puppetlabs/puppetlabs-firewall — pull request #269 by phemmer (2013-12-17 22:34:27+00:00)
Title: purge unmanaged firewall rules with ignore support

This adds support for purging unmanaged firewall rules, with the ability to specify rules that should be ignored.

The previous method of purging firewall rules required `resources { 'firewall': purge => true }`. This would purge all unmanaged firewall rules unconditionally.
This change introduces the ability to do the following:

```
firewallchain { 'INPUT:filter:IPv4':
policy => 'drop',
purge => true,
ignore => [
'-j fail2ban-ssh',
'--comment "[^"]*(?i:ignore)[^"]*"',
],
}
```

That example will tell puppet purge rules in the `INPUT:filter:IPv4` chain (so this change also adds per-chain purge support). The purge will also skip the jump rule added by fail2ban, and also skip any rule with "ignore" in the comment (it will still properly behave if puppet itself added the rule).

---

The catch, it's currently unfinished. It works just fine in my testing, but it generates lots of warnings such as this:

```
Warning: INPUT:filter:IPv4: appears to have a negative number of dependencies
Warning: INPUT:filter:IPv4: appears to have a negative number of dependencies
Warning: Class[Common::Firewall]: appears to have a negative number of dependencies
Warning: Class[Common::Firewall]: appears to have a negative number of dependencies
```

Obviously there's something wrong with the way the `eval_generate` is working, but I'm not sure what that is.

This change has been in high demand for a long time, and I think this is a great solution, but I just need help getting this one last thing fixed.