ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(network): handle Nonetype is not iterable for security groups (#7208)

Browse Source
This commit is contained in:
Hugo Pereira Brito
2025-03-25 09:28:37 +01:00
committed by GitHub
parent e68aa62f94
commit 1e324b7ed2
9 changed files with 203 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py
+4 -1
View File
@@ -17,7 +17,10 @@ class network_http_internet_access_restricted(Check):
(
rule.destination_port_range == "80"
or (
"-" in rule.destination_port_range
(
rule.destination_port_range
and "-" in rule.destination_port_range
)
and int(rule.destination_port_range.split("-")[0]) <= 80
and int(rule.destination_port_range.split("-")[1]) >= 80
)
prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py
+4 -1
View File
@@ -17,7 +17,10 @@ class network_rdp_internet_access_restricted(Check):
(
rule.destination_port_range == "3389"
or (
"-" in rule.destination_port_range
(
rule.destination_port_range
and "-" in rule.destination_port_range
)
and int(rule.destination_port_range.split("-")[0]) <= 3389
and int(rule.destination_port_range.split("-")[1]) >= 3389
)
prowler/providers/azure/services/network/network_service.py
+6 -6
View File
@@ -1,5 +1,5 @@
from dataclasses import dataclass
from typing import List
from typing import List, Optional
from azure.mgmt.network import NetworkManagementClient
@@ -168,11 +168,11 @@ class NetworkWatcher:
class SecurityRule:
id: str
name: str
destination_port_range: str
protocol: str
source_address_prefix: str
access: str
direction: str
destination_port_range: Optional[str]
protocol: Optional[str]
source_address_prefix: Optional[str]
access: Optional[str]
direction: Optional[str]
@dataclass
prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py
+4 -1
View File
@@ -17,7 +17,10 @@ class network_ssh_internet_access_restricted(Check):
(
rule.destination_port_range == "22"
or (
"-" in rule.destination_port_range
(
rule.destination_port_range
and "-" in rule.destination_port_range
)
and int(rule.destination_port_range.split("-")[0]) <= 22
and int(rule.destination_port_range.split("-")[1]) >= 22
)
prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py
+10 -4
View File
@@ -14,10 +14,16 @@ class network_udp_internet_access_restricted(Check):
report.status = "PASS"
report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has UDP internet access restricted."
rule_fail_condition = any(
rule.protocol in ["UDP", "Udp"]
and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"]
and rule.access == "Allow"
and rule.direction == "Inbound"
(
rule.protocol in ["UDP", "Udp"]
and (
rule.source_address_prefix
and rule.source_address_prefix
in ["Internet", "*", "0.0.0.0/0"]
)
and rule.access == "Allow"
and rule.direction == "Inbound"
)
for rule in security_group.security_rules
)
if rule_fail_condition:
tests/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted_test.py
+10 -2
View File
@@ -37,7 +37,7 @@ class Test_network_http_internet_access_restricted:
result = check.execute()
assert len(result) == 0
def test_network_security_groups_no_security_rules(self):
def test_network_security_groups_none_destination_port_range(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"
security_group_id = str(uuid4())
@@ -48,7 +48,15 @@ class Test_network_http_internet_access_restricted:
id=security_group_id,
name=security_group_name,
location="location",
security_rules=[],
security_rules=[
SecurityRule(
destination_port_range=None,
protocol="TCP",
source_address_prefix="Internet",
access="Allow",
direction="Inbound",
)
],
)
]
}
tests/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted_test.py
+55
View File
@@ -37,6 +37,61 @@ class Test_network_rdp_internet_access_restricted:
result = check.execute()
assert len(result) == 0
def test_network_security_groups_none_destination_port_range(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"
security_group_id = str(uuid4())
network_client.security_groups = {
AZURE_SUBSCRIPTION_ID: [
SecurityGroup(
id=security_group_id,
name=security_group_name,
location="location",
security_rules=[
SecurityRule(
destination_port_range=None,
protocol="TCP",
source_address_prefix="Internet",
access="Allow",
direction="Inbound",
)
],
)
]
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.network.network_service.Network",
new=network_client,
) as service_client,
mock.patch(
"prowler.providers.azure.services.network.network_client.network_client",
new=service_client,
),
):
from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import (
network_http_internet_access_restricted,
)
check = network_http_internet_access_restricted()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == security_group_name
assert result[0].resource_id == security_group_id
assert result[0].location == "location"
def test_network_security_groups_no_security_rules(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"
tests/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted_test.py
+55
View File
@@ -37,6 +37,61 @@ class Test_network_ssh_internet_access_restricted:
result = check.execute()
assert len(result) == 0
def test_network_security_groups_none_destination_port_range(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"
security_group_id = str(uuid4())
network_client.security_groups = {
AZURE_SUBSCRIPTION_ID: [
SecurityGroup(
id=security_group_id,
name=security_group_name,
location="location",
security_rules=[
SecurityRule(
destination_port_range=None,
protocol="TCP",
source_address_prefix="Internet",
access="Allow",
direction="Inbound",
)
],
)
]
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.network.network_service.Network",
new=network_client,
) as service_client,
mock.patch(
"prowler.providers.azure.services.network.network_client.network_client",
new=service_client,
),
):
from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import (
network_http_internet_access_restricted,
)
check = network_http_internet_access_restricted()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == security_group_name
assert result[0].resource_id == security_group_id
assert result[0].location == "location"
def test_network_security_groups_no_security_rules(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"
tests/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted_test.py
+55
View File
@@ -37,6 +37,61 @@ class Test_network_udp_internet_access_restricted:
result = check.execute()
assert len(result) == 0
def test_network_security_groups_none_source_address_prefix(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"
security_group_id = str(uuid4())
network_client.security_groups = {
AZURE_SUBSCRIPTION_ID: [
SecurityGroup(
id=security_group_id,
name=security_group_name,
location="location",
security_rules=[
SecurityRule(
destination_port_range=None,
protocol="TCP",
source_address_prefix=None,
access="Allow",
direction="Inbound",
)
],
)
]
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.network.network_service.Network",
new=network_client,
) as service_client,
mock.patch(
"prowler.providers.azure.services.network.network_client.network_client",
new=service_client,
),
):
from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import (
network_http_internet_access_restricted,
)
check = network_http_internet_access_restricted()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == security_group_name
assert result[0].resource_id == security_group_id
assert result[0].location == "location"
def test_network_security_groups_no_security_rules(self):
network_client = mock.MagicMock
security_group_name = "Security Group Name"