From 5e9e6c046f139318545c08cd3b964ecd6a10dab2 Mon Sep 17 00:00:00 2001
From: Adityaaa <144815351+addydude@users.noreply.github.com>
Date: Thu, 12 Nov 2026 23:35:10 +0530
Subject: [PATCH] pfcp: dissect the UE IP Address IPv6D, CHV4, CHV6 and IP6PL
 flags

3GPP TS 29.244 clause 8.2.62 assigns bits 4 to 7 of octet 5 to these flags and only bit 8 is spare. The IPv6 prefix delegation bits and the IPv6 prefix length announced by IPv6D and IP6PL are decoded after the IPv6 address.

AI-Assisted: yes (DeepSeek V4.1 Flash)
---
 scapy/contrib/pfcp.py | 10 +++++++++-
 test/contrib/pfcp.uts | 11 +++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/scapy/contrib/pfcp.py b/scapy/contrib/pfcp.py
index 57a9cf1fda0..3dc3338a024 100644
--- a/scapy/contrib/pfcp.py
+++ b/scapy/contrib/pfcp.py
@@ -1549,12 +1549,20 @@ class IE_UE_IP_Address(IE_Base):
     name = "IE UE IP Address"
     ie_type = 93
     fields_desc = IE_Base.fields_desc + [
-        XBitField("spare", 0, 5),
+        XBitField("spare", 0, 1),
+        BitField("IP6PL", 0, 1),
+        BitField("CHV6", 0, 1),
+        BitField("CHV4", 0, 1),
+        BitField("IPv6D", 0, 1),
         BitField("SD", 0, 1),  # source or dest
         BitField("V4", 0, 1),
         BitField("V6", 0, 1),
         ConditionalField(IPField("ipv4", 0), lambda x: x.V4 == 1),
         ConditionalField(IP6Field("ipv6", 0), lambda x: x.V6 == 1),
+        ConditionalField(ByteField("ipv6_prefix_delegation_bits", 0),
+                         lambda x: x.IPv6D == 1),
+        ConditionalField(ByteField("ipv6_prefix_length", 0),
+                         lambda x: x.IP6PL == 1),
         ExtraDataField("extra_data"),
     ]
 
diff --git a/test/contrib/pfcp.uts b/test/contrib/pfcp.uts
index df2d581b2b6..dc61e4b9d14 100644
--- a/test/contrib/pfcp.uts
+++ b/test/contrib/pfcp.uts
@@ -767,6 +767,17 @@ cases = [
     dict(
         hex="006700050280df69b2",
         expect=IE_RemoteGTP_U_Peer(V4=1, ipv4="128.223.105.178")),
+    dict(
+        hex="005d000110",
+        expect=IE_UE_IP_Address(CHV4=1)),
+    dict(
+        hex="005d00120920010db800000000000000000000000004",
+        expect=IE_UE_IP_Address(V6=1, ipv6="2001:db8::", IPv6D=1,
+                                ipv6_prefix_delegation_bits=4)),
+    dict(
+        hex="005d00124120010db800000000000000000000000038",
+        expect=IE_UE_IP_Address(V6=1, ipv6="2001:db8::", IP6PL=1,
+                                ipv6_prefix_length=56)),
 ]
 
 for case in cases: