diff -Naurw squid-2.7.STABLE4.orig/configure squid-2.7.STABLE4.tproxy/configure
--- squid-2.7.STABLE4.orig/configure	2008-09-08 18:39:26.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/configure	2008-09-08 18:39:43.000000000 -0300
@@ -1481,8 +1481,6 @@
   --enable-large-cache-files
 			  Enable support for large cache files (>2GB).
 			  WARNING: on-disk cache format is changed by this option
-  --enable-linux-tproxy
-			  Enable real Transparent Proxy support for Netfilter TPROXY.
   --enable-leakfinder
 			  Enable Leak Finding code.  Enabling this alone
 			  does nothing; you also have to modify the source
@@ -5274,27 +5272,6 @@
 	;;
 esac
 
-# Check whether --enable-linux-tproxy was given.
-if test "${enable_linux_tproxy+set}" = set; then
-  enableval=$enable_linux_tproxy;  if test "$enableval" = "yes" ; then
-	echo "Linux Netfilter/TPROXY enabled"
-
-cat >>confdefs.h <<\_ACEOF
-#define LINUX_TPROXY 1
-_ACEOF
-
-	LINUX_TPROXY="yes"
-        if test -z "$LINUX_NETFILTER"; then
-	    echo "Linux-Netfilter Transparent Proxy automatically enabled"
-	    LINUX_NETFILTER="yes"
-	fi
-  fi
-
-fi
-
-
-
-
 if false; then
   MAKE_LEAKFINDER_TRUE=
   MAKE_LEAKFINDER_FALSE='#'
@@ -8051,7 +8028,6 @@
 	grp.h \
 	libc.h \
 	linux/netfilter_ipv4.h \
-	linux/netfilter_ipv4/ip_tproxy.h \
 	malloc.h \
 	math.h \
 	memory.h \
@@ -25954,35 +25930,6 @@
     sleep 10
 fi
 
-if test "$LINUX_TPROXY" ; then
-    { echo "$as_me:$LINENO: checking if TPROXY header files are installed" >&5
-echo $ECHO_N "checking if TPROXY header files are installed... $ECHO_C" >&6; }
-    # hold on to your hats...
-    if test "$ac_cv_header_linux_netfilter_ipv4_ip_tproxy_h" = "yes" && test "$LINUX_NETFILTER" = "yes"; then
-	LINUX_TPROXY="yes"
-
-cat >>confdefs.h <<\_ACEOF
-#define LINUX_TPROXY 1
-_ACEOF
-
-    else
-	LINUX_TPROXY="no"
-
-cat >>confdefs.h <<\_ACEOF
-#define LINUX_TPROXY 0
-_ACEOF
-
-    fi
-    { echo "$as_me:$LINENO: result: $LINUX_TPROXY" >&5
-echo "${ECHO_T}$LINUX_TPROXY" >&6; }
-fi
-if test "$LINUX_TPROXY" = "no" && test "$LINUX_NETFILTER" = "yes"; then
-    echo "WARNING: Cannot find TPROXY headers, you need to install the"
-    echo "tproxy package from:"
-    echo " - lynx http://www.balabit.com/downloads/tproxy/"
-    sleep 10
-fi
-
 if test -z "$USE_GNUREGEX" ; then
     case "$host" in
     *-sun-solaris2.[0-4])
diff -Naurw squid-2.7.STABLE4.orig/configure.in squid-2.7.STABLE4.tproxy/configure.in
--- squid-2.7.STABLE4.orig/configure.in	2008-08-08 16:21:03.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/configure.in	2008-09-08 18:39:43.000000000 -0300
@@ -1136,21 +1136,6 @@
 	;;
 esac
 
-dnl Enable Linux transparent proxy support
-AC_ARG_ENABLE(linux-tproxy,
-[  --enable-linux-tproxy
-			  Enable real Transparent Proxy support for Netfilter TPROXY.],
-[ if test "$enableval" = "yes" ; then
-	echo "Linux Netfilter/TPROXY enabled"
-	AC_DEFINE(LINUX_TPROXY, 1, [Enable real Transparent Proxy support for Netfilter TPROXY.])
-	LINUX_TPROXY="yes"
-        if test -z "$LINUX_NETFILTER"; then
-	    echo "Linux-Netfilter Transparent Proxy automatically enabled"
-	    LINUX_NETFILTER="yes"
-	fi
-  fi
-])
-
 AM_CONDITIONAL(MAKE_LEAKFINDER, false)
 dnl Enable Leak Finding Functions
 AC_ARG_ENABLE(leakfinder,
@@ -1634,7 +1619,6 @@
 	grp.h \
 	libc.h \
 	linux/netfilter_ipv4.h \
-	linux/netfilter_ipv4/ip_tproxy.h \
 	malloc.h \
 	math.h \
 	memory.h \
@@ -2734,27 +2718,6 @@
     sleep 10
 fi
 
-dnl Linux Netfilter/TPROXY support requires some specific header files
-dnl Shamelessly copied from shamelessly copied from above
-if test "$LINUX_TPROXY" ; then
-    AC_MSG_CHECKING(if TPROXY header files are installed)
-    # hold on to your hats...
-    if test "$ac_cv_header_linux_netfilter_ipv4_ip_tproxy_h" = "yes" && test "$LINUX_NETFILTER" = "yes"; then
-	LINUX_TPROXY="yes"
-	AC_DEFINE(LINUX_TPROXY, 1, [Enable real Transparent Proxy support for Netfilter TPROXY.])
-    else
-	LINUX_TPROXY="no"
-	AC_DEFINE(LINUX_TPROXY, 0, [Enable real Transparent Proxy support for Netfilter TPROXY.])
-    fi
-    AC_MSG_RESULT($LINUX_TPROXY)
-fi
-if test "$LINUX_TPROXY" = "no" && test "$LINUX_NETFILTER" = "yes"; then
-    echo "WARNING: Cannot find TPROXY headers, you need to install the"
-    echo "tproxy package from:"
-    echo " - lynx http://www.balabit.com/downloads/tproxy/"
-    sleep 10
-fi
-
 if test -z "$USE_GNUREGEX" ; then
     case "$host" in
     *-sun-solaris2.[[0-4]])
diff -Naurw squid-2.7.STABLE4.orig/src/cache_cf.c squid-2.7.STABLE4.tproxy/src/cache_cf.c
--- squid-2.7.STABLE4.orig/src/cache_cf.c	2008-06-27 18:52:56.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/cache_cf.c	2008-09-08 18:39:43.000000000 -0300
@@ -42,6 +42,12 @@
 #include "snmp.h"
 #endif
 
+#if LINUX_NETFILTER 
+#warning almafa
+#else
+#error krotefa
+#endif
+
 static const char *const T_SECOND_STR = "second";
 static const char *const T_MINUTE_STR = "minute";
 static const char *const T_HOUR_STR = "hour";
@@ -2879,7 +2885,7 @@
 	s->urlgroup = xstrdup(token + 9);
     } else if (strncmp(token, "protocol=", 9) == 0) {
 	s->protocol = xstrdup(token + 9);
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     } else if (strcmp(token, "tproxy") == 0) {
 	s->tproxy = 1;
 	need_linux_tproxy = 1;
@@ -2985,7 +2991,7 @@
 	storeAppendPrintf(e, " protocol=%s", s->protocol);
     if (s->no_connection_auth)
 	storeAppendPrintf(e, " no-connection-auth");
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     if (s->tproxy)
 	storeAppendPrintf(e, " tproxy");
 #endif
diff -Naurw squid-2.7.STABLE4.orig/src/cf_gen_defines squid-2.7.STABLE4.tproxy/src/cf_gen_defines
--- squid-2.7.STABLE4.orig/src/cf_gen_defines	2006-05-31 16:39:14.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/cf_gen_defines	2008-09-08 18:39:43.000000000 -0300
@@ -6,7 +6,6 @@
 	print "struct { const char *name; const char *enable; int defined;} defines[] = {"
 	define["DELAY_POOLS"]="--enable-delay-pools"
 	define["HTTP_VIOLATIONS"]="--enable-http-violations"
-	define["LINUX_TPROXY"]="--enable-linux-tproxy"
 	define["MULTICAST_MISS_STREAM"]="--enable-multicast-miss"
 	define["SQUID_SNMP"]="--enable-snmp"
 	define["USE_CACHE_DIGESTS"]="--enable-cache-digests"
diff -Naurw squid-2.7.STABLE4.orig/src/client_side.c squid-2.7.STABLE4.tproxy/src/client_side.c
--- squid-2.7.STABLE4.orig/src/client_side.c	2008-09-08 18:39:26.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/client_side.c	2008-09-08 18:39:43.000000000 -0300
@@ -4008,7 +4008,7 @@
 	}
 	if (conn->port->urlgroup)
 	    request->urlgroup = xstrdup(conn->port->urlgroup);
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
 	request->flags.tproxy = conn->port->tproxy && need_linux_tproxy;
 #endif
 	request->flags.accelerated = http->flags.accel;
@@ -4931,6 +4931,7 @@
 {
     http_port_list *s;
     int fd;
+    int flags;
     for (s = Config.Sockaddr.http; s; s = s->next) {
 	if (MAXHTTPPORTS == NHttpSockets) {
 	    debug(1, 1) ("WARNING: You have too many 'http_port' lines.\n");
@@ -4952,11 +4953,16 @@
 		"HTTP Socket");
 	} else {
 	    enter_suid();
+	flags = COMM_NONBLOCKING;
+#if LINUX_NETFILTER
+        if (s->tproxy)
+		flags |= COMM_TRANSPARENT;
+#endif
 	    fd = comm_open(SOCK_STREAM,
 		IPPROTO_TCP,
 		s->s.sin_addr,
 		ntohs(s->s.sin_port),
-		COMM_NONBLOCKING,
+	    flags,
 		"HTTP Socket");
 	    leave_suid();
 	}
diff -Naurw squid-2.7.STABLE4.orig/src/comm.c squid-2.7.STABLE4.tproxy/src/comm.c
--- squid-2.7.STABLE4.orig/src/comm.c	2008-06-27 17:56:56.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/comm.c	2008-09-08 18:39:43.000000000 -0300
@@ -47,6 +47,12 @@
 #include <netinet/tcp.h>
 #endif
 
+#if LINUX_NETFILTER
+#ifndef IP_TRANSPARENT
+#define IP_TRANSPARENT	19
+#endif
+#endif
+
 typedef struct {
     char *host;
     u_short port;
@@ -63,6 +69,9 @@
 /* STATIC */
 static int commBind(int s, struct in_addr, u_short port);
 static void commSetReuseAddr(int);
+#if LINUX_NETFILTER
+static void commSetTransparent(int);
+#endif
 static void commSetNoLinger(int);
 static void CommWriteStateCallbackAndFree(int fd, int code);
 #ifdef TCP_NODELAY
@@ -251,6 +260,12 @@
 	if (opt_reuseaddr)
 	    commSetReuseAddr(new_socket);
     }
+#if LINUX_NETFILTER
+    if (flags & COMM_TRANSPARENT) {
+        F->flags.transparent = 1;
+        commSetTransparent(new_socket);
+    }
+#endif
     if (addr.s_addr != no_addr.s_addr) {
 	if (commBind(new_socket, addr, port) != COMM_OK) {
 	    comm_close(new_socket);
@@ -415,6 +430,11 @@
      * yuck, this has assumptions about comm_open() arguments for
      * the original socket
      */
+#if LINUX_NETFILTER
+    if (F->flags.transparent)
+    	commSetTransparent(cs->fd);
+#endif
+
     if (commBind(cs->fd, F->local_addr, F->local_port) != COMM_OK) {
 	debug(5, 0) ("commResetFD: bind: %s\n", xstrerror());
 	return 0;
@@ -978,6 +998,18 @@
 	debug(5, 1) ("commSetReuseAddr: FD %d: %s\n", fd, xstrerror());
 }
 
+#if LINUX_NETFILTER
+static void
+commSetTransparent(int fd)
+{
+    int on = 1;
+    debug(5, 3) ("commSetTransparent: FD %d\n", fd);
+    if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, (char*)&on, sizeof(on)) < 0)
+		debug(5, 1) ("commSetTransparent: FD %d: %s\n", fd, xstrerror());
+    fd_table[fd].flags.transparent = 1;
+}
+#endif
+
 static void
 commSetTcpRcvbuf(int fd, int size)
 {
diff -Naurw squid-2.7.STABLE4.orig/src/defines.h squid-2.7.STABLE4.tproxy/src/defines.h
--- squid-2.7.STABLE4.orig/src/defines.h	2007-09-24 10:31:19.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/defines.h	2008-09-08 18:39:43.000000000 -0300
@@ -93,6 +93,9 @@
 #define COMM_NONBLOCKING	0x01
 #define COMM_NOCLOEXEC		0x02
 #define COMM_REUSEADDR		0x04
+#if LINUX_NETFILTER
+#define COMM_TRANSPARENT	0x08
+#endif
 
 #define do_debug(SECTION, LEVEL) \
 	((_db_level = (LEVEL)) <= debugLevels[SECTION])
diff -Naurw squid-2.7.STABLE4.orig/src/forward.c squid-2.7.STABLE4.tproxy/src/forward.c
--- squid-2.7.STABLE4.orig/src/forward.c	2008-09-08 18:39:26.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/forward.c	2008-09-08 18:39:43.000000000 -0300
@@ -41,9 +41,6 @@
 #include <linux/types.h>
 #include <linux/netfilter_ipv4.h>
 #endif
-#if LINUX_TPROXY
-#include <linux/netfilter_ipv4/ip_tproxy.h>
-#endif
 
 static PSC fwdStartComplete;
 static void fwdDispatch(FwdState *);
@@ -524,9 +521,7 @@
     int ftimeout = Config.Timeout.forward - (squid_curtime - fwdState->start);
     struct in_addr outgoing;
     unsigned short tos;
-#if LINUX_TPROXY
-    struct in_tproxy itp;
-#endif
+    int flags;
     int idle = -1;
 
     assert(fs);
@@ -577,9 +572,10 @@
 	fwdRestart(fwdState);
 	return;
     }
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     if (fd == -1 && fwdState->request->flags.tproxy)
 	fd = pconnPop(name, port, domain, &fwdState->request->client_addr, 0, NULL);
+    else
 #endif
     if (fd == -1) {
 	fd = pconnPop(name, port, domain, NULL, 0, &idle);
@@ -631,11 +627,21 @@
 
     debug(17, 3) ("fwdConnectStart: got addr %s, tos %d\n",
 	inet_ntoa(outgoing), tos);
+
+    flags = COMM_NONBLOCKING;
+#if LINUX_NETFILTER
+    if ((outgoing.s_addr == INADDR_ANY) && fwdState->request->flags.tproxy) {
+        outgoing = fwdState->request->client_addr;
+	flags |= COMM_TRANSPARENT;
+	debug(17,3)("fwdConnectStart: setting outgoing.s_addr=%08X (will set TRANSPARENT)\n",
+		outgoing.s_addr);
+    }
+#endif
     fd = comm_openex(SOCK_STREAM,
 	IPPROTO_TCP,
 	outgoing,
 	0,
-	COMM_NONBLOCKING,
+	flags,
 	tos,
 	url);
     if (fd < 0) {
@@ -668,32 +674,6 @@
     if (fs->peer) {
 	hierarchyNote(&fwdState->request->hier, fs->code, fs->peer->name);
     } else {
-#if LINUX_TPROXY
-	if (fwdState->request->flags.tproxy) {
-
-	    itp.v.addr.faddr.s_addr = fwdState->src.sin_addr.s_addr;
-	    itp.v.addr.fport = 0;
-
-	    /* If these syscalls fail then we just fallback to connecting
-	     * normally by simply ignoring the errors...
-	     */
-	    itp.op = TPROXY_ASSIGN;
-	    if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) {
-		debug(20, 1) ("tproxy ip=%s,0x%x,port=%d ERROR ASSIGN\n",
-		    inet_ntoa(itp.v.addr.faddr),
-		    itp.v.addr.faddr.s_addr,
-		    itp.v.addr.fport);
-	    } else {
-		itp.op = TPROXY_FLAGS;
-		itp.v.flags = ITP_CONNECT;
-		if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) {
-		    debug(20, 1) ("tproxy ip=%x,port=%d ERROR CONNECT\n",
-			itp.v.addr.faddr.s_addr,
-			itp.v.addr.fport);
-		}
-	    }
-	}
-#endif
 	hierarchyNote(&fwdState->request->hier, fs->code, fwdState->request->host);
     }
     commConnectStart(fd, host, port, fwdConnectDone, fwdState);
@@ -954,7 +934,7 @@
     fwdState->start = squid_curtime;
     fwdState->orig_entry_flags = e->flags;
 
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     /* If we need to transparently proxy the request
      * then we need the client source address and port */
     fwdState->src.sin_family = AF_INET;
diff -Naurw squid-2.7.STABLE4.orig/src/globals.h squid-2.7.STABLE4.tproxy/src/globals.h
--- squid-2.7.STABLE4.orig/src/globals.h	2007-09-24 10:28:48.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/globals.h	2008-09-08 18:39:43.000000000 -0300
@@ -174,7 +174,7 @@
 #endif
 extern int opt_send_signal;	/* -1 */
 extern int opt_no_daemon;	/* 0 */
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
 extern int need_linux_tproxy;	/* 0 */
 #endif
 extern int opt_parse_cfg_only;	/* 0 */
diff -Naurw squid-2.7.STABLE4.orig/src/http.c squid-2.7.STABLE4.tproxy/src/http.c
--- squid-2.7.STABLE4.orig/src/http.c	2008-06-25 19:14:02.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/http.c	2008-09-08 18:39:43.000000000 -0300
@@ -804,7 +804,7 @@
 	keep_alive = 0;
     if (keep_alive) {
 	int pinned = 0;
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
 	if (orig_request->flags.tproxy) {
 	    client_addr = &httpState->request->client_addr;
 	}
diff -Naurw squid-2.7.STABLE4.orig/src/ssl.c squid-2.7.STABLE4.tproxy/src/ssl.c
--- squid-2.7.STABLE4.orig/src/ssl.c	2008-05-04 20:23:13.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/ssl.c	2008-09-08 18:39:43.000000000 -0300
@@ -499,6 +499,8 @@
     char *url = http->uri;
     struct in_addr outgoing;
     unsigned long tos;
+    int flags;
+
     /*
      * client_addr == no_addr indicates this is an "internal" request
      * from peer_digest.c, asn.c, netdb.c, etc and should always
@@ -523,11 +525,16 @@
     outgoing = getOutgoingAddr(request);
     tos = getOutgoingTOS(request);
     /* Create socket. */
+    flags = COMM_NONBLOCKING;
+#if LINUX_NETFILTER
+    if (request->flags.tproxy)
+	flags |= COMM_TRANSPARENT;
+#endif
     sock = comm_openex(SOCK_STREAM,
 	IPPROTO_TCP,
 	outgoing,
 	0,
-	COMM_NONBLOCKING,
+	flags,
 	tos,
 	url);
     if (sock == COMM_ERROR) {
diff -Naurw squid-2.7.STABLE4.orig/src/structs.h squid-2.7.STABLE4.tproxy/src/structs.h
--- squid-2.7.STABLE4.orig/src/structs.h	2008-07-21 17:18:50.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/structs.h	2008-09-08 18:39:43.000000000 -0300
@@ -371,7 +371,7 @@
     int vport;			/* virtual port support */
     int no_connection_auth;	/* Don't support connection oriented auth */
     unsigned int http11;	/* HTTP/1.1 support */
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     unsigned int tproxy;
 #endif
     unsigned int act_as_origin;	/* Fake Date: headers in accelerator mode */
@@ -920,6 +920,7 @@
 	unsigned int nodelay:1;
 	unsigned int close_on_exec:1;
 	unsigned int backoff:1;	/* keep track of whether the fd is backed off */
+	unsigned int transparent:1;
     } flags;
     comm_pending read_pending;
     comm_pending write_pending;
@@ -1882,7 +1883,7 @@
     unsigned int no_connection_auth:1;	/* Connection oriented auth can not be supported */
     unsigned int pinned:1;	/* Request seont on a pinned connection */
     unsigned int auth_sent:1;	/* Authentication forwarded */
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     unsigned int tproxy:1;
 #endif
     unsigned int collapsed:1;	/* This request was collapsed. Don't trust the store entry to be valid */
diff -Naurw squid-2.7.STABLE4.orig/src/tools.c squid-2.7.STABLE4.tproxy/src/tools.c
--- squid-2.7.STABLE4.orig/src/tools.c	2008-05-31 17:37:22.000000000 -0300
+++ squid-2.7.STABLE4.tproxy/src/tools.c	2008-09-08 18:39:43.000000000 -0300
@@ -1345,7 +1345,7 @@
 #if HAVE_PRCTL && defined(PR_SET_KEEPCAPS) && HAVE_SYS_CAPABILITY_H
     if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
 	/* Silent failure unless TPROXY is required. Maybe not started as root */
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
 	if (need_linux_tproxy)
 	    debug(1, 1) ("Error - tproxy support requires capability setting which has failed.  Continuing without tproxy support\n");
 	need_linux_tproxy = 0;
@@ -1377,15 +1377,15 @@
 
     cap->inheritable = 0;
     cap->effective = (1 << CAP_NET_BIND_SERVICE);
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     if (need_linux_tproxy)
-	cap->effective |= (1 << CAP_NET_ADMIN) | (1 << CAP_NET_BROADCAST);
+	cap->effective |= (1 << CAP_NET_ADMIN);
 #endif
     if (!keep)
 	cap->permitted &= cap->effective;
     if (capset(head, cap) != 0) {
 	/* Silent failure unless TPROXY is required */
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
 	if (need_linux_tproxy)
 	    debug(50, 1) ("Error enabling needed capabilities. Will continue without tproxy support\n");
 	need_linux_tproxy = 0;
@@ -1395,7 +1395,7 @@
     xfree(head);
     xfree(cap);
 #else
-#if LINUX_TPROXY
+#if LINUX_NETFILTER
     if (need_linux_tproxy)
 	debug(50, 1) ("Missing needed capability support. Will continue without tproxy support\n");
     need_linux_tproxy = 0;
