netfilter: merge some fixes from upstream