nwfilter: drop support for legacy iptables match syntax

Long ago we adapted to iptables changes by introducing support
for '-m conntrack':

  commit 06844ccbaa8544d7d08d568aff37bc4e3648f304
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Tue Aug 6 20:30:46 2013 -0400

    nwfilter: Use -m conntrack rather than -m state

    Since iptables version 1.4.16 '-m state --state NEW' is converted to
    '-m conntrack --ctstate NEW'. Therefore, when encountering this or later
    versions of iptables use '-m conntrack --ctstate'.

Given our supported platform targets, we no longer need to
consider a version of iptables before 1.4.16, so can drop
support for the old syntax.

The test suite updates are triggered because that never
probed for the new syntax, and so unconditionally
generated the old syntax.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index 54065a0f751ebaa94241ea32270e7fd4ac52b8e2..9bdefb1564eb70fedee7f03b5ed9362cc7ca8eea 100644 (file)
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -88,8 +88,6 @@ static enum ctdirStatus iptables_ctdir_corrected;
 #define PRINT_IPT_ROOT_CHAIN(buf, prefix, ifname) \
     g_snprintf(buf, sizeof(buf), "%c%c-%s", prefix[0], prefix[1], ifname)
 
-static bool newMatchState;
-
 #define MATCH_PHYSDEV_IN_FW   "-m", "physdev", "--physdev-in"
 #define MATCH_PHYSDEV_OUT_FW  "-m", "physdev", "--physdev-is-bridged", "--physdev-out"
 #define MATCH_PHYSDEV_OUT_OLD_FW  "-m", "physdev", "--physdev-out"
@@ -1489,16 +1487,10 @@ _iptablesCreateRuleInstance(virFirewall *fw,
     }
 
     if (match && !skipMatch) {
-        if (newMatchState)
-            virFirewallRuleAddArgList(fw, fwrule,
-                                      "-m", "conntrack",
-                                      "--ctstate", match,
-                                      NULL);
-        else
-            virFirewallRuleAddArgList(fw, fwrule,
-                                      "-m", "state",
-                                      "--state", match,
-                                      NULL);
+        virFirewallRuleAddArgList(fw, fwrule,
+                                  "-m", "conntrack",
+                                  "--ctstate", match,
+                                  NULL);
     }
 
     if (defMatch && match != NULL && !skipMatch && !hasICMPType)
@@ -3668,61 +3660,6 @@ ebiptablesDriverProbeCtdir(void)
 }
 
 
-static int
-ebiptablesDriverProbeStateMatchQuery(virFirewall *fw G_GNUC_UNUSED,
-                                     virFirewallLayer layer G_GNUC_UNUSED,
-                                     const char *const *lines,
-                                     void *opaque)
-{
-    unsigned long *version = opaque;
-    char *tmp;
-
-    if (!lines || !lines[0]) {
-        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                       _("No output from iptables --version"));
-        return -1;
-    }
-
-    /*
-     * we expect output in the format
-     * 'iptables v1.4.16'
-     */
-    if (!(tmp = strchr(lines[0], 'v')) ||
-        virStringParseVersion(version, tmp + 1, true) < 0) {
-        virReportError(VIR_ERR_INTERNAL_ERROR,
-                       _("Cannot parse version string '%s'"),
-                       lines[0]);
-        return -1;
-    }
-
-    return 0;
-}
-
-
-static int
-ebiptablesDriverProbeStateMatch(void)
-{
-    unsigned long version;
-    g_autoptr(virFirewall) fw = virFirewallNew();
-
-    virFirewallStartTransaction(fw, 0);
-    virFirewallAddRuleFull(fw, VIR_FIREWALL_LAYER_IPV4,
-                           false, ebiptablesDriverProbeStateMatchQuery, &version,
-                           "--version", NULL);
-
-    if (virFirewallApply(fw) < 0)
-        return -1;
-
-    /*
-     * since version 1.4.16 '-m state --state ...' will be converted to
-     * '-m conntrack --ctstate ...'
-     */
-    if (version >= 1 * 1000000 + 4 * 1000 + 16)
-        newMatchState = true;
-
-    return 0;
-}
-
 static int
 ebiptablesDriverInit(bool privileged)
 {
@@ -3730,8 +3667,6 @@ ebiptablesDriverInit(bool privileged)
         return 0;
 
     ebiptablesDriverProbeCtdir();
-    if (ebiptablesDriverProbeStateMatch() < 0)
-        return -1;
 
     ebiptables_driver.flags = TECHDRV_FLAG_INITIALIZED;
 

diff --git a/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args b/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args
index f0bf85e8a1b3eee12bc64fc879de7c8165dcd956..d36d63741a8d9bb8d47577680db0b92d2debcb13 100644 (file)
--- a/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args
@@ -8,8 +8,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -19,8 +19,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -32,8 +32,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -42,8 +42,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -54,8 +54,8 @@ ip6tables \
 --source a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -64,8 +64,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -74,8 +74,8 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -86,8 +86,8 @@ ip6tables \
 --source ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -96,6 +96,6 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/ah-linux.args b/tests/nwfilterxml2firewalldata/ah-linux.args
index c7e5c1eb174ccd882d624db3d9d39a5dbaf2922d..886ccfb0502d694a7d53f3ad351aa9796629ad94 100644 (file)
--- a/tests/nwfilterxml2firewalldata/ah-linux.args
+++ b/tests/nwfilterxml2firewalldata/ah-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -51,8 +51,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -71,8 +71,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -93,6 +93,6 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/all-ipv6-linux.args b/tests/nwfilterxml2firewalldata/all-ipv6-linux.args
index 5eb6033c640154c3c5fa5baca2e7c8244248a2f3..732627c54613df7a7f7c5b4c9dd576cd2dac9487 100644 (file)
--- a/tests/nwfilterxml2firewalldata/all-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/all-ipv6-linux.args
@@ -8,8 +8,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -19,8 +19,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -32,8 +32,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -42,8 +42,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -54,8 +54,8 @@ ip6tables \
 --source a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -64,8 +64,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -74,8 +74,8 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -86,8 +86,8 @@ ip6tables \
 --source ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -96,6 +96,6 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/all-linux.args b/tests/nwfilterxml2firewalldata/all-linux.args
index 187d9ed9ca5c771e3a860a1870c7c914f00ca7ef..a2bc6996d7a7a62024978faae5055384c9b2eef9 100644 (file)
--- a/tests/nwfilterxml2firewalldata/all-linux.args
+++ b/tests/nwfilterxml2firewalldata/all-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -51,8 +51,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -71,8 +71,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -93,6 +93,6 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/comment-linux.args b/tests/nwfilterxml2firewalldata/comment-linux.args
index 2b940ccd848976c593eeb93a519bedb2737d2d16..052b607cb2e32d5b4f90c71466f7a4e8f5465ea1 100644 (file)
--- a/tests/nwfilterxml2firewalldata/comment-linux.args
+++ b/tests/nwfilterxml2firewalldata/comment-linux.args
@@ -55,8 +55,8 @@ iptables \
 --dscp 34 \
 --sport 291:400 \
 --dport 564:1092 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'udp rule' \
 -j RETURN
@@ -69,8 +69,8 @@ iptables \
 --dscp 34 \
 --dport 291:400 \
 --sport 564:1092 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'udp rule' \
 -j ACCEPT
@@ -85,8 +85,8 @@ iptables \
 --dscp 34 \
 --sport 291:400 \
 --dport 564:1092 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'udp rule' \
 -j RETURN
@@ -99,8 +99,8 @@ ip6tables \
 --dscp 57 \
 --dport 32:33 \
 --sport 256:4369 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'tcp/ipv6 rule' \
 -j RETURN
@@ -115,8 +115,8 @@ ip6tables \
 --dscp 57 \
 --sport 32:33 \
 --dport 256:4369 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'tcp/ipv6 rule' \
 -j ACCEPT
@@ -129,8 +129,8 @@ ip6tables \
 --dscp 57 \
 --dport 32:33 \
 --sport 256:4369 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'tcp/ipv6 rule' \
 -j RETURN
@@ -138,8 +138,8 @@ ip6tables \
 -w \
 -A FJ-vnet0 \
 -p udp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3   spaces'\''' \
 -j RETURN
@@ -147,8 +147,8 @@ ip6tables \
 -w \
 -A FP-vnet0 \
 -p udp \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3   spaces'\''' \
 -j ACCEPT
@@ -156,8 +156,8 @@ ip6tables \
 -w \
 -A HJ-vnet0 \
 -p udp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3   spaces'\''' \
 -j RETURN
@@ -165,8 +165,8 @@ ip6tables \
 -w \
 -A FJ-vnet0 \
 -p sctp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'comment with lone '\'', `, ", `, \, $x, and two  spaces' \
 -j RETURN
@@ -174,8 +174,8 @@ ip6tables \
 -w \
 -A FP-vnet0 \
 -p sctp \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'comment with lone '\'', `, ", `, \, $x, and two  spaces' \
 -j ACCEPT
@@ -183,8 +183,8 @@ ip6tables \
 -w \
 -A HJ-vnet0 \
 -p sctp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'comment with lone '\'', `, ", `, \, $x, and two  spaces' \
 -j RETURN
@@ -192,8 +192,8 @@ ip6tables \
 -w \
 -A FJ-vnet0 \
 -p ah \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
 -j RETURN
@@ -201,8 +201,8 @@ ip6tables \
 -w \
 -A FP-vnet0 \
 -p ah \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
 -j ACCEPT
@@ -210,8 +210,8 @@ ip6tables \
 -w \
 -A HJ-vnet0 \
 -p ah \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/conntrack-linux.args b/tests/nwfilterxml2firewalldata/conntrack-linux.args
index 78495598a116ceda9957d39315609c5d4f08a322..4e7652e293216935ecd9f9e042752fdcddbfa2fa 100644 (file)
--- a/tests/nwfilterxml2firewalldata/conntrack-linux.args
+++ b/tests/nwfilterxml2firewalldata/conntrack-linux.args
@@ -30,20 +30,20 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args
index 426bdd3083d60b528872897a44f8cbde5d9dfa2f..be58a3f04b3cbe5b5700766a441b5189f0860329 100644 (file)
--- a/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args
@@ -8,8 +8,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -19,8 +19,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -32,8 +32,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -42,8 +42,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -54,8 +54,8 @@ ip6tables \
 --source a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -64,8 +64,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -74,8 +74,8 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -86,8 +86,8 @@ ip6tables \
 --source ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -96,6 +96,6 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/esp-linux.args b/tests/nwfilterxml2firewalldata/esp-linux.args
index 7cd70afaa12932577f2ccdec6fcd416c32c43a1a..f8626282e485e93441cc1a14bd6a6e4add5dda74 100644 (file)
--- a/tests/nwfilterxml2firewalldata/esp-linux.args
+++ b/tests/nwfilterxml2firewalldata/esp-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -51,8 +51,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -71,8 +71,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -93,6 +93,6 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/example-1-linux.args b/tests/nwfilterxml2firewalldata/example-1-linux.args
index 1cc3746d401c834cbcee7daba6824017613fbe8e..32ffb8edfa29ee0e18489eadcb7b28f7fc92efe9 100644 (file)
--- a/tests/nwfilterxml2firewalldata/example-1-linux.args
+++ b/tests/nwfilterxml2firewalldata/example-1-linux.args
@@ -3,66 +3,66 @@ iptables \
 -A FJ-vnet0 \
 -p tcp \
 --sport 22 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FP-vnet0 \
 -p tcp \
 --dport 22 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A HJ-vnet0 \
 -p tcp \
 --sport 22 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FJ-vnet0 \
 -p icmp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FP-vnet0 \
 -p icmp \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A HJ-vnet0 \
 -p icmp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \

diff --git a/tests/nwfilterxml2firewalldata/example-2-linux.args b/tests/nwfilterxml2firewalldata/example-2-linux.args
index 87462ad954c5d15904d5994c7e33df5b5af050e7..e7247aeb239b393c9c44aff18bd93dd4a41109ad 100644 (file)
--- a/tests/nwfilterxml2firewalldata/example-2-linux.args
+++ b/tests/nwfilterxml2firewalldata/example-2-linux.args
@@ -2,8 +2,8 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED,RELATED \
+-m conntrack \
+--ctstate ESTABLISHED,RELATED \
 -m comment \
 --comment 'out: existing and related (ftp) connections' \
 -j RETURN
@@ -11,8 +11,8 @@ iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED,RELATED \
+-m conntrack \
+--ctstate ESTABLISHED,RELATED \
 -m comment \
 --comment 'out: existing and related (ftp) connections' \
 -j RETURN
@@ -20,8 +20,8 @@ iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'in: existing connections' \
 -j ACCEPT
@@ -30,8 +30,8 @@ iptables \
 -A FP-vnet0 \
 -p tcp \
 --dport 21:22 \
--m state \
---state NEW \
+-m conntrack \
+--ctstate NEW \
 -m comment \
 --comment 'in: ftp and ssh' \
 -j ACCEPT
@@ -39,8 +39,8 @@ iptables \
 -w \
 -A FP-vnet0 \
 -p icmp \
--m state \
---state NEW \
+-m conntrack \
+--ctstate NEW \
 -m comment \
 --comment 'in: icmp' \
 -j ACCEPT
@@ -49,8 +49,8 @@ iptables \
 -A FJ-vnet0 \
 -p udp \
 --dport 53 \
--m state \
---state NEW \
+-m conntrack \
+--ctstate NEW \
 -m comment \
 --comment 'out: DNS lookups' \
 -j RETURN
@@ -59,8 +59,8 @@ iptables \
 -A HJ-vnet0 \
 -p udp \
 --dport 53 \
--m state \
---state NEW \
+-m conntrack \
+--ctstate NEW \
 -m comment \
 --comment 'out: DNS lookups' \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/hex-data-linux.args b/tests/nwfilterxml2firewalldata/hex-data-linux.args
index ff8f528c48c18cb60fcb1400a053f8bacc91b3ba..8b09922a654056d65ae5aea7f03ea1a16c056d63 100644 (file)
--- a/tests/nwfilterxml2firewalldata/hex-data-linux.args
+++ b/tests/nwfilterxml2firewalldata/hex-data-linux.args
@@ -55,8 +55,8 @@ iptables \
 --dscp 34 \
 --sport 291:400 \
 --dport 564:1092 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -67,8 +67,8 @@ iptables \
 --dscp 34 \
 --dport 291:400 \
 --sport 564:1092 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -81,8 +81,8 @@ iptables \
 --dscp 34 \
 --sport 291:400 \
 --dport 564:1092 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -93,8 +93,8 @@ ip6tables \
 --dscp 57 \
 --dport 32:33 \
 --sport 256:4369 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -107,8 +107,8 @@ ip6tables \
 --dscp 57 \
 --sport 32:33 \
 --dport 256:4369 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -119,6 +119,6 @@ ip6tables \
 --dscp 57 \
 --dport 32:33 \
 --sport 256:4369 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/icmp-direction-linux.args b/tests/nwfilterxml2firewalldata/icmp-direction-linux.args
index 7548aaeba55b53a725085c79fa736c4124af3272..a7ad6ac9d8e964dda1573ec835908836544d12f5 100644 (file)
--- a/tests/nwfilterxml2firewalldata/icmp-direction-linux.args
+++ b/tests/nwfilterxml2firewalldata/icmp-direction-linux.args
@@ -3,24 +3,24 @@ iptables \
 -A FP-vnet0 \
 -p icmp \
 --icmp-type 0 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A FJ-vnet0 \
 -p icmp \
 --icmp-type 8 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A HJ-vnet0 \
 -p icmp \
 --icmp-type 8 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \

diff --git a/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args b/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args
index 026702caee4756a45e540fcf2b3513424fe402ec..a1873e744871a4511b04e902eb3154dc44b65154 100644 (file)
--- a/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args
+++ b/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args
@@ -3,24 +3,24 @@ iptables \
 -A FP-vnet0 \
 -p icmp \
 --icmp-type 8 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A FJ-vnet0 \
 -p icmp \
 --icmp-type 0 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A HJ-vnet0 \
 -p icmp \
 --icmp-type 0 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \

diff --git a/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args b/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args
index 6ee6a4f84a7368483994a7d3d9f10d3c5b740b9a..1fc79939088cdb4f07ad6ba087d76bf31faa648e 100644 (file)
--- a/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args
+++ b/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args
@@ -2,22 +2,22 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p icmp \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FP-vnet0 \
 -p icmp \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A HJ-vnet0 \
 -p icmp \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \

diff --git a/tests/nwfilterxml2firewalldata/icmp-linux.args b/tests/nwfilterxml2firewalldata/icmp-linux.args
index d688e29213516e8a228aa8610be843cbd31be156..02f9bf0c067c61e2b4c0322fd2b3f91c036b2fe2 100644 (file)
--- a/tests/nwfilterxml2firewalldata/icmp-linux.args
+++ b/tests/nwfilterxml2firewalldata/icmp-linux.args
@@ -8,8 +8,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --icmp-type 12/11 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -21,8 +21,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --icmp-type 12/11 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -34,6 +34,6 @@ iptables \
 -m dscp \
 --dscp 33 \
 --icmp-type 255/255 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT

diff --git a/tests/nwfilterxml2firewalldata/icmpv6-linux.args b/tests/nwfilterxml2firewalldata/icmpv6-linux.args
index 5a8546e5c86838584eb884c7ba6bcb32159c3a44..b7f184f9b31da1fd1537fb0fd38fbe04d71ad5e4 100644 (file)
--- a/tests/nwfilterxml2firewalldata/icmpv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/icmpv6-linux.args
@@ -9,8 +9,8 @@ ip6tables \
 -m dscp \
 --dscp 2 \
 --icmpv6-type 12/11 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -23,8 +23,8 @@ ip6tables \
 -m dscp \
 --dscp 2 \
 --icmpv6-type 12/11 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -36,8 +36,8 @@ ip6tables \
 -m dscp \
 --dscp 33 \
 --icmpv6-type 255/255 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -49,6 +49,6 @@ ip6tables \
 -m dscp \
 --dscp 33 \
 --icmpv6-type 255/255 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT

diff --git a/tests/nwfilterxml2firewalldata/igmp-linux.args b/tests/nwfilterxml2firewalldata/igmp-linux.args
index b954b0ae995b3bb853dd7f70cec33edfd50fa83d..c0add2539bd399c3bdba0d69b4f4f028de0fbc6a 100644 (file)
--- a/tests/nwfilterxml2firewalldata/igmp-linux.args
+++ b/tests/nwfilterxml2firewalldata/igmp-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -51,8 +51,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -71,8 +71,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -93,6 +93,6 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/ipset-linux.args b/tests/nwfilterxml2firewalldata/ipset-linux.args
index 5cdb1513548fd6a7831e08fb6ff5f7124ff8b589..6848f64541bd24a03623e7f312e7d0788879d317 100644 (file)
--- a/tests/nwfilterxml2firewalldata/ipset-linux.args
+++ b/tests/nwfilterxml2firewalldata/ipset-linux.args
@@ -2,8 +2,8 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m set \
 --match-set tck_test src,dst \
 -j RETURN
@@ -11,8 +11,8 @@ iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src \
 -j ACCEPT
@@ -20,8 +20,8 @@ iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m set \
 --match-set tck_test src,dst \
 -j RETURN
@@ -56,8 +56,8 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src,dst \
 -j RETURN
@@ -65,8 +65,8 @@ iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m set \
 --match-set tck_test src,dst,src \
 -j ACCEPT
@@ -74,8 +74,8 @@ iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src,dst \
 -j RETURN
@@ -83,8 +83,8 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src,dst \
 -j RETURN
@@ -92,8 +92,8 @@ iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m set \
 --match-set tck_test src,dst,src \
 -j ACCEPT
@@ -101,8 +101,8 @@ iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src,dst \
 -j RETURN
@@ -110,8 +110,8 @@ iptables \
 -w \
 -A FJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src \
 -j RETURN
@@ -119,8 +119,8 @@ iptables \
 -w \
 -A FP-vnet0 \
 -p all \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m set \
 --match-set tck_test src,dst \
 -j ACCEPT
@@ -128,8 +128,8 @@ iptables \
 -w \
 -A HJ-vnet0 \
 -p all \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m set \
 --match-set tck_test dst,src \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/iter1-linux.args b/tests/nwfilterxml2firewalldata/iter1-linux.args
index 9bdad187487e0d10510e7b99a612b2788731dc8e..e50c768f6716219759792d23cdc766bd72ffbc3e 100644 (file)
--- a/tests/nwfilterxml2firewalldata/iter1-linux.args
+++ b/tests/nwfilterxml2firewalldata/iter1-linux.args
@@ -6,8 +6,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -28,8 +28,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -50,8 +50,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -72,8 +72,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -94,6 +94,6 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/iter2-linux.args b/tests/nwfilterxml2firewalldata/iter2-linux.args
index b088350ee5ccf2923ddca50acd79305ec62938d3..7f2b0e456565d65e6b3a22443cbf46c34657d1b1 100644 (file)
--- a/tests/nwfilterxml2firewalldata/iter2-linux.args
+++ b/tests/nwfilterxml2firewalldata/iter2-linux.args
@@ -6,8 +6,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -28,8 +28,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -50,8 +50,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -72,8 +72,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -94,8 +94,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -105,8 +105,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -116,8 +116,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -127,8 +127,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -138,8 +138,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -149,8 +149,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -160,8 +160,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -171,8 +171,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -182,8 +182,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -193,8 +193,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -204,8 +204,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -215,8 +215,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -226,8 +226,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -237,8 +237,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -248,8 +248,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -259,8 +259,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -270,8 +270,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -281,8 +281,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -292,8 +292,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -304,8 +304,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -316,8 +316,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -328,8 +328,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -340,8 +340,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -352,8 +352,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -364,8 +364,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -376,8 +376,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -388,8 +388,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -400,8 +400,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -412,8 +412,8 @@ iptables \
 --dscp 3 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -424,8 +424,8 @@ iptables \
 --dscp 3 \
 --dport 90 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -436,8 +436,8 @@ iptables \
 --dscp 3 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -448,8 +448,8 @@ iptables \
 --dscp 3 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -460,8 +460,8 @@ iptables \
 --dscp 3 \
 --dport 90 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -472,8 +472,8 @@ iptables \
 --dscp 3 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -484,8 +484,8 @@ iptables \
 --dscp 3 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -496,8 +496,8 @@ iptables \
 --dscp 3 \
 --dport 90 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -508,8 +508,8 @@ iptables \
 --dscp 3 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -520,8 +520,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -532,8 +532,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -544,8 +544,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -556,8 +556,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -568,8 +568,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -580,8 +580,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -592,8 +592,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -604,8 +604,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -616,8 +616,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -628,8 +628,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -640,8 +640,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -652,8 +652,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -664,8 +664,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -676,8 +676,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -688,8 +688,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -700,8 +700,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -712,8 +712,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -724,8 +724,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -736,8 +736,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -748,8 +748,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -760,8 +760,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -772,8 +772,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -784,8 +784,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -796,8 +796,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -808,8 +808,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -820,8 +820,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -832,8 +832,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -844,8 +844,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -856,8 +856,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -868,8 +868,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -880,8 +880,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -892,8 +892,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -904,8 +904,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -916,8 +916,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -928,8 +928,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1080 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -940,8 +940,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1080 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -952,8 +952,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -964,8 +964,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -976,8 +976,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -988,8 +988,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1000,8 +1000,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1012,8 +1012,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1024,8 +1024,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1036,8 +1036,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1048,8 +1048,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1060,8 +1060,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1072,8 +1072,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1084,8 +1084,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1096,8 +1096,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1108,8 +1108,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1120,8 +1120,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1132,8 +1132,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1144,8 +1144,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1090 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1156,8 +1156,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1090 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1168,8 +1168,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1180,8 +1180,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1192,8 +1192,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1204,8 +1204,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1216,8 +1216,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1228,8 +1228,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1240,8 +1240,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1252,8 +1252,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1264,8 +1264,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1276,8 +1276,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1288,8 +1288,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1300,8 +1300,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1312,8 +1312,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1324,8 +1324,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1336,8 +1336,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1348,8 +1348,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1360,8 +1360,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1372,8 +1372,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1384,8 +1384,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1396,8 +1396,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1408,8 +1408,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1420,8 +1420,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1432,8 +1432,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1444,8 +1444,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1456,8 +1456,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1468,8 +1468,8 @@ iptables \
 --dscp 4 \
 --dport 80 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1480,8 +1480,8 @@ iptables \
 --dscp 4 \
 --sport 80 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1492,8 +1492,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1504,8 +1504,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1516,8 +1516,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1528,8 +1528,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1540,8 +1540,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1552,8 +1552,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1564,8 +1564,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1576,8 +1576,8 @@ iptables \
 --dscp 4 \
 --dport 90 \
 --sport 1110 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1588,8 +1588,8 @@ iptables \
 --dscp 4 \
 --sport 90 \
 --dport 1110 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1599,8 +1599,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1610,8 +1610,8 @@ iptables \
 --source 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1621,8 +1621,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1632,8 +1632,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1643,8 +1643,8 @@ iptables \
 --source 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1654,8 +1654,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1665,8 +1665,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1676,8 +1676,8 @@ iptables \
 --source 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1687,8 +1687,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1698,8 +1698,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1709,8 +1709,8 @@ iptables \
 --source 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1720,8 +1720,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1731,8 +1731,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1742,8 +1742,8 @@ iptables \
 --source 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1753,8 +1753,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1764,8 +1764,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1775,8 +1775,8 @@ iptables \
 --source 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1786,8 +1786,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1797,8 +1797,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1808,8 +1808,8 @@ iptables \
 --source 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1819,8 +1819,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1830,8 +1830,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1841,8 +1841,8 @@ iptables \
 --source 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1852,8 +1852,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1863,8 +1863,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1874,8 +1874,8 @@ iptables \
 --source 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1885,8 +1885,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 5 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1896,8 +1896,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 6 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1907,8 +1907,8 @@ iptables \
 --source 1.1.1.1 \
 -m dscp \
 --dscp 6 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1918,8 +1918,8 @@ iptables \
 --destination 1.1.1.1 \
 -m dscp \
 --dscp 6 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1929,8 +1929,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 6 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1940,8 +1940,8 @@ iptables \
 --source 2.2.2.2 \
 -m dscp \
 --dscp 6 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1951,8 +1951,8 @@ iptables \
 --destination 2.2.2.2 \
 -m dscp \
 --dscp 6 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1962,8 +1962,8 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 6 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -1973,8 +1973,8 @@ iptables \
 --source 3.3.3.3 \
 -m dscp \
 --dscp 6 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -1984,6 +1984,6 @@ iptables \
 --destination 3.3.3.3 \
 -m dscp \
 --dscp 6 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/iter3-linux.args b/tests/nwfilterxml2firewalldata/iter3-linux.args
index cc6d442c75f6f8edfc7f13857add8388b7641560..1bc769bcd48c390205a69684bf83692764305fe9 100644 (file)
--- a/tests/nwfilterxml2firewalldata/iter3-linux.args
+++ b/tests/nwfilterxml2firewalldata/iter3-linux.args
@@ -6,8 +6,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -28,8 +28,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -50,8 +50,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 -m dscp \
 --dscp 1 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -72,8 +72,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -94,8 +94,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -105,8 +105,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -116,8 +116,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --dport 90 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -127,8 +127,8 @@ iptables \
 -m dscp \
 --dscp 2 \
 --sport 90 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -139,8 +139,8 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -151,8 +151,8 @@ iptables \
 --dscp 3 \
 --dport 80 \
 --sport 1100 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -163,6 +163,6 @@ iptables \
 --dscp 3 \
 --sport 80 \
 --dport 1100 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args
index 086c11ca52f5ae75e0913d304c4da44cebd38022..55b2b1003784e4a73681481fd8e0e5bdec6cc937 100644 (file)
--- a/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args
@@ -7,8 +7,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -17,8 +17,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -29,8 +29,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -41,8 +41,8 @@ ip6tables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -55,8 +55,8 @@ ip6tables \
 --dscp 33 \
 --sport 20:21 \
 --dport 100:1111 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -67,8 +67,8 @@ ip6tables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -79,8 +79,8 @@ ip6tables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -93,8 +93,8 @@ ip6tables \
 --dscp 63 \
 --sport 255:256 \
 --dport 65535:65535 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -105,6 +105,6 @@ ip6tables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/sctp-linux.args b/tests/nwfilterxml2firewalldata/sctp-linux.args
index a3c5a7a72d463db4e5e209e4e73c16c99790eb90..881f70ed721d984578a28626eb70e0862ec5c5f2 100644 (file)
--- a/tests/nwfilterxml2firewalldata/sctp-linux.args
+++ b/tests/nwfilterxml2firewalldata/sctp-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -41,8 +41,8 @@ iptables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -55,8 +55,8 @@ iptables \
 --dscp 33 \
 --sport 20:21 \
 --dport 100:1111 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -67,8 +67,8 @@ iptables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -79,8 +79,8 @@ iptables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -93,8 +93,8 @@ iptables \
 --dscp 63 \
 --sport 255:256 \
 --dport 65535:65535 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -105,6 +105,6 @@ iptables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/target-linux.args b/tests/nwfilterxml2firewalldata/target-linux.args
index abb01debf91f0ae0f3a98e227c73a9dcf7fa6a15..54d97307d97ca26f3162dac62bb60eb62bbbc206 100644 (file)
--- a/tests/nwfilterxml2firewalldata/target-linux.args
+++ b/tests/nwfilterxml2firewalldata/target-linux.args
@@ -49,8 +49,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'accept rule -- dir out' \
 -j RETURN
@@ -61,8 +61,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'accept rule -- dir out' \
 -j ACCEPT
@@ -75,8 +75,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'accept rule -- dir out' \
 -j RETURN
@@ -155,8 +155,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'accept rule -- dir in' \
 -j RETURN
@@ -169,8 +169,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -m comment \
 --comment 'accept rule -- dir in' \
 -j ACCEPT
@@ -181,8 +181,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -m comment \
 --comment 'accept rule -- dir in' \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/target2-linux.args b/tests/nwfilterxml2firewalldata/target2-linux.args
index c774f6f24ad20e9fbc5eb0a095fbc96526a097a4..915f1ebb2b310f15b95db549124d955d8773ac3d 100644 (file)
--- a/tests/nwfilterxml2firewalldata/target2-linux.args
+++ b/tests/nwfilterxml2firewalldata/target2-linux.args
@@ -21,24 +21,24 @@ iptables \
 -A FJ-vnet0 \
 -p tcp \
 --sport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
 -A FP-vnet0 \
 -p tcp \
 --dport 80 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
 -A HJ-vnet0 \
 -p tcp \
 --sport 80 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \

diff --git a/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args
index 50b5514a3bd8aa14ca5ebc1e4e57a0347259c9ac..9463d5a4c4e7cc9c85067187511305a6e9321a9c 100644 (file)
--- a/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args
@@ -7,8 +7,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -17,8 +17,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -29,8 +29,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -41,8 +41,8 @@ ip6tables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -55,8 +55,8 @@ ip6tables \
 --dscp 33 \
 --sport 20:21 \
 --dport 100:1111 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -67,8 +67,8 @@ ip6tables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -79,8 +79,8 @@ ip6tables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -93,8 +93,8 @@ ip6tables \
 --dscp 63 \
 --sport 255:256 \
 --dport 65535:65535 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -105,6 +105,6 @@ ip6tables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/tcp-linux.args b/tests/nwfilterxml2firewalldata/tcp-linux.args
index 74ac4a6733ff7e436babfc2110c1a42f5d93e6d6..ae2d05a7530f8d23a586f13a5446d35263f25d68 100644 (file)
--- a/tests/nwfilterxml2firewalldata/tcp-linux.args
+++ b/tests/nwfilterxml2firewalldata/tcp-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \

diff --git a/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args
index 6feec12a04cdc43e7b46d5dc129d10e0360d1007..1df20ae1398e24440df8a1b39017329742abd5a0 100644 (file)
--- a/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args
@@ -7,8 +7,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -17,8 +17,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -29,8 +29,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -41,8 +41,8 @@ ip6tables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -55,8 +55,8 @@ ip6tables \
 --dscp 33 \
 --sport 20:21 \
 --dport 100:1111 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -67,8 +67,8 @@ ip6tables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -79,8 +79,8 @@ ip6tables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -93,8 +93,8 @@ ip6tables \
 --dscp 63 \
 --sport 255:256 \
 --dport 65535:65535 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -105,6 +105,6 @@ ip6tables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/udp-linux.args b/tests/nwfilterxml2firewalldata/udp-linux.args
index 32a8f56dfc9f6ab1042a36eaa6f1556cb5e8acb7..0a04a636ae6a39a890b58d17e9e2d18b96d294fd 100644 (file)
--- a/tests/nwfilterxml2firewalldata/udp-linux.args
+++ b/tests/nwfilterxml2firewalldata/udp-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -41,8 +41,8 @@ iptables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -55,8 +55,8 @@ iptables \
 --dscp 33 \
 --sport 20:21 \
 --dport 100:1111 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -67,8 +67,8 @@ iptables \
 --dscp 33 \
 --dport 20:21 \
 --sport 100:1111 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -79,8 +79,8 @@ iptables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -93,8 +93,8 @@ iptables \
 --dscp 63 \
 --sport 255:256 \
 --dport 65535:65535 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -105,6 +105,6 @@ iptables \
 --dscp 63 \
 --dport 255:256 \
 --sport 65535:65535 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args b/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args
index 6be6aa0069e7006f6562801a9d91dcdf33e0c827..4c1d254ba89633059a88ca943987b227582b2191 100644 (file)
--- a/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args
+++ b/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args
@@ -8,8 +8,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -19,8 +19,8 @@ ip6tables \
 --source a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -32,8 +32,8 @@ ip6tables \
 --destination a:b:c::d:e:f/128 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -42,8 +42,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -54,8 +54,8 @@ ip6tables \
 --source a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -64,8 +64,8 @@ ip6tables \
 --destination a:b:c::/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -74,8 +74,8 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 ip6tables \
 -w \
@@ -86,8 +86,8 @@ ip6tables \
 --source ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 ip6tables \
 -w \
@@ -96,6 +96,6 @@ ip6tables \
 --destination ::ffff:10.1.2.3/128 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN

diff --git a/tests/nwfilterxml2firewalldata/udplite-linux.args b/tests/nwfilterxml2firewalldata/udplite-linux.args
index 8f3a9e8f24738f552dcc19a3d856f68061bf5fc3..7e85aaf15db928ee2b61409ada43353325de96b1 100644 (file)
--- a/tests/nwfilterxml2firewalldata/udplite-linux.args
+++ b/tests/nwfilterxml2firewalldata/udplite-linux.args
@@ -7,8 +7,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -17,8 +17,8 @@ iptables \
 --source 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -29,8 +29,8 @@ iptables \
 --destination 10.1.2.3/32 \
 -m dscp \
 --dscp 2 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -39,8 +39,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -51,8 +51,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -61,8 +61,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -71,8 +71,8 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN
 iptables \
 -w \
@@ -83,8 +83,8 @@ iptables \
 --source 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state NEW,ESTABLISHED \
+-m conntrack \
+--ctstate NEW,ESTABLISHED \
 -j ACCEPT
 iptables \
 -w \
@@ -93,6 +93,6 @@ iptables \
 --destination 10.1.2.3/22 \
 -m dscp \
 --dscp 33 \
--m state \
---state ESTABLISHED \
+-m conntrack \
+--ctstate ESTABLISHED \
 -j RETURN