What it does is uses the tcp repair engine from the kernel.

On dump the connection is locked with netfilter, socket is put
in the repair state and then its internals are dumped.

On restore we create a socket, put it into repair, dress it up
and then unlock all the connections at the very end.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>