add xinetd_conf resource

lib/inspec/resource.rb

@@ -93,6 +93,7 @@ require 'resources/shadow'
 require 'resources/ssh_conf'
 require 'resources/user'
 require 'resources/windows_feature'
+require 'resources/xinetd'
 require 'resources/yum'
 
 # file formats, depend on json implementation

lib/resources/xinetd.rb

@@ -0,0 +1,119 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'utils/parser'
+
+class XinetdConf < Inspec.resource(1)
+  name 'xinetd_conf'
+  desc 'Xinetd services configuration.'
+  example "
+    describe xinetd_conf.services('chargen') do
+      its('socket_types') { should eq ['dgram', 'stream'] }
+    end
+
+    describe xinetd_conf.services('chargen').socket_types('dgram') do
+      it { should be_disabled }
+    end
+  "
+
+  include XinetdParser
+
+  def initialize(conf_path = '/etc/xinetd.conf', opts = {})
+    @conf_path = conf_path
+    @params = opts[:params] unless opts[:params].nil?
+    @filters = opts[:filters] || ''
+    @contents = {}
+  end
+
+  def to_s
+    "Xinetd config #{@conf_path}"
+  end
+
+  def services(condition = nil)
+    condition.nil? ? params['services'].keys : filter(service: condition)
+  end
+
+  def ids(condition = nil)
+    condition.nil? ? services_field('id') : filter(id: condition)
+  end
+
+  def socket_types(condition = nil)
+    condition.nil? ? services_field('socket_type') : filter(socket_type: condition)
+  end
+
+  def types(condition = nil)
+    condition.nil? ? services_field('type') : filter(type: condition)
+  end
+
+  def wait(condition = nil)
+    condition.nil? ? services_field('wait') : filter(wait: condition)
+  end
+
+  def disabled?
+    filter(disable: 'no').services.empty?
+  end
+
+  def enabled?
+    filter(disable: 'yes').services.empty?
+  end
+
+  def params
+    return @params if defined?(@params)
+    return @params = {} if read_content.nil?
+    flat_params = parse_xinetd(read_content)
+    @params = { 'services' => {} }
+    flat_params.each do |k, v|
+      name = k[/^service (.+)$/, 1]
+      if name.nil?
+        @params[k] = v
+      else
+        @params['services'][name] = v
+      end
+    end
+    @params
+  end
+
+  def services_field(field)
+    params['services'].values.compact.flatten
+                      .map { |x| x.params[field] }.flatten.compact
+  end
+
+  def filter(conditions = {})
+    res = params.dup
+    filters = ''
+    conditions.each do |k, v|
+      v = v.to_s if v.is_a? Integer
+      filters += " #{k} = #{v.inspect}"
+      res['services'] = filter_by(res['services'], k.to_s, v)
+    end
+    XinetdConf.new(@conf_path, params: res, filters: filters)
+  end
+
+  private
+
+  def filter_by(services, k, v)
+    if k == 'service'
+      return Hash[services.find_all { |name, _| v == name }]
+    end
+    Hash[services.map { |name, service_arr|
+      found = service_arr.find_all { |service| service.params[k] == v }
+      found.empty? ? nil : [name, found]
+    }.compact]
+  end
+
+  def read_content(path = @conf_path)
+    return @contents[path] if @contents.key?(path)
+    file = inspec.file(path)
+    if !file.file?
+      return skip_resource "Can't find file \"#{path}\""
+    end
+
+    @contents[path] = file.content
+    if @contents[path].empty? && file.size > 0
+      return skip_resource "Can't read file \"#{path}\""
+    end
+
+    @contents[path]
+  end
+end

lib/utils/parser.rb

@@ -177,3 +177,56 @@ module SolarisNetstatParser
     line.match(Regexp.new(arr.join))
   end
 end
+
+module XinetdParser
+  def xinetd_include_dir(dir)
+    return [] if dir.nil?
+
+    unless inspec.file(dir).directory?
+      return skip_resource "Cannot read folder in #{dir}"
+    end
+
+    files = inspec.command("find #{dir} -type f").stdout.split("\n")
+    files.map { |file| parse_xinetd(read_content(file)) }
+  end
+
+  def parse_xinetd(raw) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    return {} if raw.nil?
+    res = {}
+    cur_group = nil
+    simple_conf = []
+    rest = raw
+    until rest.empty?
+      nl = rest.index("\n") || (rest.length-1)
+      comment = rest.index('#') || (rest.length-1)
+      dst_idx = (comment < nl) ? comment : nl
+      inner_line = (dst_idx == 0) ? '' : rest[0..dst_idx-1].strip
+      rest = rest[nl+1..-1]
+      next if inner_line.empty?
+
+      if inner_line == '}'
+        res[cur_group] = SimpleConfig.new(simple_conf.join("\n"))
+        cur_group = nil
+      elsif rest.lstrip[0] == '{'
+        cur_group = inner_line
+        simple_conf = []
+        rest = rest[rest.index("\n")+1..-1]
+      elsif cur_group.nil?
+        others = xinetd_include_dir(inner_line[/includedir (.+)/, 1])
+
+        # complex merging of included configurations, as multiple services
+        # may be defined with the same name but different configuration
+        others.each { |ores|
+          ores.each { |k, v|
+            res[k] ||= []
+            res[k].push(v)
+          }
+        }
+      else
+        simple_conf.push(inner_line)
+      end
+    end
+
+    res
+  end
+end

test/helper.rb

@@ -111,6 +111,10 @@ class MockLoader
       '/etc/apache2/apache2.conf' => mockfile.call('apache2.conf'),
       '/etc/apache2/ports.conf' => mockfile.call('ports.conf'),
       '/etc/apache2/conf-enabled/serve-cgi-bin.conf' => mockfile.call('serve-cgi-bin.conf'),
+      '/etc/xinetd.conf' => mockfile.call('xinetd.conf'),
+      '/etc/xinetd.d' => mockfile.call('xinetd.d'),
+      '/etc/xinetd.d/chargen-stream' => mockfile.call('xinetd.d_chargen-stream'),
+      '/etc/xinetd.d/chargen-dgram' => mockfile.call('xinetd.d_chargen-dgram'),
     }
 
     # create all mock commands
@@ -225,6 +229,8 @@ class MockLoader
       'pkg info system/file-system/zfs' => cmd.call('pkg-info-system-file-system-zfs'),
       # port netstat on solaris 10 & 11
       'netstat -an -f inet -f inet6' => cmd.call('s11-netstat-an-finet-finet6'),
+      # xinetd configuration
+      'find /etc/xinetd.d -type f' => cmd.call('find-xinetd.d'),
     }
 
     @backend

test/unit/mock/cmd/find-xinetd.d

@@ -0,0 +1,2 @@
+/etc/xinetd.d/chargen-stream
+/etc/xinetd.d/chargen-dgram

test/unit/mock/files/xinetd.conf

@@ -0,0 +1,9 @@
+defaults
+{
+# comments...
+#	enabled		=
+	log_type	= SYSLOG daemon info
+	instances	= 50
+}
+
+includedir /etc/xinetd.d

test/unit/mock/files/xinetd.d_chargen-dgram

@@ -0,0 +1,9 @@
+service chargen
+{
+    disable		= no
+    # comment
+    id		= chargen-dgram
+    type		= INTERNAL
+  	wait		= yes
+  	socket_type	= dgram
+}

test/unit/mock/files/xinetd.d_chargen-stream

@@ -0,0 +1,9 @@
+service chargen
+{
+    disable		= yes
+    # disable = no
+    id		= chargen-stream
+    type		= INTERNAL
+  	wait		= yes
+  	socket_type	= stream
+}

test/unit/resources/xinetd_test.rb

@@ -0,0 +1,55 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'helper'
+require 'inspec/resource'
+
+describe 'Inspec::Resources::XinetdConf' do
+  let(:resource) { load_resource('xinetd_conf') }
+  it 'reads default params' do
+    d = resource.params['defaults']
+    _(d).must_be_kind_of SimpleConfig
+    _(d.params['instances']).must_equal '50'
+    _(d.params['log_type']).must_equal 'SYSLOG daemon info'
+    _(d.params.length).must_equal 2
+  end
+
+  describe 'with services from child configs' do
+    it 'has one service name' do
+      _(resource.services).must_equal %w{chargen}
+    end
+
+    it 'has multiple service definitions' do
+      _(resource.ids).must_equal %w{chargen-stream chargen-dgram}
+    end
+
+    it 'can filter by name' do
+      _(resource.services('not here').params['services']).must_be_empty
+    end
+
+    it 'can chain filters' do
+      one = resource.services('chargen').socket_types('dgram')
+      _(one.params['services'].length).must_equal 1
+      _(one.ids).must_equal %w{chargen-dgram}
+    end
+
+    it 'checks if all are disabled on one disabled service' do
+      one = resource.ids('chargen-stream')
+      _(one.disabled?).must_equal true
+    end
+
+    it 'checks if all are disabled on multiple mixed' do
+      _(resource.disabled?).must_equal false
+    end
+
+    it 'checks if all are enabled on one enabled service' do
+      one = resource.ids('chargen-dgram')
+      _(one.enabled?).must_equal true
+    end
+
+    it 'checks if all are enabled on multiple mixed' do
+      _(resource.enabled?).must_equal false
+    end
+  end
+end