gbproxy/test: Extend P-TMSI patch test by a sequence of RA UDP REQ

This adds a sequence of two RA update procedures to
test_gbproxy_ptmsi_patching(). Each of them assigns a new P-TMSI.

Note that the implementation fails to patch the RAI within the
message labelled 'RA UDP ACC (P-TMSI 3)' and logs 'TLLI sent by the
SGSN is unknown'.

Sponsored-by: On-Waves ehf

2 files changed, 293 insertions, 62 deletions

diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c
index 514881e6f..9d5b84969 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.c
+++ b/openbsc/tests/gbproxy/gbproxy_test.c
@@ -195,7 +195,7 @@ static const unsigned char dtap_attach_acc[] = {
 	0x16, 0x18, 0x05, 0xf4, 0xef, 0xe2, 0xb7, 0x00
 };
 
-/* DTAP - Attach Accept, IMSI 2 */
+/* DTAP - Attach Accept, P-TMSI 2 */
 static const unsigned char dtap_attach_acc2[] = {
 	0x08, 0x02, 0x01, 0x49, 0x04, 0x21, 0x63, 0x54,
 	0x40, 0x50, 0x60, 0x19, 0xcd, 0xd7, 0x08, 0x17,
@@ -230,6 +230,26 @@ static const unsigned char dtap_ra_upd_acc[] = {
 	0x05, 0xf4, 0xef, 0xe2, 0xb7, 0x00, 0x17, 0x16,
 };
 
+/* DTAP - Routing Area Update Accept, P-TMSI 2 */
+static const unsigned char dtap_ra_upd_acc2[] = {
+	0x08, 0x09, 0x00, 0x49, 0x21, 0x63, 0x54,
+	0x40, 0x50, 0x60, 0x19, 0x54, 0xab, 0xb3, 0x18,
+	0x05, 0xf4, 0xe0, 0x98, 0x76, 0x54, 0x17, 0x16,
+};
+
+/* DTAP - Routing Area Update Accept, P-TMSI 3 */
+static const unsigned char dtap_ra_upd_acc3[] = {
+	0x08, 0x09, 0x00, 0x49, 0x21, 0x63, 0x54,
+	0x40, 0x50, 0x60, 0x19, 0x54, 0xab, 0xb3, 0x18,
+	0x05, 0xf4, 0xe0, 0x54, 0x32, 0x10, 0x17, 0x16,
+};
+
+/* DTAP - Routing Area Update Complete */
+static const unsigned char dtap_ra_upd_complete[] = {
+	0x08, 0x0a
+};
+
+
 /* DTAP - Activate PDP Context Request */
 static const unsigned char dtap_act_pdp_ctx_req[] = {
 	0x0a, 0x41, 0x05, 0x03, 0x0c, 0x00,
@@ -1501,11 +1521,19 @@ static void test_gbproxy_ptmsi_patching()
 	uint16_t cell_id = 0x1234;
 
 	const uint32_t sgsn_ptmsi = 0xefe2b700;
+	const uint32_t sgsn_ptmsi2 = 0xe0987654;
+	const uint32_t sgsn_ptmsi3 = 0xe0543210;
 	const uint32_t local_sgsn_tlli = 0xefe2b700;
+	const uint32_t local_sgsn_tlli2 = 0xe0987654;
+	const uint32_t local_sgsn_tlli3 = 0xe0543210;
 	const uint32_t random_sgsn_tlli = 0x7c69fb81;
 
 	const uint32_t bss_ptmsi = 0xc00f7304;
+	const uint32_t bss_ptmsi2 = 0xe656aa1f;
+	const uint32_t bss_ptmsi3 = 0xead4775a;
 	const uint32_t local_bss_tlli = 0xc00f7304;
+	const uint32_t local_bss_tlli2 = 0xe656aa1f;
+	const uint32_t local_bss_tlli3 = 0xead4775a;
 	const uint32_t foreign_bss_tlli = 0x8000dead;
 
 	const uint8_t imsi[] = {0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18};
@@ -1515,6 +1543,11 @@ static void test_gbproxy_ptmsi_patching()
 	unsigned sgsn_nu = 0;
 
 	OSMO_ASSERT(local_sgsn_tlli == gprs_tmsi2tlli(sgsn_ptmsi, TLLI_LOCAL));
+	OSMO_ASSERT(local_sgsn_tlli2 == gprs_tmsi2tlli(sgsn_ptmsi2, TLLI_LOCAL));
+	OSMO_ASSERT(local_sgsn_tlli3 == gprs_tmsi2tlli(sgsn_ptmsi3, TLLI_LOCAL));
+	OSMO_ASSERT(local_bss_tlli == gprs_tmsi2tlli(bss_ptmsi, TLLI_LOCAL));
+	OSMO_ASSERT(local_bss_tlli2 == gprs_tmsi2tlli(bss_ptmsi2, TLLI_LOCAL));
+	OSMO_ASSERT(local_bss_tlli3 == gprs_tmsi2tlli(bss_ptmsi3, TLLI_LOCAL));
 
 	bssgp_nsi = nsi;
 	gbcfg.nsi = bssgp_nsi;
@@ -1652,46 +1685,127 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
+	/* Repeated RA Update Requests */
+	send_llc_ul_ui(nsi, "RA UPD REQ (P-TMSI 2)", &bss_peer[0], 0x1002,
+		       local_bss_tlli, &rai_bss, 0x7080,
+		       GPRS_SAPI_GMM, bss_nu++,
+		       dtap_ra_upd_req, sizeof(dtap_ra_upd_req));
+
+	send_llc_dl_ui(nsi, "RA UDP ACC (P-TMSI 2)", &sgsn_peer, 0x1002,
+		       local_sgsn_tlli, 1, imsi, sizeof(imsi),
+		       GPRS_SAPI_GMM, sgsn_nu++,
+		       dtap_ra_upd_acc2, sizeof(dtap_ra_upd_acc2));
+
+	dump_peers(stdout, 0, 0, &gbcfg);
+
+	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2) != NULL);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli2);
+	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
+	OSMO_ASSERT(!tlli_info->tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->tlli.net_validated);
+	OSMO_ASSERT(tlli_info->tlli.ptmsi == bss_ptmsi2);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.assigned == local_sgsn_tlli2);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.current == local_sgsn_tlli);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.net_validated);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.ptmsi == sgsn_ptmsi2);
+
+	send_llc_ul_ui(nsi, "RA UPD REQ (P-TMSI 3)", &bss_peer[0], 0x1002,
+		       local_bss_tlli2, &rai_bss, 0x7080,
+		       GPRS_SAPI_GMM, bss_nu++,
+		       dtap_ra_upd_req, sizeof(dtap_ra_upd_req));
+
+	send_llc_dl_ui(nsi, "RA UDP ACC (P-TMSI 3)", &sgsn_peer, 0x1002,
+		       local_sgsn_tlli2, 1, imsi, sizeof(imsi),
+		       GPRS_SAPI_GMM, sgsn_nu++,
+		       dtap_ra_upd_acc3, sizeof(dtap_ra_upd_acc3));
+
+	dump_peers(stdout, 0, 0, &gbcfg);
+
+	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2) == NULL);
+	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli3) != NULL);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli3);
+	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
+	OSMO_ASSERT(!tlli_info->tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->tlli.net_validated);
+	OSMO_ASSERT(tlli_info->tlli.ptmsi == bss_ptmsi3);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.assigned == local_sgsn_tlli3);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.current == local_sgsn_tlli);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.net_validated);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.ptmsi == sgsn_ptmsi3);
+
+	send_llc_ul_ui(nsi, "RA UPD COMPLETE", &bss_peer[0], 0x1002,
+		       local_bss_tlli3, &rai_bss, 0x7080,
+		       GPRS_SAPI_GMM, bss_nu++,
+		       dtap_ra_upd_complete, sizeof(dtap_ra_upd_complete));
+
+	tlli_info = gbproxy_find_tlli(peer, local_bss_tlli3);
+
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info->tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->tlli.net_validated);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.net_validated);
+
+	send_llc_dl_ui(nsi, "GMM INFO", &sgsn_peer, 0x1002,
+		       local_sgsn_tlli3, 1, imsi, sizeof(imsi),
+		       GPRS_SAPI_GMM, sgsn_nu++,
+		       dtap_gmm_information, sizeof(dtap_gmm_information));
+
+	dump_peers(stdout, 0, 0, &gbcfg);
+
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli3);
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli3);
+	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.current == local_sgsn_tlli3);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.assigned == 0);
+
 	/* Other messages */
 	send_bssgp_llc_discarded(nsi, &bss_peer[0], 0x1002,
-				 local_bss_tlli, 1, 12);
+				 local_bss_tlli3, 1, 12);
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	send_bssgp_suspend(nsi, &bss_peer[0], local_bss_tlli, &rai_bss);
+	send_bssgp_suspend(nsi, &bss_peer[0], local_bss_tlli3, &rai_bss);
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	send_bssgp_suspend_ack(nsi, &sgsn_peer, local_sgsn_tlli, &rai_sgsn);
+	send_bssgp_suspend_ack(nsi, &sgsn_peer, local_sgsn_tlli3, &rai_sgsn);
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	/* Bad case: Invalid BVCI */
 	send_bssgp_llc_discarded(nsi, &bss_peer[0], 0xeee1,
-				 local_bss_tlli, 1, 12);
+				 local_bss_tlli3, 1, 12);
 	dump_global(stdout, 0);
 
 	/* Bad case: Invalid RAI */
-	send_bssgp_suspend_ack(nsi, &sgsn_peer, local_sgsn_tlli, &rai_unknown);
+	send_bssgp_suspend_ack(nsi, &sgsn_peer, local_sgsn_tlli3, &rai_unknown);
 
 	dump_global(stdout, 0);
 
 	/* Bad case: Invalid MCC (LAC ok) */
-	send_bssgp_suspend_ack(nsi, &sgsn_peer, local_sgsn_tlli,
+	send_bssgp_suspend_ack(nsi, &sgsn_peer, local_sgsn_tlli3,
 			       &rai_wrong_mcc_sgsn);
 
 	dump_global(stdout, 0);
 
 	/* Detach */
 	send_llc_ul_ui(nsi, "DETACH REQ", &bss_peer[0], 0x1002,
-		       local_bss_tlli, &rai_bss, cell_id,
+		       local_bss_tlli3, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
 		       dtap_detach_req, sizeof(dtap_detach_req));
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
 	send_llc_dl_ui(nsi, "DETACH ACC", &sgsn_peer, 0x1002,
-		       local_sgsn_tlli, 1, imsi, sizeof(imsi),
+		       local_sgsn_tlli3, 1, imsi, sizeof(imsi),
 		       GPRS_SAPI_GMM, sgsn_nu++,
 		       dtap_detach_acc, sizeof(dtap_detach_acc));
 
diff --git a/openbsc/tests/gbproxy/gbproxy_test.ok b/openbsc/tests/gbproxy/gbproxy_test.ok
index 1cf3bb034..e00c20cf5 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.ok
+++ b/openbsc/tests/gbproxy/gbproxy_test.ok
@@ -2214,100 +2214,213 @@ Peers:
     TLLI cache size                 : 1
     TLLI-Cache: 1
       TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, IMSI matches
+PROCESSING RA UPD REQ (P-TMSI 2) from 0x01020304:1111
+00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 11 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 e2 6d 78 
+
+CALLBACK, event 0, msg length 85, bvci 0x1002
+00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 11 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 e2 6d 78 
+
+NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 85 (gprs_ns_sendmsg)
+MESSAGE to SGSN at 0x05060708:32000, msg length 89
+00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 21 63 54 40 50 60 70 80 00 80 0e 00 3e 01 c0 11 08 08 10 21 63 54 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 69 a3 ae 
+
+result (RA UPD REQ (P-TMSI 2)) = 89
+
+PROCESSING RA UDP ACC (P-TMSI 2) from 0x05060708:32000
+00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 0d 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 e0 98 76 54 17 16 9f e8 ea 
+
+CALLBACK, event 0, msg length 87, bvci 0x1002
+00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 0d 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 e0 98 76 54 17 16 9f e8 ea 
+
+NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 87 (gprs_ns_sendmsg)
+MESSAGE to BSS at 0x01020304:1111, msg length 91
+00 00 10 02 00 c0 0f 73 04 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 0d 08 09 00 49 11 22 33 40 50 60 19 54 ab b3 18 05 f4 e6 56 aa 1f 17 16 c5 7f 98 
+
+result (RA UDP ACC (P-TMSI 2)) = 91
+
+Peers:
+  NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
+    RAID patched              (BSS ): 9
+    RAID patched              (SGSN): 2
+    APN patched                     : 1
+    TLLI patched              (BSS ): 7
+    TLLI patched              (SGSN): 6
+    P-TMSI patched            (SGSN): 2
+    Attach Request count            : 1
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
+      TLLI c00f7304/e656aa1f -> efe2b700/e0987654, IMSI 12131415161718, AGE 0, IMSI matches
+PROCESSING RA UPD REQ (P-TMSI 3) from 0x01020304:1111
+00 00 10 02 01 e6 56 aa 1f 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 96 3e 97 
+
+CALLBACK, event 0, msg length 85, bvci 0x1002
+00 00 10 02 01 e6 56 aa 1f 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 96 3e 97 
+
+NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 85 (gprs_ns_sendmsg)
+MESSAGE to SGSN at 0x05060708:32000, msg length 89
+00 00 10 02 01 e0 98 76 54 00 00 04 08 88 21 63 54 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 21 63 54 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 1d f0 41 
+
+result (RA UPD REQ (P-TMSI 3)) = 89
+
+PROCESSING RA UDP ACC (P-TMSI 3) from 0x05060708:32000
+00 00 10 02 00 e0 98 76 54 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 11 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 e0 54 32 10 17 16 1b a3 a8 
+
+CALLBACK, event 0, msg length 87, bvci 0x1002
+00 00 10 02 00 e0 98 76 54 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 11 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 e0 54 32 10 17 16 1b a3 a8 
+
+NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 87 (gprs_ns_sendmsg)
+MESSAGE to BSS at 0x01020304:1111, msg length 91
+00 00 10 02 00 e0 98 76 54 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 11 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 e0 54 32 10 17 16 1b a3 a8 
+
+result (RA UDP ACC (P-TMSI 3)) = 91
+
+Peers:
+  NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
+    RAID patched              (BSS ): 11
+    RAID patched              (SGSN): 2
+    APN patched                     : 1
+    TLLI patched              (BSS ): 8
+    TLLI patched              (SGSN): 6
+    P-TMSI patched            (SGSN): 2
+    Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
+      TLLI c00f7304/ead4775a -> efe2b700/e0543210, IMSI 12131415161718, AGE 0, IMSI matches
+PROCESSING RA UPD COMPLETE from 0x01020304:1111
+00 00 10 02 01 ea d4 77 5a 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 08 01 c0 19 08 0a d5 5f 5e 
+
+CALLBACK, event 0, msg length 31, bvci 0x1002
+00 00 10 02 01 ea d4 77 5a 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 08 01 c0 19 08 0a d5 5f 5e 
+
+NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 31 (gprs_ns_sendmsg)
+MESSAGE to SGSN at 0x05060708:32000, msg length 35
+00 00 10 02 01 e0 54 32 10 00 00 04 08 88 21 63 54 40 50 60 70 80 00 80 0e 00 08 01 c0 19 08 0a d5 5f 5e 
+
+result (RA UPD COMPLETE) = 35
+
+PROCESSING GMM INFO from 0x05060708:32000
+00 00 10 02 00 e0 54 32 10 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 88 41 c0 15 08 21 bb c1 c6 
+
+CALLBACK, event 0, msg length 66, bvci 0x1002
+00 00 10 02 00 e0 54 32 10 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 88 41 c0 15 08 21 bb c1 c6 
+
+NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 66 (gprs_ns_sendmsg)
+MESSAGE to BSS at 0x01020304:1111, msg length 70
+00 00 10 02 00 ea d4 77 5a 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 88 41 c0 15 08 21 bb c1 c6 
+
+result (GMM INFO) = 70
+
+Peers:
+  NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
+    RAID patched              (BSS ): 12
+    RAID patched              (SGSN): 2
+    APN patched                     : 1
+    TLLI patched              (BSS ): 9
+    TLLI patched              (SGSN): 7
+    P-TMSI patched            (SGSN): 2
+    Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
+      TLLI ead4775a -> e0543210, IMSI 12131415161718, AGE 0, IMSI matches
 PROCESSING LLC_DISCARDED from 0x01020304:1111
-00 00 00 00 2c 1f 84 c0 0f 73 04 0f 81 01 04 82 10 02 25 83 00 00 0c 
+00 00 00 00 2c 1f 84 ea d4 77 5a 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
 CALLBACK, event 0, msg length 19, bvci 0x0000
-00 00 00 00 2c 1f 84 c0 0f 73 04 0f 81 01 04 82 10 02 25 83 00 00 0c 
+00 00 00 00 2c 1f 84 ea d4 77 5a 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
 NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 19 (gprs_ns_sendmsg)
 MESSAGE to SGSN at 0x05060708:32000, msg length 23
-00 00 00 00 2c 1f 84 ef e2 b7 00 0f 81 01 04 82 10 02 25 83 00 00 0c 
+00 00 00 00 2c 1f 84 e0 54 32 10 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
 result (LLC_DISCARDED) = 23
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 7
-    RAID patched              (SGSN): 1
+    RAID patched              (BSS ): 12
+    RAID patched              (SGSN): 2
     APN patched                     : 1
-    TLLI patched              (BSS ): 7
-    TLLI patched              (SGSN): 5
-    P-TMSI patched            (SGSN): 1
+    TLLI patched              (BSS ): 10
+    TLLI patched              (SGSN): 7
+    P-TMSI patched            (SGSN): 2
     Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, IMSI matches
+      TLLI ead4775a -> e0543210, IMSI 12131415161718, AGE 0, IMSI matches
 PROCESSING BVC_SUSPEND from 0x01020304:1111
-00 00 00 00 0b 1f 84 c0 0f 73 04 1b 86 11 22 33 40 50 60 
+00 00 00 00 0b 1f 84 ea d4 77 5a 1b 86 11 22 33 40 50 60 
 
 CALLBACK, event 0, msg length 15, bvci 0x0000
-00 00 00 00 0b 1f 84 c0 0f 73 04 1b 86 11 22 33 40 50 60 
+00 00 00 00 0b 1f 84 ea d4 77 5a 1b 86 11 22 33 40 50 60 
 
 NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 15 (gprs_ns_sendmsg)
 MESSAGE to SGSN at 0x05060708:32000, msg length 19
-00 00 00 00 0b 1f 84 ef e2 b7 00 1b 86 21 63 54 40 50 60 
+00 00 00 00 0b 1f 84 e0 54 32 10 1b 86 21 63 54 40 50 60 
 
 result (BVC_SUSPEND) = 19
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 8
-    RAID patched              (SGSN): 1
+    RAID patched              (BSS ): 13
+    RAID patched              (SGSN): 2
     APN patched                     : 1
-    TLLI patched              (BSS ): 8
-    TLLI patched              (SGSN): 5
-    P-TMSI patched            (SGSN): 1
+    TLLI patched              (BSS ): 11
+    TLLI patched              (SGSN): 7
+    P-TMSI patched            (SGSN): 2
     Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, IMSI matches
+      TLLI ead4775a -> e0543210, IMSI 12131415161718, AGE 0, IMSI matches
 PROCESSING BVC_SUSPEND_ACK from 0x05060708:32000
-00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 21 63 54 40 50 60 1d 81 01 
+00 00 00 00 0c 1f 84 e0 54 32 10 1b 86 21 63 54 40 50 60 1d 81 01 
 
 CALLBACK, event 0, msg length 18, bvci 0x0000
-00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 21 63 54 40 50 60 1d 81 01 
+00 00 00 00 0c 1f 84 e0 54 32 10 1b 86 21 63 54 40 50 60 1d 81 01 
 
 NS UNITDATA MESSAGE to BSS, BVCI 0x0000, msg length 18 (gprs_ns_sendmsg)
 MESSAGE to BSS at 0x01020304:1111, msg length 22
-00 00 00 00 0c 1f 84 c0 0f 73 04 1b 86 11 22 33 40 50 60 1d 81 01 
+00 00 00 00 0c 1f 84 ea d4 77 5a 1b 86 11 22 33 40 50 60 1d 81 01 
 
 result (BVC_SUSPEND_ACK) = 22
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 8
-    RAID patched              (SGSN): 2
+    RAID patched              (BSS ): 13
+    RAID patched              (SGSN): 3
     APN patched                     : 1
-    TLLI patched              (BSS ): 8
-    TLLI patched              (SGSN): 6
-    P-TMSI patched            (SGSN): 1
+    TLLI patched              (BSS ): 11
+    TLLI patched              (SGSN): 8
+    P-TMSI patched            (SGSN): 2
     Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, IMSI matches
+      TLLI ead4775a -> e0543210, IMSI 12131415161718, AGE 0, IMSI matches
 PROCESSING LLC_DISCARDED from 0x01020304:1111
-00 00 00 00 2c 1f 84 c0 0f 73 04 0f 81 01 04 82 ee e1 25 83 00 00 0c 
+00 00 00 00 2c 1f 84 ea d4 77 5a 0f 81 01 04 82 ee e1 25 83 00 00 0c 
 
 CALLBACK, event 0, msg length 19, bvci 0x0000
-00 00 00 00 2c 1f 84 c0 0f 73 04 0f 81 01 04 82 ee e1 25 83 00 00 0c 
+00 00 00 00 2c 1f 84 ea d4 77 5a 0f 81 01 04 82 ee e1 25 83 00 00 0c 
 
 NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 19 (gprs_ns_sendmsg)
 MESSAGE to SGSN at 0x05060708:32000, msg length 23
-00 00 00 00 2c 1f 84 ef e2 b7 00 0f 81 01 04 82 ee e1 25 83 00 00 0c 
+00 00 00 00 2c 1f 84 e0 54 32 10 0f 81 01 04 82 ee e1 25 83 00 00 0c 
 
 result (LLC_DISCARDED) = 23
 
 Gbproxy global:
 PROCESSING BVC_SUSPEND_ACK from 0x05060708:32000
-00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 00 f1 99 00 63 60 1d 81 01 
+00 00 00 00 0c 1f 84 e0 54 32 10 1b 86 00 f1 99 00 63 60 1d 81 01 
 
 CALLBACK, event 0, msg length 18, bvci 0x0000
-00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 00 f1 99 00 63 60 1d 81 01 
+00 00 00 00 0c 1f 84 e0 54 32 10 1b 86 00 f1 99 00 63 60 1d 81 01 
 
 NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 24 (gprs_ns_sendmsg)
 MESSAGE to SGSN at 0x05060708:32000, msg length 28
-00 00 00 00 41 07 81 21 15 92 0c 1f 84 ef e2 b7 00 1b 86 00 f1 99 00 63 60 1d 81 01 
+00 00 00 00 41 07 81 21 15 92 0c 1f 84 e0 54 32 10 1b 86 00 f1 99 00 63 60 1d 81 01 
 
 result (BVC_SUSPEND_ACK) = 28
 
@@ -2315,14 +2428,14 @@ Gbproxy global:
     Invalid Routing Area Identifier : 1
     Patch error: no peer            : 1
 PROCESSING BVC_SUSPEND_ACK from 0x05060708:32000
-00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 99 69 54 40 50 60 1d 81 01 
+00 00 00 00 0c 1f 84 e0 54 32 10 1b 86 99 69 54 40 50 60 1d 81 01 
 
 CALLBACK, event 0, msg length 18, bvci 0x0000
-00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 99 69 54 40 50 60 1d 81 01 
+00 00 00 00 0c 1f 84 e0 54 32 10 1b 86 99 69 54 40 50 60 1d 81 01 
 
 NS UNITDATA MESSAGE to BSS, BVCI 0x0000, msg length 18 (gprs_ns_sendmsg)
 MESSAGE to BSS at 0x01020304:1111, msg length 22
-00 00 00 00 0c 1f 84 c0 0f 73 04 1b 86 11 22 33 40 50 60 1d 81 01 
+00 00 00 00 0c 1f 84 ea d4 77 5a 1b 86 11 22 33 40 50 60 1d 81 01 
 
 result (BVC_SUSPEND_ACK) = 22
 
@@ -2330,50 +2443,54 @@ Gbproxy global:
     Invalid Routing Area Identifier : 1
     Patch error: no peer            : 1
 PROCESSING DETACH REQ from 0x01020304:1111
-00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 15 01 c0 11 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 6d b1 de 
+00 00 10 02 01 ea d4 77 5a 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 15 01 c0 1d 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb aa cc a3 
 
 CALLBACK, event 0, msg length 44, bvci 0x1002
-00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 15 01 c0 11 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 6d b1 de 
+00 00 10 02 01 ea d4 77 5a 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 15 01 c0 1d 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb aa cc a3 
 
 NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 44 (gprs_ns_sendmsg)
 MESSAGE to SGSN at 0x05060708:32000, msg length 48
-00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 21 63 54 40 50 60 12 34 00 80 0e 00 15 01 c0 11 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 6d b1 de 
+00 00 10 02 01 e0 54 32 10 00 00 04 08 88 21 63 54 40 50 60 12 34 00 80 0e 00 15 01 c0 1d 08 05 01 18 05 f4 e0 54 32 10 19 03 b9 97 cb ea 6d af 
 
 result (DETACH REQ) = 48
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 9
-    RAID patched              (SGSN): 3
+    RAID patched              (BSS ): 14
+    RAID patched              (SGSN): 4
     APN patched                     : 1
-    TLLI patched              (BSS ): 10
-    TLLI patched              (SGSN): 7
-    P-TMSI patched            (SGSN): 1
+    TLLI patched              (BSS ): 13
+    TLLI patched              (SGSN): 9
+    P-TMSI patched            (BSS ): 1
+    P-TMSI patched            (SGSN): 2
     Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, IMSI matches
+      TLLI ead4775a -> e0543210, IMSI 12131415161718, AGE 0, IMSI matches
 PROCESSING DETACH ACC from 0x05060708:32000
-00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 0d 08 06 00 aa ab ee 
+00 00 10 02 00 e0 54 32 10 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 19 08 06 00 04 ff 52 
 
 CALLBACK, event 0, msg length 67, bvci 0x1002
-00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 0d 08 06 00 aa ab ee 
+00 00 10 02 00 e0 54 32 10 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 19 08 06 00 04 ff 52 
 
 NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 67 (gprs_ns_sendmsg)
 MESSAGE to BSS at 0x01020304:1111, msg length 71
-00 00 10 02 00 c0 0f 73 04 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 0d 08 06 00 aa ab ee 
+00 00 10 02 00 ea d4 77 5a 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 19 08 06 00 04 ff 52 
 
 result (DETACH ACC) = 71
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 9
-    RAID patched              (SGSN): 3
+    RAID patched              (BSS ): 14
+    RAID patched              (SGSN): 4
     APN patched                     : 1
-    TLLI patched              (BSS ): 10
-    TLLI patched              (SGSN): 8
-    P-TMSI patched            (SGSN): 1
+    TLLI patched              (BSS ): 13
+    TLLI patched              (SGSN): 10
+    P-TMSI patched            (BSS ): 1
+    P-TMSI patched            (SGSN): 2
     Attach Request count            : 1
+    TLLI from SGSN unknown          : 1
     TLLI-Cache: 0
 Gbproxy global:
     Invalid Routing Area Identifier : 1