inspec/lib/resources/etc_hosts_allow_deny.rb

# encoding: utf-8

require 'utils/parser'
require 'utils/file_reader'

module Inspec::Resources
  class EtcHostsAllow < Inspec.resource(1)
    name 'etc_hosts_allow'
    supports platform: 'unix'
    desc 'Use the etc_hosts_allow InSpec audit resource to test the connections
          the client will allow. Controlled by the /etc/hosts.allow file.'
    example <<~EXAMPLE
      describe etc_hosts_allow.where { daemon == 'ALL' } do
        its('client_list') { should include ['127.0.0.1', '[::1]'] }
        its('options') { should eq [[]] }
      end
    EXAMPLE

    attr_reader :params

    include CommentParser
    include FileReader

    def initialize(hosts_allow_path = nil)
      @conf_path      = hosts_allow_path || '/etc/hosts.allow'
      @content        = nil
      @params         = nil
      read_content
    end

    filter = FilterTable.create
    filter.register_column(:daemon,      field: 'daemon')
          .register_column(:client_list, field: 'client_list')
          .register_column(:options,     field: 'options')

    filter.install_filter_methods_on_resource(self, :params)

    private

    def read_content
      @content = ''
      @params  = {}
      @content = split_daemons(read_file(@conf_path))
      @params  = parse_conf(@content)
    end

    def split_daemons(content)
      split_daemons_list = []
      content.each do |line|
        data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
        next unless data != ''
        data.split(':')[0].split(',').each do |daemon|
          split_daemons_list.push("#{daemon} : " + line.split(':', 2)[1])
        end
      end
      split_daemons_list
    end

    def parse_conf(content)
      content.map do |line|
        data, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
        parse_line(data) unless data == ''
      end.compact
    end

    def parse_line(line)
      daemon, clients_and_options = line.split(/:\s+/, 2)
      daemon = daemon.strip

      clients_and_options ||= ''
      clients, options = clients_and_options.split(/\s+:\s+/, 2)
      client_list = clients.split(/,/).map(&:strip)

      options ||= ''
      options_list = options.split(/:\s+/).map(&:strip)

      {
        'daemon'      => daemon,
        'client_list' => client_list,
        'options'     => options_list,
      }
    end

    def read_file(conf_path = @conf_path)
      read_file_content(conf_path).lines
    end
  end

  class EtcHostsDeny < EtcHostsAllow
    name 'etc_hosts_deny'
    supports platform: 'unix'
    desc 'Use the etc_hosts_deny InSpec audit resource to test the connections
          the client will deny. Controlled by the /etc/hosts.deny file.'
    example <<~EXAMPLE
      describe etc_hosts_deny.where { daemon_list == 'ALL' } do
        its('client_list') { should eq [['127.0.0.1', '[::1]']] }
        its('options') { should eq [] }
      end
    EXAMPLE

    def initialize(path = nil)
      return skip_resource '`etc_hosts_deny` is not supported on your OS' unless inspec.os.linux?
      super(path || '/etc/hosts.deny')
    end

    def to_s
      'hosts.deny Configuration'
    end
  end
end