RHEL9-CIS/tasks/section_3/cis_3.2.x.yml

---

- name: "3.2.1 | L1 | PATCH | Ensure source routed packets are not accepted"
  block:
      - name: "3.2.1 | L1 | PATCH | Ensure source routed packets are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
        notify: 
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.2.1 | L1 | PATCH | Ensure source routed packets are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
        notify:
            - sysctl flush ipv6 route table
            - update sysctl
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_rule_3_2_1
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.1

- name: "3.2.2 | L1 | PATCH | Ensure ICMP redirects are not accepted"
  block:
      - name: "3.2.2 | L1 | PATCH | Ensure ICMP redirects are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
        notify: 
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.2.2 | L1 | PATCH | Ensure ICMP redirects are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
        notify:
            - sysctl flush ipv6 route table
            - update sysctl
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_rule_3_2_2
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.2

- name: "3.2.3 | L1 | PATCH | Ensure secure ICMP redirects are not accepted"
  debug:
    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_2_3
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.3

- name: "3.2.4 | L1 | PATCH | Ensure suspicious packets are logged"
  debug:
    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_2_4
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.4

- name: "3.2.5 | L1 | PATCH | Ensure broadcast ICMP requests are ignored"
  debug:
    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_2_5
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.5

- name: "3.2.6 | L1 | PATCH | Ensure bogus ICMP responses are ignored"
  debug:
    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_2_6
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.6

- name: "3.2.7 | L1 | PATCH | Ensure Reverse Path Filtering is enabled"
  debug:
    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_2_7
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.7

- name: "3.2.8 | L1 | PATCH | Ensure TCP SYN Cookies is enabled"
  debug:
    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
  notify: update sysctl
  when:
      - rhel9cis_rule_3_2_8
  tags:
      - level1-server
      - level1-workstation
      - sysctl
      - patch
      - rule_3.2.8

- name: "3.2.9 | L2 | PATCH | Ensure IPv6 router advertisements are not accepted"
  block:
      - name: "3.2.9 | L2 | PATCH | Ensure IPv6 router advertisements are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
        notify: 
            - update sysctl
            - sysctl flush ipv4 route table

      - name: "3.2.9 | L2 | PATCH | Ensure IPv6 router advertisements are not accepted"
        debug:
            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
        notify:
            - sysctl flush ipv6 route table
            - update sysctl
        when: rhel9cis_ipv6_required
  when:
      - rhel9cis_ipv6_required
      - rhel9cis_rule_3_2_9
  tags:
      - level2-server
      - level2-workstation
      - sysctl
      - patch
      - rule_3.2.9