Re: TProxy support

Laszlo Attila Toth wrote:
> Hello,
>
> We only supports TProxy version 4.1 but in the squid "--enable-tproxy"
> requires version 2 which is obsolete for a while.
>
> Current implementation doesn't require kernel support, only a new socket
> option, IP_TRANSPARENT, also I made a patch which drops
> "--enable-tproxy" because TProxy 4.1 uses netfilter/iptables (TPROXY
> target and socket match). If "--enable-linux-netfilter" is used, the
> "tproxy" option is available for "http_proxy".
>
> It is not yet finished, the squid proxy doesn't bind to the client's
> address. Furthermore I think it would be better to have a diferent
> option for this, and "tproxy" wouldn't imply this.
>
> The patch is available here for 2.6-STABLE18:
>
> http://www.balabit.com/downloads/files/tproxy/
>
>
> Any suggestions?

Dropping support for tproxy <4 entirely out of squid-2 is not a good
choice. Squid-3 this may be possibly done.

A new configure option --enable-linux-transparent-intercept which
pre-empts --enable-linux-netfilter and --enable-tproxy would be a better
choice.

Users of tproxy4+ can then use that option and choose their target.

Which code alteration means:
  - migrate defined LINUX_TPROXY -> LINUX_TPROXY2
  - add defined LINUX_TPROXY4
  - make flags.tproxy:1 --> #if LINUX_NETFILTER || LINUX_TPROXY4
etc.

Amos

-- 
Please use Squid 2.6STABLE17+ or 3.0STABLE1+
There are serious security advisories out on all earlier releases.