# platform = multi_platform_all
# reboot = false
# complexity = low
# strategy = configure
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- (xccdf-var firewalld_sshd_zone)

- name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld and NetworkManager
    packages are installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  - NetworkManager
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Collect facts about system
    services
  ansible.builtin.service_facts: null
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Remediation is applicable
    if firewalld and NetworkManager services are running
  block:

  - name: Enable SSH Server firewalld Firewall Exception - Collect NetworkManager
      connections names
    ansible.builtin.shell:
      cmd: nmcli -g UUID,TYPE con | grep -v loopback | awk -F ':' '{ print $1 }'
    register: result_nmcli_cmd_connections_names
    check_mode: false
    changed_when: false
    failed_when: false

  - name: Enable SSH Server firewalld Firewall Exception - Collect NetworkManager
      connections zones
    ansible.builtin.shell:
      cmd: nmcli -f connection.zone connection show {{ item | trim }} | awk '{ print
        $2}'
    register: result_nmcli_cmd_connections_zones
    changed_when: false
    failed_when: false
    with_items:
    - '{{ result_nmcli_cmd_connections_names.stdout_lines | default([]) }}'
    when:
    - result_nmcli_cmd_connections_names.stdout_lines is defined
    - result_nmcli_cmd_connections_names.stdout_lines | length > 0

  - name: Enable SSH Server firewalld Firewall Exception - Ensure NetworkManager connections
      are assigned to a firewalld zone
    ansible.builtin.command:
      cmd: nmcli connection modify {{ item.0 }} connection.zone {{ firewalld_sshd_zone
        }}
    register: result_nmcli_cmd_zone_assignment
    changed_when: true
    with_together:
    - '{{ result_nmcli_cmd_connections_names.stdout_lines | default([]) }}'
    - '{{ result_nmcli_cmd_connections_zones.stdout_lines | default([]) }}'
    when:
    - result_nmcli_cmd_connections_zones.stdout_lines is defined
    - result_nmcli_cmd_connections_zones.stdout_lines | length > 0
    - item.1.stdout == '--' or item.1.stdout != firewalld_sshd_zone

  - name: Enable SSH Server firewalld Firewall Exception - Ensure NetworkManager connections
      changes are applied
    ansible.builtin.service:
      name: NetworkManager
      state: restarted
    when:
    - result_nmcli_cmd_zone_assignment is defined
    - result_nmcli_cmd_zone_assignment is changed
    - result_nmcli_cmd_zone_assignment.results | selectattr('changed', 'equalto',
      true) | list | length > 0

  - name: Enable SSH Server firewalld Firewall Exception - Collect firewalld active
      zones
    ansible.builtin.shell:
      cmd: firewall-cmd --get-active-zones | grep -v "^ " | cut -d " " -f 1
    register: result_firewall_cmd_zones_names
    changed_when: false
    failed_when: false

  - name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld zones
      allow SSH
    ansible.posix.firewalld:
      zone: '{{ item }}'
      service: ssh
      permanent: true
      state: enabled
      immediate: true
    register: result_firewall_ssh_service_assignment
    with_items:
    - '{{ result_firewall_cmd_zones_names.stdout_lines | default([]) }}'
    when:
    - result_firewall_cmd_zones_names.stdout_lines is defined
    - result_firewall_cmd_zones_names.stdout_lines | length > 0
  when:
  - '"linux-base" in ansible_facts.packages'
  - ansible_facts.services['firewalld.service'].state == 'running'
  - ansible_facts.services['NetworkManager.service'].state == 'running'
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Informative message based
    on services states
  ansible.builtin.assert:
    that:
    - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
    - ansible_check_mode or ansible_facts.services['NetworkManager.service'].state
      == 'running'
    fail_msg:
    - firewalld and NetworkManager services are not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld and NetworkManager
      services running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Enable SSH Server firewalld Firewall Exception remediation successfully executed
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
