netfilter: reduce NF_HOOK by one argument