Class: Inspec::Resources::X509PrivateKey

Inherits:
Object
  • Object
show all
Defined in:
lib/inspec/resources/x509_private_key.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(secret_key_path, passphrase = nil) ⇒ X509PrivateKey

Returns a new instance of X509PrivateKey.



34
35
36
37
38
 
# File 'lib/inspec/resources/x509_private_key.rb', line 34

def initialize(secret_key_path, passphrase = nil)
  @openssl_utility = check_openssl_or_error
  @secret_key_path = secret_key_path
  @passphrase = passphrase
end

Instance Attribute Details

#openssl_utility ⇒ Object (readonly)

Resource initialization.



32
33
34
 
# File 'lib/inspec/resources/x509_private_key.rb', line 32

def openssl_utility
  @openssl_utility
end

#passphrase ⇒ Object (readonly)

Resource initialization.



32
33
34
 
# File 'lib/inspec/resources/x509_private_key.rb', line 32

def passphrase
  @passphrase
end

#secret_key_path ⇒ Object (readonly)

Resource initialization.



32
33
34
 
# File 'lib/inspec/resources/x509_private_key.rb', line 32

def secret_key_path
  @secret_key_path
end

Instance Method Details

#encrypted? ⇒ Boolean

Matcher to check if the given key is encrypted.

Returns:

  • (Boolean)

Raises:



58
59
60
61
62
63
64
 
# File 'lib/inspec/resources/x509_private_key.rb', line 58

def encrypted?
  raise Inspec::Exceptions::ResourceFailed, "The given secret key #{secret_key_path} does not exist." unless inspec.file(secret_key_path).exist?

  # All encrypted keys have the header of Proc-Type: 4,ENCRYPTED
  key_file = inspec.file(secret_key_path)
  key_file.content =~ /Proc-Type: 4,ENCRYPTED/
end

#has_matching_certificate?(cert_file_or_path) ⇒ Boolean

Matcher to verify if the private key maatches the certificate

Returns:

  • (Boolean)

Raises:



67
68
69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/inspec/resources/x509_private_key.rb', line 67

def has_matching_certificate?(cert_file_or_path)
  cert_hash_cmd = "openssl x509 -noout -modulus -in #{cert_file_or_path} | openssl md5"
  cert_hash = inspec.command(cert_hash_cmd)

  raise Inspec::Exceptions::ResourceFailed, "Executing #{cert_hash_cmd} failed: #{cert_hash.stderr}" if cert_hash.exit_status.to_i != 0

  key_hash_cmd = "openssl rsa -noout -modulus -in #{secret_key_path}"
  passphrase ? key_hash_cmd.concat(" -passin pass:#{passphrase} | openssl md5") : key_hash_cmd.concat(" | openssl md5")
  key_hash = inspec.command(key_hash_cmd)

  raise Inspec::Exceptions::ResourceFailed, "Executing #{key_hash_cmd} failed: #{key_hash.stderr}" if key_hash.exit_status.to_i != 0

  cert_hash.stdout == key_hash.stdout
end

#to_s ⇒ Object

Resource appearance in test reports.



41
42
43
 
# File 'lib/inspec/resources/x509_private_key.rb', line 41

def to_s
  "x509_private_key"
end

#valid? ⇒ Boolean

Matcher to check if the given key is valid.

Returns:

  • (Boolean) 


46
47
48
49
50
51
52
53
54
55
 
# File 'lib/inspec/resources/x509_private_key.rb', line 46

def valid?
  # Below is the command to check if the key is valid.
  openssl_key_validity_cmd = "#{openssl_utility} rsa -in #{secret_key_path} -check -noout"

  # Additionally, if key is password protected, passphrase needs to be given with -passin argument
  openssl_key_validity_cmd.concat(" -passin pass:#{passphrase}") if passphrase

  openssl_key_validity = inspec.command(openssl_key_validity_cmd)
  openssl_key_validity.exit_status.to_i == 0
end