d1f76a3aa1
Rule parser now accepts iptables-style: ACCEPT input -p tcp --ctstate ESTABLISHED,RELATED DROP forward state NEW Both 'state' and '--ctstate' keywords work. States are case- insensitive: NEW/New/new, ESTABLISHED/Established/established, RELATED/Related/related, INVALID/Invalid/invalid. Comma-separated lists (e.g. 'ESTABLISHED,RELATED') use the FIRST recognized state only — FilterRule stores a single StateMatch field. Docstring updated with new examples. All 31 tests pass.