RHEL9-CIS/tasks/section_3/cis_3.3.x.yml

---

- name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
  block:
      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv4 | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv4"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"

      - block:
          - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv6 | Set Fact"
            set_fact:
                flush_ipv6_route: true

          - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv6"
            debug:
                msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
        
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_rule_3_3_1
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.1

- name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
  block:
      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv4 | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true

      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv4"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"

      - block:
          - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv6 | Set Fact"
            set_fact:
              flush_ipv6_route: true

          - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv6"
            debug:
                msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_rule_3_3_2
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.2

- name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted"
  block:
      - name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - rhel9cis_rule_3_3_3
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.3

- name: "3.3.4 | PATCH | Ensure suspicious packets are logged"
  block:
      - name: "3.3.4 | PATCH | Ensure suspicious packets are logged | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.3.4 | PATCH | Ensure suspicious packets are logged"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - rhel9cis_rule_3_3_4
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.4

- name: "3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored"
  block:
      - name: "3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: 3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - rhel9cis_rule_3_3_5
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.5

- name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored"
  block:
      - name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true

      - name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - rhel9cis_rule_3_3_6
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.6

- name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
  block:
      - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - rhel9cis_rule_3_3_7
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.7

- name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled"
  block:
      - name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv4_route: true
      - name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  when:
      - rhel9cis_rule_3_3_8
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.8

- name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
  block:
      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted | IPv6 | Set Fact"
        set_fact:
            sysctl_update: true
            flush_ipv6_route: true

      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted | IPv6"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl"
  when:
      - rhel9cis_ipv6_required
      - rhel9cis_rule_3_3_9
  tags:
      - level2-server
      - level2-workstation
      - sysctl
      - patch
      - rule_3.3.9