netfilter: Use nf_hook_state.net