Incorrect response to invalid PFCP Session Establishment Request

[yoursunny]

I'm testing free5GC UPF (Docker image free5gc/upf:v3.4.4) with Open5GCore SMF (commercial software, v7.4.3).
I found that when the free5GC UPF receives an invalid PFCP Session Establishment Request, it would log an error to the console, but still responds with PFCP Session Establishment Response with "Cause: Request accepted(success)".

Packet Trace analysis

In the packet trace, frame 37 is the offending packet.
Its Wireshark analysis is:

Packet Forwarding Control Protocol
    Flags: 0x21, SEID (S)
    Message Type: PFCP Session Establishment Request (50)
    Length: 263
    SEID: 0x0000000000000000
    Sequence Number: 3
    Spare: 0
    Node ID : IPv4 address: 172.25.194.12
    F-SEID : SEID: 0x0000000101000001, IPv4 172.25.194.12
    Create PDR : [Grouped IE]: PDR ID: 1110
        IE Type: Create PDR (1)
        IE Length: 62
        PDR ID : 1110
        Precedence : 255
        PDI : [Grouped IE]
        Outer Header Removal : GTP-U/UDP/IPv4
        FAR ID : Dynamic by CP 110
        QER ID : Dynamic by CP 1110
    Create PDR : [Grouped IE]: PDR ID: 1010
        IE Type: Create PDR (1)
        IE Length: 66
        PDR ID : 1010
        Precedence : 255
        PDI : [Grouped IE]
        FAR ID : Dynamic by CP 10
        QER ID : Dynamic by CP 1010
    Create FAR : [Grouped IE]: FAR ID: Dynamic by CP 110
    Create QER : [Grouped IE]: QER ID: Dynamic by CP 1110
    Create QER : [Grouped IE]: QER ID: Dynamic by CP 1010
    Create BAR : [Grouped IE]: BAR ID: 1
    PDN Type : IPv4
    [Response In: 65]

Notably, the second CreatePDR IE in the Session Establishment Request refers to "FAR ID : Dynamic by CP 10" that does not exist in this session.
(SMF would create "FAR ID : Dynamic by CP 10" in a Session Modification Request later, but I believe this is disallowed.)

Upon receiving this PFCP Session Establishment Request, free5GC UPF logs the following to the console:

2024-11-15T14:00:15.877582736Z [INFO][UPF][PFCP][LAddr:172.25.194.5:8805] handleSessionEstablishmentRequest
2024-11-15T14:00:15.877629244Z [INFO][UPF][PFCP][LAddr:172.25.194.5:8805][CPNodeID:172.25.194.12][CPSEID:0x101000001][UPSEID:0x1] New session
2024-11-15T14:00:15.878263526Z [ERRO][UPF][PFCP][LAddr:172.25.194.5:8805][CPNodeID:172.25.194.12][CPSEID:0x101000001][UPSEID:0x1] Est CreatePDR error: invalid argument

The "invalid argument" error comes from gtp5g kernel module, due to gtp5g PR 118.
The request is not applied in gtp5g.
After that, free5GC UPF responds with PFCP Session Establishment Response with "Cause: Request accepted(success)", as seen in frame 38 of the packet trace.

Specification Reference

As stated in TS 129 244 V16.4.0 section 6.3.2.3:

When the UP function receives a PFCP Session Establishment Request message it shall:

• store and apply the rules received in the request and send a PFCP Session Establishment Response with cause
  "success", if all rules in the PFCP Session Establishment Request are stored and applied;
• Otherwise, if at least one rule failed to be stored or applied, return an appropriate error cause value with the Rule
  ID of the Rule causing the first error, discard all the received rules and not create any PFCP session context.

This means, when free5GC UPF cannot accept this PFCP Session Establishment Request, it must respond with a Cause value that is not "success".
It is incorrect for free5GC UPF to respond "success" when it cannot accept the request.