RHEL9-CIS/tasks/section_3/cis_3.2.x.yml

---

- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
  block:
      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
      - block:
          - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding | Set Fact"
            set_fact:
                flush_ipv6_route: true

          - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
            debug:
                msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
        
        when: rhel9cis_ipv6_required
  when:
      - not rhel9cis_is_router
      - rhel9cis_rule_3_2_1
  tags:
      - level1-server
      - level1-workstation
      - automated
      - sysctl
      - patch
      - rule_3.2.1

- name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
  block:
      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - not rhel9cis_is_router
      - rhel9cis_rule_3_2_2
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - sysctl
      - rule_3.2.2