---
- name: Mitigating CVE-2024-2961
  hosts: all
  gather_facts: true
  vars:
    folder: /home/ssh-gateway/ansible/playbook_output
    ara_playbook_name: RM9537.yaml
    ara_playbook_labels:
      - plesk
      - security
  tasks:
    - name: Check if gconv-modules-extra.conf exists
      ansible.builtin.stat:
        path: /usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf
      register: gconv_modules_extra_exist
    - name: Check if gconv-modules exists
      ansible.builtin.stat:
        path: /usr/lib64/gconv/gconv-modules
      register: gconv_modules_exist
    - name: Match and comment out block in the configuration file
      ansible.builtin.shell: |
        set -o pipefail
        file="{{ '/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf' if gconv_modules_extra_exist.stat.exists else '/usr/lib64/gconv/gconv-modules' }}"
        cp "$file" "$file".backup-"$(date +%d-%m-%Y-%H-%M)"
        grep -n "ISO2022CNEXT//" "$file" | while read -r line; do line_number=$(echo "$line" | cut -d':' -f1); sed -i "${line_number},$((line_number + 2)) s/^/# /" "$file"; done
        rm -f /usr/lib64/gconv/gconv-modules.cache
      register: config_changes
      notify:
        - run_iconvconfig
      when: gconv_modules_extra_exist.stat.exists or gconv_modules_exist.stat.exists
    - name: Run iconv command and check for CN-EXT
      ansible.builtin.shell: |
        set -o pipefail
        iconv -l | grep -E 'CN-?EXT'
      args:
        executable: /bin/bash
      register: iconv_output
      ignore_errors: true
      changed_when: false
    - name: Write to file if the command has output
      ansible.builtin.lineinfile:
        dest: "{{ folder }}/RM9537-patched-or-not.txt"
        create: true
        mode: '0644'
        line: "{{ ansible_facts.nodename }} - NOT PATCHED"
      delegate_to: 127.0.0.1
      when: iconv_output.rc == 0
    - name: Write to file if the command has no output
      ansible.builtin.lineinfile:
        dest: "{{ folder }}/RM9537-patched-or-not.txt"
        create: true
        mode: '0644'
        line: "{{ ansible_facts.nodename }} - clean"
      delegate_to: 127.0.0.1
      when: iconv_output.rc != 0

  handlers:
    - name: Run iconvconfig
      ansible.builtin.command: iconvconfig
      when: config_changes.changed
      listen: run_iconvconfig