Mine

cfagent.conf:

control:
   moduledirectory = ( /var/cfengine/inputs/modules )
   AddInstallable = ( "modifiedService iptables" )


iptables.conf:

control:

files:
        /etc/sysconfig/iptables mode=0644
                                owner=root
                                group=root
                                action=fixall

import:

        ussm::
                etc/iptables/iptables.ussm
        gbsm::
                etc/iptables/iptables.gbsm
        frsm::
                etc/iptables/iptables.frsm
        desm::
                etc/iptables/iptables.desm
        gsism::
                etc/iptables/iptables.gsism

        usslu::
                etc/iptables/iptables.usslu
        gbslu::
                etc/iptables/iptables.gbslu
        frslu::
                etc/iptables/iptables.frslu
        deslu::
                etc/iptables/iptables.deslu
        gsislu::
                etc/iptables/iptables.gsislu


        sdt::
                etc/iptables/iptables.sdt

        dante::
                etc/iptables/iptables.dante

        barbie::
                etc/iptables/iptables.barbie

        logdump::
                etc/iptables/iptables.logdump

        usbds::
                etc/iptables/iptables.usbds
        intlbds::
                etc/iptables/iptables.intlbds
        bds.!usbds.!intlbds::
                etc/iptables/iptables.bds


iptables.gbsm (this is the class of server i'm testing on)

control:

        AddInstallable = ( "modifiedService iptables" )

files:

        /etc/sysconfig/iptables mode=0644
                                owner=root
                                group=root
                                action=fixall

editfiles:

        any::
                { /etc/sysconfig/iptables
                        AutoCreate
                        BeginGroupIfNoLineMatching "^#CFEngine EditFiles iptables.gbsm v1.000$"
                                EmptyEntireFilePlease
                                Append "*filter"
                                Append ":INPUT DROP [0:0]"
                                Append ":FORWARD DROP [0:0]"
                                Append "-A INPUT -d 127.0.0.0/255.0.0.0 -i lo -j ACCEPT "
                                Append "-A INPUT -m state --state ESTABLISHED -j ACCEPT "
                                Append "-A INPUT -p icmp -j ACCEPT"
                                Append "-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT "
                                Append "-A INPUT -p tcp -m state --state NEW -m tcp --dport 8006 -j ACCEPT "
                                Append "-A INPUT -p tcp -m state --state NEW -m tcp --dport 13782 -j ACCEPT "
                                Append "COMMIT"
                        EndGroup
                        DefineClasses modifiedService
                }

shellcommands:

        modifiedService::
                echo "file modified restarting iptables" >> /tmp/service.debug
                echo "$CFALLCLASSES" >> /tmp/service.debug


modules:services:

#!/bin/sh

getService() {
        service="$1"
}

serviceMatch() {
        serviceClass=$1

        for cfClass in `echo $CFALLCLASSES | tr ':' ' '`; do
                if [ "$serviceClass" = "$cfClass" ]; then
                        return 0
                fi
        done
        return 1
}

modifiedService() {
        for modService in `echo $CFALLCLASSES | tr ':' ' '`; do
                if [ "$modService" = "modifiedService" ]; then
                        return 0
                fi
        done
        return 1
}

while [ $# -ne 0 ]; do

        service=$1
        shift
        echo processing service $service >> /tmp/service.debug
        echo "$CFALLCLASSES" >> /tmp/service.debug

        if serviceMatch $service; then
                echo "Found service $service" >> /tmp/service.debug
                if modifiedService; then
                        echo "executing service restart" >> /tmp/service.debug
                        echo "restarting" >> /tmp/service.debug
                fi
        else
                echo "Could not find service $service" >> /tmp/service.debug
        fi
        #if modifiedService ; then
           #if serviceMatch $service; then
                #echo "service is tagged as modified and found $service" >> /tmp/service.debug
                #/sbin/service $service restart
           #fi
           #else
                #echo "$service is not tagged as modified" >> /tmp/service.debug
        #fi
done