diff -urN Pound-2.4.5/config.c Poundtp-2.4.5/config.c
--- Pound-2.4.5/config.c	2009-06-29 17:53:58.000000000 +0200
+++ Poundtp-2.4.5/config.c	2009-07-20 21:10:00.358334124 +0200
@@ -79,6 +79,9 @@
 static regex_t  Redirect, RedirectN, TimeOut, Session, Type, TTL, ID, DynScale;
 static regex_t  ClientCert, AddHeader, Ciphers, CAlist, VerifyList, CRLlist, NoHTTPS11;
 static regex_t  Grace;
+#ifdef TPROXY_ENABLE
+static regex_t  TProxy;
+#endif
 
 static regmatch_t   matches[5];
 
@@ -125,6 +128,10 @@
     res->url = NULL;
     res->next = NULL;
     has_addr = has_port = 0;
+#ifdef TPROXY_ENABLE
+    res->tp_enabled = 0;
+#endif
+
     pthread_mutex_init(&res->mut, NULL);
     while(fgets(lin, MAXBUF, f_conf)) {
         n_lin++;
@@ -246,6 +253,10 @@
                 exit(1);
             }
             return res;
+#ifdef TPROXY_ENABLE
+        } else if(!regexec(&TProxy, lin, 4, matches, 0)) {
+	    if (enable_tproxy && have_tproxy) res->tp_enabled = atoi(lin + matches[1].rm_so);
+#endif
         } else {
             logmsg(LOG_ERR, "line %d: unknown directive \"%s\" - aborted", n_lin, lin);
             exit(1);
@@ -1186,6 +1197,13 @@
                     ;
                 svc->next = parse_service(f_conf, lin + matches[1].rm_so);
             }
+#ifdef TPROXY_ENABLE
+        } else if(!regexec(&TProxy, lin, 4, matches, 0)) {
+	    if (have_tproxy)
+                enable_tproxy = atoi(lin + matches[1].rm_so);
+	    else
+		enable_tproxy = 0;
+#endif
         } else {
             logmsg(LOG_ERR, "line %d: unknown directive \"%s\" - aborted", n_lin, lin);
             exit(1);
@@ -1258,6 +1276,9 @@
     || regcomp(&VerifyList, "^[ \t]*VerifyList[ \t]+\"(.+)\"[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
     || regcomp(&CRLlist, "^[ \t]*CRLlist[ \t]+\"(.+)\"[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
     || regcomp(&NoHTTPS11, "^[ \t]*NoHTTPS11[ \t]+([0-2])[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
+#ifdef TPROXY_ENABLE
+    || regcomp(&TProxy, "^[ \t]*TProxy[ \t]+([01])[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
+#endif
     ) {
         logmsg(LOG_ERR, "bad config Regex - aborted");
         exit(1);
@@ -1412,6 +1433,9 @@
     regfree(&VerifyList);
     regfree(&CRLlist);
     regfree(&NoHTTPS11);
+#ifdef TPROXY_ENABLE
+    regfree(&TProxy);
+#endif
 
     /* set the facility only here to ensure the syslog gets opened if necessary */
     log_facility = def_facility;
diff -urN Pound-2.4.5/http.c Poundtp-2.4.5/http.c
--- Pound-2.4.5/http.c	2009-06-29 17:53:58.000000000 +0200
+++ Poundtp-2.4.5/http.c	2009-09-21 23:32:43.560971722 +0200
@@ -782,7 +782,12 @@
                 clean_all();
                 pthread_exit(NULL);
             }
-            if(connect_nb(sock, &backend->addr, backend->to) < 0) {
+
+#ifdef TPROXY_ENABLE
+	    if(connect_nb(sock, &backend->addr, backend->to, backend->tp_enabled ? &from_host : NULL) < 0) {
+#else
+	    if(connect_nb(sock, &backend->addr, backend->to) < 0) {
+#endif
                 str_be(buf, MAXBUF - 1, backend);
                 logmsg(LOG_WARNING, "(%lx) backend %s connect: %s", pthread_self(), buf, strerror(errno));
                 shutdown(sock, 2);
diff -urN Pound-2.4.5/Makefile.in Poundtp-2.4.5/Makefile.in
--- Pound-2.4.5/Makefile.in	2009-06-29 17:53:58.000000000 +0200
+++ Poundtp-2.4.5/Makefile.in	2009-09-21 22:56:19.472972178 +0200
@@ -33,10 +33,19 @@
 C_GROUP="@C_GROUP@"
 C_SUPER="@C_SUPER@"
 C_CERT1L="@C_CERT1L@"
+C_TPROXY=
+
+TPROXY=0
+
+ifeq (${TPROXY}, 1)
+  $(if $(findstring "@target_os@", "linux-gnu"),,$(error TPROXY can be used just with Linux))
+  C_TPROXY=-DTPROXY_ENABLE
+endif
+
 
 CFLAGS=-DF_CONF=\"$(F_CONF)\" -DVERSION=\"${VERSION}\" -DC_SSL=\"${C_SSL}\" -DC_T_RSA=\"${C_T_RSA}\" \
 	-DC_MAXBUF=\"${C_MAXBUF}\" -DC_OWNER=\"${C_OWNER}\" -DC_GROUP=\"${C_GROUP}\" -DC_SUPER=\"${C_SUPER}\" \
-	-DC_CERT1L=\"${C_CERT1L}\" @CFLAGS@ @PTHREAD_CFLAGS@ @CPPFLAGS@
+	-DC_CERT1L=\"${C_CERT1L}\" @CFLAGS@ @PTHREAD_CFLAGS@ @CPPFLAGS@ ${C_TPROXY}
 LIBS=@LIBS@ @PTHREAD_LIBS@
 
 prefix=@prefix@
diff -urN Pound-2.4.5/pound.c Poundtp-2.4.5/pound.c
--- Pound-2.4.5/pound.c	2009-06-29 17:53:58.000000000 +0200
+++ Poundtp-2.4.5/pound.c	2009-09-21 23:44:46.700971301 +0200
@@ -41,6 +41,10 @@
             print_log,          /* print log messages to stdout/stderr */
             grace,              /* grace period before shutdown */
             control_sock;       /* control socket */
+#ifdef TPROXY_ENABLE
+int	    have_tproxy,	/* is transparent proxy available */
+	    enable_tproxy;	/* is tproxy enabled */
+#endif
 
 SERVICE     *services;          /* global services (if any) */
 
@@ -165,11 +169,23 @@
 #ifndef SOL_TCP
     struct protoent     *pe;
 #endif
+#ifdef TPROXY_ENABLE
+    typedef struct __user_cap_header_struct	tp_cap_header_t;
+    typedef struct __user_cap_data_struct	tp_cap_data_t;
+    tp_cap_header_t	tp_cap_header;
+    tp_cap_data_t	tp_cap_data;
+#endif
 
     print_log = 0;
     (void)umask(077);
     control_sock = -1;
     log_facility = -1;
+#ifdef TPROXY_ENABLE
+    have_tproxy = 0;
+    tp_cap_header.version = _LINUX_CAPABILITY_VERSION;
+    tp_cap_header.pid = 0;
+    tp_cap_data.effective = tp_cap_data.permitted = tp_cap_data.inheritable = 0;
+#endif
     logmsg(LOG_NOTICE, "starting...");
 
     signal(SIGHUP, h_shut);
@@ -209,6 +225,19 @@
     }
     SOL_TCP = pe->p_proto;
 #endif
+ 
+#ifdef TPROXY_ENABLE
+    if (! detect_tproxy()) {
+	if (geteuid() == 0) {
+	    have_tproxy = 1;
+	    logmsg(LOG_INFO, "tproxy: available");
+	} else {
+	    logmsg(LOG_ERR, "tproxy: disabled. you must start pound with root privileges. later it will drop privileges.");
+	}
+    } else {
+	logmsg(LOG_INFO, "tproxy: not supported or not enough privileges");
+    }
+#endif
 
     /* read config */
     config_parse(argc, argv);
@@ -326,6 +355,36 @@
         }
     }
 
+#ifdef TPROXY_ENABLE
+    if (enable_tproxy)
+    {
+        if (capget(&tp_cap_header, &tp_cap_data) != 0)
+	{
+            logmsg(LOG_ERR, "capabilities: can't get capabilities");
+            exit(1);
+	}
+	if (prctl(PR_SET_KEEPCAPS, 1) < 0)
+	{
+            logmsg(LOG_ERR, "capabilities: can't enable keep capabilities");
+            exit(1);
+	}
+	
+	tp_cap_data.effective = tp_cap_data.permitted = tp_cap_data.inheritable = 0;
+	tp_cap_data.effective |= (1 << CAP_NET_ADMIN);
+	tp_cap_data.effective |= (1 << CAP_SETUID);
+	tp_cap_data.effective |= (1 << CAP_SETGID);
+	tp_cap_data.permitted |= (1 << CAP_NET_ADMIN);
+	tp_cap_data.permitted |= (1 << CAP_SETUID);
+	tp_cap_data.permitted |= (1 << CAP_SETGID);
+
+	if (capset(&tp_cap_header, &tp_cap_data) != 0)
+	{
+            logmsg(LOG_ERR, "capabilities: can't set capabilities");
+            exit(1);
+	}
+    }
+#endif
+
     if(group)
         if(setgid(group_id) || setegid(group_id)) {
             logmsg(LOG_ERR, "setgid: %s - aborted", strerror(errno));
@@ -337,6 +396,32 @@
             exit(1);
         }
 
+#ifdef TPROXY_ENABLE
+    if (enable_tproxy)
+    {
+        if (capget(&tp_cap_header, &tp_cap_data) != 0)
+	{
+            logmsg(LOG_ERR, "user capabilities: can't get capabilities");
+            exit(1);
+	}
+	if (prctl(PR_SET_KEEPCAPS, 1) < 0)
+	{
+            logmsg(LOG_ERR, "user capabilities: can't enable keep capabilities");
+            exit(1);
+	}
+
+	tp_cap_data.effective = tp_cap_data.permitted = tp_cap_data.inheritable = 0;
+	tp_cap_data.effective |= (1 << CAP_NET_ADMIN);
+	tp_cap_data.permitted |= (1 << CAP_NET_ADMIN);
+
+	if (capset(&tp_cap_header, &tp_cap_data) != 0)
+	{
+            logmsg(LOG_ERR, "user capabilities: can't set capabilities");
+            exit(1);
+	}
+    }
+#endif
+
     /* split off into monitor and working process if necessary */
     for(;;) {
 #ifdef  UPER
diff -urN Pound-2.4.5/pound.h Poundtp-2.4.5/pound.h
--- Pound-2.4.5/pound.h	2009-06-29 17:53:58.000000000 +0200
+++ Poundtp-2.4.5/pound.h	2009-07-20 19:57:40.894334329 +0200
@@ -232,6 +232,14 @@
 #define const
 #endif
 
+#ifdef TPROXY_ENABLE
+#include <sys/prctl.h>
+#include <linux/capability.h>
+#ifndef IP_TRANSPARENT 
+#define IP_TRANSPARENT 19
+#endif
+#endif
+
 #ifndef NO_EXTERNALS
 /*
  * Global variables needed by everybody
@@ -250,6 +258,11 @@
             grace,              /* grace period before shutdown */
             control_sock;       /* control socket */
 
+#ifdef TPROXY_ENABLE
+extern int  have_tproxy,	/* is tproxy available */
+	    enable_tproxy;	/* is tproxy enabled */
+#endif
+
 extern regex_t  HEADER,     /* Allowed header */
                 CHUNK_HEAD, /* chunk header line */
                 RESP_SKIP,  /* responses for which we skip response */
@@ -294,6 +307,9 @@
     int                 priority;   /* priority */
     int                 to;
     struct addrinfo     ha_addr;    /* HA address/port */
+#ifdef TPROXY_ENABLE
+    int			tp_enabled; /* TProxy is enabled */
+#endif
     char                *url;       /* for redirectors */
     int                 redir_req;  /* the redirect should include the request path */
     pthread_mutex_t     mut;        /* mutex for this back-end */
@@ -509,7 +525,12 @@
  * Non-blocking version of connect(2). Does the same as connect(2) but
  * ensures it will time-out after a much shorter time period CONN_TO.
  */
+#ifdef TPROXY_ENABLE
+extern int  detect_tproxy(void);
+extern int  connect_nb(const int, const struct addrinfo *, const int, const struct addrinfo *);
+#else
 extern int  connect_nb(const int, const struct addrinfo *, const int);
+#endif
 
 /*
  * Parse arguments/config file
diff -urN Pound-2.4.5/svc.c Poundtp-2.4.5/svc.c
--- Pound-2.4.5/svc.c	2009-06-29 17:53:58.000000000 +0200
+++ Poundtp-2.4.5/svc.c	2009-09-21 23:27:18.912971707 +0200
@@ -260,6 +260,40 @@
     return;
 }
 
+#ifdef TPROXY_ENABLE
+/*
+ * detect_tproxy
+ * check for TPROXY
+ *
+ * Thanks to Loadbalancer.org, Inc. especially to Malcolm Turnbull for sponsorship
+ * Thanks to Sianet Business Hosting especially to Rodrigo L. L. Jorge for sponsorship
+ *
+ */
+int
+detect_tproxy(void)
+{
+    int sock, tp_val;
+
+    tp_val = 1;
+
+    sock = socket(AF_INET, SOCK_STREAM, 0);
+    if (sock < 0) {
+        logmsg(LOG_WARNING, "detect_tproxy(): socket SOCK_STREAM failed: %s", strerror(errno));
+        return 1;
+    }
+    if (setsockopt(sock, SOL_IP, IP_TRANSPARENT, &tp_val, sizeof(tp_val)) < 0) {
+        logmsg(LOG_INFO, "detect_tproxy(): tproxy is not available");
+        close(sock);
+        return 1;
+    }
+
+    close(sock);
+    logmsg(LOG_INFO, "detect_tproxy(): tproxy is is detected");
+
+    return 0;
+}
+#endif
+
 /*
  * Parse a header
  * return a code and possibly content in the arg
@@ -783,12 +817,26 @@
  * Non-blocking connect(). Does the same as connect(2) but ensures
  * it will time-out after a much shorter time period SERVER_TO
  */
+#ifdef TPROXY_ENABLE
 int
-connect_nb(const int sockfd, const struct addrinfo *serv_addr, const int to)
-{
+connect_nb(const int sockfd, const struct addrinfo *serv_addr, const int to, const struct addrinfo *tp_addr) {
+#else
+int
+connect_nb(const int sockfd, const struct addrinfo *serv_addr, const int to) {
+#endif
     int             flags, res, error;
     socklen_t       len;
     struct pollfd   p;
+#ifdef TPROXY_ENABLE
+    int tp_val = 1;
+    struct sockaddr_in in;
+#endif
+
+    if (! serv_addr->ai_addr)
+    {
+	logmsg(LOG_ERR, "cconnect_nb: wrong serv_addr->ai_addr");
+	return -1;
+    }
 
     if((flags = fcntl(sockfd, F_GETFL, 0)) < 0) {
         logmsg(LOG_WARNING, "(%lx) connect_nb: fcntl GETFL failed: %s", pthread_self(), strerror(errno));
@@ -798,6 +846,24 @@
         logmsg(LOG_WARNING, "(%lx) connect_nb: fcntl SETFL failed: %s", pthread_self(), strerror(errno));
         return -1;
     }
+ 
+#ifdef TPROXY_ENABLE
+    if (tp_addr) {
+	memcpy(&in, tp_addr->ai_addr, sizeof(in));
+	in.sin_port = 0;
+	if (setsockopt(sockfd, SOL_IP, IP_TRANSPARENT, &tp_val, sizeof(tp_val)) < 0) {
+	    logmsg(LOG_ERR, "(%lx) connect_nb: cannot set TProxy IP_TRANSPARENT socket option. Error: %d, %s.", pthread_self(),
+			     error, strerror(error));
+	    return -1;
+	}
+
+	if (bind(sockfd, (struct sockaddr *) &in, sizeof(in)) < 0) {
+  	    logmsg(LOG_ERR, "(%lx) connect_nb: cannot bind to TProxy IP. Error: %d, %s.", pthread_self(),
+			     error, strerror(error));
+	    return -1;
+	}
+    }
+#endif
 
     error = 0;
     if((res = connect(sockfd, serv_addr->ai_addr, serv_addr->ai_addrlen)) < 0)
@@ -897,7 +963,12 @@
         default:
             continue;
         }
-        if(connect_nb(sock, &be->ha_addr, be->to) != 0) {
+#ifdef TPROXY_ENABLE
+        if(connect_nb(sock, &be->ha_addr, be->to, NULL) != 0)
+#else
+        if(connect_nb(sock, &be->ha_addr, be->to) != 0)
+#endif
+	{
             kill_be(svc, be, BE_KILL);
             str_be(buf, MAXBUF - 1, be);
             logmsg(LOG_NOTICE, "BackEnd %s is dead (HA)", buf);
@@ -933,7 +1004,12 @@
         default:
             continue;
         }
-        if(connect_nb(sock, &be->ha_addr, be->to) != 0) {
+#ifdef TPROXY_ENABLE
+        if(connect_nb(sock, &be->ha_addr, be->to, NULL) != 0)
+#else
+        if(connect_nb(sock, &be->ha_addr, be->to) != 0)
+#endif
+	{
             kill_be(svc, be, BE_KILL);
             str_be(buf, MAXBUF - 1, be);
             logmsg(LOG_NOTICE, "BackEnd %s is dead (HA)", buf);
@@ -988,7 +1064,12 @@
                 }
                 addr = &be->ha_addr;
             }
-            if(connect_nb(sock, addr, be->to) == 0) {
+#ifdef TPROXY_ENABLE
+	    if(connect_nb(sock, addr, be->to, NULL) == 0)
+#else
+	    if(connect_nb(sock, addr, be->to) == 0)
+#endif
+	    {
                 be->resurrect = 1;
                 modified = 1;
             }
@@ -1057,7 +1138,12 @@
                 }
                 addr = &be->ha_addr;
             }
-            if(connect_nb(sock, addr, be->to) == 0) {
+#ifdef TPROXY_ENABLE
+	    if(connect_nb(sock, addr, be->to, NULL) != 0)
+#else
+            if(connect_nb(sock, &be->ha_addr, be->to) != 0)
+#endif
+	    {
                 be->resurrect = 1;
                 modified = 1;
             }
