[PATCH] nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH

[Hannes Reinecke <hare@kernel.org>]

Commit c46172147ebb changed the logic when to move to ASSURED if
a NAT CLASH is detected. In particular, it moved to ASSURED even
if a NAT CLASH had been detected, with the idea that they will
time out soon (and then the state will be cleared).
However, under high load this caused the timeout to happen too
slow causing an IPVS malfunction.
This patch revert part of that patch, as for NAT CLASH we
should not move to ASSURED at all.

Fixes: c46172147ebb ("netfilter: conntrack: do not auto-delete clash entries on reply")

Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
 net/netfilter/nf_conntrack_proto_udp.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 0030fbe8885c..def3e06430eb 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -116,10 +116,6 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
 
 		nf_ct_refresh_acct(ct, ctinfo, skb, extra);
 
-		/* never set ASSURED for IPS_NAT_CLASH, they time out soon */
-		if (unlikely((status & IPS_NAT_CLASH)))
-			return NF_ACCEPT;
-
 		/* Also, more likely to be important, and not a probe */
 		if (stream && !test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
 			nf_conntrack_event_cache(IPCT_ASSURED, ct);
-- 
2.35.3