diff --git a/include/envoy/network/listen_socket.h b/include/envoy/network/listen_socket.h
index 532ad5c4ba05..b8ba4700ee75 100644
--- a/include/envoy/network/listen_socket.h
+++ b/include/envoy/network/listen_socket.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <memory>
+#include <vector>
 
 #include "envoy/common/pure.h"
 #include "envoy/network/address.h"
@@ -30,36 +31,40 @@ class Socket {
    */
   virtual void close() PURE;
 
+  enum class SocketState { PreBind, PostBind };
+
   /**
    * Visitor class for setting socket options.
    */
-  class Options {
+  class Option {
   public:
-    virtual ~Options() {}
+    virtual ~Option() {}
 
     /**
      * @param socket the socket on which to apply options.
+     * @param state the current state of the socket. Significant for options that can only be
+     *        set for some particular state of the socket.
      * @return true if succeeded, false otherwise.
      */
-    virtual bool setOptions(Socket& socket) const PURE;
+    virtual bool setOption(Socket& socket, SocketState state) const PURE;
 
     /**
-     * @return bits that can be used to separate connections based on the options. Should return
-     *         zero if connections with different options can be pooled together. This is limited
-     *         to 32 bits to allow these bits to be efficiently combined into a larger hash key
-     *         used in connection pool lookups.
+     * @param vector of bytes to which the option should append hash key data that will be used
+     *        to separate connections based on the option. Any data already in the key vector must
+     *        not be modified.
      */
-    virtual uint32_t hashKey() const PURE;
+    virtual void hashKey(std::vector<uint8_t>& key) const PURE;
   };
-  typedef std::shared_ptr<Options> OptionsSharedPtr;
+  typedef std::unique_ptr<Option> OptionPtr;
+  typedef std::shared_ptr<std::vector<OptionPtr>> OptionsSharedPtr;
 
   /**
-   * Set the socket options for later retrieval with options().
+   * Add a socket option visitor for later retrieval with options().
    */
-  virtual void setOptions(const OptionsSharedPtr&) PURE;
+  virtual void addOption(OptionPtr&&) PURE;
 
   /**
-   * @return the socket options stored earlier with setOptions(), if any.
+   * @return the socket options stored earlier with addOption() calls, if any.
    */
   virtual const OptionsSharedPtr& options() const PURE;
 };
diff --git a/include/envoy/server/filter_config.h b/include/envoy/server/filter_config.h
index 8f90619c77e0..8cedca06a599 100644
--- a/include/envoy/server/filter_config.h
+++ b/include/envoy/server/filter_config.h
@@ -135,7 +135,7 @@ class ListenerFactoryContext : public FactoryContext {
   /**
    * Store socket options to be set on the listen socket before listening.
    */
-  virtual void setListenSocketOptions(const Network::Socket::OptionsSharedPtr& options) PURE;
+  virtual void addListenSocketOption(Network::Socket::OptionPtr&& option) PURE;
 };
 
 /**
diff --git a/include/envoy/server/listener_manager.h b/include/envoy/server/listener_manager.h
index 450634a5085c..439b0a4def52 100644
--- a/include/envoy/server/listener_manager.h
+++ b/include/envoy/server/listener_manager.h
@@ -23,11 +23,13 @@ class ListenerComponentFactory {
   /**
    * Creates a socket.
    * @param address supplies the socket's address.
+   * @param options to be set on the created socket just before calling 'bind()'.
    * @param bind_to_port supplies whether to actually bind the socket.
    * @return Network::SocketSharedPtr an initialized and potentially bound socket.
    */
   virtual Network::SocketSharedPtr
-  createListenSocket(Network::Address::InstanceConstSharedPtr address, bool bind_to_port) PURE;
+  createListenSocket(Network::Address::InstanceConstSharedPtr address,
+                     const Network::Socket::OptionsSharedPtr& options, bool bind_to_port) PURE;
 
   /**
    * Creates a list of filter factories.
diff --git a/source/common/network/connection_impl.cc b/source/common/network/connection_impl.cc
index 45cffe459695..c1f9d33e4532 100644
--- a/source/common/network/connection_impl.cc
+++ b/source/common/network/connection_impl.cc
@@ -539,13 +539,15 @@ ClientConnectionImpl::ClientConnectionImpl(
     : ConnectionImpl(dispatcher, std::make_unique<ClientSocketImpl>(remote_address),
                      std::move(transport_socket), false) {
   if (options) {
-    if (!options->setOptions(*socket_)) {
-      // Set a special error state to ensure asynchronous close to give the owner of the
-      // ConnectionImpl a chance to add callbacks and detect the "disconnect".
-      immediate_error_event_ = ConnectionEvent::LocalClose;
-      // Trigger a write event to close this connection out-of-band.
-      file_event_->activate(Event::FileReadyType::Write);
-      return;
+    for (const auto& option : *options) {
+      if (!option->setOption(*socket_, Socket::SocketState::PreBind)) {
+        // Set a special error state to ensure asynchronous close to give the owner of the
+        // ConnectionImpl a chance to add callbacks and detect the "disconnect".
+        immediate_error_event_ = ConnectionEvent::LocalClose;
+        // Trigger a write event to close this connection out-of-band.
+        file_event_->activate(Event::FileReadyType::Write);
+        return;
+      }
     }
   }
   if (source_address != nullptr) {
diff --git a/source/common/network/listen_socket_impl.cc b/source/common/network/listen_socket_impl.cc
index 6ef2d1f24622..35b426041532 100644
--- a/source/common/network/listen_socket_impl.cc
+++ b/source/common/network/listen_socket_impl.cc
@@ -29,7 +29,19 @@ void ListenSocketImpl::doBind() {
   }
 }
 
-TcpListenSocket::TcpListenSocket(const Address::InstanceConstSharedPtr& address, bool bind_to_port)
+void ListenSocketImpl::setListenSocketOptions(const Network::Socket::OptionsSharedPtr& options) {
+  if (options) {
+    for (const auto& option : *options) {
+      if (!option->setOption(*this, SocketState::PreBind)) {
+        throw EnvoyException("ListenSocket: Setting socket options failed");
+      }
+    }
+  }
+}
+
+TcpListenSocket::TcpListenSocket(const Address::InstanceConstSharedPtr& address,
+                                 const Network::Socket::OptionsSharedPtr& options,
+                                 bool bind_to_port)
     : ListenSocketImpl(address->socket(Address::SocketType::Stream), address) {
   RELEASE_ASSERT(fd_ != -1);
 
@@ -37,13 +49,18 @@ TcpListenSocket::TcpListenSocket(const Address::InstanceConstSharedPtr& address,
   int rc = setsockopt(fd_, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
   RELEASE_ASSERT(rc != -1);
 
+  setListenSocketOptions(options);
+
   if (bind_to_port) {
     doBind();
   }
 }
 
-TcpListenSocket::TcpListenSocket(int fd, const Address::InstanceConstSharedPtr& address)
-    : ListenSocketImpl(fd, address) {}
+TcpListenSocket::TcpListenSocket(int fd, const Address::InstanceConstSharedPtr& address,
+                                 const Network::Socket::OptionsSharedPtr& options)
+    : ListenSocketImpl(fd, address) {
+  setListenSocketOptions(options);
+}
 
 UdsListenSocket::UdsListenSocket(const Address::InstanceConstSharedPtr& address)
     : ListenSocketImpl(address->socket(Address::SocketType::Stream), address) {
diff --git a/source/common/network/listen_socket_impl.h b/source/common/network/listen_socket_impl.h
index b91deac296ad..da9a9bdbe0cd 100644
--- a/source/common/network/listen_socket_impl.h
+++ b/source/common/network/listen_socket_impl.h
@@ -26,7 +26,12 @@ class SocketImpl : public virtual Socket {
       fd_ = -1;
     }
   }
-  void setOptions(const OptionsSharedPtr& options) override { options_ = options; }
+  void addOption(OptionPtr&& option) override {
+    if (!options_) {
+      options_ = std::make_shared<std::vector<OptionPtr>>();
+    }
+    options_->emplace_back(std::move(option));
+  }
   const OptionsSharedPtr& options() const override { return options_; }
 
 protected:
@@ -44,6 +49,7 @@ class ListenSocketImpl : public SocketImpl {
       : SocketImpl(fd, local_address) {}
 
   void doBind();
+  void setListenSocketOptions(const Network::Socket::OptionsSharedPtr& options);
 };
 
 /**
@@ -51,8 +57,10 @@ class ListenSocketImpl : public SocketImpl {
  */
 class TcpListenSocket : public ListenSocketImpl {
 public:
-  TcpListenSocket(const Address::InstanceConstSharedPtr& address, bool bind_to_port);
-  TcpListenSocket(int fd, const Address::InstanceConstSharedPtr& address);
+  TcpListenSocket(const Address::InstanceConstSharedPtr& address,
+                  const Network::Socket::OptionsSharedPtr& options, bool bind_to_port);
+  TcpListenSocket(int fd, const Address::InstanceConstSharedPtr& address,
+                  const Network::Socket::OptionsSharedPtr& options);
 };
 
 typedef std::unique_ptr<TcpListenSocket> TcpListenSocketPtr;
diff --git a/source/common/upstream/cluster_manager_impl.cc b/source/common/upstream/cluster_manager_impl.cc
index c3cad3c26063..36ee13901154 100644
--- a/source/common/upstream/cluster_manager_impl.cc
+++ b/source/common/upstream/cluster_manager_impl.cc
@@ -836,28 +836,31 @@ ClusterManagerImpl::ThreadLocalClusterManagerImpl::ClusterEntry::connPool(
   }
 
   // Inherit socket options from downstream connection, if set.
-  absl::optional<uint32_t> hash_key;
+  std::vector<uint8_t> hash_key = {uint8_t(protocol), uint8_t(priority)};
 
   // Use downstream connection socket options for computing connection pool hash key, if any.
   // This allows socket options to control connection pooling so that connections with
   // different options are not pooled together.
+  bool have_options = false;
   if (context && context->downstreamConnection()) {
     const Network::ConnectionSocket::OptionsSharedPtr& options =
         context->downstreamConnection()->socketOptions();
     if (options) {
-      hash_key = options->hashKey();
+      for (const auto& option : *options) {
+        have_options = true;
+        option->hashKey(hash_key);
+      }
     }
   }
 
   ConnPoolsContainer& container = parent_.host_http_conn_pool_map_[host];
-  const auto key = container.key(priority, protocol, hash_key ? hash_key.value() : 0);
-  if (!container.pools_[key]) {
-    container.pools_[key] = parent_.parent_.factory_.allocateConnPool(
+  if (!container.pools_[hash_key]) {
+    container.pools_[hash_key] = parent_.parent_.factory_.allocateConnPool(
         parent_.thread_local_dispatcher_, host, priority, protocol,
-        hash_key ? context->downstreamConnection()->socketOptions() : nullptr);
+        have_options ? context->downstreamConnection()->socketOptions() : nullptr);
   }
 
-  return container.pools_[key].get();
+  return container.pools_[hash_key].get();
 }
 
 ClusterManagerPtr ProdClusterManagerFactory::clusterManagerFromProto(
diff --git a/source/common/upstream/cluster_manager_impl.h b/source/common/upstream/cluster_manager_impl.h
index 22cc3d8d79f7..80f6efe63736 100644
--- a/source/common/upstream/cluster_manager_impl.h
+++ b/source/common/upstream/cluster_manager_impl.h
@@ -4,9 +4,9 @@
 #include <cstdint>
 #include <functional>
 #include <list>
+#include <map>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/config/bootstrap/v2/bootstrap.pb.h"
@@ -202,17 +202,7 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
    */
   struct ThreadLocalClusterManagerImpl : public ThreadLocal::ThreadLocalObject {
     struct ConnPoolsContainer {
-      typedef std::unordered_map<uint64_t, Http::ConnectionPool::InstancePtr> ConnPools;
-
-      uint64_t key(ResourcePriority priority, Http::Protocol protocol, uint32_t hash_key) {
-        // One bit needed for priority
-        static_assert(NumResourcePriorities == 2,
-                      "Fix shifts below to match number of bits needed for 'priority'");
-        // Two bits needed for protocol
-        static_assert(Http::NumProtocols <= 4,
-                      "Fix shifts below to match number of bits needed for 'protocol'");
-        return uint64_t(hash_key) << 3 | uint64_t(protocol) << 1 | uint64_t(priority);
-      }
+      typedef std::map<std::vector<uint8_t>, Http::ConnectionPool::InstancePtr> ConnPools;
 
       ConnPools pools_;
       uint64_t drains_remaining_{};
diff --git a/source/server/config_validation/server.h b/source/server/config_validation/server.h
index 919613b00331..4085c9b45e02 100644
--- a/source/server/config_validation/server.h
+++ b/source/server/config_validation/server.h
@@ -101,6 +101,7 @@ class ValidationInstance : Logger::Loggable<Logger::Id::main>,
     return ProdListenerComponentFactory::createListenerFilterFactoryList_(filters, context);
   }
   Network::SocketSharedPtr createListenSocket(Network::Address::InstanceConstSharedPtr,
+                                              const Network::Socket::OptionsSharedPtr&,
                                               bool) override {
     // Returned sockets are not currently used so we can return nothing here safely vs. a
     // validation mock.
diff --git a/source/server/http/admin.cc b/source/server/http/admin.cc
index ab73c658b927..7549bfc63da4 100644
--- a/source/server/http/admin.cc
+++ b/source/server/http/admin.cc
@@ -620,7 +620,7 @@ AdminImpl::AdminImpl(const std::string& access_log_path, const std::string& prof
                      Network::Address::InstanceConstSharedPtr address, Server::Instance& server,
                      Stats::ScopePtr&& listener_scope)
     : server_(server), profile_path_(profile_path),
-      socket_(new Network::TcpListenSocket(address, true)),
+      socket_(new Network::TcpListenSocket(address, nullptr, true)),
       stats_(Http::ConnectionManagerImpl::generateStats("http.admin.", server_.stats())),
       tracing_stats_(Http::ConnectionManagerImpl::generateTracingStats("http.admin.tracing.",
                                                                        server_.stats())),
diff --git a/source/server/listener_manager_impl.cc b/source/server/listener_manager_impl.cc
index 31f9e283d155..e9e4ddef4a53 100644
--- a/source/server/listener_manager_impl.cc
+++ b/source/server/listener_manager_impl.cc
@@ -74,6 +74,7 @@ ProdListenerComponentFactory::createListenerFilterFactoryList_(
 
 Network::SocketSharedPtr
 ProdListenerComponentFactory::createListenSocket(Network::Address::InstanceConstSharedPtr address,
+                                                 const Network::Socket::OptionsSharedPtr& options,
                                                  bool bind_to_port) {
   ASSERT(address->type() == Network::Address::Type::Ip ||
          address->type() == Network::Address::Type::Pipe);
@@ -94,9 +95,9 @@ ProdListenerComponentFactory::createListenSocket(Network::Address::InstanceConst
   const int fd = server_.hotRestart().duplicateParentListenSocket(addr);
   if (fd != -1) {
     ENVOY_LOG(debug, "obtained socket for address {} from parent", addr);
-    return std::make_shared<Network::TcpListenSocket>(fd, address);
+    return std::make_shared<Network::TcpListenSocket>(fd, address, options);
   }
-  return std::make_shared<Network::TcpListenSocket>(address, bind_to_port);
+  return std::make_shared<Network::TcpListenSocket>(address, options, bind_to_port);
 }
 
 DrainManagerPtr
@@ -275,14 +276,17 @@ void ListenerImpl::setSocket(const Network::SocketSharedPtr& socket) {
   socket_ = socket;
   // Server config validation sets nullptr sockets.
   if (socket_ && listen_socket_options_) {
-    bool ok = listen_socket_options_->setOptions(*socket_);
-    const std::string message =
-        fmt::format("{}: Setting socket options {}", name_, ok ? "succeeded" : "failed");
-    if (!ok) {
-      ENVOY_LOG(warn, "{}", message);
-      throw EnvoyException(message);
-    } else {
-      ENVOY_LOG(debug, "{}", message);
+    // 'pre_bind = false' as bind() is never done after this.
+    for (const auto& option : *listen_socket_options_) {
+      bool ok = option->setOption(*socket_, Network::Socket::SocketState::PostBind);
+      const std::string message =
+          fmt::format("{}: Setting socket options {}", name_, ok ? "succeeded" : "failed");
+      if (!ok) {
+        ENVOY_LOG(warn, "{}", message);
+        throw EnvoyException(message);
+      } else {
+        ENVOY_LOG(debug, "{}", message);
+      }
     }
   }
 }
@@ -394,10 +398,11 @@ bool ListenerManagerImpl::addOrUpdateListener(const envoy::api::v2::Listener& co
       draining_listener_socket = existing_draining_listener->listener_->getSocket();
     }
 
-    new_listener->setSocket(
-        draining_listener_socket
-            ? draining_listener_socket
-            : factory_.createListenSocket(new_listener->address(), new_listener->bindToPort()));
+    new_listener->setSocket(draining_listener_socket
+                                ? draining_listener_socket
+                                : factory_.createListenSocket(new_listener->address(),
+                                                              new_listener->listenSocketOptions(),
+                                                              new_listener->bindToPort()));
     if (workers_started_) {
       new_listener->debugLog("add warming listener");
       warming_listeners_.emplace_back(std::move(new_listener));
diff --git a/source/server/listener_manager_impl.h b/source/server/listener_manager_impl.h
index 3b649edd6ea3..8729c339b5f0 100644
--- a/source/server/listener_manager_impl.h
+++ b/source/server/listener_manager_impl.h
@@ -50,6 +50,7 @@ class ProdListenerComponentFactory : public ListenerComponentFactory,
   }
 
   Network::SocketSharedPtr createListenSocket(Network::Address::InstanceConstSharedPtr address,
+                                              const Network::Socket::OptionsSharedPtr& options,
                                               bool bind_to_port) override;
   DrainManagerPtr createDrainManager(envoy::api::v2::Listener::DrainType drain_type) override;
   uint64_t nextListenerTag() override { return next_listener_tag_++; }
@@ -208,6 +209,8 @@ class ListenerImpl : public Network::ListenerConfig,
   void initialize();
   DrainManager& localDrainManager() const { return *local_drain_manager_; }
   void setSocket(const Network::SocketSharedPtr& socket);
+  void setSocketAndOptions(const Network::SocketSharedPtr& socket);
+  const Network::Socket::OptionsSharedPtr& listenSocketOptions() { return listen_socket_options_; }
 
   // Network::ListenerConfig
   Network::FilterChainFactory& filterChainFactory() override { return *this; }
@@ -246,8 +249,11 @@ class ListenerImpl : public Network::ListenerConfig,
   ThreadLocal::Instance& threadLocal() override { return parent_.server_.threadLocal(); }
   Admin& admin() override { return parent_.server_.admin(); }
   const envoy::api::v2::core::Metadata& listenerMetadata() const override { return metadata_; };
-  void setListenSocketOptions(const Network::Socket::OptionsSharedPtr& options) override {
-    listen_socket_options_ = options;
+  void addListenSocketOption(Network::Socket::OptionPtr&& option) override {
+    if (!listen_socket_options_) {
+      listen_socket_options_ = std::make_shared<std::vector<Network::Socket::OptionPtr>>();
+    }
+    listen_socket_options_->emplace_back(std::move(option));
   }
 
   // Network::DrainDecision
diff --git a/test/common/http/codec_client_test.cc b/test/common/http/codec_client_test.cc
index abaa7a8072b6..70618b8a4c0e 100644
--- a/test/common/http/codec_client_test.cc
+++ b/test/common/http/codec_client_test.cc
@@ -332,7 +332,7 @@ class CodecNetworkTest : public testing::TestWithParam<Network::Address::IpVersi
   Network::MockConnectionHandler connection_handler_;
   Network::Address::InstanceConstSharedPtr source_address_;
   Stats::IsolatedStoreImpl stats_store_;
-  Network::TcpListenSocket socket_{Network::Test::getAnyAddress(GetParam()), true};
+  Network::TcpListenSocket socket_{Network::Test::getAnyAddress(GetParam()), nullptr, true};
   Http::MockClientConnection* codec_;
   std::unique_ptr<CodecClientForTest> client_;
   std::shared_ptr<Upstream::MockClusterInfo> cluster_{new NiceMock<Upstream::MockClusterInfo>()};
diff --git a/test/common/network/BUILD b/test/common/network/BUILD
index a013057cf86c..0a12fc7bc464 100644
--- a/test/common/network/BUILD
+++ b/test/common/network/BUILD
@@ -114,6 +114,7 @@ envoy_cc_test(
     deps = [
         "//source/common/network:listen_socket_lib",
         "//source/common/network:utility_lib",
+        "//test/mocks/network:network_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
     ],
diff --git a/test/common/network/connection_impl_test.cc b/test/common/network/connection_impl_test.cc
index 1fdea7b15c79..f6aac6145994 100644
--- a/test/common/network/connection_impl_test.cc
+++ b/test/common/network/connection_impl_test.cc
@@ -161,7 +161,7 @@ class ConnectionImplTest : public testing::TestWithParam<Address::IpVersion> {
 protected:
   Event::DispatcherPtr dispatcher_;
   Stats::IsolatedStoreImpl stats_store_;
-  Network::TcpListenSocket socket_{Network::Test::getAnyAddress(GetParam()), true};
+  Network::TcpListenSocket socket_{Network::Test::getAnyAddress(GetParam()), nullptr, true};
   Network::MockListenerCallbacks listener_callbacks_;
   Network::MockConnectionHandler connection_handler_;
   Network::ListenerPtr listener_;
@@ -252,12 +252,12 @@ TEST_P(ConnectionImplTest, SocketOptions) {
 
   read_filter_.reset(new NiceMock<MockReadFilter>());
 
-  auto options = std::make_shared<MockSocketOptions>();
+  auto option = std::make_unique<MockSocketOption>();
 
-  EXPECT_CALL(*options, setOptions(_)).WillOnce(Return(true));
+  EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PreBind)).WillOnce(Return(true));
   EXPECT_CALL(listener_callbacks_, onAccept_(_, _))
       .WillOnce(Invoke([&](Network::ConnectionSocketPtr& socket, bool) -> void {
-        socket->setOptions(options);
+        socket->addOption(std::move(option));
         Network::ConnectionPtr new_connection = dispatcher_->createServerConnection(
             std::move(socket), Network::Test::createRawBufferSocket());
         listener_callbacks_.onNewConnection(std::move(new_connection));
@@ -300,12 +300,12 @@ TEST_P(ConnectionImplTest, SocketOptionsFailureTest) {
 
   read_filter_.reset(new NiceMock<MockReadFilter>());
 
-  auto options = std::make_shared<MockSocketOptions>();
+  auto option = std::make_unique<MockSocketOption>();
 
-  EXPECT_CALL(*options, setOptions(_)).WillOnce(Return(false));
+  EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PreBind)).WillOnce(Return(false));
   EXPECT_CALL(listener_callbacks_, onAccept_(_, _))
       .WillOnce(Invoke([&](Network::ConnectionSocketPtr& socket, bool) -> void {
-        socket->setOptions(options);
+        socket->addOption(std::move(option));
         Network::ConnectionPtr new_connection = dispatcher_->createServerConnection(
             std::move(socket), Network::Test::createRawBufferSocket());
         listener_callbacks_.onNewConnection(std::move(new_connection));
diff --git a/test/common/network/dns_impl_test.cc b/test/common/network/dns_impl_test.cc
index fe0cf9ad2cc3..6fff238f9b01 100644
--- a/test/common/network/dns_impl_test.cc
+++ b/test/common/network/dns_impl_test.cc
@@ -348,8 +348,8 @@ class DnsImplTest : public testing::TestWithParam<Address::IpVersion> {
 
     // Instantiate TestDnsServer and listen on a random port on the loopback address.
     server_.reset(new TestDnsServer(dispatcher_));
-    socket_.reset(
-        new Network::TcpListenSocket(Network::Test::getCanonicalLoopbackAddress(GetParam()), true));
+    socket_.reset(new Network::TcpListenSocket(
+        Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true));
     listener_ = dispatcher_.createListener(*socket_, *server_, true, false);
 
     // Point c-ares at the listener with no search domains and TCP-only.
diff --git a/test/common/network/listen_socket_impl_test.cc b/test/common/network/listen_socket_impl_test.cc
index a543771189de..3934d0de39e0 100644
--- a/test/common/network/listen_socket_impl_test.cc
+++ b/test/common/network/listen_socket_impl_test.cc
@@ -3,11 +3,15 @@
 #include "common/network/listen_socket_impl.h"
 #include "common/network/utility.h"
 
+#include "test/mocks/network/mocks.h"
 #include "test/test_common/environment.h"
 #include "test/test_common/network_utility.h"
 
 #include "gtest/gtest.h"
 
+using testing::Return;
+using testing::_;
+
 namespace Envoy {
 namespace Network {
 
@@ -16,6 +20,7 @@ class ListenSocketImplTest : public testing::TestWithParam<Address::IpVersion> {
   ListenSocketImplTest() : version_(GetParam()) {}
   const Address::IpVersion version_;
 };
+
 INSTANTIATE_TEST_CASE_P(IpVersions, ListenSocketImplTest,
                         testing::ValuesIn(TestEnvironment::getIpVersionsForTest()));
 
@@ -36,23 +41,32 @@ TEST_P(ListenSocketImplTest, BindSpecificPort) {
   // TODO(jamessynge): Consider adding a loop or other such approach to this test so that a
   // bind failure (in the TcpListenSocket ctor) once isn't considered an error.
   EXPECT_EQ(0, close(addr_fd.second));
-  TcpListenSocket socket1(addr, true);
+
+  auto option = std::make_unique<MockSocketOption>();
+  auto options = std::make_shared<std::vector<Network::Socket::OptionPtr>>();
+  EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PreBind)).WillOnce(Return(true));
+  options->emplace_back(std::move(option));
+  TcpListenSocket socket1(addr, options, true);
   EXPECT_EQ(0, listen(socket1.fd(), 0));
   EXPECT_EQ(addr->ip()->port(), socket1.localAddress()->ip()->port());
   EXPECT_EQ(addr->ip()->addressAsString(), socket1.localAddress()->ip()->addressAsString());
 
+  auto option2 = std::make_unique<MockSocketOption>();
+  auto options2 = std::make_shared<std::vector<Network::Socket::OptionPtr>>();
+  EXPECT_CALL(*option2, setOption(_, Network::Socket::SocketState::PreBind)).WillOnce(Return(true));
+  options2->emplace_back(std::move(option2));
   // The address and port are bound already, should throw exception.
-  EXPECT_THROW(Network::TcpListenSocket socket2(addr, true), EnvoyException);
+  EXPECT_THROW(Network::TcpListenSocket socket2(addr, options2, true), EnvoyException);
 
   // Test the case of a socket with fd and given address and port.
-  TcpListenSocket socket3(dup(socket1.fd()), addr);
+  TcpListenSocket socket3(dup(socket1.fd()), addr, nullptr);
   EXPECT_EQ(addr->asString(), socket3.localAddress()->asString());
 }
 
 // Validate that we get port allocation when binding to port zero.
 TEST_P(ListenSocketImplTest, BindPortZero) {
   auto loopback = Network::Test::getCanonicalLoopbackAddress(version_);
-  TcpListenSocket socket(loopback, true);
+  TcpListenSocket socket(loopback, nullptr, true);
   EXPECT_EQ(Address::Type::Ip, socket.localAddress()->type());
   EXPECT_EQ(version_, socket.localAddress()->ip()->version());
   EXPECT_EQ(loopback->ip()->addressAsString(), socket.localAddress()->ip()->addressAsString());
diff --git a/test/common/network/listener_impl_test.cc b/test/common/network/listener_impl_test.cc
index 2b01c6186abf..50b4d8a3c64e 100644
--- a/test/common/network/listener_impl_test.cc
+++ b/test/common/network/listener_impl_test.cc
@@ -24,7 +24,8 @@ static void errorCallbackTest(Address::IpVersion version) {
   Stats::IsolatedStoreImpl stats_store;
   Event::DispatcherImpl dispatcher;
 
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version), nullptr,
+                                  true);
   Network::MockListenerCallbacks listener_callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener =
@@ -85,8 +86,9 @@ INSTANTIATE_TEST_CASE_P(IpVersions, ListenerImplTest,
 TEST_P(ListenerImplTest, UseActualDst) {
   Stats::IsolatedStoreImpl stats_store;
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version_), true);
-  Network::TcpListenSocket socketDst(alt_address_, false);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version_), nullptr,
+                                  true);
+  Network::TcpListenSocket socketDst(alt_address_, nullptr, false);
   Network::MockListenerCallbacks listener_callbacks1;
   Network::MockConnectionHandler connection_handler;
   // Do not redirect since use_original_dst is false.
@@ -122,7 +124,7 @@ TEST_P(ListenerImplTest, UseActualDst) {
 TEST_P(ListenerImplTest, WildcardListenerUseActualDst) {
   Stats::IsolatedStoreImpl stats_store;
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getAnyAddress(version_), true);
+  Network::TcpListenSocket socket(Network::Test::getAnyAddress(version_), nullptr, true);
   Network::MockListenerCallbacks listener_callbacks;
   Network::MockConnectionHandler connection_handler;
   // Do not redirect since use_original_dst is false.
@@ -161,7 +163,12 @@ TEST_P(ListenerImplTest, WildcardListenerUseActualDst) {
 TEST_P(ListenerImplTest, WildcardListenerIpv4Compat) {
   Stats::IsolatedStoreImpl stats_store;
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getAnyAddress(version_, true), true);
+  auto option = std::make_unique<MockSocketOption>();
+  auto options = std::make_shared<std::vector<Network::Socket::OptionPtr>>();
+  EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PreBind)).WillOnce(Return(true));
+  options->emplace_back(std::move(option));
+
+  Network::TcpListenSocket socket(Network::Test::getAnyAddress(version_, true), options, true);
   Network::MockListenerCallbacks listener_callbacks;
   Network::MockConnectionHandler connection_handler;
 
diff --git a/test/common/network/proxy_protocol_test.cc b/test/common/network/proxy_protocol_test.cc
index d0b179a48c18..c0df7ba3b0eb 100644
--- a/test/common/network/proxy_protocol_test.cc
+++ b/test/common/network/proxy_protocol_test.cc
@@ -39,7 +39,7 @@ class ProxyProtocolTest : public testing::TestWithParam<Address::IpVersion>,
                           protected Logger::Loggable<Logger::Id::main> {
 public:
   ProxyProtocolTest()
-      : socket_(Network::Test::getCanonicalLoopbackAddress(GetParam()), true),
+      : socket_(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true),
         connection_handler_(new Server::ConnectionHandlerImpl(ENVOY_LOGGER(), dispatcher_)),
         name_("proxy") {
     connection_handler_->addListener(*this);
@@ -321,7 +321,7 @@ class WildcardProxyProtocolTest : public testing::TestWithParam<Address::IpVersi
                                   protected Logger::Loggable<Logger::Id::main> {
 public:
   WildcardProxyProtocolTest()
-      : socket_(Network::Test::getAnyAddress(GetParam()), true),
+      : socket_(Network::Test::getAnyAddress(GetParam()), nullptr, true),
         local_dst_address_(Network::Utility::getAddressWithPort(
             *Network::Test::getCanonicalLoopbackAddress(GetParam()),
             socket_.localAddress()->ip()->port())),
diff --git a/test/common/ssl/ssl_socket_test.cc b/test/common/ssl/ssl_socket_test.cc
index 7794d26bfa89..d11bcdf60435 100644
--- a/test/common/ssl/ssl_socket_test.cc
+++ b/test/common/ssl/ssl_socket_test.cc
@@ -56,7 +56,8 @@ void testUtil(const std::string& client_ctx_json, const std::string& server_ctx_
                                                         stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version), nullptr,
+                                  true);
   Network::MockListenerCallbacks callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher.createListener(socket, callbacks, true, false);
@@ -155,7 +156,8 @@ const std::string testUtilV2(const envoy::api::v2::Listener& server_proto,
   ASSERT(server_transport_socket_factories.size() >= 1);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(version), nullptr,
+                                  true);
   NiceMock<Network::MockListenerCallbacks> callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher.createListener(socket, callbacks, true, false);
@@ -735,7 +737,8 @@ TEST_P(SslSocketTest, FlushCloseDuringHandshake) {
                                                         stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                  true);
   Network::MockListenerCallbacks callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher.createListener(socket, callbacks, true, false);
@@ -792,7 +795,8 @@ TEST_P(SslSocketTest, HalfClose) {
                                                         stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                  true);
   Network::MockListenerCallbacks listener_callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener =
@@ -874,7 +878,8 @@ TEST_P(SslSocketTest, ClientAuthMultipleCAs) {
                                                         stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                  true);
   Network::MockListenerCallbacks callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher.createListener(socket, callbacks, true, false);
@@ -954,8 +959,10 @@ void testTicketSessionResumption(const std::string& server_ctx_json1,
                                                          manager, stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket1(Network::Test::getCanonicalLoopbackAddress(ip_version), true);
-  Network::TcpListenSocket socket2(Network::Test::getCanonicalLoopbackAddress(ip_version), true);
+  Network::TcpListenSocket socket1(Network::Test::getCanonicalLoopbackAddress(ip_version), nullptr,
+                                   true);
+  Network::TcpListenSocket socket2(Network::Test::getCanonicalLoopbackAddress(ip_version), nullptr,
+                                   true);
   NiceMock<Network::MockListenerCallbacks> callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener1 = dispatcher.createListener(socket1, callbacks, true, false);
@@ -1276,8 +1283,10 @@ TEST_P(SslSocketTest, ClientAuthCrossListenerSessionResumption) {
                                                          manager, stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), true);
-  Network::TcpListenSocket socket2(Network::Test::getCanonicalLoopbackAddress(GetParam()), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                  true);
+  Network::TcpListenSocket socket2(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                   true);
   Network::MockListenerCallbacks callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher.createListener(socket, callbacks, true, false);
@@ -1383,7 +1392,8 @@ TEST_P(SslSocketTest, SslError) {
                                                         stats_store);
 
   Event::DispatcherImpl dispatcher;
-  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), true);
+  Network::TcpListenSocket socket(Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                  true);
   Network::MockListenerCallbacks callbacks;
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher.createListener(socket, callbacks, true, false);
@@ -2172,7 +2182,8 @@ class SslReadBufferLimitTest : public SslCertsTest,
 
   Stats::IsolatedStoreImpl stats_store_;
   Event::DispatcherPtr dispatcher_{new Event::DispatcherImpl};
-  Network::TcpListenSocket socket_{Network::Test::getCanonicalLoopbackAddress(GetParam()), true};
+  Network::TcpListenSocket socket_{Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr,
+                                   true};
   Network::MockListenerCallbacks listener_callbacks_;
   Network::MockConnectionHandler connection_handler_;
   std::string server_ctx_json_ = R"EOF(
diff --git a/test/integration/fake_upstream.cc b/test/integration/fake_upstream.cc
index 787b298225c3..04afb771c4cb 100644
--- a/test/integration/fake_upstream.cc
+++ b/test/integration/fake_upstream.cc
@@ -272,7 +272,7 @@ static Network::SocketPtr makeTcpListenSocket(uint32_t port, Network::Address::I
   return Network::SocketPtr{new Network::TcpListenSocket(
       Network::Utility::parseInternetAddressAndPort(
           fmt::format("{}:{}", Network::Test::getAnyAddressUrlString(version), port)),
-      true)};
+      nullptr, true)};
 }
 
 FakeUpstream::FakeUpstream(uint32_t port, FakeHttpConnection::Type type,
diff --git a/test/mocks/api/mocks.h b/test/mocks/api/mocks.h
index 46dcacb9c430..c7338e9501a7 100644
--- a/test/mocks/api/mocks.h
+++ b/test/mocks/api/mocks.h
@@ -44,6 +44,7 @@ class MockOsSysCalls : public OsSysCallsImpl {
   // Api::OsSysCalls
   ssize_t write(int fd, const void* buffer, size_t num_bytes) override;
   int open(const std::string& full_path, int flags, int mode) override;
+
   MOCK_METHOD3(bind, int(int sockfd, const sockaddr* addr, socklen_t addrlen));
   MOCK_METHOD1(close, int(int));
   MOCK_METHOD3(open_, int(const std::string& full_path, int flags, int mode));
diff --git a/test/mocks/network/mocks.cc b/test/mocks/network/mocks.cc
index 9b706b97e430..92ddb0bd3937 100644
--- a/test/mocks/network/mocks.cc
+++ b/test/mocks/network/mocks.cc
@@ -172,8 +172,11 @@ MockListenSocket::MockListenSocket() : local_address_(new Address::Ipv4Instance(
 
 MockListenSocket::~MockListenSocket() {}
 
-MockSocketOptions::MockSocketOptions() {}
-MockSocketOptions::~MockSocketOptions() {}
+MockSocketOption::MockSocketOption() {
+  ON_CALL(*this, setOption(_, _)).WillByDefault(Return(true));
+}
+
+MockSocketOption::~MockSocketOption() {}
 
 MockConnectionSocket::MockConnectionSocket() : local_address_(new Address::Ipv4Instance(80)) {
   ON_CALL(*this, localAddress()).WillByDefault(ReturnRef(local_address_));
diff --git a/test/mocks/network/mocks.h b/test/mocks/network/mocks.h
index a8a861112d89..cd016bdda061 100644
--- a/test/mocks/network/mocks.h
+++ b/test/mocks/network/mocks.h
@@ -258,23 +258,25 @@ class MockListenSocket : public Socket {
   MockListenSocket();
   ~MockListenSocket();
 
+  void addOption(Socket::OptionPtr&& option) override { addOption_(option); }
+
   MOCK_CONST_METHOD0(localAddress, const Address::InstanceConstSharedPtr&());
   MOCK_CONST_METHOD0(fd, int());
   MOCK_METHOD0(close, void());
-  MOCK_METHOD1(setOptions, void(const Socket::OptionsSharedPtr& options));
+  MOCK_METHOD1(addOption_, void(Socket::OptionPtr& option));
   MOCK_CONST_METHOD0(options, const OptionsSharedPtr&());
 
   Address::InstanceConstSharedPtr local_address_;
   OptionsSharedPtr options_;
 };
 
-class MockSocketOptions : public Socket::Options {
+class MockSocketOption : public Socket::Option {
 public:
-  MockSocketOptions();
-  ~MockSocketOptions();
+  MockSocketOption();
+  ~MockSocketOption();
 
-  MOCK_CONST_METHOD1(setOptions, bool(Socket&));
-  MOCK_CONST_METHOD0(hashKey, uint32_t());
+  MOCK_CONST_METHOD2(setOption, bool(Socket&, Network::Socket::SocketState state));
+  MOCK_CONST_METHOD1(hashKey, void(std::vector<uint8_t>&));
 };
 
 class MockConnectionSocket : public ConnectionSocket {
@@ -282,12 +284,14 @@ class MockConnectionSocket : public ConnectionSocket {
   MockConnectionSocket();
   ~MockConnectionSocket();
 
+  void addOption(Socket::OptionPtr&& option) override { addOption_(option); }
+
   MOCK_CONST_METHOD0(localAddress, const Address::InstanceConstSharedPtr&());
   MOCK_METHOD2(setLocalAddress, void(const Address::InstanceConstSharedPtr&, bool));
   MOCK_CONST_METHOD0(localAddressRestored, bool());
   MOCK_CONST_METHOD0(remoteAddress, const Address::InstanceConstSharedPtr&());
   MOCK_METHOD1(setRemoteAddress, void(const Address::InstanceConstSharedPtr&));
-  MOCK_METHOD1(setOptions, void(const Network::ConnectionSocket::OptionsSharedPtr&));
+  MOCK_METHOD1(addOption_, void(Socket::OptionPtr&));
   MOCK_CONST_METHOD0(options, const Network::ConnectionSocket::OptionsSharedPtr&());
   MOCK_CONST_METHOD0(fd, int());
   MOCK_METHOD0(close, void());
diff --git a/test/mocks/server/mocks.cc b/test/mocks/server/mocks.cc
index c5a25071e89d..f9d581f3be5f 100644
--- a/test/mocks/server/mocks.cc
+++ b/test/mocks/server/mocks.cc
@@ -58,7 +58,19 @@ MockHotRestart::~MockHotRestart() {}
 
 MockListenerComponentFactory::MockListenerComponentFactory()
     : socket_(std::make_shared<NiceMock<Network::MockListenSocket>>()) {
-  ON_CALL(*this, createListenSocket(_, _)).WillByDefault(Return(socket_));
+  ON_CALL(*this, createListenSocket(_, _, _))
+      .WillByDefault(Invoke([&](Network::Address::InstanceConstSharedPtr,
+                                const Network::Socket::OptionsSharedPtr& options,
+                                bool) -> Network::SocketSharedPtr {
+        if (options) {
+          for (const auto& option : *options) {
+            if (!option->setOption(*socket_, Network::Socket::SocketState::PreBind)) {
+              throw EnvoyException("MockListenerComponentFactory: Setting socket options failed");
+            }
+          }
+        }
+        return socket_;
+      }));
 }
 MockListenerComponentFactory::~MockListenerComponentFactory() {}
 
diff --git a/test/mocks/server/mocks.h b/test/mocks/server/mocks.h
index f28e7203da91..4dfde44c36ec 100644
--- a/test/mocks/server/mocks.h
+++ b/test/mocks/server/mocks.h
@@ -165,8 +165,9 @@ class MockListenerComponentFactory : public ListenerComponentFactory {
                std::vector<Configuration::ListenerFilterFactoryCb>(
                    const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>&,
                    Configuration::ListenerFactoryContext& context));
-  MOCK_METHOD2(createListenSocket,
+  MOCK_METHOD3(createListenSocket,
                Network::SocketSharedPtr(Network::Address::InstanceConstSharedPtr address,
+                                        const Network::Socket::OptionsSharedPtr& options,
                                         bool bind_to_port));
   MOCK_METHOD1(createDrainManager_, DrainManager*(envoy::api::v2::Listener::DrainType drain_type));
   MOCK_METHOD0(nextListenerTag, uint64_t());
@@ -368,12 +369,16 @@ class MockTransportSocketFactoryContext : public TransportSocketFactoryContext {
   MOCK_CONST_METHOD0(statsScope, Stats::Scope&());
 };
 
-class MockListenerFactoryContext : public MockFactoryContext {
+class MockListenerFactoryContext : public virtual MockFactoryContext,
+                                   public virtual ListenerFactoryContext {
 public:
   MockListenerFactoryContext();
   ~MockListenerFactoryContext();
 
-  MOCK_METHOD1(setListenSocketOptions, void(const Network::Socket::OptionsSharedPtr&));
+  void addListenSocketOption(Network::Socket::OptionPtr&& option) override {
+    addListenSocketOption_(option);
+  }
+  MOCK_METHOD1(addListenSocketOption_, void(Network::Socket::OptionPtr&));
 };
 
 } // namespace Configuration
diff --git a/test/server/listener_manager_impl_test.cc b/test/server/listener_manager_impl_test.cc
index a27c332fb4f6..b3993f7f8a7c 100644
--- a/test/server/listener_manager_impl_test.cc
+++ b/test/server/listener_manager_impl_test.cc
@@ -128,7 +128,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, EmptyFilter) {
   )EOF";
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromJson(json), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -141,7 +141,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, DefaultListenerPerConnectionBuffe
   }
   )EOF";
 
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromJson(json), true);
   EXPECT_EQ(1024 * 1024U, manager_->listeners().back().get().perConnectionBufferLimitBytes());
 }
@@ -155,7 +155,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, SetListenerPerConnectionBufferLim
   }
   )EOF";
 
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromJson(json), true);
   EXPECT_EQ(8192U, manager_->listeners().back().get().perConnectionBufferLimitBytes());
 }
@@ -177,7 +177,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, SslContext) {
   )EOF",
                                                        Network::Address::IpVersion::v4);
 
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromJson(json), true);
   EXPECT_TRUE(
       manager_->listeners().back().get().transportSocketFactory().implementsSecureTransport());
@@ -260,7 +260,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, StatsScopeTest) {
   }
   )EOF";
 
-  EXPECT_CALL(listener_factory_, createListenSocket(_, false));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, false));
   manager_->addOrUpdateListener(parseListenerFromJson(json), true);
   manager_->listeners().front().get().listenerScope().counter("foo").inc();
 
@@ -283,7 +283,7 @@ TEST_F(ListenerManagerImplTest, ModifyOnlyDrainType) {
 
   ListenerHandle* listener_foo =
       expectListenerCreate(false, envoy::api::v2::Listener_DrainType_MODIFY_ONLY);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromV2Yaml(listener_foo_yaml), true));
   checkStats(1, 0, 0, 0, 1, 0);
 
@@ -304,7 +304,7 @@ TEST_F(ListenerManagerImplTest, AddListenerAddressNotMatching) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
   checkStats(1, 0, 0, 0, 1, 0);
 
@@ -344,7 +344,7 @@ TEST_F(ListenerManagerImplTest, UpdateRemoveNotModifiableListener) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), false));
   checkStats(1, 0, 0, 0, 1, 0);
 
@@ -383,7 +383,7 @@ TEST_F(ListenerManagerImplTest, AddOrUpdateListener) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
   checkStats(1, 0, 0, 0, 1, 0);
 
@@ -446,7 +446,7 @@ TEST_F(ListenerManagerImplTest, AddOrUpdateListener) {
   )EOF";
 
   ListenerHandle* listener_bar = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(*worker_, addListener(_, _));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_bar_json), true));
   EXPECT_EQ(2UL, manager_->listeners().size());
@@ -463,7 +463,7 @@ TEST_F(ListenerManagerImplTest, AddOrUpdateListener) {
   )EOF";
 
   ListenerHandle* listener_baz = expectListenerCreate(true);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(listener_baz->target_, initialize(_));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_baz_json), true));
   EXPECT_EQ(2UL, manager_->listeners().size());
@@ -527,7 +527,7 @@ TEST_F(ListenerManagerImplTest, AddDrainingListener) {
   ON_CALL(*listener_factory_.socket_, localAddress()).WillByDefault(ReturnRef(local_address));
 
   ListenerHandle* listener_foo = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(*worker_, addListener(_, _));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
   worker_->callAddCompletion(true);
@@ -571,7 +571,7 @@ TEST_F(ListenerManagerImplTest, CantBindSocket) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(true);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true))
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true))
       .WillOnce(Throw(EnvoyException("can't bind")));
   EXPECT_CALL(*listener_foo, onDestroy());
   EXPECT_THROW(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true),
@@ -593,7 +593,7 @@ TEST_F(ListenerManagerImplTest, ListenerDraining) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(*worker_, addListener(_, _));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
   worker_->callAddCompletion(true);
@@ -645,7 +645,7 @@ TEST_F(ListenerManagerImplTest, RemoveListener) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(true);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(listener_foo->target_, initialize(_));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
   EXPECT_EQ(0UL, manager_->listeners().size());
@@ -659,7 +659,7 @@ TEST_F(ListenerManagerImplTest, RemoveListener) {
 
   // Add foo again and initialize it.
   listener_foo = expectListenerCreate(true);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(listener_foo->target_, initialize(_));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
   checkStats(2, 0, 1, 1, 0, 0);
@@ -718,7 +718,7 @@ TEST_F(ListenerManagerImplTest, AddListenerFailure) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(false);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   EXPECT_CALL(*worker_, addListener(_, _));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
 
@@ -767,7 +767,7 @@ TEST_F(ListenerManagerImplTest, DuplicateAddressDontBind) {
   )EOF";
 
   ListenerHandle* listener_foo = expectListenerCreate(true);
-  EXPECT_CALL(listener_factory_, createListenSocket(_, false));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, false));
   EXPECT_CALL(listener_foo->target_, initialize(_));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromJson(listener_foo_json), true));
 
@@ -836,7 +836,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, SniWithSingleFilterChain) {
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -892,7 +892,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, SniWithTwoEqualFilterChains) {
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -949,7 +949,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest,
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -1073,7 +1073,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, TlsCertificateInline) {
   )EOF";
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -1092,7 +1092,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, TlsCertificateChainInlinePrivateK
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -1226,7 +1226,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstFilter) {
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 
@@ -1267,17 +1267,19 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilter) {
 
   class OriginalDstTestConfigFactory : public Configuration::NamedListenerFilterConfigFactory {
   public:
-    OriginalDstTestConfigFactory() : options_(std::make_shared<Network::MockSocketOptions>()) {}
-
     // NamedListenerFilterConfigFactory
     Configuration::ListenerFilterFactoryCb
     createFilterFactoryFromProto(const Protobuf::Message&,
                                  Configuration::ListenerFactoryContext& context) override {
-      EXPECT_CALL(*options_, setOptions(_)).WillOnce(Invoke([](Network::Socket& socket) -> bool {
-        fd = socket.fd();
-        return true;
-      }));
-      context.setListenSocketOptions(options_);
+      auto option = std::make_unique<Network::MockSocketOption>();
+      EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PreBind))
+          .WillOnce(Return(true));
+      EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PostBind))
+          .WillOnce(Invoke([](Network::Socket& socket, Network::Socket::SocketState) -> bool {
+            fd = socket.fd();
+            return true;
+          }));
+      context.addListenSocketOption(std::move(option));
       return [](Network::ListenerFilterManager& filter_manager) -> void {
         filter_manager.addAcceptFilter(std::make_unique<OriginalDstTest>());
       };
@@ -1288,8 +1290,6 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilter) {
     }
 
     std::string name() override { return "test.listener.original_dst"; }
-
-    std::shared_ptr<Network::MockSocketOptions> options_;
   };
 
   /**
@@ -1310,7 +1310,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilter) {
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 
@@ -1342,14 +1342,14 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilter) {
 TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilterOptionFail) {
   class OriginalDstTestConfigFactory : public Configuration::NamedListenerFilterConfigFactory {
   public:
-    OriginalDstTestConfigFactory() : options_(std::make_shared<Network::MockSocketOptions>()) {}
-
     // NamedListenerFilterConfigFactory
     Configuration::ListenerFilterFactoryCb
     createFilterFactoryFromProto(const Protobuf::Message&,
                                  Configuration::ListenerFactoryContext& context) override {
-      EXPECT_CALL(*options_, setOptions(_)).WillOnce(Return(false));
-      context.setListenSocketOptions(options_);
+      auto option = std::make_unique<Network::MockSocketOption>();
+      EXPECT_CALL(*option, setOption(_, Network::Socket::SocketState::PreBind))
+          .WillOnce(Return(false));
+      context.addListenSocketOption(std::move(option));
       return [](Network::ListenerFilterManager& filter_manager) -> void {
         filter_manager.addAcceptFilter(std::make_unique<OriginalDstTest>());
       };
@@ -1360,8 +1360,6 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilterOptionFail)
     }
 
     std::string name() override { return "testfail.listener.original_dst"; }
-
-    std::shared_ptr<Network::MockSocketOptions> options_;
   };
 
   /**
@@ -1382,11 +1380,11 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstTestFilterOptionFail)
   )EOF",
                                                        Network::Address::IpVersion::v4);
 
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
 
   EXPECT_THROW_WITH_MESSAGE(manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true),
                             EnvoyException,
-                            "socketOptionFailListener: Setting socket options failed");
+                            "MockListenerComponentFactory: Setting socket options failed");
   EXPECT_EQ(0U, manager_->listeners().size());
 }
 
@@ -1407,7 +1405,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, CRLFilename) {
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }
@@ -1429,7 +1427,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, CRLInline) {
                                                        Network::Address::IpVersion::v4);
 
   EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, true));
+  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }