# Network helpers ==============================================================
# Shared ingress rule extraction and port/CIDR checks for CMP and NCD packages.

package common.network

ingress_rules(rc) := rc.change.after.ingress if rc.type == "aws_security_group"

ingress_rules(rc) := [rc.change.after] if rc.type == "aws_vpc_security_group_ingress_rule"

unrestricted_cidr(rule) if rule.cidr_blocks[_] == "0.0.0.0/0"
unrestricted_cidr(rule) if rule.ipv6_cidr_blocks[_] == "::/0"
unrestricted_cidr(rule) if rule.cidr_ipv4 == "0.0.0.0/0"
unrestricted_cidr(rule) if rule.cidr_ipv6 == "::/0"

port_in_range(port, rule) if {
	rule.from_port <= port
	rule.to_port >= port
}