[PATCH net] calipso: update payload_len when removing the CALIPSO option

[Joas Antonio dos Santos]

On Wed, Oct 14, 2026 at 9:39 AM Paul Moore wrote:
> while basic CALIPSO labeling is tested via an automated test job, this
> particular code path is not part of the automated testing.
> Improvements to the tests are always welcome.

Hi Paul,

I opened a PR adding a forwarding test to tests/inet_socket:

  https://github.com/SELinuxProject/selinux-testsuite/pull/106

It builds a client -- router -- server setup with network namespaces
and checks both directions: the router removing the CALIPSO option and
the router adding one.  On Fedora 44 (6.19.10, without the fix) only
the removal subtest fails, with the forwarded packet dropped as
truncated; with the fix all inet_socket and sctp tests pass, both as
unconfined_t and sysadm_t.

Until the fix reaches the kernel used by the CI, the removal subtest
will fail there; I'm happy to gate it on a kernel version if you
prefer.

Thanks,
Joas