| 358 | } |
| 359 | |
| 360 | void GMMAttach::gmParseIEs(L3GmmFrame &src, size_t &rp, const char *culprit) |
| 361 | { |
| 362 | // All subsequent IEs are optional. |
| 363 | while (rp < src.size()) { |
| 364 | unsigned iei = src.readIEI(rp); |
| 365 | //SGSNLOG(format("debug: gmParseIes %s iei=0x%x rp=%d size=%d\n",culprit,iei,rp,src.size())); |
| 366 | if ((iei & 0xf0) == 0x90) { |
| 367 | // 10.5.5.4 TMSI status: high nibble is 9, low bit is TMSI status. |
| 368 | mTmsiStatus = iei & 1; |
| 369 | continue; |
| 370 | } |
| 371 | switch (iei) { |
| 372 | case 0x19: // TV Old P-TMSI signature. |
| 373 | // Dont have a 3 byte 'read' function so use getField then advance rp by 3. |
| 374 | mOldPtmsiSignature = src.getField(rp,24); |
| 375 | rp += 3; |
| 376 | continue; |
| 377 | case 0x17: // TV |
| 378 | mRequestedReadyTimerValue = src.readByte(rp); |
| 379 | continue; |
| 380 | case 0x27: // TV drx parameter |
| 381 | mDrxParameter = src.readUInt16(rp); |
| 382 | continue; |
| 383 | } |
| 384 | |
| 385 | // All the rest are TLV |
| 386 | // The specified length is of the ie itself, excluding the iei type and length byte. |
| 387 | // Get the length, but dont move rp - let the IEs do that, because |
| 388 | // some of them need the length byte. |
| 389 | int len = src.getByte(rp); |
| 390 | size_t nextrp = rp + len + 1; |
| 391 | if (nextrp > src.size()) { // last one will have nextrp == src.size() |
| 392 | SGSNERROR("invalid message size in "<<culprit <<" bytes="<<src.hexstr()); |
| 393 | return; |
| 394 | } |
| 395 | switch (iei) { |
| 396 | default: |
| 397 | rp = nextrp; |
| 398 | break; |
| 399 | case 0x18: // P-TMSI, hard coded in Attach Request, optional in RAUpdate |
| 400 | mMobileId.parseLV(src,rp); |
| 401 | break; |
| 402 | case 0x31: // This has a hard-code position in Attach Request, |
| 403 | // but is an optional IE in RA Update Request. |
| 404 | mMsNetworkCapability = src.readLVasBV(rp); |
| 405 | break; |
| 406 | case 0x32: // PDP Context status. |
| 407 | rp++; // skip length |
| 408 | mPdpContextStatus.mStatus[0] = src.readByte(rp); |
| 409 | mPdpContextStatus.mStatus[1] = src.readByte(rp); |
| 410 | break; |
| 411 | case 0x33: // Location services; just dump it. |
| 412 | src.skipLV(rp,1,1,"PS LCS Capability"); |
| 413 | break; |
| 414 | case 0x35: // MBMS context status in RAUpdateRequest |
| 415 | src.skipLV(rp,3,3,"MBMS context status"); |
| 416 | case 0x11: |
| 417 | src.skipLV(rp,3,3,"Mobile station classmark 2"); |
nothing calls this directly
no test coverage detected