feat(terraform): add CKV NCP rules about Network ACL.

checkov/terraform/checks/resource/ncp/NACLInbound20.py

@@ -0,0 +1,9 @@
+from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck
+
+
+class NACLInbound20(NACLInboundCheck):
+    def __init__(self):
+        super().__init__(check_id="CKV_NCP_8", port=20)
+
+
+check = NACLInbound20()

checkov/terraform/checks/resource/ncp/NACLInbound21.py

@@ -0,0 +1,9 @@
+from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck
+
+
+class NACLInbound21(NACLInboundCheck):
+    def __init__(self):
+        super().__init__(check_id="CKV_NCP_9", port=21)
+
+
+check = NACLInbound21()

checkov/terraform/checks/resource/ncp/NACLInbound22.py

@@ -0,0 +1,9 @@
+from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck
+
+
+class NACLInbound22(NACLInboundCheck):
+    def __init__(self):
+        super().__init__(check_id="CKV_NCP_10", port=22)
+
+
+check = NACLInbound22()

checkov/terraform/checks/resource/ncp/NACLInbound3389.py

@@ -0,0 +1,9 @@
+from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck
+
+
+class NACLInbound3389(NACLInboundCheck):
+    def __init__(self):
+        super().__init__(check_id="CKV_NCP_11", port=3389)
+
+
+check = NACLInbound3389()

checkov/terraform/checks/resource/ncp/NACLInboundCheck.py

@@ -0,0 +1,27 @@
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
+
+
+class NACLInboundCheck(BaseResourceCheck):
+    def __init__(self, check_id, port):
+        name = f"Ensure no NACL allow inbound from 0.0.0.0:0 to port {port}"
+        id = check_id
+        supported_resources = ('ncloud_network_acl_rule',)
+        categories = (CheckCategories.NETWORKING,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+        self.port = port
+
+    def scan_resource_conf(self, conf):
+        for inbound in conf.get('inbound', []):
+            if inbound['rule_action'] == ["ALLOW"]:
+                ip = inbound.get('ip_block', ['0.0.0.0/0'])
+                if ip == ['0.0.0.0/0'] or ip == ['::/0']:
+                    port = inbound.get('port_range', str(self.port))[0]
+                    if port == str(self.port):
+                        return CheckResult.FAILED
+                    elif port.find('-'):
+                        port_range = list(map(int, port.split("-")))
+                        if port_range[0] <= self.port <= port_range[-1]:
+                            return CheckResult.FAILED
+
+        return CheckResult.PASSED

tests/terraform/checks/resource/ncp/example_NACLInbound20/main.tf

@@ -0,0 +1,83 @@
+resource "ncloud_network_acl_rule" "pass" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "10.3.0.0/18"
+    port_range  = "20"
+  }
+}
+
+resource "ncloud_network_acl_rule" "pass1" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 110
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "222"
+  }
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "10.0.0.0/32"
+    port_range  = "19-21"
+  }
+
+  inbound {
+    priority    = 120
+    protocol    = "TCP"
+    rule_action = "DROP"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "20"
+  }
+
+    outbound {
+    priority    = 199
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "20"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "20"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail1" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "::/0"
+    port_range  = "20"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail2" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "3-40"
+  }
+}

tests/terraform/checks/resource/ncp/example_NACLInbound21/main.tf

@@ -0,0 +1,83 @@
+resource "ncloud_network_acl_rule" "pass" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "10.3.0.0/18"
+    port_range  = "21"
+  }
+}
+
+resource "ncloud_network_acl_rule" "pass1" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 110
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "222"
+  }
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "10.0.0.0/32"
+    port_range  = "19-22"
+  }
+
+  inbound {
+    priority    = 120
+    protocol    = "TCP"
+    rule_action = "DROP"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "21"
+  }
+
+    outbound {
+    priority    = 199
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "21"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "21"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail1" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "::/0"
+    port_range  = "21"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail2" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "3-40"
+  }
+}

tests/terraform/checks/resource/ncp/example_NACLInbound22/main.tf

@@ -0,0 +1,83 @@
+resource "ncloud_network_acl_rule" "pass" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "10.3.0.0/18"
+    port_range  = "22"
+  }
+}
+
+resource "ncloud_network_acl_rule" "pass1" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 110
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "222"
+  }
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "10.0.0.0/32"
+    port_range  = "19-23"
+  }
+
+  inbound {
+    priority    = 120
+    protocol    = "TCP"
+    rule_action = "DROP"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "22"
+  }
+
+    outbound {
+    priority    = 199
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "22"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "22"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail1" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "::/0"
+    port_range  = "22"
+  }
+}
+
+resource "ncloud_network_acl_rule" "fail2" {
+  network_acl_no    = ncloud_network_acl.nacl.id
+
+  inbound {
+    priority    = 100
+    protocol    = "TCP"
+    rule_action = "ALLOW"
+    ip_block    = "0.0.0.0/0"
+    port_range  = "3-40"
+  }
+}