prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  'NoneType' object is not subscriptable
  Running `checkov -d .` now emits an exception
  
  ```
  2022-02-25 17:45:59,050 [MainThread  ] [ERROR]  Failed to run check: Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 for configuration: {'cidr_block': ['0.0.0.0/0'], 'egress': [False], 'network_acl_id': ['aws_default_network_acl.public.id'], 'protocol': ['-1'], 'rule_action': ['allow'], 'rule_number': [100]} at file: /modules/network/regional/main.tf
  Process ForkProcess-1:
  Traceback (most recent call last):
    File "/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 315, in _bootstrap
      self.run()
    File "/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 108, in run
      self._target(*self._args, **self._kwargs)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/parallelizer/parallel_runner.py", line 29, in func_wrapper
      result = original_func(item)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/runners/runner_registry.py", line 66, in <lambda>
      lambda runner: runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 119, in run
      self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 215, in check_tf_definition
      self.run_all_blocks(definition, self.context, full_file_path, root_folder, report,
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 225, in run_all_blocks
      self.run_block(definition[block_type], definitions_context,
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 297, in run_block
      results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py", line 121, in scan
      result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py", line 135, in run_check
      result = check.run(
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 86, in run
      raise e
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 73, in run
      check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 70, in scan_entity_conf
      return self.scan_resource_conf(conf)
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py", line 41, in scan_resource_conf
      if not self.check_rule(conf):
    File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py", line 51, in check_rule
      if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
  TypeError: 'NoneType' object is not subscriptable
  ```
  
   - OS: MacOS 12.2
   - Checkov Version 2.0.902
  
  Relevant resource maybe as follows:
  ```
  resource "aws_network_acl_rule" "public_ingress" {
    network_acl_id = aws_default_network_acl.public.id
    rule_number    = 100
    egress         = false
    protocol       = "-1"
    rule_action    = "allow"
    cidr_block     = "0.0.0.0/0"
  }
  ```
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 from checkov.common.util.type_forcers import force_list
  4 from checkov.common.util.type_forcers import force_int
  5 
  6 
  7 class AbsNACLUnrestrictedIngress(BaseResourceCheck):
  8     def __init__(self, check_id, port):
  9         name = "Ensure no NACL allow ingress from 0.0.0.0:0 to port %d" % port
  10         supported_resources = ['aws_network_acl', 'aws_network_acl_rule']
  11         categories = [CheckCategories.NETWORKING]
  12         super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)
  13         self.port = port
  14 
  15     def scan_resource_conf(self, conf):
  16         """
  17 
  18             Return PASS if:
  19             - The NACL doesnt allows restricted ingress access to the port
  20             - The resource is an aws_network_acl of type 'ingress' that does not violate the check.
  21 
  22             Return FAIL if:
  23             - The the NACL allows unrestricted access to the port
  24 
  25             Return UNKNOWN if:
  26             - the resource is an NACL of type 'egress', OR
  27 
  28         :param conf: aws_network_acl configuration
  29         :return: <CheckResult>
  30         """
  31 
  32         if conf.get("ingress"):
  33             ingress = conf.get("ingress")
  34             for rule in ingress:
  35                 if not self.check_rule(rule):
  36                     return CheckResult.FAILED
  37             return CheckResult.PASSED
  38         # maybe its an network_acl_rule
  39         if conf.get("network_acl_id"):
  40             if not conf.get("egress")[0]:
  41                 if not self.check_rule(conf):
  42                     return CheckResult.FAILED
  43             return CheckResult.PASSED
  44 
  45         return CheckResult.UNKNOWN
  46 
  47     def check_rule(self, rule):
  48         if rule.get('cidr_block'):
  49             if rule.get('cidr_block') == ["0.0.0.0/0"]:
  50                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
  51                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
  52                         return False
  53         if rule.get('ipv6_cidr_block'):
  54             if rule.get('ipv6_cidr_block') == ["::/0"]:
  55                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
  56                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
  57                         return False
  58         return True
  59
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
  --- a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
  +++ b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
  @@ -48,11 +48,17 @@
           if rule.get('cidr_block'):
               if rule.get('cidr_block') == ["0.0.0.0/0"]:
                   if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
  +                    protocol = rule.get('protocol')
  +                    if protocol and str(protocol[0]) == "-1":
  +                        return False
                       if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
                           return False
           if rule.get('ipv6_cidr_block'):
               if rule.get('ipv6_cidr_block') == ["::/0"]:
                   if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
  +                    protocol = rule.get('protocol')
  +                    if protocol and str(protocol[0]) == "-1":
  +                        return False
                       if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
                           return False
           return True
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\n--- a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\n+++ b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\n@@ -48,11 +48,17 @@\n         if rule.get('cidr_block'):\n             if rule.get('cidr_block') == [\"0.0.0.0/0\"]:\n                 if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n+                    protocol = rule.get('protocol')\n+                    if protocol and str(protocol[0]) == \"-1\":\n+                        return False\n                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                         return False\n         if rule.get('ipv6_cidr_block'):\n             if rule.get('ipv6_cidr_block') == [\"::/0\"]:\n                 if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n+                    protocol = rule.get('protocol')\n+                    if protocol and str(protocol[0]) == \"-1\":\n+                        return False\n                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                         return False\n         return True\n", "issue": "'NoneType' object is not subscriptable\nRunning `checkov -d .` now emits an exception\r\n\r\n```\r\n2022-02-25 17:45:59,050 [MainThread  ] [ERROR]  Failed to run check: Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 for configuration: {'cidr_block': ['0.0.0.0/0'], 'egress': [False], 'network_acl_id': ['aws_default_network_acl.public.id'], 'protocol': ['-1'], 'rule_action': ['allow'], 'rule_number': [100]} at file: /modules/network/regional/main.tf\r\nProcess ForkProcess-1:\r\nTraceback (most recent call last):\r\n  File \"/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py\", line 315, in _bootstrap\r\n    self.run()\r\n  File \"/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py\", line 108, in run\r\n    self._target(*self._args, **self._kwargs)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/parallelizer/parallel_runner.py\", line 29, in func_wrapper\r\n    result = original_func(item)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/runners/runner_registry.py\", line 66, in <lambda>\r\n    lambda runner: runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 119, in run\r\n    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 215, in check_tf_definition\r\n    self.run_all_blocks(definition, self.context, full_file_path, root_folder, report,\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 225, in run_all_blocks\r\n    self.run_block(definition[block_type], definitions_context,\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 297, in run_block\r\n    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py\", line 121, in scan\r\n    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py\", line 135, in run_check\r\n    result = check.run(\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py\", line 86, in run\r\n    raise e\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py\", line 73, in run\r\n    check_result[\"result\"] = self.scan_entity_conf(entity_configuration, entity_type)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py\", line 70, in scan_entity_conf\r\n    return self.scan_resource_conf(conf)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\", line 41, in scan_resource_conf\r\n    if not self.check_rule(conf):\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\", line 51, in check_rule\r\n    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\r\nTypeError: 'NoneType' object is not subscriptable\r\n```\r\n\r\n - OS: MacOS 12.2\r\n - Checkov Version 2.0.902\r\n\r\nRelevant resource maybe as follows:\r\n```\r\nresource \"aws_network_acl_rule\" \"public_ingress\" {\r\n  network_acl_id = aws_default_network_acl.public.id\r\n  rule_number    = 100\r\n  egress         = false\r\n  protocol       = \"-1\"\r\n  rule_action    = \"allow\"\r\n  cidr_block     = \"0.0.0.0/0\"\r\n}\r\n```\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.common.util.type_forcers import force_int\n\n\nclass AbsNACLUnrestrictedIngress(BaseResourceCheck):\n    def __init__(self, check_id, port):\n        name = \"Ensure no NACL allow ingress from 0.0.0.0:0 to port %d\" % port\n        supported_resources = ['aws_network_acl', 'aws_network_acl_rule']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n\n            Return PASS if:\n            - The NACL doesnt allows restricted ingress access to the port\n            - The resource is an aws_network_acl of type 'ingress' that does not violate the check.\n\n            Return FAIL if:\n            - The the NACL allows unrestricted access to the port\n\n            Return UNKNOWN if:\n            - the resource is an NACL of type 'egress', OR\n\n        :param conf: aws_network_acl configuration\n        :return: <CheckResult>\n        \"\"\"\n\n        if conf.get(\"ingress\"):\n            ingress = conf.get(\"ingress\")\n            for rule in ingress:\n                if not self.check_rule(rule):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n        # maybe its an network_acl_rule\n        if conf.get(\"network_acl_id\"):\n            if not conf.get(\"egress\")[0]:\n                if not self.check_rule(conf):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n\n        return CheckResult.UNKNOWN\n\n    def check_rule(self, rule):\n        if rule.get('cidr_block'):\n            if rule.get('cidr_block') == [\"0.0.0.0/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        if rule.get('ipv6_cidr_block'):\n            if rule.get('ipv6_cidr_block') == [\"::/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        return True\n", "path": "checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.common.util.type_forcers import force_int\n\n\nclass AbsNACLUnrestrictedIngress(BaseResourceCheck):\n    def __init__(self, check_id, port):\n        name = \"Ensure no NACL allow ingress from 0.0.0.0:0 to port %d\" % port\n        supported_resources = ['aws_network_acl', 'aws_network_acl_rule']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n\n            Return PASS if:\n            - The NACL doesnt allows restricted ingress access to the port\n            - The resource is an aws_network_acl of type 'ingress' that does not violate the check.\n\n            Return FAIL if:\n            - The the NACL allows unrestricted access to the port\n\n            Return UNKNOWN if:\n            - the resource is an NACL of type 'egress', OR\n\n        :param conf: aws_network_acl configuration\n        :return: <CheckResult>\n        \"\"\"\n\n        if conf.get(\"ingress\"):\n            ingress = conf.get(\"ingress\")\n            for rule in ingress:\n                if not self.check_rule(rule):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n        # maybe its an network_acl_rule\n        if conf.get(\"network_acl_id\"):\n            if not conf.get(\"egress\")[0]:\n                if not self.check_rule(conf):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n\n        return CheckResult.UNKNOWN\n\n    def check_rule(self, rule):\n        if rule.get('cidr_block'):\n            if rule.get('cidr_block') == [\"0.0.0.0/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    protocol = rule.get('protocol')\n                    if protocol and str(protocol[0]) == \"-1\":\n                        return False\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        if rule.get('ipv6_cidr_block'):\n            if rule.get('ipv6_cidr_block') == [\"::/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    protocol = rule.get('protocol')\n                    if protocol and str(protocol[0]) == \"-1\":\n                        return False\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        return True\n", "path": "checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py"}]}