[PATCH net v2] calipso: update payload_len when removing the CALIPSO option

[Paul Moore]

On Thu, Oct 15, 2026 at 7:14 PM Joas Antonio dos Santos
<joasantonio108 at gmail.com> wrote:
>
> On Thu, 15 Oct 2026, Paolo Abeni wrote:
> > The above looks like a pre-existing issue, the patch itself looks
> > correct, right?
>
> Hi Paolo, Paul,
>
> Yes, the issue is pre-existing; the delattr patch doesn't change it.
> The skb_pull()/memmove()/skb_reset_network_header() sequence quoted
> by Sashiko predates this patch, which only adjusts payload_len after
> it.
>
> I tested Paul's idea on top of both CALIPSO patches (QEMU, veth +
> br0 with bridge-nf-call-ip6tables=1, SELinux + NetLabel CALIPSO
> DOI 16):
>
> - without it, a bridged CALIPSO packet towards an unlabeled
>   destination reaches the peer with a corrupted Ethernet header
>   (garbage dst MAC, ethertype 0x0000) and is dropped; an unlabeled
>   packet towards a CALIPSO-mapped destination never reaches the peer.
> - with the nf_bridge_info_exists() check in selinux_ip_forward()
>   (plus a stub returning false for CONFIG_BRIDGE_NETFILTER=n),
>   5/5 packets are delivered unmodified in both cases.
> - the routed path is unchanged: delattr 5/5, setattr still adds the
>   option 5/5. W=1 is clean with BRIDGE_NETFILTER=y and =n.
>
> Paul, if you like I can send it as a separate selinux patch with your
> Suggested-by.

Yes, please do.  Thanks for working on this!

-- 
paul-moore.com