1 files changed, 9 insertions, 4 deletions

diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index a8072cc7fa0b..dc947e59d03a 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -84,10 +84,6 @@ enum ip_conntrack_status {
         IPS_DYING_BIT = 9,
         IPS_DYING = (1 << IPS_DYING_BIT),
 
-        /* Bits that cannot be altered from userland. */
-        IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
-                                 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING),
-
         /* Connection has fixed timeout. */
         IPS_FIXED_TIMEOUT_BIT = 10,
         IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
@@ -103,6 +99,15 @@ enum ip_conntrack_status {
         /* Conntrack got a helper explicitly attached via CT target. */
         IPS_HELPER_BIT = 13,
         IPS_HELPER = (1 << IPS_HELPER_BIT),
+
+        /* Be careful here, modifying these bits can make things messy,
+         * so don't let users modify them directly.
+         */
+        IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
+                                 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
+                                 IPS_SEQ_ADJUST | IPS_TEMPLATE),
+
+        __IPS_MAX_BIT = 14,
 };
 
 /* Connection tracking event types */