netfilter: revised locking for x_tables