Add header and trailer to rule-files

Author: klump

modules/iptables/manifests/ng.pp

@@ -46,6 +46,8 @@
 
 ) {
 
+  $chains_header = $chains.map |$chain,$policy| { sprintf(":%s %s [0:0]", $chain, $policy) }
+
   $enforce_command = '/usr/local/sbin/enforce-iptables'
   file { 'enforce-command':
     path   => $enforce_command,
@@ -74,6 +76,22 @@
     notify         => Exec['enforce-puppet-iptables'],
   }
 
+  concat::fragment { '00-ipv4-header'
+    target  => $ipv4file,
+    order   => 0,
+    content => ([
+     '*filter'
+    ] + $chains_header).join('\n'),
+  }
+
+  concat::fragment { '99-ipv4-trailer'
+    target  => $ipv4file,
+    order   => 9999,
+    content => [
+      'COMMIT'
+    ].join('\n'),
+  }
+
   exec { 'enforce-puppet-iptables':
     command     => "/usr/bin/echo ${enforce_command} ipv4 '${ipv4file}'",
     refreshonly => true,
@@ -108,6 +126,22 @@
     notify         => Exec['enforce-puppet-ip6tables'],
   }
 
+  concat::fragment { '00-ipv6-header'
+    target  => $ipv6file,
+    order   => 0,
+    content => ([
+     '*filter'
+    ] + $chains_header).join('\n'),
+  }
+
+  concat::fragment { '99-ipv6-trailer'
+    target  => $ipv6file,
+    order   => 9999,
+    content => [
+      'COMMIT',
+    ].join('\n'),
+  }
+
   exec { 'enforce-puppet-ip6tables':
     command     => "/usr/bin/echo ${enforce_command} ipv6 '${ipv6file}'",
     refreshonly => true,