WIP: Add support for GPRS NS IP Sub-Network-Service (SNS)daniel/gb-sns

Change-Id: I84786c3b43a8ae34ef3b3ba84b33c90042d234ea

6 files changed, 501 insertions, 11 deletions

diff --git a/include/osmocom/gprs/gprs_ns.h b/include/osmocom/gprs/gprs_ns.h
index c97b2004..febbde22 100644
--- a/include/osmocom/gprs/gprs_ns.h
+++ b/include/osmocom/gprs/gprs_ns.h
@@ -14,8 +14,8 @@
 
 #include <osmocom/gprs/protocol/gsm_08_16.h>
 
-#define NS_TIMERS_COUNT 7
-#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries)"
+#define NS_TIMERS_COUNT 8
+#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries|tsns-prov)"
 #define NS_TIMERS_HELP	\
 	"(un)blocking Timer (Tns-block) timeout\n"		\
 	"(un)blocking Timer (Tns-block) number of retries\n"	\
@@ -23,7 +23,8 @@
 	"Reset Timer (Tns-reset) number of retries\n"		\
 	"Test Timer (Tns-test) timeout\n"			\
 	"Alive Timer (Tns-alive) timeout\n"			\
-	"Alive Timer (Tns-alive) number of retries\n"
+	"Alive Timer (Tns-alive) number of retries\n"		\
+	"SNS Provision Timer (Tsns-prov) timeout\n"
 
 /* Educated guess - LLC user payload is 1500 bytes plus possible headers */
 #define NS_ALLOC_SIZE	3072
@@ -37,6 +38,7 @@ enum ns_timeout {
 	NS_TOUT_TNS_TEST,
 	NS_TOUT_TNS_ALIVE,
 	NS_TOUT_TNS_ALIVE_RETRIES,
+	NS_TOUT_TSNS_PROV,
 };
 
 #define NSE_S_BLOCKED	0x0001
@@ -102,6 +104,8 @@ struct gprs_ns_inst {
 		uint32_t local_ip;
 		unsigned int enabled:1;
 	} frgre;
+
+	struct osmo_fsm_inst *bss_sns_fi;
 };
 
 enum nsvc_timer_mode {
@@ -169,6 +173,9 @@ struct gprs_nsvc *gprs_ns_nsip_connect(struct gprs_ns_inst *nsi,
 					struct sockaddr_in *dest,
 					uint16_t nsei, uint16_t nsvci);
 
+/* Establish a connection (from the BSS) to the SGSN using IP SNS */
+struct gprs_nsvc *gprs_ns_nsip_connect_sns(struct gprs_ns_inst *nsi, struct sockaddr_in *dest,
+					   uint16_t nsei, uint16_t nsvci);
 
 struct sockaddr_in;
 
@@ -211,6 +218,7 @@ enum signal_ns {
 	S_NS_ALIVE_EXP,	/* Tns-alive expired more than N times */
 	S_NS_REPLACED, /* nsvc object is replaced (sets old_nsvc) */
 	S_NS_MISMATCH, /* got an unexpected IE (sets msg, pdu_type, ie_type) */
+	S_SNS_CONFIGURED, /* IP-SNS configuration completed */
 };
 
 extern const struct value_string gprs_ns_signal_ns_names[];
diff --git a/src/gb/Makefile.am b/src/gb/Makefile.am
index 65b73fef..9fed587a 100644
--- a/src/gb/Makefile.am
+++ b/src/gb/Makefile.am
@@ -17,7 +17,7 @@ libosmogb_la_LIBADD = $(TALLOC_LIBS) \
 		$(top_builddir)/src/vty/libosmovty.la \
 		$(top_builddir)/src/gsm/libosmogsm.la
 
-libosmogb_la_SOURCES = gprs_ns.c gprs_ns_frgre.c gprs_ns_vty.c \
+libosmogb_la_SOURCES = gprs_ns.c gprs_ns_frgre.c gprs_ns_vty.c gprs_ns_sns.c \
 		  gprs_bssgp.c gprs_bssgp_util.c gprs_bssgp_vty.c \
 		  gprs_bssgp_bss.c common_vty.c
 endif
diff --git a/src/gb/gb_internal.h b/src/gb/gb_internal.h
new file mode 100644
index 00000000..9130935b
--- /dev/null
+++ b/src/gb/gb_internal.h
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+/* gprs_ns_sns.c */
+int gprs_ns_rx_sns(struct gprs_ns_inst *nsi, struct msgb *msg, struct tlv_parsed *tp);
+
+/* gprs_ns.c */
+int gprs_ns_tx_sns_config(struct gprs_nsvc *nsvc, bool end_flag,
+			  const struct gprs_ns_ie_ip4_elem *ip4_elems,
+			  unsigned int num_ip4_elems);
+
+int gprs_ns_tx_sns_config_ack(struct gprs_nsvc *nsvc, uint8_t *cause);
+
+int gprs_ns_tx_sns_size(struct gprs_nsvc *nsvc, bool reset_flag, uint16_t max_nr_nsvc,
+			uint16_t *ip4_ep_nr, uint16_t *ip6_ep_nr);
+
+int gprs_ns_tx_sns_size_ack(struct gprs_nsvc *nsvc, uint8_t *cause);
+
+struct osmo_fsm_inst *gprs_sns_bss_fsm_start(void *ctx, struct gprs_nsvc *nsvc, const char *id);
+int gprs_sns_init(void);
diff --git a/src/gb/gprs_ns.c b/src/gb/gprs_ns.c
index 4704ed60..ea655e4a 100644
--- a/src/gb/gprs_ns.c
+++ b/src/gb/gprs_ns.c
@@ -71,6 +71,7 @@
 #include <sys/socket.h>
 #include <arpa/inet.h>
 
+#include <osmocom/core/fsm.h>
 #include <osmocom/core/msgb.h>
 #include <osmocom/core/byteswap.h>
 #include <osmocom/gsm/tlv.h>
@@ -86,6 +87,7 @@
 #include <osmocom/gprs/gprs_ns_frgre.h>
 
 #include "common_vty.h"
+#include "gb_internal.h"
 
 #define ns_set_state(ns_, st_) ns_set_state_with_log(ns_, st_, false, __FILE__, __LINE__)
 #define ns_set_remote_state(ns_, st_) ns_set_state_with_log(ns_, st_, true, __FILE__, __LINE__)
@@ -99,6 +101,12 @@ static const struct tlv_definition ns_att_tlvdef = {
 		[NS_IE_PDU]	= { TLV_TYPE_TvLV, 0 },
 		[NS_IE_BVCI]	= { TLV_TYPE_TvLV, 0 },
 		[NS_IE_NSEI]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_IPv4_LIST] = { TLV_TYPE_TvLV, 0 },
+		[NS_IE_IPv6_LIST] = { TLV_TYPE_TvLV, 0 },
+		[NS_IE_MAX_NR_NSVC] = { TLV_TYPE_FIXED, 2 },
+		[NS_IE_IPv4_EP_NR] = { TLV_TYPE_FIXED, 2 },
+		[NS_IE_IPv6_EP_NR] = { TLV_TYPE_FIXED, 2 },
+		[NS_IE_RESET_FLAG] = { TLV_TYPE_TV, 0 },
 	},
 };
 
@@ -163,6 +171,7 @@ const struct value_string gprs_ns_signal_ns_names[] = {
 	{ S_NS_ALIVE_EXP,	"NS-ALIVE expired" },
 	{ S_NS_REPLACED,	"NSVC replaced" },
 	{ S_NS_MISMATCH,	"Unexpected IE" },
+	{ S_SNS_CONFIGURED,	"SNS Configured" },
 	{ 0, NULL }
 };
 
@@ -716,9 +725,9 @@ static int gprs_ns_tx_reset_ack(struct gprs_nsvc *nsvc)
 }
 
 /* Section 9.3.4 */
-static int gprs_ns_tx_sns_config(struct gprs_nsvc *nsvc, bool end_flag,
-				 const struct gprs_ns_ie_ip4_elem *ip4_elems,
-				 unsigned int num_ip4_elems)
+int gprs_ns_tx_sns_config(struct gprs_nsvc *nsvc, bool end_flag,
+			  const struct gprs_ns_ie_ip4_elem *ip4_elems,
+			  unsigned int num_ip4_elems)
 {
 	struct msgb *msg = gprs_ns_msgb_alloc();
 	struct gprs_ns_hdr *nsh;
@@ -747,7 +756,7 @@ static int gprs_ns_tx_sns_config(struct gprs_nsvc *nsvc, bool end_flag,
 }
 
 /* Section 9.3.5 */
-static int gprs_ns_tx_sns_config_ack(struct gprs_nsvc *nsvc, uint8_t *cause)
+int gprs_ns_tx_sns_config_ack(struct gprs_nsvc *nsvc, uint8_t *cause)
 {
 	struct msgb *msg = gprs_ns_msgb_alloc();
 	struct gprs_ns_hdr *nsh;
@@ -773,8 +782,8 @@ static int gprs_ns_tx_sns_config_ack(struct gprs_nsvc *nsvc, uint8_t *cause)
 
 
 /* Section 9.3.7 */
-static int gprs_ns_tx_sns_size(struct gprs_nsvc *nsvc, bool reset_flag, uint16_t max_nr_nsvc,
-				uint16_t *ip4_ep_nr, uint16_t *ip6_ep_nr)
+int gprs_ns_tx_sns_size(struct gprs_nsvc *nsvc, bool reset_flag, uint16_t max_nr_nsvc,
+			uint16_t *ip4_ep_nr, uint16_t *ip6_ep_nr)
 {
 	struct msgb *msg = gprs_ns_msgb_alloc();
 	struct gprs_ns_hdr *nsh;
@@ -803,7 +812,7 @@ static int gprs_ns_tx_sns_size(struct gprs_nsvc *nsvc, bool reset_flag, uint16_t
 }
 
 /* Section 9.3.8 */
-static int gprs_ns_tx_sns_size_ack(struct gprs_nsvc *nsvc, uint8_t *cause)
+int gprs_ns_tx_sns_size_ack(struct gprs_nsvc *nsvc, uint8_t *cause)
 {
 	struct msgb *msg = gprs_ns_msgb_alloc();
 	struct gprs_ns_hdr *nsh;
@@ -1475,6 +1484,7 @@ int gprs_ns_process_msg(struct gprs_ns_inst *nsi, struct msgb *msg,
 			struct gprs_nsvc **nsvc)
 {
 	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
 	int rc = 0;
 
 	msgb_nsei(msg) = (*nsvc)->nsei;
@@ -1551,6 +1561,33 @@ int gprs_ns_process_msg(struct gprs_ns_inst *nsi, struct msgb *msg,
 		/* mark remote NS-VC as blocked + active */
 		ns_set_remote_state(*nsvc, NSE_S_BLOCKED | NSE_S_ALIVE);
 		break;
+	case SNS_PDUT_CONFIG:
+		/* one additional byte ('end flag') before the TLV part starts */
+		rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data+1,
+				msgb_l2len(msg) - sizeof(*nsh)-1, 0, 0);
+		if (rc < 0) {
+			LOGPC(DNS, LOGL_NOTICE, "Error during TLV Parse in %s\n", msgb_hexdump(msg));
+			return rc;
+		}
+		/* All sub-network service related message types */
+		rc = gprs_ns_rx_sns(nsi, msg, &tp);
+		break;
+	case SNS_PDUT_ACK:
+	case SNS_PDUT_ADD:
+	case SNS_PDUT_CHANGE_WEIGHT:
+	case SNS_PDUT_CONFIG_ACK:
+	case SNS_PDUT_DELETE:
+	case SNS_PDUT_SIZE:
+	case SNS_PDUT_SIZE_ACK:
+		rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+				msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+		if (rc < 0) {
+			LOGPC(DNS, LOGL_NOTICE, "Error during TLV Parse in %s\n", msgb_hexdump(msg));
+			return rc;
+		}
+		/* All sub-network service related message types */
+		rc = gprs_ns_rx_sns(nsi, msg, &tp);
+		break;
 	default:
 		LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx Unknown NS PDU type 0x%02x\n",
 			(*nsvc)->nsei, nsh->pdu_type);
@@ -1560,6 +1597,8 @@ int gprs_ns_process_msg(struct gprs_ns_inst *nsi, struct msgb *msg,
 	return rc;
 }
 
+static bool gprs_sns_fsm_registered = false;
+
 /*! Create a new GPRS NS instance
  *  \param[in] cb Call-back function for incoming BSSGP data
  *  \returns dynamically allocated gprs_ns_inst
@@ -1568,6 +1607,11 @@ struct gprs_ns_inst *gprs_ns_instantiate(gprs_ns_cb_t *cb, void *ctx)
 {
 	struct gprs_ns_inst *nsi = talloc_zero(ctx, struct gprs_ns_inst);
 
+	if (!gprs_sns_fsm_registered) {
+		gprs_sns_init();
+		gprs_sns_fsm_registered = true;
+	}
+
 	nsi->cb = cb;
 	INIT_LLIST_HEAD(&nsi->gprs_nsvcs);
 	nsi->timeout[NS_TOUT_TNS_BLOCK] = 3;
@@ -1577,6 +1621,7 @@ struct gprs_ns_inst *gprs_ns_instantiate(gprs_ns_cb_t *cb, void *ctx)
 	nsi->timeout[NS_TOUT_TNS_TEST] = 30;
 	nsi->timeout[NS_TOUT_TNS_ALIVE] = 3;
 	nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES] = 10;
+	nsi->timeout[NS_TOUT_TSNS_PROV] = 3; /* 1..10 */
 
 	/* Create the dummy NSVC that we use for sending
 	 * messages to non-existant/unknown NS-VC's */
@@ -1823,6 +1868,44 @@ struct gprs_nsvc *gprs_ns_nsip_connect(struct gprs_ns_inst *nsi,
 	return nsvc;
 }
 
+/*! Establish a NS connection (from the BSS) to the SGSN using SNS auto-configuration
+ *  \param nsi NS-instance
+ *  \param[in] dest Destination IP/Port
+ *  \param[in] nsei NSEI of the to-be-established NS-VC
+ *  \param[in] nsvci NSVCI of the to-be-established NS-VC
+ *  \returns struct gprs_nsvc representing the new NS-VC
+ *
+ * This function will establish a single NS/UDP/IP connection in uplink
+ * (BSS to SGSN) direction.  It will start with the SNS-SIZE procedure,
+ * followed by BSS-originated SNS-CONFIG, then SGSN-originated SNS-CONFIG.
+ *
+ * Once configuration completes, the user will be notified by the S_SNS_CONFIGURED signal,
+ * at which point he typically would want to initiate NS-RESET by means of gprs_nsvc_reset().
+ */
+struct gprs_nsvc *gprs_ns_nsip_connect_sns(struct gprs_ns_inst *nsi,
+				struct sockaddr_in *dest, uint16_t nsei,
+				uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+
+	/* FIXME: We are getting the order wrong here.  Normally, one would want
+	 * to start the SNS FSM *before* creating any NS-VC and then create the NS-VC
+	 * after the SNS layer has established the IP/port/etc.  However, this would
+	 * require some massive code and API changes compared to existing libosmogb,
+	 * so let's keep the old logic. */
+	nsvc = nsvc_by_rem_addr(nsi, dest);
+	if (!nsvc)
+		nsvc = gprs_nsvc_create(nsi, nsvci);
+	nsvc->ip.bts_addr = *dest;
+	nsvc->nsei = nsei;
+	nsvc->remote_end_is_sgsn = 1;
+
+	if (nsi->bss_sns_fi)
+		osmo_fsm_inst_term(nsi->bss_sns_fi, OSMO_FSM_TERM_REQUEST, NULL);
+	nsi->bss_sns_fi = gprs_sns_bss_fsm_start(nsi, nsvc, "NSIP");
+	return nsvc;
+}
+
 void gprs_ns_set_log_ss(int ss)
 {
 	DNS = ss;
diff --git a/src/gb/gprs_ns_sns.c b/src/gb/gprs_ns_sns.c
new file mode 100644
index 00000000..ddd641f8
--- /dev/null
+++ b/src/gb/gprs_ns_sns.c
@@ -0,0 +1,375 @@
+/* Implementation of 3GPP TS 48.016 NS IP Sub-Network Service */
+/* (C) 2018 by Harald Welte <laforge@gnumonks.org> */
+
+/* The BSS NSE only has one SGSN IP address configured, and it will use the SNS procedures
+ * to communicated its local IPs/ports as well as all the SGSN side IPs/ports and
+ * associated weights.  In theory, the BSS then uses this to establish a full mesh
+ * of NSVCs between all BSS-side IPs/ports and SGSN-side IPs/ports */
+
+#include <errno.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gprs/gprs_msgb.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+#include "gb_internal.h"
+
+#define S(x)	(1 << (x))
+
+struct gprs_sns_state {
+	struct gprs_ns_inst *nsi;
+	struct gprs_nsvc *nsvc_hack;
+
+	/* local configuration to send to the remote end */
+	struct gprs_ns_ie_ip4_elem *ip4_local;
+	size_t num_ip4_local;
+
+	/* remote configuration as received */
+	struct gprs_ns_ie_ip4_elem *ip4_remote;
+	unsigned int num_ip4_remote;
+};
+
+static inline struct gprs_ns_inst *ns_inst_from_fi(struct osmo_fsm_inst *fi)
+{
+	struct gprs_sns_state *gss = (struct gprs_sns_state *) fi->priv;
+	return gss->nsi;
+}
+
+/***********************************************************************
+ * BSS-side FSM for IP Sub-Network Service
+ ***********************************************************************/
+
+enum gprs_sns_bss_state {
+	GPRS_SNS_ST_UNCONFIGURED,
+	GPRS_SNS_ST_SIZE,		/*!< SNS-SIZE procedure ongoing */
+	GPRS_SNS_ST_CONFIG_BSS,		/*!< SNS-CONFIG procedure (BSS->SGSN) ongoing */
+	GPRS_SNS_ST_CONFIG_SGSN,	/*!< SNS-CONFIG procedure (SGSN->BSS) ongoing */
+	GPRS_SNS_ST_CONFIGURED,
+};
+
+enum gprs_sns_event {
+	GPRS_SNS_EV_START,
+	GPRS_SNS_EV_SIZE,
+	GPRS_SNS_EV_SIZE_ACK,
+	GPRS_SNS_EV_CONFIG,
+	GPRS_SNS_EV_CONFIG_END,		/*!< SNS-CONFIG with end flag received */
+	GPRS_SNS_EV_CONFIG_ACK,
+};
+
+static const struct value_string gprs_sns_event_names[] = {
+	{ GPRS_SNS_EV_START, 		"START" },
+	{ GPRS_SNS_EV_SIZE,		"SIZE" },
+	{ GPRS_SNS_EV_SIZE_ACK,		"SIZE_ACK" },
+	{ GPRS_SNS_EV_CONFIG,		"CONFIG" },
+	{ GPRS_SNS_EV_CONFIG_END,	"CONFIG_END" },
+	{ GPRS_SNS_EV_CONFIG_ACK,	"CONFIG_ACK" },
+	{ 0, NULL }
+};
+
+static void gprs_sns_st_unconfigured(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gprs_ns_inst *nsi = ns_inst_from_fi(fi);
+	switch (event) {
+	case GPRS_SNS_EV_START:
+		osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_SIZE, nsi->timeout[NS_TOUT_TSNS_PROV], 1);
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+
+static void gprs_sns_st_size(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gprs_ns_inst *nsi = ns_inst_from_fi(fi);
+	struct tlv_parsed *tp = NULL;
+
+	switch (event) {
+	case GPRS_SNS_EV_SIZE_ACK:
+		tp = data;
+		if (TLVP_VAL_MINLEN(tp, NS_IE_CAUSE, 1)) {
+			LOGPFSML(fi, LOGL_ERROR, "SNS-SIZE-ACK with cause %s\n",
+				 gprs_ns_cause_str(*TLVP_VAL(tp, NS_IE_CAUSE)));
+		} else {
+			osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_CONFIG_BSS,
+						nsi->timeout[NS_TOUT_TSNS_PROV], 2);
+		}
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+static void gprs_sns_st_size_onenter(struct osmo_fsm_inst *fi, uint32_t old_state)
+{
+	struct gprs_sns_state *gss = (struct gprs_sns_state *) fi->priv;
+	uint16_t num = gss->num_ip4_local;
+
+	gprs_ns_tx_sns_size(gss->nsvc_hack, true, num, &num, NULL);
+}
+
+
+static void gprs_sns_st_config_bss(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	//struct gprs_sns_state *gss = (struct gprs_sns_state *) fi->priv;
+	//struct gprs_ns_inst *nsi = ns_inst_from_fi(fi);
+	struct tlv_parsed *tp = NULL;
+
+	switch (event) {
+	case GPRS_SNS_EV_CONFIG_ACK:
+		tp = data;
+		if (TLVP_VAL_MINLEN(tp, NS_IE_CAUSE, 1)) {
+			LOGPFSML(fi, LOGL_ERROR, "SNS-CONFIG-ACK with cause %s\n",
+				 gprs_ns_cause_str(*TLVP_VAL(tp, NS_IE_CAUSE)));
+		} else {
+			osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_CONFIG_SGSN, 0, 0);
+		}
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+static void gprs_sns_st_config_bss_onenter(struct osmo_fsm_inst *fi, uint32_t old_state)
+{
+	struct gprs_sns_state *gss = (struct gprs_sns_state *) fi->priv;
+	/* Transmit SNS-CONFIG */
+	gprs_ns_tx_sns_config(gss->nsvc_hack, true, gss->ip4_local, gss->num_ip4_local);
+}
+
+static void gprs_sns_st_config_sgsn(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gprs_sns_state *gss = (struct gprs_sns_state *) fi->priv;
+	struct tlv_parsed *tp = NULL;
+
+	switch (event) {
+	case GPRS_SNS_EV_CONFIG_END:
+	case GPRS_SNS_EV_CONFIG:
+		tp = data;
+#if 0		/* part of incoming SNS-SIZE (doesn't happen on BSS side */
+		if (TLVP_PRESENT(tp, NS_IE_RESET_FLAG)) {
+			/* reset all existing config */
+			if (gss->ip4_remote)
+				talloc_free(gss->ip4_remote);
+			gss->num_ip4_remote = 0;
+		}
+#endif
+		if (TLVP_PRESENT(tp, NS_IE_IPv4_LIST)) {
+			const struct gprs_ns_ie_ip4_elem *v4_list;
+			unsigned int num_v4;
+			v4_list = (const struct gprs_ns_ie_ip4_elem *) TLVP_VAL(tp, NS_IE_IPv4_LIST);
+			num_v4 = TLVP_LEN(tp, NS_IE_IPv4_LIST) / sizeof(*v4_list);
+			/* realloc to the new size */
+			gss->ip4_remote = talloc_realloc(gss, gss->ip4_remote,
+							 struct gprs_ns_ie_ip4_elem,
+							 gss->num_ip4_remote+num_v4);
+			/* append the new entries to the end of the list */
+			memcpy(&gss->ip4_remote[gss->num_ip4_remote], v4_list, num_v4);
+			gss->num_ip4_remote += num_v4;
+		} else {
+			uint8_t cause = NS_CAUSE_INVAL_NR_IPv4_EP;
+			gprs_ns_tx_sns_config_ack(gss->nsvc_hack, &cause);
+			/* state change? */
+		}
+		LOGPFSML(fi, LOGL_INFO, "Rx SNS-CONFIG: Remote IPv4 list now %u entries\n",
+			 gss->num_ip4_remote);
+		if (event == GPRS_SNS_EV_CONFIG_END) {
+			osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_CONFIGURED, 0, 0);
+		}
+		/* send CONFIG-ACK */
+		gprs_ns_tx_sns_config_ack(gss->nsvc_hack, NULL);
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+
+static void gprs_sns_st_configured(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	/* FIXME: ADD/DELETE procedures */
+}
+
+static void gprs_sns_st_configured_onenter(struct osmo_fsm_inst *fi, uint32_t old_state)
+{
+	struct ns_signal_data nssd = {0};
+	osmo_signal_dispatch(SS_L_NS, S_SNS_CONFIGURED, &nssd);
+}
+
+static const struct osmo_fsm_state gprs_sns_bss_states[] = {
+	[GPRS_SNS_ST_UNCONFIGURED] = {
+		.in_event_mask = S(GPRS_SNS_EV_START),
+		.out_state_mask = S(GPRS_SNS_ST_SIZE),
+		.name = "UNCONFIGURED",
+		.action = gprs_sns_st_unconfigured,
+	},
+	[GPRS_SNS_ST_SIZE] = {
+		.in_event_mask = S(GPRS_SNS_EV_SIZE_ACK),
+		.out_state_mask = S(GPRS_SNS_ST_UNCONFIGURED) |
+				  S(GPRS_SNS_ST_SIZE) |
+				  S(GPRS_SNS_ST_CONFIG_BSS),
+		.name = "SIZE",
+		.action = gprs_sns_st_size,
+		.onenter = gprs_sns_st_size_onenter,
+	},
+	[GPRS_SNS_ST_CONFIG_BSS] = {
+		.in_event_mask = S(GPRS_SNS_EV_CONFIG_ACK),
+		.out_state_mask = S(GPRS_SNS_ST_UNCONFIGURED) |
+				  S(GPRS_SNS_ST_CONFIG_BSS) |
+				  S(GPRS_SNS_ST_CONFIG_SGSN),
+		.name = "CONFIG_BSS",
+		.action = gprs_sns_st_config_bss,
+		.onenter = gprs_sns_st_config_bss_onenter,
+	},
+	[GPRS_SNS_ST_CONFIG_SGSN] = {
+		.in_event_mask = S(GPRS_SNS_EV_CONFIG) |
+				 S(GPRS_SNS_EV_CONFIG_END),
+		.out_state_mask = S(GPRS_SNS_ST_UNCONFIGURED) |
+				  S(GPRS_SNS_ST_CONFIG_SGSN) |
+				  S(GPRS_SNS_ST_CONFIGURED),
+		.name = "CONFIG_SGSN",
+		.action = gprs_sns_st_config_sgsn,
+	},
+	[GPRS_SNS_ST_CONFIGURED] = {
+		//.in_event_mask = S(),
+		.out_state_mask = S(GPRS_SNS_ST_UNCONFIGURED),
+		.name = "CONFIGURED",
+		.action = gprs_sns_st_configured,
+		.onenter = gprs_sns_st_configured_onenter,
+	},
+};
+
+static int gprs_sns_fsm_bss_timer_cb(struct osmo_fsm_inst *fi)
+{
+	struct gprs_ns_inst *nsi = ns_inst_from_fi(fi);
+
+	switch (fi->T) {
+	case 1:
+		osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_SIZE, nsi->timeout[NS_TOUT_TSNS_PROV], 1);
+		break;
+	case 2:
+		osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_CONFIG_BSS, nsi->timeout[NS_TOUT_TSNS_PROV], 2);
+		break;
+	}
+	return 0;
+}
+
+static struct osmo_fsm gprs_sns_bss_fsm = {
+	.name = "GPRS-SNS-BSS",
+	.states = gprs_sns_bss_states,
+	.num_states = ARRAY_SIZE(gprs_sns_bss_states),
+	.allstate_event_mask = 0,
+	.allstate_action = NULL,
+	.cleanup = NULL,
+	.timer_cb = gprs_sns_fsm_bss_timer_cb,
+	/* .log_subsys = DNS, "is not constant" */
+	.event_names = gprs_sns_event_names,
+	.pre_term = NULL,
+};
+
+struct osmo_fsm_inst *gprs_sns_bss_fsm_start(void *ctx, struct gprs_nsvc *nsvc,
+					     const char *id)
+{
+	struct osmo_fsm_inst *fi;
+	struct gprs_sns_state *gss;
+	struct gprs_ns_ie_ip4_elem *ip4;
+	struct gprs_ns_inst *nsi = nsvc->nsi;
+
+	fi = osmo_fsm_inst_alloc(&gprs_sns_bss_fsm, ctx, NULL, LOGL_DEBUG, id);
+	if (!fi)
+		return fi;
+
+	gss = talloc_zero(fi, struct gprs_sns_state);
+	if (!gss)
+		goto err;
+
+	fi->priv = gss;
+	gss->nsi = nsi;
+	/* FIXME: we shouldn't use 'nsvc' here but only gprs_ns_inst */
+	gss->nsvc_hack = nsvc;
+
+	/* create IPv4 list from the one IP/port the NS instance has */
+	ip4 = talloc_zero(gss, struct gprs_ns_ie_ip4_elem);
+	if (!ip4)
+		goto err;
+	if (nsi->nsip.local_ip)
+		ip4->ip_addr = htonl(nsi->nsip.local_ip);
+	else {
+		/* unspecified local address. Figure out which address the kernel would use if we
+		 * wanted to send a packet to the remote_ip */
+		char local_ip[32];
+		struct in_addr in = { .s_addr = htonl(nsi->nsip.remote_ip) };
+		osmo_sock_local_ip(local_ip, inet_ntoa(in));
+		ip4->ip_addr = inet_addr(local_ip);
+	}
+	ip4->udp_port = htons(gss->nsi->nsip.local_port);
+	ip4->sig_weight = 2;
+	ip4->data_weight = 1;
+	gss->ip4_local = ip4;
+	gss->num_ip4_local = 1;
+
+	/* start the FSM */
+	osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_START, NULL);
+
+	return fi;
+err:
+	osmo_fsm_inst_term(fi, OSMO_FSM_TERM_ERROR, NULL);
+	return NULL;
+}
+
+
+/* main entry point for receiving SNS messages from the network */
+int gprs_ns_rx_sns(struct gprs_ns_inst *nsi, struct msgb *msg, struct tlv_parsed *tp)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	uint16_t nsei = msgb_nsei(msg);
+	struct osmo_fsm_inst *fi;
+
+	LOGP(DNS, LOGL_DEBUG, "NSEI=%u Rx SNS PDU type %s\n", nsei,
+		get_value_string(gprs_ns_pdu_strings, nsh->pdu_type));
+
+	/* FIXME: how to resolve SNS FSM Instance by NSEI (SGSN)? */
+	fi = nsi->bss_sns_fi;
+
+	switch (nsh->pdu_type) {
+	case SNS_PDUT_SIZE:
+		osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_SIZE, tp);
+		break;
+	case SNS_PDUT_SIZE_ACK:
+		osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_SIZE_ACK, tp);
+		break;
+	case SNS_PDUT_CONFIG:
+		if (nsh->data[0] & 0x01)
+			osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_CONFIG_END, tp);
+		else
+			osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_CONFIG, tp);
+		break;
+	case SNS_PDUT_CONFIG_ACK:
+		osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_CONFIG_ACK, tp);
+		break;
+	case SNS_PDUT_ACK:
+	case SNS_PDUT_ADD:
+	case SNS_PDUT_DELETE:
+	case SNS_PDUT_CHANGE_WEIGHT:
+		LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx unsupported SNS PDU type %s\n", nsei,
+			get_value_string(gprs_ns_pdu_strings, nsh->pdu_type));
+		break;
+	default:
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx unknown SNS PDU type %s\n", nsei,
+			get_value_string(gprs_ns_pdu_strings, nsh->pdu_type));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int gprs_sns_init(void)
+{
+	/* "DNS" is not a constant/#define, but an integer variable set by the client app */
+	gprs_sns_bss_fsm.log_subsys = DNS;
+	return osmo_fsm_register(&gprs_sns_bss_fsm);
+}
diff --git a/src/gb/libosmogb.map b/src/gb/libosmogb.map
index ec69670e..2ad3ff71 100644
--- a/src/gb/libosmogb.map
+++ b/src/gb/libosmogb.map
@@ -52,6 +52,7 @@ gprs_ns_frgre_sendmsg;
 gprs_ns_instantiate;
 gprs_ns_nsip_listen;
 gprs_ns_nsip_connect;
+gprs_ns_nsip_connect_sns;
 gprs_ns_rcvmsg;
 gprs_ns_sendmsg;
 gprs_ns_set_log_ss;