pespin has uploaded this change for review.

View Change

sccp: Split sccp_scoc into multiple files

The previous state was really messy with sccp_scoc.c containing lots
of different not-directly-related modules, which made it very
difficult to find all the parts and gasp the whole picture.
It also makes it easier to extend the code in the future as we plan to
be adding more features from time to time.

This commit moves (splits) sccp_scoc.c + sccp_internal.h out to
different modules:
* sccp_user.h is added since there already existed sccp_user.c,
  operating on struct sccp_user.
* sccp_connection.{c,h} is added to contain all the struct
  sccp_connection data domain logic.
* sccp_scoc_fsm.{c,h} is added to have all the related FSM code
  self-contained in a file.
* sccp_sap.c: Some code related to the SCU primitive is moved here,
  where it belongs.
* sccp_vty: Some related vty code is moved here, where it belongs.

The SCOC handling logic is kept in the sccp_scoc.c file.
Some functions are properly prefixed when moved to the correct file.

Change-Id: I51e9bf60bc4c4b2babd3f408daed914eaf398e82
---
M src/Makefile.am
A src/sccp_connection.c
A src/sccp_connection.h
M src/sccp_helpers.c
M src/sccp_internal.h
M src/sccp_lbcs.c
M src/sccp_sap.c
M src/sccp_sclc.c
M src/sccp_scmg.c
M src/sccp_scoc.c
A src/sccp_scoc_fsm.c
A src/sccp_scoc_fsm.h
M src/sccp_user.c
A src/sccp_user.h
M src/sccp_vty.c
M src/ss7.c
16 files changed, 1,402 insertions(+), 1,236 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/81/40581/1

diff --git a/src/Makefile.am b/src/Makefile.am
index 53b80c0..e1cd9cb 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -3,7 +3,9 @@
 		$(LIBOSMONETIF_CFLAGS)
 
 noinst_HEADERS = \
+	sccp_scoc_fsm.h \
 	sccp_internal.h \
+	sccp_user.h \
 	ss7_as.h \
 	ss7_asp.h \
 	ss7_asp_peer.h \
@@ -43,6 +45,7 @@
 	ipa.c \
 	m3ua.c \
 	sccp2sua.c \
+	sccp_connection.c \
 	sccp_helpers.c \
 	sccp_lbcs.c \
 	sccp_sap.c \
@@ -50,6 +53,7 @@
 	sccp_scmg.c \
 	sccp_scrc.c \
 	sccp_scoc.c \
+	sccp_scoc_fsm.c \
 	sccp_types.c \
 	sccp_user.c \
 	sccp_vty.c \
diff --git a/src/sccp_connection.c b/src/sccp_connection.c
new file mode 100644
index 0000000..3a01121
--- /dev/null
+++ b/src/sccp_connection.c
@@ -0,0 +1,417 @@
+/* SCCP User related routines */
+
+/* (C) 2025 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * (C) 2017 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * based on my 2011 Erlang implementation osmo_ss7/src/sua_sccp_conv.erl
+ *
+ * References: ITU-T Q.713 and IETF RFC 3868
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <errno.h>
+#include <stdbool.h>
+#include <string.h>
+#include <limits.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/sigtran/osmo_ss7.h>
+#include <osmocom/sigtran/sccp_sap.h>
+#include <osmocom/sigtran/mtp_sap.h>
+#include <osmocom/sigtran/protocol/mtp.h>
+#include <osmocom/sigtran/protocol/sua.h>
+#include <osmocom/sigtran/sccp_helpers.h>
+#include <osmocom/sccp/sccp_types.h>
+
+#include "sccp_internal.h"
+#include "sccp_connection.h"
+#include "sccp_scoc_fsm.h"
+#include "sccp_user.h"
+#include "ss7_instance.h"
+#include "xua_msg.h"
+#include "xua_internal.h"
+
+static void sccp_conn_opt_data_clear_cache(struct sccp_connection *conn);
+
+#define INIT_TIMER(x, fn, priv)		do { (x)->cb = fn; (x)->data = priv; } while (0)
+
+/* T(ias) has expired, send a COIT message to the peer */
+static void tx_inact_tmr_cb(void *data)
+{
+	struct sccp_connection *conn = data;
+	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_IAS_EXP, NULL);
+}
+
+/* T(iar) has expired, notify the FSM about it */
+static void rx_inact_tmr_cb(void *data)
+{
+	struct sccp_connection *conn = data;
+	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_IAR_EXP, NULL);
+}
+
+/* T(rel) has expired, notify the FSM about it */
+static void rel_tmr_cb(void *data)
+{
+	struct sccp_connection *conn = data;
+	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_REL_EXP, NULL);
+}
+
+/* T(int) has expired, notify the FSM about it */
+static void int_tmr_cb(void *data)
+{
+	struct sccp_connection *conn = data;
+	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_INT_EXP, NULL);
+}
+
+/* T(repeat_rel) has expired, notify the FSM about it */
+static void rep_rel_tmr_cb(void *data)
+{
+	struct sccp_connection *conn = data;
+	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_REP_REL_EXP, NULL);
+}
+
+/* T(conn) has expired, notify the FSM about it */
+static void conn_tmr_cb(void *data)
+{
+	struct sccp_connection *conn = data;
+	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_CONN_TMR_EXP, NULL);
+}
+
+/* Generate an SLS to be used for Connection-oriented messages on this SCCP connection.
+ * SLS is 4 bits, as described in ITU Q.704 Figure 3.
+ * ITU-T Q.714 1.1.2.3 Protocol class 2:
+ *  "Messages belonging to a given signalling connection shall contain the same
+ *  value of the SLS field to ensure sequencing as described in 1.1.2.2"
+ */
+static uint8_t sccp_conn_gen_tx_co_mtp_sls(const struct sccp_connection *conn)
+{
+	/* Implementation: Derive the SLS from conn->conn_id. */
+	const uint32_t id = conn->conn_id;
+	uint8_t sls;
+
+	/* First shrink it to 1 byte: */
+	sls = ((id >> (3*8)) ^ (id >> (2*8)) ^ (id >> (1*8)) ^ (id)) & 0xff;
+	/* Now shrink it 8 -> 4 bits: */
+	sls = ((sls >> 4) ^ sls) & 0x0f;
+
+	return sls;
+}
+
+static int conn_add_node(struct osmo_sccp_instance *inst, struct sccp_connection *conn)
+{
+	struct rb_node **n = &(inst->connections.rb_node);
+	struct rb_node *parent = NULL;
+
+	while (*n) {
+		struct sccp_connection *it;
+
+		it = container_of(*n, struct sccp_connection, node);
+
+		parent = *n;
+		if (conn->conn_id < it->conn_id) {
+			n = &((*n)->rb_left);
+		} else if (conn->conn_id > it->conn_id) {
+			n = &((*n)->rb_right);
+		} else {
+			LOGPSCI(inst, LOGL_ERROR, "Trying to reserve already reserved conn_id %u\n",
+				conn->conn_id);
+			return -EEXIST;
+		}
+	}
+
+	rb_link_node(&conn->node, parent, n);
+	rb_insert_color(&conn->node, &inst->connections);
+	return 0;
+}
+
+/* allocate + init a SCCP Connection with given ID */
+struct sccp_connection *sccp_conn_alloc(struct osmo_sccp_user *user, uint32_t conn_id)
+{
+	struct sccp_connection *conn = talloc_zero(user->inst, struct sccp_connection);
+	char name[16];
+
+	conn->conn_id = conn_id;
+	conn->inst = user->inst;
+	conn->user = user;
+
+	if (conn_add_node(user->inst, conn) < 0) {
+		talloc_free(conn);
+		return NULL;
+	}
+
+	INIT_TIMER(&conn->t_conn, conn_tmr_cb, conn);
+	INIT_TIMER(&conn->t_ias, tx_inact_tmr_cb, conn);
+	INIT_TIMER(&conn->t_iar, rx_inact_tmr_cb, conn);
+	INIT_TIMER(&conn->t_rel, rel_tmr_cb, conn);
+	INIT_TIMER(&conn->t_int, int_tmr_cb, conn);
+	INIT_TIMER(&conn->t_rep_rel, rep_rel_tmr_cb, conn);
+
+	conn->tx_co_mtp_sls = sccp_conn_gen_tx_co_mtp_sls(conn);
+
+	/* this might change at runtime, as it is not a constant :/ */
+	sccp_scoc_fsm.log_subsys = DLSCCP;
+
+	/* we simply use the connection ID as FSM instance name */
+	snprintf(name, sizeof(name), "%u", conn->conn_id);
+	conn->fi = osmo_fsm_inst_alloc(&sccp_scoc_fsm, conn, conn,
+					LOGL_DEBUG, name);
+	if (!conn->fi) {
+		rb_erase(&conn->node, &user->inst->connections);
+		talloc_free(conn);
+		return NULL;
+	}
+
+	return conn;
+}
+
+/* destroy a SCCP connection state, releasing all timers, terminating
+ * FSM and releasing associated memory */
+void sccp_conn_free(struct sccp_connection *conn)
+{
+	if (!conn)
+		return;
+	sccp_conn_opt_data_clear_cache(conn);
+
+	sccp_conn_stop_connect_timer(conn);
+	sccp_conn_stop_inact_timers(conn);
+	sccp_conn_stop_release_timers(conn);
+	rb_erase(&conn->node, &conn->inst->connections);
+
+	osmo_fsm_inst_term(conn->fi, OSMO_FSM_TERM_REQUEST, NULL);
+
+	talloc_free(conn);
+}
+
+/* allocate a message buffer for an SCCP User Primitive */
+static struct msgb *scu_msgb_alloc(void)
+{
+	#define SCU_MSGB_SIZE	1024
+	return msgb_alloc(SCU_MSGB_SIZE, "SCCP User Primitive");
+}
+
+/* allocate a SCU primitive to be sent to the user */
+static struct osmo_scu_prim *scu_prim_alloc(unsigned int primitive, enum osmo_prim_operation operation)
+{
+	struct msgb *upmsg = scu_msgb_alloc();
+	struct osmo_scu_prim *prim;
+
+	prim = (struct osmo_scu_prim *) msgb_put(upmsg, sizeof(*prim));
+	osmo_prim_init(&prim->oph, SCCP_SAP_USER,
+			primitive, operation, upmsg);
+	upmsg->l2h = upmsg->tail;
+	return prim;
+}
+
+/* high-level function to generate a SCCP User primitive of requested
+ * type based on the connection and currently processed XUA message */
+void sccp_conn_scu_gen_encode_and_send(struct sccp_connection *conn, uint32_t event,
+				       struct xua_msg *xua, unsigned int primitive,
+				       enum osmo_prim_operation operation)
+{
+	struct osmo_scu_prim *scu_prim;
+	struct osmo_scu_disconn_param *udisp;
+	struct osmo_scu_connect_param *uconp;
+	struct osmo_scu_data_param *udatp;
+	struct xua_msg_part *data_ie;
+
+	scu_prim = scu_prim_alloc(primitive, operation);
+
+	switch (OSMO_PRIM_HDR(&scu_prim->oph)) {
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION):
+		udisp = &scu_prim->u.disconnect;
+		udisp->conn_id = conn->conn_id;
+		udisp->responding_addr = conn->called_addr;
+		udisp->importance = conn->importance;
+		udisp->originator = OSMO_SCCP_ORIG_UNDEFINED;
+		//udisp->in_sequence_control;
+		if (xua) {
+			udisp->cause = xua_msg_get_u32(xua, SUA_IEI_CAUSE);
+			if (xua_msg_find_tag(xua, SUA_IEI_SRC_ADDR)) {
+				if (sua_addr_parse(&udisp->responding_addr, xua, SUA_IEI_SRC_ADDR) < 0) {
+					LOGPSCC(conn, LOGL_ERROR, "XUA Message %s without valid SRC_ADDR\n",
+						xua_hdr_dump(xua, &xua_dialect_sua));
+					talloc_free(scu_prim->oph.msg);
+					return;
+				}
+			}
+			data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
+			udisp->importance = xua_msg_get_u32(xua, SUA_IEI_IMPORTANCE);
+			if (data_ie) {
+				struct msgb *upmsg = scu_prim->oph.msg;
+				upmsg->l2h = msgb_put(upmsg, data_ie->len);
+				memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
+			}
+		}
+		break;
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_INDICATION):
+		uconp = &scu_prim->u.connect;
+		uconp->conn_id = conn->conn_id;
+		uconp->called_addr = conn->called_addr;
+		uconp->calling_addr = conn->calling_addr;
+		uconp->sccp_class = conn->sccp_class;
+		uconp->importance = conn->importance;
+		if (xua) {
+			data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
+			if (data_ie) {
+				struct msgb *upmsg = scu_prim->oph.msg;
+				upmsg->l2h = msgb_put(upmsg, data_ie->len);
+				memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
+			}
+		}
+		break;
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_CONFIRM):
+		uconp = &scu_prim->u.connect;
+		uconp->conn_id = conn->conn_id;
+		uconp->called_addr = conn->called_addr;
+		uconp->calling_addr = conn->calling_addr;
+		//scu_prim->u.connect.in_sequence_control
+		uconp->sccp_class = xua_msg_get_u32(xua, SUA_IEI_PROTO_CLASS) & 3;
+		uconp->importance = xua_msg_get_u32(xua, SUA_IEI_IMPORTANCE);
+		data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
+		if (data_ie) {
+			struct msgb *upmsg = scu_prim->oph.msg;
+			upmsg->l2h = msgb_put(upmsg, data_ie->len);
+			memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
+		}
+		break;
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_DATA, PRIM_OP_INDICATION):
+		udatp = &scu_prim->u.data;
+		udatp->conn_id = conn->conn_id;
+		udatp->importance = conn->importance;
+		data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
+		if (data_ie) {
+			struct msgb *upmsg = scu_prim->oph.msg;
+			upmsg->l2h = msgb_put(upmsg, data_ie->len);
+			memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
+		}
+		break;
+	default:
+		LOGPFSML(conn->fi, LOGL_ERROR, "Unsupported primitive %u:%u\n",
+			 scu_prim->oph.primitive, scu_prim->oph.operation);
+		talloc_free(scu_prim->oph.msg);
+		return;
+	}
+
+	sccp_user_prim_up(conn->user, scu_prim);
+}
+
+static void sccp_timer_schedule(const struct sccp_connection *conn,
+				struct osmo_timer_list *timer,
+				enum osmo_sccp_timer timer_name)
+{
+	const unsigned long val_sec = osmo_tdef_get(conn->inst->tdefs, timer_name, OSMO_TDEF_S, -1);
+	osmo_timer_schedule(timer, val_sec, 0);
+}
+
+/* Re-start the Tx inactivity timer */
+void sccp_conn_restart_tx_inact_timer(struct sccp_connection *conn)
+{
+	sccp_timer_schedule(conn, &conn->t_ias, OSMO_SCCP_TIMER_IAS);
+}
+
+/* Re-start the Rx inactivity timer */
+void sccp_conn_restart_rx_inact_timer(struct sccp_connection *conn)
+{
+	sccp_timer_schedule(conn, &conn->t_iar, OSMO_SCCP_TIMER_IAR);
+}
+
+/* Re-start both Rx and Tx inactivity timers */
+void sccp_conn_start_inact_timers(struct sccp_connection *conn)
+{
+	sccp_conn_restart_tx_inact_timer(conn);
+	sccp_conn_restart_rx_inact_timer(conn);
+}
+
+/* Stop both Rx and Tx inactivity timers */
+void sccp_conn_stop_inact_timers(struct sccp_connection *conn)
+{
+	osmo_timer_del(&conn->t_ias);
+	osmo_timer_del(&conn->t_iar);
+}
+
+/* Start release timer T(rel) */
+void sccp_conn_start_rel_timer(struct sccp_connection *conn)
+{
+	sccp_timer_schedule(conn, &conn->t_rel, OSMO_SCCP_TIMER_REL);
+}
+
+/* Start repeat release timer T(rep_rel) */
+void sccp_conn_start_rep_rel_timer(struct sccp_connection *conn)
+{
+	sccp_timer_schedule(conn, &conn->t_rep_rel, OSMO_SCCP_TIMER_REPEAT_REL);
+}
+
+/* Start interval timer T(int) */
+void sccp_conn_start_int_timer(struct sccp_connection *conn)
+{
+	sccp_timer_schedule(conn, &conn->t_int, OSMO_SCCP_TIMER_INT);
+}
+
+/* Stop all release related timers: T(rel), T(int) and T(rep_rel) */
+void sccp_conn_stop_release_timers(struct sccp_connection *conn)
+{
+	osmo_timer_del(&conn->t_rel);
+	osmo_timer_del(&conn->t_int);
+	osmo_timer_del(&conn->t_rep_rel);
+}
+
+/* Start connect timer T(conn) */
+void sccp_conn_start_connect_timer(struct sccp_connection *conn)
+{
+	sccp_timer_schedule(conn, &conn->t_conn, OSMO_SCCP_TIMER_CONN_EST);
+}
+
+/* Stop connect timer T(conn) */
+void sccp_conn_stop_connect_timer(struct sccp_connection *conn)
+{
+	osmo_timer_del(&conn->t_conn);
+}
+
+static void sccp_conn_opt_data_clear_cache(struct sccp_connection *conn)
+{
+	if (conn->opt_data_cache) {
+		msgb_free(conn->opt_data_cache);
+		conn->opt_data_cache = NULL;
+	}
+}
+
+/* Send cached optional data (if any) from expected message type and clear cache */
+void sccp_conn_opt_data_send_cache(struct sccp_connection *conn, int exp_type, uint8_t msg_class)
+{
+	const struct xua_dialect *dialect = &xua_dialect_sua;
+	const struct xua_msg_class *xmc = dialect->class[msg_class];
+
+	if (!conn->opt_data_cache)
+		return;
+
+	if (conn->opt_data_cache->cb[0] != exp_type) {
+		/* Caller (from the FSM) knows what was the source of Optional Data we're sending.
+		 * Compare this information with source of Optional Data recorded while caching
+		 * to make sure we're on the same page.
+		 */
+		LOGPSCC(conn, LOGL_ERROR, "unexpected message type %s != cache source %s\n",
+			xua_class_msg_name(xmc, exp_type),
+			xua_class_msg_name(xmc, conn->opt_data_cache->cb[0]));
+	} else {
+		osmo_sccp_tx_data(conn->user, conn->conn_id, msgb_data(conn->opt_data_cache), msgb_length(conn->opt_data_cache));
+	}
+
+	sccp_conn_opt_data_clear_cache(conn);
+}
diff --git a/src/sccp_connection.h b/src/sccp_connection.h
new file mode 100644
index 0000000..82b707f
--- /dev/null
+++ b/src/sccp_connection.h
@@ -0,0 +1,95 @@
+#pragma once
+#include <inttypes.h>
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/sigtran/sccp_sap.h>
+
+struct xua_msg;
+
+/* a logical connection within the SCCP instance */
+struct sccp_connection {
+	/* entry in (struct sccp_instance)->connections */
+	struct rb_node node;
+	/* which instance are we part of? */
+	struct osmo_sccp_instance *inst;
+	/* which user owns us? */
+	struct osmo_sccp_user *user;
+
+	/* remote point code */
+	uint32_t remote_pc;
+
+	/* local/remote addresses and identities */
+	struct osmo_sccp_addr calling_addr;
+	struct osmo_sccp_addr called_addr;
+	/* SCCP connection identifier. Only relevant across the SCCP User SAP,
+	 * i.e. between the local application using the SCCP stack provided by
+	 * libosmo-sccp.  Never transmitted over the wire! */
+	uint32_t conn_id;
+	/* SCCP Remote Connection Reference.  Allocated by the remote
+	 * SCCP stack to uniquely identify a SCCP connection on its end.
+	 * We don't interpret it, but simply cache it here so we can use
+	 * it whenever sending data to the peer. Only relevant over the
+	 * wire, not to be used across the SCCP user SAP */
+	uint32_t remote_ref;
+
+	uint32_t importance;
+	uint32_t sccp_class;
+	uint32_t release_cause; /* WAIT_CONN_CONF */
+
+	/* SLS to be used to transmit all Connection-oriented messages
+	 * (ITU-T Q.714 1.1.2.3 Protocol class 2).
+	 * SLS is 4 bits, as described in ITU Q.704 Figure 3 */
+	uint8_t tx_co_mtp_sls;
+
+	struct msgb *opt_data_cache;
+
+	/* incoming (true) or outgoing (false) */
+	bool incoming;
+
+	/* Osmo FSM Instance of sccp_scoc_fsm */
+	struct osmo_fsm_inst *fi;
+
+	/* Connect timer */
+	struct osmo_timer_list t_conn;
+
+	/* inactivity timers */
+	struct osmo_timer_list t_ias;
+	struct osmo_timer_list t_iar;
+
+	/* release timers */
+	struct osmo_timer_list t_rel;
+	struct osmo_timer_list t_int;
+	struct osmo_timer_list t_rep_rel;
+};
+
+struct sccp_connection *sccp_conn_alloc(struct osmo_sccp_user *user, uint32_t conn_id);
+void sccp_conn_free(struct sccp_connection *conn);
+
+/* timer related: */
+void sccp_conn_restart_tx_inact_timer(struct sccp_connection *conn);
+void sccp_conn_restart_rx_inact_timer(struct sccp_connection *conn);
+void sccp_conn_start_inact_timers(struct sccp_connection *conn);
+void sccp_conn_stop_inact_timers(struct sccp_connection *conn);
+void sccp_conn_start_rel_timer(struct sccp_connection *conn);
+void sccp_conn_start_rep_rel_timer(struct sccp_connection *conn);
+void sccp_conn_start_int_timer(struct sccp_connection *conn);
+void sccp_conn_stop_release_timers(struct sccp_connection *conn);
+void sccp_conn_start_connect_timer(struct sccp_connection *conn);
+void sccp_conn_stop_connect_timer(struct sccp_connection *conn);
+
+void sccp_conn_opt_data_send_cache(struct sccp_connection *conn, int exp_type, uint8_t msg_class);
+
+int sccp_conn_xua_gen_encode_and_send(struct sccp_connection *conn, uint32_t event,
+				      const struct osmo_scu_prim *prim, int msg_type);
+int sccp_conn_xua_gen_relre_and_send(struct sccp_connection *conn, uint32_t cause,
+				     struct osmo_scu_prim *prim);
+void sccp_conn_scu_gen_encode_and_send(struct sccp_connection *conn, uint32_t event,
+				       struct xua_msg *xua, unsigned int primitive,
+				       enum osmo_prim_operation operation);
+
+
+#define _LOGPSCC(scc, subsys, level, fmt, args ...) \
+	_LOGPSCU((scc)->user, subsys, level, "CONN(%d,remPC=%u=%s) " fmt, \
+		 (conn)->conn_id, (conn)->remote_pc, osmo_ss7_pointcode_print((conn)->inst->ss7, (conn)->remote_pc), ## args)
+#define LOGPSCC(scc, level, fmt, args ...) \
+	_LOGPSCC(scc, DLSCCP, level, fmt, ## args)
diff --git a/src/sccp_helpers.c b/src/sccp_helpers.c
index 39099fd..e86aa32 100644
--- a/src/sccp_helpers.c
+++ b/src/sccp_helpers.c
@@ -35,6 +35,7 @@
 
 #include "ss7_internal.h"
 #include "sccp_internal.h"
+#include "sccp_user.h"
 
 #define SCU_MSG_SIZE		2048
 #define SCU_MSG_HEADROOM	512
diff --git a/src/sccp_internal.h b/src/sccp_internal.h
index 298ef3e..5490fdb 100644
--- a/src/sccp_internal.h
+++ b/src/sccp_internal.h
@@ -11,9 +11,11 @@
 #include <osmocom/sigtran/osmo_ss7.h>
 #include <osmocom/sigtran/protocol/mtp.h>
 
+#include "ss7_user.h"
+
 #define SCCP_STR "Signalling Connection Control Part\n"
 
-#include "ss7_user.h"
+struct xua_msg;
 
 /* SCCP addressbook */
 extern struct llist_head sccp_address_book_global;
@@ -71,39 +73,13 @@
 
 	uint32_t max_optional_data;
 };
+struct sccp_connection *sccp_find_conn_by_id(const struct osmo_sccp_instance *inst, uint32_t id);
 #define _LOGPSCI(sci, subsys, level, fmt, args ...) \
 	_LOGSS7((sci)->ss7, subsys, level, "SCCP(rctx=%" PRIu32 ") " fmt, (sci)->route_ctx, ## args)
 #define LOGPSCI(sci, level, fmt, args ...) \
 	_LOGPSCI(sci, DLSCCP, level, fmt, ## args)
 
 
-struct osmo_sccp_user {
-	/*! \brief entry in list of sccp users of \ref osmo_sccp_instance */
-	struct llist_head list;
-	/*! \brief pointer back to SCCP instance */
-	struct osmo_sccp_instance *inst;
-	/*! \brief human-readable name of this user */
-	char *name;
-
-	/*! \brief SSN and/or point code to which we are bound */
-	uint16_t ssn;
-	uint32_t pc;
-
-	/* set if we are a server */
-	struct llist_head links;
-
-	/* user call-back function in case of incoming primitives */
-	osmo_prim_cb prim_cb;
-	void *priv;
-
-	/* Application Server FSM Instance */
-	struct osmo_fsm_inst *as_fi;
-};
-#define _LOGPSCU(scu, subsys, level, fmt, args ...) \
-	_LOGPSCI((scu)->inst, subsys, level, "SCU(%s) " fmt, osmo_sccp_user_name(scu), ## args)
-#define LOGPSCU(scu, level, fmt, args ...) \
-	_LOGPSCU(scu, DLSCCP, level, fmt, ## args)
-
 extern int DSCCP;
 
 struct xua_msg;
@@ -136,18 +112,12 @@
 void sccp_sclc_rx_scrc_rout_fail(struct osmo_sccp_instance *inst,
 				 struct xua_msg *xua, uint32_t cause);
 
-int sccp_user_prim_up(struct osmo_sccp_user *scut, struct osmo_scu_prim *prim);
-
 /* SCU -> SCLC */
 int sccp_sclc_user_sap_down(struct osmo_sccp_user *scu, struct osmo_prim_hdr *oph);
 int sccp_sclc_user_sap_down_nofree(struct osmo_sccp_user *scu, struct osmo_prim_hdr *oph);
 
 struct msgb *sccp_msgb_alloc(const char *name);
 
-extern struct osmo_fsm sccp_scoc_fsm;
-
-void sccp_scoc_show_connections(struct vty *vty, struct osmo_sccp_instance *inst);
-
 void osmo_sccp_vty_write_cs7_node(struct vty *vty, const char *indent, struct osmo_sccp_instance *inst);
 
 /* Local Broadcast (LBCS) */
diff --git a/src/sccp_lbcs.c b/src/sccp_lbcs.c
index 3aa4f7a..34b6181 100644
--- a/src/sccp_lbcs.c
+++ b/src/sccp_lbcs.c
@@ -34,6 +34,7 @@
 
 #include "xua_internal.h"
 #include "sccp_internal.h"
+#include "sccp_user.h"
 
 /* perform a "local broadcast" of a N-PCSTATE.ind */
 void sccp_lbcs_local_bcast_pcstate(struct osmo_sccp_instance *inst,
diff --git a/src/sccp_sap.c b/src/sccp_sap.c
index b3bc3e8..45e4dfc 100644
--- a/src/sccp_sap.c
+++ b/src/sccp_sap.c
@@ -25,6 +25,12 @@
 
 #include <osmocom/sigtran/sccp_sap.h>
 
+#include "ss7_instance.h"
+#include "sccp_connection.h"
+#include "sccp_scoc_fsm.h"
+#include "sccp_internal.h"
+#include "sccp_user.h"
+
 const struct value_string osmo_scu_prim_type_names[] = {
 	{ OSMO_SCU_PRIM_N_CONNECT,		"N-CONNECT" },
 	{ OSMO_SCU_PRIM_N_DATA,			"N-DATA" },
@@ -166,3 +172,106 @@
 	{ OSMO_SCCP_SSN_BSSAP,		"BSSAP" },
 	{ 0, NULL }
 };
+
+/* get the Connection ID of the given SCU primitive */
+static uint32_t scu_prim_conn_id(const struct osmo_scu_prim *prim)
+{
+	switch (prim->oph.primitive) {
+	case OSMO_SCU_PRIM_N_CONNECT:
+		return prim->u.connect.conn_id;
+	case OSMO_SCU_PRIM_N_DATA:
+		return prim->u.data.conn_id;
+	case OSMO_SCU_PRIM_N_DISCONNECT:
+		return prim->u.disconnect.conn_id;
+	case OSMO_SCU_PRIM_N_RESET:
+		return prim->u.reset.conn_id;
+	default:
+		return 0;
+	}
+}
+
+/* map from SCU-primitives to SCOC FSM events */
+static const struct osmo_prim_event_map scu_scoc_event_map[] = {
+	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_REQUEST,
+		SCOC_E_SCU_N_CONN_REQ },
+	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_RESPONSE,
+		SCOC_E_SCU_N_CONN_RESP },
+	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_DATA, PRIM_OP_REQUEST,
+		SCOC_E_SCU_N_DATA_REQ },
+	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_REQUEST,
+		SCOC_E_SCU_N_DISC_REQ },
+	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_EXPEDITED_DATA, PRIM_OP_REQUEST,
+		SCOC_E_SCU_N_EXP_DATA_REQ },
+	{ 0, 0, 0, OSMO_NO_EVENT }
+};
+
+/*! Main entrance function for primitives from SCCP User.
+ * The caller is required to free oph->msg, otherwise the same as osmo_sccp_user_sap_down().
+ *  \param[in] scu SCCP User sending us the primitive
+ *  \param[in] oph Osmocom primitive sent by the user
+ *  \returns 0 on success; negative on error */
+int osmo_sccp_user_sap_down_nofree(struct osmo_sccp_user *scu, struct osmo_prim_hdr *oph)
+{
+	struct osmo_scu_prim *prim = (struct osmo_scu_prim *) oph;
+	struct osmo_sccp_instance *inst = scu->inst;
+	struct sccp_connection *conn;
+	int rc = 0;
+	int event;
+
+	LOGPSCU(scu, LOGL_DEBUG, "Received SCCP User Primitive (%s)\n",
+		osmo_scu_prim_name(&prim->oph));
+
+	switch (OSMO_PRIM_HDR(&prim->oph)) {
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_UNITDATA, PRIM_OP_REQUEST):
+	/* other CL primitives? */
+		/* Connectionless by-passes this altogether */
+		return sccp_sclc_user_sap_down_nofree(scu, oph);
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_REQUEST):
+		/* Allocate new connection structure */
+		conn = sccp_conn_alloc(scu, prim->u.connect.conn_id);
+		if (!conn) {
+			/* FIXME: inform SCCP user with proper reply */
+			LOGPSCU(scu, LOGL_ERROR, "Cannot create conn-id for primitive %s\n",
+				osmo_scu_prim_name(&prim->oph));
+			return rc;
+		}
+		break;
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_RESPONSE):
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_DATA, PRIM_OP_REQUEST):
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_REQUEST):
+	case OSMO_PRIM(OSMO_SCU_PRIM_N_RESET, PRIM_OP_REQUEST):
+		/* Resolve existing connection structure */
+		conn = sccp_find_conn_by_id(inst, scu_prim_conn_id(prim));
+		if (!conn) {
+			/* FIXME: inform SCCP user with proper reply */
+			LOGPSCU(scu, LOGL_ERROR, "Received unknown conn-id %u for primitive %s\n",
+				scu_prim_conn_id(prim), osmo_scu_prim_name(&prim->oph));
+			return rc;
+		}
+		break;
+	default:
+		LOGPSCU(scu, LOGL_ERROR, "Received unknown primitive %s\n",
+			osmo_scu_prim_name(&prim->oph));
+		return -1;
+	}
+
+	/* Map from primitive to event */
+	event = osmo_event_for_prim(oph, scu_scoc_event_map);
+
+	/* Dispatch event into connection */
+	return osmo_fsm_inst_dispatch(conn->fi, event, prim);
+}
+
+/*! Main entrance function for primitives from SCCP User.
+ * Implies a msgb_free(oph->msg), otherwise the same as osmo_sccp_user_sap().
+ *  \param[in] scu SCCP User sending us the primitive
+ *  \param[in] oph Osmocom primitive sent by the user
+ *  \returns 0 on success; negative on error */
+int osmo_sccp_user_sap_down(struct osmo_sccp_user *scu, struct osmo_prim_hdr *oph)
+{
+	struct osmo_scu_prim *prim = (struct osmo_scu_prim *) oph;
+	struct msgb *msg = prim->oph.msg;
+	int rc = osmo_sccp_user_sap_down_nofree(scu, oph);
+	msgb_free(msg);
+	return rc;
+}
diff --git a/src/sccp_sclc.c b/src/sccp_sclc.c
index 7fee2a3..b8df996 100644
--- a/src/sccp_sclc.c
+++ b/src/sccp_sclc.c
@@ -59,6 +59,7 @@
 #include "xua_internal.h"
 #include "ss7_internal.h"
 #include "sccp_internal.h"
+#include "sccp_user.h"
 
 /* generate a 'struct xua_msg' of requested type from primitive data */
 static struct xua_msg *xua_gen_msg_cl(uint32_t event,
diff --git a/src/sccp_scmg.c b/src/sccp_scmg.c
index 6f7383c..ee86954 100644
--- a/src/sccp_scmg.c
+++ b/src/sccp_scmg.c
@@ -36,6 +36,7 @@
 #include "xua_internal.h"
 #include "ss7_internal.h"
 #include "sccp_internal.h"
+#include "sccp_user.h"
 
 /* ITU-T Q.714 5.3.3 Subsystem allowed */
 void sccp_scmg_rx_ssn_allowed(struct osmo_sccp_instance *inst, uint32_t dpc, uint32_t ssn, uint32_t smi)
diff --git a/src/sccp_scoc.c b/src/sccp_scoc.c
index a725a02..b460d7d 100644
--- a/src/sccp_scoc.c
+++ b/src/sccp_scoc.c
@@ -62,158 +62,17 @@
 #include <osmocom/sccp/sccp_types.h>
 
 #include "xua_internal.h"
+#include "sccp_connection.h"
+#include "sccp_scoc_fsm.h"
 #include "sccp_internal.h"
+#include "sccp_user.h"
 #include "ss7_internal.h"
 #include "ss7_instance.h"
 
-#define S(x)	(1 << (x))
-#define SCU_MSGB_SIZE	1024
-
 /***********************************************************************
  * SCCP connection table
  ***********************************************************************/
 
-/* a logical connection within the SCCP instance */
-struct sccp_connection {
-	/* entry in (struct sccp_instance)->connections */
-	struct rb_node node;
-	/* which instance are we part of? */
-	struct osmo_sccp_instance *inst;
-	/* which user owns us? */
-	struct osmo_sccp_user *user;
-
-	/* remote point code */
-	uint32_t remote_pc;
-
-	/* local/remote addresses and identities */
-	struct osmo_sccp_addr calling_addr;
-	struct osmo_sccp_addr called_addr;
-	/* SCCP connection identifier. Only relevant across the SCCP User SAP,
-	 * i.e. between the local application using the SCCP stack provided by
-	 * libosmo-sccp.  Never transmitted over the wire! */
-	uint32_t conn_id;
-	/* SCCP Remote Connection Reference.  Allocated by the remote
-	 * SCCP stack to uniquely identify a SCCP connection on its end.
-	 * We don't interpret it, but simply cache it here so we can use
-	 * it whenever sending data to the peer. Only relevant over the
-	 * wire, not to be used across the SCCP user SAP */
-	uint32_t remote_ref;
-
-	uint32_t importance;
-	uint32_t sccp_class;
-	uint32_t release_cause; /* WAIT_CONN_CONF */
-
-	/* SLS to be used to transmit all Connection-oriented messages
-	 * (ITU-T Q.714 1.1.2.3 Protocol class 2).
-	 * SLS is 4 bits, as described in ITU Q.704 Figure 3 */
-	uint8_t tx_co_mtp_sls;
-
-	struct msgb *opt_data_cache;
-
-	/* incoming (true) or outgoing (false) */
-	bool incoming;
-
-	/* Osmo FSM Instance of sccp_scoc_fsm */
-	struct osmo_fsm_inst *fi;
-
-	/* Connect timer */
-	struct osmo_timer_list t_conn;
-
-	/* inactivity timers */
-	struct osmo_timer_list t_ias;
-	struct osmo_timer_list t_iar;
-
-	/* release timers */
-	struct osmo_timer_list t_rel;
-	struct osmo_timer_list t_int;
-	struct osmo_timer_list t_rep_rel;
-};
-#define _LOGPSCC(scc, subsys, level, fmt, args ...) \
-	_LOGPSCU((scc)->user, subsys, level, "CONN(%d,remPC=%u=%s) " fmt, \
-		 (conn)->conn_id, (conn)->remote_pc, osmo_ss7_pointcode_print((conn)->inst->ss7, (conn)->remote_pc), ## args)
-#define LOGPSCC(scc, level, fmt, args ...) \
-	_LOGPSCC(scc, DLSCCP, level, fmt, ## args)
-
-/***********************************************************************
- * various helper functions
- ***********************************************************************/
-
-enum sccp_connection_state {
-	S_IDLE,
-	S_CONN_PEND_IN,
-	S_CONN_PEND_OUT,
-	S_ACTIVE,
-	S_DISCONN_PEND,
-	S_RESET_IN,
-	S_RESET_OUT,
-	S_BOTHWAY_RESET,
-	S_WAIT_CONN_CONF,
-};
-
-/* Events that this FSM can process */
-enum sccp_scoc_event {
-	/* Primitives from SCCP-User */
-	SCOC_E_SCU_N_CONN_REQ,
-	SCOC_E_SCU_N_CONN_RESP,
-	SCOC_E_SCU_N_DISC_REQ,
-	SCOC_E_SCU_N_DATA_REQ,
-	SCOC_E_SCU_N_EXP_DATA_REQ,
-
-	/* Events from RCOC (Routing for Connection Oriented) */
-	SCOC_E_RCOC_CONN_IND,
-	SCOC_E_RCOC_ROUT_FAIL_IND,
-	SCOC_E_RCOC_RLSD_IND,
-	SCOC_E_RCOC_REL_COMPL_IND,
-	SCOC_E_RCOC_CREF_IND,
-	SCOC_E_RCOC_CC_IND,
-	SCOC_E_RCOC_DT1_IND,
-	SCOC_E_RCOC_DT2_IND,
-	SCOC_E_RCOC_IT_IND,
-	SCOC_E_RCOC_OTHER_NPDU,
-	SCOC_E_RCOC_ERROR_IND,
-
-	/* Timer Events */
-	SCOC_E_T_IAR_EXP,
-	SCOC_E_T_IAS_EXP,
-
-	SCOC_E_CONN_TMR_EXP,
-
-	SCOC_E_T_REL_EXP,
-	SCOC_E_T_INT_EXP,
-	SCOC_E_T_REP_REL_EXP,
-};
-
-static const struct value_string scoc_event_names[] = {
-	/* Primitives from SCCP-User */
-	{ SCOC_E_SCU_N_CONN_REQ,	"N-CONNECT.req" },
-	{ SCOC_E_SCU_N_CONN_RESP,	"N-CONNECT.resp" },
-	{ SCOC_E_SCU_N_DISC_REQ,	"N-DISCONNECT.req" },
-	{ SCOC_E_SCU_N_DATA_REQ,	"N-DATA.req" },
-	{ SCOC_E_SCU_N_EXP_DATA_REQ,	"N-EXPEDITED_DATA.req" },
-
-	/* Events from RCOC (Routing for Connection Oriented) */
-	{ SCOC_E_RCOC_CONN_IND,		"RCOC-CONNECT.ind" },
-	{ SCOC_E_RCOC_ROUT_FAIL_IND,	"RCOC-ROUT_FAIL.ind" },
-	{ SCOC_E_RCOC_RLSD_IND,		"RCOC-RELEASED.ind" },
-	{ SCOC_E_RCOC_REL_COMPL_IND,	"RCOC-RELEASE_COMPLETE.ind" },
-	{ SCOC_E_RCOC_CREF_IND,		"RCOC-CONNECT_REFUSED.ind" },
-	{ SCOC_E_RCOC_CC_IND,		"RCOC-CONNECT_CONFIRM.ind" },
-	{ SCOC_E_RCOC_DT1_IND,		"RCOC-DT1.ind" },
-	{ SCOC_E_RCOC_DT2_IND,		"RCOC-DT2.ind" },
-	{ SCOC_E_RCOC_IT_IND,		"RCOC-IT.ind" },
-	{ SCOC_E_RCOC_OTHER_NPDU,	"RCOC-OTHER_NPDU.ind" },
-	{ SCOC_E_RCOC_ERROR_IND,	"RCOC-ERROR.ind" },
-
-	{ SCOC_E_T_IAR_EXP,		"T(iar)_expired" },
-	{ SCOC_E_T_IAS_EXP,		"T(ias)_expired" },
-	{ SCOC_E_CONN_TMR_EXP,		"T(conn)_expired" },
-	{ SCOC_E_T_REL_EXP,		"T(rel)_expired" },
-	{ SCOC_E_T_INT_EXP,		"T(int)_expired" },
-	{ SCOC_E_T_REP_REL_EXP,		"T(rep_rel)_expired" },
-
-	{ 0, NULL }
-};
-
 /* how to map a SCCP CO message to an event */
 static const struct xua_msg_event_map sua_scoc_event_map[] = {
 	{ SUA_MSGC_CO, SUA_CO_CORE, SCOC_E_RCOC_CONN_IND },
@@ -226,22 +85,6 @@
 	{ SUA_MSGC_CO, SUA_CO_COERR, SCOC_E_RCOC_ERROR_IND },
 };
 
-
-/* map from SCU-primitives to SCOC FSM events */
-static const struct osmo_prim_event_map scu_scoc_event_map[] = {
-	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_REQUEST,
-		SCOC_E_SCU_N_CONN_REQ },
-	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_RESPONSE,
-		SCOC_E_SCU_N_CONN_RESP },
-	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_DATA, PRIM_OP_REQUEST,
-		SCOC_E_SCU_N_DATA_REQ },
-	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_REQUEST,
-		SCOC_E_SCU_N_DISC_REQ },
-	{ SCCP_SAP_USER, OSMO_SCU_PRIM_N_EXPEDITED_DATA, PRIM_OP_REQUEST,
-		SCOC_E_SCU_N_EXP_DATA_REQ },
-	{ 0, 0, 0, OSMO_NO_EVENT }
-};
-
 /***********************************************************************
  * Timer Handling
  ***********************************************************************/
@@ -289,128 +132,11 @@
 		   ARRAY_SIZE(osmo_sccp_timer_names) == (OSMO_SCCP_TIMERS_LEN),
 		   assert_osmo_sccp_timers_count);
 
-static void sccp_timer_schedule(const struct sccp_connection *conn,
-				struct osmo_timer_list *timer,
-				enum osmo_sccp_timer timer_name)
-{
-	const unsigned long val_sec = osmo_tdef_get(conn->inst->tdefs, timer_name, OSMO_TDEF_S, -1);
-	osmo_timer_schedule(timer, val_sec, 0);
-}
-
-/* T(ias) has expired, send a COIT message to the peer */
-static void tx_inact_tmr_cb(void *data)
-{
-	struct sccp_connection *conn = data;
-	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_IAS_EXP, NULL);
-}
-
-/* T(iar) has expired, notify the FSM about it */
-static void rx_inact_tmr_cb(void *data)
-{
-	struct sccp_connection *conn = data;
-	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_IAR_EXP, NULL);
-}
-
-/* T(rel) has expired, notify the FSM about it */
-static void rel_tmr_cb(void *data)
-{
-	struct sccp_connection *conn = data;
-	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_REL_EXP, NULL);
-}
-
-/* T(int) has expired, notify the FSM about it */
-static void int_tmr_cb(void *data)
-{
-	struct sccp_connection *conn = data;
-	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_INT_EXP, NULL);
-}
-
-/* T(repeat_rel) has expired, notify the FSM about it */
-static void rep_rel_tmr_cb(void *data)
-{
-	struct sccp_connection *conn = data;
-	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_T_REP_REL_EXP, NULL);
-}
-
-/* T(conn) has expired, notify the FSM about it */
-static void conn_tmr_cb(void *data)
-{
-	struct sccp_connection *conn = data;
-	osmo_fsm_inst_dispatch(conn->fi, SCOC_E_CONN_TMR_EXP, NULL);
-}
-
-/* Re-start the Tx inactivity timer */
-static void conn_restart_tx_inact_timer(struct sccp_connection *conn)
-{
-	sccp_timer_schedule(conn, &conn->t_ias, OSMO_SCCP_TIMER_IAS);
-}
-
-/* Re-start the Rx inactivity timer */
-static void conn_restart_rx_inact_timer(struct sccp_connection *conn)
-{
-	sccp_timer_schedule(conn, &conn->t_iar, OSMO_SCCP_TIMER_IAR);
-}
-
-/* Re-start both Rx and Tx inactivity timers */
-static void conn_start_inact_timers(struct sccp_connection *conn)
-{
-	conn_restart_tx_inact_timer(conn);
-	conn_restart_rx_inact_timer(conn);
-}
-
-/* Stop both Rx and Tx inactivity timers */
-static void conn_stop_inact_timers(struct sccp_connection *conn)
-{
-	osmo_timer_del(&conn->t_ias);
-	osmo_timer_del(&conn->t_iar);
-}
-
-/* Start release timer T(rel) */
-static void conn_start_rel_timer(struct sccp_connection *conn)
-{
-	sccp_timer_schedule(conn, &conn->t_rel, OSMO_SCCP_TIMER_REL);
-}
-
-/* Start repeat release timer T(rep_rel) */
-static void conn_start_rep_rel_timer(struct sccp_connection *conn)
-{
-	sccp_timer_schedule(conn, &conn->t_rep_rel, OSMO_SCCP_TIMER_REPEAT_REL);
-}
-
-/* Start interval timer T(int) */
-static void conn_start_int_timer(struct sccp_connection *conn)
-{
-	sccp_timer_schedule(conn, &conn->t_int, OSMO_SCCP_TIMER_INT);
-}
-
-/* Stop all release related timers: T(rel), T(int) and T(rep_rel) */
-static void conn_stop_release_timers(struct sccp_connection *conn)
-{
-	osmo_timer_del(&conn->t_rel);
-	osmo_timer_del(&conn->t_int);
-	osmo_timer_del(&conn->t_rep_rel);
-}
-
-/* Start connect timer T(conn) */
-static void conn_start_connect_timer(struct sccp_connection *conn)
-{
-	sccp_timer_schedule(conn, &conn->t_conn, OSMO_SCCP_TIMER_CONN_EST);
-}
-
-/* Stop connect timer T(conn) */
-static void conn_stop_connect_timer(struct sccp_connection *conn)
-{
-	osmo_timer_del(&conn->t_conn);
-}
-
-
 /***********************************************************************
  * SUA Instance and Connection handling
  ***********************************************************************/
 
-static void conn_destroy(struct sccp_connection *conn);
-
-static struct sccp_connection *conn_find_by_id(const struct osmo_sccp_instance *inst, uint32_t id)
+struct sccp_connection *sccp_find_conn_by_id(const struct osmo_sccp_instance *inst, uint32_t id)
 {
 	struct sccp_connection *conn;
 	const struct rb_node *node = inst->connections.rb_node;
@@ -427,98 +153,9 @@
 	return NULL;
 }
 
-static int conn_add_node(struct osmo_sccp_instance *inst, struct sccp_connection *conn)
-{
-	struct rb_node **n = &(inst->connections.rb_node);
-	struct rb_node *parent = NULL;
-
-	while (*n) {
-		struct sccp_connection *it;
-
-		it = container_of(*n, struct sccp_connection, node);
-
-		parent = *n;
-		if (conn->conn_id < it->conn_id) {
-			n = &((*n)->rb_left);
-		} else if (conn->conn_id > it->conn_id) {
-			n = &((*n)->rb_right);
-		} else {
-			LOGPSCI(inst, LOGL_ERROR, "Trying to reserve already reserved conn_id %u\n",
-				conn->conn_id);
-			return -EEXIST;
-		}
-	}
-
-	rb_link_node(&conn->node, parent, n);
-	rb_insert_color(&conn->node, &inst->connections);
-	return 0;
-}
-
 bool osmo_sccp_conn_id_exists(const struct osmo_sccp_instance *inst, uint32_t id)
 {
-	return conn_find_by_id(inst, id) ? true : false;
-}
-
-#define INIT_TIMER(x, fn, priv)		do { (x)->cb = fn; (x)->data = priv; } while (0)
-
-/* Generate an SLS to be used for Connection-oriented messages on this SCCP connection.
- * SLS is 4 bits, as described in ITU Q.704 Figure 3.
- * ITU-T Q.714 1.1.2.3 Protocol class 2:
- *  "Messages belonging to a given signalling connection shall contain the same
- *  value of the SLS field to ensure sequencing as described in 1.1.2.2"
- */
-static uint8_t sccp_conn_gen_tx_co_mtp_sls(const struct sccp_connection *conn)
-{
-	/* Implementation: Derive the SLS from conn->conn_id. */
-	const uint32_t id = conn->conn_id;
-	uint8_t sls;
-
-	/* First shrink it to 1 byte: */
-	sls = ((id >> (3*8)) ^ (id >> (2*8)) ^ (id >> (1*8)) ^ (id)) & 0xff;
-	/* Now shrink it 8 -> 4 bits: */
-	sls = ((sls >> 4) ^ sls) & 0x0f;
-
-	return sls;
-}
-
-/* allocate + init a SCCP Connection with given ID */
-static struct sccp_connection *conn_create_id(struct osmo_sccp_user *user, uint32_t conn_id)
-{
-	struct sccp_connection *conn = talloc_zero(user->inst, struct sccp_connection);
-	char name[16];
-
-	conn->conn_id = conn_id;
-	conn->inst = user->inst;
-	conn->user = user;
-
-	if (conn_add_node(user->inst, conn) < 0) {
-		talloc_free(conn);
-		return NULL;
-	}
-
-	INIT_TIMER(&conn->t_conn, conn_tmr_cb, conn);
-	INIT_TIMER(&conn->t_ias, tx_inact_tmr_cb, conn);
-	INIT_TIMER(&conn->t_iar, rx_inact_tmr_cb, conn);
-	INIT_TIMER(&conn->t_rel, rel_tmr_cb, conn);
-	INIT_TIMER(&conn->t_int, int_tmr_cb, conn);
-	INIT_TIMER(&conn->t_rep_rel, rep_rel_tmr_cb, conn);
-
-	conn->tx_co_mtp_sls = sccp_conn_gen_tx_co_mtp_sls(conn);
-
-	/* this might change at runtime, as it is not a constant :/ */
-	sccp_scoc_fsm.log_subsys = DLSCCP;
-
-	/* we simply use the connection ID as FSM instance name */
-	snprintf(name, sizeof(name), "%u", conn->conn_id);
-	conn->fi = osmo_fsm_inst_alloc(&sccp_scoc_fsm, conn, conn,
-					LOGL_DEBUG, name);
-	if (!conn->fi) {
-		rb_erase(&conn->node, &user->inst->connections);
-		talloc_free(conn);
-		return NULL;
-	}
-
-	return conn;
+	return sccp_find_conn_by_id(inst, id) ? true : false;
 }
 
 /* Return an unused SCCP connection ID.
@@ -547,7 +184,7 @@
 		if (OSMO_UNLIKELY(sccp->next_id == 0x00FFFFFF))
 			sccp->next_id = 0;
 
-		if (!conn_find_by_id(sccp, sccp->next_id))
+		if (!sccp_find_conn_by_id(sccp, sccp->next_id))
 			return sccp->next_id;
 	}
 
@@ -560,37 +197,7 @@
 	int conn_id = osmo_sccp_instance_next_conn_id(user->inst);
 	if (conn_id < 0)
 		return NULL;
-	return conn_create_id(user, conn_id);
-}
-
-static void conn_opt_data_clear_cache(struct sccp_connection *conn)
-{
-	if (conn->opt_data_cache) {
-		msgb_free(conn->opt_data_cache);
-		conn->opt_data_cache = NULL;
-	}
-}
-
-/* destroy a SCCP connection state, releasing all timers, terminating
- * FSM and releasing associated memory */
-static void conn_destroy(struct sccp_connection *conn)
-{
-	conn_opt_data_clear_cache(conn);
-
-	conn_stop_connect_timer(conn);
-	conn_stop_inact_timers(conn);
-	conn_stop_release_timers(conn);
-	rb_erase(&conn->node, &conn->inst->connections);
-
-	osmo_fsm_inst_term(conn->fi, OSMO_FSM_TERM_REQUEST, NULL);
-
-	talloc_free(conn);
-}
-
-/* allocate a message buffer for an SCCP User Primitive */
-static struct msgb *scu_msgb_alloc(void)
-{
-	return msgb_alloc(SCU_MSGB_SIZE, "SCCP User Primitive");
+	return sccp_conn_alloc(user, conn_id);
 }
 
 /* generate a RELRE (release request) xua_msg for given conn */
@@ -617,8 +224,8 @@
 }
 
 /* generate xua_msg, encode it and send it to SCRC */
-static int xua_gen_relre_and_send(struct sccp_connection *conn, uint32_t cause,
-				  struct osmo_scu_prim *prim)
+int sccp_conn_xua_gen_relre_and_send(struct sccp_connection *conn, uint32_t cause,
+				     struct osmo_scu_prim *prim)
 {
 	struct xua_msg *xua;
 
@@ -634,32 +241,8 @@
 	return 0;
 }
 
-/* Send cached optional data (if any) from expected message type and clear cache */
-static void xua_opt_data_send_cache(struct sccp_connection *conn, int exp_type, uint8_t msg_class)
-{
-	const struct xua_dialect *dialect = &xua_dialect_sua;
-	const struct xua_msg_class *xmc = dialect->class[msg_class];
-
-	if (!conn->opt_data_cache)
-		return;
-
-	if (conn->opt_data_cache->cb[0] != exp_type) {
-		/* Caller (from the FSM) knows what was the source of Optional Data we're sending.
-		 * Compare this information with source of Optional Data recorded while caching
-		 * to make sure we're on the same page.
-		 */
-		LOGPSCC(conn, LOGL_ERROR, "unexpected message type %s != cache source %s\n",
-			xua_class_msg_name(xmc, exp_type),
-			xua_class_msg_name(xmc, conn->opt_data_cache->cb[0]));
-	} else {
-		osmo_sccp_tx_data(conn->user, conn->conn_id, msgb_data(conn->opt_data_cache), msgb_length(conn->opt_data_cache));
-	}
-
-	conn_opt_data_clear_cache(conn);
-}
-
 /* Check if optional data should be dropped, log given error message if so */
-static bool xua_drop_data_check_drop(const struct osmo_scu_prim *prim, unsigned lim, const char *message)
+static bool xua_opt_data_check_drop(const struct osmo_scu_prim *prim, unsigned lim, const char *message)
 {
 	if (msgb_l2len(prim->oph.msg) > lim) {
 		LOGP(DLSCCP, LOGL_ERROR,
@@ -677,7 +260,7 @@
 	uint8_t *buf;
 	uint32_t max_optional_data = conn->inst->max_optional_data;
 
-	if (xua_drop_data_check_drop(prim, SCCP_MAX_DATA, "cache overrun"))
+	if (xua_opt_data_check_drop(prim, SCCP_MAX_DATA, "cache overrun"))
 		return false;
 
 	if (msgb_l2len(prim->oph.msg) > max_optional_data) {
@@ -713,7 +296,7 @@
 	case SUA_CO_COAK: /* §4.3 Connection confirm (CC) */
 		return xua_opt_data_cache_keep(conn, prim, msg_type);
 	case SUA_CO_COREF: /* §4.4 Connection refused (CREF) */
-		if (xua_drop_data_check_drop(prim, max_optional_data, "over ITU-T Rec. Q.713 §4.4 limit")) {
+		if (xua_opt_data_check_drop(prim, max_optional_data, "over ITU-T Rec. Q.713 §4.4 limit")) {
 			/* From the state diagrams in ITU-T Rec Q.714, there's no way to send DT1 neither before nor after CREF
 			 * at this point, so the only option we have is to drop optional data:
 			 * see Figure C.3 / Q.714 (sheet 2 of 6) */
@@ -722,7 +305,7 @@
 		break;
 	case SUA_CO_RELRE: /* §4.5 Released (RLSD) */
 		if (msgb_l2len(prim->oph.msg) > max_optional_data) {
-			if (xua_drop_data_check_drop(prim, SCCP_MAX_DATA, "protocol error"))
+			if (xua_opt_data_check_drop(prim, SCCP_MAX_DATA, "protocol error"))
 				return false;
 			/* There's no need to cache the optional data since the connection is still active at this point:
 			 * Send the Optional Data in a DT1 ahead of the RLSD, because it is too large to be sent in one message.
@@ -867,8 +450,8 @@
 /* generate xua_msg, encode it and send it to SCRC
  * returns 0 on success, negative on error
  */
-static int xua_gen_encode_and_send(struct sccp_connection *conn, uint32_t event,
-				   const struct osmo_scu_prim *prim, int msg_type)
+int sccp_conn_xua_gen_encode_and_send(struct sccp_connection *conn, uint32_t event,
+				      const struct osmo_scu_prim *prim, int msg_type)
 {
 	struct xua_msg *xua;
 
@@ -881,643 +464,6 @@
 	return 0;
 }
 
-/* allocate a SCU primitive to be sent to the user */
-static struct osmo_scu_prim *scu_prim_alloc(unsigned int primitive, enum osmo_prim_operation operation)
-{
-	struct msgb *upmsg = scu_msgb_alloc();
-	struct osmo_scu_prim *prim;
-
-	prim = (struct osmo_scu_prim *) msgb_put(upmsg, sizeof(*prim));
-	osmo_prim_init(&prim->oph, SCCP_SAP_USER,
-			primitive, operation, upmsg);
-	upmsg->l2h = upmsg->tail;
-	return prim;
-}
-
-/* high-level function to generate a SCCP User primitive of requested
- * type based on the connection and currently processed XUA message */
-static void scu_gen_encode_and_send(struct sccp_connection *conn, uint32_t event,
-				    struct xua_msg *xua, unsigned int primitive,
-				    enum osmo_prim_operation operation)
-{
-	struct osmo_scu_prim *scu_prim;
-	struct osmo_scu_disconn_param *udisp;
-	struct osmo_scu_connect_param *uconp;
-	struct osmo_scu_data_param *udatp;
-	struct xua_msg_part *data_ie;
-
-	scu_prim = scu_prim_alloc(primitive, operation);
-
-	switch (OSMO_PRIM_HDR(&scu_prim->oph)) {
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION):
-		udisp = &scu_prim->u.disconnect;
-		udisp->conn_id = conn->conn_id;
-		udisp->responding_addr = conn->called_addr;
-		udisp->importance = conn->importance;
-		udisp->originator = OSMO_SCCP_ORIG_UNDEFINED;
-		//udisp->in_sequence_control;
-		if (xua) {
-			udisp->cause = xua_msg_get_u32(xua, SUA_IEI_CAUSE);
-			if (xua_msg_find_tag(xua, SUA_IEI_SRC_ADDR)) {
-				if (sua_addr_parse(&udisp->responding_addr, xua, SUA_IEI_SRC_ADDR) < 0) {
-					LOGPSCC(conn, LOGL_ERROR, "XUA Message %s without valid SRC_ADDR\n",
-						xua_hdr_dump(xua, &xua_dialect_sua));
-					talloc_free(scu_prim->oph.msg);
-					return;
-				}
-			}
-			data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
-			udisp->importance = xua_msg_get_u32(xua, SUA_IEI_IMPORTANCE);
-			if (data_ie) {
-				struct msgb *upmsg = scu_prim->oph.msg;
-				upmsg->l2h = msgb_put(upmsg, data_ie->len);
-				memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
-			}
-		}
-		break;
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_INDICATION):
-		uconp = &scu_prim->u.connect;
-		uconp->conn_id = conn->conn_id;
-		uconp->called_addr = conn->called_addr;
-		uconp->calling_addr = conn->calling_addr;
-		uconp->sccp_class = conn->sccp_class;
-		uconp->importance = conn->importance;
-		if (xua) {
-			data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
-			if (data_ie) {
-				struct msgb *upmsg = scu_prim->oph.msg;
-				upmsg->l2h = msgb_put(upmsg, data_ie->len);
-				memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
-			}
-		}
-		break;
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_CONFIRM):
-		uconp = &scu_prim->u.connect;
-		uconp->conn_id = conn->conn_id;
-		uconp->called_addr = conn->called_addr;
-		uconp->calling_addr = conn->calling_addr;
-		//scu_prim->u.connect.in_sequence_control
-		uconp->sccp_class = xua_msg_get_u32(xua, SUA_IEI_PROTO_CLASS) & 3;
-		uconp->importance = xua_msg_get_u32(xua, SUA_IEI_IMPORTANCE);
-		data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
-		if (data_ie) {
-			struct msgb *upmsg = scu_prim->oph.msg;
-			upmsg->l2h = msgb_put(upmsg, data_ie->len);
-			memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
-		}
-		break;
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_DATA, PRIM_OP_INDICATION):
-		udatp = &scu_prim->u.data;
-		udatp->conn_id = conn->conn_id;
-		udatp->importance = conn->importance;
-		data_ie = xua_msg_find_tag(xua, SUA_IEI_DATA);
-		if (data_ie) {
-			struct msgb *upmsg = scu_prim->oph.msg;
-			upmsg->l2h = msgb_put(upmsg, data_ie->len);
-			memcpy(upmsg->l2h, data_ie->dat, data_ie->len);
-		}
-		break;
-	default:
-		LOGPFSML(conn->fi, LOGL_ERROR, "Unsupported primitive %u:%u\n",
-			 scu_prim->oph.primitive, scu_prim->oph.operation);
-		talloc_free(scu_prim->oph.msg);
-		return;
-	}
-
-	sccp_user_prim_up(conn->user, scu_prim);
-}
-
-
-/***********************************************************************
- * Actual SCCP Connection Oriented Control (SCOC) Finite State Machine
- ***********************************************************************/
-
-/* Figure C.2/Q.714 (sheet 1 of 7) and C.3/Q.714 (sheet 1 of 6) */
-static void scoc_fsm_idle(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct sccp_connection *conn = fi->priv;
-	struct osmo_scu_prim *prim = NULL;
-	struct osmo_scu_connect_param *uconp;
-	struct xua_msg *xua = NULL;
-	int rc;
-
-	switch (event) {
-	case SCOC_E_SCU_N_CONN_REQ:
-		prim = data;
-		uconp = &prim->u.connect;
-		/* copy relevant parameters from prim to conn */
-		conn->called_addr = uconp->called_addr;
-		conn->calling_addr = uconp->calling_addr;
-		conn->sccp_class = uconp->sccp_class;
-		/* generate + send CR PDU to SCRC */
-		rc = xua_gen_encode_and_send(conn, event, prim, SUA_CO_CORE);
-		if (rc < 0)
-			LOGPFSML(fi, LOGL_ERROR, "Failed to initiate connection: %s\n", strerror(-rc));
-		else {
-			/* start connection timer */
-			conn_start_connect_timer(conn);
-			osmo_fsm_inst_state_chg(fi, S_CONN_PEND_OUT, 0, 0);
-		}
-		break;
-#if 0
-	case SCOC_E_SCU_N_TYPE1_REQ:
-		/* ?!? */
-		break;
-#endif
-	case SCOC_E_RCOC_RLSD_IND:
-		/* send release complete to SCRC */
-		xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
-		break;
-	case SCOC_E_RCOC_REL_COMPL_IND:
-		/* do nothing */
-		break;
-	case SCOC_E_RCOC_OTHER_NPDU:
-#if 0
-		if (src_ref) {
-			/* FIXME: send ERROR to SCRC */
-		}
-#endif
-		break;
-	/* destination node / incoming connection */
-	/* Figure C.3 / Q.714 (sheet 1 of 6) */
-	case SCOC_E_RCOC_CONN_IND:
-		xua = data;
-		/* copy relevant parameters from xua to conn */
-		conn->remote_ref = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
-		conn->sccp_class = xua_msg_get_u32(xua, SUA_IEI_PROTO_CLASS) & 3;
-		conn->importance = xua_msg_get_u32(xua, SUA_IEI_IMPORTANCE);
-
-		rc = sua_addr_parse(&conn->calling_addr, xua, SUA_IEI_SRC_ADDR);
-		if (rc < 0) {
-			LOGPSCC(conn, LOGL_ERROR, "XUA Message %s without valid SRC_ADDR\n",
-				xua_hdr_dump(xua, &xua_dialect_sua));
-			goto refuse_destroy_conn;
-		}
-		/* 3.1.6.1 The originating node of the CR message
-		 * (identified by the OPC in the calling party address
-		 * or by default by the OPC in the MTP label, [and the
-		 * MTP-SAP instance]) is associated with the incoming
-		 * connection section. */
-		if (conn->calling_addr.presence & OSMO_SCCP_ADDR_T_PC)
-			conn->remote_pc = conn->calling_addr.pc;
-		else {
-			/* Hack to get the MTP label here ?!? */
-			conn->remote_pc = xua->mtp.opc;
-		}
-
-		rc = sua_addr_parse(&conn->called_addr, xua, SUA_IEI_DEST_ADDR);
-		if (rc < 0) {
-			LOGPSCC(conn, LOGL_ERROR, "XUA Message %s without valid DEST_ADDR\n",
-				xua_hdr_dump(xua, &xua_dialect_sua));
-			goto refuse_destroy_conn;
-		}
-
-		osmo_fsm_inst_state_chg(fi, S_CONN_PEND_IN, 0, 0);
-		/* N-CONNECT.ind to User */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_CONNECT,
-					PRIM_OP_INDICATION);
-		break;
-	}
-	return;
-
-refuse_destroy_conn:
-	xua_gen_encode_and_send(conn, event, NULL, SUA_CO_COREF);
-	osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-}
-
-static void scoc_fsm_idle_onenter(struct osmo_fsm_inst *fi, uint32_t old_state)
-{
-	conn_destroy(fi->priv);
-}
-
-/* Figure C.3 / Q.714 (sheet 2 of 6) */
-static void scoc_fsm_conn_pend_in(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct sccp_connection *conn = fi->priv;
-	struct osmo_scu_prim *prim = NULL;
-
-	switch (event) {
-	case SCOC_E_SCU_N_CONN_RESP:
-		prim = data;
-		/* FIXME: assign local reference (only now?) */
-		/* FIXME: assign sls, protocol class and credit */
-		xua_gen_encode_and_send(conn, event, prim, SUA_CO_COAK);
-		/* start inactivity timers */
-		conn_start_inact_timers(conn);
-		osmo_fsm_inst_state_chg(fi, S_ACTIVE, 0, 0);
-		xua_opt_data_send_cache(conn, SUA_CO_COAK, SUA_MSGC_CO);
-		break;
-	case SCOC_E_SCU_N_DISC_REQ:
-		prim = data;
-		/* release resources: implicit */
-		xua_gen_encode_and_send(conn, event, prim, SUA_CO_COREF);
-		/* N. B: we've ignored CREF sending errors as there's no recovery option anyway */
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	}
-}
-
-/* Figure C.2/Q.714 (sheet 2 of 7) */
-static void scoc_fsm_conn_pend_out(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct sccp_connection *conn = fi->priv;
-	struct osmo_scu_prim *prim = NULL;
-	struct xua_msg *xua = NULL;
-
-	switch (event) {
-	case SCOC_E_SCU_N_DISC_REQ:
-		prim = data;
-		conn->release_cause = prim->u.disconnect.cause;
-		osmo_fsm_inst_state_chg(fi, S_WAIT_CONN_CONF, 0, 0);
-		/* keep conn timer running(!) */
-		break;
-	case SCOC_E_CONN_TMR_EXP:
-		/* N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, NULL, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		/* below implicitly releases resources + local ref */
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_ROUT_FAIL_IND:
-	case SCOC_E_RCOC_CREF_IND:
-		xua = data;
-		/* stop conn timer */
-		conn_stop_connect_timer(conn);
-		/* release local res + ref (implicit by going to idle) */
-		/* N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		/* below implicitly releases resources + local ref */
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_RLSD_IND:
-		xua = data;
-		/* RLC to SCRC */
-		xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
-		/* stop conn timer */
-		conn_stop_connect_timer(conn);
-		/* release local res + ref (implicit) */
-		/* N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_OTHER_NPDU:
-		xua = data;
-		conn_start_connect_timer(conn);
-		/* release local res + ref (implicit) */
-		/* N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_CC_IND:
-		xua = data;
-		/* stop conn timer */
-		conn_stop_connect_timer(conn);
-		/* start inactivity timers */
-		conn_start_inact_timers(conn);
-		/* TODO: assign PCU and credit */
-		/* associate remote ref to conn */
-		conn->remote_ref = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
-		/* 3.1.4.2 The node sending the CC message (identified
-		 * by the parameter OPC contained in the
-		 * MTP-TRANSFER.indication primitive which conveyed the
-		 * CC message [plus the MTP-SAP instance]) is associated
-		 * with the connection section. */
-		conn->remote_pc = xua->mtp.opc;
-
-		osmo_fsm_inst_state_chg(fi, S_ACTIVE, 0, 0);
-		/* If CR which was used to initiate this connection had excessive Optional Data which we had to cache,
-		 * now is the time to send it: the connection is already active but we hadn't notified upper layers about it
-		 * so we have the connection all to ourselves and can use it to transmit "leftover" data via DT1 */
-		xua_opt_data_send_cache(conn, SUA_CO_CORE, xua->hdr.msg_class);
-
-		/* N-CONNECT.conf to user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_CONNECT,
-					PRIM_OP_CONFIRM);
-		break;
-	}
-}
-
-/* Figure C.2/Q.714 (sheet 3 of 7) */
-static void scoc_fsm_wait_conn_conf(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct sccp_connection *conn = fi->priv;
-	struct xua_msg *xua = NULL;
-
-	switch (event) {
-	case SCOC_E_RCOC_RLSD_IND:
-		xua = data;
-		/* release complete to SCRC */
-		xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
-		/* stop conn timer */
-		conn_stop_connect_timer(conn);
-		/* release local res + ref (implicit) */
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_CC_IND:
-		xua = data;
-		/* stop conn timer */
-		conn_stop_connect_timer(conn);
-		/* associate rem ref to conn */
-		conn->remote_ref = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
-		/* 3.1.4.2 The node sending the CC message (identified
-		 * by the parameter OPC contained in the
-		 * MTP-TRANSFER.indication primitive which conveyed the
-		 * CC message [plus the MTP-SAP instance]) is associated
-		 * with the connection section. */
-		conn->remote_pc = xua->mtp.opc;
-
-		/* released to SCRC */
-		xua_gen_relre_and_send(conn, conn->release_cause, NULL);
-		/* start rel timer */
-		conn_start_rel_timer(conn);
-		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
-		break;
-	case SCOC_E_RCOC_OTHER_NPDU:
-	case SCOC_E_RCOC_CREF_IND:
-	case SCOC_E_RCOC_ROUT_FAIL_IND:
-		xua = data;
-		/* stop conn timer */
-		conn_stop_connect_timer(conn);
-		/* release local res + ref */
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_CONN_TMR_EXP:
-		/* release local res + ref */
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	}
-}
-
-/* C.2/Q.714 (sheet 4+5 of 7) and C.3/Q714 (sheet 3+4 of 6) */
-static void scoc_fsm_active(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct xua_msg *xua = data;
-	struct sccp_connection *conn = fi->priv;
-	struct osmo_scu_prim *prim = NULL;
-
-	switch (event) {
-#pragma message ("TODO: internal disco: send N-DISCONNECT.ind to user")
-		/* send N-DISCONNECT.ind to user */
-		/*scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);*/
-		/* fall-through */
-	case SCOC_E_SCU_N_DISC_REQ:
-		prim = data;
-		/* stop inact timers */
-		conn_stop_inact_timers(conn);
-		/* send RLSD to SCRC */
-		xua_gen_encode_and_send(conn, event, prim, SUA_CO_RELRE);
-		/* start rel timer */
-		conn_start_rel_timer(conn);
-		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
-		break;
-	case SCOC_E_RCOC_CREF_IND:
-	case SCOC_E_RCOC_CC_IND:
-	case SCOC_E_RCOC_REL_COMPL_IND:
-		/* do nothing */
-		break;
-	case SCOC_E_RCOC_RLSD_IND:
-		/* send N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		/* release res + local ref (implicit) */
-		/* stop inact timers */
-		conn_stop_inact_timers(conn);
-		/* RLC to SCRC */
-		xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_ERROR_IND:
-		xua = data;
-		/* FIXME: check for cause service_class_mismatch */
-		/* release res + local ref (implicit) */
-		/* send N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		/* stop inact timers */
-		conn_stop_inact_timers(conn);
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_T_IAR_EXP:
-		/* stop inact timers */
-		conn_stop_inact_timers(conn);
-		xua = xua_msg_alloc();
-		xua_msg_add_u32(xua, SUA_IEI_CAUSE,
-				SUA_CAUSE_T_RELEASE | SCCP_RELEASE_CAUSE_EXPIRATION_INACTIVE);
-		xua_msg_add_u32(xua, SUA_IEI_IMPORTANCE, conn->importance);
-		/* Send N-DISCONNECT.ind to local user */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		talloc_free(xua);
-		/* Send RLSD to peer */
-		xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_EXPIRATION_INACTIVE, NULL);
-		/* start release timer */
-		conn_start_rel_timer(conn);
-		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
-		break;
-	case SCOC_E_RCOC_ROUT_FAIL_IND:
-		/* send N-DISCONNECT.ind to user */
-		scu_gen_encode_and_send(conn, event, NULL, OSMO_SCU_PRIM_N_DISCONNECT,
-					PRIM_OP_INDICATION);
-		/* stop inact timers */
-		conn_stop_inact_timers(conn);
-		/* start release timer */
-		conn_start_rel_timer(conn);
-		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
-		break;
-	/* Figure C.4/Q.714 */
-	case SCOC_E_SCU_N_DATA_REQ:
-	case SCOC_E_SCU_N_EXP_DATA_REQ:
-		prim = data;
-		xua_gen_encode_and_send(conn, event, prim, SUA_CO_CODT);
-		conn_restart_tx_inact_timer(conn);
-		break;
-	case SCOC_E_RCOC_DT1_IND:
-		/* restart receive inactivity timer */
-		conn_restart_rx_inact_timer(conn);
-		/* TODO: M-bit */
-		scu_gen_encode_and_send(conn, event, xua, OSMO_SCU_PRIM_N_DATA,
-					PRIM_OP_INDICATION);
-		break;
-	/* Figure C.4/Q.714 (sheet 4 of 4) */
-	case SCOC_E_RCOC_IT_IND:
-		xua = data;
-		/* check if remote reference is what we expect */
-		/* check class is what we expect */
-		if (xua_msg_get_u32(xua, SUA_IEI_SRC_REF) != conn->remote_ref ||
-		    xua_msg_get_u32(xua, SUA_IEI_PROTO_CLASS) != conn->sccp_class) {
-			/* Release connection */
-			/* Stop inactivity Timers */
-			conn_stop_inact_timers(conn);
-			xua = xua_msg_alloc();
-			xua_msg_add_u32(xua, SUA_IEI_CAUSE,
-					SUA_CAUSE_T_RELEASE | SCCP_RELEASE_CAUSE_INCONSISTENT_CONN_DATA);
-			xua_msg_add_u32(xua, SUA_IEI_IMPORTANCE, conn->importance);
-			/* send N-DISCONNECT.ind to user */
-			scu_gen_encode_and_send(conn, event, xua,
-						OSMO_SCU_PRIM_N_DISCONNECT,
-						PRIM_OP_INDICATION);
-			talloc_free(xua);
-			/* Send RLSD to SCRC */
-			xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_INCONSISTENT_CONN_DATA, NULL);
-			talloc_free(xua);
-			/* Start release timer */
-			conn_start_rel_timer(conn);
-			osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
-		}
-		conn_restart_rx_inact_timer(conn);
-		break;
-	case SCOC_E_T_IAS_EXP:
-		/* Send IT to peer */
-		xua_gen_encode_and_send(conn, event, NULL, SUA_CO_COIT);
-		conn_restart_tx_inact_timer(conn);
-		break;
-	}
-}
-
-/* C.2/Q.714 (sheet 6+7 of 7) and C.3/Q.714 (sheet 5+6 of 6) */
-static void scoc_fsm_disconn_pend(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct sccp_connection *conn = fi->priv;
-
-	switch (event) {
-	case SCOC_E_RCOC_REL_COMPL_IND:
-	case SCOC_E_RCOC_RLSD_IND:
-		/* release res + local ref (implicit) */
-		/* freeze local ref */
-		/* stop release + interval timers */
-		conn_stop_release_timers(conn);
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_RCOC_ROUT_FAIL_IND:
-	case SCOC_E_RCOC_OTHER_NPDU:
-		/* do nothing */
-		break;
-	case SCOC_E_T_REL_EXP: /* release timer exp */
-		/* send RLSD */
-		xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_UNQUALIFIED, NULL);
-		/* start interval timer */
-		conn_start_int_timer(conn);
-		/* start repeat release timer */
-		conn_start_rep_rel_timer(conn);
-		break;
-	case SCOC_E_T_INT_EXP: /* interval timer exp */
-		/* TODO: Inform maintenance */
-		/* stop release and interval timers */
-		conn_stop_release_timers(conn);
-		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
-		break;
-	case SCOC_E_T_REP_REL_EXP: /* repeat release timer exp */
-		/* send RLSD */
-		xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_UNQUALIFIED, NULL);
-		/* re-start repeat release timer */
-		conn_start_rep_rel_timer(conn);
-		break;
-	}
-}
-
-static const struct osmo_fsm_state sccp_scoc_states[] = {
-	[S_IDLE] = {
-		.name = "IDLE",
-		.action = scoc_fsm_idle,
-		.onenter= scoc_fsm_idle_onenter,
-		.in_event_mask = S(SCOC_E_SCU_N_CONN_REQ) |
-				 //S(SCOC_E_SCU_N_TYPE1_REQ) |
-				 S(SCOC_E_RCOC_CONN_IND) |
-				 S(SCOC_E_RCOC_RLSD_IND) |
-				 S(SCOC_E_RCOC_REL_COMPL_IND) |
-				 S(SCOC_E_RCOC_OTHER_NPDU),
-		.out_state_mask = S(S_IDLE) |
-				  S(S_CONN_PEND_OUT) |
-				  S(S_CONN_PEND_IN),
-	},
-	[S_CONN_PEND_IN] = {
-		.name = "CONN_PEND_IN",
-		.action = scoc_fsm_conn_pend_in,
-		.in_event_mask = S(SCOC_E_SCU_N_CONN_RESP) |
-				 S(SCOC_E_SCU_N_DISC_REQ),
-		.out_state_mask = S(S_IDLE) |
-				  S(S_ACTIVE),
-	},
-	[S_CONN_PEND_OUT] = {
-		.name = "CONN_PEND_OUT",
-		.action = scoc_fsm_conn_pend_out,
-		.in_event_mask = S(SCOC_E_SCU_N_DISC_REQ) |
-				 S(SCOC_E_CONN_TMR_EXP) |
-				 S(SCOC_E_RCOC_ROUT_FAIL_IND) |
-				 S(SCOC_E_RCOC_RLSD_IND) |
-				 S(SCOC_E_RCOC_OTHER_NPDU) |
-				 S(SCOC_E_RCOC_CREF_IND) |
-				 S(SCOC_E_RCOC_CC_IND),
-		.out_state_mask = S(S_IDLE) |
-				  S(S_ACTIVE) |
-				  S(S_WAIT_CONN_CONF),
-	},
-	[S_ACTIVE] = {
-		.name = "ACTIVE",
-		.action = scoc_fsm_active,
-		.in_event_mask = S(SCOC_E_SCU_N_DISC_REQ) |
-				/* internal disconnect */
-				 S(SCOC_E_RCOC_CREF_IND) |
-				 S(SCOC_E_RCOC_REL_COMPL_IND) |
-				 S(SCOC_E_RCOC_RLSD_IND) |
-				 S(SCOC_E_RCOC_ERROR_IND) |
-				 S(SCOC_E_T_IAR_EXP) |
-				 S(SCOC_E_T_IAS_EXP) |
-				 S(SCOC_E_RCOC_ROUT_FAIL_IND) |
-				 S(SCOC_E_SCU_N_DATA_REQ) |
-				 S(SCOC_E_SCU_N_EXP_DATA_REQ) |
-				 S(SCOC_E_RCOC_DT1_IND) |
-				 S(SCOC_E_RCOC_IT_IND),
-		.out_state_mask = S(S_IDLE) |
-				  S(S_DISCONN_PEND),
-	},
-	[S_DISCONN_PEND] = {
-		.name = "DISCONN_PEND",
-		.action = scoc_fsm_disconn_pend,
-		.in_event_mask = S(SCOC_E_RCOC_REL_COMPL_IND) |
-				 S(SCOC_E_RCOC_RLSD_IND) |
-				 S(SCOC_E_RCOC_ROUT_FAIL_IND) |
-				 S(SCOC_E_RCOC_OTHER_NPDU) |
-				 S(SCOC_E_T_REL_EXP) |
-				 S(SCOC_E_T_INT_EXP) |
-				 S(SCOC_E_T_REP_REL_EXP),
-		.out_state_mask = S(S_IDLE),
-	},
-	[S_RESET_IN] = {
-		.name = "RESET_IN",
-	},
-	[S_RESET_OUT] = {
-		.name = "RESET_OUT",
-	},
-	[S_BOTHWAY_RESET] = {
-		.name = "BOTHWAY_RESET",
-	},
-	[S_WAIT_CONN_CONF] = {
-		.name = "WAIT_CONN_CONF",
-		.action = scoc_fsm_wait_conn_conf,
-		.in_event_mask = S(SCOC_E_RCOC_RLSD_IND) |
-				 S(SCOC_E_RCOC_CC_IND) |
-				 S(SCOC_E_RCOC_OTHER_NPDU) |
-				 S(SCOC_E_CONN_TMR_EXP) |
-				 S(SCOC_E_RCOC_CREF_IND) |
-				 S(SCOC_E_RCOC_ROUT_FAIL_IND),
-		.out_state_mask = S(S_IDLE) |
-				  S(S_DISCONN_PEND),
-	},
-};
-
-struct osmo_fsm sccp_scoc_fsm = {
-	.name = "SCCP-SCOC",
-	.states = sccp_scoc_states,
-	.num_states = ARRAY_SIZE(sccp_scoc_states),
-	/* ".log_subsys = DLSCCP" doesn't work as DLSCCP is not a constant */
-	.event_names = scoc_event_names,
-};
-
 /* map from SCCP return cause to SCCP Refusal cause */
 static const uint8_t cause_map_cref[] = {
 	[SCCP_RETURN_CAUSE_SUBSYSTEM_CONGESTION] =
@@ -1609,7 +555,7 @@
 
 	/* try to dispatch to connection FSM (if any) */
 	conn_id = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
-	conn = conn_find_by_id(inst, conn_id);
+	conn = sccp_find_conn_by_id(inst, conn_id);
 	if (conn) {
 		osmo_fsm_inst_dispatch(conn->fi,
 					SCOC_E_RCOC_ROUT_FAIL_IND, xua);
@@ -1873,7 +819,7 @@
 		uint32_t conn_id;
 		/* Resolve existing connection */
 		conn_id = xua_msg_get_u32(xua, SUA_IEI_DEST_REF);
-		conn = conn_find_by_id(inst, conn_id);
+		conn = sccp_find_conn_by_id(inst, conn_id);
 		if (!conn) {
 			LOGPSCI(inst, LOGL_NOTICE, "Received %s: Cannot find connection for "
 				"local reference %u\n", xua_hdr_dump(xua, &xua_dialect_sua), conn_id);
@@ -1920,142 +866,13 @@
 	osmo_fsm_inst_dispatch(conn->fi, event, xua);
 }
 
-/* get the Connection ID of the given SCU primitive */
-static uint32_t scu_prim_conn_id(const struct osmo_scu_prim *prim)
-{
-	switch (prim->oph.primitive) {
-	case OSMO_SCU_PRIM_N_CONNECT:
-		return prim->u.connect.conn_id;
-	case OSMO_SCU_PRIM_N_DATA:
-		return prim->u.data.conn_id;
-	case OSMO_SCU_PRIM_N_DISCONNECT:
-		return prim->u.disconnect.conn_id;
-	case OSMO_SCU_PRIM_N_RESET:
-		return prim->u.reset.conn_id;
-	default:
-		return 0;
-	}
-}
-
-/*! Main entrance function for primitives from SCCP User.
- * The caller is required to free oph->msg, otherwise the same as osmo_sccp_user_sap_down().
- *  \param[in] scu SCCP User sending us the primitive
- *  \param[in] oph Osmocom primitive sent by the user
- *  \returns 0 on success; negative on error */
-int osmo_sccp_user_sap_down_nofree(struct osmo_sccp_user *scu, struct osmo_prim_hdr *oph)
-{
-	struct osmo_scu_prim *prim = (struct osmo_scu_prim *) oph;
-	struct osmo_sccp_instance *inst = scu->inst;
-	struct sccp_connection *conn;
-	int rc = 0;
-	int event;
-
-	LOGPSCU(scu, LOGL_DEBUG, "Received SCCP User Primitive (%s)\n",
-		osmo_scu_prim_name(&prim->oph));
-
-	switch (OSMO_PRIM_HDR(&prim->oph)) {
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_UNITDATA, PRIM_OP_REQUEST):
-	/* other CL primitives? */
-		/* Connectionless by-passes this altogether */
-		return sccp_sclc_user_sap_down_nofree(scu, oph);
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_REQUEST):
-		/* Allocate new connection structure */
-		conn = conn_create_id(scu, prim->u.connect.conn_id);
-		if (!conn) {
-			/* FIXME: inform SCCP user with proper reply */
-			LOGPSCU(scu, LOGL_ERROR, "Cannot create conn-id for primitive %s\n",
-				osmo_scu_prim_name(&prim->oph));
-			return rc;
-		}
-		break;
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_RESPONSE):
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_DATA, PRIM_OP_REQUEST):
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_REQUEST):
-	case OSMO_PRIM(OSMO_SCU_PRIM_N_RESET, PRIM_OP_REQUEST):
-		/* Resolve existing connection structure */
-		conn = conn_find_by_id(inst, scu_prim_conn_id(prim));
-		if (!conn) {
-			/* FIXME: inform SCCP user with proper reply */
-			LOGPSCU(scu, LOGL_ERROR, "Received unknown conn-id %u for primitive %s\n",
-				scu_prim_conn_id(prim), osmo_scu_prim_name(&prim->oph));
-			return rc;
-		}
-		break;
-	default:
-		LOGPSCU(scu, LOGL_ERROR, "Received unknown primitive %s\n",
-			osmo_scu_prim_name(&prim->oph));
-		return -1;
-	}
-
-	/* Map from primitive to event */
-	event = osmo_event_for_prim(oph, scu_scoc_event_map);
-
-	/* Dispatch event into connection */
-	return osmo_fsm_inst_dispatch(conn->fi, event, prim);
-}
-
-/*! Main entrance function for primitives from SCCP User.
- * Implies a msgb_free(oph->msg), otherwise the same as osmo_sccp_user_sap().
- *  \param[in] scu SCCP User sending us the primitive
- *  \param[in] oph Osmocom primitive sent by the user
- *  \returns 0 on success; negative on error */
-int osmo_sccp_user_sap_down(struct osmo_sccp_user *scu, struct osmo_prim_hdr *oph)
-{
-	struct osmo_scu_prim *prim = (struct osmo_scu_prim *) oph;
-	struct msgb *msg = prim->oph.msg;
-	int rc = osmo_sccp_user_sap_down_nofree(scu, oph);
-	msgb_free(msg);
-	return rc;
-}
-
 void sccp_scoc_flush_connections(struct osmo_sccp_instance *inst)
 {
 	struct rb_node *node;
 	while ((node = rb_first(&inst->connections))) {
 		struct sccp_connection *conn = container_of(node, struct sccp_connection, node);
-		conn_destroy(conn);
+		sccp_conn_free(conn);
 	}
 
 }
 
-#include <osmocom/vty/vty.h>
-
-static void vty_show_connection(struct vty *vty, struct sccp_connection *conn)
-{
-	struct osmo_ss7_instance *s7i = conn->inst->ss7;
-	struct osmo_sccp_addr *remote_addr;
-	uint32_t local_pc = OSMO_SS7_PC_INVALID;
-
-	if (osmo_ss7_pc_is_valid(conn->user->pc))
-		local_pc = conn->user->pc;
-	else if (osmo_ss7_pc_is_valid(s7i->cfg.primary_pc))
-		local_pc = s7i->cfg.primary_pc;
-
-	if (conn->incoming)
-		remote_addr = &conn->calling_addr;
-	else
-		remote_addr = &conn->called_addr;
-
-	vty_out(vty, "%c %06x %3u %7s ", conn->incoming ? 'I' : 'O',
-		conn->conn_id, conn->user->ssn,
-		osmo_ss7_pointcode_print(s7i, local_pc));
-	vty_out(vty, "%16s %06x %3u %7s%s",
-		osmo_fsm_inst_state_name(conn->fi), conn->remote_ref, remote_addr->ssn,
-		osmo_ss7_pointcode_print(s7i, conn->remote_pc),
-		VTY_NEWLINE);
-}
-
-void sccp_scoc_show_connections(struct vty *vty, struct osmo_sccp_instance *inst)
-{
-	struct sccp_connection *conn;
-	struct rb_node *node;
-
-	vty_out(vty, "I Local              Conn.            Remote            %s", VTY_NEWLINE);
-	vty_out(vty, "O Ref    SSN PC      State            Ref    SSN PC     %s", VTY_NEWLINE);
-	vty_out(vty, "- ------ --- ------- ---------------- ------ --- -------%s", VTY_NEWLINE);
-
-	for (node = rb_first(&inst->connections); node; node = rb_next(node)) {
-		conn = container_of(node, struct sccp_connection, node);
-		vty_show_connection(vty, conn);
-	}
-}
diff --git a/src/sccp_scoc_fsm.c b/src/sccp_scoc_fsm.c
new file mode 100644
index 0000000..dbee91e
--- /dev/null
+++ b/src/sccp_scoc_fsm.c
@@ -0,0 +1,615 @@
+/* SCCP Connection Oriented (SCOC) FSM according to ITU-T Q.713/Q.714 */
+
+/* (C) 2025 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * (C) 2015-2017 by Harald Welte <laforge@gnumonks.org>
+ * All Rights reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* This code is a bit of a hybrid between the ITU-T Q.71x specifications
+ * for SCCP (particularly its connection-oriented part), and the IETF
+ * RFC 3868 (SUA).  The idea here is to have one shared code base of the
+ * state machines for SCCP Connection Oriented, and use those both from
+ * SCCP and SUA.
+ */
+
+#include <errno.h>
+#include <string.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/linuxrbtree.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/fsm.h>
+#include <osmocom/sigtran/sccp_helpers.h>
+#include <osmocom/sigtran/sccp_sap.h>
+#include <osmocom/sigtran/protocol/sua.h>
+#include <osmocom/sccp/sccp_types.h>
+
+#include "xua_internal.h"
+#include "sccp_connection.h"
+#include "sccp_scoc_fsm.h"
+#include "sccp_internal.h"
+#include "sccp_user.h"
+#include "ss7_internal.h"
+#include "ss7_instance.h"
+
+/***********************************************************************
+ * Actual SCCP Connection Oriented Control (SCOC) Finite State Machine
+ ***********************************************************************/
+
+#define S(x)	(1 << (x))
+
+static const struct value_string scoc_event_names[] = {
+	/* Primitives from SCCP-User */
+	{ SCOC_E_SCU_N_CONN_REQ,	"N-CONNECT.req" },
+	{ SCOC_E_SCU_N_CONN_RESP,	"N-CONNECT.resp" },
+	{ SCOC_E_SCU_N_DISC_REQ,	"N-DISCONNECT.req" },
+	{ SCOC_E_SCU_N_DATA_REQ,	"N-DATA.req" },
+	{ SCOC_E_SCU_N_EXP_DATA_REQ,	"N-EXPEDITED_DATA.req" },
+
+	/* Events from RCOC (Routing for Connection Oriented) */
+	{ SCOC_E_RCOC_CONN_IND,		"RCOC-CONNECT.ind" },
+	{ SCOC_E_RCOC_ROUT_FAIL_IND,	"RCOC-ROUT_FAIL.ind" },
+	{ SCOC_E_RCOC_RLSD_IND,		"RCOC-RELEASED.ind" },
+	{ SCOC_E_RCOC_REL_COMPL_IND,	"RCOC-RELEASE_COMPLETE.ind" },
+	{ SCOC_E_RCOC_CREF_IND,		"RCOC-CONNECT_REFUSED.ind" },
+	{ SCOC_E_RCOC_CC_IND,		"RCOC-CONNECT_CONFIRM.ind" },
+	{ SCOC_E_RCOC_DT1_IND,		"RCOC-DT1.ind" },
+	{ SCOC_E_RCOC_DT2_IND,		"RCOC-DT2.ind" },
+	{ SCOC_E_RCOC_IT_IND,		"RCOC-IT.ind" },
+	{ SCOC_E_RCOC_OTHER_NPDU,	"RCOC-OTHER_NPDU.ind" },
+	{ SCOC_E_RCOC_ERROR_IND,	"RCOC-ERROR.ind" },
+
+	{ SCOC_E_T_IAR_EXP,		"T(iar)_expired" },
+	{ SCOC_E_T_IAS_EXP,		"T(ias)_expired" },
+	{ SCOC_E_CONN_TMR_EXP,		"T(conn)_expired" },
+	{ SCOC_E_T_REL_EXP,		"T(rel)_expired" },
+	{ SCOC_E_T_INT_EXP,		"T(int)_expired" },
+	{ SCOC_E_T_REP_REL_EXP,		"T(rep_rel)_expired" },
+
+	{ 0, NULL }
+};
+
+/* Figure C.2/Q.714 (sheet 1 of 7) and C.3/Q.714 (sheet 1 of 6) */
+static void scoc_fsm_idle(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct sccp_connection *conn = fi->priv;
+	struct osmo_scu_prim *prim = NULL;
+	struct osmo_scu_connect_param *uconp;
+	struct xua_msg *xua = NULL;
+	int rc;
+
+	switch (event) {
+	case SCOC_E_SCU_N_CONN_REQ:
+		prim = data;
+		uconp = &prim->u.connect;
+		/* copy relevant parameters from prim to conn */
+		conn->called_addr = uconp->called_addr;
+		conn->calling_addr = uconp->calling_addr;
+		conn->sccp_class = uconp->sccp_class;
+		/* generate + send CR PDU to SCRC */
+		rc = sccp_conn_xua_gen_encode_and_send(conn, event, prim, SUA_CO_CORE);
+		if (rc < 0)
+			LOGPFSML(fi, LOGL_ERROR, "Failed to initiate connection: %s\n", strerror(-rc));
+		else {
+			/* start connection timer */
+			sccp_conn_start_connect_timer(conn);
+			osmo_fsm_inst_state_chg(fi, S_CONN_PEND_OUT, 0, 0);
+		}
+		break;
+#if 0
+	case SCOC_E_SCU_N_TYPE1_REQ:
+		/* ?!? */
+		break;
+#endif
+	case SCOC_E_RCOC_RLSD_IND:
+		/* send release complete to SCRC */
+		sccp_conn_xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
+		break;
+	case SCOC_E_RCOC_REL_COMPL_IND:
+		/* do nothing */
+		break;
+	case SCOC_E_RCOC_OTHER_NPDU:
+#if 0
+		if (src_ref) {
+			(void)src_ref;
+			/* FIXME: send ERROR to SCRC */
+		}
+#endif
+		break;
+	/* destination node / incoming connection */
+	/* Figure C.3 / Q.714 (sheet 1 of 6) */
+	case SCOC_E_RCOC_CONN_IND:
+		xua = data;
+		/* copy relevant parameters from xua to conn */
+		conn->remote_ref = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
+		conn->sccp_class = xua_msg_get_u32(xua, SUA_IEI_PROTO_CLASS) & 3;
+		conn->importance = xua_msg_get_u32(xua, SUA_IEI_IMPORTANCE);
+
+		rc = sua_addr_parse(&conn->calling_addr, xua, SUA_IEI_SRC_ADDR);
+		if (rc < 0) {
+			LOGPSCC(conn, LOGL_ERROR, "XUA Message %s without valid SRC_ADDR\n",
+				xua_hdr_dump(xua, &xua_dialect_sua));
+			goto refuse_destroy_conn;
+		}
+		/* 3.1.6.1 The originating node of the CR message
+		 * (identified by the OPC in the calling party address
+		 * or by default by the OPC in the MTP label, [and the
+		 * MTP-SAP instance]) is associated with the incoming
+		 * connection section. */
+		if (conn->calling_addr.presence & OSMO_SCCP_ADDR_T_PC)
+			conn->remote_pc = conn->calling_addr.pc;
+		else {
+			/* Hack to get the MTP label here ?!? */
+			conn->remote_pc = xua->mtp.opc;
+		}
+
+		rc = sua_addr_parse(&conn->called_addr, xua, SUA_IEI_DEST_ADDR);
+		if (rc < 0) {
+			LOGPSCC(conn, LOGL_ERROR, "XUA Message %s without valid DEST_ADDR\n",
+				xua_hdr_dump(xua, &xua_dialect_sua));
+			goto refuse_destroy_conn;
+		}
+
+		osmo_fsm_inst_state_chg(fi, S_CONN_PEND_IN, 0, 0);
+		/* N-CONNECT.ind to User */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_INDICATION);
+		break;
+	}
+	return;
+
+refuse_destroy_conn:
+	sccp_conn_xua_gen_encode_and_send(conn, event, NULL, SUA_CO_COREF);
+	osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+}
+
+static void scoc_fsm_idle_onenter(struct osmo_fsm_inst *fi, uint32_t old_state)
+{
+	sccp_conn_free(fi->priv);
+}
+
+/* Figure C.3 / Q.714 (sheet 2 of 6) */
+static void scoc_fsm_conn_pend_in(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct sccp_connection *conn = fi->priv;
+	struct osmo_scu_prim *prim = NULL;
+
+	switch (event) {
+	case SCOC_E_SCU_N_CONN_RESP:
+		prim = data;
+		/* FIXME: assign local reference (only now?) */
+		/* FIXME: assign sls, protocol class and credit */
+		sccp_conn_xua_gen_encode_and_send(conn, event, prim, SUA_CO_COAK);
+		/* start inactivity timers */
+		sccp_conn_start_inact_timers(conn);
+		osmo_fsm_inst_state_chg(fi, S_ACTIVE, 0, 0);
+		sccp_conn_opt_data_send_cache(conn, SUA_CO_COAK, SUA_MSGC_CO);
+		break;
+	case SCOC_E_SCU_N_DISC_REQ:
+		prim = data;
+		/* release resources: implicit */
+		sccp_conn_xua_gen_encode_and_send(conn, event, prim, SUA_CO_COREF);
+		/* N. B: we've ignored CREF sending errors as there's no recovery option anyway */
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	}
+}
+
+/* Figure C.2/Q.714 (sheet 2 of 7) */
+static void scoc_fsm_conn_pend_out(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct sccp_connection *conn = fi->priv;
+	struct osmo_scu_prim *prim = NULL;
+	struct xua_msg *xua = NULL;
+
+	switch (event) {
+	case SCOC_E_SCU_N_DISC_REQ:
+		prim = data;
+		conn->release_cause = prim->u.disconnect.cause;
+		osmo_fsm_inst_state_chg(fi, S_WAIT_CONN_CONF, 0, 0);
+		/* keep conn timer running(!) */
+		break;
+	case SCOC_E_CONN_TMR_EXP:
+		/* N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, NULL,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		/* below implicitly releases resources + local ref */
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_ROUT_FAIL_IND:
+	case SCOC_E_RCOC_CREF_IND:
+		xua = data;
+		/* stop conn timer */
+		sccp_conn_stop_connect_timer(conn);
+		/* release local res + ref (implicit by going to idle) */
+		/* N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		/* below implicitly releases resources + local ref */
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_RLSD_IND:
+		xua = data;
+		/* RLC to SCRC */
+		sccp_conn_xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
+		/* stop conn timer */
+		sccp_conn_stop_connect_timer(conn);
+		/* release local res + ref (implicit) */
+		/* N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_OTHER_NPDU:
+		xua = data;
+		sccp_conn_start_connect_timer(conn);
+		/* release local res + ref (implicit) */
+		/* N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_CC_IND:
+		xua = data;
+		/* stop conn timer */
+		sccp_conn_stop_connect_timer(conn);
+		/* start inactivity timers */
+		sccp_conn_start_inact_timers(conn);
+		/* TODO: assign PCU and credit */
+		/* associate remote ref to conn */
+		conn->remote_ref = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
+		/* 3.1.4.2 The node sending the CC message (identified
+		 * by the parameter OPC contained in the
+		 * MTP-TRANSFER.indication primitive which conveyed the
+		 * CC message [plus the MTP-SAP instance]) is associated
+		 * with the connection section. */
+		conn->remote_pc = xua->mtp.opc;
+
+		osmo_fsm_inst_state_chg(fi, S_ACTIVE, 0, 0);
+		/* If CR which was used to initiate this connection had excessive Optional Data which we had to cache,
+		 * now is the time to send it: the connection is already active but we hadn't notified upper layers about it
+		 * so we have the connection all to ourselves and can use it to transmit "leftover" data via DT1 */
+		sccp_conn_opt_data_send_cache(conn, SUA_CO_CORE, xua->hdr.msg_class);
+
+		/* N-CONNECT.conf to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_CONNECT, PRIM_OP_CONFIRM);
+		break;
+	}
+}
+
+/* Figure C.2/Q.714 (sheet 3 of 7) */
+static void scoc_fsm_wait_conn_conf(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct sccp_connection *conn = fi->priv;
+	struct xua_msg *xua = NULL;
+
+	switch (event) {
+	case SCOC_E_RCOC_RLSD_IND:
+		xua = data;
+		/* release complete to SCRC */
+		sccp_conn_xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
+		/* stop conn timer */
+		sccp_conn_stop_connect_timer(conn);
+		/* release local res + ref (implicit) */
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_CC_IND:
+		xua = data;
+		/* stop conn timer */
+		sccp_conn_stop_connect_timer(conn);
+		/* associate rem ref to conn */
+		conn->remote_ref = xua_msg_get_u32(xua, SUA_IEI_SRC_REF);
+		/* 3.1.4.2 The node sending the CC message (identified
+		 * by the parameter OPC contained in the
+		 * MTP-TRANSFER.indication primitive which conveyed the
+		 * CC message [plus the MTP-SAP instance]) is associated
+		 * with the connection section. */
+		conn->remote_pc = xua->mtp.opc;
+
+		/* released to SCRC */
+		sccp_conn_xua_gen_relre_and_send(conn, conn->release_cause, NULL);
+		/* start rel timer */
+		sccp_conn_start_rel_timer(conn);
+		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
+		break;
+	case SCOC_E_RCOC_OTHER_NPDU:
+	case SCOC_E_RCOC_CREF_IND:
+	case SCOC_E_RCOC_ROUT_FAIL_IND:
+		xua = data;
+		/* stop conn timer */
+		sccp_conn_stop_connect_timer(conn);
+		/* release local res + ref */
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_CONN_TMR_EXP:
+		/* release local res + ref */
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	}
+}
+
+/* C.2/Q.714 (sheet 4+5 of 7) and C.3/Q714 (sheet 3+4 of 6) */
+static void scoc_fsm_active(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct xua_msg *xua = data;
+	struct sccp_connection *conn = fi->priv;
+	struct osmo_scu_prim *prim = NULL;
+
+	switch (event) {
+#pragma message("TODO: internal disco: send N-DISCONNECT.ind to user")
+		/* send N-DISCONNECT.ind to user */
+		/*sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						    OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);*/
+		/* fall-through */
+	case SCOC_E_SCU_N_DISC_REQ:
+		prim = data;
+		/* stop inact timers */
+		sccp_conn_stop_inact_timers(conn);
+		/* send RLSD to SCRC */
+		sccp_conn_xua_gen_encode_and_send(conn, event, prim, SUA_CO_RELRE);
+		/* start rel timer */
+		sccp_conn_start_rel_timer(conn);
+		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
+		break;
+	case SCOC_E_RCOC_CREF_IND:
+	case SCOC_E_RCOC_CC_IND:
+	case SCOC_E_RCOC_REL_COMPL_IND:
+		/* do nothing */
+		break;
+	case SCOC_E_RCOC_RLSD_IND:
+		/* send N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		/* release res + local ref (implicit) */
+		/* stop inact timers */
+		sccp_conn_stop_inact_timers(conn);
+		/* RLC to SCRC */
+		sccp_conn_xua_gen_encode_and_send(conn, event, NULL, SUA_CO_RELCO);
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_ERROR_IND:
+		xua = data;
+		/* FIXME: check for cause service_class_mismatch */
+		/* release res + local ref (implicit) */
+		/* send N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		/* stop inact timers */
+		sccp_conn_stop_inact_timers(conn);
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_T_IAR_EXP:
+		/* stop inact timers */
+		sccp_conn_stop_inact_timers(conn);
+		xua = xua_msg_alloc();
+		xua_msg_add_u32(xua, SUA_IEI_CAUSE,
+				SUA_CAUSE_T_RELEASE | SCCP_RELEASE_CAUSE_EXPIRATION_INACTIVE);
+		xua_msg_add_u32(xua, SUA_IEI_IMPORTANCE, conn->importance);
+		/* Send N-DISCONNECT.ind to local user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		talloc_free(xua);
+		/* Send RLSD to peer */
+		sccp_conn_xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_EXPIRATION_INACTIVE, NULL);
+		/* start release timer */
+		sccp_conn_start_rel_timer(conn);
+		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
+		break;
+	case SCOC_E_RCOC_ROUT_FAIL_IND:
+		/* send N-DISCONNECT.ind to user */
+		sccp_conn_scu_gen_encode_and_send(conn, event, NULL,
+						  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+		/* stop inact timers */
+		sccp_conn_stop_inact_timers(conn);
+		/* start release timer */
+		sccp_conn_start_rel_timer(conn);
+		osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
+		break;
+	/* Figure C.4/Q.714 */
+	case SCOC_E_SCU_N_DATA_REQ:
+	case SCOC_E_SCU_N_EXP_DATA_REQ:
+		prim = data;
+		sccp_conn_xua_gen_encode_and_send(conn, event, prim, SUA_CO_CODT);
+		sccp_conn_restart_tx_inact_timer(conn);
+		break;
+	case SCOC_E_RCOC_DT1_IND:
+		/* restart receive inactivity timer */
+		sccp_conn_restart_rx_inact_timer(conn);
+		/* TODO: M-bit */
+		sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+						  OSMO_SCU_PRIM_N_DATA, PRIM_OP_INDICATION);
+		break;
+	/* Figure C.4/Q.714 (sheet 4 of 4) */
+	case SCOC_E_RCOC_IT_IND:
+		xua = data;
+		/* check if remote reference is what we expect */
+		/* check class is what we expect */
+		if (xua_msg_get_u32(xua, SUA_IEI_SRC_REF) != conn->remote_ref ||
+		    xua_msg_get_u32(xua, SUA_IEI_PROTO_CLASS) != conn->sccp_class) {
+			/* Release connection */
+			/* Stop inactivity Timers */
+			sccp_conn_stop_inact_timers(conn);
+			xua = xua_msg_alloc();
+			xua_msg_add_u32(xua, SUA_IEI_CAUSE,
+					SUA_CAUSE_T_RELEASE | SCCP_RELEASE_CAUSE_INCONSISTENT_CONN_DATA);
+			xua_msg_add_u32(xua, SUA_IEI_IMPORTANCE, conn->importance);
+			/* send N-DISCONNECT.ind to user */
+			sccp_conn_scu_gen_encode_and_send(conn, event, xua,
+							  OSMO_SCU_PRIM_N_DISCONNECT, PRIM_OP_INDICATION);
+			talloc_free(xua);
+			/* Send RLSD to SCRC */
+			sccp_conn_xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_INCONSISTENT_CONN_DATA, NULL);
+			talloc_free(xua);
+			/* Start release timer */
+			sccp_conn_start_rel_timer(conn);
+			osmo_fsm_inst_state_chg(fi, S_DISCONN_PEND, 0, 0);
+		}
+		sccp_conn_restart_rx_inact_timer(conn);
+		break;
+	case SCOC_E_T_IAS_EXP:
+		/* Send IT to peer */
+		sccp_conn_xua_gen_encode_and_send(conn, event, NULL, SUA_CO_COIT);
+		sccp_conn_restart_tx_inact_timer(conn);
+		break;
+	}
+}
+
+/* C.2/Q.714 (sheet 6+7 of 7) and C.3/Q.714 (sheet 5+6 of 6) */
+static void scoc_fsm_disconn_pend(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct sccp_connection *conn = fi->priv;
+
+	switch (event) {
+	case SCOC_E_RCOC_REL_COMPL_IND:
+	case SCOC_E_RCOC_RLSD_IND:
+		/* release res + local ref (implicit) */
+		/* freeze local ref */
+		/* stop release + interval timers */
+		sccp_conn_stop_release_timers(conn);
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_RCOC_ROUT_FAIL_IND:
+	case SCOC_E_RCOC_OTHER_NPDU:
+		/* do nothing */
+		break;
+	case SCOC_E_T_REL_EXP: /* release timer exp */
+		/* send RLSD */
+		sccp_conn_xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_UNQUALIFIED, NULL);
+		/* start interval timer */
+		sccp_conn_start_int_timer(conn);
+		/* start repeat release timer */
+		sccp_conn_start_rep_rel_timer(conn);
+		break;
+	case SCOC_E_T_INT_EXP: /* interval timer exp */
+		/* TODO: Inform maintenance */
+		/* stop release and interval timers */
+		sccp_conn_stop_release_timers(conn);
+		osmo_fsm_inst_state_chg(fi, S_IDLE, 0, 0);
+		break;
+	case SCOC_E_T_REP_REL_EXP: /* repeat release timer exp */
+		/* send RLSD */
+		sccp_conn_xua_gen_relre_and_send(conn, SCCP_RELEASE_CAUSE_UNQUALIFIED, NULL);
+		/* re-start repeat release timer */
+		sccp_conn_start_rep_rel_timer(conn);
+		break;
+	}
+}
+
+static const struct osmo_fsm_state sccp_scoc_states[] = {
+	[S_IDLE] = {
+		.name = "IDLE",
+		.action = scoc_fsm_idle,
+		.onenter = scoc_fsm_idle_onenter,
+		.in_event_mask = S(SCOC_E_SCU_N_CONN_REQ) |
+				 //S(SCOC_E_SCU_N_TYPE1_REQ) |
+				 S(SCOC_E_RCOC_CONN_IND) |
+				 S(SCOC_E_RCOC_RLSD_IND) |
+				 S(SCOC_E_RCOC_REL_COMPL_IND) |
+				 S(SCOC_E_RCOC_OTHER_NPDU),
+		.out_state_mask = S(S_IDLE) |
+				  S(S_CONN_PEND_OUT) |
+				  S(S_CONN_PEND_IN),
+	},
+	[S_CONN_PEND_IN] = {
+		.name = "CONN_PEND_IN",
+		.action = scoc_fsm_conn_pend_in,
+		.in_event_mask = S(SCOC_E_SCU_N_CONN_RESP) |
+				 S(SCOC_E_SCU_N_DISC_REQ),
+		.out_state_mask = S(S_IDLE) |
+				  S(S_ACTIVE),
+	},
+	[S_CONN_PEND_OUT] = {
+		.name = "CONN_PEND_OUT",
+		.action = scoc_fsm_conn_pend_out,
+		.in_event_mask = S(SCOC_E_SCU_N_DISC_REQ) |
+				 S(SCOC_E_CONN_TMR_EXP) |
+				 S(SCOC_E_RCOC_ROUT_FAIL_IND) |
+				 S(SCOC_E_RCOC_RLSD_IND) |
+				 S(SCOC_E_RCOC_OTHER_NPDU) |
+				 S(SCOC_E_RCOC_CREF_IND) |
+				 S(SCOC_E_RCOC_CC_IND),
+		.out_state_mask = S(S_IDLE) |
+				  S(S_ACTIVE) |
+				  S(S_WAIT_CONN_CONF),
+	},
+	[S_ACTIVE] = {
+		.name = "ACTIVE",
+		.action = scoc_fsm_active,
+		.in_event_mask = S(SCOC_E_SCU_N_DISC_REQ) |
+				/* internal disconnect */
+				 S(SCOC_E_RCOC_CREF_IND) |
+				 S(SCOC_E_RCOC_REL_COMPL_IND) |
+				 S(SCOC_E_RCOC_RLSD_IND) |
+				 S(SCOC_E_RCOC_ERROR_IND) |
+				 S(SCOC_E_T_IAR_EXP) |
+				 S(SCOC_E_T_IAS_EXP) |
+				 S(SCOC_E_RCOC_ROUT_FAIL_IND) |
+				 S(SCOC_E_SCU_N_DATA_REQ) |
+				 S(SCOC_E_SCU_N_EXP_DATA_REQ) |
+				 S(SCOC_E_RCOC_DT1_IND) |
+				 S(SCOC_E_RCOC_IT_IND),
+		.out_state_mask = S(S_IDLE) |
+				  S(S_DISCONN_PEND),
+	},
+	[S_DISCONN_PEND] = {
+		.name = "DISCONN_PEND",
+		.action = scoc_fsm_disconn_pend,
+		.in_event_mask = S(SCOC_E_RCOC_REL_COMPL_IND) |
+				 S(SCOC_E_RCOC_RLSD_IND) |
+				 S(SCOC_E_RCOC_ROUT_FAIL_IND) |
+				 S(SCOC_E_RCOC_OTHER_NPDU) |
+				 S(SCOC_E_T_REL_EXP) |
+				 S(SCOC_E_T_INT_EXP) |
+				 S(SCOC_E_T_REP_REL_EXP),
+		.out_state_mask = S(S_IDLE),
+	},
+	[S_RESET_IN] = {
+		.name = "RESET_IN",
+	},
+	[S_RESET_OUT] = {
+		.name = "RESET_OUT",
+	},
+	[S_BOTHWAY_RESET] = {
+		.name = "BOTHWAY_RESET",
+	},
+	[S_WAIT_CONN_CONF] = {
+		.name = "WAIT_CONN_CONF",
+		.action = scoc_fsm_wait_conn_conf,
+		.in_event_mask = S(SCOC_E_RCOC_RLSD_IND) |
+				 S(SCOC_E_RCOC_CC_IND) |
+				 S(SCOC_E_RCOC_OTHER_NPDU) |
+				 S(SCOC_E_CONN_TMR_EXP) |
+				 S(SCOC_E_RCOC_CREF_IND) |
+				 S(SCOC_E_RCOC_ROUT_FAIL_IND),
+		.out_state_mask = S(S_IDLE) |
+				  S(S_DISCONN_PEND),
+	},
+};
+
+struct osmo_fsm sccp_scoc_fsm = {
+	.name = "SCCP-SCOC",
+	.states = sccp_scoc_states,
+	.num_states = ARRAY_SIZE(sccp_scoc_states),
+	/* ".log_subsys = DLSCCP" doesn't work as DLSCCP is not a constant */
+	.event_names = scoc_event_names,
+};
diff --git a/src/sccp_scoc_fsm.h b/src/sccp_scoc_fsm.h
new file mode 100644
index 0000000..4da09e9
--- /dev/null
+++ b/src/sccp_scoc_fsm.h
@@ -0,0 +1,50 @@
+#pragma once
+
+#include <osmocom/core/fsm.h>
+
+enum sccp_scoc_fsm_state {
+	S_IDLE,
+	S_CONN_PEND_IN,
+	S_CONN_PEND_OUT,
+	S_ACTIVE,
+	S_DISCONN_PEND,
+	S_RESET_IN,
+	S_RESET_OUT,
+	S_BOTHWAY_RESET,
+	S_WAIT_CONN_CONF,
+};
+
+/* Events that this FSM can process */
+enum sccp_scoc_fsm_event {
+	/* Primitives from SCCP-User */
+	SCOC_E_SCU_N_CONN_REQ,
+	SCOC_E_SCU_N_CONN_RESP,
+	SCOC_E_SCU_N_DISC_REQ,
+	SCOC_E_SCU_N_DATA_REQ,
+	SCOC_E_SCU_N_EXP_DATA_REQ,
+
+	/* Events from RCOC (Routing for Connection Oriented) */
+	SCOC_E_RCOC_CONN_IND,
+	SCOC_E_RCOC_ROUT_FAIL_IND,
+	SCOC_E_RCOC_RLSD_IND,
+	SCOC_E_RCOC_REL_COMPL_IND,
+	SCOC_E_RCOC_CREF_IND,
+	SCOC_E_RCOC_CC_IND,
+	SCOC_E_RCOC_DT1_IND,
+	SCOC_E_RCOC_DT2_IND,
+	SCOC_E_RCOC_IT_IND,
+	SCOC_E_RCOC_OTHER_NPDU,
+	SCOC_E_RCOC_ERROR_IND,
+
+	/* Timer Events */
+	SCOC_E_T_IAR_EXP,
+	SCOC_E_T_IAS_EXP,
+
+	SCOC_E_CONN_TMR_EXP,
+
+	SCOC_E_T_REL_EXP,
+	SCOC_E_T_INT_EXP,
+	SCOC_E_T_REP_REL_EXP,
+};
+
+extern struct osmo_fsm sccp_scoc_fsm;
diff --git a/src/sccp_user.c b/src/sccp_user.c
index bf92c1a..8219829 100644
--- a/src/sccp_user.c
+++ b/src/sccp_user.c
@@ -38,6 +38,7 @@
 #include <osmocom/sccp/sccp_types.h>
 
 #include "sccp_internal.h"
+#include "sccp_user.h"
 #include "xua_internal.h"
 #include "ss7_as.h"
 #include "ss7_asp.h"
diff --git a/src/sccp_user.h b/src/sccp_user.h
new file mode 100644
index 0000000..b0b73fe
--- /dev/null
+++ b/src/sccp_user.h
@@ -0,0 +1,41 @@
+#pragma once
+#include <inttypes.h>
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/prim.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <osmocom/sigtran/sccp_sap.h>
+
+struct osmo_sccp_instance;
+
+struct osmo_sccp_user {
+	/*! \brief entry in list of sccp users of \ref osmo_sccp_instance */
+	struct llist_head list;
+	/*! \brief pointer back to SCCP instance */
+	struct osmo_sccp_instance *inst;
+	/*! \brief human-readable name of this user */
+	char *name;
+
+	/*! \brief SSN and/or point code to which we are bound */
+	uint16_t ssn;
+	uint32_t pc;
+
+	/* set if we are a server */
+	struct llist_head links;
+
+	/* user call-back function in case of incoming primitives */
+	osmo_prim_cb prim_cb;
+	void *priv;
+
+	/* Application Server FSM Instance */
+	struct osmo_fsm_inst *as_fi;
+};
+
+
+int sccp_user_prim_up(struct osmo_sccp_user *scut, struct osmo_scu_prim *prim);
+
+#define _LOGPSCU(scu, subsys, level, fmt, args ...) \
+	_LOGPSCI((scu)->inst, subsys, level, "SCU(%s) " fmt, osmo_sccp_user_name(scu), ## args)
+#define LOGPSCU(scu, level, fmt, args ...) \
+	_LOGPSCU(scu, DLSCCP, level, fmt, ## args)
diff --git a/src/sccp_vty.c b/src/sccp_vty.c
index d809c1f..c8d143f 100644
--- a/src/sccp_vty.c
+++ b/src/sccp_vty.c
@@ -40,10 +40,52 @@
 #include <osmocom/sccp/sccp_types.h>
 
 #include "xua_internal.h"
+#include "sccp_connection.h"
 #include "sccp_internal.h"
+#include "sccp_user.h"
 #include "ss7_instance.h"
 #include "ss7_vty.h"
 
+static void vty_show_connection(struct vty *vty, struct sccp_connection *conn)
+{
+	struct osmo_ss7_instance *s7i = conn->inst->ss7;
+	struct osmo_sccp_addr *remote_addr;
+	uint32_t local_pc = OSMO_SS7_PC_INVALID;
+
+	if (osmo_ss7_pc_is_valid(conn->user->pc))
+		local_pc = conn->user->pc;
+	else if (osmo_ss7_pc_is_valid(s7i->cfg.primary_pc))
+		local_pc = s7i->cfg.primary_pc;
+
+	if (conn->incoming)
+		remote_addr = &conn->calling_addr;
+	else
+		remote_addr = &conn->called_addr;
+
+	vty_out(vty, "%c %06x %3u %7s ", conn->incoming ? 'I' : 'O',
+		conn->conn_id, conn->user->ssn,
+		osmo_ss7_pointcode_print(s7i, local_pc));
+	vty_out(vty, "%16s %06x %3u %7s%s",
+		osmo_fsm_inst_state_name(conn->fi), conn->remote_ref, remote_addr->ssn,
+		osmo_ss7_pointcode_print(s7i, conn->remote_pc),
+		VTY_NEWLINE);
+}
+
+void sccp_show_connections(struct vty *vty, struct osmo_sccp_instance *inst)
+{
+	struct sccp_connection *conn;
+	struct rb_node *node;
+
+	vty_out(vty, "I Local              Conn.            Remote            %s", VTY_NEWLINE);
+	vty_out(vty, "O Ref    SSN PC      State            Ref    SSN PC     %s", VTY_NEWLINE);
+	vty_out(vty, "- ------ --- ------- ---------------- ------ --- -------%s", VTY_NEWLINE);
+
+	for (node = rb_first(&inst->connections); node; node = rb_next(node)) {
+		conn = container_of(node, struct sccp_connection, node);
+		vty_show_connection(vty, conn);
+	}
+}
+
 static void show_user(struct vty *vty, struct osmo_sccp_user *user)
 {
 	struct osmo_sccp_instance *sccp = user->inst;
@@ -140,7 +182,7 @@
 		return CMD_WARNING;
 	};
 
-	sccp_scoc_show_connections(vty, sccp);
+	sccp_show_connections(vty, sccp);
 
 	return CMD_SUCCESS;
 }
diff --git a/src/ss7.c b/src/ss7.c
index e2f2ca9..3476ee2 100644
--- a/src/ss7.c
+++ b/src/ss7.c
@@ -48,6 +48,7 @@
 #include <osmocom/netif/ipa.h>
 #include <osmocom/netif/sctp.h>
 
+#include "sccp_scoc_fsm.h"
 #include "sccp_internal.h"
 #include "xua_internal.h"
 #include "ss7_as.h"

To view, visit change 40581. To unsubscribe, or for help writing mail filters, visit settings.