mirror of
https://github.com/inspec/inspec
synced 2024-11-14 00:47:10 +00:00
c7e87ca3e3
* Create file-check functionality into utility file There are the similar issues as PR #2302. Almost resources return false positives when a file does not exist or is not read. * Replace to file-check functionality * Fix dh_params and x509_certificate resources If a file is empty, OpenSSL::PKey::DH and OpenSSL::X509::Certificate have raised an exception and have skipped the inspection. Thus x509_certificate and dh_params resources are not allowed to read a empty file. * to_s of shadow expects filters is not nil * Remove workaround of sshd_config Removes the workaround of sshd_config since Travis CI fails due to a bug of dev-sec/ssh-baseline and the PR #100 will fix it. * Use init block variable in methods Signed-off-by: ERAMOTO Masaya <eramoto.masaya@jp.fujitsu.com>
77 lines
1.7 KiB
Ruby
77 lines
1.7 KiB
Ruby
# encoding: utf-8
|
|
|
|
require 'openssl'
|
|
require 'utils/file_reader'
|
|
|
|
class DhParams < Inspec.resource(1)
|
|
name 'dh_params'
|
|
supports platform: 'unix'
|
|
desc '
|
|
Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH)
|
|
parameters.
|
|
'
|
|
|
|
example "
|
|
describe dh_params('/path/to/file.dh_pem') do
|
|
it { should be_dh_params }
|
|
it { should be_valid }
|
|
its('generator') { should eq 2 }
|
|
its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
|
|
its('prime_length') { should eq 2048 }
|
|
its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
|
|
its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
|
|
end
|
|
"
|
|
|
|
include FileReader
|
|
|
|
def initialize(filename)
|
|
@dh_params_path = filename
|
|
@dh_params = OpenSSL::PKey::DH.new read_file_content(@dh_params_path)
|
|
end
|
|
|
|
# it { should be_dh_params }
|
|
def dh_params?
|
|
!@dh_params.nil?
|
|
end
|
|
|
|
# its('generator') { should eq 2 }
|
|
def generator
|
|
return if @dh_params.nil?
|
|
@dh_params.g.to_i
|
|
end
|
|
|
|
# its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
|
|
def modulus
|
|
return if @dh_params.nil?
|
|
'00:' + @dh_params.p.to_s(16).downcase.scan(/.{2}/).join(':')
|
|
end
|
|
|
|
# its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
|
|
def pem
|
|
return if @dh_params.nil?
|
|
@dh_params.to_pem
|
|
end
|
|
|
|
# its('prime_length') { should be 2048 }
|
|
def prime_length
|
|
return if @dh_params.nil?
|
|
@dh_params.p.num_bits
|
|
end
|
|
|
|
# its('text') { should eq 'human-readable-text' }
|
|
def text
|
|
return if @dh_params.nil?
|
|
@dh_params.to_text
|
|
end
|
|
|
|
# it { should be_valid }
|
|
def valid?
|
|
return if @dh_params.nil?
|
|
@dh_params.params_ok?
|
|
end
|
|
|
|
def to_s
|
|
"dh_params #{@dh_params_path}"
|
|
end
|
|
end
|