inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/grub_conf.rb

@@ -1,230 +0,0 @@
-require "inspec/utils/simpleconfig"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class GrubConfig < Inspec.resource(1)
-    name "grub_conf"
-    supports platform: "unix"
-    desc "Use the grub_conf InSpec audit resource to test the boot config of Linux systems that use Grub."
-    example <<~EXAMPLE
-      describe grub_conf('/etc/grub.conf',  'default') do
-        its('kernel') { should include '/vmlinuz-2.6.32-573.7.1.el6.x86_64' }
-        its('initrd') { should include '/initramfs-2.6.32-573.el6.x86_64.img=1' }
-        its('default') { should_not eq '1' }
-        its('timeout') { should eq '5' }
-      end
-
-      also check specific kernels
-      describe grub_conf('/etc/grub.conf',  'CentOS (2.6.32-573.12.1.el6.x86_64)') do
-        its('kernel') { should include 'audit=1' }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    class UnknownGrubConfig < StandardError; end
-
-    def initialize(path = nil, kernel = nil)
-      config_for_platform(path)
-      @content = read_file(@conf_path)
-      @kernel = kernel || "default"
-    rescue UnknownGrubConfig
-      skip_resource "The `grub_config` resource is not supported on your OS yet."
-    end
-
-    def config_for_platform(path)
-      os = inspec.os
-      if os.redhat? || os[:name] == "fedora"
-        config_for_redhatish(path)
-      elsif os.debian?
-        @conf_path = path || "/boot/grub/grub.cfg"
-        @defaults_path = "/etc/default/grub"
-        @grubenv_path = "/boot/grub2/grubenv"
-        @version = "grub2"
-      elsif os[:name] == "amazon"
-        @conf_path = path || "/etc/grub.conf"
-        @version = "legacy"
-      else
-        raise UnknownGrubConfig
-      end
-    end
-
-    def config_for_redhatish(path)
-      if inspec.os[:release].to_f < 7
-        @conf_path = path || "/etc/grub.conf"
-        @version = "legacy"
-      else
-        @conf_path = path || "/boot/grub2/grub.cfg"
-        @defaults_path = "/etc/default/grub"
-        @grubenv_path = "/boot/grub2/grubenv"
-        @version = "grub2"
-      end
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def to_s
-      "Grub Config"
-    end
-
-    private
-
-    ######################################################################
-    # Grub2 This is used by all supported versions of Ubuntu and Rhel 7+ #
-    ######################################################################
-
-    def grub2_parse_kernel_lines(content, conf)
-      menu_entries = extract_menu_entries(content)
-
-      if @kernel == "default"
-        default_menu_entry(menu_entries, conf["GRUB_DEFAULT"])
-      else
-        menu_entries.find { |entry| entry["name"] == @kernel }
-      end
-    end
-
-    def extract_menu_entries(content)
-      menu_entries = []
-
-      lines = content.split("\n")
-      lines.each_with_index do |line, index|
-        next unless line =~ /^menuentry\s+.*/
-
-        entry = {}
-        entry["insmod"] = []
-
-        # Extract name from menuentry line
-        capture_data = line.match(/(?:^|\s+).*menuentry\s*['|"](.*)['|"]\s*--/)
-        if capture_data.nil? || capture_data.captures[0].nil?
-          raise Inspec::Exceptions::ResourceFailed "Failed to extract menuentry name from #{line}"
-        end
-
-        entry["name"] = capture_data.captures[0]
-
-        # Begin processing from index forward until a `}` line is met
-        lines.drop(index + 1).each do |mline|
-          break if mline =~ /^\s*}\s*$/
-
-          case mline
-          when /(?:^|\s*)initrd.*/
-            entry["initrd"] = mline.split(" ")[1]
-          when /(?:^|\s*)linux.*/
-            entry["kernel"] = mline.split
-          when /(?:^|\s*)set root=.*/
-            entry["root"] = mline.split("=")[1].tr("'", "")
-          when /(?:^|\s*)insmod.*/
-            entry["insmod"] << mline.split(" ")[1]
-          end
-        end
-
-        menu_entries << entry
-      end
-
-      menu_entries
-    end
-
-    def default_menu_entry(menu_entries, default)
-      # If the default entry isn't `saved` then a number is used as an index.
-      # By default this is `0`, which would be the first item in the list.
-      return menu_entries[default.to_i] unless default == "saved"
-
-      grubenv_contents = inspec.file(@grubenv_path).content
-
-      # The location of the grubenv file is not guaranteed. In the case that
-      # the file does not exist this will return the 0th entry. This will also
-      # return the 0th entry if InSpec lacks permission to read the file. Both
-      # of these reflect the default Grub2 behavior.
-      return menu_entries[0] if grubenv_contents.nil?
-
-      default_name = SimpleConfig.new(grubenv_contents).params["saved_entry"]
-      default_entry = menu_entries.select { |k| k["name"] == default_name }[0]
-      return default_entry unless default_entry.nil?
-
-      # It is possible for the saved entry to not be valid . For example, grubenv
-      # not being up to date. If so, the 0th entry is the default.
-      menu_entries[0]
-    end
-
-    ###################################################################
-    # Grub1 aka legacy-grub config. Primarily used by Centos/Rhel 6.x #
-    ###################################################################
-
-    def parse_kernel_lines(content, conf)
-      # Find all "title" lines and then parse them into arrays
-      menu_entry = 0
-      lines = content.split("\n")
-      kernel_opts = {}
-      lines.each_with_index do |file_line, index|
-        next unless file_line =~ /^title.*/
-
-        current_kernel = file_line.split(" ", 2)[1]
-        lines.drop(index + 1).each do |kernel_line|
-          if kernel_line =~ /^\s.*/
-            option_type = kernel_line.split(" ")[0]
-            line_options = kernel_line.split(" ").drop(1)
-            if (menu_entry == conf["default"].to_i && @kernel == "default") || current_kernel == @kernel
-              if option_type == "kernel"
-                kernel_opts["kernel"] = line_options
-              else
-                kernel_opts[option_type] = line_options[0]
-              end
-            end
-          else
-            menu_entry += 1
-            break
-          end
-        end
-      end
-      kernel_opts
-    end
-
-    def read_file(config_file)
-      read_file_content(config_file)
-    end
-
-    def read_params
-      return @params if defined?(@params)
-
-      content = read_file(@conf_path)
-
-      if @version == "legacy"
-        # parse the file
-        conf = SimpleConfig.new(
-          content,
-          multiple_values: true
-        ).params
-        # convert single entry arrays into strings
-        conf.each do |key, value|
-          if value.size == 1
-            conf[key] = conf[key][0].to_s
-          end
-        end
-        kernel_opts = parse_kernel_lines(content, conf)
-        @params = conf.merge(kernel_opts)
-      end
-
-      if @version == "grub2"
-        # read defaults
-        defaults = read_file(@defaults_path)
-
-        conf = SimpleConfig.new(
-          defaults,
-          multiple_values: true
-        ).params
-
-        # convert single entry arrays into strings
-        conf.each do |key, value|
-          if value.size == 1
-            conf[key] = conf[key][0].to_s
-          end
-        end
-
-        kernel_opts = grub2_parse_kernel_lines(content, conf)
-        @params = conf.merge(kernel_opts)
-      end
-      @params
-    end
-  end
-end

data/lib/inspec/resources/host.rb

@@ -1,310 +0,0 @@
-require "inspec/resources/command"
-
-# Usage:
-# describe host('example.com') do
-#   it { should be_resolvable }
-#   it { should be_reachable }
-#   its('ipaddress') { should include '93.184.216.34' }
-# end
-#
-# To verify a hostname with protocol and port
-# describe host('example.com', port: 443, protocol: 'tcp') do
-#   it { should be_reachable }
-# end
-#
-# We do not support the following serverspec syntax:
-# describe host('example.com') do
-#   it { should be_reachable.with( :port => 22 ) }
-#   it { should be_reachable.with( :port => 22, :proto => 'tcp' ) }
-#   it { should be_reachable.with( :port => 53, :proto => 'udp' ) }
-#
-#   it { should be_resolvable.by('hosts') }
-#   it { should be_resolvable.by('dns') }
-# end
-
-require "resolv"
-
-module Inspec::Resources
-  class Host < Inspec.resource(1)
-    name "host"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the host InSpec audit resource to test the name used to refer to a specific host and its availability, including the Internet protocols and ports over which that host name should be available."
-    example <<~EXAMPLE
-      describe host('example.com') do
-        it { should be_reachable }
-        it { should be_resolvable }
-        its('ipaddress') { should include '12.34.56.78' }
-      end
-
-      describe host('example.com', port: '80', protocol: 'tcp') do
-        it { should be_reachable }
-      end
-    EXAMPLE
-
-    attr_reader :hostname, :port, :protocol
-
-    def initialize(hostname, params = {})
-      @hostname = hostname
-      @port = params[:port]
-
-      if params[:proto]
-        Inspec.deprecate(:host_resource_proto_usage, "The `host` resource `proto` resource parameter is deprecated. Please use `protocol`.")
-        @protocol = params[:proto]
-      else
-        @protocol = params.fetch(:protocol, "icmp")
-      end
-
-      @host_provider = nil
-      if inspec.os.linux?
-        @host_provider = LinuxHostProvider.new(inspec)
-      elsif inspec.os.windows?
-        return skip_resource "Invalid protocol: only `tcp` and `icmp` protocols are support for the `host` resource on your OS." unless
-          %w{icmp tcp}.include?(@protocol)
-
-        @host_provider = WindowsHostProvider.new(inspec)
-      elsif inspec.os.darwin?
-        @host_provider = DarwinHostProvider.new(inspec)
-      else
-        return skip_resource "The `host` resource is not supported on your OS yet."
-      end
-
-      missing_requirements = @host_provider.missing_requirements(protocol)
-      unless missing_requirements.empty?
-        return skip_resource "The following requirements are not met for this resource: " \
-          "#{missing_requirements.join(", ")}"
-      end
-    end
-
-    def proto
-      Inspec.deprecate(:host_resource_proto_usage, "The host resource `proto` method is deprecated. Please use `protocol`.")
-      protocol
-    end
-
-    # if we get the IP address, the host is resolvable
-    def resolvable?(type = nil)
-      warn "The `host` resource ignores #{type} parameters. Continue to resolve host." unless type.nil?
-      resolve.nil? || resolve.empty? ? false : true
-    end
-
-    def reachable?
-      # ping checks do not require port or protocol
-      return ping.fetch(:success, false) if protocol == "icmp"
-
-      # if either port or protocol are specified but not both, we cannot proceed.
-      if port.nil? || protocol.nil?
-        raise "Protocol required with port. Use `host` resource with host('#{hostname}', port: 1234, proto: 'tcp') parameters." if port.nil? || protocol.nil?
-      end
-
-      # perform the protocol-specific reachability test
-      ping.fetch(:success, false)
-    end
-
-    def connection
-      ping[:connection]
-    end
-
-    def socket
-      ping[:socket]
-    end
-
-    # returns all A records of the IP address, will return an array
-    def ipaddress
-      resolve.nil? || resolve.empty? ? nil : resolve
-    end
-
-    def to_s
-      resource_name = "Host #{hostname}"
-      resource_name += " port #{port} proto #{protocol}" if port
-
-      resource_name
-    end
-
-    private
-
-    def ping
-      return @ping_cache if defined?(@ping_cache)
-      return {} if @host_provider.nil?
-
-      @ping_cache = @host_provider.ping(hostname, port, protocol)
-    end
-
-    def resolve
-      return @ip_cache if defined?(@ip_cache)
-
-      @ip_cache = @host_provider.resolve(hostname) unless @host_provider.nil?
-    end
-  end
-
-  class HostProvider
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-
-    def missing_requirements(_protocol)
-      # each provider can return an array of missing requirements that can
-      # be enumerated in a skip_resource message
-      []
-    end
-  end
-
-  class UnixHostProvider < HostProvider
-    def initialize(inspec)
-      super
-
-      @has_nc = inspec.command("nc").exist?
-      @has_ncat = inspec.command("ncat").exist?
-      @has_net_redirections = inspec.command("strings `which bash` | grep -qE '/dev/(tcp|udp)/'").exit_status == 0
-    end
-
-    def missing_requirements(protocol)
-      missing = []
-
-      if %w{tcp udp}.include?(protocol) && !@has_nc && !@has_ncat
-        if @has_net_redirections
-          missing << "#{timeout} (part of coreutils) or netcat must be installed" unless inspec.command(timeout).exist?
-        else
-          missing << "netcat must be installed"
-        end
-      end
-
-      missing
-    end
-
-    def ping(hostname, port, protocol)
-      if %w{tcp udp}.include?(protocol)
-        if @has_nc || @has_ncat
-          resp = inspec.command(netcat_check_command(hostname, port, protocol))
-        else
-          resp = inspec.command("#{timeout} 1 bash -c \"< /dev/#{protocol}/#{hostname}/#{port}\"")
-        end
-      else
-        # fall back to ping, but we can only test ICMP packages with ping
-        resp = inspec.command("ping -w 1 -c 1 #{hostname}")
-      end
-
-      {
-        success: resp.exit_status.to_i == 0,
-        connection: resp.stderr,
-        socket: resp.stdout,
-      }
-    end
-
-    def netcat_check_command(hostname, port, protocol)
-      if @has_nc
-        base_cmd = "nc"
-      elsif @has_ncat
-        base_cmd = "ncat"
-      else
-        return
-      end
-
-      if protocol == "udp"
-        extra_flags = "-u"
-      else
-        extra_flags = ""
-      end
-
-      "echo | #{base_cmd} -v -w 1 #{extra_flags} #{hostname} #{port}"
-    end
-
-    def timeout
-      "timeout"
-    end
-
-    def resolve_with_dig(hostname)
-      addresses = []
-
-      # look for IPv4 addresses
-      cmd = inspec.command("dig +short A #{hostname}")
-      cmd.stdout.lines.each do |line|
-        matched = line.chomp.match(Resolv::IPv4::Regex)
-        addresses << matched.to_s unless matched.nil?
-      end
-
-      # look for IPv6 addresses
-      cmd = inspec.command("dig +short AAAA #{hostname}")
-      cmd.stdout.lines.each do |line|
-        matched = line.chomp.match(Resolv::IPv6::Regex)
-        addresses << matched.to_s unless matched.nil?
-      end
-
-      addresses.empty? ? nil : addresses
-    end
-
-    def resolve_with_getent(hostname)
-      cmd = inspec.command("getent ahosts #{hostname}")
-      return nil unless cmd.exit_status.to_i == 0
-
-      # getent ahosts output is formatted like so:
-      # $ getent ahosts www.google.com
-      # 172.217.8.4     STREAM www.google.com
-      # 172.217.8.4     DGRAM
-      # 172.217.8.4     RAW
-      # 2607:f8b0:4004:803::2004 STREAM
-      # 2607:f8b0:4004:803::2004 DGRAM
-      # 2607:f8b0:4004:803::2004 RAW
-      addresses = []
-      cmd.stdout.lines.each do |line|
-        ip, = line.split(/\s+/, 2)
-        next unless ip.match(Resolv::IPv4::Regex) || ip.match(Resolv::IPv6::Regex)
-
-        addresses << ip unless addresses.include?(ip)
-      end
-
-      addresses
-    end
-  end
-
-  class DarwinHostProvider < UnixHostProvider
-    def timeout
-      "gtimeout"
-    end
-
-    def resolve(hostname)
-      resolve_with_dig(hostname)
-    end
-  end
-
-  class LinuxHostProvider < UnixHostProvider
-    def resolve(hostname)
-      resolve_with_getent(hostname)
-    end
-  end
-
-  # Windows
-  # TODO: UDP is not supported yey, we need a custom ps1 script to add udp support
-  # @see http://blogs.technet.com/b/josebda/archive/2015/04/18/windows-powershell-equivalents-for-common-networking-commands-ipconfig-ping-nslookup.aspx
-  # @see http://blogs.technet.com/b/heyscriptingguy/archive/2014/03/19/creating-a-port-scanner-with-windows-powershell.aspx
-  class WindowsHostProvider < HostProvider
-    def ping(hostname, port = nil, _proto = nil)
-      # ICMP: Test-NetConnection www.microsoft.com
-      # TCP and port: Test-NetConnection -ComputerName www.microsoft.com -RemotePort 80
-      request = "Test-NetConnection -ComputerName #{hostname} -WarningAction SilentlyContinue"
-      request += " -RemotePort #{port}" unless port.nil?
-      request += "| Select-Object -Property ComputerName, TcpTestSucceeded, PingSucceeded | ConvertTo-Json"
-      cmd = inspec.command(request)
-
-      begin
-        ping = JSON.parse(cmd.stdout)
-      rescue JSON::ParserError => _e
-        return {}
-      end
-
-      { success: port.nil? ? ping["PingSucceeded"] : ping["TcpTestSucceeded"] }
-    end
-
-    def resolve(hostname)
-      cmd = inspec.command("Resolve-DnsName –Type A #{hostname} | ConvertTo-Json")
-      begin
-        resolv = JSON.parse(cmd.stdout)
-      rescue JSON::ParserError => _e
-        return nil
-      end
-
-      resolv = [resolv] unless resolv.is_a?(Array)
-      resolv.map { |entry| entry["IPAddress"] }
-    end
-  end
-end