diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/core/ngx_connection.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/core/ngx_connection.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/core/ngx_connection.c 2017-10-26 16:42:53.000000000 +1100 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/core/ngx_connection.c 2018-08-02 15:22:53.652819986 +1000 @@ -501,6 +501,49 @@ } #endif +#if (NGX_HAVE_TRANSPARENT_PROXY && __linux) + /* Don't need to set on FreeBSD or OSX */ + + if (ls[i].transparent && !ngx_test_config) { + + int transparent = 1; + + switch (ls[i].sockaddr->sa_family) { + + case AF_INET: + + if (setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, + (const void *) &transparent, sizeof(int)) == -1) + { + ngx_log_error(NGX_LOG_EMERG, log, ngx_socket_errno, + "setsockopt(IP_TRANSPARENT) %V failed", + &ls[i].addr_text); + return NGX_ERROR; + } + + break; + +#if (NGX_HAVE_INET6) + + case AF_INET6: + + if (setsockopt(s, IPPROTO_IPV6, IPV6_TRANSPARENT, + (const void *) &transparent, sizeof(int)) == -1) + { + ngx_log_error(NGX_LOG_EMERG, log, ngx_socket_errno, + "setsockopt(IPV6_TRANSPARENT) %V failed", + &ls[i].addr_text); + return NGX_ERROR; + } + + break; + +#endif /* NGX_HAVE_INET6 */ + + } + } +#endif /* NGX_HAVE_TRANSPARENT_PROXY */ + #if (NGX_HAVE_INET6 && defined IPV6_V6ONLY) if (ls[i].sockaddr->sa_family == AF_INET6) { diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/core/ngx_connection.h ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/core/ngx_connection.h --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/core/ngx_connection.h 2017-10-26 16:42:53.000000000 +1100 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/core/ngx_connection.h 2018-08-02 13:57:14.579715578 +1000 @@ -71,6 +71,10 @@ #endif unsigned reuseport:1; unsigned add_reuseport:1; + +#if (NGX_HAVE_TRANSPARENT_PROXY) + unsigned transparent:1; +#endif unsigned keepalive:2; unsigned deferred_accept:1; diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/event/ngx_event_accept.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/event/ngx_event_accept.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/event/ngx_event_accept.c 2018-05-15 06:24:38.000000000 +1000 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/event/ngx_event_accept.c 2018-08-02 15:11:02.332851640 +1000 @@ -232,6 +232,13 @@ c->local_sockaddr = ls->sockaddr; c->local_socklen = ls->socklen; +#if (NGX_HAVE_TRANSPARENT_PROXY) + if (ls->transparent) { + c->local_sockaddr = NULL; + c->local_socklen = 0; + } +#endif + #if (NGX_HAVE_UNIX_DOMAIN) if (c->sockaddr->sa_family == AF_UNIX) { c->tcp_nopush = NGX_TCP_NOPUSH_DISABLED; diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http.c 2018-05-15 06:24:38.000000000 +1000 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http.c 2018-08-02 13:59:39.696375794 +1000 @@ -1776,6 +1776,10 @@ ls->reuseport = addr->opt.reuseport; #endif +#if (NGX_HAVE_TRANSPARENT_PROXY) + ls->transparent = addr->opt.transparent; +#endif + return ls; } diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http_core_module.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http_core_module.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http_core_module.c 2018-05-15 06:24:38.000000000 +1000 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http_core_module.c 2018-08-02 14:03:29.763032192 +1000 @@ -3952,6 +3952,18 @@ continue; } + if (ngx_strcmp(value[n].data, "transparent") == 0) { +#if (NGX_HAVE_TRANSPARENT_PROXY) + lsopt.transparent = 1; + continue; +#else + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "transparent is not supported " + "on this platform"); + return NGX_CONF_ERROR; +#endif + } + if (ngx_strcmp(value[n].data, "ssl") == 0) { #if (NGX_HTTP_SSL) lsopt.ssl = 1; diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http_core_module.h ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http_core_module.h --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http_core_module.h 2017-10-26 16:42:53.000000000 +1100 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http_core_module.h 2018-08-02 14:24:00.302977383 +1000 @@ -79,6 +79,9 @@ #endif unsigned deferred_accept:1; unsigned reuseport:1; +#if (NGX_HAVE_TRANSPARENT_PROXY) + unsigned transparent:1; +#endif unsigned so_keepalive:2; unsigned proxy_protocol:1; diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http_request.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http_request.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/http/ngx_http_request.c 2018-05-15 06:24:38.000000000 +1000 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/http/ngx_http_request.c 2018-08-02 15:08:29.969525091 +1000 @@ -226,7 +226,11 @@ port = c->listening->servers; - if (port->naddrs > 1) { + if (port->naddrs > 1 +#if (NGX_HAVE_TRANSPARENT_PROXY) + || c->listening->transparent +#endif + ) { /* * there are several addresses on this port and one of them diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream.c 2017-10-26 16:42:53.000000000 +1100 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream.c 2018-08-02 14:00:06.753041252 +1000 @@ -513,6 +513,9 @@ #if (NGX_HAVE_REUSEPORT) ls->reuseport = addr[i].opt.reuseport; #endif +#if (NGX_HAVE_TRANSPARENT_PROXY) + ls->transparent = addr[i].opt.transparent; +#endif stport = ngx_palloc(cf->pool, sizeof(ngx_stream_port_t)); if (stport == NULL) { diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream_core_module.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream_core_module.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream_core_module.c 2017-10-26 16:42:53.000000000 +1100 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream_core_module.c 2018-08-02 14:29:10.122963611 +1000 @@ -732,6 +732,18 @@ continue; } + if (ngx_strcmp(value[i].data, "transparent") == 0) { +#if (NGX_HAVE_TRANSPARENT_PROXY) + ls->transparent = 1; + continue; +#else + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "transparent is not supported " + "on this platform"); + return NGX_CONF_ERROR; +#endif + } + if (ngx_strcmp(value[i].data, "ssl") == 0) { #if (NGX_STREAM_SSL) ls->ssl = 1; diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream.h ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream.h --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream.h 2018-05-15 06:24:38.000000000 +1000 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream.h 2018-08-02 14:24:16.022976681 +1000 @@ -55,6 +55,9 @@ unsigned ipv6only:1; #endif unsigned reuseport:1; +#if (NGX_HAVE_TRANSPARENT_PROXY) + unsigned transparent:1; +#endif unsigned so_keepalive:2; unsigned proxy_protocol:1; #if (NGX_HAVE_KEEPALIVE_TUNABLE) diff -ru ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream_handler.c ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream_handler.c --- ../openresty-1.13.6.2-patched/bundle/nginx-1.13.6/src/stream/ngx_stream_handler.c 2017-10-26 16:42:53.000000000 +1100 +++ ../openresty-1.13.6.2-modified/bundle/nginx-1.13.6/src/stream/ngx_stream_handler.c 2018-08-02 15:08:32.192858326 +1000 @@ -42,7 +42,11 @@ port = c->listening->servers; - if (port->naddrs > 1) { + if (port->naddrs > 1 +#if (NGX_HAVE_TRANSPARENT_PROXY) + || c->listening->transparent +#endif + ) { /* * There are several addresses on this port and one of them