netfilter: add an API to pass the packet to next filter