netfilter: Correct calculation using skb->tail and skb-network_header