WIP: Initial IuUP support using proper FSMs

Change-Id: I6694a21480b25ab8f35d375295be6601ce38e31d

include/osmocom/mgcp/Makefile.am

@@ -13,4 +13,5 @@ noinst_HEADERS = \
 	mgcp_e1.h \
 	mgcp_network.h \
 	mgcp_protocol.h \
+	mgcp_iuup.h \
 	$(NULL)

include/osmocom/mgcp/mgcp_conn.h

@@ -28,6 +28,7 @@
 #include <osmocom/mgcp/osmux.h>
 #include <osmocom/core/linuxlist.h>
 #include <osmocom/core/rate_ctr.h>
+#include <osmocom/gsm/iuup.h>
 #include <inttypes.h>
 
 #define LOGPCONN(conn, cat, level, fmt, args...) \
@@ -47,6 +48,7 @@ enum mgcp_conn_rtp_type {
 	MGCP_RTP_DEFAULT	= 0,
 	MGCP_OSMUX_BSC,
 	MGCP_OSMUX_BSC_NAT,
+	MGCP_RTP_IUUP,
 };
 
 /*! Connection type, specifies which member of the union "u" in mgcp_conn
@@ -93,6 +95,12 @@ struct mgcp_conn_rtp {
 		} stats;
 	} osmux;
 
+	struct {
+		struct osmo_iuup_instance *iui;
+		bool active_init; /* true: Send IuUP Init */
+		bool first_rtp_pkt_received;
+	} iuup;
+
 	struct rate_ctr_group *rate_ctr_group;
 };
 
@@ -176,6 +184,11 @@ static inline bool mgcp_conn_rtp_is_osmux(const struct mgcp_conn_rtp *conn) {
 	return conn->type == MGCP_OSMUX_BSC || conn->type == MGCP_OSMUX_BSC_NAT;
 }
 
+/* Was conn configured to handle Osmux? */
+static inline bool mgcp_conn_rtp_is_iuup(const struct mgcp_conn_rtp *conn) {
+	return conn->type == MGCP_RTP_IUUP;
+}
+
 struct mgcp_conn *mgcp_conn_alloc(void *ctx, struct mgcp_endpoint *endp,
 				  enum mgcp_conn_type type, char *name);
 struct mgcp_conn *mgcp_conn_get(struct mgcp_endpoint *endp, const char *id);

include/osmocom/mgcp/mgcp_iuup.h

@@ -0,0 +1,32 @@
+/* Message connection list handling */
+
+/*
+ * (C) 2021 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Pau Espin Pedrol
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#pragma once
+
+#include <osmocom/core/msgb.h>
+
+struct mgcp_conn_rtp;
+
+int mgcp_conn_iuup_init(struct mgcp_conn_rtp *conn_rtp);
+void mgcp_conn_iuup_cleanup(struct mgcp_conn_rtp *conn_rtp);
+int mgcp_conn_iuup_dispatch_rtp(struct msgb *msg);
+int mgcp_conn_iuup_send_rtp(struct mgcp_conn_rtp *conn_rtp, struct msgb *msg);

include/osmocom/mgcp/mgcp_network.h

@@ -70,8 +70,6 @@ struct mgcp_rtp_state {
 	 * data is just re-used) */
 	uint16_t alt_rtp_tx_sequence;
 	uint32_t alt_rtp_tx_ssrc;
-
-	bool patched_first_rtp_payload; /* FIXME: drop this, see OS#2459 */
 };
 
 struct mgcp_rtp_codec {

src/libosmo-mgcp/Makefile.am

@@ -48,4 +48,5 @@ libosmo_mgcp_a_SOURCES = \
 	mgcp_ctrl.c \
 	mgcp_ratectr.c \
 	mgcp_e1.c \
+	mgcp_iuup.c \
 	$(NULL)

src/libosmo-mgcp/mgcp_conn.c

@@ -30,6 +30,8 @@
 #include <osmocom/mgcp/mgcp_trunk.h>
 #include <osmocom/mgcp/mgcp_sdp.h>
 #include <osmocom/mgcp/mgcp_codec.h>
+#include <osmocom/mgcp/mgcp_iuup.h>
+
 #include <osmocom/gsm/gsm_utils.h>
 #include <osmocom/core/rate_ctr.h>
 #include <osmocom/core/timer.h>
@@ -129,6 +131,8 @@ static void mgcp_rtp_conn_cleanup(struct mgcp_conn_rtp *conn_rtp)
 {
 	if (mgcp_conn_rtp_is_osmux(conn_rtp))
 		conn_osmux_disable(conn_rtp);
+	if (mgcp_conn_rtp_is_iuup(conn_rtp))
+		mgcp_conn_iuup_cleanup(conn_rtp);
 	mgcp_free_rtp_port(&conn_rtp->end);
 	rate_ctr_group_free(conn_rtp->rate_ctr_group);
 	mgcp_codec_reset_all(conn_rtp);

src/libosmo-mgcp/mgcp_iuup.c

@@ -0,0 +1,346 @@
+/*
+ * (C) 2021 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All rights not specifically granted under this license are reserved.
+ *
+ * Author: Pau Espin Pedrol
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published by the
+ * Free Software Foundation; either version 3 of the License, or (at your
+ * option) any later version.
+ */
+
+#include <stdint.h>
+
+#include <osmocom/gsm/iuup.h>
+
+#include <osmocom/netif/rtp.h>
+
+#include <osmocom/mgcp/mgcp_conn.h>
+#include <osmocom/mgcp/mgcp_iuup.h>
+#include <osmocom/mgcp/mgcp_endp.h>
+#include <osmocom/mgcp/debug.h>
+
+#define MGW_IUUP_MSGB_SIZE 4096
+
+static struct osmo_iuup_rnl_config def_configure_req = {
+	.transparent = false,
+	.active = true,
+	.supported_versions_mask = 0x0003,
+	.num_rfci = 0,
+	.num_subflows = 0,
+	/* .delivery_err_sdu = All set to 0 (YES) by default, */
+	.IPTIs_present = false,
+	.t_init = { .t_ms = IUUP_TIMER_INIT_T_DEFAULT, .n_max = IUUP_TIMER_INIT_N_DEFAULT },
+	.t_ta = { .t_ms = IUUP_TIMER_TA_T_DEFAULT, .n_max = IUUP_TIMER_TA_N_DEFAULT },
+	.t_rc = { .t_ms = IUUP_TIMER_RC_T_DEFAULT, .n_max = IUUP_TIMER_RC_N_DEFAULT },
+};
+
+static struct mgcp_conn *_find_dst_conn(struct mgcp_conn *conn)
+{
+	/* Find a destination connection. */
+	/* NOTE: This code path runs every time an RTP packet is received. The
+	 * function mgcp_find_dst_conn() we use to determine the detination
+	 * connection will iterate the connection list inside the endpoint.
+	 * Since list iterations are quite costly, we will figure out the
+	 * destination only once and use the optional private data pointer of
+	 * the connection to cache the destination connection pointer. */
+
+	struct mgcp_conn *conn_dst;
+	if (!conn->priv) {
+		conn_dst = mgcp_find_dst_conn(conn);
+		conn->priv = conn_dst;
+	} else {
+		conn_dst = (struct mgcp_conn *)conn->priv;
+	}
+	return conn_dst;
+}
+
+static int _conn_iuup_configure_as_passive(struct mgcp_conn_rtp *conn_rtp, struct msgb *msg)
+{
+	struct osmo_iuup_rnl_prim *irp;
+	int rc;
+
+	conn_rtp->iuup.active_init = false;
+
+	/* Tx CONFIG.req */
+	irp = osmo_iuup_rnl_prim_alloc(conn_rtp->conn, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, MGW_IUUP_MSGB_SIZE);
+	irp->u.config = def_configure_req;
+	irp->u.config.active = conn_rtp->iuup.active_init;
+	if ((rc = osmo_iuup_rnl_prim_down(conn_rtp->iuup.iui, irp)) != 0)
+		LOG_CONN_RTP(conn_rtp, LOGL_ERROR, "Failed configuring IuUP layer\n");
+	return rc;
+}
+
+static int _conn_iuup_rtp_pl_up(struct mgcp_conn_rtp *conn_rtp, struct msgb *msg)
+{
+	/* Send RTP payload (IuUP) up the stack: */
+	struct osmo_iuup_tnl_prim *itp;
+	int rc;
+
+	msg->l2h = msgb_data(msg) + sizeof(struct rtp_hdr);
+
+	itp = osmo_iuup_tnl_prim_alloc(conn_rtp->conn, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, MGW_IUUP_MSGB_SIZE);
+	itp->oph.msg->l2h = msgb_put(itp->oph.msg, msgb_l2len(msg));
+	memcpy(itp->oph.msg->l2h, msgb_l2(msg), msgb_l2len(msg));
+	if ((rc = osmo_iuup_tnl_prim_up(conn_rtp->iuup.iui, itp)) != 0) {
+		LOG_CONN_RTP(conn_rtp, LOGL_ERROR, "Failed passing IuUP-Init to IuUP layer\n");
+	}
+	return rc;
+}
+
+static int check_rtp_iuup(const struct mgcp_conn_rtp *conn_rtp, struct msgb *msg)
+{
+	size_t min_size = sizeof(struct rtp_hdr);
+	/* Check there's at least 2 bytes of RTP payload (IuUP header). This is
+	 ** mainly to avoid 0-byte payload copy cases */
+	if (msgb_length(msg) < sizeof(struct rtp_hdr) + 2) {
+		LOG_CONN_RTP(conn_rtp, LOGL_ERROR, "RTP-IuUP packet too short (%u < %zu)\n",
+			     msgb_length(msg), min_size);
+		return -1;
+	}
+	return 0;
+}
+
+static int _conn_iuup_rx_rnl_data(struct mgcp_conn_rtp *conn_rtp_src, struct osmo_iuup_rnl_prim *irp)
+{
+	struct mgcp_conn *conn_dst;
+	struct mgcp_conn_rtp *conn_rtp_dst;
+	int rc;
+
+	conn_dst = _find_dst_conn(conn_rtp_src->conn);
+
+	/* There is no destination conn, stop here */
+	if (!conn_dst) {
+		LOGPCONN(conn_rtp_src->conn, DRTP, LOGL_DEBUG,
+			 "no connection to forward an incoming IuUP payload to\n");
+		rc= -1;
+		goto free_ret;
+	}
+
+	/* The destination conn is not an RTP/IuUP connection */
+	if (conn_dst->type != MGCP_CONN_TYPE_RTP) {
+		LOGPCONN(conn_rtp_src->conn, DRTP, LOGL_ERROR,
+			 "unable to find suitable destination conn\n");
+		 rc= -1;
+		goto free_ret;
+	}
+	conn_rtp_dst = &conn_dst->u.rtp;
+
+	switch (conn_rtp_dst->type) {
+	case MGCP_RTP_IUUP:
+		/* We simply forward the msg, without freeing it: */
+		talloc_steal(conn_dst, irp->oph.msg);
+		irp->oph.operation = PRIM_OP_REQUEST;
+		if ((rc = osmo_iuup_rnl_prim_down(conn_rtp_dst->iuup.iui, irp)) != 0)
+			LOG_CONN_RTP(conn_rtp_dst, LOGL_ERROR, "Failed Tx data down to IuUP layer\n");
+		return rc;
+		break;
+	case MGCP_RTP_DEFAULT:
+		/* FIXME: We probably need transcoding here?! Or at least look up AMR modes and translate to related RFCI */
+	case MGCP_OSMUX_BSC:
+	case MGCP_OSMUX_BSC_NAT:
+	default:
+		LOGPCONN(conn_rtp_src->conn, DRTP, LOGL_ERROR,
+			 "Forward of IuUP payload to RTP connection type %u not supported!\n",
+			 conn_rtp_dst->type);
+	}
+
+free_ret:
+	msgb_free(irp->oph.msg);
+	return rc;
+}
+
+static int _conn_iuup_rx_rnl_status_init(struct mgcp_conn_rtp *conn_rtp_src, struct osmo_iuup_rnl_prim *irp)
+{
+	struct mgcp_conn *conn_dst;
+	struct mgcp_conn_rtp *conn_rtp_dst;
+	int rc = 0;
+
+	conn_dst = _find_dst_conn(conn_rtp_src->conn);
+	if (!conn_dst)
+		return 0; /* FIXME: that probably means we potentially need to Init the peer dst later! */
+	conn_rtp_dst = &conn_dst->u.rtp;
+	if (!mgcp_conn_rtp_is_iuup(conn_rtp_dst))
+		return 0; /* Nothing to do */
+
+	if (conn_rtp_dst->iuup.first_rtp_pkt_received) {
+		/* Note: This could actually happen if INIT is rentransmitted, etc: */
+		LOG_CONN_RTP(conn_rtp_dst, LOGL_ERROR, "Unexpected: Peer conn received IuUP INIT-ACK but RTP packets already received on this conn!\n");
+	}
+	/* We received IuUP parameters on the peer (RNC), Init actively this conn (against CN): */
+
+	/* TODO: we still don't send this INIT INDICATION from IuUP FSM! Once we
+	   do, we copy RFCI, etc. and send CONFIGURE.req(init=active) to
+	   conn_rtp_dst->iuup.iui  */
+	return rc;
+}
+
+static int _conn_iuup_rx_rnl_status(struct mgcp_conn_rtp *conn_rtp_src, struct osmo_iuup_rnl_prim *irp)
+{
+	int rc;
+
+	switch (irp->u.status.procedure) {
+	case IUUP_PROC_INIT:
+		rc = _conn_iuup_rx_rnl_status_init(conn_rtp_src, irp);
+		break;
+	case IUUP_PROC_RATE_CTRL:
+	case IUUP_PROC_TIME_ALIGN:
+	case IUUP_PROC_ERR_EVENT:
+	default:
+		LOG_CONN_RTP(conn_rtp_src, LOGL_ERROR,
+			     "Received IuUP RNL STATUS procedure type %u not handled\n",
+			     irp->u.status.procedure);
+		rc = 0;
+	}
+
+	return rc;
+}
+static int _conn_iuup_user_prim_cb(struct osmo_prim_hdr *oph, void *ctx)
+{
+	struct mgcp_conn_rtp *conn_rtp_src = ctx;
+	struct osmo_iuup_rnl_prim *irp = (struct osmo_iuup_rnl_prim *)oph;
+	struct msgb *msg = oph->msg;
+	int rc;
+
+	switch (OSMO_PRIM_HDR(&irp->oph)) {
+	case OSMO_PRIM(OSMO_IUUP_RNL_DATA, PRIM_OP_INDICATION):
+		/* we pass ownsership of msg here: */
+		rc = _conn_iuup_rx_rnl_data(conn_rtp_src, irp);
+		break;
+	case OSMO_PRIM(OSMO_IUUP_RNL_STATUS, PRIM_OP_INDICATION):
+		rc = _conn_iuup_rx_rnl_status(conn_rtp_src, irp);
+		msgb_free(msg);
+		break;
+	default:
+		msgb_free(msg);
+		OSMO_ASSERT(false);
+	}
+
+	return rc;
+}
+
+static int _conn_iuup_transport_prim_cb(struct osmo_prim_hdr *oph, void *ctx)
+{
+	struct mgcp_conn_rtp *conn_rtp_dst = ctx;
+	struct mgcp_conn *conn_dst = conn_rtp_dst->conn;
+	struct osmo_iuup_tnl_prim *itp = (struct osmo_iuup_tnl_prim *)oph;
+	struct mgcp_conn *conn_src;
+	struct msgb *msg;
+	struct rtp_hdr *rtph;
+	struct osmo_sockaddr from_addr = {0}; /* FIXME: what to do with this one? */
+
+	OSMO_ASSERT(OSMO_PRIM_HDR(&itp->oph) == OSMO_PRIM(OSMO_IUUP_TNL_UNITDATA, PRIM_OP_REQUEST));
+
+	msg = oph->msg;
+	talloc_steal(conn_rtp_dst->conn, msg);
+
+	msgb_pull_to_l2(msg);
+	rtph = (struct rtp_hdr *)msgb_push(msg, sizeof(*rtph));
+	/* TODO: fill rtph properly: */
+	*rtph = (struct rtp_hdr){
+		.csrc_count = 0,
+		.extension = 0,
+		.padding = 0,
+		.version = 2,
+		.payload_type = 96,
+		.marker = 0,
+		.sequence = 0,
+		.timestamp = 0,
+		.ssrc = 0
+	};
+
+	/* TODO: mgcp_send_rtp() expects msg to have OSMO_RTP_MSG_CTX filled */
+
+	/* The destination of the destination conn is the source conn, right? */
+	conn_src = _find_dst_conn(conn_dst);
+
+	return mgcp_send(conn_dst->endp, 1,
+			 &from_addr, msg, &conn_src->u.rtp, conn_rtp_dst);
+}
+
+int mgcp_conn_iuup_init(struct mgcp_conn_rtp *conn_rtp)
+{
+	conn_rtp->type = MGCP_RTP_IUUP;
+	conn_rtp->iuup.iui = osmo_iuup_instance_alloc(conn_rtp->conn, conn_rtp->conn->id);
+	OSMO_ASSERT(conn_rtp->iuup.iui);
+	osmo_iuup_instance_set_user_prim_cb(conn_rtp->iuup.iui, _conn_iuup_user_prim_cb, conn_rtp);
+	osmo_iuup_instance_set_transport_prim_cb(conn_rtp->iuup.iui, _conn_iuup_transport_prim_cb, conn_rtp);
+	return 0;
+}
+
+void mgcp_conn_iuup_cleanup(struct mgcp_conn_rtp *conn_rtp)
+{
+	osmo_iuup_instance_free(conn_rtp->iuup.iui);
+	conn_rtp->iuup.iui = NULL;
+}
+
+int mgcp_conn_iuup_dispatch_rtp(struct msgb *msg)
+{
+	struct osmo_rtp_msg_ctx *mc = OSMO_RTP_MSG_CTX(msg);
+	struct mgcp_conn_rtp *conn_rtp_src = mc->conn_src;
+	struct mgcp_conn *conn_dst;
+	int rc = 0;
+	bool force_output_enabled = false;
+	int prev_output_enabled;
+
+	OSMO_ASSERT(mgcp_conn_rtp_is_iuup(conn_rtp_src));
+
+	if ((rc = check_rtp_iuup(conn_rtp_src, msg)) < 0)
+		goto free_ret;
+
+	if (!conn_rtp_src->iuup.active_init && !conn_rtp_src->iuup.first_rtp_pkt_received) {
+		conn_rtp_src->iuup.first_rtp_pkt_received = true;
+		/* We received the first message without sending any, the peer is the active side (RNC). */
+		conn_dst = _find_dst_conn(conn_rtp_src->conn);
+		if (conn_dst && mgcp_conn_rtp_is_iuup(&conn_dst->u.rtp) &&
+		    !conn_dst->u.rtp.iuup.first_rtp_pkt_received) {
+			conn_dst->u.rtp.iuup.active_init = true;
+			/* TODO: start Init as active there */
+		}
+		rc = _conn_iuup_configure_as_passive(conn_rtp_src, msg);
+		if (rc < 0)
+			goto free_ret;
+		/* We need to force allowance of RTP containing Init-ACK back: */
+		prev_output_enabled = conn_rtp_src->end.output_enabled;
+		conn_rtp_src->end.output_enabled = 1;
+		force_output_enabled = true;
+	}
+
+	rc = _conn_iuup_rtp_pl_up(conn_rtp_src, msg);
+
+	if (force_output_enabled)
+		conn_rtp_src->end.output_enabled = prev_output_enabled;
+
+	return rc;
+free_ret:
+	msgb_free(msg);
+	return rc;
+}
+
+/* Build IuUP RNL Data primitive from msg containing an incoming RTP pkt from
+ * peer and send it down the IuUP layer towards the destination as IuUP/RTP: */
+int mgcp_conn_iuup_send_rtp(struct mgcp_conn_rtp *conn_rtp, struct msgb *msg)
+{
+	struct osmo_iuup_rnl_prim *irp;
+	struct rtp_hdr *rtph;
+	int rc;
+
+	/* Tx RNL-DATA.req */
+	rtph = (struct rtp_hdr *)msgb_data(msg);
+	msgb_pull(msg, sizeof(*rtph));
+
+	irp = osmo_iuup_rnl_prim_alloc(conn_rtp->conn, OSMO_IUUP_RNL_DATA, PRIM_OP_REQUEST, MGW_IUUP_MSGB_SIZE);
+	/* FIXME: We probably need transcoding here?! Or at least look up AMR modes and translate to related RFCI */
+	irp->u.data.rfci = 0;
+	irp->u.data.frame_nr = rtph->sequence % 4;
+	irp->u.data.fqc = IUUP_FQC_FRAME_GOOD;
+	irp->oph.msg->l3h = msgb_put(irp->oph.msg, msgb_length(msg));
+	memcpy(irp->oph.msg->l3h, msgb_data(msg), msgb_length(msg));
+	if ((rc = osmo_iuup_rnl_prim_down(conn_rtp->iuup.iui, irp)) != 0) {
+		LOG_CONN_RTP(conn_rtp, LOGL_ERROR, "Failed Tx RTP payload down the IuUP layer\n");
+		return rc;
+	}
+
+	return rc;
+}

src/libosmo-mgcp/mgcp_network.c

@@ -48,7 +48,7 @@
 #include <osmocom/mgcp/debug.h>
 #include <osmocom/codec/codec.h>
 #include <osmocom/mgcp/mgcp_e1.h>
-
+#include <osmocom/mgcp/mgcp_iuup.h>
 
 #define RTP_SEQ_MOD		(1 << 16)
 #define RTP_MAX_DROPOUT		3000
@@ -975,7 +975,8 @@ static int check_rtp(struct mgcp_conn_rtp *conn_src, struct msgb *msg)
 	 * the length is because we currently handle IUUP packets as RTP
 	 * packets, so they must pass this check, if we weould be more
 	 * strict here, we would possibly break 3G. (see also FIXME note
-	 * below */
+	 * below. */
+	 /* FIXME UPDATE: we can now apply more checks based on mgcp_conn_rtp_is_iuup(conn_src) */
 
 	return 0;
 }
@@ -1013,6 +1014,11 @@ static int mgcp_send_rtp(struct mgcp_conn_rtp *conn_dst, struct msgb *msg)
 			 "endpoint type is MGCP_OSMUX_BSC_NAT, "
 			 "using osmux_xfrm_to_osmux() to forward data through OSMUX\n");
 		return osmux_xfrm_to_osmux((char*)msgb_data(msg), msgb_length(msg), conn_dst);
+	case MGCP_RTP_IUUP:
+		LOGPENDP(endp, DRTP, LOGL_DEBUG,
+			 "endpoint type is MGCP_RTP_IUUP, "
+			 "using mgcp_conn_iuup_send_rtp() to forward data over IuUP\n");
+		return mgcp_conn_iuup_send_rtp(conn_dst, msg);
 	}
 
 	/* If the data has not been handled/forwarded until here, it will
@@ -1214,25 +1220,6 @@ int mgcp_send(struct mgcp_endpoint *endp, int is_rtp, struct osmo_sockaddr *addr
 			forward_data(rtp_end->rtp.fd, &conn_src->tap_out,
 				     msg);
 
-			/* FIXME: HACK HACK HACK. See OS#2459.
-			 * The ip.access nano3G needs the first RTP payload's first two bytes to read hex
-			 * 'e400', or it will reject the RAB assignment. It seems to not harm other femto
-			 * cells (as long as we patch only the first RTP payload in each stream).
-			 */
-			if (!rtp_state->patched_first_rtp_payload
-			    && conn_src->conn->mode == MGCP_CONN_LOOPBACK) {
-				uint8_t *data = msgb_data(msg) + 12;
-				if (data[0] == 0xe0) {
-					data[0] = 0xe4;
-					data[1] = 0x00;
-					data[2] = 0x09; /* Patch CRC Header to adapt to new header above */
-					rtp_state->patched_first_rtp_payload = true;
-					LOGPENDP(endp, DRTP, LOGL_DEBUG,
-						 "Patching over first two bytes"
-						 " to fake an IuUP Initialization Ack\n");
-				}
-			}
-
 			len = mgcp_udp_send(rtp_end->rtp.fd, &rtp_end->addr, rtp_end->rtp_port,
 					    (char *)msgb_data(msg), msgb_length(msg));
 
@@ -1292,6 +1279,9 @@ int mgcp_dispatch_rtp_bridge_cb(struct msgb *msg)
 	 *  destination connection is known the RTP packet is sent via
 	 *  the destination connection. */
 
+	/* If source is IuUP, we need to handle state, forward it rhough specific bridge: */
+	if (mgcp_conn_rtp_is_iuup(conn_src))
+		return mgcp_conn_iuup_dispatch_rtp(msg);
 
 	 /* Check if the connection is in loopback mode, if yes, just send the
 	 * incoming data back to the origin */

src/libosmo-mgcp/mgcp_protocol.c

@@ -46,6 +46,7 @@
 #include <osmocom/mgcp/mgcp_sdp.h>
 #include <osmocom/mgcp/mgcp_codec.h>
 #include <osmocom/mgcp/mgcp_conn.h>
+#include <osmocom/mgcp/mgcp_iuup.h>
 
 /* Contains the last successfully resolved endpoint name. This variable is used
  * for the unit-tests to verify that the endpoint was correctly resolved. */
@@ -1028,6 +1029,11 @@ mgcp_header_done:
 		rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_CRCX_FAIL_CODEC_NEGOTIATION));
 		goto error2;
 	}
+	/* Upgrade the conn type RTP_DEFAULT->RTP_IUUP if needed based on requested codec: */
+	/* TODO: "codec" probably needs to be moved from endp to conn */
+	if (conn->type == MGCP_RTP_DEFAULT && strcmp(conn->end.codec->subtype_name, "VND.3GPP.IUFP") == 0) {
+		rc = mgcp_conn_iuup_init(conn);
+	}
 
 	conn->end.fmtp_extra = talloc_strdup(trunk->endpoints,
 					     trunk->audio_fmtp_extra);