Repository: bridgecrewio/checkov

Issue:
'NoneType' object is not subscriptable
Running `checkov -d .` now emits an exception

```
2022-02-25 17:45:59,050 [MainThread  ] [ERROR]  Failed to run check: Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 for configuration: {'cidr_block': ['0.0.0.0/0'], 'egress': [False], 'network_acl_id': ['aws_default_network_acl.public.id'], 'protocol': ['-1'], 'rule_action': ['allow'], 'rule_number': [100]} at file: /modules/network/regional/main.tf
Process ForkProcess-1:
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 315, in _bootstrap
    self.run()
  File "/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 108, in run
    self._target(*self._args, **self._kwargs)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/parallelizer/parallel_runner.py", line 29, in func_wrapper
    result = original_func(item)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/runners/runner_registry.py", line 66, in <lambda>
    lambda runner: runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 119, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 215, in check_tf_definition
    self.run_all_blocks(definition, self.context, full_file_path, root_folder, report,
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 225, in run_all_blocks
    self.run_block(definition[block_type], definitions_context,
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 297, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py", line 121, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py", line 135, in run_check
    result = check.run(
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 86, in run
    raise e
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 73, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 70, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py", line 41, in scan_resource_conf
    if not self.check_rule(conf):
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py", line 51, in check_rule
    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
TypeError: 'NoneType' object is not subscriptable
```

 - OS: MacOS 12.2
 - Checkov Version 2.0.902

Relevant resource maybe as follows:
```
resource "aws_network_acl_rule" "public_ingress" {
  network_acl_id = aws_default_network_acl.public.id
  rule_number    = 100
  egress         = false
  protocol       = "-1"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
}
```



Discussion:
hi @MrHash thanks for raising this issue and adding an example 🏅 

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
--- a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
+++ b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
@@ -48,11 +48,17 @@ def check_rule(self, rule):
         if rule.get('cidr_block'):
             if rule.get('cidr_block') == ["0.0.0.0/0"]:
                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
+                    protocol = rule.get('protocol')
+                    if protocol and str(protocol[0]) == "-1":
+                        return False
                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
                         return False
         if rule.get('ipv6_cidr_block'):
             if rule.get('ipv6_cidr_block') == ["::/0"]:
                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
+                    protocol = rule.get('protocol')
+                    if protocol and str(protocol[0]) == "-1":
+                        return False
                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
                         return False
         return True


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/main.tf b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/main.tf
--- a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/main.tf
+++ b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/main.tf
@@ -246,3 +246,12 @@ resource "aws_network_acl_rule" "pass2" {
   to_port        = 25
 }
 
+# open all
+resource "aws_network_acl_rule" "public_ingress" {
+  network_acl_id = aws_network_acl.pass.id
+  rule_number    = 100
+  egress         = false
+  protocol       = "-1"
+  rule_action    = "allow"
+  cidr_block     = "0.0.0.0/0"
+}
diff --git a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress21/main.tf b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress21/main.tf
--- a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress21/main.tf
+++ b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress21/main.tf
@@ -254,3 +254,13 @@ resource "aws_network_acl_rule" "pass2" {
   from_port      = 5
   to_port        = 25
 }
+
+# open all
+resource "aws_network_acl_rule" "public_ingress" {
+  network_acl_id = aws_network_acl.pass.id
+  rule_number    = 100
+  egress         = false
+  protocol       = "-1"
+  rule_action    = "allow"
+  cidr_block     = "0.0.0.0/0"
+}
diff --git a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress22/main.tf b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress22/main.tf
--- a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress22/main.tf
+++ b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress22/main.tf
@@ -252,3 +252,13 @@ resource "aws_network_acl_rule" "pass2" {
   from_port      = 5
   to_port        = 25
 }
+
+# open all
+resource "aws_network_acl_rule" "public_ingress" {
+  network_acl_id = aws_network_acl.pass.id
+  rule_number    = 100
+  egress         = false
+  protocol       = "-1"
+  rule_action    = "allow"
+  cidr_block     = "0.0.0.0/0"
+}
diff --git a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress3389/main.tf b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress3389/main.tf
--- a/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress3389/main.tf
+++ b/tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress3389/main.tf
@@ -247,4 +247,14 @@ resource "aws_vpc" "main" {
 
 provider "aws" {
   region="eu-west-2"
-}
\ No newline at end of file
+}
+
+# open all
+resource "aws_network_acl_rule" "public_ingress" {
+  network_acl_id = aws_network_acl.pass.id
+  rule_number    = 100
+  egress         = false
+  protocol       = "-1"
+  rule_action    = "allow"
+  cidr_block     = "0.0.0.0/0"
+}
diff --git a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress20.py b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress20.py
--- a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress20.py
+++ b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress20.py
@@ -29,13 +29,14 @@ def test(self):
             "aws_network_acl.fail3",
             "aws_network_acl_rule.fail",
             "aws_network_acl_rule.fail2",
+            "aws_network_acl_rule.public_ingress",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary["passed"], 4)
-        self.assertEqual(summary["failed"], 5)
+        self.assertEqual(summary["failed"], 6)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
 
diff --git a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress21.py b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress21.py
--- a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress21.py
+++ b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress21.py
@@ -29,13 +29,14 @@ def test(self):
             "aws_network_acl.fail3",
             "aws_network_acl_rule.fail",
             "aws_network_acl_rule.fail2",
+            "aws_network_acl_rule.public_ingress",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary["passed"], 4)
-        self.assertEqual(summary["failed"], 5)
+        self.assertEqual(summary["failed"], 6)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
 
diff --git a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress22.py b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress22.py
--- a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress22.py
+++ b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress22.py
@@ -29,13 +29,14 @@ def test(self):
             "aws_network_acl.fail3",
             "aws_network_acl_rule.fail",
             "aws_network_acl_rule.fail2",
+            "aws_network_acl_rule.public_ingress",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary["passed"], 4)
-        self.assertEqual(summary["failed"], 5)
+        self.assertEqual(summary["failed"], 6)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
 
diff --git a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress3389.py b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress3389.py
--- a/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress3389.py
+++ b/tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress3389.py
@@ -29,13 +29,14 @@ def test(self):
             "aws_network_acl.fail3",
             "aws_network_acl_rule.fail",
             "aws_network_acl_rule.fail2",
+            "aws_network_acl_rule.public_ingress",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary["passed"], 4)
-        self.assertEqual(summary["failed"], 5)
+        self.assertEqual(summary["failed"], 6)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)