feat(query): added "Google Compute Network Using Firewall Rule that A…

…llows All Ports" for Ansible and Terraform (Checkmarx#4512)

assets/libraries/terraform.rego

@@ -551,3 +551,9 @@ matches(target, name) {
 } else {
 	target == name
 }
+
+matches(target, name) {
+	split(target, ".")[1] == name
+} else {
+	target == name
+}

assets/queries/ansible/gcp/google_compute_network_using_firewall_rule_allows_all_ports/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "3602d273-3290-47b2-80fa-720162b1a8af",
+  "queryName": "Google Compute Network Using Firewall Rule that Allows All Ports",
+  "severity": "MEDIUM",
+  "category": "Networking and Firewall",
+  "descriptionText": "Google Compute Network should not use a firewall rule that allows all ports",
+  "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_compute_firewall_module.html#parameter-allowed",
+  "platform": "Ansible",
+  "descriptionID": "da7c0346",
+  "cloudProvider": "gcp"
+}

assets/queries/ansible/gcp/google_compute_network_using_firewall_rule_allows_all_ports/query.rego

@@ -0,0 +1,30 @@
+package Cx
+
+import data.generic.ansible as ans_lib
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+	task := ans_lib.tasks[_][t]
+	modulesFirewall := {"google.cloud.gcp_compute_firewall", "gcp_compute_firewall"}
+	firewall := task[modulesFirewall[_]]
+	ans_lib.checkState(firewall)
+
+	common_lib.is_ingress(firewall)
+	firewall.allowed[_].ports[0] == "0-65535"
+
+	tk := ans_lib.tasks[id][_]
+	modulesCompute := {"google.cloud.gcp_compute_network", "gcp_compute_network"}
+	computeNetwork := tk[modulesCompute[m]]
+	ans_lib.checkState(computeNetwork)
+	firewall.network == sprintf("{{ %s }}", [tk.register])
+
+
+	result := {
+		"documentId": id,
+		"searchKey": sprintf("name={{%s}}.{{%s}}", [tk.name, modulesCompute[m]]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'%s' is not using a firewall rule that allows access to all ports", [modulesCompute[m]]),
+		"keyActualValue": sprintf("'%s' is using a firewall rule that allows access to all ports", [modulesCompute[m]]),
+		"searchLine": common_lib.build_search_line(["playbooks", t, modulesCompute[m]], []),
+	}
+}

assets/queries/ansible/gcp/google_compute_network_using_firewall_rule_allows_all_ports/test/negative.yaml

@@ -0,0 +1,26 @@
+- name: create a firewall
+  google.cloud.gcp_compute_firewall:
+    name: test_object
+    allowed:
+    - ip_protocol: tcp
+      ports:
+      - '22'
+    target_tags:
+    - test-ssh-server
+    - staging-ssh-server
+    source_tags:
+    - test-ssh-clients
+    project: test_project
+    auth_kind: serviceaccount
+    service_account_file: "/tmp/auth.pem"
+    state: present
+    network: "{{ my_network }}"
+- name: create a network
+  google.cloud.gcp_compute_network:
+    name: test_object
+    auto_create_subnetworks: 'true'
+    project: test_project
+    auth_kind: serviceaccount
+    service_account_file: "/tmp/auth.pem"
+    state: present
+  register: my_network

assets/queries/ansible/gcp/google_compute_network_using_firewall_rule_allows_all_ports/test/positive.yaml

@@ -0,0 +1,26 @@
+- name: create a firewall2
+  google.cloud.gcp_compute_firewall:
+    name: test_object
+    allowed:
+    - ip_protocol: tcp
+      ports:
+      - '0-65535'
+    target_tags:
+    - test-ssh-server
+    - staging-ssh-server
+    source_tags:
+    - test-ssh-clients
+    project: test_project
+    auth_kind: serviceaccount
+    service_account_file: "/tmp/auth.pem"
+    state: present
+    network: "{{ my_network2 }}"
+- name: create a network2
+  google.cloud.gcp_compute_network:
+    name: test_object
+    auto_create_subnetworks: 'true'
+    project: test_project
+    auth_kind: serviceaccount
+    service_account_file: "/tmp/auth.pem"
+    state: present
+  register: my_network2

assets/queries/ansible/gcp/google_compute_network_using_firewall_rule_allows_all_ports/test/positive_expected_result.json

@@ -0,0 +1,8 @@
+[
+  {
+    "queryName": "Google Compute Network Using Firewall Rule that Allows All Ports",
+    "severity": "MEDIUM",
+    "line": 19,
+    "fileName": "positive.yaml"
+  }
+]

assets/queries/terraform/gcp/google_compute_network_using_firewall_rule_allows_all_ports/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "22ef1d26-80f8-4a6c-8c15-f35aab3cac78",
+  "queryName": "Google Compute Network Using Firewall Rule that Allows All Ports",
+  "severity": "MEDIUM",
+  "category": "Networking and Firewall",
+  "descriptionText": "Google Compute Network should not use a firewall rule that allows all ports",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall#allow",
+  "platform": "Terraform",
+  "descriptionID": "20fce4e9",
+  "cloudProvider": "gcp"
+}

assets/queries/terraform/gcp/google_compute_network_using_firewall_rule_allows_all_ports/query.rego

@@ -0,0 +1,32 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as terra_lib
+
+CxPolicy[result] {
+
+	computeNetwork := input.document[i].resource.google_compute_network[name]
+
+	firewall := input.document[_].resource.google_compute_firewall[_]
+
+	terra_lib.matches(firewall.network, name)
+	common_lib.is_ingress(firewall)
+	all_ports(firewall.allow)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("google_compute_network[%s]", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'google_compute_network[%s]' is not using a firewall rule that allows access to all ports", [name]),
+		"keyActualValue": sprintf("'google_compute_network[%s]' is using a firewall rule that allows access to all ports", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "google_compute_network", name], []),
+	}
+}
+
+all_ports(allow) {
+	is_array(allow)
+	allow[_].ports[0] == "0-65535"
+} else {
+	is_object(allow)
+	allow.ports[0] == "0-65535"
+}

assets/queries/terraform/gcp/google_compute_network_using_firewall_rule_allows_all_ports/test/negative.tf

@@ -0,0 +1,19 @@
+resource "google_compute_firewall" "negative1" {
+  name    = "test-firewall"
+  network = google_compute_network.negative1.name
+
+  allow {
+    protocol = "icmp"
+  }
+
+  allow {
+    protocol = "tcp"
+    ports    = ["80", "8080"]
+  }
+
+  source_tags = ["web"]
+}
+
+resource "google_compute_network" "negative1" {
+  name = "test-network"
+}

assets/queries/terraform/gcp/google_compute_network_using_firewall_rule_allows_all_ports/test/positive.tf

@@ -0,0 +1,19 @@
+resource "google_compute_firewall" "positive1" {
+  name    = "test-firewall"
+  network = google_compute_network.positive1.name
+
+  allow {
+    protocol = "icmp"
+  }
+
+  allow {
+    protocol = "tcp"
+    ports    = ["0-65535"]
+  }
+
+  source_tags = ["web"]
+}
+
+resource "google_compute_network" "positive1" {
+  name = "test-network"
+}

assets/queries/terraform/gcp/google_compute_network_using_firewall_rule_allows_all_ports/test/positive_expected_result.json

@@ -0,0 +1,8 @@
+[
+	{
+		"queryName": "Google Compute Network Using Firewall Rule that Allows All Ports",
+		"severity": "MEDIUM",
+		"line": 17,
+		"fileName": "positive.tf"
+	}
+]