Re: [PATCH 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Feb 10, 2026 at 06:51:29PM +0000, Aleksei Oladko wrote:
> The tests use the tc pedit action to modify the IPv4 source address
> ("pedit ex munge ip src set"), but the IP header checksum is not
> recalculated after the modification. As a result, the modified packet
> fails sanity checks in br_netfilter after bridging and is dropped,
> which causes the test to fail.
> 
> Fix this by adding an explicit checksum recalculation using the
> "csum ip" action, so the modified packet contains a valid IPv4
> checksum.
> 
> Note on IPv6:
>   The tests in pedit_ip.sh also cover IPv6 (test_ip6_src, test_ip6_dst).
>   The csum ip action is harmless for IPv6 packets since IPv6 has no
>   header checksum — it will be a no-op.
> 
> Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
> ---
>  tools/testing/selftests/net/forwarding/pedit_dsfield.sh | 5 +++--
>  tools/testing/selftests/net/forwarding/pedit_ip.sh      | 2 +-
>  2 files changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
> index af008fbf2725..310f96fb2274 100755
> --- a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
> +++ b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
> @@ -156,7 +156,7 @@ do_test_pedit_dsfield()
>  	local daddr=$1; shift
>  
>  	tc filter add $pedit_locus handle 101 pref 1 \
> -	   flower action pedit ex munge $pedit_action
> +	   flower action pedit ex munge $pedit_action pipe action csum ip

I believe that this is going to be a problem when running the test over
a device that does not support "action csum" offload.

Can you instead set "net.bridge.bridge-nf-call-iptables" to "0"
(assuming it exists) and restore its original value at the end?

>  	tc filter add dev $h2 ingress handle 101 pref 1 prot $match_prot \
>  	   flower skip_hw $match_flower action pass
>  
> @@ -229,7 +229,8 @@ do_test_ip_dscp_ecn()
>  
>  	tc filter add $locus handle 101 pref 1				\
>  	   flower action pedit ex munge ip dsfield set 124 retain 0xfc	\
> -		  action pedit ex munge ip dsfield set 1 retain 0x03
> +		  action pedit ex munge ip dsfield set 1 retain 0x03	\
> +		  pipe action csum ip
>  	tc filter add dev $h2 ingress handle 101 pref 1 prot ip		\
>  	   flower skip_hw ip_tos 125 action pass
>  
> diff --git a/tools/testing/selftests/net/forwarding/pedit_ip.sh b/tools/testing/selftests/net/forwarding/pedit_ip.sh
> index d14efb2d23b2..a53ee3b1ef67 100755
> --- a/tools/testing/selftests/net/forwarding/pedit_ip.sh
> +++ b/tools/testing/selftests/net/forwarding/pedit_ip.sh
> @@ -122,7 +122,7 @@ do_test_pedit_ip()
>  	local mz_flags=$1; shift
>  
>  	tc filter add $pedit_locus handle 101 pref 1 \
> -	   flower action pedit ex munge $pedit_action
> +	   flower action pedit ex munge $pedit_action pipe action csum ip
>  	tc filter add dev $h2 ingress handle 101 pref 1 prot $match_prot \
>  	   flower skip_hw $match_flower action pass
>  
> -- 
> 2.43.0
>