[PATCH 0/3] selftests: forwarding: fix br_netfilter related test failures

[PATCH 0/3] selftests: forwarding: fix br_netfilter related test failures

[Aleksei Oladko]

Hello

This patch series fixes kselftests that fail when the br_nefilter
module is loaded. The failures occur because the tests generate
packets that are either modified or encapsulated, but their IP
headers are not fully correct for sanity checks performed by
be_netfilter.

Aleksei Oladko (3):
  selftests: forwarding: vxlan_bridge_1d: fix test failure with
    br_netfilter enabled
  selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with
    br_netfilter enabled
  selftests: forwarding: fix pedit tests failure with br_netfilter
    enabled

 .../selftests/net/forwarding/pedit_dsfield.sh |  5 ++--
 .../selftests/net/forwarding/pedit_ip.sh      |  2 +-
 .../net/forwarding/vxlan_bridge_1d.sh         | 26 ++++++++++++-------
 .../net/forwarding/vxlan_bridge_1d_ipv6.sh    |  2 +-
 4 files changed, 21 insertions(+), 14 deletions(-)

-- 
2.43.0

[PATCH 1/3] selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled

[Aleksei Oladko]

The test generates VXLAN traffic using mausezahn, where the encapsulated
inner IPv4 packet contains a zero IP header checksum. After VXLAN
decapsulation, such packets do not pass sanity checks in br_netfilter
and are dropped, which causes the test to fail.

Fix this by calculating and setting a valid IPv4 header checksum for the
encapsulated packet generated by mausezahn, so that the packet is accepted
by br_netfilter.

Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
---
 .../net/forwarding/vxlan_bridge_1d.sh         | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
index b43816dd998c..457f41d5e584 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
@@ -567,6 +567,21 @@ vxlan_encapped_ping_do()
 	local inner_tos=$1; shift
 	local outer_tos=$1; shift
 
+	local ipv4hdr=$(:
+		    )"45:"$(                      : IP version + IHL
+		    )"$inner_tos:"$(              : IP TOS
+		    )"00:54:"$(                   : IP total length
+		    )"99:83:"$(                   : IP identification
+		    )"40:00:"$(                   : IP flags + frag off
+		    )"40:"$(                      : IP TTL
+		    )"01:"$(                      : IP proto
+		    )"CHECKSUM:"$(                : IP header csum
+		    )"c0:00:02:03:"$(             : IP saddr: 192.0.2.3
+		    )"c0:00:02:01"$(              : IP daddr: 192.0.2.1
+		)
+	local checksum=$(payload_template_calc_checksum "$ipv4hdr")
+	ipv4hdr=$(payload_template_expand_checksum "$ipv4hdr" $checksum)
+
 	$MZ $dev -c $count -d 100msec -q \
 		-b $next_hop_mac -B $dest_ip \
 		-t udp tos=$outer_tos,sp=23456,dp=$VXPORT,p=$(:
@@ -577,16 +592,7 @@ vxlan_encapped_ping_do()
 		    )"$dest_mac:"$(               : ETH daddr
 		    )"$(mac_get w2):"$(           : ETH saddr
 		    )"08:00:"$(                   : ETH type
-		    )"45:"$(                      : IP version + IHL
-		    )"$inner_tos:"$(              : IP TOS
-		    )"00:54:"$(                   : IP total length
-		    )"99:83:"$(                   : IP identification
-		    )"40:00:"$(                   : IP flags + frag off
-		    )"40:"$(                      : IP TTL
-		    )"01:"$(                      : IP proto
-		    )"00:00:"$(                   : IP header csum
-		    )"c0:00:02:03:"$(             : IP saddr: 192.0.2.3
-		    )"c0:00:02:01:"$(             : IP daddr: 192.0.2.1
+		    )"$ipv4hdr:"$(                : IPv4 header
 		    )"08:"$(                      : ICMP type
 		    )"00:"$(                      : ICMP code
 		    )"8b:f2:"$(                   : ICMP csum
-- 
2.43.0

[PATCH 2/3] selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled

[Aleksei Oladko]

The test generates VXLAN traffic using mausezahn, where the encapsulated
inner IPv6 packet has an incorrect payload length set in the IPv6 header.
After VXLAN decapsulation, such packets do not pass sanity checks in
br_netfilter and are dropped, which causes the test to fail.

Fix this by setting the correct IPv6 payload length for the encapsulated
packet generated by mausezahn, so that the packet is accepted
by br_netfilter.

tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
lines 698-706

              )"00:03:"$(           : Payload length
              )"3a:"$(              : Next header
              )"04:"$(              : Hop limit
              )"$saddr:"$(          : IP saddr
              )"$daddr:"$(          : IP daddr
              )"80:"$(              : ICMPv6.type
              )"00:"$(              : ICMPv6.code
              )"00:"$(              : ICMPv6.checksum
              )

Data after IPv6 header:
• 80: — 1 byte (ICMPv6 type)
• 00: — 1 byte (ICMPv6 code)
• 00: — 1 byte (ICMPv6 checksum, truncated)

Total: 3 bytes → 00:03 is correct. The old value 00:08 did not match
the actual payload size.

Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
---
 tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
index a603f7b0a08f..e642feeada0e 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
@@ -695,7 +695,7 @@ vxlan_encapped_ping_do()
 		    )"6"$(			  : IP version
 		    )"$inner_tos"$(               : Traffic class
 		    )"0:00:00:"$(                 : Flow label
-		    )"00:08:"$(                   : Payload length
+		    )"00:03:"$(                   : Payload length
 		    )"3a:"$(                      : Next header
 		    )"04:"$(                      : Hop limit
 		    )"$saddr:"$(		  : IP saddr
-- 
2.43.0

[PATCH 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Aleksei Oladko]

The tests use the tc pedit action to modify the IPv4 source address
("pedit ex munge ip src set"), but the IP header checksum is not
recalculated after the modification. As a result, the modified packet
fails sanity checks in br_netfilter after bridging and is dropped,
which causes the test to fail.

Fix this by adding an explicit checksum recalculation using the
"csum ip" action, so the modified packet contains a valid IPv4
checksum.

Note on IPv6:
  The tests in pedit_ip.sh also cover IPv6 (test_ip6_src, test_ip6_dst).
  The csum ip action is harmless for IPv6 packets since IPv6 has no
  header checksum — it will be a no-op.

Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
---
 tools/testing/selftests/net/forwarding/pedit_dsfield.sh | 5 +++--
 tools/testing/selftests/net/forwarding/pedit_ip.sh      | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
index af008fbf2725..310f96fb2274 100755
--- a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
+++ b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
@@ -156,7 +156,7 @@ do_test_pedit_dsfield()
 	local daddr=$1; shift
 
 	tc filter add $pedit_locus handle 101 pref 1 \
-	   flower action pedit ex munge $pedit_action
+	   flower action pedit ex munge $pedit_action pipe action csum ip
 	tc filter add dev $h2 ingress handle 101 pref 1 prot $match_prot \
 	   flower skip_hw $match_flower action pass
 
@@ -229,7 +229,8 @@ do_test_ip_dscp_ecn()
 
 	tc filter add $locus handle 101 pref 1				\
 	   flower action pedit ex munge ip dsfield set 124 retain 0xfc	\
-		  action pedit ex munge ip dsfield set 1 retain 0x03
+		  action pedit ex munge ip dsfield set 1 retain 0x03	\
+		  pipe action csum ip
 	tc filter add dev $h2 ingress handle 101 pref 1 prot ip		\
 	   flower skip_hw ip_tos 125 action pass
 
diff --git a/tools/testing/selftests/net/forwarding/pedit_ip.sh b/tools/testing/selftests/net/forwarding/pedit_ip.sh
index d14efb2d23b2..a53ee3b1ef67 100755
--- a/tools/testing/selftests/net/forwarding/pedit_ip.sh
+++ b/tools/testing/selftests/net/forwarding/pedit_ip.sh
@@ -122,7 +122,7 @@ do_test_pedit_ip()
 	local mz_flags=$1; shift
 
 	tc filter add $pedit_locus handle 101 pref 1 \
-	   flower action pedit ex munge $pedit_action
+	   flower action pedit ex munge $pedit_action pipe action csum ip
 	tc filter add dev $h2 ingress handle 101 pref 1 prot $match_prot \
 	   flower skip_hw $match_flower action pass
 
-- 
2.43.0

Re: [PATCH 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Jakub Kicinski]

On Tue, 10 Feb 2026 18:51:29 +0000 Aleksei Oladko wrote:
> The tests use the tc pedit action to modify the IPv4 source address
> ("pedit ex munge ip src set"), but the IP header checksum is not
> recalculated after the modification. As a result, the modified packet
> fails sanity checks in br_netfilter after bridging and is dropped,
> which causes the test to fail.
> 
> Fix this by adding an explicit checksum recalculation using the
> "csum ip" action, so the modified packet contains a valid IPv4
> checksum.
> 
> Note on IPv6:
>   The tests in pedit_ip.sh also cover IPv6 (test_ip6_src, test_ip6_dst).
>   The csum ip action is harmless for IPv6 packets since IPv6 has no
>   header checksum — it will be a no-op.

I think this makes the test fail for us:

make: Entering directory '/srv/vmksft/testing/wt-3/tools/testing/selftests'
make[1]: Nothing to be done for 'all'.
TAP version 13
1..1
# timeout set to 10800
# selftests: net/forwarding: pedit_ip.sh
# 6.13 [+6.13] TEST: ping                                                          [ OK ]
# 7.09 [+0.97] TEST: ping6                                                         [ OK ]
# 7.12 [+0.02] Error: Failed to load TC action module.
# 7.12 [+0.00] We have an error talking to the kernel
# 8.36 [+1.24] TEST: dev veth1 ingress pedit ip src set 198.51.100.1               [FAIL]
# 8.36 [+0.01] Expected to get 10 packets, but got 0.
# 8.37 [+0.01] Error: Cannot find specified filter chain.
# 8.38 [+0.00] We have an error talking to the kernel
# 8.39 [+0.01] Error: Failed to load TC action module.
# 8.39 [+0.00] We have an error talking to the kernel
# 9.63 [+1.24] TEST: dev veth2 egress pedit ip src set 198.51.100.1                [FAIL]
# 9.63 [+0.01] Expected to get 10 packets, but got 0.
# 9.64 [+0.00] Error: Cannot find specified filter chain.
# 9.64 [+0.00] We have an error talking to the kernel
# 9.65 [+0.01] Error: Failed to load TC action module.
# 9.65 [+0.00] We have an error talking to the kernel
# 10.89 [+1.24] TEST: dev veth1 ingress pedit ip dst set 198.51.100.1               [FAIL]
# 10.89 [+0.00] Expected to get 10 packets, but got 0.
# 10.90 [+0.01] Error: Cannot find specified filter chain.
# 10.91 [+0.00] We have an error talking to the kernel
# 10.91 [+0.01] Error: Failed to load TC action module.
# 10.91 [+0.00] We have an error talking to the kernel
# 12.14 [+1.23] TEST: dev veth2 egress pedit ip dst set 198.51.100.1                [FAIL]
# 12.15 [+0.01] Expected to get 10 packets, but got 0.
# 12.15 [+0.00] Error: Cannot find specified filter chain.
# 12.16 [+0.00] We have an error talking to the kernel
# 12.17 [+0.01] Error: Failed to load TC action module.
# 12.17 [+0.00] We have an error talking to the kernel
# 13.42 [+1.24] TEST: dev veth1 ingress pedit ip6 src set 2001:db8:2::1             [FAIL]
# 13.42 [+0.00] Expected to get 10 packets, but got 0.
# 13.43 [+0.01] Error: Cannot find specified filter chain.
# 13.43 [+0.00] We have an error talking to the kernel
# 13.45 [+0.01] Error: Failed to load TC action module.
# 13.45 [+0.00] We have an error talking to the kernel
# 14.69 [+1.24] TEST: dev veth2 egress pedit ip6 src set 2001:db8:2::1              [FAIL]
# 14.69 [+0.00] Expected to get 10 packets, but got 0.
# 14.70 [+0.00] Error: Cannot find specified filter chain.
# 14.70 [+0.00] We have an error talking to the kernel
# 14.71 [+0.01] Error: Failed to load TC action module.
# 14.72 [+0.00] We have an error talking to the kernel
# 15.96 [+1.24] TEST: dev veth1 ingress pedit ip6 dst set 2001:db8:2::1             [FAIL]
# 15.96 [+0.00] Expected to get 10 packets, but got 0.
# 15.97 [+0.01] Error: Cannot find specified filter chain.
# 15.97 [+0.00] We have an error talking to the kernel
# 15.99 [+0.01] Error: Failed to load TC action module.
# 15.99 [+0.00] We have an error talking to the kernel
# 17.23 [+1.24] TEST: dev veth2 egress pedit ip6 dst set 2001:db8:2::1              [FAIL]
# 17.23 [+0.01] Expected to get 10 packets, but got 0.
# 17.24 [+0.00] Error: Cannot find specified filter chain.
# 17.24 [+0.00] We have an error talking to the kernel
not ok 1 selftests: net/forwarding: pedit_ip.sh # exit=1


https://netdev-ctrl.bots.linux.dev/logs/vmksft/forwarding/results/512621/80-pedit-ip-sh/stdout

I could be wrong, kernel.org is having a DNS outage so our CI is a bit
unstable.
-- 
pw-bot: cr

Re: [PATCH 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Ido Schimmel]

On Tue, Feb 10, 2026 at 06:51:29PM +0000, Aleksei Oladko wrote:
> The tests use the tc pedit action to modify the IPv4 source address
> ("pedit ex munge ip src set"), but the IP header checksum is not
> recalculated after the modification. As a result, the modified packet
> fails sanity checks in br_netfilter after bridging and is dropped,
> which causes the test to fail.
> 
> Fix this by adding an explicit checksum recalculation using the
> "csum ip" action, so the modified packet contains a valid IPv4
> checksum.
> 
> Note on IPv6:
>   The tests in pedit_ip.sh also cover IPv6 (test_ip6_src, test_ip6_dst).
>   The csum ip action is harmless for IPv6 packets since IPv6 has no
>   header checksum — it will be a no-op.
> 
> Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
> ---
>  tools/testing/selftests/net/forwarding/pedit_dsfield.sh | 5 +++--
>  tools/testing/selftests/net/forwarding/pedit_ip.sh      | 2 +-
>  2 files changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
> index af008fbf2725..310f96fb2274 100755
> --- a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
> +++ b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
> @@ -156,7 +156,7 @@ do_test_pedit_dsfield()
>  	local daddr=$1; shift
>  
>  	tc filter add $pedit_locus handle 101 pref 1 \
> -	   flower action pedit ex munge $pedit_action
> +	   flower action pedit ex munge $pedit_action pipe action csum ip

I believe that this is going to be a problem when running the test over
a device that does not support "action csum" offload.

Can you instead set "net.bridge.bridge-nf-call-iptables" to "0"
(assuming it exists) and restore its original value at the end?

>  	tc filter add dev $h2 ingress handle 101 pref 1 prot $match_prot \
>  	   flower skip_hw $match_flower action pass
>  
> @@ -229,7 +229,8 @@ do_test_ip_dscp_ecn()
>  
>  	tc filter add $locus handle 101 pref 1				\
>  	   flower action pedit ex munge ip dsfield set 124 retain 0xfc	\
> -		  action pedit ex munge ip dsfield set 1 retain 0x03
> +		  action pedit ex munge ip dsfield set 1 retain 0x03	\
> +		  pipe action csum ip
>  	tc filter add dev $h2 ingress handle 101 pref 1 prot ip		\
>  	   flower skip_hw ip_tos 125 action pass
>  
> diff --git a/tools/testing/selftests/net/forwarding/pedit_ip.sh b/tools/testing/selftests/net/forwarding/pedit_ip.sh
> index d14efb2d23b2..a53ee3b1ef67 100755
> --- a/tools/testing/selftests/net/forwarding/pedit_ip.sh
> +++ b/tools/testing/selftests/net/forwarding/pedit_ip.sh
> @@ -122,7 +122,7 @@ do_test_pedit_ip()
>  	local mz_flags=$1; shift
>  
>  	tc filter add $pedit_locus handle 101 pref 1 \
> -	   flower action pedit ex munge $pedit_action
> +	   flower action pedit ex munge $pedit_action pipe action csum ip
>  	tc filter add dev $h2 ingress handle 101 pref 1 prot $match_prot \
>  	   flower skip_hw $match_flower action pass
>  
> -- 
> 2.43.0
> 

Re: [PATCH 1/3] selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled

[Ido Schimmel]

On Tue, Feb 10, 2026 at 06:51:27PM +0000, Aleksei Oladko wrote:
> The test generates VXLAN traffic using mausezahn, where the encapsulated
> inner IPv4 packet contains a zero IP header checksum. After VXLAN
> decapsulation, such packets do not pass sanity checks in br_netfilter
> and are dropped, which causes the test to fail.
> 
> Fix this by calculating and setting a valid IPv4 header checksum for the
> encapsulated packet generated by mausezahn, so that the packet is accepted
> by br_netfilter.
> 
> Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>

If you are targeting this as a fix, then:

1. Use "[PATCH net]" as subject prefix. See [1].

2. Add a Fixes tag.

3. Please mention in the commit message that this is fixed by using the
payload_template_calc_checksum() / payload_template_expand_checksum()
helpers that are only available in v6.3 and newer kernels.

Patch looks good otherwise (I also tested it).

[1] https://docs.kernel.org/process/maintainer-netdev.html