inspec/lib/resources/apache_conf.rb
Miah Johnson 685ba1bc1e Update apache_conf regular expression to exclude whitespace. (#2416)
* Update apache_conf test to check for ServerAlias values.

Signed-off-by: Miah Johnson <miah@chia-pet.org>

* Add ServerAlias key and values to mock apache conf which includes
trailing whitespace.

Signed-off-by: Miah Johnson <miah@chia-pet.org>

* Updated test to reflect all ServerAlias values being put into a single
array item. This is expected as we do not override the key_values
default setting of '1' when passing the raw configuration to
SimpleConfig.

Signed-off-by: Miah Johnson <miah@chia-pet.org>

* Update the regular expression to include a conditional with positive
lookahead that checks if the line ends with one or more spaces. If the
lookahead succeeds we non-greedily capture, and when it fails we
greedily capture.

Signed-off-by: Miah Johnson <miah@chia-pet.org>
2017-12-22 17:07:46 +01:00

133 lines
3.8 KiB
Ruby

# encoding: utf-8
# copyright: 2015, Vulcano Security GmbH
# author: Dominik Richter
# author: Christoph Hartmann
require 'utils/simpleconfig'
require 'utils/find_files'
module Inspec::Resources
class ApacheConf < Inspec.resource(1)
name 'apache_conf'
desc 'Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform.'
example "
describe apache_conf do
its('setting_name') { should eq 'value' }
end
"
include FindFiles
def initialize(conf_path = nil)
@conf_path = conf_path || inspec.apache.conf_path
@conf_dir = conf_path ? File.dirname(@conf_path) : inspec.apache.conf_dir
@files_contents = {}
@content = nil
@params = nil
read_content
end
def content
@content ||= read_content
end
def params(*opts)
@params || read_content
res = @params
opts.each do |opt|
res = res[opt] unless res.nil?
end
res
end
def method_missing(name)
# ensure params are loaded
@params || read_content
# extract values
@params[name.to_s] unless @params.nil?
end
def filter_comments(data)
content = ''
data.each_line do |line|
if !line.match(/^\s*#/)
content << line
end
end
content
end
def read_content
@content = ''
@params = {}
# skip if the main configuration file doesn't exist
file = inspec.file(@conf_path)
if !file.file?
return skip_resource "Can't find file \"#{@conf_path}\""
end
raw_conf = file.content
if raw_conf.empty? && !file.empty?
return skip_resource("Can't read file \"#{@conf_path}\"")
end
to_read = [@conf_path]
until to_read.empty?
raw_conf = read_file(to_read[0])
@content += raw_conf
# An explaination of the below regular expression.
# Creates two capture groups.
# The first group captures the first group of non-whitespace character
# surrounded whitespace characters.
# The second group contains a conditional with a positive lookahead
# (does the line end with one or more spaces?). If the lookahead succeeds
# a non-greedy capture takes place, if it fails then a greedy capture takes place.
# The regex is terminated by an expression that matches zero or more spaces.
params = SimpleConfig.new(
raw_conf,
assignment_regex: /^\s*(\S+)\s+((?=.*\s+$).*?|.*)\s*$/,
multiple_values: true,
).params
@params.merge!(params)
to_read = to_read.drop(1)
to_read += include_files(params).find_all do |fp|
not @files_contents.key? fp
end
end
# fiter comments
@content = filter_comments @content
@content
end
def include_files(params)
# see if there is more config files to include
include_files = params['Include'] || []
include_files_optional = params['IncludeOptional'] || []
includes = []
(include_files + include_files_optional).each do |f|
id = Pathname.new(f).absolute? ? f : File.join(@conf_dir, f)
files = find_files(id, depth: 1, type: 'file')
files += find_files(id, depth: 1, type: 'link')
includes.push(files) if files
end
# [].flatten! == nil
includes.flatten! || []
end
def read_file(path)
@files_contents[path] ||= inspec.file(path).content
end
def to_s
"Apache Config #{@conf_path}"
end
end
end