From e6d79654535d324e5a0f4bc522a0bf30a2b56f21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Thu, 18 Apr 2024 08:11:29 +0200 Subject: [PATCH] fix(network_azure): handle capitalized protocols in security group rules (#3808) --- .../network_http_internet_access_restricted.py | 2 +- .../network_rdp_internet_access_restricted.py | 2 +- .../network_ssh_internet_access_restricted.py | 2 +- .../network_udp_internet_access_restricted.py | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py b/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py index 12b8f1c395..6833c37591 100644 --- a/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py @@ -23,7 +23,7 @@ class network_http_internet_access_restricted(Check): and int(rule.destination_port_range.split("-")[1]) >= 80 ) ) - and rule.protocol in ["TCP", "*"] + and rule.protocol in ["TCP", "Tcp", "*"] and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"] and rule.access == "Allow" and rule.direction == "Inbound" diff --git a/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py b/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py index dc21ced73a..27e2bd5058 100644 --- a/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py @@ -23,7 +23,7 @@ class network_rdp_internet_access_restricted(Check): and int(rule.destination_port_range.split("-")[1]) >= 3389 ) ) - and rule.protocol in ["TCP", "*"] + and rule.protocol in ["TCP", "Tcp", "*"] and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"] and rule.access == "Allow" and rule.direction == "Inbound" diff --git a/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py b/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py index 236b7a87a4..f60ea13958 100644 --- a/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py @@ -23,7 +23,7 @@ class network_ssh_internet_access_restricted(Check): and int(rule.destination_port_range.split("-")[1]) >= 22 ) ) - and rule.protocol in ["TCP", "*"] + and rule.protocol in ["TCP", "Tcp", "*"] and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"] and rule.access == "Allow" and rule.direction == "Inbound" diff --git a/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py b/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py index 4fab26f1ec..387c9f4483 100644 --- a/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py @@ -15,7 +15,7 @@ class network_udp_internet_access_restricted(Check): report.location = security_group.location report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has UDP internet access restricted." rule_fail_condition = any( - rule.protocol in ["UDP"] + rule.protocol in ["UDP", "Udp"] and rule.source_address_prefix in ["Internet", "*", "0.0.0.0/0"] and rule.access == "Allow" and rule.direction == "Inbound"