Skip to content

Commit 8c29d18

Browse files
mehakseedat63mehakseedat63
authored
Merge pull request #1790 from fatima99s/settingCheckENI
Added check ENI setting for open all port plugins
2 parents dc54ac8 + 0a912c0 commit 8c29d18

File tree

7 files changed

+128
-9
lines changed

7 files changed

+128
-9
lines changed

‎exports.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -965,7 +965,6 @@ module.exports = {
965965
'lbHttpsOnly' : require(__dirname + '/plugins/azure/loadbalancer/lbHttpsOnly.js'),
966966
'lbNoInstances' : require(__dirname + '/plugins/azure/loadbalancer/lbNoInstances.js'),
967967
'lbHasTags' : require(__dirname + '/plugins/azure/loadbalancer/lbHasTags.js'),
968-
'applicationGatewayHasTags' : require(__dirname + '/plugins/azure/loadbalancer/applicationGatewayHasTags.js'),
969968
'lbLogAnalyticsEnabled' : require(__dirname + '/plugins/azure/loadbalancer/lbLogAnalyticsEnabled.js'),
970969

971970
'kvRecoveryEnabled' : require(__dirname + '/plugins/azure/keyvaults/kvRecoveryEnabled.js'),
@@ -1000,6 +999,7 @@ module.exports = {
1000999
'enableDefenderForKeyVaults' : require(__dirname + '/plugins/azure/defender/enableDefenderForKeyVaults.js'),
10011000

10021001
'agWafEnabled' : require(__dirname + '/plugins/azure/applicationGateway/agWafEnabled'),
1002+
'applicationGatewayHasTags' : require(__dirname + '/plugins/azure/applicationGateway/applicationGatewayHasTags.js'),
10031003
'agSecurityLoggingEnabled' : require(__dirname + '/plugins/azure/applicationGateway/agSecurityLoggingEnabled.js'),
10041004
'agSslPolicy' : require(__dirname + '/plugins/azure/applicationGateway/agSslPolicy'),
10051005
'agPreventionModeEnabled' : require(__dirname + '/plugins/azure/applicationGateway/agPreventionModeEnabled.js'),

‎plugins/aws/ec2/openAllPortsProtocols.js‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ module.exports = {
1616
description: 'When set to true, skip checking ports for unused security groups and produce a WARN result',
1717
regex: '^(true|false)$',
1818
default: 'false',
19+
},
20+
check_network_interface: {
21+
name: 'Check Associated ENI',
22+
description: 'When set to true, checks elastic network interfaces associated to the security group and returns FAIL if both the security group and ENI are publicly exposed',
23+
regex: '^(true|false)$',
24+
default: 'false',
1925
}
2026
},
2127
compliance: {
@@ -31,9 +37,11 @@ module.exports = {
3137
run: function(cache, settings, callback) {
3238
var config = {
3339
ec2_skip_unused_groups: settings.ec2_skip_unused_groups || this.settings.ec2_skip_unused_groups.default,
40+
check_network_interface: settings.check_network_interface || this.settings.check_network_interface.default,
3441
};
3542

3643
config.ec2_skip_unused_groups = (config.ec2_skip_unused_groups == 'true');
44+
config.check_network_interface = (config.check_network_interface == 'true');
3745

3846
var results = [];
3947
var source = {};
@@ -109,6 +117,9 @@ module.exports = {
109117
usedGroups.length && !usedGroups.includes(groups[g].GroupId)) {
110118
helpers.addResult(results, 1, `Security Group: ${groups[g].GroupId} is not in use`,
111119
region, resource);
120+
} else if ( config.check_network_interface) {
121+
var resultString = `Security group:${groups[g].GroupId} (${groups[g].GroupName}) has ${strings.join(' and ')}`;
122+
helpers.checkNetworkInterface(groups[g].GroupId, groups[g].GroupName, resultString, region, results, resource, cache);
112123
} else {
113124
helpers.addResult(results, 2,
114125
'Security group: ' + groups[g].GroupId +

‎plugins/aws/ec2/openAllPortsProtocols.spec.js‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,47 @@ const describeSecurityGroups = [
7676
}
7777
],
7878
"VpcId": "vpc-99de2fe4"
79+
},
80+
{
81+
"Description": "Allows SSh access to developer",
82+
"GroupName": "spec-test-sg2",
83+
"IpPermissions": [{
84+
"IpProtocol": "tcp",
85+
"IpRanges": [
86+
{
87+
"CidrIp": "0.0.0.0/0"
88+
}
89+
],
90+
"Ipv6Ranges": [
91+
{
92+
"CidrIpv6": "::/0"
93+
}
94+
],
95+
"PrefixListIds": [],
96+
"UserIdGroupPairs": []
97+
}],
98+
"OwnerId": "12345654321",
99+
"GroupId": "sg-001",
100+
"IpPermissionsEgress": [
101+
{
102+
"FromPort": 25,
103+
"IpProtocol": "tcp",
104+
"IpRanges": [
105+
{
106+
"CidrIp": "0.0.0.0/0"
107+
}
108+
],
109+
"Ipv6Ranges": [
110+
{
111+
"CidrIpv6": "::/0"
112+
}
113+
],
114+
"PrefixListIds": [],
115+
"ToPort": 25,
116+
"UserIdGroupPairs": []
117+
}
118+
],
119+
"VpcId": "vpc-99de2fe4"
79120
}
80121
];
81122

@@ -90,7 +131,7 @@ const describeNetworkInterfaces = [
90131
},
91132
{
92133
"GroupName": "HTTP-Access",
93-
"GroupId": "sg-02e2c70cd463dca29"
134+
"GroupId": "sg-001639e564442dfec"
94135
},
95136
],
96137
"InterfaceType": "interface",
@@ -261,7 +302,7 @@ describe('openAllPortsProtocols', function () {
261302
});
262303

263304
it('should WARN if security group is unused', function (done) {
264-
const cache = createCache([describeSecurityGroups[1]], [describeNetworkInterfaces[0]], []);
305+
const cache = createCache([describeSecurityGroups[2]], [describeNetworkInterfaces[0]], []);
265306
openAllPortsProtocols.run(cache, {ec2_skip_unused_groups: 'true'}, (err, results) => {
266307
expect(results.length).to.equal(1);
267308
expect(results[0].status).to.equal(1);
@@ -294,6 +335,14 @@ describe('openAllPortsProtocols', function () {
294335
done();
295336
});
296337
});
338+
it('should PASS if open port security group attached to the network interface has no public IP associated', function (done) {
339+
const cache = createCache([describeSecurityGroups[1]], [describeNetworkInterfaces[0]], [listFunctions[0]]);
340+
openAllPortsProtocols.run(cache, {check_network_interface:'true'}, (err, results) => {
341+
expect(results.length).to.equal(1);
342+
expect(results[0].status).to.equal(0);
343+
done();
344+
});
345+
});
297346

298347
});
299348
});

‎plugins/aws/ec2/openAllPortsProtocolsEgress.js‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,22 @@ module.exports = {
1616
description: 'When set to true, skip checking ports for unused security groups and produce a WARN result',
1717
regex: '^(true|false)$',
1818
default: 'false',
19+
},
20+
check_network_interface: {
21+
name: 'Check Associated ENI',
22+
description: 'When set to true, checks elastic network interfaces associated to the security group and returns FAIL if both the security group and ENI are publicly exposed',
23+
regex: '^(true|false)$',
24+
default: 'false',
1925
}
2026
},
2127
run: function(cache, settings, callback) {
2228
var config = {
2329
ec2_skip_unused_groups: settings.ec2_skip_unused_groups || this.settings.ec2_skip_unused_groups.default,
30+
check_network_interface: settings.check_network_interface || this.settings.check_network_interface.default,
2431
};
2532

2633
config.ec2_skip_unused_groups = (config.ec2_skip_unused_groups == 'true');
34+
config.check_network_interface = (config.check_network_interface == 'true');
2735

2836
var results = [];
2937
var source = {};
@@ -89,6 +97,9 @@ module.exports = {
8997
usedGroups.length && !usedGroups.includes(group.GroupId)) {
9098
helpers.addResult(results, 1, `Security Group: ${group.GroupId} is not in use`,
9199
region, resource);
100+
} else if ( config.check_network_interface) {
101+
var resultString = `Security group:${group.GroupId} (${group.GroupName}) has ${strings.join(' and ')}`;
102+
helpers.checkNetworkInterface(group.GroupId, group.GroupName, resultString, region, results, resource, cache);
92103
} else {
93104
helpers.addResult(results, 2,
94105
'Security group: ' + group.GroupId +

‎plugins/aws/ec2/openAllPortsProtocolsEgress.spec.js‎

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,48 @@ const describeSecurityGroups = [
7676
}
7777
],
7878
"VpcId": "vpc-99de2fe4"
79-
}
79+
},
80+
{
81+
"Description": "Allows SSh access to developer",
82+
"GroupName": "spec-test-sg2",
83+
"IpPermissionsEgress": [{
84+
"IpProtocol": "tcp",
85+
"IpRanges": [
86+
{
87+
"CidrIp": "0.0.0.0/0"
88+
}
89+
],
90+
"Ipv6Ranges": [
91+
{
92+
"CidrIpv6": "::/0"
93+
}
94+
],
95+
"PrefixListIds": [],
96+
"UserIdGroupPairs": []
97+
}],
98+
"OwnerId": "12345654321",
99+
"GroupId": "sg-001639e5",
100+
"IpPermissions": [
101+
{
102+
"FromPort": 25,
103+
"IpProtocol": "tcp",
104+
"IpRanges": [
105+
{
106+
"CidrIp": "0.0.0.0/0"
107+
}
108+
],
109+
"Ipv6Ranges": [
110+
{
111+
"CidrIpv6": "::/0"
112+
}
113+
],
114+
"PrefixListIds": [],
115+
"ToPort": 25,
116+
"UserIdGroupPairs": []
117+
}
118+
],
119+
"VpcId": "vpc-99de2fe4"
120+
},
80121
];
81122

82123
const describeNetworkInterfaces = [
@@ -90,7 +131,7 @@ const describeNetworkInterfaces = [
90131
},
91132
{
92133
"GroupName": "HTTP-Access",
93-
"GroupId": "sg-02e2c70cd463dca29"
134+
"GroupId": "sg-001639e564442dfec"
94135
},
95136
],
96137
"InterfaceType": "interface",
@@ -261,7 +302,7 @@ describe('openAllPortsEgress', function () {
261302
});
262303

263304
it('should WARN if security group is unused', function (done) {
264-
const cache = createCache([describeSecurityGroups[1]], [describeNetworkInterfaces[0]], []);
305+
const cache = createCache([describeSecurityGroups[2]], [describeNetworkInterfaces[0]], []);
265306
openAllPortsEgress.run(cache, {ec2_skip_unused_groups: 'true'}, (err, results) => {
266307
expect(results.length).to.equal(1);
267308
expect(results[0].status).to.equal(1);
@@ -294,6 +335,13 @@ describe('openAllPortsEgress', function () {
294335
done();
295336
});
296337
});
297-
338+
it('should PASS if open port security group attached to the network interface has no public IP associated', function (done) {
339+
const cache = createCache([describeSecurityGroups[1]], [describeNetworkInterfaces[0]], [listFunctions[0]]);
340+
openAllPortsEgress.run(cache, {check_network_interface:'true'}, (err, results) => {
341+
expect(results.length).to.equal(1);
342+
expect(results[0].status).to.equal(0);
343+
done();
344+
});
345+
});
298346
});
299347
});

‎plugins/azure/loadbalancer/applicationGatewayHasTags.js‎ renamed to ‎plugins/azure/applicationGateway/applicationGatewayHasTags.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ const helpers = require('../../../helpers/azure');
33

44
module.exports = {
55
title: 'Application Gateway Has Tags',
6-
category: 'Load Balancer',
7-
domain: 'Availability',
6+
category: 'Application Gateway',
7+
domain: 'Network Access Control',
88
description: 'Ensures that Microsoft Azure Application Gateway has tags associated.',
99
more_info: 'Tags help you to group resources together that are related to or associated with each other. It is a best practice to tag cloud resources to better organize and gain visibility into their usage.',
1010
recommended_action: 'Modify application gateways and add tags.',

‎plugins/azure/loadbalancer/applicationGatewayHasTags.spec.js‎ renamed to ‎plugins/azure/applicationGateway/applicationGatewayHasTags.spec.js‎

File renamed without changes.

0 commit comments

Comments
 (0)