prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  CKV_AZURE_9 & CKV_AZURE_10 - Scan fails if protocol value is a wildcard
  **Describe the issue**
  CKV_AZURE_9 & CKV_AZURE_10
  
  When scanning Bicep files the checks are looking for a protocol value of `tcp` and fail to catch when `*` is used.
  
  **Examples**
  
  The following bicep code fails to produce a finding for CKV_AZURE_9 & CKV_AZURE_10
  ```
  resource nsg 'Microsoft.Network/networkSecurityGroups@2021-05-01' = {
    name: nsgName
    location: nsgLocation
    properties: {
      securityRules: [
        {
          name: 'badrule'
          properties: {
            access: 'Allow'
            destinationAddressPrefix: '*'
            destinationPortRange: '*'
            direction: 'Inbound'
            priority: 100
            protocol: '*'
            sourceAddressPrefix: '*'
            sourcePortRange: '*'
          }
        }
      ]
    }
  }
  ```
  
  While this works as expected:
  ```
  resource nsg 'Microsoft.Network/networkSecurityGroups@2021-05-01' = {
    name: nsgName
    location: nsgLocation
    properties: {
      securityRules: [
        {
          name: 'badrule'
          properties: {
            access: 'Allow'
            destinationAddressPrefix: '*'
            destinationPortRange: '*'
            direction: 'Inbound'
            priority: 100
            protocol: 'tcp'
            sourceAddressPrefix: '*'
            sourcePortRange: '*'
          }
        }
      ]
    }
  }
  ```
  
  **Version (please complete the following information):**
   - docker container 2.2.0
  
  **Additional context**
  A similar problem existed for Terraform that was previously fixed (see https://github.com/bridgecrewio/checkov/issues/601) 
  
  I believe the relevant lines is: 
  https://github.com/bridgecrewio/checkov/blob/master/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py#LL48C4-L48C117
  
  
  
  </issue>
  <code>
  [start of checkov/arm/checks/resource/NSGRulePortAccessRestricted.py]
  1 import re
  2 from typing import Union, Dict, Any
  3 
  4 from checkov.common.models.enums import CheckResult, CheckCategories
  5 from checkov.arm.base_resource_check import BaseResourceCheck
  6 
  7 # https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups
  8 # https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules
  9 
  10 INTERNET_ADDRESSES = ["*", "0.0.0.0", "<nw>/0", "/0", "internet", "any"]  # nosec
  11 PORT_RANGE = re.compile(r"\d+-\d+")
  12 
  13 
  14 class NSGRulePortAccessRestricted(BaseResourceCheck):
  15     def __init__(self, name: str, check_id: str, port: int) -> None:
  16         supported_resources = (
  17             "Microsoft.Network/networkSecurityGroups",
  18             "Microsoft.Network/networkSecurityGroups/securityRules",
  19         )
  20         categories = (CheckCategories.NETWORKING,)
  21         super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)
  22         self.port = port
  23 
  24     def is_port_in_range(self, port_range: Union[int, str]) -> bool:
  25         if re.match(PORT_RANGE, str(port_range)):
  26             start, end = int(port_range.split("-")[0]), int(port_range.split("-")[1])
  27             if start <= self.port <= end:
  28                 return True
  29         if port_range in (str(self.port), "*"):
  30             return True
  31         return False
  32 
  33     def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult:
  34         if "properties" in conf:
  35             securityRules = []
  36             if self.entity_type == "Microsoft.Network/networkSecurityGroups":
  37                 if "securityRules" in conf["properties"]:
  38                     securityRules.extend(conf["properties"]["securityRules"])
  39             if self.entity_type == "Microsoft.Network/networkSecurityGroups/securityRules":
  40                 securityRules.append(conf)
  41 
  42             for rule in securityRules:
  43                 portRanges = []
  44                 sourcePrefixes = []
  45                 if "properties" in rule:
  46                     if "access" in rule["properties"] and rule["properties"]["access"].lower() == "allow":
  47                         if "direction" in rule["properties"] and rule["properties"]["direction"].lower() == "inbound":
  48                             if "protocol" in rule["properties"] and rule["properties"]["protocol"].lower() == "tcp":
  49                                 if "destinationPortRanges" in rule["properties"]:
  50                                     portRanges.extend(rule["properties"]["destinationPortRanges"])
  51                                 if "destinationPortRange" in rule["properties"]:
  52                                     portRanges.append(rule["properties"]["destinationPortRange"])
  53 
  54                                 if "sourceAddressPrefixes" in rule["properties"]:
  55                                     sourcePrefixes.extend(rule["properties"]["sourceAddressPrefixes"])
  56                                 if "sourceAddressPrefix" in rule["properties"]:
  57                                     sourcePrefixes.append(rule["properties"]["sourceAddressPrefix"])
  58 
  59                                 for portRange in portRanges:
  60                                     if self.is_port_in_range(portRange):
  61                                         for prefix in sourcePrefixes:
  62                                             if prefix in INTERNET_ADDRESSES:
  63                                                 return CheckResult.FAILED
  64 
  65         return CheckResult.PASSED
  66
  [end of checkov/arm/checks/resource/NSGRulePortAccessRestricted.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py b/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py
  --- a/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py
  +++ b/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py
  @@ -45,7 +45,7 @@
                   if "properties" in rule:
                       if "access" in rule["properties"] and rule["properties"]["access"].lower() == "allow":
                           if "direction" in rule["properties"] and rule["properties"]["direction"].lower() == "inbound":
  -                            if "protocol" in rule["properties"] and rule["properties"]["protocol"].lower() == "tcp":
  +                            if "protocol" in rule["properties"] and rule["properties"]["protocol"].lower() in ("tcp", "*"):
                                   if "destinationPortRanges" in rule["properties"]:
                                       portRanges.extend(rule["properties"]["destinationPortRanges"])
                                   if "destinationPortRange" in rule["properties"]:
  
verification_info: {"golden_diff": "diff --git a/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py b/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py\n--- a/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py\n+++ b/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py\n@@ -45,7 +45,7 @@\n                 if \"properties\" in rule:\n                     if \"access\" in rule[\"properties\"] and rule[\"properties\"][\"access\"].lower() == \"allow\":\n                         if \"direction\" in rule[\"properties\"] and rule[\"properties\"][\"direction\"].lower() == \"inbound\":\n-                            if \"protocol\" in rule[\"properties\"] and rule[\"properties\"][\"protocol\"].lower() == \"tcp\":\n+                            if \"protocol\" in rule[\"properties\"] and rule[\"properties\"][\"protocol\"].lower() in (\"tcp\", \"*\"):\n                                 if \"destinationPortRanges\" in rule[\"properties\"]:\n                                     portRanges.extend(rule[\"properties\"][\"destinationPortRanges\"])\n                                 if \"destinationPortRange\" in rule[\"properties\"]:\n", "issue": "CKV_AZURE_9 & CKV_AZURE_10 - Scan fails if protocol value is a wildcard\n**Describe the issue**\r\nCKV_AZURE_9 & CKV_AZURE_10\r\n\r\nWhen scanning Bicep files the checks are looking for a protocol value of `tcp` and fail to catch when `*` is used.\r\n\r\n**Examples**\r\n\r\nThe following bicep code fails to produce a finding for CKV_AZURE_9 & CKV_AZURE_10\r\n```\r\nresource nsg 'Microsoft.Network/networkSecurityGroups@2021-05-01' = {\r\n  name: nsgName\r\n  location: nsgLocation\r\n  properties: {\r\n    securityRules: [\r\n      {\r\n        name: 'badrule'\r\n        properties: {\r\n          access: 'Allow'\r\n          destinationAddressPrefix: '*'\r\n          destinationPortRange: '*'\r\n          direction: 'Inbound'\r\n          priority: 100\r\n          protocol: '*'\r\n          sourceAddressPrefix: '*'\r\n          sourcePortRange: '*'\r\n        }\r\n      }\r\n    ]\r\n  }\r\n}\r\n```\r\n\r\nWhile this works as expected:\r\n```\r\nresource nsg 'Microsoft.Network/networkSecurityGroups@2021-05-01' = {\r\n  name: nsgName\r\n  location: nsgLocation\r\n  properties: {\r\n    securityRules: [\r\n      {\r\n        name: 'badrule'\r\n        properties: {\r\n          access: 'Allow'\r\n          destinationAddressPrefix: '*'\r\n          destinationPortRange: '*'\r\n          direction: 'Inbound'\r\n          priority: 100\r\n          protocol: 'tcp'\r\n          sourceAddressPrefix: '*'\r\n          sourcePortRange: '*'\r\n        }\r\n      }\r\n    ]\r\n  }\r\n}\r\n```\r\n\r\n**Version (please complete the following information):**\r\n - docker container 2.2.0\r\n\r\n**Additional context**\r\nA similar problem existed for Terraform that was previously fixed (see https://github.com/bridgecrewio/checkov/issues/601) \r\n\r\nI believe the relevant lines is: \r\nhttps://github.com/bridgecrewio/checkov/blob/master/checkov/arm/checks/resource/NSGRulePortAccessRestricted.py#LL48C4-L48C117\r\n\r\n\n", "before_files": [{"content": "import re\nfrom typing import Union, Dict, Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.arm.base_resource_check import BaseResourceCheck\n\n# https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups\n# https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules\n\nINTERNET_ADDRESSES = [\"*\", \"0.0.0.0\", \"<nw>/0\", \"/0\", \"internet\", \"any\"]  # nosec\nPORT_RANGE = re.compile(r\"\\d+-\\d+\")\n\n\nclass NSGRulePortAccessRestricted(BaseResourceCheck):\n    def __init__(self, name: str, check_id: str, port: int) -> None:\n        supported_resources = (\n            \"Microsoft.Network/networkSecurityGroups\",\n            \"Microsoft.Network/networkSecurityGroups/securityRules\",\n        )\n        categories = (CheckCategories.NETWORKING,)\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def is_port_in_range(self, port_range: Union[int, str]) -> bool:\n        if re.match(PORT_RANGE, str(port_range)):\n            start, end = int(port_range.split(\"-\")[0]), int(port_range.split(\"-\")[1])\n            if start <= self.port <= end:\n                return True\n        if port_range in (str(self.port), \"*\"):\n            return True\n        return False\n\n    def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult:\n        if \"properties\" in conf:\n            securityRules = []\n            if self.entity_type == \"Microsoft.Network/networkSecurityGroups\":\n                if \"securityRules\" in conf[\"properties\"]:\n                    securityRules.extend(conf[\"properties\"][\"securityRules\"])\n            if self.entity_type == \"Microsoft.Network/networkSecurityGroups/securityRules\":\n                securityRules.append(conf)\n\n            for rule in securityRules:\n                portRanges = []\n                sourcePrefixes = []\n                if \"properties\" in rule:\n                    if \"access\" in rule[\"properties\"] and rule[\"properties\"][\"access\"].lower() == \"allow\":\n                        if \"direction\" in rule[\"properties\"] and rule[\"properties\"][\"direction\"].lower() == \"inbound\":\n                            if \"protocol\" in rule[\"properties\"] and rule[\"properties\"][\"protocol\"].lower() == \"tcp\":\n                                if \"destinationPortRanges\" in rule[\"properties\"]:\n                                    portRanges.extend(rule[\"properties\"][\"destinationPortRanges\"])\n                                if \"destinationPortRange\" in rule[\"properties\"]:\n                                    portRanges.append(rule[\"properties\"][\"destinationPortRange\"])\n\n                                if \"sourceAddressPrefixes\" in rule[\"properties\"]:\n                                    sourcePrefixes.extend(rule[\"properties\"][\"sourceAddressPrefixes\"])\n                                if \"sourceAddressPrefix\" in rule[\"properties\"]:\n                                    sourcePrefixes.append(rule[\"properties\"][\"sourceAddressPrefix\"])\n\n                                for portRange in portRanges:\n                                    if self.is_port_in_range(portRange):\n                                        for prefix in sourcePrefixes:\n                                            if prefix in INTERNET_ADDRESSES:\n                                                return CheckResult.FAILED\n\n        return CheckResult.PASSED\n", "path": "checkov/arm/checks/resource/NSGRulePortAccessRestricted.py"}]}