[CentOS] kernel/iptables state match support

I just noticed that the stock Centos7 kernels no longer include 
state/match support. What happened and what can be done to get it?

--Richard