Improve conntrack locking and have the conntrack_timer handler unlock the conntrack when done.