extend MATE rules with minimalistic GTPv2C, PFCP and S1AP rules

This commit is contained in:
Harald Welte 2021-09-17 12:23:33 +02:00
parent 989861a078
commit 5abbb2cb2e
1 changed files with 73 additions and 0 deletions

View File

@ -79,5 +79,78 @@ Gop sccp_conn On sccp_pdu Match (pc, pc, sccp_lr) {
* BSSAP
***********************************************************************/
/***********************************************************************
* GTPv1-C
***********************************************************************/
/* incomplete as it can only track one of the two TEID, so we get all requests but not the responses */
Pdu gtp_pdu Proto gtp Transport udp/ip {
Extract ip_addr From ip.addr;
Extract port From udp.port;
Extract gtp_msg_type From gtp.message;
Extract teid From gtp.teid_cp;
Extract teid From gtp.teid;
};
Gop gtp_ctx On gtp_pdu Match (ip_addr, ip_addr, port, port, teid) {
Start (gtp_msg_type {16}); // CREATE PDP CTX
Stop (gtp_msg_type {21}); // DELETE PDP CTX RESP
};
/***********************************************************************
* GTPv2-C
***********************************************************************/
/* incomplete as it can only track one of the two TEID, so we get all requests but not the responses */
Pdu gtpv2_pdu Proto gtpv2 Transport udp/ip {
Extract ip_addr From ip.addr;
Extract port From udp.port;
Extract gtpv2_msg_type From gtpv2.message_type;
Extract teid From gtpv2.teid;
};
Gop gtpv2_ctx On gtpv2_pdu Match (ip_addr, ip_addr, port, teid) {
Start (gtpv2_msg_type {33}); // CREATE SESSION RESP
Stop (gtpv2_msg_type {37}); // DELETE SESSION RESP
};
/***********************************************************************
* PFCP
***********************************************************************/
Pdu pfcp_pdu Proto pfcp Transport udp/ip {
Extract ip_addr From ip.addr;
Extract port From udp.port;
Extract pfcp_msg_type From pfcp.msg_type;
Extract seid From pfcp.seid;
};
Gop pfcp_ctx On pfcp_pdu Match (ip_addr, ip_addr, port, seid) {
/* we cannot match the request, as it contains seid 0 */
Start (pfcp_msg_type {51}); // Session Establishment Response
Stop (pfcp_msg_type {55}); // Session Deletion Response
};
/***********************************************************************
* S1AP
***********************************************************************/
Pdu s1ap_pdu Proto s1ap Transport sctp/ip {
Extract ip_addr From ip.addr;
Extract port From sctp.port;
Extract s1ap_proc_code From s1ap.procedureCode;
Extract s1ap_mme_id From s1ap.MME_UE_S1AP_ID;
Extract s1ap_enb_id From s1ap.ENB_UE_S1AP_ID;
};
Gop s1ap_ctx On s1ap_pdu Match (ip_addr, ip_addr, port, port, s1ap_mme_id) {
Start (s1ap_proc_code {9}); // InitialContextSetup
Stop (s1ap_proc_code {23}); // UEContextRelease
};
Done;