[PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()

[PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()

[Shivaji Kant]

Currently, bpf_setsockopt() and bpf_getsockopt() for SOL_IP and SOL_IPV6
only allow a small subset of socket options (such as IP_TOS,
IPV6_TCLASS, and IPV6_AUTOFLOWLABEL). Calling bpf_setsockopt() with
IP_TRANSPARENT or IPV6_TRANSPARENT fails with -EINVAL.

Transparent proxying (TPROXY) and related networking components often
rely on IP_TRANSPARENT and IPV6_TRANSPARENT to enable binding sockets
to non-local IP addresses.

Allow IP_TRANSPARENT for SOL_IP in sol_ip_sockopt() and
IPV6_TRANSPARENT for SOL_IPV6 in sol_ipv6_sockopt().

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Tested-by: Anubhav Singh <anubhavsinggh@google.com>
Signed-off-by: Shivaji Kant <shivajikant@google.com>
---
 net/core/filter.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index c21c1daecf9d..04a9f9d8d07b 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5645,6 +5645,7 @@ static int sol_ip_sockopt(struct sock *sk, int optname,
 
 	switch (optname) {
 	case IP_TOS:
+	case IP_TRANSPARENT:
 		if (*optlen != sizeof(int))
 			return -EINVAL;
 		break;
@@ -5671,6 +5672,7 @@ static int sol_ipv6_sockopt(struct sock *sk, int optname,
 	switch (optname) {
 	case IPV6_TCLASS:
 	case IPV6_AUTOFLOWLABEL:
+	case IPV6_TRANSPARENT:
 		if (*optlen != sizeof(int))
 			return -EINVAL;
 		break;
-- 
2.55.0.508.g3f0d502094-goog

[PATCH bpf-next v2 2/2] selftests/bpf: Add IP_TRANSPARENT and IPV6_TRANSPARENT to setget_sockopt

[Shivaji Kant]

Add test coverage for IP_TRANSPARENT and IPV6_TRANSPARENT socket options
in the setget_sockopt BPF selftest to verify bpf_setsockopt() and
bpf_getsockopt() helpers.

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Tested-by: Anubhav Singh <anubhavsinggh@google.com>
Signed-off-by: Shivaji Kant <shivajikant@google.com>
---
 tools/testing/selftests/bpf/progs/bpf_tracing_net.h | 2 ++
 tools/testing/selftests/bpf/progs/setget_sockopt.c  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/bpf_tracing_net.h b/tools/testing/selftests/bpf/progs/bpf_tracing_net.h
index c4b438854565..593b38f90417 100644
--- a/tools/testing/selftests/bpf/progs/bpf_tracing_net.h
+++ b/tools/testing/selftests/bpf/progs/bpf_tracing_net.h
@@ -31,10 +31,12 @@
 #define __SO_ACCEPTCON		(1 << 16)
 
 #define IP_TOS			1
+#define IP_TRANSPARENT		19
 
 #define SOL_IPV6		41
 #define IPV6_TCLASS		67
 #define IPV6_AUTOFLOWLABEL	70
+#define IPV6_TRANSPARENT	75
 
 #define TC_ACT_UNSPEC		(-1)
 #define TC_ACT_OK		0
diff --git a/tools/testing/selftests/bpf/progs/setget_sockopt.c b/tools/testing/selftests/bpf/progs/setget_sockopt.c
index 636a7cd8e2fa..d96e99b67aeb 100644
--- a/tools/testing/selftests/bpf/progs/setget_sockopt.c
+++ b/tools/testing/selftests/bpf/progs/setget_sockopt.c
@@ -69,12 +69,14 @@ static const struct sockopt_test sol_tcp_tests[] = {
 
 static const struct sockopt_test sol_ip_tests[] = {
 	{ .opt = IP_TOS, .new = 0xe1, .expected = 0xe1, .tcp_expected = 0xe0, },
+	{ .opt = IP_TRANSPARENT, .flip = 1, },
 	{ .opt = 0, },
 };
 
 static const struct sockopt_test sol_ipv6_tests[] = {
 	{ .opt = IPV6_TCLASS, .new = 0xe1, .expected = 0xe1, .tcp_expected = 0xe0, },
 	{ .opt = IPV6_AUTOFLOWLABEL, .flip = 1, },
+	{ .opt = IPV6_TRANSPARENT, .flip = 1, },
 	{ .opt = 0, },
 };
 
-- 
2.55.0.508.g3f0d502094-goog

Re: [PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf_setsockopt() bypasses MPTCP subflow synchronization for IP_TRANSPARENT and IPV6_TRANSPARENT.
--

--- Patch [1]: [PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt() ---
commit c5ad31eb12f337883443730bb1839d63112c725e
Author: Shivaji Kant <shivajikant@google.com>

bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()

This commit allows IP_TRANSPARENT and IPV6_TRANSPARENT socket options to be
used with bpf_setsockopt() and bpf_getsockopt().

> diff --git a/net/core/filter.c b/net/core/filter.c
> index c21c1daecf9d1..04a9f9d8d07b4 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -5645,6 +5645,7 @@ static int sol_ip_sockopt(struct sock *sk, int optname,
>  
>  	switch (optname) {
>  	case IP_TOS:
> +	case IP_TRANSPARENT:
>  		if (*optlen != sizeof(int))
>  			return -EINVAL;
>  		break;

[Severity: Medium]
Does bypassing the protocol-specific sk->sk_prot->setsockopt() handler here
break MPTCP subflow synchronization?

Since sol_ip_sockopt() calls do_ip_setsockopt(sk) directly, it appears that
IP_TRANSPARENT settings applied via bpf_setsockopt() will not be synchronized
to existing MPTCP subflows. Could this cause the underlying subflows to lack
the transparent attribute after they are instantiated?

[ ... ]

> @@ -5671,6 +5672,7 @@ static int sol_ipv6_sockopt(struct sock *sk, int optname,
>  	switch (optname) {
>  	case IPV6_TCLASS:
>  	case IPV6_AUTOFLOWLABEL:
> +	case IPV6_TRANSPARENT:
>  		if (*optlen != sizeof(int))
>  			return -EINVAL;
>  		break;

[Severity: Medium]
Will this introduce the same synchronization issue for IPV6_TRANSPARENT on IPv6
MPTCP sockets?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260801051307.478469-1-shivajikant@google.com?part=1

Re: [PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()

[Kumar Kartikeya Dwivedi]

On Sat Aug 1, 2026 at 7:36 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] bpf_setsockopt() bypasses MPTCP subflow synchronization for IP_TRANSPARENT and IPV6_TRANSPARENT.
> --
>
> --- Patch [1]: [PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt() ---
> commit c5ad31eb12f337883443730bb1839d63112c725e
> Author: Shivaji Kant <shivajikant@google.com>
>
> bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()
>
> This commit allows IP_TRANSPARENT and IPV6_TRANSPARENT socket options to be
> used with bpf_setsockopt() and bpf_getsockopt().
>
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index c21c1daecf9d1..04a9f9d8d07b4 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -5645,6 +5645,7 @@ static int sol_ip_sockopt(struct sock *sk, int optname,
>>
>>  	switch (optname) {
>>  	case IP_TOS:
>> +	case IP_TRANSPARENT:
>>  		if (*optlen != sizeof(int))
>>  			return -EINVAL;
>>  		break;
>
> [Severity: Medium]
> Does bypassing the protocol-specific sk->sk_prot->setsockopt() handler here
> break MPTCP subflow synchronization?
>
> Since sol_ip_sockopt() calls do_ip_setsockopt(sk) directly, it appears that
> IP_TRANSPARENT settings applied via bpf_setsockopt() will not be synchronized
> to existing MPTCP subflows. Could this cause the underlying subflows to lack
> the transparent attribute after they are instantiated?
>
> [ ... ]
>
>> @@ -5671,6 +5672,7 @@ static int sol_ipv6_sockopt(struct sock *sk, int optname,
>>  	switch (optname) {
>>  	case IPV6_TCLASS:
>>  	case IPV6_AUTOFLOWLABEL:
>> +	case IPV6_TRANSPARENT:
>>  		if (*optlen != sizeof(int))
>>  			return -EINVAL;
>>  		break;
>
> [Severity: Medium]
> Will this introduce the same synchronization issue for IPV6_TRANSPARENT on IPv6
> MPTCP sockets?

For now I applied the current set. This does seem to be a real concern, but it
seems other options have similar problem, so likely requires more thought.

Re: [PATCH bpf-next v2 1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Sat,  1 Aug 2026 05:12:59 +0000 you wrote:
> Currently, bpf_setsockopt() and bpf_getsockopt() for SOL_IP and SOL_IPV6
> only allow a small subset of socket options (such as IP_TOS,
> IPV6_TCLASS, and IPV6_AUTOFLOWLABEL). Calling bpf_setsockopt() with
> IP_TRANSPARENT or IPV6_TRANSPARENT fails with -EINVAL.
> 
> Transparent proxying (TPROXY) and related networking components often
> rely on IP_TRANSPARENT and IPV6_TRANSPARENT to enable binding sockets
> to non-local IP addresses.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/2] bpf: Allow IP_TRANSPARENT and IPV6_TRANSPARENT in bpf_{set,get}sockopt()
    https://git.kernel.org/bpf/bpf-next/c/dec58a70d4e7
  - [bpf-next,v2,2/2] selftests/bpf: Add IP_TRANSPARENT and IPV6_TRANSPARENT to setget_sockopt
    https://git.kernel.org/bpf/bpf-next/c/60781269e26c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html