From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f179.google.com (mail-dy1-f179.google.com [74.125.82.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A9EB735675E for ; Fri, 16 Oct 2026 14:26:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792160782; cv=none; b=JnrHvGbQK5ShuJduN97MciJXSzGp5eMFEOdgtJcnymvF/butJKeYaCf6gvfcHlEQ5XjQv0DU9EPvex8KDMbUh+UMGwHG87QQac950/X2KB3nxSeNMwOBK3U3ciTw1jK6XVNo0BopZ194rN2T0t1gOUA0BUAWExSRrDFbFVaIW98= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792160782; c=relaxed/simple; bh=BA3ZOMsHyP2GTKp/rqwxW3xgiYBeA3bbd1xCYOxEnto=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=pcqW0LzTsAdaYwb2ou8wYpRk8Tx12sUVcLt8lp2JsiGiFgox97sBzqoq9BqItVTWwfbzz0s/duKK+WI1v5EfOyqHT3vgQ2m/nodvS35ssfuJmQWC+GrV2EVz9a8VXjsP9S0rE7yL2EfRCloYJfJq5+rE8MbL3g73h32mT0UYaCc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NRUpRL1M; arc=none smtp.client-ip=74.125.82.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NRUpRL1M" Received: by mail-dy1-f179.google.com with SMTP id 5a478bee46e88-3535bf8b3e0so5288645eec.0 for ; Fri, 16 Oct 2026 07:26:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792160780; x=1792765580; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:content-type:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=BMcQDGMpfF+Xt2i/WNjW/x8k2X+ctHzEstRfrAzmcvk=; b=NRUpRL1MzMDAaRTXXFuHrqn4wko3xp/8JnOIn7pYQnxhCO99toCDQkZmTO/2bTJcnv H27wEl9FegfrAHFdfBpSt9Yg3x5ZTbOiqmd1gsMZCczKn8TpsQ3iWwwuI50XfFtW3k5t Rf+e2PaT7aVBSAL+fPosWssDsQo/R7fA+kfWTvK34LkN8M9S22wL9nbP5+NnwvxGVyqq lPEQHlXLh36DzpNw6lokYGHVhIwzKehLN+PgmkUISoOyKg0o0TjZzoY+OLSDyNuRMze7 VwQ69ZsZRMMfvy6qwjuN7PWYzzWc2SXTVfU0OBrPlP8A2XRp1V89hx264PDzphYX6Z2G 41LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792160780; x=1792765580; h=mime-version:content-transfer-encoding:content-type:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=BMcQDGMpfF+Xt2i/WNjW/x8k2X+ctHzEstRfrAzmcvk=; b=kSuhLSstLTOy7+nfA8YwQ2awTfrLQDj9Nab2TrVc941RRDijLdnP8vkFAYaGEZkN8z RYJkjkzHcpIxBi2W2++FjgBKMWbhiEOvSR29BBRPsKr+Ihpx7FJsOGTQ3yyXBP9p6eBu htuxSFB844ERzscHIZr561BUBdL/k2m3U5EFFTUwOeXbgdKPIuC4O7W9yYXw/wBAh/Jw O8lpEwy4GnhCvKxayTg2Z7ZgajzWvyMmHAgpjQ1UmwKP0YNrWAhzxs7RXIKhIiQTxgs9 X/ducgySDNtTOcyxN16ypqokCbHAg1CmdwmnkIBiZvXIzXD/rDZlueYwbJeucYEnqF61 gmdw== X-Forwarded-Encrypted: i=1; AKwUvBzoUCA/Wk6rYuapV9QRnuOWbBAZjm17KYsLma74j+l9ub0TkDZh68qB17qitFTjQcgUHhdRPCE=@vger.kernel.org X-Gm-Message-State: AFq9FYJtJSHBt1V5gVj3+jf/RFnx6Gqtr0qbvPNtCj/YYHZJ8QjSgw// rEJ+4yKLg24smWUANp0Kor9XiqqFHFaHsd4Z09K3l+p6LuEHcDfsPjI8 X-Gm-Gg: AYBFou0GSpASJFaJdlxeyh1rFnEUOSNxLmA0YUg+teq2Txb4FupmkfTCVi4gH3v0pFz gyhBN1uwMfZH1deHG0qtUfroF5lVhtFHFjLzeJ59QU7ZtyWEhp6s3hz6HfCflv/K6Fdin/AHEf3 71H8wruhkCimN1MeU0rLoI/9ATVjQKEibGmcUCFIjBeSPPX/dU8v8AomPuwMXf9nqtfpCpndmaV erarDTbkS1Ia+TRpcihG3O4HORTSXvlLWZyYg27E86atkHpsEOBE8yozQSVGGbIh1P1zJHP/9Xh 9b2ZwWmoVfTPNnzKJqZE4cj5yxDgdle+ciJM5HAUyG7l0TEKWLBc0eY0lgZAQDgZBvgSEfTBm2K 4fCGpbxjR1D17LVRk6dMYsSHQFEdRRoP5tAzwxC8cf3i997W/jyScldMia0gpbABcTDf9N2uKfA +dZ+RyQJOoGM+LEsOS8v+R0g9PHqlsiZrWUaUSapVbTY/MpAIFRs4q3l/I17+GhJA8LN/6gpkjo I6yKiGw7CmOtLSWYuMoPx5WUofzQhwUyCnP3YosbYvukFprnHRwDZUsQNQeO1qBpMa2XNct1fqy ikm4b7KgCV4+naYbuOGVND+mgli0SXU9IKVtEYs1G3EOK3rfLT9oDQnC X-Received: by 2002:a05:7022:28b:10b0:16f:c9db:c5af with SMTP id a92af1059eb24-185118eded7mr132172c88.11.1792160779405; Fri, 16 Oct 2026 07:26:19 -0700 (PDT) Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa ([2804:7f0:b100:ece0:b5:bb23:a54:ce61]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-18314ef8ed8sm6348059c88.3.2026.10.16.07.26.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 07:26:18 -0700 (PDT) From: Joas Antonio dos Santos To: Paul Moore Cc: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Paolo Abeni , Simon Horman , netdev@vger.kernel.org, linux-security-module@vger.kernel.org, Alice Mikityanska Subject: Re: [PATCH net] calipso: update payload_len when removing the CALIPSO option Date: Fri, 16 Oct 2026 11:26:14 -0300 Message-ID: <179216077404.22091.15636720633867774901@gmail.com> In-Reply-To: References: <179138670045.80227.16292613517250896744@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Wed, Oct 14, 2026 at 9:39 AM Paul Moore wrote: > while basic CALIPSO labeling is tested via an automated test job, this > particular code path is not part of the automated testing. > Improvements to the tests are always welcome. Hi Paul, I opened a PR adding a forwarding test to tests/inet_socket: https://github.com/SELinuxProject/selinux-testsuite/pull/106 It builds a client -- router -- server setup with network namespaces and checks both directions: the router removing the CALIPSO option and the router adding one. On Fedora 44 (6.19.10, without the fix) only the removal subtest fails, with the forwarded packet dropped as truncated; with the fix all inet_socket and sctp tests pass, both as unconfined_t and sysadm_t. Until the fix reaches the kernel used by the CI, the removal subtest will fail there; I'm happy to gate it on a kernel version if you prefer. Thanks, Joas