iptables: nft-ipv6: Use meta l4proto instead of nexthdr

Use meta l4proto in place of nexthdr for ipv6 protocols as it is not
necessary that all protocols be next header.

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 92d37a022bf0035f8f9c20112e4118ae3af82f87..115011893305c92e9e941db8784be20cc235cd14 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -417,7 +417,7 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
                        snprintf(protonum, sizeof(protonum), "%u",
                                 cs->fw6.ipv6.proto);
                        protonum[sizeof(protonum) - 1] = '\0';
-                       xt_xlate_add(xl, "ip6 nexthdr %s%s ",
+                       xt_xlate_add(xl, "meta l4proto %s%s ",
                                   cs->fw6.ipv6.invflags & IP6T_INV_PROTO ?
                                        "!= " : "",
                                   pent ? pent->p_name : protonum);