RHEL9-CIS/tasks/section_3/cis_3.3.x.yml

---

- name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
  block:
      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
        notify:
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
        notify:
            - sysctl flush ipv6 route table
            - update sysctl
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_rule_3_3_1
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.1

- name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
  block:
      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
        notify:
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
        notify:
            - sysctl flush ipv6 route table
            - update sysctl
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_rule_3_3_2
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.2

- name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_3_3
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.3

- name: "3.3.4 | PATCH | Ensure suspicious packets are logged"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_3_4
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.4

- name: "3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_3_5
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.5

- name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_3_6
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.6

- name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_3_7
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.7

- name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled"
  debug:
      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_3_8
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.3.8

- name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
  block:
      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
        notify:
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl"
        notify:
            - sysctl flush ipv6 route table
            - update sysctl
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_ipv6_required
      - rhel9cis_rule_3_3_9
  tags:
      - level2-server
      - level2-workstation
      - sysctl
      - patch
      - rule_3.3.9