[libvirt] [PATCH v2] nwfilter: Use -m conntrack rather than -m state