PFCP Session Establishment Response: UE IP Address field should not be present when CP allocates UE IP address

[yoursunny]

I'm testing free5GC UPF with OAI-CN5G-SMF and noticed that the PFCP Session Establishment Response is encoded incorrectly.
According to TS 129 244:

• Section 7.5.3.2 Created PDR IE within PFCP Session Establishment Response:
  • UE IP Address IE is conditional.
  • If the UP function allocates the UE IP address/prefix, this IE shall be present and shall contain the UE IP address/prefix assigned by the UP function.
• Section 5.21 UE IP address/prefix Allocation and Release:
  • A UE IPv4 address or IPv6 prefix may be allocated by the CP function or the UP function.
  • The UP function shall set the UEIP feature flag in the UP Function Features IE if it supports UE IP address/prefix
    allocation in the UP function (see clause 8.2.25).
• note: free5gc/free5gc indicates that free5GC implements 3GPP R15, but I quoted R16 specs, which is the earliest version that contains UE IP Address IE in the Created PDR IE.

However, free5GC UPF is still including UE IP Address IE in the Created PDR IE, despite that the UE IPv4 address has been allocated by the CP function.

Packet trace: free5gc-ueip.pcapng.gz

In frame 5 PFCP Session Establishment Request, the PDI field includes UE IPv4 address allocated by the CP function:

Create PDR : [Grouped IE]: PDR ID: 1
    IE Type: Create PDR (1)
    IE Length: 124
    PDR ID : 1
    Precedence : 0
    PDI : [Grouped IE]
        IE Type: PDI (2)
        IE Length: 93
        Source Interface : Access
        F-TEID : TEID: 0x00000002, IPv4 172.25.195.5
        Network Instance : access.oai.org
        UE IP Address : 
            IE Type: UE IP Address (93)
            IE Length: 5
            0... .... = Spare: 0
            .0.. .... = IPV6PL: Source IP address
            ..0. .... = CHV6: Source IP address
            ...0 .... = CHV4: Source IP address
            .... 0... = IPv6D: Source IP address
            .... .0.. = S/D: Source IP address
            .... ..1. = V4 (IPv4): Present
            .... ...0 = V6 (IPv6): Not Present
            IPv4 address: 10.1.0.2
        SDF Filter : 
        QFI : 
    Outer Header Removal : GTP-U/UDP/IPv4
    FAR ID : Dynamic by CP 1

In frame 6 PFCP Session Establishment Response, the Created PDR IE contains erroneous UE IP Address IE:

Created PDR : [Grouped IE]: PDR ID: 1
    IE Type: Created PDR (8)
    IE Length: 15
    PDR ID : 1
    UE IP Address : 
        IE Type: UE IP Address (93)
        IE Length: 5
        0... .... = Spare: 0
        .0.. .... = IPV6PL: Source IP address
        ..0. .... = CHV6: Source IP address
        ...0 .... = CHV4: Source IP address
        .... 0... = IPv6D: Source IP address
        .... .0.. = S/D: Source IP address
        .... ..1. = V4 (IPv4): Present
        .... ...0 = V6 (IPv6): Not Present
        IPv4 address: 10.1.0.2

This bug was introduced in #58.

The improper PFCP Session Establishment Response message subsequently causes OAI-CN5G-SMF to log the error below, and therefore makes free5GC UPF incompatible with OAI-CN5G-SMF:

[2024-12-12 19:08:29.684] [smf_n4 ] [info] handle_receive(66 bytes)
[2024-12-12 19:08:29.684] [smf_n4 ] [debug] handle_receive_pfcp_msg msg type 51 length 62
[2024-12-12 19:08:29.684] [smf_n4 ] [info] handle_receive exception PFCP msg 0 Illegal IE 93 Exception /openair-smf/src/pfcp/msg_pfcp.hpp:939
[2024-12-12 19:08:29.913] [smf_n4 ] [info] TIME-OUT event timer id 18