feat(azure): Add new checks related to Network service #3402

pedrooot · 2024-02-15T13:17:31Z

Context

This pr adds 7 new checks related to network service.

Description

The checks that are included in this pr are:

network_rdp_internet_access_restricted
network_ssh_internet_access_restricted
network_udp_internet_access_restricted
network_http_internet_access_restricted
network_flow_log_more_than_90_days
network_network_watcher_enabled
network_bastion_host_exists

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

… network service

…stricted

… related tests

…cted

…ated tests

sergargar · 2024-02-16T10:07:20Z

prowler/providers/azure/services/network/network_service.py

+                            security_rules=security_group.security_rules,
+                            network_watchers=network_watchers,
+                            subscription_locations=subscription_locations,
+                            flow_logs=self.__get_flow_logs__(subscription),


can you do it up like the others?

sergargar · 2024-02-16T10:09:12Z

.../providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py

+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription, bastion_hosts in network_client.bastion_hosts.items():
+            if bastion_hosts == []:


Suggested change

if bastion_hosts == []:

if not bastion_hosts:

sergargar · 2024-02-16T10:12:43Z

.../providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py

+            else:
+                status = "PASS"
+                status_extended = (
+                    f"Bastion Host from subscription {subscription} exists"


Please, add here the bastion hosts that are available

sergargar · 2024-02-16T10:15:11Z

...re/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py

+                    report.status = "PASS"
+                    report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has flow logs enabled for more than 90 days"
+                    has_failed = False
+                    if not has_failed:


Suggested change

if not has_failed:

sergargar · 2024-02-16T10:15:49Z

...re/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py

+                report.subscription = subscription
+                report.resource_name = security_group.name
+                report.resource_id = security_group.id
+                if security_group.flow_logs and security_group.flow_logs.__len__() > 0:


Suggested change

if security_group.flow_logs and security_group.flow_logs.__len__() > 0:

if security_group.flow_logs:

sergargar

Please, review my comments.

sergargar · 2024-02-16T10:19:09Z

...s/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py

+                report.status = "PASS"
+                report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has HTTP internet access restricted."
+                rule_fail_condition = any(
+                    rule.destination_port_range == "80"


Please, review if the rule accepts all ports or a range of ports that includes port 80.

sergargar · 2024-02-16T10:20:58Z

...rvices/network/network_network_watcher_enabled/network_network_watcher_enabled.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "network_network_watcher_enabled",


Suggested change

"CheckID": "network_network_watcher_enabled",

"CheckID": "network_watcher_enabled",

sergargar · 2024-02-16T10:24:58Z

prowler/providers/azure/services/network/network_service.py

+        self.bastion_hosts = self.__get_bastion_hosts__()
+
+    def __get_security_groups__(self, token):
+        logger.info("SQL Server - Getting Network Security Groups...")


Please, remove SQL Server from the INFO logs.

sergargar · 2024-02-16T10:25:28Z

prowler/providers/azure/services/network/network_service.py

+                security_groups.update({subscription: []})
+                security_groups_list = client.network_security_groups.list_all()
+                available_locations = {}
+                network_watchers = self.__get_network_watchers__(client, subscription)


Please, do a separate function and class for Network Watchers.

sergargar · 2024-02-16T10:26:46Z

prowler/providers/azure/services/network/network_service.py

+                            security_rules=security_group.security_rules,
+                            network_watchers=network_watchers,
+                            subscription_locations=subscription_locations,
+                            flow_logs=self.__get_flow_logs__(subscription),


add it to the new Network Watchers class

sergargar · 2024-02-16T10:27:16Z

...ces/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py

+                report.status = "PASS"
+                report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has RDP internet access restricted."
+                rule_fail_condition = any(
+                    rule.destination_port_range == "3389"


Same as HTTP check

sergargar · 2024-02-16T10:28:35Z

...ces/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py

+                report.status = "PASS"
+                report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has SSH internet access restricted."
+                rule_fail_condition = any(
+                    rule.destination_port_range == "22"


Same as previous checks

sergargar · 2024-02-16T10:29:16Z

pyproject.toml

@@ -53,6 +53,7 @@ schema = "0.7.5"
 shodan = "1.31.0"
 slack-sdk = "3.26.2"
 tabulate = "0.9.0"
+azure-mgmt-network = "^25.2.0"


Suggested change

azure-mgmt-network = "^25.2.0"

azure-mgmt-network = "25.2.0"

codecov · 2024-02-19T16:55:40Z

Codecov Report

Attention: 53 lines in your changes are missing coverage. Please review.

Comparison is base (753f32b) 85.85% compared to head (5920151) 85.76%.
Report is 1 commits behind head on master.

Files	Patch %	Lines
...roviders/azure/services/network/network_service.py	44.28%	39 Missing ⚠️
prowler/providers/azure/azure_provider.py	26.31%	14 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3402      +/-   ##
==========================================
- Coverage   85.85%   85.76%   -0.10%     
==========================================
  Files         609      618       +9     
  Lines       19369    19615     +246     
==========================================
+ Hits        16630    16823     +193     
- Misses       2739     2792      +53

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

sergargar · 2024-02-20T10:26:44Z

prowler/providers/azure/services/network/network_service.py

+                            name=security_group.name,
+                            location=security_group.location,
+                            security_rules=security_group.security_rules,
+                            subscription_locations=subscription_locations,


Suggested change

subscription_locations=subscription_locations,

sergargar · 2024-02-20T10:26:53Z

prowler/providers/azure/services/network/network_service.py

+                security_groups_list = client.network_security_groups.list_all()
+                for security_group in security_groups_list:
+                    subscription_id = security_group.id.split("/")[2]
+                    subscription_locations = audit_info.locations[subscription_id]


Suggested change

subscription_locations = audit_info.locations[subscription_id]

sergargar · 2024-02-20T10:28:37Z

prowler/providers/azure/services/network/network_service.py

+    name: str
+    location: str
+    security_rules: list
+    subscription_locations: list


Suggested change

subscription_locations: list

sergargar · 2024-02-20T10:29:31Z

prowler/providers/azure/services/network/network_watcher_enabled/network_watcher_enabled.py

+            for network_watcher in network_watchers:
+                nw_locations.append(network_watcher.location)
+        for subscription, security_groups in network_client.security_groups.items():
+            for security_group in security_groups:


Iterate with the locations that are in audit info, please

sergargar · 2024-02-20T10:30:47Z

tests/providers/azure/services/network/network_service_test.py

+        assert network.security_groups[AZURE_SUBSCRIPTION][
+            0
+        ].subscription_locations == ["location"]


Suggested change

assert network.security_groups[AZURE_SUBSCRIPTION][

0

].subscription_locations == ["location"]

sergargar · 2024-02-20T10:31:47Z

prowler/providers/azure/azure_provider.py

@@ -212,3 +213,31 @@ def get_identity(self):

    def get_region_config(self):
        return self.region_config
+
+    def get_locations(self, credentials, region_config):


Please, add tests to this function

sergargar

Awesome PR!!

pedrooot added 18 commits February 14, 2024 12:04

feat(azure): add new check network_rdp_internet_access_restricted and…

c11ca6a

… network service

refactor(check): change logic of check network_rdp_internet_access_re…

f7ed12a

…stricted

feat(azure): add test of new network service

5c9dad7

feat(azure): add test of check network_rdp_internet_access_restricted

91a6a78

fix(print): delete print

30bc0ee

feat(azure): add new check network_ssh_internet_access_restricted and…

c4a9db5

… related tests

feat(azure): add new check network_udp_internet_access_restricted and…

05f5997

… related tests

feat(azure): remove print

5ecc6d4

feat(azure): add new check network_http_internet_access_restricted

eb9a0dc

feat(azure): add tests related to network_http_internet_access_restri…

8d6b0c1

…cted

refactor(azure): change network service

0af9f85

refactor(azure): modify tests to new service changes

18cef2b

feat(azure): add new check network_network_watcher_enabled

dafe69d

feat(azure): add tests related to network_network_watcher_enabled

2a55dc9

feat(azure): add new check network_flow_log_more_than_90_days and rel…

1db22ee

…ated tests

feat(azure): add new check network_bastion_exists

09a3912

fix(azure): fix check metadata

16019ba

feat(azure): add test related to new check network_bastion_host_exists

c2ae634

pedrooot requested a review from a team as a code owner February 15, 2024 13:17

pedrooot added 3 commits February 16, 2024 09:16

Merge branch 'master' into azure_network_checks

ad45476

fix poetry.lock

6bdac33

fix(azure): fix network service token failure

90b80c9

sergargar reviewed Feb 16, 2024

View reviewed changes

sergargar requested changes Feb 16, 2024

View reviewed changes

pedrooot added 2 commits February 19, 2024 10:58

resolve comments

e5b1adc

Merge branch 'master' into azure_network_checks

4146969

pedrooot added 2 commits February 19, 2024 11:02

fix poetry lock

46c3fe7

resolve comments

1551c32

github-actions bot added the provider/azure Issues/PRs related with the Azure provider label Feb 19, 2024

pedrooot added 5 commits February 19, 2024 16:11

fix tests

17399f2

fix tests

5453066

fix tests

8621893

fix tests

b86261c

fix tests

f1f021a

sergargar reviewed Feb 20, 2024

View reviewed changes

resolve comments

03ff440

sergargar self-requested a review February 20, 2024 13:02

sergargar previously approved these changes Feb 20, 2024

View reviewed changes

Merge branch 'master' into azure_network_checks

b49a814

sergargar dismissed their stale review via b49a814 February 20, 2024 13:04

fix poetry lock

827da25

sergargar self-requested a review February 20, 2024 13:13

sergargar previously approved these changes Feb 20, 2024

View reviewed changes

fix tests

5920151

pedrooot dismissed sergargar’s stale review via 5920151 February 20, 2024 13:51

sergargar approved these changes Feb 20, 2024

View reviewed changes

sergargar merged commit 9a22c2d into prowler-cloud:master Feb 20, 2024
8 of 10 checks passed

	if security_group.flow_logs and security_group.flow_logs.__len__() > 0:
	if security_group.flow_logs:

	"CheckID": "network_network_watcher_enabled",
	"CheckID": "network_watcher_enabled",

	assert network.security_groups[AZURE_SUBSCRIPTION][
	0
	].subscription_locations == ["location"]

feat(azure): Add new checks related to Network service #3402

feat(azure): Add new checks related to Network service #3402

Conversation

pedrooot commented Feb 15, 2024 • edited

Context

Description

License

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sergargar left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Feb 19, 2024 • edited

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sergargar left a comment

Choose a reason for hiding this comment

pedrooot commented Feb 15, 2024 •

edited

codecov bot commented Feb 19, 2024 •

edited