-level2
80
+ * cis/cis-ubuntu14.04lts-level1
81
+ * cis/cis-ubuntu14.04lts-level2
82
+ ```
83
+
84
+ ### Upload a profile to Chef Compliance / Automate
85
+
86
+ ```
87
+ $ inspec compliance version
88
+ Chef Compliance version: 1.0.11
89
+ ➜ inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec compliance upload examples/profile
90
+ I, [2016-05-06T14:27:20.907547 #37592] INFO -- : Checking profile in examples/profile
91
+ I, [2016-05-06T14:27:20.907668 #37592] INFO -- : Metadata OK.
92
+ I, [2016-05-06T14:27:20.968584 #37592] INFO -- : Found 4 controls.
93
+ I, [2016-05-06T14:27:20.968638 #37592] INFO -- : Control definitions OK.
94
+ Profile is valid
95
+ Generate temporary profile archive at /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz
96
+ I, [2016-05-06T14:27:21.020017 #37592] INFO -- : Generate archive /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz.
97
+ I, [2016-05-06T14:27:21.024837 #37592] INFO -- : Finished archive generation.
98
+ Start upload to admin/profile
99
+ Uploading to Chef Compliance
100
+ Successfully uploaded profile
101
+
102
+ # display all profiles
103
+ $ inspec compliance profiles
104
+ Available profiles:
105
+ -------------------
106
+ * admin/profile
107
+ * base/apache
108
+ * base/linux
109
+ * base/mysql
110
+ * base/postgres
111
+ * base/ssh
112
+ * base/windows
113
+ * cis/cis-centos6-level1
114
+ * cis/cis-centos6-level2
115
+ * cis/cis-centos7-level1
116
+ * cis/cis-centos7-level2
117
+ * cis/cis-rhel7-level1
118
+ * cis/cis-rhel7-level2
119
+ * cis/cis-ubuntu12.04lts-level1
120
+ * cis/cis-ubuntu12.04lts-level2
121
+ * cis/cis-ubuntu14.04lts-level1
122
+ * cis/cis-ubuntu14.04lts-level2
123
+ ```
124
+
125
+ ### Run a profile from Chef Compliance / Chef Automate on Workstation
126
+
127
+ ```
128
+ $ inspec exec compliance://admin/profile
129
+ .*...
130
+
131
+ Pending: (Failures listed here are expected and do not affect your suite's status)
132
+
133
+ 1) gordon_config Can't find file "/tmp/gordon/config.yaml"
134
+ # Not yet implemented
135
+ # ./lib/inspec/runner.rb:157
136
+
137
+
138
+ Finished in 0.02862 seconds (files took 0.62628 seconds to load)
139
+ 5 examples, 0 failures, 1 pending
140
+ ```
141
+
142
+ Exec a specific version(2.0.1) of a profile when logged in with Automate:
143
+
144
+ ```
145
+ $ inspec exec compliance://admin/apache-baseline#2.0.1
146
+ ```
147
+
148
+ Download a specific version(2.0.2) of a profile when logged in with Automate:
149
+ ```
150
+ $ inspec compliance download compliance://admin/apache-baseline#2.0.2
151
+ ```
152
+
153
+ ### To Logout from Chef Compliance
154
+
155
+ ```
156
+ $ inspec compliance logout
157
+ Successfully logged out
158
+ ```
159
+
160
+ ## Integration Tests
161
+
162
+ At this point of time, InSpec is not able to pick up the token directly, therefore the integration test is semi-automatic at this point of time:
163
+
164
+ * run `kitchen converge`
165
+ * open https://192.168.251.2 and log in with user `admin` and password `admin`
166
+ * click on user->about and obtain the access token and the refresh token
167
+ * run `kitchen verify` with the required env variables:
168
+
169
+ ```
170
+ # both token need to be set, since the test suite runs for each token type
171
+ export COMPLIANCE_ACCESSTOKEN='mycompliancetoken'
172
+ export COMPLIANCE_REFRESHTOKEN='myrefreshtoken'
173
+ kitchen verify
174
+ -----> Starting Kitchen (v1.7.3)
175
+ -----> Verifying <default-ubuntu-1404>...
176
+ Search `/Users/chartmann/Development/compliance/inspec/lib/bundles/inspec-compliance/test/integration/default` for tests
177
+ ..................................
178
+
179
+ Finished in 6.35 seconds (files took 0.40949 seconds to load)
180
+ 34 examples, 0 failures
181
+
182
+ Finished verifying <default-ubuntu-1404> (0m6.62s).
183
+ -----> Kitchen is finished. (0m7.02s)
184
+ zlib(finalizer): the stream was freed prematurely.
185
+ ```
@@ -1,316 +1,316 @@
1
- # encoding: utf-8
2
- # author: Christoph Hartmann
3
- # author: Dominik Richter
4
-
5
- require 'net/http'
6
- require 'uri'
7
-
8
- require_relative 'api/login'
9
-
10
- module Compliance
11
- class ServerConfigurationMissing < StandardError; end
12
-
13
- # API Implementation does not hold any state by itself,
14
- # everything will be stored in local Configuration store
15
- class API
16
- extend Compliance::API::Login
17
-
18
- # return all compliance profiles available for the user
19
- # the user is either specified in the options hash or by default
20
- # the username of the account is used that is logged in
21
- def self.profiles(config)
22
- owner = config['owner'] || config['user']
23
-
24
- # Chef Compliance
25
- if is_compliance_server?(config)
26
- url = "#{config['server']}/user/compliance"
27
- # Chef Automate
28
- elsif is_automate_server?(config)
29
- url = "#{config['server']}/profiles/#{owner}"
30
- else
31
- raise ServerConfigurationMissing
32
- end
33
-
34
- headers = get_headers(config)
35
- response = Compliance::HTTP.get(url, headers, config['insecure'])
36
- data = response.body
37
- response_code = response.code
38
- case response_code
39
- when '200'
40
- msg = 'success'
41
- profiles = JSON.parse(data)
42
- # iterate over profiles
43
- if is_compliance_server?(config)
44
- mapped_profiles = []
45
- profiles.values.each { |org|
46
- mapped_profiles += org.values
47
- }
48
- # Chef Automate pre 0.8.0
49
- elsif is_automate_server_pre_080?(config)
50
- mapped_profiles = profiles.values.flatten
51
- else
52
- mapped_profiles = profiles.map { |e|
53
- e['owner_id'] = owner
54
- e
55
- }
56
- end
57
- return msg, mapped_profiles
58
- when '401'
59
- msg = '401 Unauthorized. Please check your token.'
60
- return msg, []
61
- else
62
- msg = "An unexpected error occurred (HTTP #{response_code}): #{response.message}"
63
- return msg, []
64
- end
65
- end
66
-
67
- # return the server api version
68
- # NB this method does not use Compliance::Configuration to allow for using
69
- # it before we know the version (e.g. oidc or not)
70
- def self.version(config)
71
- url = config['server']
72
- insecure = config['insecure']
73
-
74
- raise ServerConfigurationMissing if url.nil?
75
-
76
- headers = get_headers(config)
77
- response = Compliance::HTTP.get(url+'/version', headers, insecure)
78
- return {} if response.code == '404'
79
-
80
- data = response.body
81
- return {} if data.nil? || data.empty?
82
-
83
- parsed = JSON.parse(data)
84
- return {} unless parsed.key?('version') && !parsed['version'].empty?
85
-
86
- parsed
87
- end
88
-
89
- # verifies that a profile
90
- def self.exist?(config, profile)
91
- owner, id, ver = profile_split(profile)
92
-
93
- # ensure that we do not manipulate the configuration object
94
- user_config = config.dup
95
- user_config['owner'] = owner
96
- _msg, profiles = Compliance::API.profiles(user_config)
97
-
98
- if !profiles.empty?
99
- profiles.any? do |p|
100
- p['owner_id'] == owner &&
101
- p['name'] == id &&
102
- (ver.nil? || p['version'] == ver)
103
- end
104
- else
105
- false
106
- end
107
- end
108
-
109
- def self.upload(config, owner, profile_name, archive_path)
110
- # Chef Compliance
111
- if is_compliance_server?(config)
112
- url = "#{config['server']}/owners/#{owner}/compliance/#{profile_name}/tar"
113
- # Chef Automate pre 0.8.0
114
- elsif is_automate_server_pre_080?(config)
115
- url = "#{config['server']}/#{owner}"
116
- # Chef Automate
117
- else
118
- url = "#{config['server']}/profiles/#{owner}"
119
- end
120
-
121
- headers = get_headers(config)
122
- res = Compliance::HTTP.post_file(url, headers, archive_path, config['insecure'])
123
- [res.is_a?(Net::HTTPSuccess), res.body]
124
- end
125
-
126
- # Use username and refresh_token to get an API access token
127
- def self.get_token_via_refresh_token(url, refresh_token, insecure)
128
- uri = URI.parse("#{url}/login")
129
- req = Net::HTTP::Post.new(uri.path)
130
- req.body = { token: refresh_token }.to_json
131
- access_token = nil
132
- response = Compliance::HTTP.send_request(uri, req, insecure)
133
- data = response.body
134
- if response.code == '200'
135
- begin
136
- tokendata = JSON.parse(data)
137
- access_token = tokendata['access_token']
138
- msg = 'Successfully fetched API access token'
139
- success = true
140
- rescue JSON::ParserError => e
141
- success = false
142
- msg = e.message
143
- end
144
- else
145
- success = false
146
- msg = "Failed to authenticate to #{url} \n\
147
- Response code: #{response.code}\n Body: #{response.body}"
148
- end
149
-
150
- [success, msg, access_token]
151
- end
152
-
153
- # Use username and password to get an API access token
154
- def self.get_token_via_password(url, username, password, insecure)
155
- uri = URI.parse("#{url}/login")
156
- req = Net::HTTP::Post.new(uri.path)
157
- req.body = { userid: username, password: password }.to_json
158
- access_token = nil
159
- response = Compliance::HTTP.send_request(uri, req, insecure)
160
- data = response.body
161
- if response.code == '200'
162
- access_token = data
163
- msg = 'Successfully fetched an API access token valid for 12 hours'
164
- success = true
165
- else
166
- success = false
167
- msg = "Failed to authenticate to #{url} \n\
168
- Response code: #{response.code}\n Body: #{response.body}"
169
- end
170
-
171
- [success, msg, access_token]
172
- end
173
-
174
- def self.get_headers(config)
175
- token = get_token(config)
176
- if is_automate_server?(config)
177
- headers = { 'chef-delivery-enterprise' => config['automate']['ent'] }
178
- if config['automate']['token_type'] == 'dctoken'
179
- headers['x-data-collector-token'] = token
180
- else
181
- headers['chef-delivery-user'] = config['user']
182
- headers['chef-delivery-token'] = token
183
- end
184
- else
185
- headers = { 'Authorization' => "Bearer #{token}" }
186
- end
187
- headers
188
- end
189
-
190
- def self.get_token(config)
191
- return config['token'] unless config['refresh_token']
192
- _success, _msg, token = get_token_via_refresh_token(config['server'], config['refresh_token'], config['insecure'])
193
- token
194
- end
195
-
196
- def self.target_url(config, profile)
197
- owner, id, ver = profile_split(profile)
198
-
199
- return "#{config['server']}/owners/#{owner}/compliance/#{id}/tar" unless is_automate_server?(config)
200
-
201
- if ver.nil?
202
- "#{config['server']}/profiles/#{owner}/#{id}/tar"
203
- else
204
- "#{config['server']}/profiles/#{owner}/#{id}/version/#{ver}/tar"
205
- end
206
- end
207
-
208
- def self.profile_split(profile)
209
- owner, id = profile.split('/')
210
- id, version = id.split('#')
211
- [owner, id, version]
212
- end
213
-
214
- # returns a parsed url for `admin/profile` or `compliance://admin/profile`
215
- def self.sanitize_profile_name(profile)
216
- if URI(profile).scheme == 'compliance'
217
- uri = URI(profile)
218
- else
219
- uri = URI("compliance://#{profile}")
220
- end
221
- uri.to_s.sub(%r{^compliance:\/\/}, '')
222
- end
223
-
224
- def self.is_compliance_server?(config)
225
- config['server_type'] == 'compliance'
226
- end
227
-
228
- def self.is_automate_server_pre_080?(config)
229
- # Automate versions before 0.8.x do not have a valid version in the config
230
- return false unless config['server_type'] == 'automate'
231
- server_version_from_config(config).nil?
232
- end
233
-
234
- def self.is_automate_server_080_and_later?(config)
235
- # Automate versions 0.8.x and later will have a "version" key in the config
236
- # that is properly parsed out via server_version_from_config below
237
- return false unless config['server_type'] == 'automate'
238
- !server_version_from_config(config).nil?
239
- end
240
-
241
- def self.is_automate_server?(config)
242
- config['server_type'] == 'automate'
243
- end
244
-
245
- def self.server_version_from_config(config)
246
- # Automate versions 0.8.x and later will have a "version" key in the config
247
- # that looks like: "version":{"api":"compliance","version":"0.8.24"}
248
- return nil unless config.key?('version')
249
- return nil unless config['version'].is_a?(Hash)
250
- config['version']['version']
251
- end
252
-
253
- def self.determine_server_type(url, insecure)
254
- if target_is_automate_server?(url, insecure)
255
- :automate
256
- elsif target_is_compliance_server?(url, insecure)
257
- :compliance
258
- else
259
- Inspec::Log.debug('Could not determine server type using known endpoints')
260
- nil
261
- end
262
- end
263
-
264
- def self.target_is_automate_server?(url, insecure)
265
- automate_endpoint = '/compliance/version'
266
- response = Compliance::HTTP.get(url + automate_endpoint, nil, insecure)
267
- case response.code
268
- when '401'
269
- Inspec::Log.debug(
270
- "Received 401 from #{url}#{automate_endpoint} - " \
271
- 'assuming target is a Chef Automate instance',
272
- )
273
- true
274
- when '200'
275
- # Chef Automate currently returns 401 for `/compliance/version` but some
276
- # versions of OpsWorks Chef Automate return 200 and a Chef Manage page
277
- # when unauthenticated requests are received.
278
- if response.body.include?('Are You Looking For the Chef Server?')
279
- Inspec::Log.debug(
280
- "Received 200 from #{url}#{automate_endpoint} - " \
281
- 'assuming target is an OpsWorks Chef Automate instance',
282
- )
283
- true
284
- else
285
- Inspec::Log.debug(
286
- "Received 200 from #{url}#{automate_endpoint} " \
287
- 'but did not receive the Chef Manage page - ' \
288
- 'assuming target is not a Chef Automate instance',
289
- )
290
- false
291
- end
292
- else
293
- Inspec::Log.debug(
294
- "Received unexpected status code #{response.code} " \
295
- "from #{url}#{automate_endpoint} - " \
296
- 'assuming target is not a Chef Automate instance',
297
- )
298
- false
299
- end
300
- end
301
-
302
- def self.target_is_compliance_server?(url, insecure)
303
- # All versions of Chef Compliance return 200 for `/api/version`
304
- compliance_endpoint = '/api/version'
305
-
306
- response = Compliance::HTTP.get(url + compliance_endpoint, nil, insecure)
307
- return false unless response.code == '200'
308
-
309
- Inspec::Log.debug(
310
- "Received 200 from #{url}#{compliance_endpoint} - " \
311
- 'assuming target is a Compliance server',
312
- )
313
- true
314
- end
315
- end
316
- end
1
+ # encoding: utf-8
2
+ # author: Christoph Hartmann
3
+ # author: Dominik Richter
4
+
5
+ require 'net/http'
6
+ require 'uri'
7
+
8
+ require_relative 'api/login'
9
+
10
+ module Compliance
11
+ class ServerConfigurationMissing < StandardError; end
12
+
13
+ # API Implementation does not hold any state by itself,
14
+ # everything will be stored in local Configuration store
15
+ class API
16
+ extend Compliance::API::Login
17
+
18
+ # return all compliance profiles available for the user
19
+ # the user is either specified in the options hash or by default
20
+ # the username of the account is used that is logged in
21
+ def self.profiles(config)
22
+ owner = config['owner'] || config['user']
23
+
24
+ # Chef Compliance
25
+ if is_compliance_server?(config)
26
+ url = "#{config['server']}/user/compliance"
27
+ # Chef Automate
28
+ elsif is_automate_server?(config)
29
+ url = "#{config['server']}/profiles/#{owner}"
30
+ else
31
+ raise ServerConfigurationMissing
32
+ end
33
+
34
+ headers = get_headers(config)
35
+ response = Compliance::HTTP.get(url, headers, config['insecure'])
36
+ data = response.body
37
+ response_code = response.code
38
+ case response_code
39
+ when '200'
40
+ msg = 'success'
41
+ profiles = JSON.parse(data)
42
+ # iterate over profiles
43
+ if is_compliance_server?(config)
44
+ mapped_profiles = []
45
+ profiles.values.each { |org|
46
+ mapped_profiles += org.values
47
+ }
48
+ # Chef Automate pre 0.8.0
49
+ elsif is_automate_server_pre_080?(config)
50
+ mapped_profiles = profiles.values.flatten
51
+ else
52
+ mapped_profiles = profiles.map { |e|
53
+ e['owner_id'] = owner
54
+ e
55
+ }
56
+ end
57
+ return msg, mapped_profiles
58
+ when '401'
59
+ msg = '401 Unauthorized. Please check your token.'
60
+ return msg, []
61
+ else
62
+ msg = "An unexpected error occurred (HTTP #{response_code}): #{response.message}"
63
+ return msg, []
64
+ end
65
+ end
66
+
67
+ # return the server api version
68
+ # NB this method does not use Compliance::Configuration to allow for using
69
+ # it before we know the version (e.g. oidc or not)
70
+ def self.version(config)
71
+ url = config['server']
72
+ insecure = config['insecure']
73
+
74
+ raise ServerConfigurationMissing if url.nil?
75
+
76
+ headers = get_headers(config)
77
+ response = Compliance::HTTP.get(url+'/version', headers, insecure)
78
+ return {} if response.code == '404'
79
+
80
+ data = response.body
81
+ return {} if data.nil? || data.empty?
82
+
83
+ parsed = JSON.parse(data)
84
+ return {} unless parsed.key?('version') && !parsed['version'].empty?
85
+
86
+ parsed
87
+ end
88
+
89
+ # verifies that a profile
90
+ def self.exist?(config, profile)
91
+ owner, id, ver = profile_split(profile)
92
+
93
+ # ensure that we do not manipulate the configuration object
94
+ user_config = config.dup
95
+ user_config['owner'] = owner
96
+ _msg, profiles = Compliance::API.profiles(user_config)
97
+
98
+ if !profiles.empty?
99
+ profiles.any? do |p|
100
+ p['owner_id'] == owner &&
101
+ p['name'] == id &&
102
+ (ver.nil? || p['version'] == ver)
103
+ end
104
+ else
105
+ false
106
+ end
107
+ end
108
+
109
+ def self.upload(config, owner, profile_name, archive_path)
110
+ # Chef Compliance
111
+ if is_compliance_server?(config)
112
+ url = "#{config['server']}/owners/#{owner}/compliance/#{profile_name}/tar"
113
+ # Chef Automate pre 0.8.0
114
+ elsif is_automate_server_pre_080?(config)
115
+ url = "#{config['server']}/#{owner}"
116
+ # Chef Automate
117
+ else
118
+ url = "#{config['server']}/profiles/#{owner}"
119
+ end
120
+
121
+ headers = get_headers(config)
122
+ res = Compliance::HTTP.post_file(url, headers, archive_path, config['insecure'])
123
+ [res.is_a?(Net::HTTPSuccess), res.body]
124
+ end
125
+
126
+ # Use username and refresh_token to get an API access token
127
+ def self.get_token_via_refresh_token(url, refresh_token, insecure)
128
+ uri = URI.parse("#{url}/login")
129
+ req = Net::HTTP::Post.new(uri.path)
130
+ req.body = { token: refresh_token }.to_json
131
+ access_token = nil
132
+ response = Compliance::HTTP.send_request(uri, req, insecure)
133
+ data = response.body
134
+ if response.code == '200'
135
+ begin
136
+ tokendata = JSON.parse(data)
137
+ access_token = tokendata['access_token']
138
+ msg = 'Successfully fetched API access token'
139
+ success = true
140
+ rescue JSON::ParserError => e
141
+ success = false
142
+ msg = e.message
143
+ end
144
+ else
145
+ success = false
146
+ msg = "Failed to authenticate to #{url} \n\
147
+ Response code: #{response.code}\n Body: #{response.body}"
148
+ end
149
+
150
+ [success, msg, access_token]
151
+ end
152
+
153
+ # Use username and password to get an API access token
154
+ def self.get_token_via_password(url, username, password, insecure)
155
+ uri = URI.parse("#{url}/login")
156
+ req = Net::HTTP::Post.new(uri.path)
157
+ req.body = { userid: username, password: password }.to_json
158
+ access_token = nil
159
+ response = Compliance::HTTP.send_request(uri, req, insecure)
160
+ data = response.body
161
+ if response.code == '200'
162
+ access_token = data
163
+ msg = 'Successfully fetched an API access token valid for 12 hours'
164
+ success = true
165
+ else
166
+ success = false
167
+ msg = "Failed to authenticate to #{url} \n\
168
+ Response code: #{response.code}\n Body: #{response.body}"
169
+ end
170
+
171
+ [success, msg, access_token]
172
+ end
173
+
174
+ def self.get_headers(config)
175
+ token = get_token(config)
176
+ if is_automate_server?(config)
177
+ headers = { 'chef-delivery-enterprise' => config['automate']['ent'] }
178
+ if config['automate']['token_type'] == 'dctoken'
179
+ headers['x-data-collector-token'] = token
180
+ else
181
+ headers['chef-delivery-user'] = config['user']
182
+ headers['chef-delivery-token'] = token
183
+ end
184
+ else
185
+ headers = { 'Authorization' => "Bearer #{token}" }
186
+ end
187
+ headers
188
+ end
189
+
190
+ def self.get_token(config)
191
+ return config['token'] unless config['refresh_token']
192
+ _success, _msg, token = get_token_via_refresh_token(config['server'], config['refresh_token'], config['insecure'])
193
+ token
194
+ end
195
+
196
+ def self.target_url(config, profile)
197
+ owner, id, ver = profile_split(profile)
198
+
199
+ return "#{config['server']}/owners/#{owner}/compliance/#{id}/tar" unless is_automate_server?(config)
200
+
201
+ if ver.nil?
202
+ "#{config['server']}/profiles/#{owner}/#{id}/tar"
203
+ else
204
+ "#{config['server']}/profiles/#{owner}/#{id}/version/#{ver}/tar"
205
+ end
206
+ end
207
+
208
+ def self.profile_split(profile)
209
+ owner, id = profile.split('/')
210
+ id, version = id.split('#')
211
+ [owner, id, version]
212
+ end
213
+
214
+ # returns a parsed url for `admin/profile` or `compliance://admin/profile`
215
+ def self.sanitize_profile_name(profile)
216
+ if URI(profile).scheme == 'compliance'
217
+ uri = URI(profile)
218
+ else
219
+ uri = URI("compliance://#{profile}")
220
+ end
221
+ uri.to_s.sub(%r{^compliance:\/\/}, '')
222
+ end
223
+
224
+ def self.is_compliance_server?(config)
225
+ config['server_type'] == 'compliance'
226
+ end
227
+
228
+ def self.is_automate_server_pre_080?(config)
229
+ # Automate versions before 0.8.x do not have a valid version in the config
230
+ return false unless config['server_type'] == 'automate'
231
+ server_version_from_config(config).nil?
232
+ end
233
+
234
+ def self.is_automate_server_080_and_later?(config)
235
+ # Automate versions 0.8.x and later will have a "version" key in the config
236
+ # that is properly parsed out via server_version_from_config below
237
+ return false unless config['server_type'] == 'automate'
238
+ !server_version_from_config(config).nil?
239
+ end
240
+
241
+ def self.is_automate_server?(config)
242
+ config['server_type'] == 'automate'
243
+ end
244
+
245
+ def self.server_version_from_config(config)
246
+ # Automate versions 0.8.x and later will have a "version" key in the config
247
+ # that looks like: "version":{"api":"compliance","version":"0.8.24"}
248
+ return nil unless config.key?('version')
249
+ return nil unless config['version'].is_a?(Hash)
250
+ config['version']['version']
251
+ end
252
+
253
+ def self.determine_server_type(url, insecure)
254
+ if target_is_automate_server?(url, insecure)
255
+ :automate
256
+ elsif target_is_compliance_server?(url, insecure)
257
+ :compliance
258
+ else
259
+ Inspec::Log.debug('Could not determine server type using known endpoints')
260
+ nil
261
+ end
262
+ end
263
+
264
+ def self.target_is_automate_server?(url, insecure)
265
+ automate_endpoint = '/compliance/version'
266
+ response = Compliance::HTTP.get(url + automate_endpoint, nil, insecure)
267
+ case response.code
268
+ when '401'
269
+ Inspec::Log.debug(
270
+ "Received 401 from #{url}#{automate_endpoint} - " \
271
+ 'assuming target is a Chef Automate instance',
272
+ )
273
+ true
274
+ when '200'
275
+ # Chef Automate currently returns 401 for `/compliance/version` but some
276
+ # versions of OpsWorks Chef Automate return 200 and a Chef Manage page
277
+ # when unauthenticated requests are received.
278
+ if response.body.include?('Are You Looking For the Chef Server?')
279
+ Inspec::Log.debug(
280
+ "Received 200 from #{url}#{automate_endpoint} - " \
281
+ 'assuming target is an OpsWorks Chef Automate instance',
282
+ )
283
+ true
284
+ else
285
+ Inspec::Log.debug(
286
+ "Received 200 from #{url}#{automate_endpoint} " \
287
+ 'but did not receive the Chef Manage page - ' \
288
+ 'assuming target is not a Chef Automate instance',
289
+ )
290
+ false
291
+ end
292
+ else
293
+ Inspec::Log.debug(
294
+ "Received unexpected status code #{response.code} " \
295
+ "from #{url}#{automate_endpoint} - " \
296
+ 'assuming target is not a Chef Automate instance',
297
+ )
298
+ false
299
+ end
300
+ end
301
+
302
+ def self.target_is_compliance_server?(url, insecure)
303
+ # All versions of Chef Compliance return 200 for `/api/version`
304
+ compliance_endpoint = '/api/version'
305
+
306
+ response = Compliance::HTTP.get(url + compliance_endpoint, nil, insecure)
307
+ return false unless response.code == '200'
308
+
309
+ Inspec::Log.debug(
310
+ "Received 200 from #{url}#{compliance_endpoint} - " \
311
+ 'assuming target is a Compliance server',
312
+ )
313
+ true
314
+ end
315
+ end
316
+ end