Merged from trunk.

Added final step of TPROXY4 patch - settign of IP_TRANSPARENT option

diff --cc configure.in
index 6df159b07e1ccc7fcb645475bd8c06704eea9d5e,6df159b07e1ccc7fcb645475bd8c06704eea9d5e..13fb91d007fd65b3fb098ff3202e72b184597d15
--- 1/configure.in
--- 2/configure.in
+++ b/configure.in
@@@ -1219,13 -1219,13 +1219,26 @@@ dnl "-64" from LDFLAG
  fi
  
  dnl Enable Linux transparent proxy support
--AC_ARG_ENABLE(linux-tproxy,
--[  --enable-linux-tproxy
--                        Enable real Transparent Proxy support for Netfilter TPROXY.],
++AC_ARG_ENABLE(linux-tproxy2,
++[  --enable-linux-tproxy2
++                        Enable real Transparent Proxy support for Netfilter TPROXY (version 2).],
  [ if test "$enableval" = "yes" ; then
--      echo "Linux Netfilter/TPROXY enabled"
--      AC_DEFINE(LINUX_TPROXY, 1, [Enable real Transparent Proxy support for Netfilter TPROXY.])
--      LINUX_TPROXY="yes"
++      echo "Linux Netfilter/TPROXY v2 enabled"
++      AC_DEFINE(LINUX_TPROXY2, 1, [Enable real Transparent Proxy support for Netfilter TPROXY v2.])
++      LINUX_TPROXY2="yes"
++        if test -z "$LINUX_NETFILTER"; then
++          echo "Linux-Netfilter Transparent Proxy automatically enabled"
++          LINUX_NETFILTER="yes"
++      fi
++  fi
++])
++AC_ARG_ENABLE(linux-tproxy4,
++[  --enable-linux-tproxy4
++                        Enable real Transparent Proxy support for Netfilter TPROXY (version 4+).],
++[ if test "$enableval" = "yes" ; then
++      echo "Linux Netfilter/TPROXY v4 enabled"
++      AC_DEFINE(LINUX_TPROXY4, 1, [Enable real Transparent Proxy support for Netfilter TPROXY v4.])
++      LINUX_TPROXY4="yes"
          if test -z "$LINUX_NETFILTER"; then
            echo "Linux-Netfilter Transparent Proxy automatically enabled"
            LINUX_NETFILTER="yes"
@@@ -2882,25 -2882,25 +2895,26 @@@ if test "$LINUX_NETFILTER" = "no" ; the
      sleep 10
  fi
  
--dnl Linux Netfilter/TPROXY support requires some specific header files
++dnl Linux Netfilter/TPROXYv2 support requires some specific header files
  dnl Shamelessly copied from shamelessly copied from above
--if test "$LINUX_TPROXY" ; then
--    AC_MSG_CHECKING(if TPROXY header files are installed)
++if test "$LINUX_TPROXY2" ; then
++    AC_MSG_CHECKING(if TPROXYv2 header files are installed)
      # hold on to your hats...
      if test "$ac_cv_header_linux_netfilter_ipv4_ip_tproxy_h" = "yes" && test "$LINUX_NETFILTER" = "yes"; then
--      LINUX_TPROXY="yes"
--      AC_DEFINE(LINUX_TPROXY, 1, [Enable real Transparent Proxy support for Netfilter TPROXY.])
++      LINUX_TPROXY2="yes"
++      AC_DEFINE(LINUX_TPROXY2, 1, [Enable real Transparent Proxy support for Netfilter TPROXY v2.])
      else
--      LINUX_TPROXY="no"
--      AC_DEFINE(LINUX_TPROXY, 0, [Enable real Transparent Proxy support for Netfilter TPROXY.])
++      LINUX_TPROXY2="no"
++      AC_DEFINE(LINUX_TPROXY2, 0, [Enable real Transparent Proxy support for Netfilter TPROXY v2.])
++    fi
++    AC_MSG_RESULT($LINUX_TPROXY2)
++    if test "$LINUX_TPROXY2" = "no" && test "$LINUX_NETFILTER" = "yes"; then
++        echo "WARNING: Cannot find TPROXY v2 headers, you need to install the"
++        echo "tproxy package from:"
++        echo " - lynx http://www.balabit.com/downloads/tproxy/"
++        echo "Or select the '--enable-linux-tproxy4' option instead."
++        sleep 10
      fi
--    AC_MSG_RESULT($LINUX_TPROXY)
--fi
--if test "$LINUX_TPROXY" = "no" && test "$LINUX_NETFILTER" = "yes"; then
--    echo "WARNING: Cannot find TPROXY headers, you need to install the"
--    echo "tproxy package from:"
--    echo " - lynx http://www.balabit.com/downloads/tproxy/"
--    sleep 10
  fi
  
  if test -z "$USE_GNUREGEX" ; then

diff --cc include/autoconf.h.in
index 712aa4a35a43a096688f94be20912f44c73448f4,712aa4a35a43a096688f94be20912f44c73448f4..815f5b998f68febce802761a0ef6b9463cb50185
--- 1/include/autoconf.h.in
--- 2/include/autoconf.h.in
+++ b/include/autoconf.h.in
@@@ -792,8 -792,8 +792,11 @@@
  /* Enable support for Transparent Proxy on Linux (Netfilter) systems */
  #undef LINUX_NETFILTER
  
--/* Enable real Transparent Proxy support for Netfilter TPROXY. */
--#undef LINUX_TPROXY
++/* Enable real Transparent Proxy support for Netfilter TPROXY v2. */
++#undef LINUX_TPROXY2
++
++/* Enable real Transparent Proxy support for Netfilter TPROXY v4. */
++#undef LINUX_TPROXY4
  
  /* If we need to declare sys_errlist[] as external */
  #undef NEED_SYS_ERRLIST

diff --cc src/IPInterception.cc
index e7d510b2b95e620c9ebedd0f3380fc1378e89de8,e7d510b2b95e620c9ebedd0f3380fc1378e89de8..5feb509169cbbc6e559f71f1593a77cfae1fd6d7
--- 1/src/IPInterception.cc
--- 2/src/IPInterception.cc
+++ b/src/IPInterception.cc
@@@ -1,4 -1,4 +1,3 @@@
--
  /*
   * $Id: IPInterception.cc,v 1.20 2008/02/05 22:38:24 amosjeffries Exp $
   *
@@@ -88,11 -88,11 +87,12 @@@
  #include <linux/netfilter_ipv4.h>
  #endif
  
--#if IPF_TRANSPARENT
  int
--
  clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst)
  {
++
++#if IPF_TRANSPARENT  /* --enable-ipf-transparent */
++
      dst = me;
      if( !me.IsIPv4() ) return -1;
      if( !peer.IsIPv4() ) return -1;
@@@ -198,12 -198,12 +198,11 @@@
  
          return 0;
      }
--}
  
--#elif LINUX_NETFILTER
--int
--clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst)
--{
++
++
++#elif LINUX_NETFILTER || LINUX_TPROXY4  /* --enable-linux-netfilter OR --enable-linux-tproxy4 */
++
      dst = me;
      if( !me.IsIPv4() ) return -1;
      if( !peer.IsIPv4() ) return -1;
@@@ -213,12 -213,12 +212,16 @@@
  
      dst.GetAddrInfo(lookup,AF_INET);
  
++#if LINUX_NETFILTER
      if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, lookup->ai_addr, &lookup->ai_addrlen) != 0)
++#elif LINUX_TPROXY4
++    if (getsockopt(fd, SOL_IP, IP_TRANSPARENT, lookup->ai_addr, &lookup->ai_addrlen) != 0)
++#endif
      {
          dst.FreeAddrInfo(lookup);
  
          if (squid_curtime - last_reported > 60) {
--            debugs(89, 1, "clientNatLookup: peer " << peer << " NF getsockopt(SO_ORIGINAL_DST) failed: " << xstrerror());
++            debugs(89, 1, "clientNatLookup: peer " << peer << " NF getsockopt(" << (LINUX_NETFILTER?"SO_ORIGINAL_DST":"IP_TRANSPARENT") << ") failed: " << xstrerror());
              last_reported = squid_curtime;
          }
  
@@@ -234,13 -234,13 +237,9 @@@
          return 0;
      else
          return -1;
--}
  
--#elif PF_TRANSPARENT
--int
  
--clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress dst)
--{
++#elif PF_TRANSPARENT  /* --enable-pf-transparent */
  
      struct pfioc_natlook nl;
      static int pffd = -1;
@@@ -300,12 -300,12 +299,10 @@@
          else
              return -1;
      }
--}
  
--#elif IPFW_TRANSPARENT
--int
--clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst)
--{
++
++#elif IPFW_TRANSPARENT /* --enable-ipfw-transparent */
++
      int ret;
      struct addrinfo *lookup = NULL;
  
@@@ -330,14 -330,14 +327,13 @@@
      dst.FreeAddrInfo(lookup);
  
      return 0;
--}
  
--#else
--int
--clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst)
--{
++
++#else /* none of the transparent options configured */
++
      debugs(89, 1, "WARNING: transparent proxying not supported");
      return -1;
--}
++
  #endif
  
++}

diff --cc src/IPInterception.h
index 7c810de544d0f10e47adc87dadeccecc87e3ee03,7c810de544d0f10e47adc87dadeccecc87e3ee03..0e349b81fa7106b24b790556d016015ef87226c0
--- 1/src/IPInterception.h
--- 2/src/IPInterception.h
+++ b/src/IPInterception.h
@@@ -1,4 -1,4 +1,3 @@@
--
  /*
   * $Id: IPInterception.h,v 1.7 2007/12/14 23:11:45 amosjeffries Exp $
   *
@@@ -30,13 -30,13 +29,15 @@@
   *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
   *
   */
--
  #ifndef SQUID_IPINTERCEPTION_H
  #define SQUID_IPINTERCEPTION_H
  
  #include "IPAddress.h"
  
--SQUIDCEXTERN int
--clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst);
++#if LINUX_TPROXY4 && !defined(IP_TRANSPARENT)
++#define IP_TRANSPARENT 19
++#endif
++
++SQUIDCEXTERN int clientNatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst);
  
  #endif /* SQUID_IPINTERCEPTION_H */

diff --cc src/ProtoPort.h
index 8873dbea6e9d5b57abc6dbf466fa62b97765c6ea,ff696cf970b5d829ce6bb8bad21418c26ada7b9e..9d1ea8fa0a400ae50e6bddcccbb6597b0e45ed82
--- 1/src/ProtoPort.h
--- 2/src/ProtoPort.h
+++ b/src/ProtoPort.h
@@@ -35,9 -31,8 +31,9 @@@ struct http_port_lis
  
      int vport;                 /* virtual port support, -1 for dynamic, >0 static*/
      int disable_pmtu_discovery;
--#if LINUX_TPROXY
- unsigned int tproxy:
-     1; /* spoof client ip using tproxy */
++
++#if LINUX_TPROXY2 || LINUX_TPROXY4
+     unsigned int tproxy:1; /* spoof client ip using tproxy */
  #endif
  
      struct {

diff --cc src/cache_cf.cc
index d3c708144c6d177f1fe5803362dff9aae1ec1975,9080a07b2abff97085e101f59be70a82315938ee..d05034d035105ce22505991fd785795c29b0fafb
--- 1/src/cache_cf.cc
--- 2/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@@ -1,4 -1,4 +1,3 @@@
--
  /*
   * $Id: cache_cf.cc,v 1.544 2008/03/04 12:00:36 amosjeffries Exp $
   *
@@@ -2932,7 -2928,7 +2927,7 @@@ parse_http_port_option(http_port_list 
          else
              self_destruct();
  
--#if LINUX_TPROXY
++#if LINUX_TPROXY2 || LINUX_TPROXY4
  
      } else if (strcmp(token, "tproxy") == 0) {
          s->tproxy = 1;
@@@ -2945,6 -2941,6 +2940,7 @@@
          }
  #endif
  #endif
++
      } else if (strcmp(token, "ipv4") == 0) {
  #if USE_IPV6
          if( !s->s.SetIPv4() ) {

diff --cc src/client_side.cc
index 76b253b7799d848f38257b651e9585423a7fa9a9,db8561a4b2503e675ccb3a37555c6b10411b4a16..5cb617f5d9efe9f7f404610c0b6e1939d5944bc5
--- 1/src/client_side.cc
--- 2/src/client_side.cc
+++ b/src/client_side.cc
@@@ -2217,8 -2213,8 +2213,7 @@@ clientProcessRequest(ConnStateData *con
  
      request->flags.transparent = http->flags.transparent;
  
--#if LINUX_TPROXY
--
++#if LINUX_TPROXY2 || LINUX_TPROXY4
      request->flags.tproxy = conn->port->tproxy && need_linux_tproxy;
  #endif
  
@@@ -3124,6 -3118,6 +3117,13 @@@ clientHttpConnectionsOpen(void
          if (fd < 0)
              continue;
  
++#if LINUX_TPROXY4
++        /* because the transparent/non-transparent port info is only known here.
++         * we have to set the IP_TRANSPARENT option here. */
++        if(s->transparent)
++            comm_set_transparent(fd,0);
++#endif
++
          comm_listen(fd);
  
          comm_accept(fd, httpAccept, s);

diff --cc src/comm.cc
index 513c71a2ceb670f7ab6eb3ebd461cbc340e97510,5d6e5034246b6af1dce86a8d8d72a22026aa07f0..f3798a26a2329ed9c78aeb24e292a7a2ac0976c4
--- 1/src/comm.cc
--- 2/src/comm.cc
+++ b/src/comm.cc
@@@ -627,6 -627,6 +627,18 @@@ comm_set_v6only(int fd, int tos
  #endif /* sockopt */
  }
  
++void
++comm_set_transparent(int fd, int tos)
++{
++#if LINUX_TPROXY4
++    if (setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, (char *) &tos, sizeof(int)) < 0) {
++        debugs(50, 1, "comm_open: setsockopt(IP_TRANSPARENT) on FD " << fd << ": " << xstrerror());
++    }
++#else
++    debugs(50, 0, "WARNING: comm_open: setsockopt(IP_TRANSPARENT) not supported on this platform");
++#endif /* sockopt */
++}
++
  /**
   * Create a socket. Default is blocking, stream (TCP) socket.  IO_TYPE
   * is OR of flags specified in defines.h:COMM_*

diff --cc src/forward.cc
index 48e060311b93316400cb8d41af928841b2b41706,d8e47225d9103824729b14efb3c93de51e3c3f93..2c0144106259e43672191dcc760cd451ae7c5d9e
--- 1/src/forward.cc
--- 2/src/forward.cc
+++ b/src/forward.cc
@@@ -49,8 -49,8 +49,12 @@@
  #include "SquidTime.h"
  #include "Store.h"
  
--#if LINUX_TPROXY
++#if LINUX_TPROXY2
++#ifdef HAVE_LINUX_NETFILTER_IPV4_IP_TPROXY_H
  #include <linux/netfilter_ipv4/ip_tproxy.h>
++#else
++#error " TPROXY v2 Header file missing: linux/netfilter_ipv4/ip_tproxy.h. Perhapse you meant to use TPROXY v4 ? "
++#endif
  #endif
  
  static PSC fwdStartCompleteWrapper;

diff --cc src/forward.h
index 90e46956d9b45529172b45298ea69eab7622632a,d15149cb43a2f8b4807cf19a942786b3e7d1c63c..c3a8d77ef880387385f7de2de7095c9a34c9f6db
--- 1/src/forward.h
--- 2/src/forward.h
+++ b/src/forward.h
@@@ -95,18 -95,11 +95,11 @@@ private
  
      struct
      {
- 
- unsigned int dont_retry:
-         1;
- 
- unsigned int ftp_pasv_failed:
-         1;
- 
- unsigned int forward_completed:1;
-     }
- 
-     flags;
- #if LINUX_NETFILTER
+         unsigned int dont_retry:1;
+         unsigned int ftp_pasv_failed:1;
+         unsigned int forward_completed:1;
+     } flags;
 -#if LINUX_NETFILTER
++#if LINUX_NETFILTER || LINUX_TPROXY2 || LINUX_TPROXY4
      IPAddress src;
  #endif
  

diff --cc src/globals.h
index 0d6afa2d9a7f477eaa4009c91ec6304c0c79e071,0d6afa2d9a7f477eaa4009c91ec6304c0c79e071..9d581252fc22232c74c8166efd6f0f8e6971ccf2
--- 1/src/globals.h
--- 2/src/globals.h
+++ b/src/globals.h
@@@ -185,7 -185,7 +185,7 @@@ extern "C
      extern const char *external_acl_message;      /* NULL */
      extern int opt_send_signal;       /* -1 */
      extern int opt_no_daemon; /* 0 */
--#if LINUX_TPROXY
++#if LINUX_TPROXY2 || LINUX_TPROXY4
      extern int need_linux_tproxy; /* 0 */
  #endif
  

diff --cc src/http.cc
index 3b48de45d734dfabdc705cd3f485c64e86f06d76,3b48de45d734dfabdc705cd3f485c64e86f06d76..18f643688a8ac0f9ff7c237893b35d83a07259ff
--- 1/src/http.cc
--- 2/src/http.cc
+++ b/src/http.cc
@@@ -1229,7 -1229,7 +1229,8 @@@ HttpStateData::processReplyBody(
            comm_remove_close_handler(fd, closeHandler);
              closeHandler = NULL;
              fwd->unregister(fd);
--#if LINUX_TPROXY
++
++#if LINUX_TPROXY2 || LINUX_TPROXY4
  
              if (orig_request->flags.tproxy)
                  client_addr = orig_request->client_addr;

diff --cc src/structs.h
index 014b82db5d7f4aacbf16b2322e1f6641df84c4fe,b65065a9a376beb915af388f21063a4b82c05cf3..dfbce3fe16d8ad34bc2f5541ba4d1fd9e5fc105c
--- 1/src/structs.h
--- 2/src/structs.h
+++ b/src/structs.h
@@@ -1164,71 -1029,34 +1029,34 @@@ struct request_flag
  #if HTTP_VIOLATIONS
          nocache_hack = 0;
  #endif
--#if LINUX_TPROXY
++#if LINUX_TPROXY2 || LINUX_TPROXY4
        tproxy = 0;
  #endif
- 
      }
  
- unsigned int range:
-     1;
- 
- unsigned int nocache:
-     1;
- 
- unsigned int ims:
-     1;
- 
- unsigned int auth:
-     1;
- 
- unsigned int cachable:
-     1;
- 
- unsigned int hierarchical:
-     1;
- 
- unsigned int loopdetect:
-     1;
- 
- unsigned int proxy_keepalive:
-     1;
- 
- unsigned int proxying:
-     1;        /* this should be killed, also in httpstateflags */
- 
- unsigned int refresh:
-     1;
- 
- unsigned int redirected:
-     1;
- 
- unsigned int need_validation:
-     1;
+     unsigned int range:1;
+     unsigned int nocache:1;
+     unsigned int ims:1;
+     unsigned int auth:1;
+     unsigned int cachable:1;
+     unsigned int hierarchical:1;
+     unsigned int loopdetect:1;
+     unsigned int proxy_keepalive:1;
+     unsigned int proxying:1;  /* this should be killed, also in httpstateflags */
+     unsigned int refresh:1;
+     unsigned int redirected:1;
+     unsigned int need_validation:1;
  #if HTTP_VIOLATIONS
- 
- unsigned int nocache_hack:
-     1;        /* for changing/ignoring no-cache requests */
+     unsigned int nocache_hack:1;      /* for changing/ignoring no-cache requests */
  #endif
- 
- unsigned int accelerated:
-     1;
- 
- unsigned int transparent:
-     1;
- 
- #if LINUX_TPROXY
- unsigned int tproxy:
-     1; /* spoof client ip using tproxy */
+     unsigned int accelerated:1;
+     unsigned int transparent:1;
 -#if LINUX_TPROXY
++#if LINUX_TPROXY2 || LINUX_TPROXY4
+     unsigned int tproxy:1; /* spoof client ip using tproxy */
  #endif
- unsigned int internal:
-     1;
- 
- unsigned int internalclient:
-     1;
- 
- unsigned int must_keepalive:
-     1;
+     unsigned int internal:1;
+     unsigned int internalclient:1;
+     unsigned int must_keepalive:1;
  
      // When adding new flags, please update cloneAdaptationImmune() as needed.
  

diff --cc src/tools.cc
index 47255438ea798778e1116b3347c9d4f7792469a4,bf3f7c452852530dd236bbe871a69732e33ee38e..aa87a254a7c81a4f8d71aec5715549aa50e68fdd
--- 1/src/tools.cc
--- 2/src/tools.cc
+++ b/src/tools.cc
@@@ -1238,7 -1236,7 +1236,7 @@@ keepCapabilities(void
  
      if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
          /* Silent failure unless TPROXY is required. Maybe not started as root */
--#if LINUX_TPROXY
++#if LINUX_TPROXY2 || LINUX_TPROXY4
  
          if (need_linux_tproxy)
              debugs(1, 1, "Error - tproxy support requires capability setting which has failed.  Continuing without tproxy support");
@@@ -1248,7 -1246,7 +1246,6 @@@
  #endif
  
      }
--
  #endif
  }
  
@@@ -1275,10 -1273,10 +1272,13 @@@ restoreCapabilities(int keep
  
      cap->inheritable = 0;
      cap->effective = (1 << CAP_NET_BIND_SERVICE);
--#if LINUX_TPROXY
  
++#if LINUX_TPROXY2
      if (need_linux_tproxy)
          cap->effective |= (1 << CAP_NET_ADMIN) | (1 << CAP_NET_BROADCAST);
++#elif LINUX_TPROXY4
++    if (need_linux_tproxy)
++        cap->effective |= (1 << CAP_NET_ADMIN);
  
  #endif
  
@@@ -1287,7 -1285,7 +1287,7 @@@
  
      if (capset(head, cap) != 0) {
          /* Silent failure unless TPROXY is required */
--#if LINUX_TPROXY
++#if LINUX_TPROXY2 || LINUX_TPROXY4
  
          if (need_linux_tproxy)
              debugs(50, 1, "Error enabling needed capabilities. Will continue without tproxy support");
@@@ -1301,14 -1299,14 +1301,14 @@@
  nocap:
      xfree(head);
      xfree(cap);
--#else
--#if LINUX_TPROXY
++#else /* not defined(_SQUID_LINUX_) && HAVE_SYS_CAPABILITY_H */
++
++#if LINUX_TPROXY2 || LINUX_TPROXY4
  
      if (need_linux_tproxy)
          debugs(50, 1, "Missing needed capability support. Will continue without tproxy support");
  
      need_linux_tproxy = 0;
--
  #endif
  
  #endif