better merge of max's work, reenable security group config
first draft of stateful filters
implement CLOCK_MONOTONIC_COARSE for fast time-checking
use simple old/new/swap expiration algorithm
named conntrack module
external tracking code runs, yet to see what it's tracking
cleaner & thinner conntrack api