Function spawn_tcp_proxy 

pub fn spawn_tcp_proxy(
    handle: &Handle,
    guest_dst: SocketAddr,
    connect_dst: SocketAddr,
    from_smoltcp: Receiver<Bytes>,
    to_smoltcp: Sender<Bytes>,
    shared: Arc<SharedState>,
    network_policy: Arc<NetworkPolicy>,
    secrets: Arc<SecretsConfig>,
    proxy_connect: Arc<ProxyConnectState>,
)

Spawn a TCP proxy task for a newly established connection.

guest_dst is what the guest dialed — the address policy rules match against. connect_dst is the host-side address tokio actually dials; for host-alias connections it’s loopback (gateway rewritten). For everything else the two are identical.

proxy_connect is updated before the task exits so the connection tracker can decide between FIN (clean close) and RST (upstream connect failure).