netfilter: xtables: change targets to return error code