Bump version: 0.1.1.112-9c90 → 0.2.0

Change-Id: I772edbd17fcac0da597c30eecefa54f9fd8c3ed3
osmo-upf: add VTY 'gtp-echo' command
2025-11-03 13:33:31 +00:00 · 2024-12-11 16:56:21 +01:00 · 2024-11-05 11:05:21 +01:00 · 2024-10-24 11:20:24 +00:00 · 2024-10-24 11:16:54 +00:00
13 changed files with 527 additions and 47 deletions
--- a/8
+++ b/8
@@ -1,9 +1,9 @@
 # When cleaning up this file: bump API version in corresponding Makefile.am and rename corresponding debian/lib*.install
-# according to https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html#Updating-version-info
-# In short:
+# according to https://osmocom.org/projects/cellular-infrastructure/wiki/Make_a_new_release
+# In short: https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html#Updating-version-info
 # LIBVERSION=c:r:a
 # If the library source code has changed at all since the last update, then increment revision: c:r + 1:a.
-# If any interfaces have been added, removed, or changed since the last update: c + 1:0:0.
+# If any interfaces have been added, removed, or changed since the last update: c + 1:0:a.
 # If any interfaces have been added since the last public release: c:r:a + 1.
 # If any interfaces have been removed or changed since the last public release: c:r:0.
-#library	what		description / commit summary line
+#library	what			description / commit summary line
--- a/configure.ac
+++ b/configure.ac
@@ -36,11 +36,11 @@ fi
 PKG_PROG_PKG_CONFIG([0.20])

 dnl checks for libraries
-PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 1.6.0)
-PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 1.6.0)
-PKG_CHECK_MODULES(LIBOSMOCTRL, libosmoctrl >= 1.6.0)
-PKG_CHECK_MODULES(LIBOSMOPFCP, libosmo-pfcp >= 0.1.0)
-PKG_CHECK_MODULES(LIBGTPNL, libgtpnl >= 1.2.0)
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOCTRL, libosmoctrl >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOPFCP, libosmo-pfcp >= 0.4.0)
+PKG_CHECK_MODULES(LIBGTPNL, libgtpnl >= 1.3.0)
 PKG_CHECK_MODULES(LIBNFTABLES, libnftables >= 1.0.2)

 dnl checks for header files
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,133 @@
+osmo-upf (0.2.0) unstable; urgency=medium
+
+  [ Neels Hofmeyr ]
+  * improve manual: PFCP and GTP interfaces
+  * example cfg: tweak logging
+
+  [ Oliver Smith ]
+  * osmo_pfcp_tool: fix osmo_pfcp_tool_copyright error
+  * debian: add osmo-pfcp-tool to osmo-upf package
+  * Run struct_endianness.py
+  * contrib/jenkins: build nftables without python
+  * contrib/jenkins: clone netfilter repos with https
+  * contrib/jenkins: netfilter: use PARALLEL_MAKE
+  * debian: set compat level to 10
+  * systemd: depend on networking-online.target
+  * .deb/.rpm: various fixes related to non-root
+  * contrib/systemd: AmbientCapabilities=CAP_NET_ADMIN
+  * contrib: remove rpm spec file
+  * debian/postinst: add checks, be verbose
+
+  [ Neels Janosch Hofmeyr ]
+  * Allow running without a GTP dev
+  * drop charts/, duplicated from libosmo-pfcp.git
+  * manual: add/fix running.adoc
+  * manual: add 'Configure Primary Links'
+  * vty doc: indicate default nft table name
+  * silence misleading error: "HEARTBEAT_REQ: Unknown message type"
+  * drop unused enum up_session_kind
+  * tests/upf.vty: add some missing nodes to the test
+  * VTY: rename 'gtp' to 'tunend'
+  * VTY: rename 'nft' to 'tunmap'
+  * osmo-pfcp-tool VTY: rename 'endecaps' to 'tunend'
+  * cosmetic: in code, rename 'endecaps' to 'tunend'
+  * cosmetic: rename upf_gtp_tun to upf_gtp_tunend
+  * drop unused upf_gtp_dev_is_tunnel_active()
+  * cosmetic: rename upf_gtp_dev_tunnel_* to upf_gtp_dev_tunend_*
+  * vty: revert rename of 'show gtp'
+  * VTY: show gtp: still list tunmap if no tunend device is open
+  * up_gtp_action_to_str_buf(): always print PDR IDs
+  * use osmo_pfcp_ie_outer_header_creation_to_str_buf()
+  * gtpu_echo: do not osmo_fd_register twice
+  * VTY 'show gtp': more accurately identify local/remote IP
+  * fix access/core mixup of PDR IDs / tunmap FAR
+  * clarify comments and naming around PDR+FAR classification
+  * tunmap: choose local GTP addr by Network Instance IEs
+  * log: add missing sep in far_to_str
+  * fix PFCP Session Mod: Update FAR
+  * in GTP actions, also store local GTP addrs
+  * nft: rename addr to addr_remote, add addr_local
+  * nft: incoming GTP-U: match on local IP, not remote IP
+  * nft: rewrite source IP in outgoing GTP-U
+  * nft: log nft rulesets on debug log
+  * nft: end each rule in semicolon
+  * nft: ensure to assign rule id only once
+  * GTP,UE addrs in osmo_sockaddr: assert( port == 0 )
+  * nft: allow to get the ruleset string without running
+  * vty: add: show nft-rule tunmap example
+  * add cfg: tunmap / nft-rule append
+  * nft: append 'accept' to each rule
+  * tunend: choose local GTP addr by Network Instance IEs
+  * manual: use 'tunend' and 'tunmap'
+  * manual: explain new netinst cfg
+  * manual: tweak 'running' for new netinst feature
+  * manual: add charts explaining tunend and tunmap
+  * manual: some tweaks in overview
+  * manual: fix broken reference to netinst section
+  * fix copy-paste bug in up_endpoint.c
+  * fix deprecation: use telnet_init_default()
+  * check rc of osmo_use_count_get_put()
+  * error log: fix msg for gtp_del_tunnel() failure
+  * fix various crashes on osmo_pfcp_endpoint_tx() err handling
+  * osmo-pfcp-tool: avoid stale pointers on msg copy
+  * fix some PFCP peer,session error handling paths
+  * drop unused function up_peer_tx
+  * move GTP port definitions to upf.h
+  * deprecate cfg 'nft rule tunmap append'
+  * tunmap: prep new nft ruleset: log only mapping id
+  * tunmap: refactor nft ruleset: fix "martians" and "1024"
+  * tunmap: ensure nft table is removed on program exit
+  * osmo_pfcp_tool: make usable again
+  * minor api doc
+  * cosmetic: simplify naming: struct upf_tunmap, struct upf_tunend
+  * cosmetic: reduce dup in tunnel struct definitions
+  * cosmetic: rename g_upf->gtp to tunend, ->nft to tunmap
+  * move next_teid from up_endpoint to g_upf
+  * cosmetic: rename next_seid to next_up_seid
+  * build: drop LIBOSMO_GTLV
+  * build: add libupf.la (noinst)
+  * add unique_ids_test.c
+  * tunmap: ensure assigned chain_id is unused
+  * cosmetic: clarify session active / partially active semantics
+  * unique_ids_test.c: fix coverity ASSERT_SIDE_EFFECT
+  * manual: fix typo in running.adoc
+  * manual: 'Running': flatten section depths a bit
+  * manual: 'Running': tweak, mention 'tunmap' and 'tunend'
+  * manual: 'Running': tweak word, fix ws at line end
+  * manual: explain GTP Echo workaround for tunmap
+  * manual: explain IP forwarding
+  * tunmap: always set GTP-U source port to 2152 when forwarding
+  * vty doc fix
+  * pfcp-tool: fix extra newline in vty_out
+  * fix msgb memleak on GTP echo response
+  * fix EXTRA_DIST for vty test scripts
+  * drop unreachable statement
+  * contrib/pfcp-tool-scripts: adjust tunend_session_est.vty and upf cfg to match up
+  * upf gtp-u echo: improve loging
+  * upf gtp-u echo: rx Echo Response messages
+  * pfcp-tool: always use specific PDR ids for access and core
+  * nft: batch nftables commands
+  * osmo-upf: add VTY 'gtp-echo' command
+
+  [ Max ]
+  * Set working directory in systemd service file
+  * ctrl: take both address and port from vty config
+  * .deb/.rpm: add osmocom user during package install
+
+  [ Vadim Yanitskiy ]
+  * update git URLs (git -> https; gitea)
+  * contrib/jenkins.sh: clone libnftnl and libnftables via git://
+  * copyright: fix typo: sysmocom s/s.m.f.c./s.f.m.c./ GmbH
+
+  [ arehbein ]
+  * osmo-pfcp-tool: Fix call to strerror
+  * up_session: Silence coverity warning
+
+  [ Andreas Eversberg ]
+  * Use uniform log format for default config files
+
+ -- Oliver Smith <osmith@sysmocom.de>  Wed, 11 Dec 2024 16:37:06 +0100
+
 osmo-upf (0.1.1) unstable; urgency=medium

  [ Vadim Yanitskiy ]
--- a/debian/control
+++ b/debian/control
@@ -12,10 +12,10 @@ Build-Depends: debhelper (>= 10),
               pkg-config,
               python3-minimal,
               libtalloc-dev,
-               libgtpnl-dev (>= 1.2.0),
+               libgtpnl-dev (>= 1.3.0),
               libnftables-dev (>= 1.0.2),
-               libosmocore-dev (>= 1.6.0),
-               libosmo-pfcp-dev (>= 0.1.0),
+               libosmocore-dev (>= 1.10.0),
+               libosmo-pfcp-dev (>= 0.4.0),
               osmo-gsm-manuals-dev (>= 1.2.0)
 Standards-Version: 3.9.8
 Vcs-Git: https://gitea.osmocom.org/cellular-infrastructure/osmo-upf
--- a/include/osmocom/upf/upf.h
+++ b/include/osmocom/upf/upf.h
@@ -44,6 +44,7 @@ struct nft_ctx;
 #define PORT_GTP1_U 2152

 extern struct osmo_tdef_group g_upf_tdef_groups[];
+extern struct osmo_tdef g_upf_nft_tdefs[];

 struct pfcp_vty_cfg {
 	char *local_addr;
@@ -117,6 +118,7 @@ struct g_upf {

 	struct {
 		uint32_t next_local_teid_state;
+		uint16_t next_echo_seq_nr;
 	} gtp;

 	struct llist_head netinst;
--- a/include/osmocom/upf/upf_gtpu_echo.h
+++ b/include/osmocom/upf/upf_gtpu_echo.h
@@ -2,3 +2,4 @@
 #pragma once

 int upf_gtpu_echo_setup(struct upf_gtp_dev *dev);
+int upf_gtpu_echo_req_tx(struct upf_gtp_dev *dev, const struct osmo_sockaddr *remote, uint16_t seq_nr);
--- a/src/osmo-pfcp-tool/pfcp_tool_vty.c
+++ b/src/osmo-pfcp-tool/pfcp_tool_vty.c
@@ -397,6 +397,11 @@ DEFUN(s_f_teid_choose, s_f_teid_choose_cmd,
 	return CMD_SUCCESS;
 }

+enum pdr_id_fixed {
+	PDR_ID_CORE = 1,
+	PDR_ID_ACCESS = 2,
+};
+
 int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 {
 	struct pfcp_tool_session *session = vty->index;
@@ -475,7 +480,7 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 		.create_pdr_count = 2,
 		.create_pdr = {
 			{
-				.pdr_id = 1,
+				.pdr_id = PDR_ID_CORE,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_CORE,
@@ -492,7 +497,7 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 				.far_id = 1,
 			},
 			{
-				.pdr_id = 2,
+				.pdr_id = PDR_ID_ACCESS,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_ACCESS,
@@ -635,7 +640,7 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 		.create_pdr_count = 2,
 		.create_pdr = {
 			{
-				.pdr_id = 1,
+				.pdr_id = PDR_ID_CORE,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_CORE,
@@ -650,7 +655,7 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 				.far_id = 1,
 			},
 			{
-				.pdr_id = 2,
+				.pdr_id = PDR_ID_ACCESS,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_ACCESS,
--- a/src/osmo-upf/upf.c
+++ b/src/osmo-upf/upf.c
@@ -36,8 +36,20 @@

 struct g_upf *g_upf = NULL;

+struct osmo_tdef g_upf_nft_tdefs[] = {
+	{ .T = -32, .default_val = 1000, .unit = OSMO_TDEF_MS,
+	  .desc = "How long to wait for more nft rulesets before flushing in batch",
+	},
+	{ .T = -33, .default_val = 1, .unit = OSMO_TDEF_CUSTOM,
+	  .desc = "When reaching this nr of queued nft rulesets, flush the queue",
+	  .max_val = 128,
+	},
+	{}
+};
+
 struct osmo_tdef_group g_upf_tdef_groups[] = {
 	{ "pfcp", "PFCP endpoint timers", osmo_pfcp_tdefs, },
+	{ "nft", "netfilter timers", g_upf_nft_tdefs, },
 	{}
 };

--- a/src/osmo-upf/upf_gtpu_echo.c
+++ b/src/osmo-upf/upf_gtpu_echo.c
@@ -122,6 +122,43 @@ static int tx_echo_resp(struct upf_gtp_dev *dev, const struct osmo_sockaddr *rem
 	return rc;
 }

+int upf_gtpu_echo_req_tx(struct upf_gtp_dev *dev, const struct osmo_sockaddr *remote, uint16_t seq_nr)
+{
+	struct gtp1u_hdr *tx_h;
+	int rc;
+	uint8_t msgbuf[sizeof(struct gtp1u_hdr) + 2];
+
+	tx_h = (void *)msgbuf;
+	*tx_h = (struct gtp1u_hdr){
+		/* 3GPP TS 29.281 5.1 defines that the ECHO REQ & RESP shall contain a sequence nr */
+		.s = 1,
+		.pt = 1,
+		.version = 1,
+		.msg_type = GTP1U_MSGTYPE_ECHO_REQ,
+		.ext = {
+			.seq_nr = seq_nr,
+		},
+	};
+
+	/* ECHO REQUEST shall contain a recovery counter */
+	tx_h->data2[0] = GTP1U_IEI_RECOVERY;
+	tx_h->data2[1] = g_upf->tunend.recovery_count;
+
+	osmo_store16be(sizeof(msgbuf) - offsetof(struct gtp1u_hdr, data1), &tx_h->length);
+
+	rc = sendto(dev->gtpv1.ofd.fd, msgbuf, sizeof(msgbuf), 0, &remote->u.sa, sizeof(*remote));
+	if (rc < 0) {
+		rc = -errno;
+		LOG_GTP_DEV(dev, LOGL_ERROR, "GTP1-U sendto(len=%zu, to=%s): %s\n", sizeof(msgbuf),
+			    osmo_sockaddr_to_str(remote), strerror(-rc));
+	} else {
+		rc = 0;
+	}
+	LOG_GTP_DEV(dev, LOGL_INFO, "<- %s: tx GTP1-U Echo Request: seq_nr=%u recovery_count=%u\n",
+		    osmo_sockaddr_to_str(remote), seq_nr, g_upf->tunend.recovery_count);
+	return rc;
+}
+
 int upf_gtpu_echo_read_cb(struct osmo_fd *ofd, unsigned int what)
 {
 	struct upf_gtp_dev *dev = ofd->data;
--- a/src/osmo-upf/upf_nft.c
+++ b/src/osmo-upf/upf_nft.c
@@ -26,6 +26,7 @@

 #include <osmocom/core/talloc.h>
 #include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>

 #include <osmocom/upf/upf.h>
 #include <osmocom/upf/upf_nft.h>
@@ -59,9 +60,10 @@ static char *upf_nft_ruleset_vmap_init(void *ctx, const char *table_name, int pr
 		table_name);
 }

-static int upf_nft_run(const char *ruleset)
+static int upf_nft_run_now(const char *ruleset)
 {
 	int rc;
+	const int logmax = 256;

 	if (g_upf->tunmap.mockup) {
 		LOGP(DNFT, LOGL_NOTICE, "tunmap/mockup active: not running nft ruleset: '%s'\n", ruleset);
@@ -81,14 +83,135 @@ static int upf_nft_run(const char *ruleset)
 		return -EIO;
 	}

-	LOGP(DNFT, LOGL_DEBUG, "run nft ruleset: %s\n", osmo_quote_str_c(OTC_SELECT, ruleset, -1));
+	if (log_check_level(DNFT, LOGL_DEBUG)) {
+		size_t l = strlen(ruleset);
+		LOGP(DNFT, LOGL_DEBUG, "ran nft ruleset, %zu chars: \"%s%s\"\n",
+		     l,
+		     osmo_escape_cstr_c(OTC_SELECT, ruleset, OSMO_MIN(logmax, l)),
+		     l > logmax ? "..." : "");
+	}
+
 	return 0;
 }

+struct nft_queue {
+	struct osmo_tdef *flush_time_tdef;
+	struct osmo_tdef *ruleset_max_tdef;
+	struct osmo_strbuf sb;
+	/* 128 NFT rulesets amount to about 110 kb of char */
+	char buf[1<<17];
+	unsigned int ruleset_count;
+	struct osmo_timer_list timer;
+};
+
+static void nft_queue_clear_buf(struct nft_queue *q)
+{
+	q->sb = (struct osmo_strbuf){ .buf = q->buf, .len = sizeof(q->buf) };
+	q->buf[0] = '\0';
+}
+
+static void nft_queue_init(void *ctx, struct nft_queue *q,
+			   struct osmo_tdef *flush_time_tdef,
+			   struct osmo_tdef *ruleset_max_tdef)
+{
+	*q = (struct nft_queue){
+		.flush_time_tdef = flush_time_tdef,
+		.ruleset_max_tdef = ruleset_max_tdef,
+	};
+	nft_queue_clear_buf(q);
+}
+
+static void nft_queue_flush(struct nft_queue *q, const char *reason)
+{
+	static unsigned int flush_count = 0;
+	static unsigned int ruleset_count = 0;
+
+	/* We will now flush the queue empty. A timer needs to run only when the next pending entry is added. */
+	osmo_timer_del(&q->timer);
+
+	/* Nothing to send? */
+	if (!q->sb.chars_needed)
+		return;
+
+	flush_count++;
+	ruleset_count += q->ruleset_count;
+	LOGP(DNFT, LOGL_INFO, "Flushing NFT ruleset queue: %s: n:%u strlen:%zu (flush count: %u avg rules per flush: %s)\n",
+	     reason,
+	     q->ruleset_count, q->sb.chars_needed,
+	     flush_count, osmo_int_to_float_str_c(OTC_SELECT, 10 * ruleset_count / flush_count, 1));
+
+	q->ruleset_count = 0;
+
+	upf_nft_run_now(q->sb.buf);
+
+	nft_queue_clear_buf(q);
+}
+
+static void nft_queue_flush_cb(void *q)
+{
+	nft_queue_flush(q, "timeout");
+}
+
+static int nft_enqueue(struct nft_queue *q,
+		       int (*tunmap_to_str_buf)(char *buf, size_t len, struct upf_tunmap *tunmap),
+		       struct upf_tunmap *tunmap)
+{
+	int ruleset_max;
+	struct osmo_strbuf q_sb_was = q->sb;
+
+	OSMO_STRBUF_APPEND(q->sb, tunmap_to_str_buf, tunmap);
+
+	/* is that being cut off? then revert the addition. This should never happen in practice. */
+	if (q->sb.chars_needed >= q->sb.len) {
+		q->sb = q_sb_was;
+		if (q->sb.pos)
+			*q->sb.pos = '\0';
+		nft_queue_flush(q, "reached max nr of chars");
+		OSMO_STRBUF_APPEND(q->sb, tunmap_to_str_buf, tunmap);
+	}
+
+	/* Append separator -- no problem if that gets cut off. */
+	OSMO_STRBUF_PRINTF(q->sb, "\n");
+
+	q->ruleset_count++;
+
+	LOGP(DNFT, LOGL_INFO, "Added NFT ruleset to queue: n:%u strlen:%zu\n",
+	     q->ruleset_count, q->sb.chars_needed);
+
+	/* Added a rule, see if it has reached ruleset_max. */
+	ruleset_max = osmo_tdef_get(q->ruleset_max_tdef, q->ruleset_max_tdef->T, OSMO_TDEF_CUSTOM, 128);
+	if (q->ruleset_count >= ruleset_max) {
+		nft_queue_flush(q, "reached max nr of rules");
+		return 0;
+	}
+
+	/* Item added. If the timer is not running yet, schedule a flush in given timeout */
+	if (!osmo_timer_pending(&q->timer)) {
+		struct osmo_tdef *t;
+		unsigned long us;
+		osmo_timer_setup(&q->timer, nft_queue_flush_cb, q);
+		t = q->flush_time_tdef;
+		us = osmo_tdef_get(t, t->T, OSMO_TDEF_US, 100000);
+		osmo_timer_schedule(&q->timer, us / 1000000, us % 1000000);
+	}
+	return 0;
+}
+
+static void nft_queue_free(struct nft_queue *q)
+{
+	osmo_timer_del(&q->timer);
+}
+
+static struct nft_queue g_nft_queue = {};
+
 int upf_nft_init()
 {
 	int rc;

+	nft_queue_init(g_upf, &g_nft_queue,
+		       osmo_tdef_get_entry(g_upf_nft_tdefs, -32),
+		       osmo_tdef_get_entry(g_upf_nft_tdefs, -33));
+
 	/* Always set up the default settings, also in mockup mode, so that the VTY reflects sane values */
 	if (!g_upf->tunmap.table_name)
 		g_upf->tunmap.table_name = talloc_strdup(g_upf, "osmo-upf");
@@ -106,7 +229,7 @@ int upf_nft_init()
 		return -EIO;
 	}

-	rc = upf_nft_run(upf_nft_tunmap_get_table_init_str(OTC_SELECT));
+	rc = upf_nft_run_now(upf_nft_tunmap_get_table_init_str(OTC_SELECT));
 	if (rc) {
 		LOGP(DNFT, LOGL_ERROR, "Failed to create nft table %s\n",
 		     osmo_quote_str_c(OTC_SELECT, g_upf->tunmap.table_name, -1));
@@ -114,7 +237,7 @@ int upf_nft_init()
 	}
 	LOGP(DNFT, LOGL_NOTICE, "Created nft table %s\n", osmo_quote_str_c(OTC_SELECT, g_upf->tunmap.table_name, -1));

-	rc = upf_nft_run(upf_nft_tunmap_get_vmap_init_str(OTC_SELECT));
+	rc = upf_nft_run_now(upf_nft_tunmap_get_vmap_init_str(OTC_SELECT));
 	if (rc) {
 		LOGP(DNFT, LOGL_ERROR, "Failed to initialize nft verdict map in table %s\n", g_upf->tunmap.table_name);
 		return rc;
@@ -124,6 +247,7 @@ int upf_nft_init()

 int upf_nft_free()
 {
+	nft_queue_free(&g_nft_queue);
 	if (!g_upf->tunmap.nft_ctx)
 		return 0;
 	nft_ctx_free(g_upf->tunmap.nft_ctx);
@@ -263,11 +387,6 @@ static int upf_nft_ruleset_tunmap_create_buf(char *buf, size_t buflen, const str
 	return sb.chars_needed;
 }

-static char *upf_nft_ruleset_tunmap_create_c(void *ctx, const struct upf_nft_args *args)
-{
-	OSMO_NAME_C_IMPL(ctx, 1024, "ERROR", upf_nft_ruleset_tunmap_create_buf, args)
-}
-
 static int upf_nft_ruleset_tunmap_delete_buf(char *buf, size_t buflen, const struct upf_nft_args *args)
 {
 	struct osmo_strbuf sb = { .buf = buf, .len = buflen };
@@ -280,11 +399,6 @@ static int upf_nft_ruleset_tunmap_delete_buf(char *buf, size_t buflen, const str
 	return sb.chars_needed;
 }

-static char *upf_nft_ruleset_tunmap_delete_c(void *ctx, const struct upf_nft_args *args)
-{
-	OSMO_NAME_C_IMPL(ctx, 512, "ERROR", upf_nft_ruleset_tunmap_delete_buf, args)
-}
-
 int upf_nft_tunmap_to_str_buf(char *buf, size_t buflen, const struct upf_tunmap *tunmap)
 {
 	struct osmo_strbuf sb = { .buf = buf, .len = buflen };
@@ -344,18 +458,28 @@ char *upf_nft_tunmap_get_vmap_init_str(void *ctx)
 					 g_upf->tunmap.priority_post);
 }

-char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_tunmap *tunmap)
+int upf_nft_tunmap_get_ruleset_str_buf(char *buf, size_t len, struct upf_tunmap *tunmap)
 {
 	struct upf_nft_args args;
 	upf_nft_args_from_tunmap(&args, tunmap);
-	return upf_nft_ruleset_tunmap_create_c(ctx, &args);
+	return upf_nft_ruleset_tunmap_create_buf(buf, len, &args);
+}
+
+char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_tunmap *tunmap)
+{
+	OSMO_NAME_C_IMPL(ctx, 1024, "ERROR", upf_nft_tunmap_get_ruleset_str_buf, tunmap)
+}
+
+int upf_nft_tunmap_get_ruleset_del_str_buf(char *buf, size_t len, struct upf_tunmap *tunmap)
+{
+	struct upf_nft_args args;
+	upf_nft_args_from_tunmap(&args, tunmap);
+	return upf_nft_ruleset_tunmap_delete_buf(buf, len, &args);
 }

 char *upf_nft_tunmap_get_ruleset_del_str(void *ctx, struct upf_tunmap *tunmap)
 {
-	struct upf_nft_args args;
-	upf_nft_args_from_tunmap(&args, tunmap);
-	return upf_nft_ruleset_tunmap_delete_c(ctx, &args);
+	OSMO_NAME_C_IMPL(ctx, 1024, "ERROR", upf_nft_tunmap_get_ruleset_del_str_buf, tunmap)
 }

 static int upf_nft_tunmap_ensure_chain_id(struct upf_nft_tun *tun)
@@ -373,10 +497,10 @@ int upf_nft_tunmap_create(struct upf_tunmap *tunmap)
 	if (upf_nft_tunmap_ensure_chain_id(&tunmap->access)
 	    || upf_nft_tunmap_ensure_chain_id(&tunmap->core))
 		return -ENOSPC;
-	return upf_nft_run(upf_nft_tunmap_get_ruleset_str(OTC_SELECT, tunmap));
+	return nft_enqueue(&g_nft_queue, upf_nft_tunmap_get_ruleset_str_buf, tunmap);
 }

 int upf_nft_tunmap_delete(struct upf_tunmap *tunmap)
 {
-	return upf_nft_run(upf_nft_tunmap_get_ruleset_del_str(OTC_SELECT, tunmap));
+	return nft_enqueue(&g_nft_queue, upf_nft_tunmap_get_ruleset_del_str_buf, tunmap);
 }
--- a/src/osmo-upf/upf_vty.c
+++ b/src/osmo-upf/upf_vty.c
@@ -38,6 +38,7 @@
 #include <osmocom/upf/up_session.h>
 #include <osmocom/upf/up_gtp_action.h>
 #include <osmocom/upf/netinst.h>
+#include <osmocom/upf/upf_gtpu_echo.h>

 enum upf_vty_node {
 	PFCP_NODE = _LAST_OSMOVTY_NODE + 1,
@@ -486,6 +487,105 @@ DEFUN(show_session, show_session_cmd,
 	return CMD_SUCCESS;
 }

+/* variant:
+ *  0 "gtp1u-echo send to (A.B.C.D|X:X::X:X)"
+ *  1 "gtp1u-echo send to (A.B.C.D|X:X::X:X) local-ip (A.B.C.D|X:X::X:X)"
+ *  2 "gtp1u-echo send to (A.B.C.D|X:X::X:X) local-dev DEV_NAME"
+ */
+static int _gtp_echo_tx(struct vty *vty, int variant, int argc, const char **argv)
+{
+	struct osmo_sockaddr_str addr;
+	struct osmo_sockaddr osa_remote;
+	struct osmo_sockaddr osa_local;
+	struct upf_gtp_dev *gtp_dev = NULL;
+	const char *remote_str = argv[0];
+	const char *local_str = NULL;
+	if (argc > 1)
+		local_str = argv[1];
+
+	/* GTP can be received on port 2152 only, i.e. the remote port must be 2152. (The sending port is allowed to
+	 * differ). */
+	if (osmo_sockaddr_str_from_str(&addr, remote_str, 2152)
+	    || osmo_sockaddr_str_to_osa(&addr, &osa_remote)) {
+		vty_out(vty, "%% Error: cannot send Echo: invalid IP address: %s%s",
+			osmo_quote_str(remote_str, -1), VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	switch (variant) {
+	case 0:
+		gtp_dev = llist_first_entry_or_null(&g_upf->tunend.devs, struct upf_gtp_dev, entry);
+		if (!gtp_dev) {
+			vty_out(vty, "%% Error: cannot send Echo: there is no GTP device%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		break;
+	case 1:
+		if (osmo_sockaddr_str_from_str(&addr, local_str, 2152)
+		    || osmo_sockaddr_str_to_osa(&addr, &osa_local)) {
+			vty_out(vty, "%% Error: cannot send Echo: invalid IP address: %s%s",
+				osmo_quote_str(local_str, -1), VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		gtp_dev = upf_gtp_dev_find_by_local_addr(&osa_local);
+		if (!gtp_dev) {
+			vty_out(vty, "%% Error: cannot send Echo: this does not seem to be a locally bound GTP address: %s%s",
+				osmo_sockaddr_to_str_c(OTC_SELECT, &osa_local), VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		break;
+	case 2:
+		gtp_dev = upf_gtp_dev_find_by_name(local_str);
+		if (!gtp_dev) {
+			vty_out(vty, "%% Error: cannot send Echo: there is no GTP device by the name of '%s'%s",
+				local_str, VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		break;
+	}
+	OSMO_ASSERT(gtp_dev);
+
+	if (upf_gtpu_echo_req_tx(gtp_dev, &osa_remote, g_upf->gtp.next_echo_seq_nr++)) {
+		vty_out(vty, "%% Error: Failed to transmit Echo Request (see DGTP logging)%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	vty_out(vty, "%s -> %s tx Echo Request; for responses, see DGTP logging level INFO%s",
+		gtp_dev->name, osmo_sockaddr_to_str_c(OTC_SELECT, &osa_remote), VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+#define IP46_STR "IPv4 address\nIPv6 address\n"
+#define GTP_ECHO_TX_STR \
+      "GTP1-U Echo probing\n" \
+      "Send a GTP1-U Echo Request to a remote peer\n" \
+      "Send to remote peer's GTP address\n" IP46_STR
+
+DEFUN(gtp_echo_tx, gtp_echo_tx_cmd,
+      "gtp1u-echo send to " VTY_IPV46_CMD,
+      GTP_ECHO_TX_STR)
+{
+	return _gtp_echo_tx(vty, 0, argc, argv);
+}
+
+DEFUN(gtp_echo_tx_local_ip, gtp_echo_tx_local_ip_cmd,
+      "gtp1u-echo send to " VTY_IPV46_CMD " local-ip " VTY_IPV46_CMD,
+      GTP_ECHO_TX_STR
+      "Send from local GTP device, chosen by IP address\n"
+      IP46_STR)
+{
+	return _gtp_echo_tx(vty, 1, argc, argv);
+}
+
+DEFUN(gtp_echo_tx_local_dev, gtp_echo_tx_local_dev_cmd,
+      "gtp1u-echo send to " VTY_IPV46_CMD " local-dev DEV_NAME",
+      GTP_ECHO_TX_STR
+      "Send from local GTP device, chosen by name as configured in 'dev create' or 'dev use'.\n"
+      "A GTP device name as it appears in the cfg\n")
+{
+	return _gtp_echo_tx(vty, 2, argc, argv);
+}
+
 void upf_vty_init()
 {
 	OSMO_ASSERT(g_upf != NULL);
@@ -495,6 +595,9 @@ void upf_vty_init()
 	install_element_ve(&show_session_cmd);
 	install_element_ve(&show_netinst_cmd);
 	install_element_ve(&show_nft_rule_append_cmd);
+	install_element_ve(&gtp_echo_tx_cmd);
+	install_element_ve(&gtp_echo_tx_local_ip_cmd);
+	install_element_ve(&gtp_echo_tx_local_dev_cmd);

 	install_node(&cfg_pfcp_node, config_write_pfcp);
 	install_element(CONFIG_NODE, &cfg_pfcp_cmd);
--- a/tests/gtp-echo.vty
+++ b/tests/gtp-echo.vty
@@ -0,0 +1,42 @@
+OsmoUPF> list
+...
+  gtp1u-echo send to (A.B.C.D|X:X::X:X)
+  gtp1u-echo send to (A.B.C.D|X:X::X:X) local-ip (A.B.C.D|X:X::X:X)
+  gtp1u-echo send to (A.B.C.D|X:X::X:X) local-dev DEV_NAME
+...
+OsmoUPF> enable
+OsmoUPF# list
+...
+  gtp1u-echo send to (A.B.C.D|X:X::X:X)
+  gtp1u-echo send to (A.B.C.D|X:X::X:X) local-ip (A.B.C.D|X:X::X:X)
+  gtp1u-echo send to (A.B.C.D|X:X::X:X) local-dev DEV_NAME
+...
+OsmoUPF# configure terminal
+OsmoUPF(config)# list
+... !gtp1u-echo
+OsmoUPF(config)# end
+
+OsmoUPF# gtp1u-echo?
+  gtp1u-echo  GTP1-U Echo probing
+OsmoUPF# gtp1u-echo ?
+  send  Send a GTP1-U Echo Request to a remote peer
+OsmoUPF# gtp1u-echo send ?
+  to  Send to remote peer's GTP address
+OsmoUPF# gtp1u-echo send to ?
+  A.B.C.D   IPv4 address
+  X:X::X:X  IPv6 address
+OsmoUPF# gtp1u-echo send to 1.2.3.4 ?
+  local-ip   Send from local GTP device, chosen by IP address
+  local-dev  Send from local GTP device, chosen by name as configured in 'dev create' or 'dev use'.
+  <cr>       
+OsmoUPF# gtp1u-echo send to 1.2.3.4 local-ip ?
+  A.B.C.D   IPv4 address
+  X:X::X:X  IPv6 address
+OsmoUPF# gtp1u-echo send to 1.2.3.4 local-dev ?
+  DEV_NAME  A GTP device name as it appears in the cfg
+OsmoUPF# gtp1u-echo send to 1.2.3.4
+% Error: cannot send Echo: there is no GTP device
+OsmoUPF# gtp1u-echo send to 1.2.3.4 local-ip 1.2.3.4
+% Error: cannot send Echo: this does not seem to be a locally bound GTP address: 1.2.3.4:2152
+OsmoUPF# gtp1u-echo send to 1.2.3.4 local-dev apn0
+% Error: cannot send Echo: there is no GTP device by the name of 'apn0'
--- a/tests/unique_ids/unique_ids_test.err
+++ b/tests/unique_ids/unique_ids_test.err
@@ -8,7 +8,7 @@ DLPFCP NOTICE PFCP endpoint: recovery timestamp = 0x83aa7e80 (0 seconds since UN
 [test override] nft_run_cmd_from_buffer():
 add table inet osmo-upf { flags owner; };

-DNFT DEBUG run nft ruleset: "add table inet osmo-upf { flags owner; };\n"
+DNFT DEBUG ran nft ruleset, 42 chars: "add table inet osmo-upf { flags owner; };\n"
 DNFT NOTICE Created nft table "osmo-upf"

 [test override] nft_run_cmd_from_buffer():
@@ -19,7 +19,7 @@ add map inet osmo-upf tunmap-post { typeof meta mark : verdict; };
 add rule inet osmo-upf pre udp dport 2152 ip daddr . @ih,32,32 vmap @tunmap-pre;
 add rule inet osmo-upf post meta mark vmap @tunmap-post;

-DNFT DEBUG run nft ruleset: "add chain inet osmo-upf pre { type filter hook prerouting priority -300; policy accept; };\nadd chain inet osmo-upf post { type filter hook postrouting priority 400; policy accept; };\nadd map inet osmo-upf tunmap-pre { typeof ip daddr . @ih,32,32 : verdict; };\nadd map inet osmo-upf tunmap-post { typeof meta mark : verdict; };\nadd rule inet osmo-upf pre udp dport 2152 ip daddr . @ih,32,32 vmap @tunmap-pre;\nadd rule inet osmo-upf post meta mark vmap @tunmap-post;\n"
+DNFT DEBUG ran nft ruleset, 465 chars: "add chain inet osmo-upf pre { type filter hook prerouting priority -300; policy accept; };\nadd chain inet osmo-upf post { type filter hook postrouting priority 400; policy accept; };\nadd map inet osmo-upf tunmap-pre { typeof ip daddr . @ih,32,32 : verdict;..."

 PFCP Associate peer
 DPEER DEBUG up_peer{NOT_ASSOCIATED}: Allocated
@@ -58,6 +58,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: Active PDR set: + PDR-1{src:Core T
 DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: GTP actions: 0 previously active; want active: 1
 DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: want: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x100 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x101 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: enabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x100 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x101 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:847
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:847 (flush count: 1 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 add chain inet osmo-upf tunmap-pre-1;
@@ -73,7 +75,8 @@ add rule inet osmo-upf tunmap-post-2 ip saddr set 1.1.1.1 udp sport set 2152 @ih
 add element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 : jump tunmap-pre-2 };
 add element inet osmo-upf tunmap-post { 2 : jump tunmap-post-2 };

-DNFT DEBUG run nft ruleset: "add chain inet osmo-upf tunmap-pre-1;\nadd rule inet osmo-upf tunmap-pre-1 ip daddr set 13.14.15.16 meta mark set 1 counter accept;\nadd chain inet osmo-upf tunmap-post-1;\nadd rule inet osmo-upf tunmap-post-1 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x101 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 : jump tunmap-pre-1 };\nadd element inet osmo-upf tunmap-post { 1 : jump tunmap-post-1 };\nadd chain inet osmo-upf tunmap-pre-2;\nadd rule inet osmo-upf tunmap-pre-2 ip daddr set 5.6.7.8 meta mark set 2 counter accept;\nadd chain inet osmo-upf tunmap-post-2;\nadd rule inet osmo-upf tunmap-post-2 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x100 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 : jump tunmap-pre-2 };\nadd element inet osmo-upf tunmap-post { 2 : jump tunmap-post-2 };\n"
+
+DNFT DEBUG ran nft ruleset, 847 chars: "add chain inet osmo-upf tunmap-pre-1;\nadd rule inet osmo-upf tunmap-pre-1 ip daddr set 13.14.15.16 meta mark set 1 counter accept;\nadd chain inet osmo-upf tunmap-post-1;\nadd rule inet osmo-upf tunmap-post-1 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x100 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x101 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1: Enabled tunmap, nft chain IDs: access--1-> <-2--core

 [test override] PFCP tx:
@@ -123,6 +126,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x2){INIT}: Active PDR set: + PDR-1{src:Core T
 DSESSION DEBUG up_session(1-2-3-4-0x2){INIT}: GTP actions: 0 previously active; want active: 1
 DSESSION DEBUG up_session(1-2-3-4-0x2){INIT}: want: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x102 GTP-access-l:1.1.1.1 TEID-access-l:0x4 GTP-core-r:13.14.15.16 TEID-core-r:0x103 GTP-core-l:1.1.1.1 TEID-core-l:0x3 PFCP-peer:1.2.3.4 SEID-l:0x2 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x2){INIT}: enabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x102 GTP-access-l:1.1.1.1 TEID-access-l:0x4 GTP-core-r:13.14.15.16 TEID-core-r:0x103 GTP-core-l:1.1.1.1 TEID-core-l:0x3 PFCP-peer:1.2.3.4 SEID-l:0x2 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:847
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:847 (flush count: 2 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 add chain inet osmo-upf tunmap-pre-3;
@@ -138,7 +143,8 @@ add rule inet osmo-upf tunmap-post-4 ip saddr set 1.1.1.1 udp sport set 2152 @ih
 add element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x3 : jump tunmap-pre-4 };
 add element inet osmo-upf tunmap-post { 4 : jump tunmap-post-4 };

-DNFT DEBUG run nft ruleset: "add chain inet osmo-upf tunmap-pre-3;\nadd rule inet osmo-upf tunmap-pre-3 ip daddr set 13.14.15.16 meta mark set 3 counter accept;\nadd chain inet osmo-upf tunmap-post-3;\nadd rule inet osmo-upf tunmap-post-3 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x103 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x4 : jump tunmap-pre-3 };\nadd element inet osmo-upf tunmap-post { 3 : jump tunmap-post-3 };\nadd chain inet osmo-upf tunmap-pre-4;\nadd rule inet osmo-upf tunmap-pre-4 ip daddr set 5.6.7.8 meta mark set 4 counter accept;\nadd chain inet osmo-upf tunmap-post-4;\nadd rule inet osmo-upf tunmap-post-4 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x102 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x3 : jump tunmap-pre-4 };\nadd element inet osmo-upf tunmap-post { 4 : jump tunmap-post-4 };\n"
+
+DNFT DEBUG ran nft ruleset, 847 chars: "add chain inet osmo-upf tunmap-pre-3;\nadd rule inet osmo-upf tunmap-pre-3 ip daddr set 13.14.15.16 meta mark set 3 counter accept;\nadd chain inet osmo-upf tunmap-post-3;\nadd rule inet osmo-upf tunmap-post-3 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x102 GTP-access-l:1.1.1.1 TEID-access-l:0x4 GTP-core-r:13.14.15.16 TEID-core-r:0x103 GTP-core-l:1.1.1.1 TEID-core-l:0x3 PFCP-peer:1.2.3.4 SEID-l:0x2 PDR-access:2 PDR-core:1: Enabled tunmap, nft chain IDs: access--3-> <-4--core

 [test override] PFCP tx:
@@ -182,6 +188,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: Received Event UP_SESSION_E
 DREF INFO up_peer(1-2-3-4){ASSOCIATED}: - msg-tx: now used by 0 (-)
 DPEER DEBUG up_peer(1-2-3-4){ASSOCIATED}: Received Event UP_PEER_EV_USE_COUNT_ZERO
 DSESSION NOTICE up_session(1-2-3-4-0x1){ESTABLISHED}: Session releasing: peer:1.2.3.4 SEID-r:0x100 SEID-l:0x1 state:ESTABLISHED PDR-active:2/2 FAR-active:2/2 GTP-active:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:381
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:381 (flush count: 3 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 };
@@ -193,7 +201,8 @@ delete element inet osmo-upf tunmap-post { 2 };
 delete chain inet osmo-upf tunmap-pre-2;
 delete chain inet osmo-upf tunmap-post-2;

-DNFT DEBUG run nft ruleset: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 };\ndelete element inet osmo-upf tunmap-post { 1 };\ndelete chain inet osmo-upf tunmap-pre-1;\ndelete chain inet osmo-upf tunmap-post-1;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 };\ndelete element inet osmo-upf tunmap-post { 2 };\ndelete chain inet osmo-upf tunmap-pre-2;\ndelete chain inet osmo-upf tunmap-post-2;\n"
+
+DNFT DEBUG ran nft ruleset, 381 chars: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 };\ndelete element inet osmo-upf tunmap-post { 1 };\ndelete chain inet osmo-upf tunmap-pre-1;\ndelete chain inet osmo-upf tunmap-post-1;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 };\ndelete ..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x100 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x101 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1: Disabled tunmap, nft chain IDs: access--1-> <-2--core
 DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: State change to WAIT_USE_COUNT (no timeout)
 DSESSION DEBUG up_session(1-2-3-4-0x1){WAIT_USE_COUNT}: GTP actions: 0 previously active; want active: 0
@@ -231,6 +240,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: Active PDR set: + PDR-1{src:Core T
 DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: GTP actions: 0 previously active; want active: 1
 DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: want: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x104 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x105 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x1){INIT}: enabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x104 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x105 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:847
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:847 (flush count: 4 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 add chain inet osmo-upf tunmap-pre-1;
@@ -246,7 +257,8 @@ add rule inet osmo-upf tunmap-post-2 ip saddr set 1.1.1.1 udp sport set 2152 @ih
 add element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 : jump tunmap-pre-2 };
 add element inet osmo-upf tunmap-post { 2 : jump tunmap-post-2 };

-DNFT DEBUG run nft ruleset: "add chain inet osmo-upf tunmap-pre-1;\nadd rule inet osmo-upf tunmap-pre-1 ip daddr set 13.14.15.16 meta mark set 1 counter accept;\nadd chain inet osmo-upf tunmap-post-1;\nadd rule inet osmo-upf tunmap-post-1 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x105 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 : jump tunmap-pre-1 };\nadd element inet osmo-upf tunmap-post { 1 : jump tunmap-post-1 };\nadd chain inet osmo-upf tunmap-pre-2;\nadd rule inet osmo-upf tunmap-pre-2 ip daddr set 5.6.7.8 meta mark set 2 counter accept;\nadd chain inet osmo-upf tunmap-post-2;\nadd rule inet osmo-upf tunmap-post-2 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x104 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 : jump tunmap-pre-2 };\nadd element inet osmo-upf tunmap-post { 2 : jump tunmap-post-2 };\n"
+
+DNFT DEBUG ran nft ruleset, 847 chars: "add chain inet osmo-upf tunmap-pre-1;\nadd rule inet osmo-upf tunmap-pre-1 ip daddr set 13.14.15.16 meta mark set 1 counter accept;\nadd chain inet osmo-upf tunmap-post-1;\nadd rule inet osmo-upf tunmap-post-1 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x104 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x105 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1: Enabled tunmap, nft chain IDs: access--1-> <-2--core

 [test override] PFCP tx:
@@ -296,6 +308,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x3){INIT}: Active PDR set: + PDR-1{src:Core T
 DSESSION DEBUG up_session(1-2-3-4-0x3){INIT}: GTP actions: 0 previously active; want active: 1
 DSESSION DEBUG up_session(1-2-3-4-0x3){INIT}: want: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x106 GTP-access-l:1.1.1.1 TEID-access-l:0x6 GTP-core-r:13.14.15.16 TEID-core-r:0x107 GTP-core-l:1.1.1.1 TEID-core-l:0x5 PFCP-peer:1.2.3.4 SEID-l:0x3 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x3){INIT}: enabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x106 GTP-access-l:1.1.1.1 TEID-access-l:0x6 GTP-core-r:13.14.15.16 TEID-core-r:0x107 GTP-core-l:1.1.1.1 TEID-core-l:0x5 PFCP-peer:1.2.3.4 SEID-l:0x3 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:847
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:847 (flush count: 5 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 add chain inet osmo-upf tunmap-pre-5;
@@ -311,7 +325,8 @@ add rule inet osmo-upf tunmap-post-6 ip saddr set 1.1.1.1 udp sport set 2152 @ih
 add element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x5 : jump tunmap-pre-6 };
 add element inet osmo-upf tunmap-post { 6 : jump tunmap-post-6 };

-DNFT DEBUG run nft ruleset: "add chain inet osmo-upf tunmap-pre-5;\nadd rule inet osmo-upf tunmap-pre-5 ip daddr set 13.14.15.16 meta mark set 5 counter accept;\nadd chain inet osmo-upf tunmap-post-5;\nadd rule inet osmo-upf tunmap-post-5 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x107 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x6 : jump tunmap-pre-5 };\nadd element inet osmo-upf tunmap-post { 5 : jump tunmap-post-5 };\nadd chain inet osmo-upf tunmap-pre-6;\nadd rule inet osmo-upf tunmap-pre-6 ip daddr set 5.6.7.8 meta mark set 6 counter accept;\nadd chain inet osmo-upf tunmap-post-6;\nadd rule inet osmo-upf tunmap-post-6 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32 set 0x106 counter accept;\nadd element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x5 : jump tunmap-pre-6 };\nadd element inet osmo-upf tunmap-post { 6 : jump tunmap-post-6 };\n"
+
+DNFT DEBUG ran nft ruleset, 847 chars: "add chain inet osmo-upf tunmap-pre-5;\nadd rule inet osmo-upf tunmap-pre-5 ip daddr set 13.14.15.16 meta mark set 5 counter accept;\nadd chain inet osmo-upf tunmap-post-5;\nadd rule inet osmo-upf tunmap-post-5 ip saddr set 1.1.1.1 udp sport set 2152 @ih,32,32..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x106 GTP-access-l:1.1.1.1 TEID-access-l:0x6 GTP-core-r:13.14.15.16 TEID-core-r:0x107 GTP-core-l:1.1.1.1 TEID-core-l:0x5 PFCP-peer:1.2.3.4 SEID-l:0x3 PDR-access:2 PDR-core:1: Enabled tunmap, nft chain IDs: access--5-> <-6--core

 [test override] PFCP tx:
@@ -348,6 +363,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x3){ESTABLISHED}: Removing from parent up_pee
 DSESSION DEBUG up_session(1-2-3-4-0x3){ESTABLISHED}: GTP actions: 1 previously active; want active: 0
 DSESSION DEBUG up_session(1-2-3-4-0x3){ESTABLISHED}: active: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x106 GTP-access-l:1.1.1.1 TEID-access-l:0x6 GTP-core-r:13.14.15.16 TEID-core-r:0x107 GTP-core-l:1.1.1.1 TEID-core-l:0x5 PFCP-peer:1.2.3.4 SEID-l:0x3 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x3){ESTABLISHED}: disabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x106 GTP-access-l:1.1.1.1 TEID-access-l:0x6 GTP-core-r:13.14.15.16 TEID-core-r:0x107 GTP-core-l:1.1.1.1 TEID-core-l:0x5 PFCP-peer:1.2.3.4 SEID-l:0x3 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:381
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:381 (flush count: 6 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x6 };
@@ -359,7 +376,8 @@ delete element inet osmo-upf tunmap-post { 6 };
 delete chain inet osmo-upf tunmap-pre-6;
 delete chain inet osmo-upf tunmap-post-6;

-DNFT DEBUG run nft ruleset: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x6 };\ndelete element inet osmo-upf tunmap-post { 5 };\ndelete chain inet osmo-upf tunmap-pre-5;\ndelete chain inet osmo-upf tunmap-post-5;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x5 };\ndelete element inet osmo-upf tunmap-post { 6 };\ndelete chain inet osmo-upf tunmap-pre-6;\ndelete chain inet osmo-upf tunmap-post-6;\n"
+
+DNFT DEBUG ran nft ruleset, 381 chars: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x6 };\ndelete element inet osmo-upf tunmap-post { 5 };\ndelete chain inet osmo-upf tunmap-pre-5;\ndelete chain inet osmo-upf tunmap-post-5;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x5 };\ndelete ..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x106 GTP-access-l:1.1.1.1 TEID-access-l:0x6 GTP-core-r:13.14.15.16 TEID-core-r:0x107 GTP-core-l:1.1.1.1 TEID-core-l:0x5 PFCP-peer:1.2.3.4 SEID-l:0x3 PDR-access:2 PDR-core:1: Disabled tunmap, nft chain IDs: access--5-> <-6--core
 DSESSION DEBUG up_session(1-2-3-4-0x3){ESTABLISHED}: Freeing instance
 DSESSION DEBUG up_session(1-2-3-4-0x3){ESTABLISHED}: Deallocated
@@ -368,6 +386,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: Removing from parent up_pee
 DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: GTP actions: 1 previously active; want active: 0
 DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: active: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x104 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x105 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: disabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x104 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x105 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:381
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:381 (flush count: 7 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 };
@@ -379,7 +399,8 @@ delete element inet osmo-upf tunmap-post { 2 };
 delete chain inet osmo-upf tunmap-pre-2;
 delete chain inet osmo-upf tunmap-post-2;

-DNFT DEBUG run nft ruleset: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 };\ndelete element inet osmo-upf tunmap-post { 1 };\ndelete chain inet osmo-upf tunmap-pre-1;\ndelete chain inet osmo-upf tunmap-post-1;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 };\ndelete element inet osmo-upf tunmap-post { 2 };\ndelete chain inet osmo-upf tunmap-pre-2;\ndelete chain inet osmo-upf tunmap-post-2;\n"
+
+DNFT DEBUG ran nft ruleset, 381 chars: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x2 };\ndelete element inet osmo-upf tunmap-post { 1 };\ndelete chain inet osmo-upf tunmap-pre-1;\ndelete chain inet osmo-upf tunmap-post-1;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x1 };\ndelete ..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x104 GTP-access-l:1.1.1.1 TEID-access-l:0x2 GTP-core-r:13.14.15.16 TEID-core-r:0x105 GTP-core-l:1.1.1.1 TEID-core-l:0x1 PFCP-peer:1.2.3.4 SEID-l:0x1 PDR-access:2 PDR-core:1: Disabled tunmap, nft chain IDs: access--1-> <-2--core
 DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: Freeing instance
 DSESSION DEBUG up_session(1-2-3-4-0x1){ESTABLISHED}: Deallocated
@@ -388,6 +409,8 @@ DSESSION DEBUG up_session(1-2-3-4-0x2){ESTABLISHED}: Removing from parent up_pee
 DSESSION DEBUG up_session(1-2-3-4-0x2){ESTABLISHED}: GTP actions: 1 previously active; want active: 0
 DSESSION DEBUG up_session(1-2-3-4-0x2){ESTABLISHED}: active: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x102 GTP-access-l:1.1.1.1 TEID-access-l:0x4 GTP-core-r:13.14.15.16 TEID-core-r:0x103 GTP-core-l:1.1.1.1 TEID-core-l:0x3 PFCP-peer:1.2.3.4 SEID-l:0x2 PDR-access:2 PDR-core:1
 DSESSION DEBUG up_session(1-2-3-4-0x2){ESTABLISHED}: disabling: GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x102 GTP-access-l:1.1.1.1 TEID-access-l:0x4 GTP-core-r:13.14.15.16 TEID-core-r:0x103 GTP-core-l:1.1.1.1 TEID-core-l:0x3 PFCP-peer:1.2.3.4 SEID-l:0x2 PDR-access:2 PDR-core:1
+DNFT INFO Added NFT ruleset to queue: n:1 strlen:381
+DNFT INFO Flushing NFT ruleset queue: reached max nr of rules: n:1 strlen:381 (flush count: 8 avg rules per flush: 1)

 [test override] nft_run_cmd_from_buffer():
 delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x4 };
@@ -399,7 +422,8 @@ delete element inet osmo-upf tunmap-post { 4 };
 delete chain inet osmo-upf tunmap-pre-4;
 delete chain inet osmo-upf tunmap-post-4;

-DNFT DEBUG run nft ruleset: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x4 };\ndelete element inet osmo-upf tunmap-post { 3 };\ndelete chain inet osmo-upf tunmap-pre-3;\ndelete chain inet osmo-upf tunmap-post-3;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x3 };\ndelete element inet osmo-upf tunmap-post { 4 };\ndelete chain inet osmo-upf tunmap-pre-4;\ndelete chain inet osmo-upf tunmap-post-4;\n"
+
+DNFT DEBUG ran nft ruleset, 381 chars: "delete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x4 };\ndelete element inet osmo-upf tunmap-post { 3 };\ndelete chain inet osmo-upf tunmap-pre-3;\ndelete chain inet osmo-upf tunmap-post-3;\ndelete element inet osmo-upf tunmap-pre { 1.1.1.1 . 0x3 };\ndelete ..."
 DGTP NOTICE GTP:tunmap GTP-access-r:5.6.7.8 TEID-access-r:0x102 GTP-access-l:1.1.1.1 TEID-access-l:0x4 GTP-core-r:13.14.15.16 TEID-core-r:0x103 GTP-core-l:1.1.1.1 TEID-core-l:0x3 PFCP-peer:1.2.3.4 SEID-l:0x2 PDR-access:2 PDR-core:1: Disabled tunmap, nft chain IDs: access--3-> <-4--core
 DSESSION DEBUG up_session(1-2-3-4-0x2){ESTABLISHED}: Freeing instance
 DSESSION DEBUG up_session(1-2-3-4-0x2){ESTABLISHED}: Deallocated
Author	SHA1	Message	Date
Oliver Smith	12d7cf87a9	Bump version: 0.1.1.112-9c90 → 0.2.0 Change-Id: I772edbd17fcac0da597c30eecefa54f9fd8c3ed3	2024-12-11 16:56:21 +01:00
Neels Janosch Hofmeyr	9c904c185a	osmo-upf: add VTY 'gtp-echo' command Allow sending GTPv1-U Echo Requests to GTP peers via new VTY command gtp1u-echo send to (A.B.C.D\|X:X::X:X) gtp1u-echo send to (A.B.C.D\|X:X::X:X) local-ip (A.B.C.D\|X:X::X:X) gtp1u-echo send to (A.B.C.D\|X:X::X:X) local-dev DEV_NAME Related: OS#6541 Tweaked-by: Oliver Smith <osmith@sysmocom.de> Change-Id: I970dccd7a27b098eea9e660822e24e2c4b059fc6	2024-11-05 11:05:21 +01:00
Neels Janosch Hofmeyr	b3d4ca6d80	nft: batch nftables commands Store nftables ruleset commands for a limited time and a limited volume before submitting in batch, in order to minimize the overhead associated with submitting nftables commands. Configurable by 'timer nft X32' and 'X33' Change-Id: Ib0a8e86b29bab1559d94fc55a89daa00ec670318	2024-10-24 11:20:24 +00:00
Neels Janosch Hofmeyr	e16bb2826b	pfcp-tool: always use specific PDR ids for access and core Makes it easier to find the right one later. This will be used to fetch the UPF chosen TEIDs from PFCP responses in upcoming "n-sessions [4/4]" I74a21cc31296ab89a2acda1da8ae9693c1992e66. Related: SYS#6590 Change-Id: Ic343494001c70a84f3402ce5749d08e729551b26	2024-10-24 11:16:54 +00:00