Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_9 & CKV_AZURE_10 - Scan fails if protocol value is a wildcard
**Describe the issue**
CKV_AZURE_9 & CKV_AZURE_10

When scanning Bicep files the checks are looking for a protocol value of `tcp` and fail to catch when `*` is used.

**Examples**

The following bicep code fails to produce a finding for CKV_AZURE_9 & CKV_AZURE_10
```
resource nsg 'Microsoft.Network/networkSecurityGroups@2021-05-01' = {
  name: nsgName
  location: nsgLocation
  properties: {
    securityRules: [
      {
        name: 'badrule'
        properties: {
          access: 'Allow'
          destinationAddressPrefix: '*'
          destinationPortRange: '*'
          direction: 'Inbound'
          priority: 100
          protocol: '*'
          sourceAddressPrefix: '*'
          sourcePortRange: '*'
        }
      }
    ]
  }
}
```

While this works as expected:
```
resource nsg 'Microsoft.Network/networkSecurityGroups@2021-05-01' = {
  name: nsgName
  location: nsgLocation
  properties: {
    securityRules: [
      {
        name: 'badrule'
        properties: {
          access: 'Allow'
          destinationAddressPrefix: '*'
          destinationPortRange: '*'
          direction: 'Inbound'
          priority: 100
          protocol: 'tcp'
          sourceAddressPrefix: '*'
          sourcePortRange: '*'
        }
      }
    ]
  }
}
```

**Version (please complete the following information):**
 - docker container 2.2.0

**Additional context**
A similar problem existed for Terraform that was previously fixed (see https://github.com/bridgecrewio/checkov/issues/601) 

I believe the relevant lines is: 
https://github.com/bridgecrewio/checkov/blob/master/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py#LL48C4-L48C117




Discussion:

Resolving patch:
diff --git a/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py b/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py
--- a/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py
+++ b/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py
@@ -45,7 +45,7 @@ def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult:
                 if "properties" in rule:
                     if "access" in rule["properties"] and rule["properties"]["access"].lower() == "allow":
                         if "direction" in rule["properties"] and rule["properties"]["direction"].lower() == "inbound":
-                            if "protocol" in rule["properties"] and rule["properties"]["protocol"].lower() == "tcp":
+                            if "protocol" in rule["properties"] and rule["properties"]["protocol"].lower() in ("tcp", "*"):
                                 if "destinationPortRanges" in rule["properties"]:
                                     portRanges.extend(rule["properties"]["destinationPortRanges"])
                                 if "destinationPortRange" in rule["properties"]:


Test patch:
diff --git a/tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-FAILED.json b/tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-FAILED.json
--- a/tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-FAILED.json
+++ b/tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-FAILED.json
@@ -122,6 +122,30 @@
         ]
       }
     },
+    {
+      "comments": "Wildcard protocol rule",
+      "type": "Microsoft.Network/networkSecurityGroups",
+      "apiVersion": "2019-08-01",
+      "name": "[variables('networkSecurityGroupName')]",
+      "location": "[resourceGroup().location]",
+      "properties": {
+        "securityRules": [
+          {
+            "name": "default-allow-3389",
+            "properties": {
+              "priority": 1000,
+              "access": "Allow",
+              "direction": "Inbound",
+              "destinationPortRange": "3389",
+              "protocol": "*",
+              "sourceAddressPrefix": "*",
+              "sourcePortRange": "*",
+              "destinationAddressPrefix": "*"
+            }
+          }
+        ]
+      }
+    },
     {
       "type": "Microsoft.Network/virtualNetworks",
       "name": "[variables('virtualNetworkName')]",
diff --git a/tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-FAILED.json b/tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-FAILED.json
--- a/tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-FAILED.json
+++ b/tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-FAILED.json
@@ -122,6 +122,30 @@
         ]
       }
     },
+    {
+      "comments": "Wildcard protocl rule",
+      "type": "Microsoft.Network/networkSecurityGroups",
+      "apiVersion": "2019-08-01",
+      "name": "[variables('networkSecurityGroupName')]",
+      "location": "[resourceGroup().location]",
+      "properties": {
+        "securityRules": [
+          {
+            "name": "default-allow-22",
+            "properties": {
+              "priority": 1000,
+              "access": "Allow",
+              "direction": "Inbound",
+              "destinationPortRange": "22",
+              "protocol": "Tcp",
+              "sourceAddressPrefix": "*",
+              "sourcePortRange": "*",
+              "destinationAddressPrefix": "*"
+            }
+          }
+        ]
+      }
+    },
     {
       "type": "Microsoft.Network/virtualNetworks",
       "name": "[variables('virtualNetworkName')]",
diff --git a/tests/arm/checks/resource/test_NSGRuleRDPAccessRestricted.py b/tests/arm/checks/resource/test_NSGRuleRDPAccessRestricted.py
--- a/tests/arm/checks/resource/test_NSGRuleRDPAccessRestricted.py
+++ b/tests/arm/checks/resource/test_NSGRuleRDPAccessRestricted.py
@@ -17,7 +17,7 @@ def test_summary(self):
         summary = report.get_summary()
 
         self.assertEqual(summary['passed'], 2)
-        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['failed'], 3)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
 
diff --git a/tests/arm/checks/resource/test_NSGRuleSSHAccessRestricted.py b/tests/arm/checks/resource/test_NSGRuleSSHAccessRestricted.py
--- a/tests/arm/checks/resource/test_NSGRuleSSHAccessRestricted.py
+++ b/tests/arm/checks/resource/test_NSGRuleSSHAccessRestricted.py
@@ -17,7 +17,7 @@ def test_summary(self):
         summary = report.get_summary()
 
         self.assertEqual(summary['passed'], 2)
-        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['failed'], 3)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)