target addresses of listening ports and add control for troubleshooting

[alexpop]

Listening ports can be bound on any interface available on the node. If this is the case, the ssl resource needs to use that IP address and not localhost or target IP.

[arlimus]

Also I'm not sure if we need the Debug resource; how do you envision it?

[arlimus]

Maybe as a different suggestion: (still not happy here)

invalid_addrs = %w{ 127.0.0.1 0.0.0.0 ::1 :: } tcpports = ... enabled_sockets = ... ssl_list = enabled_sockets.map do |s| params = { port: s.port } params[:host] = s.address unless invalid_addrs.include?(s.address) [s, ssl(params)] end control 'tls1.2' do title 'Run TLS 1.2 whenever SSL is active on a port' impact 0.5 ssl_list.each do |socket, ssl_socket| # create a description proc_desc = "on node == #{command('hostname').stdout.strip} running #{socket.process.inspect} (#{socket.pid})" describe ssl_socket.protocols('tls1.2') do it(proc_desc) { should be_enabled } it { should be_enabled } end end end 

[alexpop]

Thanks for the feedback Dom.
I updated my branch to handle the host without the lambda method.

Also getting the hostname only once instead of 6 times per port.

I've also made a few more cosmetic changes.

I would keep the debugging control until we iron out all the edge cases.

[alexpop]

^ sample scan with this profile

[chris-rock]

@arlimus Could you please re-review @alexpop updates?

[chris-rock]

Thank you @alexpop