diff --git a/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py b/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py index 5fd8d053f4..61f018bae4 100644 --- a/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py @@ -17,7 +17,10 @@ class network_http_internet_access_restricted(Check): ( rule.destination_port_range == "80" or ( - "-" in rule.destination_port_range + ( + rule.destination_port_range + and "-" in rule.destination_port_range + ) and int(rule.destination_port_range.split("-")[0]) <= 80 and int(rule.destination_port_range.split("-")[1]) >= 80 ) diff --git a/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py b/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py index 8c3d804ccd..7d08678d27 100644 --- a/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py @@ -17,7 +17,10 @@ class network_rdp_internet_access_restricted(Check): ( rule.destination_port_range == "3389" or ( - "-" in rule.destination_port_range + ( + rule.destination_port_range + and "-" in rule.destination_port_range + ) and int(rule.destination_port_range.split("-")[0]) <= 3389 and int(rule.destination_port_range.split("-")[1]) >= 3389 ) diff --git a/prowler/providers/azure/services/network/network_service.py b/prowler/providers/azure/services/network/network_service.py index 6842926014..fb9af1af3a 100644 --- a/prowler/providers/azure/services/network/network_service.py +++ b/prowler/providers/azure/services/network/network_service.py @@ -1,5 +1,5 @@ from dataclasses import dataclass -from typing import List +from typing import List, Optional from azure.mgmt.network import NetworkManagementClient @@ -168,11 +168,11 @@ class NetworkWatcher: class SecurityRule: id: str name: str - destination_port_range: str - protocol: str - source_address_prefix: str - access: str - direction: str + destination_port_range: Optional[str] + protocol: Optional[str] + source_address_prefix: Optional[str] + access: Optional[str] + direction: Optional[str] @dataclass diff --git a/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py b/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py index a24cd10da3..e4207194e1 100644 --- a/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py @@ -17,7 +17,10 @@ class network_ssh_internet_access_restricted(Check): ( rule.destination_port_range == "22" or ( - "-" in rule.destination_port_range + ( + rule.destination_port_range + and "-" in rule.destination_port_range + ) and int(rule.destination_port_range.split("-")[0]) <= 22 and int(rule.destination_port_range.split("-")[1]) >= 22 ) diff --git a/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py b/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py index c465c891f2..ebd5fc7d50 100644 --- a/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py @@ -14,10 +14,16 @@ class network_udp_internet_access_restricted(Check): report.status = "PASS" report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has UDP internet access restricted." rule_fail_condition = any( - rule.protocol in ["UDP", "Udp"] - and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"] - and rule.access == "Allow" - and rule.direction == "Inbound" + ( + rule.protocol in ["UDP", "Udp"] + and ( + rule.source_address_prefix + and rule.source_address_prefix + in ["Internet", "*", "0.0.0.0/0"] + ) + and rule.access == "Allow" + and rule.direction == "Inbound" + ) for rule in security_group.security_rules ) if rule_fail_condition: diff --git a/tests/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted_test.py b/tests/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted_test.py index 082e96e1b9..0c2ee9883d 100644 --- a/tests/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted_test.py +++ b/tests/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted_test.py @@ -33,7 +33,7 @@ class Test_network_http_internet_access_restricted: result = check.execute() assert len(result) == 0 - def test_network_security_groups_no_security_rules(self): + def test_network_security_groups_none_destination_port_range(self): network_client = mock.MagicMock security_group_name = "Security Group Name" security_group_id = str(uuid4()) @@ -44,7 +44,15 @@ class Test_network_http_internet_access_restricted: id=security_group_id, name=security_group_name, location="location", - security_rules=[], + security_rules=[ + SecurityRule( + destination_port_range=None, + protocol="TCP", + source_address_prefix="Internet", + access="Allow", + direction="Inbound", + ) + ], ) ] } diff --git a/tests/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted_test.py b/tests/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted_test.py index ce03204158..9f8c9b145a 100644 --- a/tests/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted_test.py +++ b/tests/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted_test.py @@ -15,15 +15,19 @@ class Test_network_rdp_internet_access_restricted: network_client = mock.MagicMock network_client.security_groups = {} - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import ( network_rdp_internet_access_restricted, @@ -33,6 +37,61 @@ class Test_network_rdp_internet_access_restricted: result = check.execute() assert len(result) == 0 + def test_network_security_groups_none_destination_port_range(self): + network_client = mock.MagicMock + security_group_name = "Security Group Name" + security_group_id = str(uuid4()) + + network_client.security_groups = { + AZURE_SUBSCRIPTION_ID: [ + SecurityGroup( + id=security_group_id, + name=security_group_name, + location="location", + security_rules=[ + SecurityRule( + destination_port_range=None, + protocol="TCP", + source_address_prefix="Internet", + access="Allow", + direction="Inbound", + ) + ], + ) + ] + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), + ): + from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import ( + network_http_internet_access_restricted, + ) + + check = network_http_internet_access_restricted() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted." + ) + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == security_group_name + assert result[0].resource_id == security_group_id + assert result[0].location == "location" + def test_network_security_groups_no_security_rules(self): network_client = mock.MagicMock security_group_name = "Security Group Name" @@ -49,15 +108,19 @@ class Test_network_rdp_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import ( network_rdp_internet_access_restricted, @@ -100,15 +163,19 @@ class Test_network_rdp_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import ( network_rdp_internet_access_restricted, @@ -151,15 +218,19 @@ class Test_network_rdp_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_rdp_internet_access_restricted.network_rdp_internet_access_restricted import ( network_rdp_internet_access_restricted, diff --git a/tests/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted_test.py b/tests/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted_test.py index 5070e7c29b..4472055075 100644 --- a/tests/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted_test.py +++ b/tests/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted_test.py @@ -15,15 +15,19 @@ class Test_network_ssh_internet_access_restricted: network_client = mock.MagicMock network_client.security_groups = {} - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import ( network_ssh_internet_access_restricted, @@ -33,6 +37,61 @@ class Test_network_ssh_internet_access_restricted: result = check.execute() assert len(result) == 0 + def test_network_security_groups_none_destination_port_range(self): + network_client = mock.MagicMock + security_group_name = "Security Group Name" + security_group_id = str(uuid4()) + + network_client.security_groups = { + AZURE_SUBSCRIPTION_ID: [ + SecurityGroup( + id=security_group_id, + name=security_group_name, + location="location", + security_rules=[ + SecurityRule( + destination_port_range=None, + protocol="TCP", + source_address_prefix="Internet", + access="Allow", + direction="Inbound", + ) + ], + ) + ] + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), + ): + from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import ( + network_http_internet_access_restricted, + ) + + check = network_http_internet_access_restricted() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted." + ) + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == security_group_name + assert result[0].resource_id == security_group_id + assert result[0].location == "location" + def test_network_security_groups_no_security_rules(self): network_client = mock.MagicMock security_group_name = "Security Group Name" @@ -49,15 +108,19 @@ class Test_network_ssh_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import ( network_ssh_internet_access_restricted, @@ -100,15 +163,19 @@ class Test_network_ssh_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import ( network_ssh_internet_access_restricted, @@ -151,15 +218,19 @@ class Test_network_ssh_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import ( network_ssh_internet_access_restricted, @@ -202,15 +273,19 @@ class Test_network_ssh_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_ssh_internet_access_restricted.network_ssh_internet_access_restricted import ( network_ssh_internet_access_restricted, diff --git a/tests/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted_test.py b/tests/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted_test.py index f6c7a68f13..7d519df326 100644 --- a/tests/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted_test.py +++ b/tests/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted_test.py @@ -15,15 +15,19 @@ class Test_network_udp_internet_access_restricted: network_client = mock.MagicMock network_client.security_groups = {} - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import ( network_udp_internet_access_restricted, @@ -33,6 +37,61 @@ class Test_network_udp_internet_access_restricted: result = check.execute() assert len(result) == 0 + def test_network_security_groups_none_source_address_prefix(self): + network_client = mock.MagicMock + security_group_name = "Security Group Name" + security_group_id = str(uuid4()) + + network_client.security_groups = { + AZURE_SUBSCRIPTION_ID: [ + SecurityGroup( + id=security_group_id, + name=security_group_name, + location="location", + security_rules=[ + SecurityRule( + destination_port_range=None, + protocol="TCP", + source_address_prefix=None, + access="Allow", + direction="Inbound", + ) + ], + ) + ] + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), + ): + from prowler.providers.azure.services.network.network_http_internet_access_restricted.network_http_internet_access_restricted import ( + network_http_internet_access_restricted, + ) + + check = network_http_internet_access_restricted() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Security Group {security_group_name} from subscription {AZURE_SUBSCRIPTION_ID} has HTTP internet access restricted." + ) + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == security_group_name + assert result[0].resource_id == security_group_id + assert result[0].location == "location" + def test_network_security_groups_no_security_rules(self): network_client = mock.MagicMock security_group_name = "Security Group Name" @@ -49,15 +108,19 @@ class Test_network_udp_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import ( network_udp_internet_access_restricted, @@ -99,15 +162,19 @@ class Test_network_udp_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import ( network_udp_internet_access_restricted, @@ -149,15 +216,19 @@ class Test_network_udp_internet_access_restricted: ] } - with mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), mock.patch( - "prowler.providers.azure.services.network.network_service.Network", - new=network_client, - ) as service_client, mock.patch( - "prowler.providers.azure.services.network.network_client.network_client", - new=service_client, + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.network.network_service.Network", + new=network_client, + ) as service_client, + mock.patch( + "prowler.providers.azure.services.network.network_client.network_client", + new=service_client, + ), ): from prowler.providers.azure.services.network.network_udp_internet_access_restricted.network_udp_internet_access_restricted import ( network_udp_internet_access_restricted,