fix(nrfcache): match filters reject profiles they should accept

[bgrewell]

Two related defects in nrfcache/match_filters.go. Both make cached NF discovery return empty for profiles that are valid, so the cache is structurally incapable of hitting and every lookup falls through to the NRF.

Both were found and measured against a live Aether SD-Core deployment under registration load, with a 5G SA gNB/UE simulator driving attaches.

1 — Profiles without SUPI ranges are treated as restricted

MatchUdmProfile / MatchPcfProfile / MatchAusfProfile require a cached profile to carry a non-empty SupiRanges whenever the discovery query includes a supi; a profile with no ranges is rejected.

SD-Core registers one UDM/PCF serving every subscriber, with no SUPI ranges — verified on the wire, the NRF returns udmInfo:{"groupId":""}. So the match can never succeed, and the AMF logs cache miss for nftype AUSF/UDM/PCF on every attach, preceded by match found = false (no SUPI ranges).

Per TS 29.510 supiRanges is an optional restriction on an NF profile: a range constrains, and an absent constraint admits everything. The matchers now treat "no SUPI ranges" as unrestricted.

2 — No match filter is registered for UDR

matchFilters has no NFTYPE_UDR entry, and nrfcache.go silently drops any profile whose NfType has no filter. Cached UDR discovery therefore always returns empty — a permanent miss — after which the EnableNrfCaching && empty fallback fires a second, direct NRF query. The UDM performs several UDR discoveries per registration, so this sits on the attach hot path.

Measured effect

Registering the UDR filter took the test deployment from 22 to ~185 registrations/s (stable across 5 runs, 173–189/s, 100% success), registration P50 400 ms → 256 ms, and MongoDB operations per attach 50 → 25 as NfProfile and urilist queries left the hot path. The SUPI-range fix removes the remaining per-attach AUSF/UDM/PCF misses (4 → 0 observed).

Testing

Regression tests added for both defects; each fails without its fix. go test ./nrfcache/ passes.

Validated live by building the consuming NFs (AMF, UDM) against this branch with a go mod edit -replace and re-measuring on the deployment.

The two changes share nrfcache_test.go and the second builds on the first, hence one PR; happy to split if preferred.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

nrfcache/match_filters.go:289

• The inline reference to nrf producer/nf_discovery.go / [Query-18] appears to point to a file/query that does not exist in this repository, which makes the rationale hard to verify/maintain from this codebase. Consider rewording the comment to describe the behavior without referencing an external path/query label.

		// A profile declaring no SUPI ranges is unrestricted and serves every
		// SUPI. The NRF's own discovery filter encodes this as an $or over
		// "a range contains the SUPI" / "supiRanges is null" / "supiRanges is
		// absent" (nrf producer/nf_discovery.go, [Query-18] supi). Rationale:
		// the cache must select the same profiles as the NRF it caches,
		// otherwise a cached lookup and a live discovery disagree.