checkthisshitout.txt

class my_firewall (
  $purge_resources = true,
  $log_default_drop = true
) {
  if is_hash($purge_resources) {
    $purge_default_chains = {
      'PREROUTING:raw:IPv4'     => {},
      'OUTPUT:raw:IPv4'         => {},
      'PREROUTING:mangle:IPv4'  => {},
      'INPUT:mangle:IPv4'       => {},
      'FORWARD:mangle:IPv4'     => {},
      'OUTPUT:mangle:IPv4'      => {},
      'POSTROUTING:mangle:IPv4' => {},
      'PREROUTING:nat:IPv4'     => {},
      'POSTROUTING:nat:IPv4'    => {},
      'OUTPUT:nat:IPv4'         => {},
      'INPUT:filter:IPv4'       => {},
      'FORWARD:filter:IPv4'     => {},
      'OUTPUT:filter:IPv4'      => {},
    }
    $default_purge = {
      purge => true,
    }
    $purge_chains_config = util_overlay_hash($purge_default_chains, $purge_resources)

    create_resources(firewallchain, $purge_chains_config, $default_purge)
  }
  else {
    ## TODO: use is_bool() to verify it's really boolean.
    resources { 'firewall':
      purge => $purge_resources
    }
  }
}

class pewp {
    $firewall_purge = {
      'PREROUTING:mangle:IPv4' => {
        ignore => 'MARK',
      }
    }
    class { 'my_firewall':
        purge_resources => $firewall_purge,
    }
}