We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
'NoneType' object is not subscriptable
Running `checkov -d .` now emits an exception

```
2022-02-25 17:45:59,050 [MainThread  ] [ERROR]  Failed to run check: Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 for configuration: {'cidr_block': ['0.0.0.0/0'], 'egress': [False], 'network_acl_id': ['aws_default_network_acl.public.id'], 'protocol': ['-1'], 'rule_action': ['allow'], 'rule_number': [100]} at file: /modules/network/regional/main.tf
Process ForkProcess-1:
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 315, in _bootstrap
    self.run()
  File "/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 108, in run
    self._target(*self._args, **self._kwargs)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/parallelizer/parallel_runner.py", line 29, in func_wrapper
    result = original_func(item)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/runners/runner_registry.py", line 66, in <lambda>
    lambda runner: runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 119, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 215, in check_tf_definition
    self.run_all_blocks(definition, self.context, full_file_path, root_folder, report,
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 225, in run_all_blocks
    self.run_block(definition[block_type], definitions_context,
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py", line 297, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py", line 121, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py", line 135, in run_check
    result = check.run(
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 86, in run
    raise e
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 73, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 70, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py", line 41, in scan_resource_conf
    if not self.check_rule(conf):
  File "/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py", line 51, in check_rule
    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
TypeError: 'NoneType' object is not subscriptable
```

 - OS: MacOS 12.2
 - Checkov Version 2.0.902

Relevant resource maybe as follows:
```
resource "aws_network_acl_rule" "public_ingress" {
  network_acl_id = aws_default_network_acl.public.id
  rule_number    = 100
  egress         = false
  protocol       = "-1"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
}
```


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
3 from checkov.common.util.type_forcers import force_list
4 from checkov.common.util.type_forcers import force_int
5 
6 
7 class AbsNACLUnrestrictedIngress(BaseResourceCheck):
8     def __init__(self, check_id, port):
9         name = "Ensure no NACL allow ingress from 0.0.0.0:0 to port %d" % port
10         supported_resources = ['aws_network_acl', 'aws_network_acl_rule']
11         categories = [CheckCategories.NETWORKING]
12         super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)
13         self.port = port
14 
15     def scan_resource_conf(self, conf):
16         """
17 
18             Return PASS if:
19             - The NACL doesnt allows restricted ingress access to the port
20             - The resource is an aws_network_acl of type 'ingress' that does not violate the check.
21 
22             Return FAIL if:
23             - The the NACL allows unrestricted access to the port
24 
25             Return UNKNOWN if:
26             - the resource is an NACL of type 'egress', OR
27 
28         :param conf: aws_network_acl configuration
29         :return: <CheckResult>
30         """
31 
32         if conf.get("ingress"):
33             ingress = conf.get("ingress")
34             for rule in ingress:
35                 if not self.check_rule(rule):
36                     return CheckResult.FAILED
37             return CheckResult.PASSED
38         # maybe its an network_acl_rule
39         if conf.get("network_acl_id"):
40             if not conf.get("egress")[0]:
41                 if not self.check_rule(conf):
42                     return CheckResult.FAILED
43             return CheckResult.PASSED
44 
45         return CheckResult.UNKNOWN
46 
47     def check_rule(self, rule):
48         if rule.get('cidr_block'):
49             if rule.get('cidr_block') == ["0.0.0.0/0"]:
50                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
51                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
52                         return False
53         if rule.get('ipv6_cidr_block'):
54             if rule.get('ipv6_cidr_block') == ["::/0"]:
55                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
56                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
57                         return False
58         return True
59
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
--- a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
+++ b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py
@@ -48,11 +48,17 @@
         if rule.get('cidr_block'):
             if rule.get('cidr_block') == ["0.0.0.0/0"]:
                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
+                    protocol = rule.get('protocol')
+                    if protocol and str(protocol[0]) == "-1":
+                        return False
                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
                         return False
         if rule.get('ipv6_cidr_block'):
             if rule.get('ipv6_cidr_block') == ["::/0"]:
                 if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]:
+                    protocol = rule.get('protocol')
+                    if protocol and str(protocol[0]) == "-1":
+                        return False
                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):
                         return False
         return True

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\n--- a/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\n+++ b/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\n@@ -48,11 +48,17 @@\n         if rule.get('cidr_block'):\n             if rule.get('cidr_block') == [\"0.0.0.0/0\"]:\n                 if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n+                    protocol = rule.get('protocol')\n+                    if protocol and str(protocol[0]) == \"-1\":\n+                        return False\n                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                         return False\n         if rule.get('ipv6_cidr_block'):\n             if rule.get('ipv6_cidr_block') == [\"::/0\"]:\n                 if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n+                    protocol = rule.get('protocol')\n+                    if protocol and str(protocol[0]) == \"-1\":\n+                        return False\n                     if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                         return False\n         return True\n", "issue": "'NoneType' object is not subscriptable\nRunning `checkov -d .` now emits an exception\r\n\r\n```\r\n2022-02-25 17:45:59,050 [MainThread  ] [ERROR]  Failed to run check: Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 for configuration: {'cidr_block': ['0.0.0.0/0'], 'egress': [False], 'network_acl_id': ['aws_default_network_acl.public.id'], 'protocol': ['-1'], 'rule_action': ['allow'], 'rule_number': [100]} at file: /modules/network/regional/main.tf\r\nProcess ForkProcess-1:\r\nTraceback (most recent call last):\r\n  File \"/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py\", line 315, in _bootstrap\r\n    self.run()\r\n  File \"/opt/homebrew/Cellar/python@3.10/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py\", line 108, in run\r\n    self._target(*self._args, **self._kwargs)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/parallelizer/parallel_runner.py\", line 29, in func_wrapper\r\n    result = original_func(item)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/runners/runner_registry.py\", line 66, in <lambda>\r\n    lambda runner: runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 119, in run\r\n    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 215, in check_tf_definition\r\n    self.run_all_blocks(definition, self.context, full_file_path, root_folder, report,\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 225, in run_all_blocks\r\n    self.run_block(definition[block_type], definitions_context,\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/runner.py\", line 297, in run_block\r\n    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py\", line 121, in scan\r\n    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check_registry.py\", line 135, in run_check\r\n    result = check.run(\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py\", line 86, in run\r\n    raise e\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/common/checks/base_check.py\", line 73, in run\r\n    check_result[\"result\"] = self.scan_entity_conf(entity_configuration, entity_type)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py\", line 70, in scan_entity_conf\r\n    return self.scan_resource_conf(conf)\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\", line 41, in scan_resource_conf\r\n    if not self.check_rule(conf):\r\n  File \"/opt/homebrew/lib/python3.10/site-packages/checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py\", line 51, in check_rule\r\n    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\r\nTypeError: 'NoneType' object is not subscriptable\r\n```\r\n\r\n - OS: MacOS 12.2\r\n - Checkov Version 2.0.902\r\n\r\nRelevant resource maybe as follows:\r\n```\r\nresource \"aws_network_acl_rule\" \"public_ingress\" {\r\n  network_acl_id = aws_default_network_acl.public.id\r\n  rule_number    = 100\r\n  egress         = false\r\n  protocol       = \"-1\"\r\n  rule_action    = \"allow\"\r\n  cidr_block     = \"0.0.0.0/0\"\r\n}\r\n```\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.common.util.type_forcers import force_int\n\n\nclass AbsNACLUnrestrictedIngress(BaseResourceCheck):\n    def __init__(self, check_id, port):\n        name = \"Ensure no NACL allow ingress from 0.0.0.0:0 to port %d\" % port\n        supported_resources = ['aws_network_acl', 'aws_network_acl_rule']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n\n            Return PASS if:\n            - The NACL doesnt allows restricted ingress access to the port\n            - The resource is an aws_network_acl of type 'ingress' that does not violate the check.\n\n            Return FAIL if:\n            - The the NACL allows unrestricted access to the port\n\n            Return UNKNOWN if:\n            - the resource is an NACL of type 'egress', OR\n\n        :param conf: aws_network_acl configuration\n        :return: <CheckResult>\n        \"\"\"\n\n        if conf.get(\"ingress\"):\n            ingress = conf.get(\"ingress\")\n            for rule in ingress:\n                if not self.check_rule(rule):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n        # maybe its an network_acl_rule\n        if conf.get(\"network_acl_id\"):\n            if not conf.get(\"egress\")[0]:\n                if not self.check_rule(conf):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n\n        return CheckResult.UNKNOWN\n\n    def check_rule(self, rule):\n        if rule.get('cidr_block'):\n            if rule.get('cidr_block') == [\"0.0.0.0/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        if rule.get('ipv6_cidr_block'):\n            if rule.get('ipv6_cidr_block') == [\"::/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        return True\n", "path": "checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.common.util.type_forcers import force_int\n\n\nclass AbsNACLUnrestrictedIngress(BaseResourceCheck):\n    def __init__(self, check_id, port):\n        name = \"Ensure no NACL allow ingress from 0.0.0.0:0 to port %d\" % port\n        supported_resources = ['aws_network_acl', 'aws_network_acl_rule']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n\n            Return PASS if:\n            - The NACL doesnt allows restricted ingress access to the port\n            - The resource is an aws_network_acl of type 'ingress' that does not violate the check.\n\n            Return FAIL if:\n            - The the NACL allows unrestricted access to the port\n\n            Return UNKNOWN if:\n            - the resource is an NACL of type 'egress', OR\n\n        :param conf: aws_network_acl configuration\n        :return: <CheckResult>\n        \"\"\"\n\n        if conf.get(\"ingress\"):\n            ingress = conf.get(\"ingress\")\n            for rule in ingress:\n                if not self.check_rule(rule):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n        # maybe its an network_acl_rule\n        if conf.get(\"network_acl_id\"):\n            if not conf.get(\"egress\")[0]:\n                if not self.check_rule(conf):\n                    return CheckResult.FAILED\n            return CheckResult.PASSED\n\n        return CheckResult.UNKNOWN\n\n    def check_rule(self, rule):\n        if rule.get('cidr_block'):\n            if rule.get('cidr_block') == [\"0.0.0.0/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    protocol = rule.get('protocol')\n                    if protocol and str(protocol[0]) == \"-1\":\n                        return False\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        if rule.get('ipv6_cidr_block'):\n            if rule.get('ipv6_cidr_block') == [\"::/0\"]:\n                if rule.get('action') == [\"allow\"] or rule.get('rule_action') == [\"allow\"]:\n                    protocol = rule.get('protocol')\n                    if protocol and str(protocol[0]) == \"-1\":\n                        return False\n                    if int(rule.get('from_port')[0]) <= self.port <= int(rule.get('to_port')[0]):\n                        return False\n        return True\n", "path": "checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py"}]}