Repository: forseti-security/forseti-security

Issue #1918: IAP scanner will fail if the network property of instanceGroup is empty
Created: 2018-08-21T00:09:02Z
2018-08-20 20:05:53,579 INFO [forseti-security] google.cloud.forseti.scanner.scanners.iap_scanner(_find_violations): Finding IAP violations with <google.cloud.forseti.scanner.audit.iap
_rules_engine.IapRulesEngine object at 0x7f125c1a8550>...
2018-08-20 20:05:54,110 ERROR [forseti-security] google.cloud.forseti.scanner.scanners.iap_scanner(instance_group_network_port): NetworkPort can not be constructed. Unable to find the
appropriate port from backend service or instance group.
2018-08-20 20:05:54,463 ERROR [forseti-security] google.cloud.forseti.scanner.scanners.iap_scanner(instance_group_network_port): NetworkPort can not be constructed. Unable to find the
appropriate port from backend service or instance group.
2018-08-20 20:05:54,463 ERROR [forseti-security] google.cloud.forseti.scanner.scanners.iap_scanner(instance_group_network_port): NetworkPort can not be constructed. Unable to find the
appropriate port from backend service or instance group.
2018-08-20 20:05:54,463 ERROR [forseti-security] google.cloud.forseti.scanner.scanners.iap_scanner(instance_group_network_port): NetworkPort can not be constructed. Unable to find the
appropriate port from backend service or instance group.
2018-08-20 20:05:54,689 ERROR [forseti-security] google.cloud.forseti.scanner.scanner(run): Error running scanner: IapScanner
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanner.py", line 112, in run
scanner.run()
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanners/iap_scanner.py", line 634, in run
all_violations, _ = self._find_violations(iap_data)
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanners/iap_scanner.py", line 619, in _find_violations
for (iap_resources, project_resource_counts) in iap_data:
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanners/iap_scanner.py", line 602, in _retrieve
run_data.make_iap_resource(backend, parent.full_name))
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanners/iap_scanner.py", line 321, in make_iap_resource
if self.is_alternate_service(backend_service, backend_service2):
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanners/iap_scanner.py", line 361, in is_alternate_service
backend_service2, instance_group2)
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/scanner/scanners/iap_scanner.py", line 140, in instance_group_network_port
project_id=instance_group.project_id),
File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.1.0-py2.7.egg/google/cloud/forseti/common/gcp_type/network.py", line 64, in from_url
if '://' not in url:
TypeError: argument of type 'NoneType' is not iterable

Duplicate issue #2294: Blacklist scanner crashes if no network interfaces found
Created: 2018-11-26T16:48:14Z
[forseti-security][2.7.0] google.cloud.forseti.scanner.scanners.blacklist_scanner(get_instance_networks_interfaces): No VM network interfaces found. Exiting.
[forseti-security][2.7.0] google.cloud.forseti.scanner.scanner(run): Error running scanner: BlacklistScanner Traceback (most recent call last): File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.7.0-py2.7.egg/google/cloud/forseti/scanner/scanner.py", line 111, in run scanner.run() File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.7.0-py2.7.egg/google/cloud/forseti/scanner/scanners/blacklist_scanner.py", line 144, in run self._find_violations(instances_network_interface_data)) File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.7.0-py2.7.egg/google/cloud/forseti/scanner/scanners/blacklist_scanner.py", line 137, in _find_violations all_violations.extend(violations) File "/usr/local/lib/python2.7/dist-packages/forseti_security-2.7.0-py2.7.egg/google/cloud/forseti/scanner/audit/blacklist_rules_engine.py", line 216, in find_violations for network_interface in instance_network_interface: TypeError: 'NoneType' object is not iterable

The _retrieve code in the rule generator is hitting this line:
        if not network_interfaces:
            LOGGER.warn('No VM network interfaces found. Exiting.')
            return None, 0

I think just making this return [], 0 should work? Though I haven't dug through the rule generator code to see what would happen in this case.

Closing comment (2018-11-26T18:02:48Z): Might be related to : #1918