inspec 2.1.30 → 2.1.43

data/lib/resources/aws/aws_security_group.rb

@@ -1,22 +1,174 @@
+require 'set'
+require 'ipaddr'
+
 class AwsSecurityGroup < Inspec.resource(1)
   name 'aws_security_group'
   desc 'Verifies settings for an individual AWS Security Group.'
-  example '
-    describe aws_security_group("sg-12345678") do
-      it { should exist }
-    end
-  '
+  example "
+  describe aws_security_group('sg-12345678') do
+    it { should exist }
+  end
+  "
   supports platform: 'aws'
 
   include AwsSingularResourceMixin
-  attr_reader :description, :group_id, :group_name, :vpc_id
+  attr_reader :description, :group_id, :group_name, :vpc_id, :inbound_rules, :outbound_rules
 
   def to_s
     "EC2 Security Group #{@group_id}"
   end
 
+  def allow_in?(criteria = {})
+    allow(inbound_rules, criteria)
+  end
+  RSpec::Matchers.alias_matcher :allow_in, :be_allow_in
+
+  def allow_out?(criteria = {})
+    allow(outbound_rules, criteria)
+  end
+  RSpec::Matchers.alias_matcher :allow_out, :be_allow_out
+
+  def allow_in_only?(criteria = {})
+    allow_only(inbound_rules, criteria)
+  end
+  RSpec::Matchers.alias_matcher :allow_in_only, :be_allow_in_only
+
+  def allow_out_only?(criteria = {})
+    allow_only(outbound_rules, criteria)
+  end
+  RSpec::Matchers.alias_matcher :allow_out_only, :be_allow_out_only
+
   private
 
+  def allow_only(rules, criteria)
+    # allow_{in_out}_only require either a single-rule group, or you
+    # to select a rule using position.
+    return false unless rules.count == 1 || criteria.key?(:position)
+    criteria[:exact] = true
+    allow(rules, criteria)
+  end
+
+  def allow(rules, criteria)
+    criteria = allow__check_criteria(criteria)
+    rules = allow__focus_on_position(rules, criteria)
+
+    rules.any? do |rule|
+      matched = true
+      matched &&= allow__match_port(rule, criteria)
+      matched &&= allow__match_protocol(rule, criteria)
+      matched &&= allow__match_ipv4_range(rule, criteria)
+      matched
+    end
+  end
+
+  def allow__check_criteria(raw_criteria)
+    allowed_criteria = [
+      :from_port,
+      :ipv4_range,
+      :port,
+      :position,
+      :protocol,
+      :to_port,
+      :exact, # Internal
+    ]
+    recognized_criteria = {}
+    allowed_criteria.each do |expected_criterion|
+      if raw_criteria.key?(expected_criterion)
+        recognized_criteria[expected_criterion] = raw_criteria.delete(expected_criterion)
+      end
+    end
+
+    # Any leftovers are unwelcome
+    unless raw_criteria.empty?
+      raise ArgumentError, "Unrecognized security group rule 'allow' criteria '#{raw_criteria.keys.join(',')}'. Expected criteria: #{allowed_criteria.join(', ')}"
+    end
+
+    recognized_criteria
+  end
+
+  def allow__focus_on_position(rules, criteria)
+    return rules unless criteria.key?(:position)
+
+    idx = criteria.delete(:position)
+
+    # Normalize to a zero-based numeric index
+    case # rubocop: disable Style/EmptyCaseCondition
+    when idx.is_a?(Symbol) && idx == :first
+      idx = 0
+    when idx.is_a?(Symbol) && idx == :last
+      idx = rules.count - 1
+    when idx.is_a?(String)
+      idx = idx.to_i - 1 # We document this as 1-based, so adjust to be zero-based.
+    when idx.is_a?(Numeric)
+      idx -= 1 # We document this as 1-based, so adjust to be zero-based.
+    else
+      raise ArgumentError, "aws_security_group 'allow' 'position' criteria must be an integer or the symbols :first or :last"
+    end
+
+    unless idx < rules.count
+      raise ArgumentError, "aws_security_group 'allow' 'position' criteria #{idx+1} is out of range - there are only #{rules.count} rules for security group #{group_id}."
+    end
+
+    [rules[idx]]
+  end
+
+  def allow__match_port(rule, criteria) # rubocop: disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+    if criteria[:exact] || criteria[:from_port] || criteria[:to_port]
+      # Exact match mode
+      # :port is shorthand for a single-valued port range.
+      criteria[:to_port] = criteria[:from_port] = criteria[:port] if criteria[:port]
+      to = criteria[:to_port]
+      from = criteria[:from_port]
+      # It's a match if neither criteria was specified
+      return true if to.nil? && from.nil?
+      # Normalize to integers
+      to = to.to_i unless to.nil?
+      from = from.to_i unless from.nil?
+      # It's a match if either was specified and the other was not
+      return true if rule[:to_port] == to && from.nil?
+      return true if rule[:from_port] == from && to.nil?
+      # Finally, both must match.
+      rule[:to_port] == to && rule[:from_port] == from
+    elsif !criteria[:port]
+      # port not specified, match anything
+      true
+    else
+      # Range membership mode
+      rule_from = rule[:from_port] || 0
+      rule_to = rule[:to_port] || 65535
+      (rule_from..rule_to).cover?(criteria[:port].to_i)
+    end
+  end
+
+  def allow__match_protocol(rule, criteria)
+    return true unless criteria.key?(:protocol)
+    prot = criteria[:protocol]
+    # We provide a "fluency alias" for -1 (any).
+    prot = '-1' if prot == 'any'
+
+    rule[:ip_protocol] == prot
+  end
+
+  def allow__match_ipv4_range(rule, criteria)
+    return true unless criteria.key?(:ipv4_range)
+    query = criteria[:ipv4_range]
+    query = [query] unless query.is_a?(Array)
+    ranges = rule[:ip_ranges].map { |rng| rng[:cidr_ip] }
+    if criteria[:exact]
+      Set.new(query) == Set.new(ranges)
+    else
+      # CIDR subset mode
+      # "Each of the provided IP ranges must be a member of one of the rule's listed IP ranges"
+      query.all? do |candidate|
+        candidate = IPAddr.new(candidate)
+        ranges.any? do |range|
+          range = IPAddr.new(range)
+          range.include?(candidate)
+        end
+      end
+    end
+  end
+
   def validate_params(raw_params)
     recognized_params = check_resource_param_names(
       raw_params: raw_params,
@@ -44,7 +196,7 @@ class AwsSecurityGroup < Inspec.resource(1)
     validated_params
   end
 
-  def fetch_from_api
+  def fetch_from_api # rubocop: disable Metrics/AbcSize
     backend = BackendFactory.create(inspec_runner)
 
     # Transform into filter format expected by AWS
@@ -70,6 +222,8 @@ class AwsSecurityGroup < Inspec.resource(1)
 
     if dsg_response.security_groups.empty?
       @exists = false
+      @inbound_rules = []
+      @outbound_rules = []
       return
     end
 
@@ -78,6 +232,8 @@ class AwsSecurityGroup < Inspec.resource(1)
     @group_id   = dsg_response.security_groups[0].group_id
     @group_name = dsg_response.security_groups[0].group_name
     @vpc_id     = dsg_response.security_groups[0].vpc_id
+    @inbound_rules = dsg_response.security_groups[0].ip_permissions.map(&:to_h)
+    @outbound_rules = dsg_response.security_groups[0].ip_permissions_egress.map(&:to_h)
   end
 
   class Backend

data/lib/resources/aws/aws_vpc.rb

@@ -15,11 +15,8 @@ class AwsVpc < Inspec.resource(1)
     "VPC #{vpc_id}"
   end
 
-  [:cidr_block, :dhcp_options_id, :state, :vpc_id, :instance_tenancy, :is_default].each do |property|
-    define_method(property) do
-      @vpc[property]
-    end
-  end
+  attr_reader :cidr_block, :dhcp_options_id, :instance_tenancy, :is_default,\
+              :state, :vpc_id
 
   alias default? is_default
 
@@ -51,9 +48,16 @@ class AwsVpc < Inspec.resource(1)
 
     resp = backend.describe_vpcs({ filters: [filter] })
 
-    @vpc = resp.vpcs[0].to_h
-    @vpc_id = @vpc[:vpc_id]
-    @exists = !@vpc.empty?
+    vpc = resp.vpcs[0].to_h
+    @exists = !vpc.empty?
+    return unless @exists
+
+    @cidr_block = vpc[:cidr_block]
+    @dhcp_options_id = vpc[:dhcp_options_id]
+    @instance_tenancy = vpc[:instance_tenancy]
+    @is_default = vpc[:is_default]
+    @state = vpc[:state]
+    @vpc_id = vpc[:vpc_id]
   end
 
   class Backend

data/lib/resources/aws/aws_vpcs.rb

@@ -13,7 +13,13 @@ class AwsVpcs < Inspec.resource(1)
   # Underlying FilterTable implementation.
   filter = FilterTable.create
   filter.add_accessor(:entries)
+        .add_accessor(:where)
         .add(:exists?) { |x| !x.entries.empty? }
+        .add(:cidr_blocks, field: :cidr_block)
+        .add(:vpc_ids, field: :vpc_id)
+  # We need a dummy here, so FilterTable will define and populate the dhcp_options_id field
+  filter.add(:dummy, field: :dhcp_options_id)
+        .add(:dhcp_options_ids) { |obj| obj.entries.map(&:dhcp_options_id).uniq }
   filter.connect(self, :table)
 
   def validate_params(raw_params)
@@ -29,7 +35,8 @@ class AwsVpcs < Inspec.resource(1)
   end
 
   def fetch_from_api
-    @table = BackendFactory.create(inspec_runner).describe_vpcs.to_h[:vpcs]
+    describe_vpcs_response = BackendFactory.create(inspec_runner).describe_vpcs
+    @table = describe_vpcs_response.to_h[:vpcs].map(&:to_h)
   end
 
   class Backend

data/lib/resources/key_rsa.rb

@@ -3,6 +3,7 @@
 require 'openssl'
 require 'hashie/mash'
 require 'utils/file_reader'
+require 'utils/pkey_reader'
 
 module Inspec::Resources
   class RsaKey < Inspec.resource(1)
@@ -22,11 +23,12 @@ module Inspec::Resources
     "
 
     include FileReader
+    include PkeyReader
 
     def initialize(keypath, passphrase = nil)
       @key_path = keypath
       @passphrase = passphrase
-      @key = OpenSSL::PKey.read(read_file_content(@key_path, allow_empty: true), @passphrase)
+      @key = read_pkey(read_file_content(@key_path, allow_empty: true), @passphrase)
     end
 
     def public?