[Tech] kernel 2.4 e transparent proxy

[Aldo Podavini]

Vabbè, ci riprovo:

L'autore di Zorp - Balázs Scheidler - scrive ( 
http://www.balabit.com/products/oss/tproxy/ ):

> Real transparent proxying requires the following three features from 
> the IP stack of the computer it is running on:
>  1 - Redirect sessions destined to the outer network to a local 
> process using a packet filter rule.
>  2 - Make it possible for a process to listen to connections on a 
> foreign address.
>  3 - Make it possible for a process to initiate a connection with a 
> foreign address as a source.
> Item #1 is usually provided by packet filtering packages like 
> Netfilter/IPTables, IPFilter.
>
> All three were provided in Linux kernels 2.2.x, but support for this 
> was removed. 



E per ovviare a questo passo indietro della 2.4 lui stesso ha scritto 
una patch ( http://www.balabit.com/products/zorp_gpl/tutorial/ ) :

> The transparent proxy support that was present in Linux 2.2 was 
> removed from Linux 2.4 when iptables was introduced. We implemented a 
> patch against Linux 2.4 that adds the required features so Zorp 
> tightly integrates into NetFilter/iptables. 



Ma come ?!?
Forse che Squid, quando viene configurato per essere un transparent 
proxy, non si mette proprio a "listen to connections on a foreign 
address" , senza nessuna patch particolare ?!?
Capisco - forse - il punto 3 (HTTP non ha bisogno di connessioni 
all'indietro, come invece FTP, per esempio, e quindi è un problema che 
Squid non ha), ma il punto 2 proprio non lo capisco.
Serve davvero questa benedetta patch di Balázs ? E cosa avrebbe avuto la 
2.2 che la 2.4 ha poi perso ?

Ciao
Aldo