"Proper" way to transparent proxy?

[Kevin White <kwhite@secureinteriors.com>]

Short story: I need to write a transparent, application level proxy. 
I've searched through the mailing lists for information on how to do it, 
and find conflicting information about things like "stateless 
redirection" patches by Bazsi, and comments that they would no longer be 
maintained because something better was coming.  But I can't tell if 
that something better happened, or what it is.

If there's something I should be looking at, I'd be greatful for pointers.

Long story: we have an OpenBSD based firewall that uses this particular 
application level proxy, using IPFilter's transparent proxy support.  We 
are investigating rehosting the whole thing on Linux (for the record, MY 
first choice anyways :) and this is the hardest problem so far:

I need to find the address and port the outgoing connecion was 
originally heading to.  I'm assuming this is what's meant by the 
stateless redirection patches and such, but those (admittedly) didn't 
even come with documentation.

I'm starting from scratch here: I've never programmed to Netfilter 
before.  What I need is fairly simple, I think, but I don't know how to 
get started.

What we had on IPFilter was a "redirect" rule that redirected all 
connections to external hosts on this specific port to a specific port 
on the firewall machine, where a proxy program was waiting for it.  We 
then used IPFilter system calls to retreive where the connection was 
heading.

I expect that I'll be able to reuse most of my code: just the lookup 
part needs to change.

Thanks in advance for any help/pointers.  I'll attempt to collect what 
I've learned and post it, so that it ends up in the archives and more 
people like me don't have to ask.  :)

Kevin