inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/docker_image.rb

@@ -1,84 +0,0 @@
-#
-# Copyright 2017, Christoph Hartmann
-
-require "inspec/resources/docker"
-require_relative "docker_object"
-
-module Inspec::Resources
-  class DockerImage < Inspec.resource(1)
-    include Inspec::Resources::DockerObject
-
-    name "docker_image"
-    supports platform: "unix"
-    desc ""
-    example <<~EXAMPLE
-      describe docker_image('alpine:latest') do
-        it { should exist }
-        its('id') { should_not eq '' }
-        its('image') { should eq 'alpine:latest' }
-        its('repo') { should eq 'alpine' }
-        its('tag') { should eq 'latest' }
-      end
-
-      describe docker_image('alpine:latest') do
-        it { should exist }
-      end
-
-      describe docker_image(id: '4a415e366388') do
-        it { should exist }
-      end
-    EXAMPLE
-
-    def initialize(opts = {})
-      # do sanitizion of input values
-      o = opts.dup
-      o = { image: opts } if opts.is_a?(String)
-      @opts = sanitize_options(o)
-    end
-
-    def image
-      "#{repo}:#{tag}" if object_info.entries.size == 1
-    end
-
-    def repo
-      object_info.repositories[0] if object_info.entries.size == 1
-    end
-
-    def tag
-      object_info.tags[0] if object_info.entries.size == 1
-    end
-
-    def to_s
-      img = @opts[:image] || @opts[:id]
-      "Docker Image #{img}"
-    end
-
-    private
-
-    def sanitize_options(opts)
-      opts.merge!(parse_components_from_image(opts[:image]))
-
-      # assume a "latest" tag if we don't have one
-      opts[:tag] ||= "latest"
-
-      # if the ID isn't nil and doesn't contain a hash indicator (indicated by the presence
-      # of a colon, which separates the indicator from the actual hash), we assume it's sha256.
-      opts[:id] = "sha256:" + opts[:id] unless opts[:id].nil? || opts[:id].include?(":")
-
-      # Assemble/reassemble the image from the repo and tag
-      opts[:image] = "#{opts[:repo]}:#{opts[:tag]}" unless opts[:repo].nil?
-
-      # return the santized opts back to the caller
-      opts
-    end
-
-    def object_info
-      return @info if defined?(@info)
-
-      opts = @opts
-      @info = inspec.docker.images.where do
-        (repository == opts[:repo] && tag == opts[:tag]) || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id])))
-      end
-    end
-  end
-end

data/lib/inspec/resources/docker_object.rb

@@ -1,52 +0,0 @@
-#
-# Copyright 2017, Christoph Hartmann
-#
-
-module Inspec::Resources::DockerObject
-  def exist?
-    object_info.exists?
-  end
-
-  def id
-    object_info.ids[0] if object_info.entries.size == 1
-  end
-
-  private
-
-  def parse_components_from_image(image_string)
-    # if the user did not supply an image string, they likely supplied individual
-    # option parameters, such as repo and tag. Return empty data back to the caller.
-    return {} if image_string.nil?
-
-    first_colon = image_string.index(":") || -1
-    first_slash = image_string.index("/") || -1
-
-    if image_string.count(":") == 2
-      # If there are two colons in the image string, it contains a repo-with-port and a tag.
-      # example: localhost:5000/chef/inspec:1.46.3
-      partitioned_string = image_string.rpartition(":")
-      repo = partitioned_string.first
-      tag = partitioned_string.last
-      image_name = repo.split("/")[1..-1].join
-    elsif image_string.count(":") == 1 && first_colon < first_slash
-      # If there's one colon in the image string, and it comes before a forward-slash,
-      # it contains a repo-with-port but no tag.
-      # example: localhost:5000/ubuntu
-      repo = image_string
-      tag = nil
-      image_name = repo.split("/")[1..-1].join
-    else
-      # If there's one colon in the image string and it doesn't preceed a slash, or if
-      # there is no colon at all, then it separates the repo from the tag, if there is a tag.
-      # example: chef/inspec:1.46.3
-      # example: chef/inspec
-      # example: ubuntu:14.04
-      repo, tag = image_string.split(":")
-      image_name = repo
-    end
-
-    # return the repo, image_name and tag parsed from the string, which can be merged into
-    # the rest of the user-supplied options
-    { repo: repo, image_name: image_name, tag: tag }
-  end
-end

data/lib/inspec/resources/docker_plugin.rb

@@ -1,64 +0,0 @@
-require "inspec/resources/docker"
-
-module Inspec::Resources
-  class DockerPlugin < Inspec.resource(1)
-    name "docker_plugin"
-    supports platform: "unix"
-    desc "Retrieves info about docker plugins"
-    example <<~EXAMPLE
-      describe docker_plugin('rexray/ebs') do
-        it { should exist }
-        its('id') { should_not eq '0ac30b93ad40' }
-        its('version') { should eq '0.11.1' }
-        it { should be_enabled }
-      end
-
-      describe docker_plugin('alpine:latest') do
-        it { should exist }
-      end
-
-      describe docker_plugin(id: '4a415e366388') do
-        it { should exist }
-      end
-    EXAMPLE
-
-    def initialize(opts = {})
-      # do sanitizion of input values
-      o = opts.dup
-      o = { name: opts } if opts.is_a?(String)
-      @opts = o
-    end
-
-    def exist?
-      object_info.entries.size == 1
-    end
-
-    def enabled?
-      object_info.enabled[0]
-    end
-
-    def id
-      object_info.ids[0] if object_info.entries.size == 1
-    end
-
-    def version
-      object_info.versions[0] if object_info.entries.size == 1
-    end
-
-    def to_s
-      plugin = @opts[:name] || @opts[:id]
-      "Docker plugin #{plugin}"
-    end
-
-    private
-
-    def object_info
-      return @info if defined?(@info)
-
-      opts = @opts
-      @info = inspec.docker.plugins.where do
-        (name == opts[:name]) || (!id.nil? && !opts[:id].nil? && (id == opts[:id]))
-      end
-    end
-  end
-end

data/lib/inspec/resources/docker_service.rb

@@ -1,91 +0,0 @@
-#
-# Copyright 2017, Christoph Hartmann
-
-require "inspec/resources/docker"
-require_relative "docker_object"
-
-module Inspec::Resources
-  class DockerService < Inspec.resource(1)
-    include Inspec::Resources::DockerObject
-
-    name "docker_service"
-    supports platform: "unix"
-    desc "Swarm-mode service"
-    example <<~EXAMPLE
-      describe docker_service('service1') do
-        it { should exist }
-        its('id') { should_not eq '' }
-        its('image') { should eq 'alpine:latest' }
-        its('repo') { should eq 'alpine' }
-        its('tag') { should eq 'latest' }
-      end
-
-      describe docker_service(id: '4a415e366388') do
-        it { should exist }
-      end
-
-      describe docker_service(image: 'alpine:latest') do
-        it { should exist }
-      end
-    EXAMPLE
-
-    def initialize(opts = {})
-      # do sanitizion of input values
-      o = opts.dup
-      o = { name: opts } if opts.is_a?(String)
-      @opts = sanitize_options(o)
-    end
-
-    def name
-      object_info.names[0] if object_info.entries.size == 1
-    end
-
-    def image
-      object_info.images[0] if object_info.entries.size == 1
-    end
-
-    def image_name
-      parse_components_from_image(image)[:image_name] if object_info.entries.size == 1
-    end
-
-    def repo
-      parse_components_from_image(image)[:repo] if object_info.entries.size == 1
-    end
-
-    def tag
-      parse_components_from_image(image)[:tag] if object_info.entries.size == 1
-    end
-
-    def mode
-      object_info.modes[0] if object_info.entries.size == 1
-    end
-
-    def replicas
-      object_info.replicas[0] if object_info.entries.size == 1
-    end
-
-    def ports
-      object_info.ports[0] if object_info.entries.size == 1
-    end
-
-    def to_s
-      service = @opts[:name] || @opts[:id]
-      "Docker Service #{service}"
-    end
-
-    private
-
-    def sanitize_options(opts)
-      opts.merge(parse_components_from_image(opts[:image]))
-    end
-
-    def object_info
-      return @info if defined?(@info)
-
-      opts = @opts
-      @info = inspec.docker.services.where do
-        name == opts[:name] || image == opts[:image] || (!id.nil? && !opts[:id].nil? && (id == opts[:id] || id.start_with?(opts[:id])))
-      end
-    end
-  end
-end

data/lib/inspec/resources/elasticsearch.rb

@@ -1,165 +0,0 @@
-require "inspec/utils/filter"
-require "hashie/mash"
-require "inspec/resources/package"
-
-module Inspec::Resources
-  class Elasticsearch < Inspec.resource(1)
-    name "elasticsearch"
-    supports platform: "unix"
-    desc "Use the Elasticsearch InSpec audit resource to test the status of nodes in
-      an Elasticsearch cluster."
-
-    example <<~EXAMPLE
-      describe elasticsearch('http://eshost.mycompany.biz:9200/', username: 'elastic', password: 'changeme', ssl_verify: false) do
-        its('node_count') { should >= 3 }
-      end
-
-      describe elasticsearch do
-        its('node_name') { should include 'node1' }
-        its('os') { should_not include 'MacOS' }
-        its('version') { should cmp > 1.2.0 }
-      end
-    EXAMPLE
-
-    filter = FilterTable.create
-    filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
-    filter.register_column(:cluster_name,          field: "cluster_name")
-      .register_column(:node_name,             field: "name")
-      .register_column(:transport_address,     field: "transport_address")
-      .register_column(:host,                  field: "host")
-      .register_column(:ip,                    field: "ip")
-      .register_column(:version,               field: "version")
-      .register_column(:build_hash,            field: "build_hash")
-      .register_column(:total_indexing_buffer, field: "total_indexing_buffer")
-      .register_column(:roles,                 field: "roles")
-      .register_column(:settings,              field: "settings")
-      .register_column(:os,                    field: "os")
-      .register_column(:process,               field: "process")
-      .register_column(:jvm,                   field: "jvm")
-      .register_column(:transport,             field: "transport")
-      .register_column(:http,                  field: "http")
-      .register_column(:plugins,               field: "plugins")
-      .register_column(:plugin_list,           field: "plugin_list")
-      .register_column(:modules,               field: "modules")
-      .register_column(:module_list,           field: "module_list")
-      .register_column(:node_id,               field: "node_id")
-      .register_column(:ingest,                field: "ingest")
-      .register_custom_property(:node_count) do |t, _|
-        t.entries.length
-      end
-
-    filter.install_filter_methods_on_resource(self, :nodes)
-
-    attr_reader :nodes, :url
-
-    def initialize(opts = {})
-      return skip_resource "Package `curl` not avaiable on the host" unless inspec.command("curl").exist?
-
-      @url = opts.fetch(:url, "http://localhost:9200")
-
-      username   = opts.fetch(:username, nil)
-      password   = opts.fetch(:password, nil)
-      ssl_verify = opts.fetch(:ssl_verify, true)
-
-      cmd = inspec.command(curl_command_string(username, password, ssl_verify))
-
-      # after implementation of PR #2235, this begin..rescue won't be necessary.
-      # The checks in verify_curl_success! can raise their own skip message exception.
-      begin
-        verify_curl_success!(cmd)
-      rescue => e
-        return skip_resource e.message
-      end
-
-      begin
-        content = JSON.parse(cmd.stdout)
-        # after implementation of PR #2235, this can be broken out of the begin..rescue
-        # clause. The checks in verify_json_payload! can raise their own skip message exception.
-        verify_json_payload!(content)
-      rescue JSON::ParserError => e
-        return skip_resource "Couldn't parse the Elasticsearch response: #{e.message}"
-      rescue => e
-        return skip_resource e.message
-      end
-
-      @nodes = parse_cluster(content)
-    end
-
-    def to_s
-      "Elasticsearch Cluster #{url}"
-    end
-
-    private
-
-    def parse_cluster(content)
-      return [] unless content["nodes"]
-
-      nodes = []
-
-      content["nodes"].each do |node_id, node_data|
-        node_data = fix_mash_key_collision(node_data)
-
-        node = Hashie::Mash.new(node_data)
-        node.node_id = node_id
-        node.plugin_list = node.plugins.map(&:name)
-        node.module_list = node.modules.map(&:name)
-        node.cluster_name = node.settings.cluster.name
-        nodes << node
-      end
-
-      nodes
-    end
-
-    #
-    # Hashie::Mash will throw warnings if the Mash contains a key that is the same as a built-in
-    # method on a Hashie::Mash instance. This is a crude way of avoiding those warnings without
-    # hard-coding a bunch of key renames.
-    #
-    # Any key that is in conflict will be renamed "es_ORIGINALKEY"
-    #
-    def fix_mash_key_collision(data)
-      test_mash = Hashie::Mash.new
-
-      new_data = {}
-      data.each do |key, value|
-        new_key = test_mash.respond_to?(key.to_sym) ? "es_#{key}" : key
-        new_value = value.is_a?(Hash) ? fix_mash_key_collision(value) : value
-
-        new_data[new_key] = new_value
-      end
-
-      new_data
-    end
-
-    def curl_command_string(username, password, ssl_verify)
-      cmd_string = ["curl"]
-      cmd_string << "-k" unless ssl_verify
-      cmd_string << "-H 'Content-Type: application/json'"
-      cmd_string << " -u #{username}:#{password}" unless username.nil? || password.nil?
-      cmd_string << URI.join(url, "_nodes")
-
-      cmd_string.join(" ")
-    end
-
-    def verify_curl_success!(cmd)
-      # the following lines captures known possible curl command errors and provides compact skip resource messeges
-      if cmd.stderr =~ /Failed to connect/
-        raise "Connection refused - please check the URL #{url} for accuracy"
-      end
-
-      if cmd.stderr =~ /Peer's Certificate issuer is not recognized/
-        raise "Connection refused - peer certificate issuer is not recognized"
-      end
-
-      raise "Error fetching Elastcsearch data from curl #{url}: #{cmd.stderr}" unless cmd.exit_status == 0
-    end
-
-    def verify_json_payload!(content)
-      unless content["error"].nil?
-        raise "#{content["error"]["type"]}: #{content["error"]["reason"]}"
-      end
-
-      raise "No successful nodes available in cluster" if content["_nodes"]["successful"] == 0
-    end
-  end
-end