pfcp: fix modification of wrong FAR ID

Do not update the Core-facing Forwarding Action Rule with the Access
side's remote TEID, update the Access-facing FAR as we should.

This is a seemingly small but very grave bug in osmo-hnbgw's PFCP
implementation, and proof that no-one anywhere has tested osmo-hnbgw's
PFCP support properly yet.

Related: SYS#5895
Change-Id: I596f1785d280d7e53e0cef649d6bb5df01ebf648
---
M src/osmo-hnbgw/ps_rab_fsm.c
1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/osmo-hnbgw/ps_rab_fsm.c b/src/osmo-hnbgw/ps_rab_fsm.c
index df98826..512c983 100644
--- a/src/osmo-hnbgw/ps_rab_fsm.c
+++ b/src/osmo-hnbgw/ps_rab_fsm.c
@@ -519,7 +519,8 @@
 static void ps_rab_fsm_wait_pfcp_mod_resp_onenter(struct osmo_fsm_inst *fi, uint32_t prev_state)
 {
 	/* We have been given the Access side's remote F-TEID, now in rab->access.remote, and we need to tell the UPF
-	 * about it. */
+	 * about it. This affects the Core to Access direction: now we know where to forward payloads coming from Core.
+	 */
 	struct ps_rab *rab = fi->priv;
 	struct osmo_pfcp_msg *m;
 
@@ -531,7 +532,7 @@
 
 	m = ps_rab_new_pfcp_msg_req(rab, OSMO_PFCP_MSGT_SESSION_MOD_REQ);
 
-	if (rab_to_pfcp_session_mod_req_upd_far(&m->ies.session_mod_req, ID_ACCESS_TO_CORE, &rab->access.remote)) {
+	if (rab_to_pfcp_session_mod_req_upd_far(&m->ies.session_mod_req, ID_CORE_TO_ACCESS, &rab->access.remote)) {
 		LOG_PS_RAB(rab, LOGL_ERROR, "error composing Update FAR IE in PFCP msg\n");
 		ps_rab_failure(rab);
 		return;

