It's literally a single port forwarding operation that can happen outside the CF app.

There's also datapipe.c, socat and other modern equivalents for someone who doesn't want
to involve the kernel.