From 9e3a029a1c69e63633cba7e81fee22afce440e16 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 23 Mar 2012 00:02:07 +0100
Subject: [PATCH] --- yaml --- r: 296239 b: refs/heads/master c:
 eeb4cb952386aac764a5cf4cf2490e50a24a8880 h: refs/heads/master i:   296237:
 1337bdf06ed2f003610909a2929060d96a7ec360   296235:
 18e29bfc1d3aafa638ff4bfed3455fdf6ab875e8   296231:
 5a3df1c7ef157cd28fce320e338433815882b3e2   296223:
 5d8d56e9aa85ea6e281f66803204362440c0436d v: v3

---
 [refs]                      | 2 +-
 trunk/net/netfilter/xt_CT.c | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index c9a8dbb564c0..c1986e757d08 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 1ac0bf99260761ad0a536ddbc15f6f9b82b9bab3
+refs/heads/master: eeb4cb952386aac764a5cf4cf2490e50a24a8880
diff --git a/trunk/net/netfilter/xt_CT.c b/trunk/net/netfilter/xt_CT.c
index 33a02b41abb4..0c8e43810ce3 100644
--- a/trunk/net/netfilter/xt_CT.c
+++ b/trunk/net/netfilter/xt_CT.c
@@ -14,6 +14,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_CT.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
@@ -224,6 +225,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 
 		if (timeout_find_get) {
 			const struct ipt_entry *e = par->entryinfo;
+			struct nf_conntrack_l4proto *l4proto;
 
 			if (e->ip.invflags & IPT_INV_PROTO) {
 				ret = -EINVAL;
@@ -245,7 +247,12 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 					info->timeout, timeout->l3num);
 				goto err4;
 			}
-			if (timeout->l4proto->l4proto != e->ip.proto) {
+			/* Make sure the timeout policy matches any existing
+			 * protocol tracker, otherwise default to generic.
+			 */
+			l4proto = __nf_ct_l4proto_find(par->family,
+						       e->ip.proto);
+			if (timeout->l4proto->l4proto != l4proto->l4proto) {
 				ret = -EINVAL;
 				pr_info("Timeout policy `%s' can only be "
 					"used by L4 protocol number %d\n",