{"shas":[["7645c3977e65471f5c9ba730a300b04f73901786","035f816d23c808f99c8380c415b2522f8ae625cf@cipherdyne.org","Bugfix for --ipt-list and --ipt-flush\n\nFixed a problem with --ipt-list and --ipt-flush to ensure that the proper\niptables binary path is chosen.  These args failed without this because the\niptables binary was not set.","Michael Rash"],["84f12e1f048ff94ceab7e6ed3aa596864eefe763","035f816d23c808f99c8380c415b2522f8ae625cf@cipherdyne.org","Added test for conntrack --ctstate\n\nRecent releases of iptables and the Linux kernel support matching\non connection state via the conntrack modules and the --ctstate\nswitch.  Added a capabilities test for this, and will fall back to\nusing the state match if the conntrack module is not available.","Michael Rash"],["00c4379a69975097948ed9e5ba356eeba69c0c93","035f816d23c808f99c8380c415b2522f8ae625cf@cipherdyne.org","Added the --Conntrack-state argument\n\nAdded the --Conntrack-state argument to specify a conntrack state in place of\nthe \"established\" state that commonly accompanies the Snort \"flow\" keyword.\nBy default, fwsnort uses the conntrack state of \"ESTABLISHED\" for this.  In\ncertain corner cases, it might be useful to use \"ESTABLISHED,RELATED\" instead\nto apply application layer inspection to things like ICMP port unreachable\nmessages that are responses to real attempted communications.  (Need to add\nUDP tracking for the _ESTAB chains for this too - coming soon.)","Michael Rash"]],"ref":"refs/heads/master","size":3,"head":"00c4379a69975097948ed9e5ba356eeba69c0c93","push_id":34700042}