[PATCH net v2 0/3] selftests: forwarding: fix br_netfilter related test failures

[PATCH net v2 0/3] selftests: forwarding: fix br_netfilter related test failures

[Aleksei Oladko]

Hello

This patch series fixes kselftests that fail when the br_nefilter
module is loaded. The failures occur because the tests generate
packets that are either modified or encapsulated, but their IP
headers are not fully correct for sanity checks performed by
be_netfilter.

Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>

Changes in v2:
- Changed the fix for pedit tests from adding 'action csum' to disabling
  br_netfilter via sytsctl
- Mentioned in the commit message that the fix vxlan_bridge_1d utilizes
  helpers available since v6.3 kernel.
- Updated subject prefix to include 'net'.
- Added a Fixes: tag to the appropriate commit as requested
- Link to v1: https://lore.kernel.org/linux-kselftest/20260210185129.480015-1-aleksey.oladko@virtuozzo.com/T/#t
---
Aleksei Oladko (3):
  selftests: forwarding: vxlan_bridge_1d: fix test failure with
    br_netfilter enabled
  selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with
    br_netfilter enabled
  selftests: forwarding: fix pedit tests failure with br_netfilter
    enabled

 .../selftests/net/forwarding/pedit_dsfield.sh |  8 ++++++
 .../selftests/net/forwarding/pedit_ip.sh      |  8 ++++++
 .../net/forwarding/vxlan_bridge_1d.sh         | 26 ++++++++++++-------
 .../net/forwarding/vxlan_bridge_1d_ipv6.sh    |  2 +-
 4 files changed, 33 insertions(+), 11 deletions(-)

-- 
2.43.0

[PATCH net v2 1/3] selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled

[Aleksei Oladko]

The test generates VXLAN traffic using mausezahn, where the encapsulated
inner IPv4 packet contains a zero IP header checksum. After VXLAN
decapsulation, such packets do not pass sanity checks in br_netfilter
and are dropped, which causes the test to fail.

Fix this by calculating and setting a valid IPv4 header checksum for the
encapsulated packet generated by mausezahn, so that the packet is accepted
by br_netfilter. Fixed by using the payload_template_calc_checksum() /
payload_template_expand_checksum() helpers that are only available
in v6.3 and newer kernels.

Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test")
Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
---
 .../net/forwarding/vxlan_bridge_1d.sh         | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
index b43816dd998c..457f41d5e584 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
@@ -567,6 +567,21 @@ vxlan_encapped_ping_do()
 	local inner_tos=$1; shift
 	local outer_tos=$1; shift
 
+	local ipv4hdr=$(:
+		    )"45:"$(                      : IP version + IHL
+		    )"$inner_tos:"$(              : IP TOS
+		    )"00:54:"$(                   : IP total length
+		    )"99:83:"$(                   : IP identification
+		    )"40:00:"$(                   : IP flags + frag off
+		    )"40:"$(                      : IP TTL
+		    )"01:"$(                      : IP proto
+		    )"CHECKSUM:"$(                : IP header csum
+		    )"c0:00:02:03:"$(             : IP saddr: 192.0.2.3
+		    )"c0:00:02:01"$(              : IP daddr: 192.0.2.1
+		)
+	local checksum=$(payload_template_calc_checksum "$ipv4hdr")
+	ipv4hdr=$(payload_template_expand_checksum "$ipv4hdr" $checksum)
+
 	$MZ $dev -c $count -d 100msec -q \
 		-b $next_hop_mac -B $dest_ip \
 		-t udp tos=$outer_tos,sp=23456,dp=$VXPORT,p=$(:
@@ -577,16 +592,7 @@ vxlan_encapped_ping_do()
 		    )"$dest_mac:"$(               : ETH daddr
 		    )"$(mac_get w2):"$(           : ETH saddr
 		    )"08:00:"$(                   : ETH type
-		    )"45:"$(                      : IP version + IHL
-		    )"$inner_tos:"$(              : IP TOS
-		    )"00:54:"$(                   : IP total length
-		    )"99:83:"$(                   : IP identification
-		    )"40:00:"$(                   : IP flags + frag off
-		    )"40:"$(                      : IP TTL
-		    )"01:"$(                      : IP proto
-		    )"00:00:"$(                   : IP header csum
-		    )"c0:00:02:03:"$(             : IP saddr: 192.0.2.3
-		    )"c0:00:02:01:"$(             : IP daddr: 192.0.2.1
+		    )"$ipv4hdr:"$(                : IPv4 header
 		    )"08:"$(                      : ICMP type
 		    )"00:"$(                      : ICMP code
 		    )"8b:f2:"$(                   : ICMP csum
-- 
2.43.0

Re: [PATCH net v2 1/3] selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled

[Ido Schimmel]

On Fri, Feb 13, 2026 at 01:19:05PM +0000, Aleksei Oladko wrote:
> The test generates VXLAN traffic using mausezahn, where the encapsulated
> inner IPv4 packet contains a zero IP header checksum. After VXLAN
> decapsulation, such packets do not pass sanity checks in br_netfilter
> and are dropped, which causes the test to fail.
> 
> Fix this by calculating and setting a valid IPv4 header checksum for the
> encapsulated packet generated by mausezahn, so that the packet is accepted
> by br_netfilter. Fixed by using the payload_template_calc_checksum() /
> payload_template_expand_checksum() helpers that are only available
> in v6.3 and newer kernels.
> 
> Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test")
> Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

[PATCH net v2 2/3] selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled

[Aleksei Oladko]

The test generates VXLAN traffic using mausezahn, where the encapsulated
inner IPv6 packet has an incorrect payload length set in the IPv6 header.
After VXLAN decapsulation, such packets do not pass sanity checks in
br_netfilter and are dropped, which causes the test to fail.

Fix this by setting the correct IPv6 payload length for the encapsulated
packet generated by mausezahn, so that the packet is accepted
by br_netfilter.

tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
lines 698-706

              )"00:03:"$(           : Payload length
              )"3a:"$(              : Next header
              )"04:"$(              : Hop limit
              )"$saddr:"$(          : IP saddr
              )"$daddr:"$(          : IP daddr
              )"80:"$(              : ICMPv6.type
              )"00:"$(              : ICMPv6.code
              )"00:"$(              : ICMPv6.checksum
              )

Data after IPv6 header:
• 80: — 1 byte (ICMPv6 type)
• 00: — 1 byte (ICMPv6 code)
• 00: — 1 byte (ICMPv6 checksum, truncated)

Total: 3 bytes → 00:03 is correct. The old value 00:08 did not match
the actual payload size.

Fixes: b07e9957f220 ("selftests: forwarding: Add VxLAN tests with a VLAN-unaware bridge for IPv6")
Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
---
 tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
index a603f7b0a08f..e642feeada0e 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
@@ -695,7 +695,7 @@ vxlan_encapped_ping_do()
 		    )"6"$(			  : IP version
 		    )"$inner_tos"$(               : Traffic class
 		    )"0:00:00:"$(                 : Flow label
-		    )"00:08:"$(                   : Payload length
+		    )"00:03:"$(                   : Payload length
 		    )"3a:"$(                      : Next header
 		    )"04:"$(                      : Hop limit
 		    )"$saddr:"$(		  : IP saddr
-- 
2.43.0

Re: [PATCH net v2 2/3] selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled

[Ido Schimmel]

On Fri, Feb 13, 2026 at 01:19:06PM +0000, Aleksei Oladko wrote:
> The test generates VXLAN traffic using mausezahn, where the encapsulated
> inner IPv6 packet has an incorrect payload length set in the IPv6 header.
> After VXLAN decapsulation, such packets do not pass sanity checks in
> br_netfilter and are dropped, which causes the test to fail.
> 
> Fix this by setting the correct IPv6 payload length for the encapsulated
> packet generated by mausezahn, so that the packet is accepted
> by br_netfilter.
> 
> tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
> lines 698-706
> 
>               )"00:03:"$(           : Payload length
>               )"3a:"$(              : Next header
>               )"04:"$(              : Hop limit
>               )"$saddr:"$(          : IP saddr
>               )"$daddr:"$(          : IP daddr
>               )"80:"$(              : ICMPv6.type
>               )"00:"$(              : ICMPv6.code
>               )"00:"$(              : ICMPv6.checksum
>               )
> 
> Data after IPv6 header:
> • 80: — 1 byte (ICMPv6 type)
> • 00: — 1 byte (ICMPv6 code)
> • 00: — 1 byte (ICMPv6 checksum, truncated)
> 
> Total: 3 bytes → 00:03 is correct. The old value 00:08 did not match
> the actual payload size.
> 
> Fixes: b07e9957f220 ("selftests: forwarding: Add VxLAN tests with a VLAN-unaware bridge for IPv6")
> Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

[PATCH net v2 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Aleksei Oladko]

The tests use the tc pedit action to modify the IPv4 source address
("pedit ex munge ip src set"), but the IP header checksum is not
recalculated after the modification. As a result, the modified packet
fails sanity checks in br_netfilter after bridging and is dropped,
which causes the test to fail.

Fix this by ensuring net.bridge.bridge-nf-call-iptables is set to 0
during the test execution. This prevents the bridge from passing
L2 traffic to netfilter, bypasing the checksum validation that
causes the test failure.

Fixes: 92ad3828944e ("selftests: forwarding: Add a test for pedit munge SIP and DIP")
Fixes: 226657ba2389 ("selftests: forwarding: Add a forwarding test for pedit munge dsfield")
Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
---
 tools/testing/selftests/net/forwarding/pedit_dsfield.sh | 8 ++++++++
 tools/testing/selftests/net/forwarding/pedit_ip.sh      | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
index af008fbf2725..eb2d8034de9c 100755
--- a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
+++ b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
@@ -98,12 +98,20 @@ setup_prepare()
 	h1_create
 	h2_create
 	switch_create
+
+	if [ -f /proc/sys/net/bridge/bridge-nf-call-iptables ]; then
+		sysctl_set net.bridge.bridge-nf-call-iptables 0
+	fi
 }
 
 cleanup()
 {
 	pre_cleanup
 
+	if [ -f /proc/sys/net/bridge/bridge-nf-call-iptables ]; then
+		sysctl_restore net.bridge.bridge-nf-call-iptables
+	fi
+
 	switch_destroy
 	h2_destroy
 	h1_destroy
diff --git a/tools/testing/selftests/net/forwarding/pedit_ip.sh b/tools/testing/selftests/net/forwarding/pedit_ip.sh
index d14efb2d23b2..9235674627ab 100755
--- a/tools/testing/selftests/net/forwarding/pedit_ip.sh
+++ b/tools/testing/selftests/net/forwarding/pedit_ip.sh
@@ -91,12 +91,20 @@ setup_prepare()
 	h1_create
 	h2_create
 	switch_create
+
+	if [ -f /proc/sys/net/bridge/bridge-nf-call-iptables ]; then
+		sysctl_set net.bridge.bridge-nf-call-iptables 0
+	fi
 }
 
 cleanup()
 {
 	pre_cleanup
 
+	if [ -f /proc/sys/net/bridge/bridge-nf-call-iptables ]; then
+		sysctl_restore net.bridge.bridge-nf-call-iptables
+	fi
+
 	switch_destroy
 	h2_destroy
 	h1_destroy
-- 
2.43.0

Re: [PATCH net v2 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Ido Schimmel]

On Fri, Feb 13, 2026 at 01:19:07PM +0000, Aleksei Oladko wrote:
> The tests use the tc pedit action to modify the IPv4 source address
> ("pedit ex munge ip src set"), but the IP header checksum is not
> recalculated after the modification. As a result, the modified packet
> fails sanity checks in br_netfilter after bridging and is dropped,
> which causes the test to fail.
> 
> Fix this by ensuring net.bridge.bridge-nf-call-iptables is set to 0
> during the test execution. This prevents the bridge from passing
> L2 traffic to netfilter, bypasing the checksum validation that

s/bypasing/bypassing/

> causes the test failure.
> 
> Fixes: 92ad3828944e ("selftests: forwarding: Add a test for pedit munge SIP and DIP")
> Fixes: 226657ba2389 ("selftests: forwarding: Add a forwarding test for pedit munge dsfield")
> Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH net v2 3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled

[Paolo Abeni]

On 2/15/26 10:45 AM, Ido Schimmel wrote:
> On Fri, Feb 13, 2026 at 01:19:07PM +0000, Aleksei Oladko wrote:
>> The tests use the tc pedit action to modify the IPv4 source address
>> ("pedit ex munge ip src set"), but the IP header checksum is not
>> recalculated after the modification. As a result, the modified packet
>> fails sanity checks in br_netfilter after bridging and is dropped,
>> which causes the test to fail.
>>
>> Fix this by ensuring net.bridge.bridge-nf-call-iptables is set to 0
>> during the test execution. This prevents the bridge from passing
>> L2 traffic to netfilter, bypasing the checksum validation that
> 
> s/bypasing/bypassing/

No need to resubmit, I'll fix it while applying.

/P

Re: [PATCH net v2 0/3] selftests: forwarding: fix br_netfilter related test failures

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 13 Feb 2026 13:19:04 +0000 you wrote:
> Hello
> 
> This patch series fixes kselftests that fail when the br_nefilter
> module is loaded. The failures occur because the tests generate
> packets that are either modified or encapsulated, but their IP
> headers are not fully correct for sanity checks performed by
> be_netfilter.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/3] selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled
    https://git.kernel.org/netdev/net/c/02cb2e6bacbb
  - [net,v2,2/3] selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled
    https://git.kernel.org/netdev/net/c/ce9f6aec0fb7
  - [net,v2,3/3] selftests: forwarding: fix pedit tests failure with br_netfilter enabled
    https://git.kernel.org/netdev/net/c/a8c198d16c64

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html