Add allow_port_from_internet matcher to azurerm_network_security_group

[gsreynolds]

Description

I need to write controls that match on arbitrary ports, not just SSH and RDP.

Additionally:

• refactor the existing allow_ssh_from_internet and allow_rdp_from_internet matchers to use allow_port_from_internet underneath
• fix handling of port range(s) (port range and port ranges in the Azure API are strings - but we need integers in matches_port? to create the Ruby Ranges and use .cover? on to check if a port is included in a security rule)
• add better integration tests for security rules.

Issues Resolved

Related: #243, #244

Check List

• New functionality includes tests
• All tests pass
• rake lint passes
• All commits have been signed-off for the Developer Certificate of Origin. See https://github.com/chef/chef/blob/master/CONTRIBUTING.md#developer-certification-of-origin-dco

[gsreynolds]

Integration tests pass:

  ✔  azurerm_network_security_group: 'Inspec-NSG' Network Security Group
     ✔  'Inspec-NSG' Network Security Group is expected to exist
     ✔  'Inspec-NSG' Network Security Group is expected not to allow rdp from internet
     ✔  'Inspec-NSG' Network Security Group is expected not to allow ssh from internet
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "1433"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "1521"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "4333"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "5432"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "139"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "1433"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "445"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "1433"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "21"
     ✔  'Inspec-NSG' Network Security Group is expected not to allow port from internet "69"
     ✔  'Inspec-NSG' Network Security Group id is expected to eq "/subscriptions/ab381f11-741d-4d18-a3a0-f0f9b37390c8/resourceGroups/Inspec-Azure-gavin/providers/Microsoft.Network/networkSecurityGroups/Inspec-NSG"
     ✔  'Inspec-NSG' Network Security Group name is expected to eq "Inspec-NSG"
     ✔  'Inspec-NSG' Network Security Group type is expected to eq "Microsoft.Network/networkSecurityGroups"
     ✔  'Inspec-NSG' Network Security Group security_rules is expected not to be empty
     ✔  'Inspec-NSG' Network Security Group default_security_rules is expected not to be empty
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to exist
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow rdp from internet
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow ssh from internet
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "1433"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "1521"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "4333"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "5432"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "139"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "1433"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "445"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "1433"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "21"
     ✔  'Inspec-NSG-Insecure' Network Security Group is expected to allow port from internet "69"
     ✔  'Inspec-NSG-Open' Network Security Group is expected to exist
     ✔  'Inspec-NSG-Open' Network Security Group is expected to allow rdp from internet
     ✔  'Inspec-NSG-Open' Network Security Group is expected to allow ssh from internet
     ✔  '' Network Security Group is expected not to exist
     ✔  '' Network Security Group is expected not to exist

[skpaterson]

Thanks @gsreynolds !

[Sum123it]

Thanks @gsreynolds @skpaterson - This was a very important feature for Inspec users!
Can we go a step ahead with these features in azure as well like we have in aws with ipv4 range for azurerm_network_security_group?

describe aws_security_group(group_name: linux_servers) do
  it { should allow_in(port: 22, ipv4_range: '10.5.0.0/16') }
  it { should_not allow_in(port: 22, ipv4_range: '0.0.0.0/0') }
end

also below features:

inbound_rules
outbound_rules

[skpaterson]

We can certainly explore that @Sum123it - #249