[PATCH net-next 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()
From: Shivaji Kant <hidden>
Date: 2026-07-31 17:51:52
Also in:
bpf, lkml
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), networking [general], the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Currently, bpf_setsockopt() and bpf_getsockopt() for SOL_IP and SOL_IPV6 only allow a small subset of socket options (such as IP_TOS, IPV6_TCLASS, and IPV6_AUTOFLOWLABEL). Calling bpf_setsockopt() with IP_TRANSPARENT or IPV6_TRANSPARENT fails with -EINVAL. Transparent proxying (TPROXY) and related networking components often rely on IP_TRANSPARENT and IPV6_TRANSPARENT to enable binding sockets to non-local IP addresses. Allow IP_TRANSPARENT for SOL_IP in sol_ip_sockopt() and IPV6_TRANSPARENT for SOL_IPV6 in sol_ipv6_sockopt(). Tested-by: Anubhav Singh <redacted> Signed-off-by: Shivaji Kant <redacted> --- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 11bb0d236822..5a5980c671f3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c@@ -5640,6 +5640,7 @@ static int sol_ip_sockopt(struct sock *sk, int optname, switch (optname) { case IP_TOS: + case IP_TRANSPARENT: if (*optlen != sizeof(int)) return -EINVAL; break;
@@ -5666,6 +5667,7 @@ static int sol_ipv6_sockopt(struct sock *sk, int optname, switch (optname) { case IPV6_TCLASS: case IPV6_AUTOFLOWLABEL: + case IPV6_TRANSPARENT: if (*optlen != sizeof(int)) return -EINVAL; break;
--
2.55.0.508.g3f0d502094-goog