cfengine, IPTables, and DNS

[Systems Administrator]

        Hi all.  I'm trying to roll out my iptables config from cfengine.
I've added the "### Start DNS" line to my iptables file to indicate that
the DNS servers follow that.  I probably really need an
"InsertLineIfNoLineMatching" command, but since I didn't have one, I
tried:

        { /etc/sysconfig/iptables
                BeginGroupIfFileExists "/etc/sysconfig/iptables"
                        LocateLineMatching "### Start DNS"
                        BeginGroupIfNoLineMatching "$(dnsproxyips)"
                                InsertLine "-A INPUT -s $(dnsproxyips) 53 -p 
udp -j ACCEPT"
                        EndGroup
                EndGroup
                DefineClasses "iptablesrestart"
        }

        The $(dnsproxyips) is a colon-separated list.  Is there some easy
way I can get it to iterate over it?  Or do I need two of these, one for
each DNS server?  Or should I give up and use templating or perl or
something?

        Thanks,

--
Tim Nelson
Systems Administrator
Sunet Internet
Tel: +61 3 5241 1155
Fax: +61 3 5241 6187
Web: http://www.sunet.com.au/
Email: sysadmin@sunet.com.au