inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/windows_registry_key.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/registry_key.rb"

data/lib/inspec/resources/windows_task.rb

@@ -1,112 +0,0 @@
-require "inspec/resources/powershell"
-
-module Inspec::Resources
-  class WindowsTasks < Inspec.resource(1) # TODO: rename singular
-    name "windows_task"
-    supports platform: "windows"
-    desc "Use the windows_task InSpec audit resource to test task schedules on Microsoft Windows."
-    example <<~EXAMPLE
-      describe windows_task('\\Microsoft\\Windows\\Time Synchronization\\SynchronizeTime') do
-        it { should be_enabled }
-      end
-
-      describe windows_task('\\Microsoft\\Windows\\AppID\\PolicyConverter') do
-        it { should be_disabled }
-      end
-
-      describe windows_task('\\Microsoft\\Windows\\Defrag\\ScheduledDefrag') do
-        it { should exist }
-      end
-
-      describe windows_task('\\Microsoft\\Windows\\AppID\\PolicyConverter') do
-        its('logon_mode') { should eq 'Interactive/Background' }
-        its('last_result') { should eq '1' }
-        its('task_to_run') { should cmp '%Windir%\\system32\\appidpolicyconverter.exe' }
-        its('run_as_user') { should eq 'LOCAL SERVICE' }
-      end
-    EXAMPLE
-
-    def initialize(taskuri)
-      @taskuri = taskuri
-      @cache = nil
-    end
-
-    def exists?
-      return true unless info.nil? || info[:uri].nil?
-
-      false
-    end
-
-    # rubocop:disable Style/WordArray
-    def enabled?
-      return false if info.nil? || info[:state].nil?
-
-      ["Ready", "Running"].include?(info[:state])
-    end
-
-    def disabled?
-      return false if info.nil? || info[:state].nil?
-
-      info[:scheduled_task_state] == "Disabled" || info[:state] == "Disabled"
-    end
-
-    def logon_mode
-      info[:logon_mode]
-    end
-
-    def last_result
-      info[:last_result]
-    end
-
-    def task_to_run
-      info[:task_to_run].to_s.strip
-    end
-
-    def run_as_user
-      info[:run_as_user]
-    end
-
-    def type
-      info[:type] unless info.nil?
-    end
-
-    def info
-      return @cache unless @cache.nil?
-
-      # PowerShell v5 has Get-ScheduledTask cmdlet,
-      # _using something with backward support to v3_
-      # script = "Get-ScheduledTask | ? { $_.URI -eq '#{@taskuri}' } | Select-Object URI,@{N='State';E={$_.State.ToString()}} | ConvertTo-Json"
-
-      # Using schtasks as suggested by @modille but aligning property names to match cmdlet to future proof.
-      script = "schtasks /query /v /fo csv /tn '#{@taskuri}' | ConvertFrom-Csv | Select @{N='URI';E={$_.TaskName}},@{N='State';E={$_.Status.ToString()}},'Logon Mode','Last Result','Task To Run','Run As User','Scheduled Task State' | ConvertTo-Json -Compress"
-
-      cmd = inspec.powershell(script)
-
-      begin
-        params = JSON.parse(cmd.stdout)
-      rescue JSON::ParserError => _e
-        return nil
-      end
-
-      # If multiple triggers are defined, `schtasks` returns a list.
-      # This merges that list with the latest item taking precedence.
-      # This is the same behavior as `Get-ScheduledTask`.
-      params = params.reduce(:merge) if params.is_a?(Array)
-
-      @cache = {
-        uri: params["URI"],
-        state: params["State"],
-        logon_mode: params["Logon Mode"],
-        last_result: params["Last Result"],
-        task_to_run: params["Task To Run"],
-        run_as_user: params["Run As User"],
-        scheduled_task_state: params["Scheduled Task State"],
-        type: "windows-task",
-      }
-    end
-
-    def to_s
-      "Windows Task '#{@taskuri}'"
-    end
-  end
-end

data/lib/inspec/resources/wmi.rb

@@ -1,109 +0,0 @@
-require "inspec/resources/powershell"
-require "inspec/utils/object_traversal"
-
-module Inspec::Resources
-  # This resource simplifies the access to wmi
-  # on CLI you would use:
-  # WMIC /NAMESPACE:\\root\rsop\computer PATH RSOP_SecuritySettingNumeric WHERE "KeyName = 'MinimumPasswordAge' And precedence=1" GET Setting
-  # We use Get-WmiObject via Powershell to retrieve all values.
-  class WMI < Inspec.resource(1)
-    name "wmi"
-    supports platform: "windows"
-    desc "request wmi information"
-    example <<~EXAMPLE
-      describe wmi({
-        class: 'RSOP_SecuritySettingNumeric',
-        namespace: 'root\\rsop\\computer',
-        filter: 'KeyName = \'MinimumPasswordAge\' And precedence=1'
-      }) do
-         its('Setting') { should eq true }
-      end
-    EXAMPLE
-
-    include ObjectTraverser
-    attr_accessor :content
-
-    def initialize(wmiclass = nil, opts = nil)
-      @options = opts || {}
-      if wmiclass.is_a?(Hash)
-        @options.merge!(wmiclass)
-      else
-        Inspec.deprecate(:wmi_non_hash_usage, "Using `wmi('wmisclass')` is deprecated. Please use`wmi({class: 'wmisclass'})`")
-        @options[:class] = wmiclass
-      end
-    end
-
-    # returns nil, if not existant or value
-    def method_missing(*keys)
-      # catch behavior of rspec its implementation
-      # @see https://github.com/rspec/rspec-its/blob/master/lib/rspec/its.rb#L110
-      keys.shift if keys.is_a?(Array) && keys[0] == :[]
-
-      # map all symbols to strings
-      keys = keys.map { |x| x.to_s.downcase } if keys.is_a?(Array)
-
-      value(keys)
-    end
-
-    def value(key)
-      extract_value(key, params)
-    end
-
-    def params
-      return @content if defined?(@content)
-
-      @content = {}
-
-      # abort if no options are available
-      return @content unless defined?(@options)
-
-      # filter for supported options
-      args = @options.select { |key, _value| %i{class namespace query filter}.include?(key) }
-
-      # convert to Get-WmiObject arguments
-      params = ""
-      args.each { |key, value| params += " -#{key} \"#{value.gsub('"', '`"')}\"" }
-
-      # run wmi command and filter empty wmi
-      script = <<-EOH
-      Filter Aggregate
-      {
-          $arr = @{}
-          $_.properties | % {
-              $arr.Add($_.name, $_.value)
-          }
-          $arr
-      }
-      Get-WmiObject #{params} | Aggregate | ConvertTo-Json
-      EOH
-
-      # run wmi command
-      cmd = inspec.powershell(script)
-      @content = JSON.parse(cmd.stdout)
-
-      # make all keys case-insensitive
-      @content = lowercase_keys(@content)
-    rescue JSON::ParserError => _e
-      @content
-    end
-
-    def to_s
-      "WMI with #{@options}"
-    end
-
-    private
-
-    def lowercase_keys(content)
-      if content.is_a?(Hash)
-        content.keys.each do |key|
-          new_key = key.to_s.downcase
-          content[new_key] = content.delete(key)
-          lowercase_keys(content[new_key])
-        end
-      elsif content.respond_to?(:each)
-        content.each { |item| lowercase_keys(item) }
-      end
-      content
-    end
-  end
-end

data/lib/inspec/resources/x509_certificate.rb

@@ -1,143 +0,0 @@
-require "openssl"
-require "hashie/mash"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class X509CertificateResource < Inspec.resource(1)
-    name "x509_certificate"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Used to test x.509 certificates"
-    example <<~EXAMPLE
-      describe x509_certificate('/etc/pki/www.mywebsite.com.pem') do
-        its('subject') { should match /CN=My Website/ }
-        its('validity_in_days') { should be > 30 }
-      end
-
-      describe x509_certificate('trials/x509/cert.pem') do
-        it { should be_certificate }
-        it { should be_valid }
-        its('fingerprint') { should eq '62b137bdf427e7273dc2e487877b3033e4c8ce17' }
-        its('signature_algorithm') { should eq 'sha1WithRSAEncryption' }
-        its('validity_in_days') { should_not be < 100 }
-        its('validity_in_days') { should be >= 100 }
-        its('subject_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
-        its('subject.C') { should eq 'DE' }
-        its('subject.emailAddress') { should_not be_empty }
-        its('subject.emailAddress') { should eq 'support@chef.io' }
-        its('issuer_dn') { should eq '/C=DE/ST=Berlin/L=Berlin/O=InSpec/OU=Chef Software, Inc/CN=inspec.io/emailAddress=support@chef.io' }
-        its('key_length') { should be >= 2048 }
-        its('extensions.subjectKeyIdentifier') { should cmp 'A5:16:0B:12:F4:48:0F:06:6C:32:29:67:98:12:DF:3D:0D:75:9D:5C' }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    # @see https://tools.ietf.org/html/rfc5280#page-23
-    def initialize(filename)
-      @certpath = filename
-      @issuer = nil
-      @parsed_subject = nil
-      @parsed_issuer = nil
-      @extensions = nil
-      @cert = OpenSSL::X509::Certificate.new read_file_content(@certpath)
-    end
-
-    # Forward these methods directly to OpenSSL::X509::Certificate instance
-    %w{version not_before not_after signature_algorithm public_key}.each do |m|
-      define_method m do |*args|
-        @cert.send(m, *args)
-      end
-    end
-
-    def certificate?
-      !@cert.nil?
-    end
-
-    def fingerprint
-      return if @cert.nil?
-
-      OpenSSL::Digest::SHA1.new(@cert.to_der).to_s
-    end
-
-    def serial
-      return if @cert.nil?
-
-      @cert.serial.to_i
-    end
-
-    def subject_dn
-      return if @cert.nil?
-
-      @cert.subject.to_s
-    end
-
-    def subject
-      return if @cert.nil?
-      # Return cached subject if we have already parsed it
-      return @parsed_subject if @parsed_subject
-
-      # Use a Mash to make it easier to access hash elements in "its('subject') {should ...}"
-      @parsed_subject = Hashie::Mash.new(Hash[@cert.subject.to_a.map { |k, v, _| [k, v] }])
-    end
-
-    def issuer_dn
-      return if @cert.nil?
-
-      @cert.issuer.to_s
-    end
-
-    def issuer
-      return if @cert.nil?
-      # Return cached subject if we have already parsed it
-      return @parsed_issuer if @parsed_issuer
-
-      # Use a Mash to make it easier to access hash elements in "its('issuer') {should ...}"
-      @parsed_issuer = Hashie::Mash.new(Hash[@cert.issuer.to_a.map { |k, v, _| [k, v] }])
-    end
-
-    def key_length
-      return if @cert.nil?
-
-      @cert.public_key.n.num_bytes * 8
-    end
-
-    def validity_in_days
-      (not_after - Time.now.utc) / 86400
-    end
-
-    def valid?
-      now = Time.now
-      certificate? && (now >= not_before && now <= not_after)
-    end
-
-    def extensions
-      # Return cached Mash if we already parsed the certificate extensions
-      return @extensions if @extensions
-      # Return the exception class if we failed to instantiate a Cert from file
-      return @cert unless @cert.respond_to? :extensions
-
-      # Use a Mash to make it easier to access hash elements in "its('entensions') {should ...}"
-      @extensions = Hashie::Mash.new({})
-      # Make sure standard extensions exist so we don't get nil for nil:NilClass
-      # when the user tests for extensions which aren't present
-      %w{
-        keyUsage extendedKeyUsage basicConstraints subjectKeyIdentifier
-        authorityKeyIdentifier subjectAltName issuerAltName authorityInfoAccess
-        crlDistributionPoints issuingDistributionPoint certificatePolicies
-        policyConstraints nameConstraints noCheck tlsfeature nsComment
-      }.each { |extension| @extensions[extension] ||= [] }
-      # Now parse the extensions into the Mash
-      extension_array = @cert.extensions.map(&:to_s)
-      extension_array.each do |extension|
-        kv = extension.split(/ *= */, 2)
-        @extensions[kv.first] = kv.last.split(/ *, */)
-      end
-      @extensions
-    end
-
-    def to_s
-      "x509_certificate #{@certpath}"
-    end
-  end
-end

data/lib/inspec/resources/xinetd_conf.rb

@@ -1,103 +0,0 @@
-require "inspec/utils/parser"
-require "inspec/utils/filter"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class XinetdConf < Inspec.resource(1)
-    name "xinetd_conf"
-    supports platform: "unix"
-    desc "Xinetd services configuration."
-    example <<~EXAMPLE
-      describe xinetd_conf.services('chargen') do
-        its('socket_types') { should include 'dgram' }
-      end
-
-      describe xinetd_conf.services('chargen').socket_types('dgram') do
-        it { should be_disabled }
-      end
-    EXAMPLE
-
-    include XinetdParser
-    include FileReader
-
-    def initialize(conf_path = "/etc/xinetd.conf")
-      @conf_path = conf_path
-      @contents = {}
-      read_content(@conf_path)
-    end
-
-    def to_s
-      "Xinetd config #{@conf_path}#{@filters}"
-    end
-
-    def params
-      @params ||= read_params
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:services, field: "service")
-      .register_column(:ids,          field: "id")
-      .register_column(:socket_types, field: "socket_type")
-      .register_column(:types,        field: "type")
-      .register_column(:protocols,    field: "protocol")
-      .register_column(:wait,         field: "wait")
-      .register_custom_matcher(:disabled?) { |x| x.where("disable" => "no").services.empty? }
-      .register_custom_matcher(:enabled?) { |x| x.where("disable" => "yes").services.empty? }
-      .install_filter_methods_on_resource(self, :service_lines)
-
-    private
-
-    def read_content(path = @conf_path)
-      return @contents[path] if @contents.key?(path)
-
-      @contents[path] = read_file_content(path)
-    end
-
-    def read_params
-      return {} if read_content.nil?
-
-      flat_params = parse_xinetd(read_content)
-      # we need to map service data in order to use it with filtertable
-      params = { "services" => {} }
-      # map services that were defined and map it to the service hash
-      flat_params.each do |k, v|
-        name = k[/^service (.+)$/, 1]
-        # its not a service, no change required
-        if name.nil?
-          params[k] = v
-        # handle service entries
-        else
-          # store service
-          params["services"][name] = v
-
-          # add the service identifier to its parameters
-          if v.is_a?(Array)
-            v.each { |service| service.params["service"] = name }
-          else
-            v.params["service"] = name
-          end
-        end
-      end
-      params
-    end
-
-    # Method used to derive the default protocol used from the socket_type
-    def default_protocol(type)
-      case type
-      when "stream"
-        "tcp"
-      when "dgram"
-        "udp"
-      else
-        "unknown"
-      end
-    end
-
-    def service_lines
-      @services ||= params["services"].values.flatten.map do |service|
-        service.params["protocol"] ||= default_protocol(service.params["socket_type"])
-        service.params
-      end
-    end
-  end
-end