tcp: forward SYN in TIME_WAIT to the protocol handler

pkg/tcpip/stack/stack.go

@@ -517,6 +517,18 @@ func (s *Stack) SetTransportProtocolHandler(p tcpip.TransportProtocolNumber, h f
 	}
 }
 
+// TransportProtocolDefaultHandler returns the per-stack default handler
+// previously set for the given protocol via SetTransportProtocolHandler, or
+// nil if none was set (e.g. a tcp.Forwarder registered as the TCP handler
+// for a stack that has no bound listening endpoints).
+func (s *Stack) TransportProtocolDefaultHandler(p tcpip.TransportProtocolNumber) func(TransportEndpointID, *PacketBuffer) bool {
+	state := s.transportProtocols[p]
+	if state == nil {
+		return nil
+	}
+	return state.defaultHandler
+}
+
 // Clock returns the Stack's clock for retrieving the current time and
 // scheduling work.
 func (s *Stack) Clock() tcpip.Clock {

pkg/tcpip/transport/tcp/connect.go

@@ -1427,6 +1427,30 @@ func (e *Endpoint) handleTimeWaitSegments() (extendTimeWait bool, reuseTW func()
 					}
 				}
 			}
+
+			// No bound listening endpoint claimed the new connection. The
+			// stack may still be accepting connections through a
+			// tcp.Forwarder registered as the protocol's default handler
+			// instead of a listening endpoint, so give it the same chance a
+			// listening endpoint would have had rather than dropping the SYN
+			// for the rest of the TIME-WAIT period.
+			if handler := e.stack.TransportProtocolDefaultHandler(info.TransProto); handler != nil {
+				reuseTW = func() {
+					if !handler(s.id, s.pkt) {
+						// Mirror the normal (non-TIME-WAIT) delivery path in
+						// nic.DeliverTransportPacket: a default handler that
+						// declines the segment is not itself an answer, so
+						// reply with a RST rather than dropping it silently.
+						if !s.flags.Contains(header.TCPFlagRst) {
+							replyWithReset(e.stack, s, stack.DefaultTOS, tcpip.UseDefaultIPv4TTL, tcpip.UseDefaultIPv6HopLimit)
+						}
+					}
+					s.DecRef()
+				}
+				// We explicitly do not DecRef the segment as it's still valid and
+				// being reflected to the default handler.
+				return false, reuseTW
+			}
 		}
 		if extTW {
 			extendTimeWait = true