netfilter: xtables: change matches to return error code