diff --git a/openbsc/src/gprs/gb_proxy.c b/openbsc/src/gprs/gb_proxy.c
index bc2e119..bf79444 100644
--- a/openbsc/src/gprs/gb_proxy.c
+++ b/openbsc/src/gprs/gb_proxy.c
@@ -403,6 +403,122 @@
 	return len;
 }
 
+/* TODO: Move shift functions to libosmocore */
+
+int v_fixed_shift(uint8_t **data, size_t *data_len,
+		  size_t len, uint8_t **value)
+{
+	if (len > *data_len)
+		goto fail;
+
+	if (value)
+		*value = *data;
+
+	*data += len;
+	*data_len -= len;
+
+	return len;
+
+fail:
+	*data += *data_len;
+	*data_len = 0;
+	return -1;
+}
+
+int tv_fixed_match(uint8_t **data, size_t *data_len,
+		   uint8_t tag, size_t len,
+		   uint8_t **value)
+{
+	size_t ie_len;
+
+	if (*data_len == 0)
+		goto fail;
+
+	if ((*data)[0] != tag)
+		return 0;
+
+	if (len > *data_len - 1)
+		goto fail;
+
+	if (value)
+		*value = *data + 1;
+
+	ie_len = len + 1;
+	*data += ie_len;
+	*data_len -= ie_len;
+
+	return ie_len;
+
+fail:
+	*data += *data_len;
+	*data_len = 0;
+	return -1;
+}
+
+int tlv_match(uint8_t **data, size_t *data_len,
+	      uint8_t tag, uint8_t **value, size_t *value_len)
+{
+	size_t len;
+	size_t ie_len;
+
+	if (*data_len < 2)
+		goto fail;
+
+	if ((*data)[0] != tag)
+		return 0;
+
+	len = (*data)[1];
+	if (len > *data_len - 2)
+		goto fail;
+
+	if (value)
+		*value = *data + 2;
+	if (value_len)
+		*value_len = len;
+
+	ie_len = len + 2;
+
+	*data += ie_len;
+	*data_len -= ie_len;
+
+	return ie_len;
+
+fail:
+	*data += *data_len;
+	*data_len = 0;
+	return -1;
+}
+
+int lv_shift(uint8_t **data, size_t *data_len,
+	     uint8_t **value, size_t *value_len)
+{
+	size_t len;
+	size_t ie_len;
+
+	if (*data_len < 1)
+		goto fail;
+
+	len = (*data)[0];
+	if (len > *data_len - 1)
+		goto fail;
+
+	if (value)
+		*value = *data + 1;
+	if (value_len)
+		*value_len = len;
+
+	ie_len = len + 1;
+	*data += ie_len;
+	*data_len -= ie_len;
+
+	return ie_len;
+
+fail:
+	*data += *data_len;
+	*data_len = 0;
+	return -1;
+}
+
 struct gbprox_tlli_info {
 	struct llist_head list;
 
diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c
index 1598c72..d5675d8 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.c
+++ b/openbsc/tests/gbproxy/gbproxy_test.c
@@ -23,6 +23,7 @@
 #include <osmocom/core/talloc.h>
 #include <osmocom/core/signal.h>
 #include <osmocom/core/rate_ctr.h>
+#include <osmocom/gsm/tlv.h>
 #include <osmocom/gprs/gprs_msgb.h>
 #include <osmocom/gprs/gprs_ns.h>
 #include <osmocom/gprs/gprs_bssgp.h>
@@ -967,6 +968,240 @@
 	nsi = NULL;
 }
 
+/* TODO: Move tlv testing to libosmocore */
+int v_fixed_shift(uint8_t **data, size_t *data_len, size_t len, uint8_t **value);
+int tv_fixed_match(uint8_t **data, size_t *data_len, uint8_t tag, size_t len,
+	     uint8_t **value);
+int tlv_match(uint8_t **data, size_t *data_len, uint8_t tag, uint8_t **value,
+	      size_t *value_len);
+int lv_shift(uint8_t **data, size_t *data_len,
+	     uint8_t **value, size_t *value_len);
+
+static void check_tlv_match(uint8_t **data, size_t *data_len,
+			    uint8_t tag, size_t exp_len, const uint8_t *exp_val)
+{
+	uint8_t *value;
+	size_t value_len;
+	int rc;
+
+	rc = tlv_match(data, data_len, tag ^ 1, NULL, NULL);
+	OSMO_ASSERT(rc == 0);
+
+	rc = tlv_match(data, data_len, tag, &value, &value_len);
+	OSMO_ASSERT(rc == value_len + 2);
+	OSMO_ASSERT(value_len == exp_len);
+	OSMO_ASSERT(memcmp(value, exp_val, exp_len) == 0);
+}
+
+static void check_tv_fixed_match(uint8_t **data, size_t *data_len,
+				 uint8_t tag, size_t len, const uint8_t *exp_val)
+{
+	uint8_t *value;
+	int rc;
+
+	rc = tv_fixed_match(data, data_len, tag ^ 1, len, NULL);
+	OSMO_ASSERT(rc == 0);
+
+	rc = tv_fixed_match(data, data_len, tag, len, &value);
+	OSMO_ASSERT(rc == len + 1);
+	OSMO_ASSERT(memcmp(value, exp_val, len) == 0);
+}
+
+static void check_v_fixed_shift(uint8_t **data, size_t *data_len,
+				size_t len, const uint8_t *exp_val)
+{
+	uint8_t *value;
+	int rc;
+
+	rc = v_fixed_shift(data, data_len, len, &value);
+	OSMO_ASSERT(rc == len);
+	OSMO_ASSERT(memcmp(value, exp_val, len) == 0);
+}
+
+static void check_lv_shift(uint8_t **data, size_t *data_len,
+			   size_t exp_len, const uint8_t *exp_val)
+{
+	uint8_t *value;
+	size_t value_len;
+	int rc;
+
+	rc = lv_shift(data, data_len, &value, &value_len);
+	OSMO_ASSERT(rc == value_len + 1);
+	OSMO_ASSERT(value_len == exp_len);
+	OSMO_ASSERT(memcmp(value, exp_val, exp_len) == 0);
+}
+
+static void check_tlv_match_data_len(size_t data_len, uint8_t tag, size_t len,
+				     const uint8_t *test_data)
+{
+	uint8_t buf[300] = {0};
+
+	uint8_t *unchanged_ptr = buf - 1;
+	size_t unchanged_len = 0xdead;
+	size_t tmp_data_len = data_len;
+	uint8_t *value = unchanged_ptr;
+	size_t value_len = unchanged_len;
+	uint8_t *data = buf;
+
+	OSMO_ASSERT(data_len <= sizeof(buf));
+
+	tlv_put(data, tag, len, test_data);
+	if (data_len < len + 2) {
+		OSMO_ASSERT(-1 == tlv_match(&data, &tmp_data_len,
+					    tag, &value, &value_len));
+		OSMO_ASSERT(tmp_data_len == 0);
+		OSMO_ASSERT(data == buf + data_len);
+		OSMO_ASSERT(value == unchanged_ptr);
+		OSMO_ASSERT(value_len == unchanged_len);
+	} else {
+		OSMO_ASSERT(0 <= tlv_match(&data, &tmp_data_len,
+					   tag, &value, &value_len));
+		OSMO_ASSERT(value != unchanged_ptr);
+		OSMO_ASSERT(value_len != unchanged_len);
+	}
+}
+
+static void check_tv_fixed_match_data_len(size_t data_len,
+					  uint8_t tag, size_t len,
+					  const uint8_t *test_data)
+{
+	uint8_t buf[300] = {0};
+
+	uint8_t *unchanged_ptr = buf - 1;
+	size_t tmp_data_len = data_len;
+	uint8_t *value = unchanged_ptr;
+	uint8_t *data = buf;
+
+	OSMO_ASSERT(data_len <= sizeof(buf));
+
+	tv_fixed_put(data, tag, len, test_data);
+
+	if (data_len < len + 1) {
+		OSMO_ASSERT(-1 == tv_fixed_match(&data, &tmp_data_len,
+						 tag, len, &value));
+		OSMO_ASSERT(tmp_data_len == 0);
+		OSMO_ASSERT(data == buf + data_len);
+		OSMO_ASSERT(value == unchanged_ptr);
+	} else {
+		OSMO_ASSERT(0 <= tv_fixed_match(&data, &tmp_data_len,
+						tag, len, &value));
+		OSMO_ASSERT(value != unchanged_ptr);
+	}
+}
+
+static void check_v_fixed_shift_data_len(size_t data_len,
+					 size_t len, const uint8_t *test_data)
+{
+	uint8_t buf[300] = {0};
+
+	uint8_t *unchanged_ptr = buf - 1;
+	size_t tmp_data_len = data_len;
+	uint8_t *value = unchanged_ptr;
+	uint8_t *data = buf;
+
+	OSMO_ASSERT(data_len <= sizeof(buf));
+
+	memcpy(data, test_data, len);
+
+	if (data_len < len) {
+		OSMO_ASSERT(-1 == v_fixed_shift(&data, &tmp_data_len,
+						len, &value));
+		OSMO_ASSERT(tmp_data_len == 0);
+		OSMO_ASSERT(data == buf + data_len);
+		OSMO_ASSERT(value == unchanged_ptr);
+	} else {
+		OSMO_ASSERT(0 <= v_fixed_shift(&data, &tmp_data_len,
+					       len, &value));
+		OSMO_ASSERT(value != unchanged_ptr);
+	}
+}
+
+static void check_lv_shift_data_len(size_t data_len,
+				    size_t len, const uint8_t *test_data)
+{
+	uint8_t buf[300] = {0};
+
+	uint8_t *unchanged_ptr = buf - 1;
+	size_t unchanged_len = 0xdead;
+	size_t tmp_data_len = data_len;
+	uint8_t *value = unchanged_ptr;
+	size_t value_len = unchanged_len;
+	uint8_t *data = buf;
+
+	lv_put(data, len, test_data);
+	if (data_len < len + 1) {
+		OSMO_ASSERT(-1 == lv_shift(&data, &tmp_data_len,
+					   &value, &value_len));
+		OSMO_ASSERT(tmp_data_len == 0);
+		OSMO_ASSERT(data == buf + data_len);
+		OSMO_ASSERT(value == unchanged_ptr);
+		OSMO_ASSERT(value_len == unchanged_len);
+	} else {
+		OSMO_ASSERT(0 <= lv_shift(&data, &tmp_data_len,
+					  &value, &value_len));
+		OSMO_ASSERT(value != unchanged_ptr);
+		OSMO_ASSERT(value_len != unchanged_len);
+	}
+}
+
+static void test_tlv_shift_functions()
+{
+	uint8_t test_data[1024];
+	uint8_t buf[1024];
+	uint8_t *data_end;
+	int i, len;
+	uint8_t *data;
+	size_t data_len;
+	const uint8_t tag = 0x1a;
+
+	printf("Test shift functions\n");
+
+	for (i = 0; i < ARRAY_SIZE(test_data); i++)
+		test_data[i] = (uint8_t)i;
+
+	for (len = 0; len < 256; len++) {
+		const int iterations = sizeof(buf) / (len + 2) / 4;
+
+		memset(buf, 0xee, sizeof(buf));
+		data_end = data = buf;
+
+		for (i = 0; i < iterations; i++) {
+			data_end = tlv_put(data_end, tag, len, test_data);
+			data_end = tv_fixed_put(data_end, tag, len, test_data);
+			/* v_fixed_put */
+			memcpy(data_end, test_data, len);
+			data_end += len;
+			data_end = lv_put(data_end, len, test_data);
+		}
+
+		data_len = data_end - data;
+		OSMO_ASSERT(data_len <= sizeof(buf));
+
+		for (i = 0; i < iterations; i++) {
+			check_tlv_match(&data, &data_len, tag, len, test_data);
+			check_tv_fixed_match(&data, &data_len, tag, len, test_data);
+			check_v_fixed_shift(&data, &data_len, len, test_data);
+			check_lv_shift(&data, &data_len, len, test_data);
+		}
+
+		OSMO_ASSERT(data == data_end);
+
+		/* Test at end of data */
+
+		OSMO_ASSERT(-1 == tlv_match(&data, &data_len, tag, NULL, NULL));
+		OSMO_ASSERT(-1 == tv_fixed_match(&data, &data_len, tag, len, NULL));
+		OSMO_ASSERT((len ? -1 : 0) == v_fixed_shift(&data, &data_len, len, NULL));
+		OSMO_ASSERT(-1 == lv_shift(&data, &data_len, NULL, NULL));
+
+		/* Test invalid data_len */
+		for (data_len = 0; data_len <= len + 2 + 1; data_len += 1) {
+			check_tlv_match_data_len(data_len, tag, len, test_data);
+			check_tv_fixed_match_data_len(data_len, tag, len, test_data);
+			check_v_fixed_shift_data_len(data_len, len, test_data);
+			check_lv_shift_data_len(data_len, len, test_data);
+		}
+	}
+}
 static struct log_info_cat gprs_categories[] = {
 	[DGPRS] = {
 		.name = "DGPRS",
@@ -1006,6 +1241,7 @@
 	setlinebuf(stdout);
 
 	printf("===== GbProxy test START\n");
+	test_tlv_shift_functions();
 	test_gbproxy();
 	test_gbproxy_ident_changes();
 	test_gbproxy_ra_patching();
diff --git a/openbsc/tests/gbproxy/gbproxy_test.ok b/openbsc/tests/gbproxy/gbproxy_test.ok
index 5f2d81e..f99087d 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.ok
+++ b/openbsc/tests/gbproxy/gbproxy_test.ok
@@ -1,4 +1,5 @@
 ===== GbProxy test START
+Test shift functions
 === test_gbproxy ===
 --- Initialise SGSN ---