Adrian Chadd wrote:
On Mon, Mar 31, 2008, Alex Rousskov wrote:
What about Adrian plans (if I understood them correctly) to add
TPROXY-like support to FreeBSD but not for TPROXY4-like API? Is that a
good enough reason to continue supporting unsupported TPROXY versions?
The FreeBSD API will be almost like the TPROXY-4 API.
I'd suggest supporting TPROXY-2 for a few reasons:
* Those who are using it may not want to track the latest kernel + TPROXY
patches for various reasons (if it just works; company policy; etc.)
and I think its easy enough to maintain support for both without
too much hassle.
* Supporting both TPROXY-2 and TPROXY-4 will (hopefully!) force someone
to integrate it cleanishly and avoid the Squid-2 ip interception mess!
* Thus making it easier for me to drop in a FreeBSD version of "tproxy"
without too much hassle (or #ifdef's for that matter.)
It shouldn't be that difficult to isolate the bits of the code required for
spoofing the client IP in the request versus the TPROXY-specific stuff.
In fact, the only tproxy-specific stuff I can really see is:
* the logic in forward.c to the local bind, which can be wrapped up as
part of the socket creation process, and
* The initialisation code, which in the tproxy-2 case does capabilities
magic.
Adrian
We have come up with a 'final-beta' patch for squid-3 now.
http://treenet.co.nz/projects/squid/patches/tproxy-squid-3_20080407.patch
Just waiting on Laszlo final approval.
It's pretty much:
* adding a COMM_TRANSPARENT flag to comm_openex(...)
* adds a comm_set_transparent for internal comm use to do setsockopt()
* adding a transparent flag to all fde's
- set to 1 on fde's which are opened with the transparent flag
OR, accepted from a listening fde with transparent flag.
* override getOutgoingAddr ACL checks to produce the transparent
client-address as outgoing addr.
* adapt the existing Netfilter NAT getsockopt() for tproxy option.
Should be easy to drop the squid side of your emulated TPROXY-4
alterations in there Adrian.
Amos
--
Please use Squid 2.6.STABLE19 or 3.0.STABLE4
