fix(network): handle Nonetype is not iterable for security groups (#7372)

Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Co-authored-by: MrCloudSec <hello@mistercloudsec.com>

prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py

@@ -17,7 +17,10 @@ class network_http_internet_access_restricted(Check):
                     (
                         rule.destination_port_range == "80"
                         or (
-                            "-" in rule.destination_port_range
+                            (
+                                rule.destination_port_range
+                                and "-" in rule.destination_port_range
+                            )
                             and int(rule.destination_port_range.split("-")[0]) <= 80
                             and int(rule.destination_port_range.split("-")[1]) >= 80
                         )

prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py

@@ -17,7 +17,10 @@ class network_rdp_internet_access_restricted(Check):
                     (
                         rule.destination_port_range == "3389"
                         or (
-                            "-" in rule.destination_port_range
+                            (
+                                rule.destination_port_range
+                                and "-" in rule.destination_port_range
+                            )
                             and int(rule.destination_port_range.split("-")[0]) <= 3389
                             and int(rule.destination_port_range.split("-")[1]) >= 3389
                         )

prowler/providers/azure/services/network/network_service.py

@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import List
+from typing import List, Optional
 
 from azure.mgmt.network import NetworkManagementClient
 
@@ -168,11 +168,11 @@ class NetworkWatcher:
 class SecurityRule:
     id: str
     name: str
-    destination_port_range: str
-    protocol: str
-    source_address_prefix: str
-    access: str
-    direction: str
+    destination_port_range: Optional[str]
+    protocol: Optional[str]
+    source_address_prefix: Optional[str]
+    access: Optional[str]
+    direction: Optional[str]
 
 
 @dataclass

prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py

@@ -17,7 +17,10 @@ class network_ssh_internet_access_restricted(Check):
                     (
                         rule.destination_port_range == "22"
                         or (
-                            "-" in rule.destination_port_range
+                            (
+                                rule.destination_port_range
+                                and "-" in rule.destination_port_range
+                            )
                             and int(rule.destination_port_range.split("-")[0]) <= 22
                             and int(rule.destination_port_range.split("-")[1]) >= 22
                         )

prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py

@@ -14,10 +14,16 @@ class network_udp_internet_access_restricted(Check):
                 report.status = "PASS"
                 report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has UDP internet access restricted."
                 rule_fail_condition = any(
-                    rule.protocol in ["UDP", "Udp"]
-                    and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"]
-                    and rule.access == "Allow"
-                    and rule.direction == "Inbound"
+                    (
+                        rule.protocol in ["UDP", "Udp"]
+                        and (
+                            rule.source_address_prefix
+                            and rule.source_address_prefix
+                            in ["Internet", "*", "0.0.0.0/0"]
+                        )
+                        and rule.access == "Allow"
+                        and rule.direction == "Inbound"
+                    )
                     for rule in security_group.security_rules
                 )
                 if rule_fail_condition:

tests/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted_test.py

@@ -33,7 +33,7 @@ class Test_network_http_internet_access_restricted:
             result = check.execute()
             assert len(result) == 0
 
-    def test_network_security_groups_no_security_rules(self):
+    def test_network_security_groups_none_destination_port_range(self):
         network_client = mock.MagicMock
         security_group_name = "Security Group Name"
         security_group_id = str(uuid4())
@@ -44,7 +44,15 @@ class Test_network_http_internet_access_restricted:
                     id=security_group_id,
                     name=security_group_name,
                     location="location",
-                    security_rules=[],
+                    security_rules=[
+                        SecurityRule(
+                            destination_port_range=None,
+                            protocol="TCP",
+                            source_address_prefix="Internet",
+                            access="Allow",
+                            direction="Inbound",
+                        )
+                    ],
                 )
             ]
         }

tests/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted_test.py

@@ -15,15 +15,19 @@ class Test_network_rdp_internet_access_restricted:
         network_client = mock.MagicMock
         network_client.security_groups = {}
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import (
                 network_rdp_internet_access_restricted,
@@ -33,6 +37,61 @@ class Test_network_rdp_internet_access_restricted:
             result = check.execute()
             assert len(result) == 0
 
+    def test_network_security_groups_none_destination_port_range(self):
+        network_client = mock.MagicMock
+        security_group_name = "Security Group Name"
+        security_group_id = str(uuid4())
+
+        network_client.security_groups = {
+            AZURE_SUBSCRIPTION_ID: [
+                SecurityGroup(
+                    id=security_group_id,
+                    name=security_group_name,
+                    location="location",
+                    security_rules=[
+                        SecurityRule(
+                            destination_port_range=None,
+                            protocol="TCP",
+                            source_address_prefix="Internet",
+                            access="Allow",
+                            direction="Inbound",
+                        )
+                    ],
+                )
+            ]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import (
+                network_http_internet_access_restricted,
+            )
+
+            check = network_http_internet_access_restricted()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == security_group_name
+            assert result[0].resource_id == security_group_id
+            assert result[0].location == "location"
+
     def test_network_security_groups_no_security_rules(self):
         network_client = mock.MagicMock
         security_group_name = "Security Group Name"
@@ -49,15 +108,19 @@ class Test_network_rdp_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import (
                 network_rdp_internet_access_restricted,
@@ -100,15 +163,19 @@ class Test_network_rdp_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import (
                 network_rdp_internet_access_restricted,
@@ -151,15 +218,19 @@ class Test_network_rdp_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import (
                 network_rdp_internet_access_restricted,

tests/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted_test.py

@@ -15,15 +15,19 @@ class Test_network_ssh_internet_access_restricted:
         network_client = mock.MagicMock
         network_client.security_groups = {}
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import (
                 network_ssh_internet_access_restricted,
@@ -33,6 +37,61 @@ class Test_network_ssh_internet_access_restricted:
             result = check.execute()
             assert len(result) == 0
 
+    def test_network_security_groups_none_destination_port_range(self):
+        network_client = mock.MagicMock
+        security_group_name = "Security Group Name"
+        security_group_id = str(uuid4())
+
+        network_client.security_groups = {
+            AZURE_SUBSCRIPTION_ID: [
+                SecurityGroup(
+                    id=security_group_id,
+                    name=security_group_name,
+                    location="location",
+                    security_rules=[
+                        SecurityRule(
+                            destination_port_range=None,
+                            protocol="TCP",
+                            source_address_prefix="Internet",
+                            access="Allow",
+                            direction="Inbound",
+                        )
+                    ],
+                )
+            ]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import (
+                network_http_internet_access_restricted,
+            )
+
+            check = network_http_internet_access_restricted()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == security_group_name
+            assert result[0].resource_id == security_group_id
+            assert result[0].location == "location"
+
     def test_network_security_groups_no_security_rules(self):
         network_client = mock.MagicMock
         security_group_name = "Security Group Name"
@@ -49,15 +108,19 @@ class Test_network_ssh_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import (
                 network_ssh_internet_access_restricted,
@@ -100,15 +163,19 @@ class Test_network_ssh_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import (
                 network_ssh_internet_access_restricted,
@@ -151,15 +218,19 @@ class Test_network_ssh_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import (
                 network_ssh_internet_access_restricted,
@@ -202,15 +273,19 @@ class Test_network_ssh_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import (
                 network_ssh_internet_access_restricted,

tests/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted_test.py

@@ -15,15 +15,19 @@ class Test_network_udp_internet_access_restricted:
         network_client = mock.MagicMock
         network_client.security_groups = {}
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import (
                 network_udp_internet_access_restricted,
@@ -33,6 +37,61 @@ class Test_network_udp_internet_access_restricted:
             result = check.execute()
             assert len(result) == 0
 
+    def test_network_security_groups_none_source_address_prefix(self):
+        network_client = mock.MagicMock
+        security_group_name = "Security Group Name"
+        security_group_id = str(uuid4())
+
+        network_client.security_groups = {
+            AZURE_SUBSCRIPTION_ID: [
+                SecurityGroup(
+                    id=security_group_id,
+                    name=security_group_name,
+                    location="location",
+                    security_rules=[
+                        SecurityRule(
+                            destination_port_range=None,
+                            protocol="TCP",
+                            source_address_prefix=None,
+                            access="Allow",
+                            direction="Inbound",
+                        )
+                    ],
+                )
+            ]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import (
+                network_http_internet_access_restricted,
+            )
+
+            check = network_http_internet_access_restricted()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == security_group_name
+            assert result[0].resource_id == security_group_id
+            assert result[0].location == "location"
+
     def test_network_security_groups_no_security_rules(self):
         network_client = mock.MagicMock
         security_group_name = "Security Group Name"
@@ -49,15 +108,19 @@ class Test_network_udp_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import (
                 network_udp_internet_access_restricted,
@@ -99,15 +162,19 @@ class Test_network_udp_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import (
                 network_udp_internet_access_restricted,
@@ -149,15 +216,19 @@ class Test_network_udp_internet_access_restricted:
             ]
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_azure_provider(),
-        ), mock.patch(
-            "prowler.providers.azure.services.network.network_service.Network",
-            new=network_client,
-        ) as service_client, mock.patch(
-            "prowler.providers.azure.services.network.network_client.network_client",
-            new=service_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
         ):
             from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import (
                 network_udp_internet_access_restricted,