Skip to content

Commit 98e136e

Browse files
nikpivkinnikpivkin
authored
feat(misconf): port and protocol support for EC2 networks (#7146)
Signed-off-by: nikpivkin <[email protected]>
1 parent 9d7264a commit 98e136e

File tree

9 files changed

+106
-28
lines changed

9 files changed

+106
-28
lines changed

‎pkg/iac/adapters/cloudformation/aws/ec2/adapt_test.go

+19-4
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,15 @@ Resources:
5151
SecurityGroupIngress:
5252
- IpProtocol: tcp
5353
Description: ingress
54-
FromPort: 80
54+
FromPort: "80"
5555
ToPort: 80
5656
CidrIp: 0.0.0.0/0
5757
SecurityGroupEgress:
58-
- IpProtocol: tcp
58+
- IpProtocol: -1
5959
Description: egress
6060
FromPort: 80
61-
ToPort: 80
62-
CidrIp: 0.0.0.0/0
61+
ToPort: "80"
62+
CidrIp: "0.0.0.0/0"
6363
myNetworkAcl:
6464
Type: AWS::EC2::NetworkAcl
6565
Properties:
@@ -73,6 +73,9 @@ Resources:
7373
Protocol: 6
7474
RuleAction: allow
7575
CidrBlock: 172.16.0.0/24
76+
PortRange:
77+
From: 22
78+
To: "23"
7679
myLaunchConfig:
7780
Type: AWS::AutoScaling::LaunchConfiguration
7881
Properties:
@@ -137,6 +140,9 @@ Resources:
137140
CIDRs: []types.StringValue{
138141
types.StringTest("0.0.0.0/0"),
139142
},
143+
FromPort: types.IntTest(80),
144+
ToPort: types.IntTest(80),
145+
Protocol: types.StringTest("tcp"),
140146
},
141147
},
142148
EgressRules: []ec2.SecurityGroupRule{
@@ -145,6 +151,9 @@ Resources:
145151
CIDRs: []types.StringValue{
146152
types.StringTest("0.0.0.0/0"),
147153
},
154+
FromPort: types.IntTest(80),
155+
ToPort: types.IntTest(80),
156+
Protocol: types.StringTest("-1"),
148157
},
149158
},
150159
},
@@ -159,6 +168,8 @@ Resources:
159168
CIDRs: []types.StringValue{
160169
types.StringTest("172.16.0.0/24"),
161170
},
171+
FromPort: types.IntTest(22),
172+
ToPort: types.IntTest(23),
162173
},
163174
},
164175
},
@@ -309,6 +320,8 @@ Resources:
309320
CIDRs: []types.StringValue{
310321
types.StringTest("0.0.0.0/0"),
311322
},
323+
FromPort: types.IntTest(-1),
324+
ToPort: types.IntTest(-1),
312325
},
313326
},
314327
EgressRules: []ec2.SecurityGroupRule{
@@ -317,6 +330,8 @@ Resources:
317330
CIDRs: []types.StringValue{
318331
types.StringTest("0.0.0.0/0"),
319332
},
333+
FromPort: types.IntTest(-1),
334+
ToPort: types.IntTest(-1),
320335
},
321336
},
322337
},

‎pkg/iac/adapters/cloudformation/aws/ec2/nacl.go

+14-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"strconv"
55

66
"github.com/aquasecurity/trivy/pkg/iac/providers/aws/ec2"
7+
"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/cftypes"
78
"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/parser"
89
iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
910
)
@@ -29,7 +30,8 @@ func getRules(id string, ctx parser.FileContext) (rules []ec2.NetworkACLRule) {
2930
Metadata: ruleResource.Metadata(),
3031
Type: iacTypes.StringDefault(ec2.TypeIngress, ruleResource.Metadata()),
3132
Action: iacTypes.StringDefault(ec2.ActionAllow, ruleResource.Metadata()),
32-
Protocol: iacTypes.String("-1", ruleResource.Metadata()),
33+
FromPort: iacTypes.IntDefault(-1, ruleResource.Metadata()),
34+
ToPort: iacTypes.IntDefault(-1, ruleResource.Metadata()),
3335
CIDRs: nil,
3436
}
3537

@@ -62,6 +64,17 @@ func getRules(id string, ctx parser.FileContext) (rules []ec2.NetworkACLRule) {
6264
rule.CIDRs = append(rule.CIDRs, ipv6Cidr.AsStringValue())
6365
}
6466

67+
portRange := ruleResource.GetProperty("PortRange")
68+
fromPort := portRange.GetProperty("From").ConvertTo(cftypes.Int)
69+
if fromPort.IsInt() {
70+
rule.FromPort = fromPort.AsIntValue()
71+
}
72+
73+
toPort := portRange.GetProperty("To").ConvertTo(cftypes.Int)
74+
if toPort.IsInt() {
75+
rule.ToPort = toPort.AsIntValue()
76+
}
77+
6578
rules = append(rules, rule)
6679
}
6780
}

‎pkg/iac/adapters/cloudformation/aws/ec2/security_group.go

+19
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"github.com/samber/lo"
55

66
"github.com/aquasecurity/trivy/pkg/iac/providers/aws/ec2"
7+
"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/cftypes"
78
"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/parser"
89
"github.com/aquasecurity/trivy/pkg/iac/types"
910
)
@@ -75,7 +76,10 @@ func adaptRule(r interface {
7576
rule := ec2.SecurityGroupRule{
7677
Metadata: r.Metadata(),
7778
Description: r.GetStringProperty("Description"),
79+
FromPort: types.IntDefault(-1, r.Metadata()),
80+
ToPort: types.IntDefault(-1, r.Metadata()),
7881
}
82+
7983
v4Cidr := r.GetProperty("CidrIp")
8084
if v4Cidr.IsString() && v4Cidr.AsStringValue().IsNotEmpty() {
8185
rule.CIDRs = append(rule.CIDRs, types.StringExplicit(v4Cidr.AsString(), v4Cidr.Metadata()))
@@ -85,5 +89,20 @@ func adaptRule(r interface {
8589
rule.CIDRs = append(rule.CIDRs, types.StringExplicit(v6Cidr.AsString(), v6Cidr.Metadata()))
8690
}
8791

92+
fromPort := r.GetProperty("FromPort").ConvertTo(cftypes.Int)
93+
if fromPort.IsInt() {
94+
rule.FromPort = fromPort.AsIntValue()
95+
}
96+
97+
toPort := r.GetProperty("ToPort").ConvertTo(cftypes.Int)
98+
if toPort.IsInt() {
99+
rule.ToPort = toPort.AsIntValue()
100+
}
101+
102+
protocol := r.GetProperty("IpProtocol").ConvertTo(cftypes.String)
103+
if protocol.IsString() {
104+
rule.Protocol = protocol.AsStringValue()
105+
}
106+
88107
return rule
89108
}

‎pkg/iac/adapters/terraform/aws/ec2/subnet.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ func adaptSubnets(modules terraform.Modules) []ec2.Subnet {
99
var subnets []ec2.Subnet
1010
for _, module := range modules {
1111
for _, resource := range module.GetResourcesByType("aws_subnet") {
12-
subnets = append(subnets, adaptSubnet(resource, module))
12+
subnets = append(subnets, adaptSubnet(resource))
1313
}
1414
}
1515
return subnets
1616
}
1717

18-
func adaptSubnet(resource *terraform.Block, module *terraform.Module) ec2.Subnet {
18+
func adaptSubnet(resource *terraform.Block) ec2.Subnet {
1919
mapPublicIpOnLaunchAttr := resource.GetAttribute("map_public_ip_on_launch")
2020
mapPublicIpOnLaunchVal := mapPublicIpOnLaunchAttr.AsBoolValueOrDefault(false, resource)
2121

‎pkg/iac/adapters/terraform/aws/ec2/subnet_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func Test_adaptSubnet(t *testing.T) {
6161
for _, test := range tests {
6262
t.Run(test.name, func(t *testing.T) {
6363
modules := tftestutil.CreateModulesFromSource(t, test.terraform, ".tf")
64-
adapted := adaptSubnet(modules.GetBlocks()[0], modules[0])
64+
adapted := adaptSubnet(modules.GetBlocks()[0])
6565
testutil.AssertDefsecEqual(t, test.expected, adapted)
6666
})
6767
}

‎pkg/iac/adapters/terraform/aws/ec2/vpc.go

+16-18
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@ func (a *sgAdapter) adaptSecurityGroups(modules terraform.Modules) []ec2.Securit
7272
}
7373
for _, sgRule := range orphanResources {
7474
if sgRule.GetAttribute("type").Equals("ingress") {
75-
orphanage.IngressRules = append(orphanage.IngressRules, adaptSGRule(sgRule, modules))
75+
orphanage.IngressRules = append(orphanage.IngressRules, adaptSGRule(sgRule))
7676
} else if sgRule.GetAttribute("type").Equals("egress") {
77-
orphanage.EgressRules = append(orphanage.EgressRules, adaptSGRule(sgRule, modules))
77+
orphanage.EgressRules = append(orphanage.EgressRules, adaptSGRule(sgRule))
7878
}
7979
}
8080
securityGroups = append(securityGroups, orphanage)
@@ -116,21 +116,21 @@ func (a *sgAdapter) adaptSecurityGroup(resource *terraform.Block, module terrafo
116116

117117
ingressBlocks := resource.GetBlocks("ingress")
118118
for _, ingressBlock := range ingressBlocks {
119-
ingressRules = append(ingressRules, adaptSGRule(ingressBlock, module))
119+
ingressRules = append(ingressRules, adaptSGRule(ingressBlock))
120120
}
121121

122122
egressBlocks := resource.GetBlocks("egress")
123123
for _, egressBlock := range egressBlocks {
124-
egressRules = append(egressRules, adaptSGRule(egressBlock, module))
124+
egressRules = append(egressRules, adaptSGRule(egressBlock))
125125
}
126126

127127
rulesBlocks := module.GetReferencingResources(resource, "aws_security_group_rule", "security_group_id")
128128
for _, ruleBlock := range rulesBlocks {
129129
a.sgRuleIDs.Resolve(ruleBlock.ID())
130130
if ruleBlock.GetAttribute("type").Equals("ingress") {
131-
ingressRules = append(ingressRules, adaptSGRule(ruleBlock, module))
131+
ingressRules = append(ingressRules, adaptSGRule(ruleBlock))
132132
} else if ruleBlock.GetAttribute("type").Equals("egress") {
133-
egressRules = append(egressRules, adaptSGRule(ruleBlock, module))
133+
egressRules = append(egressRules, adaptSGRule(ruleBlock))
134134
}
135135
}
136136

@@ -154,24 +154,14 @@ func (a *sgAdapter) adaptSecurityGroup(resource *terraform.Block, module terrafo
154154
}
155155
}
156156

157-
func adaptSGRule(resource *terraform.Block, modules terraform.Modules) ec2.SecurityGroupRule {
157+
func adaptSGRule(resource *terraform.Block) ec2.SecurityGroupRule {
158158
ruleDescAttr := resource.GetAttribute("description")
159159
ruleDescVal := ruleDescAttr.AsStringValueOrDefault("", resource)
160160

161161
var cidrs []iacTypes.StringValue
162162

163163
cidrBlocks := resource.GetAttribute("cidr_blocks")
164164
ipv6cidrBlocks := resource.GetAttribute("ipv6_cidr_blocks")
165-
varBlocks := modules.GetBlocks().OfType("variable")
166-
167-
for _, vb := range varBlocks {
168-
if cidrBlocks.IsNotNil() && cidrBlocks.ReferencesBlock(vb) {
169-
cidrBlocks = vb.GetAttribute("default")
170-
}
171-
if ipv6cidrBlocks.IsNotNil() && ipv6cidrBlocks.ReferencesBlock(vb) {
172-
ipv6cidrBlocks = vb.GetAttribute("default")
173-
}
174-
}
175165

176166
if cidrBlocks.IsNotNil() {
177167
cidrs = cidrBlocks.AsStringValues()
@@ -185,6 +175,9 @@ func adaptSGRule(resource *terraform.Block, modules terraform.Modules) ec2.Secur
185175
Metadata: resource.GetMetadata(),
186176
Description: ruleDescVal,
187177
CIDRs: cidrs,
178+
FromPort: resource.GetAttribute("from_port").AsIntValueOrDefault(-1, resource),
179+
ToPort: resource.GetAttribute("to_port").AsIntValueOrDefault(-1, resource),
180+
Protocol: resource.GetAttribute("protocol").AsStringValueOrDefault("", resource),
188181
}
189182
}
190183

@@ -203,6 +196,9 @@ func adaptSingleSGRule(resource *terraform.Block) ec2.SecurityGroupRule {
203196
Metadata: resource.GetMetadata(),
204197
Description: description,
205198
CIDRs: cidrs,
199+
FromPort: resource.GetAttribute("from_port").AsIntValueOrDefault(-1, resource),
200+
ToPort: resource.GetAttribute("to_port").AsIntValueOrDefault(-1, resource),
201+
Protocol: resource.GetAttribute("ip_protocol").AsStringValueOrDefault("", resource),
206202
}
207203
}
208204

@@ -236,7 +232,7 @@ func adaptNetworkACLRule(resource *terraform.Block) ec2.NetworkACLRule {
236232
actionVal := actionAttr.AsStringValueOrDefault("", resource)
237233

238234
protocolAtrr := resource.GetAttribute("protocol")
239-
protocolVal := protocolAtrr.AsStringValueOrDefault("-1", resource)
235+
protocolVal := protocolAtrr.AsStringValueOrDefault("", resource)
240236

241237
cidrAttr := resource.GetAttribute("cidr_block")
242238
if cidrAttr.IsNotNil() {
@@ -253,5 +249,7 @@ func adaptNetworkACLRule(resource *terraform.Block) ec2.NetworkACLRule {
253249
Action: actionVal,
254250
Protocol: protocolVal,
255251
CIDRs: cidrs,
252+
FromPort: resource.GetAttribute("from_port").AsIntValueOrDefault(-1, resource),
253+
ToPort: resource.GetAttribute("to_port").AsIntValueOrDefault(-1, resource),
256254
}
257255
}

‎pkg/iac/adapters/terraform/aws/ec2/vpc_test.go

+23-1
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ func Test_AdaptVPC(t *testing.T) {
102102
CIDRs: []iacTypes.StringValue{
103103
iacTypes.String("4.5.6.7/32", iacTypes.NewTestMetadata()),
104104
},
105+
FromPort: iacTypes.IntTest(80),
106+
ToPort: iacTypes.IntTest(80),
107+
Protocol: iacTypes.StringTest("tcp"),
105108
},
106109
{
107110
Metadata: iacTypes.NewTestMetadata(),
@@ -111,6 +114,9 @@ func Test_AdaptVPC(t *testing.T) {
111114
iacTypes.String("1.2.3.4/32", iacTypes.NewTestMetadata()),
112115
iacTypes.String("4.5.6.7/32", iacTypes.NewTestMetadata()),
113116
},
117+
FromPort: iacTypes.IntTest(22),
118+
ToPort: iacTypes.IntTest(22),
119+
Protocol: iacTypes.StringTest("tcp"),
114120
},
115121
},
116122

@@ -121,6 +127,8 @@ func Test_AdaptVPC(t *testing.T) {
121127
CIDRs: []iacTypes.StringValue{
122128
iacTypes.String("1.2.3.4/32", iacTypes.NewTestMetadata()),
123129
},
130+
FromPort: iacTypes.IntTest(-1),
131+
ToPort: iacTypes.IntTest(-1),
124132
},
125133
},
126134
},
@@ -137,6 +145,8 @@ func Test_AdaptVPC(t *testing.T) {
137145
CIDRs: []iacTypes.StringValue{
138146
iacTypes.String("10.0.0.0/16", iacTypes.NewTestMetadata()),
139147
},
148+
FromPort: iacTypes.IntTest(22),
149+
ToPort: iacTypes.IntTest(22),
140150
},
141151
},
142152
IsDefaultRule: iacTypes.Bool(false, iacTypes.NewTestMetadata()),
@@ -169,13 +179,17 @@ func Test_AdaptVPC(t *testing.T) {
169179
{
170180
Metadata: iacTypes.NewTestMetadata(),
171181
Description: iacTypes.String("", iacTypes.NewTestMetadata()),
182+
FromPort: iacTypes.IntTest(-1),
183+
ToPort: iacTypes.IntTest(-1),
172184
},
173185
},
174186

175187
EgressRules: []ec2.SecurityGroupRule{
176188
{
177189
Metadata: iacTypes.NewTestMetadata(),
178190
Description: iacTypes.String("", iacTypes.NewTestMetadata()),
191+
FromPort: iacTypes.IntTest(-1),
192+
ToPort: iacTypes.IntTest(-1),
179193
},
180194
},
181195
},
@@ -188,7 +202,9 @@ func Test_AdaptVPC(t *testing.T) {
188202
Metadata: iacTypes.NewTestMetadata(),
189203
Type: iacTypes.String("ingress", iacTypes.NewTestMetadata()),
190204
Action: iacTypes.String("", iacTypes.NewTestMetadata()),
191-
Protocol: iacTypes.String("-1", iacTypes.NewTestMetadata()),
205+
Protocol: iacTypes.String("", iacTypes.NewTestMetadata()),
206+
FromPort: iacTypes.IntTest(-1),
207+
ToPort: iacTypes.IntTest(-1),
192208
},
193209
},
194210
IsDefaultRule: iacTypes.Bool(false, iacTypes.NewTestMetadata()),
@@ -252,13 +268,19 @@ resource "aws_vpc_security_group_ingress_rule" "test" {
252268
CIDRs: []iacTypes.StringValue{
253269
iacTypes.StringTest("0.0.0.0/0"),
254270
},
271+
Protocol: iacTypes.StringTest("tcp"),
272+
FromPort: iacTypes.IntTest(22),
273+
ToPort: iacTypes.IntTest(22),
255274
},
256275
},
257276
EgressRules: []ec2.SecurityGroupRule{
258277
{
259278
CIDRs: []iacTypes.StringValue{
260279
iacTypes.StringTest("0.0.0.0/0"),
261280
},
281+
Protocol: iacTypes.StringTest("-1"),
282+
FromPort: iacTypes.IntTest(-1),
283+
ToPort: iacTypes.IntTest(-1),
262284
},
263285
},
264286
},

‎pkg/iac/providers/aws/ec2/vpc.go

+5
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ type SecurityGroupRule struct {
2323
Metadata iacTypes.Metadata
2424
Description iacTypes.StringValue
2525
CIDRs []iacTypes.StringValue
26+
Protocol iacTypes.StringValue
27+
FromPort iacTypes.IntValue
28+
ToPort iacTypes.IntValue
2629
}
2730

2831
type VPC struct {
@@ -49,4 +52,6 @@ type NetworkACLRule struct {
4952
Action iacTypes.StringValue
5053
Protocol iacTypes.StringValue
5154
CIDRs []iacTypes.StringValue
55+
FromPort iacTypes.IntValue
56+
ToPort iacTypes.IntValue
5257
}

0 commit comments

Comments
 (0)