netfilter: xt_CT: fix wrong checking in the timeout assignment path

The current checking always succeeded. We have to check the first
character of the string to check that it's empty, thus, skipping
the timeout path.

This fixes the use of the CT target without the timeout option.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 59530e93fa58f7abdaa4a0734ad2fd1e5241c040..3746d8b9a47868694be0848fc0d09013a0a5b282 100644 (file)
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -227,7 +227,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
        }
 
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-       if (info->timeout) {
+       if (info->timeout[0]) {
                typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
                struct nf_conn_timeout *timeout_ext;