[PATCH net] calipso: update payload_len when removing the CALIPSO option

[Paul Moore]

On Fri, Oct 16, 2026 at 10:26 AM Joas Antonio dos Santos
<joasantonio108 at gmail.com> wrote:
>
> On Wed, Oct 14, 2026 at 9:39 AM Paul Moore wrote:
> > while basic CALIPSO labeling is tested via an automated test job, this
> > particular code path is not part of the automated testing.
> > Improvements to the tests are always welcome.
>
> Hi Paul,
>
> I opened a PR adding a forwarding test to tests/inet_socket:
>
>   https://github.com/SELinuxProject/selinux-testsuite/pull/106
>
> It builds a client -- router -- server setup with network namespaces
> and checks both directions: the router removing the CALIPSO option and
> the router adding one.  On Fedora 44 (6.19.10, without the fix) only
> the removal subtest fails, with the forwarded packet dropped as
> truncated; with the fix all inet_socket and sctp tests pass, both as
> unconfined_t and sysadm_t.
>
> Until the fix reaches the kernel used by the CI, the removal subtest
> will fail there; I'm happy to gate it on a kernel version if you
> prefer.

I see you sent it to the list too - thank you for helping with this!

-- 
paul-moore.com