nf_tproxy_handle_time_wait6(9)

🦋 nf_tproxy_handle_time_wait6(9) — Kernel API Manual, bestie edition 🦋

🌸 NAME 🌸

nf_tproxy_handle_time_wait6 — handle IPv6 TCP TIME_WAIT reopen redirections. Periodt, that's the name and it's literally giving kernel IPv6 TCP TIME_WAIT reopen redirection realness. 💅

✨ SYNOPSIS ✨

Okay so the signature is exactly this:

struct sock * nf_tproxy_handle_time_wait6 (struct sk_buff *skb , int
       tproto , int thoff , struct net *net , const struct in6_addr *laddr ,
       const __be16 lport , struct sock *sk );

No cap, copy it exactly. 🫶

🎀 ARGUMENTS 🎀

Here's the cast, bestie:

• skb — The skb being processed. Main character packet energy.
• tproto — Transport protocol. Yep, that one. ✨
• thoff — Transport protocol header offset.
• net — Network namespace. The neighborhood, basically.
• laddr — IPv6 address to redirect to.
• lport — TCP port to redirect to or zero.
• sk — The TIME_WAIT TCP socket found by the lookup. iykyk

💖 DESCRIPTION 💖

Okay so the whole plot: we have to handle SYN packets arriving to TIME_WAIT sockets differently. Instead of reopening the connection, we should rather redirect the new connection to the proxy if there's a listener socket present. That's the lore. 🔥

And important: nf_tproxy_handle_time_wait6 consumes the socket reference passed in. So yeah, it eats that ref. 🍴

⚠️ Bestie warning: the socket reference passed in gets consumed. Don't sleep on that detail. 😭

⭐ RETURN ⭐

What you get back:

• the listener socket if there's one,
• the TIME_WAIT socket if no such listener is found,
• or NULL if the TCP header is incomplete.

That's the return vibe check, fr fr. 💀✨

🌈 SEE ALSO 🌈

• Kernel file ./include/net/netfilter/nf_tproxy.h
• nf_tproxy_handle_time_wait4(9)

Go peep those, ngl. 👑

---

Source/version: ./include/net/netfilter · Date: October 2026 · Page: nf_tproxy_handle_time_wait6(9) — mwah 💋🎀