netfilter: nf_conntrack: split up IPCT_STATUS event

Split up the IPCT_STATUS event into an IPCT_REPLY event, which is generated
when the IPS_SEEN_REPLY bit is set, and an IPCT_ASSURED event, which is
generated when the IPS_ASSURED bit is set.

In combination with a following patch to support selective event delivery,
this can be used for "sparse" conntrack replication: start replicating the
conntrack entry after it reached the ASSURED state and that way it's SYN-flood
resistant.

Signed-off-by: Patrick McHardy <kaber@trash.net>

1 files changed, 11 insertions, 10 deletions

diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 475facc3051a..5e05fb883ab1 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -14,19 +14,20 @@
 
 /* Connection tracking event types */
 enum ip_conntrack_events {
-        IPCT_NEW                = 0,    /* new conntrack */
-        IPCT_RELATED            = 1,    /* related conntrack */
-        IPCT_DESTROY            = 2,    /* destroyed conntrack */
-        IPCT_STATUS             = 3,    /* status has changed */
-        IPCT_PROTOINFO          = 4,    /* protocol information has changed */
-        IPCT_HELPER             = 5,    /* new helper has been set */
-        IPCT_MARK               = 6,    /* new mark has been set */
-        IPCT_NATSEQADJ          = 7,    /* NAT is doing sequence adjustment */
-        IPCT_SECMARK            = 8,    /* new security mark has been set */
+        IPCT_NEW,               /* new conntrack */
+        IPCT_RELATED,           /* related conntrack */
+        IPCT_DESTROY,           /* destroyed conntrack */
+        IPCT_REPLY,             /* connection has seen two-way traffic */
+        IPCT_ASSURED,           /* connection status has changed to assured */
+        IPCT_PROTOINFO,         /* protocol information has changed */
+        IPCT_HELPER,            /* new helper has been set */
+        IPCT_MARK,              /* new mark has been set */
+        IPCT_NATSEQADJ,         /* NAT is doing sequence adjustment */
+        IPCT_SECMARK,           /* new security mark has been set */
 };
 
 enum ip_conntrack_expect_events {
-        IPEXP_NEW               = 0,    /* new expectation */
+        IPEXP_NEW,              /* new expectation */
 };
 
 struct nf_conntrack_ecache {