{"record":{"id":"4583a772cd692de9","repo":"cilium/cilium","slug":"setsockopt-ip-transparent-for-s-failed-w","errorCode":null,"errorMessage":"setsockopt(IP_TRANSPARENT) for %s failed: %w","messagePattern":"setsockopt\\(IP_TRANSPARENT\\) for (.+?) failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/fqdn/dnsproxy/proxy.go","lineNumber":839,"sourceCode":"//   - So the client socket can not be left lingering around, as it causes network traffic destined\n//     for the source pod to be intercepted to the dnsproxy, which is exactly what we want but only\n//     until a DNS response has been received.\nfunc setSoMarks(fd int, ipFamily ipfamily.IPFamily, secId identity.NumericIdentity) error {\n\t// Set SO_MARK to allow datapath to know these upstream packets from an egress proxy\n\tmark := linux_defaults.MakeMagicMark(linux_defaults.MagicMarkEgress, secId)\n\terr := unix.SetsockoptUint64(fd, unix.SOL_SOCKET, unix.SO_MARK, uint64(mark))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error setting SO_MARK: %w\", err)\n\t}\n\n\t// Rest of the options are only set in the transparent mode.\n\tif !option.Config.DNSProxyEnableTransparentMode {\n\t\treturn nil\n\t}\n\n\t// Set IP_TRANSPARENT to be able to use a non-host address as the source address\n\tif err := unix.SetsockoptInt(fd, ipFamily.SocketOptsFamily, ipFamily.SocketOptsTransparent, 1); err != nil {\n\t\treturn fmt.Errorf(\"setsockopt(IP_TRANSPARENT) for %s failed: %w\", ipFamily.Name, err)\n\t}\n\n\t// Set SO_REUSEADDR to allow binding to an address that is already used by some other\n\t// connection in a lingering state. This is needed in cases where we close a client\n\t// connection but the client issues new requests re-using its source port. In that case we\n\t// need to be able to reuse the address likely very soon after the prior close, which may\n\t// not be allowed without this option.\n\tif err := unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_REUSEADDR, 1); err != nil {\n\t\treturn fmt.Errorf(\"setsockopt(SO_REUSEADDR) failed: %w\", err)\n\t}\n\n\t// Set SO_REUSEPORT to allow two active connections to bind to the same address and\n\t// port. Normally this would not be needed, but is set to allow a new connection to be\n\t// created on a port where the old connection may not yet be closed. If two UDP sockets\n\t// using the same port due to this option were reading at the same time, the OS stack would\n\t// distribute incoming packets to them essentially randomly. We do not want that, so we\n\t// strive to avoid that situation. This may be helpful in avoiding bind errors in some cases\n\t// regardless.","sourceCodeStart":821,"sourceCodeEnd":857,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/fqdn/dnsproxy/proxy.go#L821-L857","documentation":"In transparent DNS proxy mode, setSoMarks enables IP_TRANSPARENT so the proxy can use a non-host address as the source. This error wraps a failed setsockopt(IP_TRANSPARENT) and includes the IP family name. IP_TRANSPARENT requires CAP_NET_ADMIN and kernel support for the family-specific option.","triggerScenarios":"option.Config.DNSProxyEnableTransparentMode is true and unix.SetsockoptInt(fd, ipFamily.SocketOptsFamily, ipFamily.SocketOptsTransparent, 1) fails, usually EPERM without CAP_NET_ADMIN or EOPNOTSUPP/ENOPROTOOPT on kernels lacking the option for IPv6 (IPV6_TRANSPARENT).","commonSituations":"Transparent mode enabled in an unprivileged container; IPv6 socket on a kernel built without IPV6_TRANSPARENT; seccomp blocking thesockopt.","solutions":["Grant CAP_NET_ADMIN to the process (required for IP_TRANSPARENT).","Disable DNSProxyEnableTransparentMode if you do not need non-host source addresses.","Verify kernel/config supports IP_TRANSPARENT and IPV6_TRANSPARENT (CONFIG_IPV6)."],"exampleFix":"// before\n// DNSProxyEnableTransparentMode: true  // in unprivileged container\n// after\n// DNSProxyEnableTransparentMode: false\n// (or add NET_ADMIN capability)","handlingStrategy":"validation","validationCode":"probe, err := unix.Socket(family, unix.SOCK_DGRAM, 0)\nif err == nil {\n    defer unix.Close(probe)\n    if err := unix.SetsockoptInt(probe, optFamily, optTransparent, 1); err != nil {\n        return fmt.Errorf(\"IP_TRANSPARENT unavailable: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := setSoMarks(fd, family, secID); err != nil {\n    if errors.Is(err, unix.EPERM) || errors.Is(err, unix.EOPNOTSUPP) {\n        // fall back to non-transparent mode or surface config error\n    }\n    return err\n}","preventionTips":["Enable transparent mode only in environments with CAP_NET_ADMIN.","Verify kernel config includes IP_TRANSPARENT/IPV6_TRANSPARENT support.","Probe the option once at startup instead of failing per-connection."],"tags":["socket","linux","permissions","transparent-proxy"],"backgroundTag":"setsockopt-eperm","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}