sdp strs fu

Change-Id: Id8ab7f870067d793a2b8934f2cca51cf06ee5dc2
wip
2025-11-02 13:03:33 +00:00 · 2024-06-24 03:02:22 +02:00 · 2024-06-24 03:02:22 +02:00 · 2024-06-24 03:02:22 +02:00 · 2024-06-24 03:02:22 +02:00 · 2024-06-24 03:02:22 +02:00
83 changed files with 8221 additions and 1659 deletions
--- a/Makefile.am
+++ b/Makefile.am
@@ -24,7 +24,7 @@ pkgconfig_DATA = \
 BUILT_SOURCES = $(top_srcdir)/.version
 EXTRA_DIST = \
 	     .version \
-	     contrib/osmo-mgw.spec.in \
+	     README.md \
 	     debian \
 	     git-version-gen \
 	     osmoappdesc.py \
--- a/24
+++ b/24
@@ -1,24 +0,0 @@
-About OsmoMGW
-=============
-
-OsmoMGW originated from the OpenBSC project, which started as a minimalistic
-all-in-one implementation of the GSM Network. In 2017, OpenBSC had reached
-maturity and diversity (including M3UA SIGTRAN and 3G support in the form of
-IuCS and IuPS interfaces) that naturally lead to a separation of the all-in-one
-approach to fully independent separate programs as in typical GSM networks.
-
-OsmoMGW was one of the parts split off from the old openbsc.git. It originated
-as a solution to merely navigate RTP streams through a NAT, but has since
-matured to a Media Gateway implementation that is capable of streaming RTP for
-2G (AoIP) and 3G (IuCS) GSM networks as well as (still not implemented at time
-of writing) transcoding between TRAU, various RTP payloads and IuUP.
-
-The OsmoMGW program exposes an MGCP interface towards clients like OsmoMSC and
-OsmoBSC, and receives and sends RTP streams as configured via MGCP.
-
-The libosmo-mgcp-client library exposes utilities used by e.g. OsmoMSC (found
-in osmo-msc.git) to instruct OsmoMGW via its MGCP service.
-
-Find OsmoMGW issue tracker and wiki online at
-https://osmocom.org/projects/osmo-mgw
-https://osmocom.org/projects/osmo-mgw/wiki
--- a/README.md
+++ b/README.md
@@ -0,0 +1,102 @@
+osmo-mgw - Osmocom MGW (Media GateWay) Implementation
+=====================================================
+
+This repository contains a C-language implementation of an MGW (Media
+GateWay) for use [not only] within the 2G (GSM) and/or 3G (UMTS)
+Cellular Network built using Osmocom CNI (Cellular Network
+Infrastructure) software.
+
+The OsmoMGW program provides an MGCP interface towards an MGCP call agent
+(client) like OsmoMSC and OsmoBSC, and receives and sends RTP streams as
+configured via the MGCP control plane.
+
+This Media Gateway implementation is capable of
+
+* streaming RTP for 2G (3GPP AoIP and Abis-over-IP)
+* streaming RTP for 3G (IuCS including the IuFP protocol)
+* TDM (E1/T1) based Abis interface with TRAU frames on 16k sub-slots
+* basic support for LCLS (Local Call, Local Switch) related features
+* various built-in translation capabilities
+  * between Abis TRAU frames and RTP formats
+  * between 2G AMR/RTP and 3G AMR/IuFP/RTP
+  * between bandwidth-efficient and octet-aligned AMR
+  * between different standards for encapsulating GSM HR codec frames in RTP
+
+osmo-mgw is typically co-located with
+
+ * osmo-bsc (GSM BSC)
+ * osmo-msc (GSM/UMTS MSC)
+ * osmo-hnbgw (UMTS HNBGW); osmo-mgw implements RTP relay between Iuh
+   and IuCS interfaces
+
+The libosmo-mgcp-client library exposes utilities used by e.g. OsmoMSC
+(found in osmo-msc.git) to instruct OsmoMGW via its MGCP service.
+
+Homepage
+--------
+
+You can find the OsmoMGW issue tracker and wiki online at
+<https://osmocom.org/projects/osmo-mgw> and <https://osmocom.org/projects/osmo-mgw/wiki>.
+
+
+GIT Repository
+--------------
+
+You can clone from the official osmo-mgw.git repository using
+
+        git clone https://gitea.osmocom.org/cellular-infrastructure/osmo-mgw
+
+There is a web interface at <https://gitea.osmocom.org/cellular-infrastructure/osmo-mgw>
+
+
+Documentation
+-------------
+
+User Manuals and VTY reference manuals are [optionally] built in PDF form
+as part of the build process.
+
+Pre-rendered PDF version of the current "master" can be found at
+[User Manual](https://ftp.osmocom.org/docs/latest/osmomgw-usermanual.pdf)
+as well as the [VTY Reference Manual](https://ftp.osmocom.org/docs/latest/osmomgw-vty-reference.pdf)
+
+
+Mailing List
+------------
+
+Discussions related to osmo-mgw are happening on the
+openbsc@lists.osmocom.org mailing list, please see
+<https://lists.osmocom.org/mailman/listinfo/openbsc> for subscription
+options and the list archive.
+
+Please observe the [Osmocom Mailing List
+Rules](https://osmocom.org/projects/cellular-infrastructure/wiki/Mailing_List_Rules)
+when posting.
+
+
+Contributing
+------------
+
+Our coding standards are described at
+<https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards>
+
+We use a gerrit based patch submission/review process for managing
+contributions.  Please see
+<https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit> for
+more details
+
+The current patch queue for osmo-mgw can be seen at
+<https://gerrit.osmocom.org/#/q/project:osmo-mgw+status:open>
+
+
+History
+-------
+
+OsmoMGW originated from the OpenBSC project, which started as a minimalistic
+all-in-one implementation of the GSM Network. In 2017, OpenBSC had reached
+maturity and diversity (including M3UA SIGTRAN and 3G support in the form of
+IuCS and IuPS interfaces) that naturally lead to a separation of the all-in-one
+approach to fully independent separate programs as in typical GSM networks.
+
+OsmoMGW was one of the parts split off from the old openbsc.git. It originated
+as a solution to merely navigate RTP streams through a NAT, but has since
+matured.
--- a/17
+++ b/17
@@ -24,3 +24,20 @@
 # If any interfaces have been removed or changed since the last public release, a=0.
 #
 #library		what		description / commit summary line
+libosmo-mgcp-client	remove public API	These public API items have not been called by any of our osmo-programs
+						for many years. Any sane caller of libosmo-mgcp-client should use the
+						higher level osmo_mgcpc_* API instead. Move these to a private header:
+						struct mgcp_response_head
+						struct mgcp_response
+						struct mgcp_msg
+						mgcp_response_parse_params()
+						mgcp_client_tx()
+						mgcp_client_cancel()
+						mgcp_msg_gen()
+						mgcp_msg_trans_id()
+libosmo-mgcp-client	deprecate public API	New code should no longer use codecs[], instead use ptmap[].codec. There
+						is backwards compat code that moves codecs[] entries, if any, over to
+						ptmap[], so callers may migrate at own leisure.
+osmo-mgw		remove cfg		Remove VTY config item 'sdp audio fmtp-extra' (see OS#6313)
+libosmocore		bump_dep; workaround	Bump libosmocore version dependency after I68328adb952ca8833ba047cb3b49ccc6f8a1f1b5
+						has been merged to libosmocore.git; then remove my_msgb_copy_c wrapper function.
--- a/configure.ac
+++ b/configure.ac
@@ -44,15 +44,16 @@ AC_SEARCH_LIBS([dlsym], [dl dld], [LIBRARY_DLSYM="$LIBS";LIBS=""])
 AC_SUBST(LIBRARY_DLSYM)


-PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOCTRL, libosmoctrl >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMONETIF, libosmo-netif >= 1.3.0)
-PKG_CHECK_MODULES(LIBOSMOABIS, libosmoabis >= 1.4.0)
-PKG_CHECK_MODULES(LIBOSMOTRAU, libosmotrau >= 1.4.0)
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 1.9.0)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm >= 1.9.0)
+PKG_CHECK_MODULES(LIBOSMOCTRL, libosmoctrl >= 1.9.0)
+PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 1.9.0)
+PKG_CHECK_MODULES(LIBOSMONETIF, libosmo-netif >= 1.4.0)
+PKG_CHECK_MODULES(LIBOSMOABIS, libosmoabis >= 1.5.0)
+PKG_CHECK_MODULES(LIBOSMOTRAU, libosmotrau >= 1.5.0)

-CFLAGS="$CFLAGS -pthread"
+CFLAGS="$CFLAGS -DBUILDING_LIBOSMOMGCPCLIENT -pthread"
+CPPFLAGS="$CPPFLAGS -DBUILDING_LIBOSMOMGCPCLIENT -pthread"
 LDFLAGS="$LDFLAGS -pthread"

 AC_ARG_ENABLE(sanitize,
@@ -188,9 +189,11 @@ AC_OUTPUT(
    libosmo-mgcp-client.pc
    include/Makefile
    include/osmocom/Makefile
+    include/osmocom/sdp/Makefile
    include/osmocom/mgcp_client/Makefile
    include/osmocom/mgcp/Makefile
    src/Makefile
+    src/libosmo-sdp/Makefile
    src/libosmo-mgcp-client/Makefile
    src/libosmo-mgcp/Makefile
    src/osmo-mgw/Makefile
@@ -198,10 +201,10 @@ AC_OUTPUT(
    tests/atlocal
    tests/mgcp_client/Makefile
    tests/mgcp/Makefile
+    tests/sdp/Makefile
    doc/Makefile
    doc/examples/Makefile
    doc/manuals/Makefile
    contrib/Makefile
    contrib/systemd/Makefile
-    contrib/osmo-mgw.spec
    Makefile)
--- a/contrib/osmo-mgw.spec.in
+++ b/contrib/osmo-mgw.spec.in
@@ -1,137 +0,0 @@
-#
-# spec file for package osmo-mgw
-#
-# Copyright (c) 2017, Martin Hauke <mardnh@gmx.de>
-#
-# All modifications and additions to the file contributed by third parties
-# remain the property of their copyright owners, unless otherwise agreed
-# upon. The license for this file, and modifications and additions to the
-# file, is the same license as for the pristine package itself (unless the
-# license for the pristine package is not an Open Source License, in which
-# case the license is the MIT License). An "Open Source License" is a
-# license that conforms to the Open Source Definition (Version 1.9)
-# published by the Open Source Initiative.
-
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
-#
-
-Name:           osmo-mgw
-Version:        @VERSION@
-Release:        0
-Summary:        Osmocom's Media Gateway for 2G and 3G circuit-switched mobile networks
-License:        AGPL-3.0-or-later AND GPL-2.0-or-later
-Group:          Hardware/Mobile
-URL:            https://osmocom.org/projects/osmo-mgw
-Source:         %{name}-%{version}.tar.xz
-BuildRequires:  automake >= 1.9
-BuildRequires:  libtool >= 2
-BuildRequires:  pkgconfig >= 0.20
-%if 0%{?suse_version}
-BuildRequires:  systemd-rpm-macros
-%endif
-BuildRequires:  pkgconfig(libosmo-netif) >= 1.3.0
-BuildRequires:  pkgconfig(libosmocore) >= 1.8.0
-BuildRequires:  pkgconfig(libosmoctrl) >= 1.8.0
-BuildRequires:  pkgconfig(libosmogsm) >= 1.8.0
-BuildRequires:  pkgconfig(libosmovty) >= 1.8.0
-BuildRequires:  pkgconfig(libosmocoding) >= 1.8.0
-BuildRequires:  pkgconfig(libosmoabis) >= 1.4.0
-BuildRequires:  pkgconfig(libosmotrau) >= 1.4.0
-%{?systemd_requires}
-
-%description
-OsmoMGW is Osmocom's Media Gateway for 2G and 3G circuit-switched mobile networks.
-
-%package -n libosmo-mgcp-client11
-Summary:        Osmocom's Media Gateway Control Protocol client library
-Group:          System/Libraries
-
-%description -n libosmo-mgcp-client11
-Osmocom's Media Gateway Control Protocol client library.
-
-%package -n libosmo-mgcp-client-devel
-Summary:        Development files for Osmocom's Media Gateway Control Protocol client library
-Group:          Development/Libraries/C and C++
-Requires:       libosmo-mgcp-client11 = %{version}
-
-%description -n libosmo-mgcp-client-devel
-Osmocom's Media Gateway Control Protocol client librarary.
-
-This subpackage contains libraries and header files for developing
-applications that want to make use of libosmo-mgcp-client.
-
-%package -n libosmo-mgcp-devel
-Summary:        Development files for Osmocom's Media Gateway server library
-Group:          Development/Libraries/C and C++
-
-%description -n libosmo-mgcp-devel
-Osmocom's Media Gateway Control Protocol server library.
-
-This subpackage contains libraries and header files for developing
-applications that want to make use of libosmo-mgcp.
-
-%prep
-%setup -q
-
-%build
-echo "%{version}" >.tarball-version
-autoreconf -fi
-%configure \
-  --disable-static \
-  --docdir=%{_docdir}/%{name} \
-  --with-systemdsystemunitdir=%{_unitdir}
-
-make %{?_smp_mflags}
-
-%install
-%make_install
-find %{buildroot} -type f -name "*.la" -delete -print
-
-%check
-make %{?_smp_mflags} check || (find . -name testsuite.log -exec cat {} +)
-
-%post   -n libosmo-mgcp-client11 -p /sbin/ldconfig
-%postun -n libosmo-mgcp-client11 -p /sbin/ldconfig
-
-%if 0%{?suse_version}
-%preun
-%service_del_preun osmo-mgw.service
-
-%postun
-%service_del_postun osmo-mgw.service
-
-%pre
-%service_add_pre osmo-mgw.service
-
-%post
-%service_add_post osmo-mgw.service
-%endif
-
-%files
-%license COPYING
-%doc AUTHORS README
-%dir %{_docdir}/%{name}/examples
-%dir %{_docdir}/%{name}/examples/osmo-mgw
-%{_docdir}/%{name}/examples/osmo-mgw/osmo-mgw.cfg
-%{_docdir}/%{name}/examples/osmo-mgw/osmo-mgw-abis_e1.cfg
-%{_bindir}/osmo-mgw
-%{_unitdir}/osmo-mgw.service
-%dir %{_sysconfdir}/osmocom
-%config(noreplace) %{_sysconfdir}/osmocom/osmo-mgw.cfg
-
-%files -n libosmo-mgcp-client11
-%{_libdir}/libosmo-mgcp-client.so.11*
-
-%files -n libosmo-mgcp-client-devel
-%{_libdir}/libosmo-mgcp-client.so
-%{_libdir}/pkgconfig/libosmo-mgcp-client.pc
-%dir %{_includedir}/osmocom
-%dir %{_includedir}/osmocom/mgcp_client
-%{_includedir}/osmocom/mgcp_client/*.h
-
-%files -n libosmo-mgcp-devel
-%dir %{_includedir}/osmocom
-%dir %{_includedir}/osmocom/mgcp
-%{_includedir}/osmocom/mgcp/*.h
-
-%changelog
--- a/contrib/systemd/osmo-mgw.service
+++ b/contrib/systemd/osmo-mgw.service
@@ -1,13 +1,19 @@
 [Unit]
 Description=Osmocom Media Gateway (MGW)
+After=network-online.target
+Wants=network-online.target

 [Service]
 Type=simple
+LimitNOFILE=65536
 StateDirectory=osmocom
 WorkingDirectory=%S/osmocom
 Restart=always
+User=osmocom
+Group=osmocom
 ExecStart=/usr/bin/osmo-mgw -s -c /etc/osmocom/osmo-mgw.cfg
 RestartSec=2
+AmbientCapabilities=CAP_SYS_NICE
 # CPU scheduling policy:
 CPUSchedulingPolicy=rr
 # For real-time scheduling policies an integer between 1 (lowest priority) and 99 (highest priority):
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,83 @@
+osmo-mgw (1.12.1) unstable; urgency=medium
+
+  [ Pau Espin Pedrol ]
+  * mgcp-client: Fix missing include in mgcp_client_pool.h
+  * mgcp-client: Introduce API osmo_mgcpc_ep_local_name()
+  * mgw: Configure IuUP if codec set during MDCX
+
+ -- Oliver Smith <osmith@sysmocom.de>  Thu, 28 Sep 2023 15:58:17 +0200
+
+osmo-mgw (1.12.0) unstable; urgency=medium
+
+  [ Philipp Maier ]
+  * mgcp_sdp: add spec reference
+  * mgcp_sdp: cosmetic: remove newline
+  * mgcp_endp: cosmetic move mgcp_endp_release to the end
+  * mgcp_endp: cosmetic: remove unnecessary new line
+  * mgcp_e1: fix log output
+  * mgcp_e1: be more frugal withe E1 line resources
+  * mgcp_client: fix sourcecode formatting
+  * mgcp_e1: fix typo
+  * mgcp_e1: rewrite comment
+  * mgcp_e1: rename e1_send to e1_send_ts_frame
+  * mgcp_e1: cosmetic: rewrite comment
+  * Revert "mgcp_codec: do not differentiate between oa and bwe when comparing codec"
+  * mgcp_codec: fix oa/bwe comparison in mgcp_codec_pt_translate()
+  * mgcp_codec: refactor payload type converstion
+  * mgcp_codec: cosmetic: remove line break in api-doc
+  * mgcp_network: fix apidoc
+  * mgcp_vty: add warnings for deprecated config options
+  * mgcp_codec: move mgcp_codec_decide down
+  * mgcp_codec: fix codec decision
+  * mgcp_network: do not deliver RTP packets with unpatched PT
+  * mgcp_codec: be sensitive about IuFP when checking codecs
+  * mgcp_client.h: also add spec ref to the other 3gpp defined payload types
+
+  [ Harald Welte ]
+  * cosmetic: Fix grammar suggesting reading _the_ user manual
+
+  [ arehbein ]
+  * Transition to use of 'telnet_init_default'
+
+  [ Oliver Smith ]
+  * mgcp_client: mgcp_msg_gen: add more error logs
+  * mgcp_client_pool: add mgcp_client_pool_empty()
+  * Cosmetic: mgcp_client: fix typo
+  * debian: set compat level to 10
+  * systemd: depend on networking-online.target
+  * Cosmetic: fix a typo
+  * mgcp_client: check rc of map_str_to_codec
+
+  [ Pau Espin Pedrol ]
+  * mgcp_network: Unregister osmo_fd before closing fd
+  * mgcp-client: Call osmo_fd_unregister() before closing and changing bfd->fd
+  * mgcp-client: Drop unused struct mgcp_client field
+  * mgcp_client: Introduce mgcp_client_conf_alloc(), deprecate mgcp_client_conf_init()
+  * mgcp-client: Move some static functions further above
+  * mgw: Allow auditing speciall 'null' endpoint
+  * mgcp-client: Add keepalive feature
+  * mgcp_client: pool: Only pick clients with an MGCP link considered to be UP
+  * mgcp-client: Always mark client as UP if keepalive request-interval disabled
+  * mgcp-client: Mark client as UP when keepalive request-interval/timeout is disabled through VTY
+
+  [ Vadim Yanitskiy ]
+  * */Makefile.am: libraries shall not be in AM_LDFLAGS
+  * tests: use -no-install libtool flag to avoid ./lt-* scripts
+  * tests: $(BUILT_SOURCES) is not defined, depend on osmo-mgw
+  * copyright: fix typo: sysmocom s/s.m.f.c./s.f.m.c./ GmbH
+
+  [ Neels Hofmeyr ]
+  * mgcp_find_section_end(): skip spaces at start of SDP
+  * mgcp_client: simpler error handling
+  * mgcp: fix "L: a:" header parsing: heed ";" separator
+  * mgcp_client: tweak extract_codec_name() implementation
+
+  [ Andreas Eversberg ]
+  * ASCI: Add new mode for voice group/broadcast call
+  * ASCI: Support conference briding with 1..n connections
+
+ -- Pau Espin Pedrol <pespin@sysmocom.de>  Tue, 12 Sep 2023 14:48:51 +0200
+
 osmo-mgw (1.11.0) unstable; urgency=medium

  [ Pau Espin Pedrol ]
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-9
+10
--- a/debian/control
+++ b/debian/control
@@ -2,14 +2,14 @@ Source: osmo-mgw
 Section: net
 Priority: extra
 Maintainer: Osmocom team <openbsc@lists.osmocom.org>
-Build-Depends: debhelper (>=9),
+Build-Depends: debhelper (>= 10),
               dh-autoreconf,
               pkg-config,
               autotools-dev,
-               libosmocore-dev (>= 1.8.0),
-               libosmo-netif-dev (>= 1.3.0),
-               libosmo-abis-dev (>= 1.4.0),
-               osmo-gsm-manuals-dev (>= 1.4.0)
+               libosmocore-dev (>= 1.9.0),
+               libosmo-netif-dev (>= 1.4.0),
+               libosmo-abis-dev (>= 1.5.0),
+               osmo-gsm-manuals-dev (>= 1.5.0)
 Standards-Version: 3.9.8
 Vcs-Git: https://gitea.osmocom.org/cellular-infrastructure/osmo-mgw
 Vcs-Browser: https://gitea.osmocom.org/cellular-infrastructure/osmo-mgw
@@ -21,7 +21,7 @@ Multi-Arch: foreign
 Depends: ${misc:Depends}, ${shlibs:Depends}
 Description: OsmoMGW: Osmocom's Media Gateway for 2G and 3G circuit-switched mobile networks

-Package: libosmo-mgcp-client11
+Package: libosmo-mgcp-client12
 Section: libs
 Architecture: any
 Multi-Arch: same
@@ -33,7 +33,7 @@ Package: libosmo-mgcp-client-dev
 Section: libdevel
 Architecture: any
 Multi-Arch: same
-Depends: libosmo-mgcp-client11 (= ${binary:Version}), ${misc:Depends}
+Depends: libosmo-mgcp-client12 (= ${binary:Version}), ${misc:Depends}
 Description: libosmo-mgcp-client: Osmocom's Media Gateway Control Protocol client utilities

 Package: osmo-mgw-doc
--- a/debian/copyright
+++ b/debian/copyright
@@ -6,7 +6,7 @@ Files:     *
 Copyright: 2009-2014 On-Waves
           2009-2015 Holger Hans Peter Freyther <zecke@selfish.org>
           2013 Jacob Erlbeck <jerlbeck@sysmocom.de>
-           2016-2017 sysmocom s.m.f.c. GmbH <info@sysmocom.de>
+           2016-2017 sysmocom s.f.m.c. GmbH <info@sysmocom.de>
 License:   AGPL-3.0+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU Affero General Public License as published by
@@ -22,7 +22,7 @@ License:   AGPL-3.0+
 along with this program.  If not, see <http://www.gnu.org/licenses/>.

 Files:     src/libosmo-mgcp-client/* include/osmocom/mgcp_client/*
-Copyright: 2016 by sysmocom s.m.f.c. GmbH <info@sysmocom.de>
+Copyright: 2016 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
           Based on OpenBSC interface to quagga VTY (libmsc/vty_interface_layer3.c)
           2009 by Harald Welte <laforge@gnumonks.org>
           2009-2011 by Holger Hans Peter Freyther
--- a/debian/libosmo-mgcp-client12.install
+++ b/debian/libosmo-mgcp-client12.install
--- a/debian/postinst
+++ b/debian/postinst
@@ -0,0 +1,38 @@
+#!/bin/sh -e
+case "$1" in
+	configure)
+		# Create the osmocom group and user (if it doesn't exist yet)
+		if ! getent group osmocom >/dev/null; then
+			groupadd --system osmocom
+		fi
+		if ! getent passwd osmocom >/dev/null; then
+			useradd \
+				--system \
+				--gid osmocom \
+				--home-dir /var/lib/osmocom \
+				--shell /sbin/nologin \
+				--comment "Open Source Mobile Communications" \
+				osmocom
+		fi
+
+		# Fix permissions of previous (root-owned) install (OS#4107)
+		if dpkg --compare-versions "$2" le "1.13.0"; then
+			if [ -e /etc/osmocom/osmo-mgw.cfg ]; then
+				chown -v osmocom:osmocom /etc/osmocom/osmo-mgw.cfg
+				chmod -v 0660 /etc/osmocom/osmo-mgw.cfg
+			fi
+
+			if [ -d /etc/osmocom ]; then
+				chown -v root:osmocom /etc/osmocom
+				chmod -v 2775 /etc/osmocom
+			fi
+
+			mkdir -p /var/lib/osmocom
+			chown -R -v osmocom:osmocom /var/lib/osmocom
+		fi
+		;;
+esac
+
+# dh_installdeb(1) will replace this with shell code automatically
+# generated by other debhelper scripts.
+#DEBHELPER#
--- a/doc/examples/osmo-mgw/osmo-mgw-abis_e1.cfg
+++ b/doc/examples/osmo-mgw/osmo-mgw-abis_e1.cfg
@@ -1,20 +1,25 @@
 !
 ! MGCP configuration example
 !
+log stderr
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+
 e1_input
 e1_line 0 driver dahdi
 e1_line 0 port 0
 mgcp
  bind ip 127.0.0.1
-  rtp port-range 4002 16000
+  rtp port-range 4002 16001
  rtp bind-ip 127.0.0.1
  rtp ip-probing
  rtp ip-dscp 46
  bind port 2427
-  sdp audio payload number 98
-  sdp audio payload name GSM
  number endpoints 512
-  loop 0
  force-realloc 1
  rtcp-omit
  rtp-patch ssrc
--- a/doc/examples/osmo-mgw/osmo-mgw.cfg
+++ b/doc/examples/osmo-mgw/osmo-mgw.cfg
@@ -1,17 +1,22 @@
 !
 ! MGCP configuration example
 !
+log stderr
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+
 mgcp
  bind ip 127.0.0.1
-  rtp port-range 4002 16000
+  rtp port-range 4002 16001
  rtp bind-ip 127.0.0.1
  rtp ip-probing
  rtp ip-dscp 46
  bind port 2427
-  sdp audio payload number 98
-  sdp audio payload name GSM
  number endpoints 512
-  loop 0
  force-realloc 1
  rtcp-omit
  rtp-patch ssrc
--- a/doc/manuals/chapters/mgcp_endpoints.adoc
+++ b/doc/manuals/chapters/mgcp_endpoints.adoc
@@ -91,4 +91,10 @@ encoding/decoding for 16K and 8K subslots. Endpoints with other bitrates are
 not yet useable.

 NOTE: the VTY command "show mgcp" can be used to get a list of all available
-endpoints (including identifiers)
+endpoints (including identifiers)
+
+=== The `null` endpoint
+
+OsmoMGW offers a special `null@<domain>` endpoint which can be audited at all times.
+This is useful for MGCP clients who wish to submit requests to OsmoMGW
+periodically to find out whether it is still reachable and in a working state.
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -23,3 +23,20 @@ arguments:
 	Disable colors for logging to stderr. This has mostly been
 	deprecated by VTY based logging configuration, see <<logging>>
 	for more information.
+
+
+=== Configure limits
+
+When servicing hundreds of media endpoints, it may be necessary to adjust the
+operating system's limit on open file descriptors for the osmo-mgw process. A
+typical default limit imposed by operating systems is 1024; this would be
+exceeded by, for example, about 256 active voice calls with 4 RTP/RTPC ports
+each, sockets for other interfaces not considered yet.
+
+It should be ok to set an OS limit on open file descriptors as high as 65536
+for osmo-mgw, which practically rules out failure from running out of file
+descriptors anywhere (<16,000 active calls).
+
+When using systemd, the file descriptor limit may be adjusted in the service
+file by the `LimitNOFILE` setting ("Number of Open FILE descriptors"). OsmoMGW
+ships a systemd service file with a high LimitNOFILE setting.
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -3,10 +3,19 @@ SUBDIRS = \
 	$(NULL)

 nobase_include_HEADERS = \
+	osmocom/mgcp_client/defs.h \
 	osmocom/mgcp_client/mgcp_client.h \
 	osmocom/mgcp_client/mgcp_client_endpoint_fsm.h \
 	osmocom/mgcp_client/mgcp_client_fsm.h \
 	osmocom/mgcp_client/mgcp_client_pool.h \
+	osmocom/sdp/fmtp.h \
+	osmocom/sdp/sdp_codec.h \
+	osmocom/sdp/sdp_codec_list.h \
+	osmocom/sdp/sdp_msg.h \
+	osmocom/sdp/sdp_strings.h \
+	$(NULL)
+
+noinst_HEADERS = \
 	osmocom/mgcp/mgcp.h \
 	osmocom/mgcp/mgcp_common.h \
 	osmocom/mgcp/osmux.h \
--- a/include/osmocom/Makefile.am
+++ b/include/osmocom/Makefile.am
@@ -1,4 +1,5 @@
 SUBDIRS = \
+	sdp \
 	mgcp_client \
 	mgcp \
 	$(NULL)
--- a/include/osmocom/mgcp/mgcp.h
+++ b/include/osmocom/mgcp/mgcp.h
@@ -24,6 +24,7 @@

 #include <osmocom/core/msgb.h>
 #include <osmocom/core/socket.h>
+#include <osmocom/core/osmo_io.h>
 #include <osmocom/core/write_queue.h>
 #include <osmocom/core/timer.h>
 #include <osmocom/core/logging.h>
@@ -70,12 +71,10 @@ typedef int (*mgcp_rqnt)(struct mgcp_endpoint *endp, char tone);
 /**
 * Return:
 *   <  0 in case no audio was processed
- *   >= 0 in case audio was processed. The remaining payload
- *   length will be returned.
+ *   >= 0 in case audio was processed.
 */
 typedef int (*mgcp_processing)(struct mgcp_endpoint *endp,
-			       struct mgcp_rtp_end *dst_end,
-			       char *data, int *len, int buf_size);
+			       struct mgcp_rtp_end *dst_end, struct msgb *msg);

 struct mgcp_conn_rtp;

@@ -138,8 +137,6 @@ struct mgcp_config {
 	mgcp_processing rtp_processing_cb;
 	mgcp_processing_setup setup_rtp_processing_cb;

-	mgcp_get_format get_net_downlink_format_cb;
-
 	struct osmo_wqueue gw_fd;

 	struct mgcp_port_range net_ports;
@@ -208,6 +205,5 @@ int mgcp_send_reset_ep(struct mgcp_endpoint *endp);
 int mgcp_send_reset_all(struct mgcp_config *cfg);


-int mgcp_create_bind(const char *source_addr, struct osmo_fd *fd, int port, uint8_t dscp,
-		     uint8_t prio);
-int mgcp_udp_send(int fd, const struct osmo_sockaddr *addr, const char *buf, int len);
+int mgcp_create_bind(const char *source_addr, int port, uint8_t dscp, uint8_t prio);
+int mgcp_udp_send(struct osmo_io_fd *iofd, const struct osmo_sockaddr *addr, const char *buf, int len);
--- a/include/osmocom/mgcp/mgcp_codec.h
+++ b/include/osmocom/mgcp/mgcp_codec.h
@@ -13,8 +13,8 @@ struct mgcp_conn_rtp;
 void mgcp_codec_summary(struct mgcp_conn_rtp *conn);
 void mgcp_codec_reset_all(struct mgcp_conn_rtp *conn);
 int mgcp_codec_add(struct mgcp_conn_rtp *conn, int payload_type, const char *audio_name, const struct mgcp_codec_param *param);
-int mgcp_codec_decide(struct mgcp_conn_rtp *conn);
-struct mgcp_rtp_codec *mgcp_codec_find_convertible(struct mgcp_conn_rtp *conn, struct mgcp_rtp_codec *codec);
+int mgcp_codec_add2(struct mgcp_conn_rtp *conn, int payload_type, const char *audio_name, const char *fmtp);
+int mgcp_codec_decide(struct mgcp_conn_rtp *conn_src, struct mgcp_conn_rtp *conn_dst);
 const struct mgcp_rtp_codec *mgcp_codec_pt_find_by_subtype_name(struct mgcp_conn_rtp *conn,
 								const char *subtype_name, unsigned int match_nr);
 bool mgcp_codec_amr_align_mode_is_indicated(const struct mgcp_rtp_codec *codec);
--- a/include/osmocom/mgcp/mgcp_common.h
+++ b/include/osmocom/mgcp/mgcp_common.h
@@ -47,6 +47,7 @@ enum mgcp_connection_mode {
 	MGCP_CONN_SEND_ONLY = 2,
 	MGCP_CONN_RECV_SEND = MGCP_CONN_RECV_ONLY | MGCP_CONN_SEND_ONLY,
 	MGCP_CONN_LOOPBACK  = 4 | MGCP_CONN_RECV_SEND,
+	MGCP_CONN_CONFECHO  = 8 | MGCP_CONN_RECV_SEND,
 };

 #define MGCP_X_OSMO_IGN_HEADER "X-Osmo-IGN:"
@@ -58,7 +59,7 @@ enum mgcp_x_osmo_ign {
 	MGCP_X_OSMO_IGN_CALLID = 1,
 };

-/* Codec parameters (communicated via SDP/fmtp) */
+/* Deprecated. Use the new fmtp string instead. */
 struct mgcp_codec_param {
 	bool amr_octet_aligned_present;
 	bool amr_octet_aligned;
@@ -67,11 +68,11 @@ struct mgcp_codec_param {
 /* Ensure that the msg->l2h is NUL terminated. */
 static inline int mgcp_msg_terminate_nul(struct msgb *msg)
 {
-	unsigned char *tail = msg->l2h + msgb_l2len(msg); /* char after l2 data */
+	unsigned char *tail = msg->tail; /* char after l2 data */
 	if (tail[-1] == '\0')
 		/* nothing to do */;
 	else if (msgb_tailroom(msg) > 0)
-		tail[0] = '\0';
+		msgb_put_u8(msg, (uint8_t)'\0');
 	else if (tail[-1] == '\r' || tail[-1] == '\n')
 		tail[-1] = '\0';
 	else {
--- a/include/osmocom/mgcp/mgcp_conn.h
+++ b/include/osmocom/mgcp/mgcp_conn.h
@@ -49,6 +49,11 @@ enum mgcp_conn_rtp_type {
 	MGCP_RTP_OSMUX,
 	MGCP_RTP_IUUP,
 };
+extern const struct value_string mgcp_conn_rtp_type_names[];
+static inline const char *mgcp_conn_rtp_type_name(enum mgcp_conn_rtp_type val)
+{
+	return get_value_string(mgcp_conn_rtp_type_names, val);
+}

 /*! Connection type, specifies which member of the union "u" in mgcp_conn
 *  contains a useful connection description (currently only RTP) */
--- a/include/osmocom/mgcp/mgcp_endp.h
+++ b/include/osmocom/mgcp/mgcp_endp.h
@@ -133,6 +133,7 @@ struct mgcp_endpoint *mgcp_endp_alloc(struct mgcp_trunk *trunk, unsigned int ind
 int mgcp_endp_claim(struct mgcp_endpoint *endp, const char *callid);
 void mgcp_endp_update(struct mgcp_endpoint *endp);
 bool mgcp_endp_is_wildcarded(const char *epname);
+bool mgcp_endp_is_null(const char *epname);
 struct mgcp_endpoint *mgcp_endp_by_name_trunk(int *cause, const char *epname,
 					      const struct mgcp_trunk *trunk);
 struct mgcp_endpoint *mgcp_endp_by_name(int *cause, const char *epname,
--- a/include/osmocom/mgcp/mgcp_network.h
+++ b/include/osmocom/mgcp/mgcp_network.h
@@ -4,6 +4,7 @@
 #include <stdbool.h>

 #include <osmocom/core/socket.h>
+#include <osmocom/core/osmo_io.h>

 #include <osmocom/mgcp/mgcp.h>

@@ -83,8 +84,11 @@ struct mgcp_rtp_codec {
 	char audio_name[64];
 	char subtype_name[64];

+	/* Deprecated. Use the new fmtp string instead. */
 	bool param_present;
 	struct mgcp_codec_param param;
+
+	char fmtp[256];
 };

 /* 'mgcp_rtp_end': basically a wrapper around the RTP+RTCP ports */
@@ -108,7 +112,6 @@ struct mgcp_rtp_end {
 	int  frames_per_packet;
 	uint32_t packet_duration_ms;
 	int maximum_packet_time; /* -1: not set */
-	char *fmtp_extra;
 	/* are we transmitting packets (true) or dropping (false) outbound packets */
 	bool output_enabled;
 	/* FIXME: This parameter can be set + printed, but is nowhere used! */
@@ -121,8 +124,8 @@ struct mgcp_rtp_end {
 	bool rfc5993_hr_convert;

 	/* Each end has a separate socket for RTP and RTCP */
-	struct osmo_fd rtp;
-	struct osmo_fd rtcp;
+	struct osmo_io_fd *rtp;
+	struct osmo_io_fd *rtcp;

 	/* local UDP port number of the RTP socket; RTCP is +1 */
 	int local_port;
@@ -160,8 +163,7 @@ void mgcp_patch_and_count(const struct mgcp_endpoint *endp,
 int mgcp_get_local_addr(char *addr, struct mgcp_conn_rtp *conn);

 /* payload processing default functions */
-int mgcp_rtp_processing_default(struct mgcp_endpoint *endp, struct mgcp_rtp_end *dst_end,
-				char *data, int *len, int buf_size);
+int mgcp_rtp_processing_default(struct mgcp_endpoint *endp, struct mgcp_rtp_end *dst_end, struct msgb *msg);

 int mgcp_setup_rtp_processing_default(struct mgcp_endpoint *endp,
 				      struct mgcp_conn_rtp *conn_dst,
@@ -181,7 +183,7 @@ void rtpconn_rate_ctr_add(struct mgcp_conn_rtp *conn_rtp, struct mgcp_endpoint *
 				 int id, int inc);
 void rtpconn_rate_ctr_inc(struct mgcp_conn_rtp *conn_rtp, struct mgcp_endpoint *endp,
 				 int id);
-void forward_data_tap(int fd, struct mgcp_rtp_tap *tap, struct msgb *msg);
+void forward_data_tap(struct osmo_io_fd *iofd, struct mgcp_rtp_tap *tap, struct msgb *msg);
 uint32_t mgcp_get_current_ts(unsigned codec_rate);

 int amr_oa_bwe_convert(struct mgcp_endpoint *endp, struct msgb *msg, bool target_is_oa);
--- a/include/osmocom/mgcp/mgcp_trunk.h
+++ b/include/osmocom/mgcp/mgcp_trunk.h
@@ -27,12 +27,9 @@ struct mgcp_trunk {
 	unsigned int trunk_nr;
 	enum mgcp_trunk_type trunk_type;

-	char *audio_fmtp_extra;
 	int audio_send_ptime;
 	int audio_send_name;

-	int no_audio_transcoding;
-
 	int omit_rtcp;
 	int keepalive_interval;

--- a/include/osmocom/mgcp_client/defs.h
+++ b/include/osmocom/mgcp_client/defs.h
@@ -0,0 +1,7 @@
+#include <osmocom/core/defs.h>
+
+#if BUILDING_LIBOSMOMGCPCLIENT
+# define OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT(text)
+#else
+# define OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT(text) OSMO_DEPRECATED(text)
+#endif
--- a/include/osmocom/mgcp_client/mgcp_client.h
+++ b/include/osmocom/mgcp_client/mgcp_client.h
@@ -3,6 +3,7 @@
 #include <stdint.h>
 #include <arpa/inet.h>

+#include <osmocom/mgcp_client/defs.h>
 #include <osmocom/mgcp_client/mgcp_common.h>

 /* See also: RFC 3435, chapter 3.5 Transmission over UDP */
@@ -10,7 +11,7 @@
 #define MGCP_CLIENT_LOCAL_PORT_DEFAULT 0
 #define MGCP_CLIENT_REMOTE_ADDR_DEFAULT "127.0.0.1"
 #define MGCP_CLIENT_REMOTE_PORT_DEFAULT 2427
-
+#define MGCP_CLIENT_KEEPALIVE_DEFAULT_ENDP "null"
 #define MGCP_CLIENT_MGW_STR "Configure MGCP connection to Media Gateway\n"

 struct msgb;
@@ -35,6 +36,12 @@ struct mgcp_client_conf {

 	/* human readable name / description */
 	char *description;
+
+	struct {
+		uint32_t timeout_sec;
+		uint32_t req_interval_sec;
+		char req_endpoint_name[MGCP_ENDPOINT_MAXLEN];
+	} keepalive;
 };

 typedef unsigned int mgcp_trans_id_t;
@@ -45,12 +52,12 @@ enum mgcp_codecs {
 	CODEC_GSM_8000_1 = 3,
 	CODEC_PCMA_8000_1 = 8,
 	CODEC_G729_8000_1 = 18,
-	CODEC_GSMEFR_8000_1 = 110,
-	CODEC_GSMHR_8000_1 = 111,
-	CODEC_AMR_8000_1 = 112,
-	CODEC_AMRWB_16000_1 = 113,
+	CODEC_GSMEFR_8000_1 = 110,	/* 3GPP TS 48.103 table 5.4.2.2.1 */
+	CODEC_GSMHR_8000_1 = 111,	/* 3GPP TS 48.103 table 5.4.2.2.1 */
+	CODEC_AMR_8000_1 = 112,		/* 3GPP TS 48.103 table 5.4.2.2.1 */
+	CODEC_AMRWB_16000_1 = 113,	/* 3GPP TS 48.103 table 5.4.2.2.1 */
 	CODEC_IUFP = 96,
-	CODEC_CLEARMODE = 120, /* 3GPP TS 48.103 table 5.4.2.2.1 */
+	CODEC_CLEARMODE = 120,		/* 3GPP TS 48.103 table 5.4.2.2.1 */
 };
 /* Note: when new codec types are added, the corresponding value strings
 * in mgcp_client.c (codec_table) must be updated as well. Enumerations
@@ -70,29 +77,12 @@ struct ptmap {

 	/*! payload type number (96-127) */
 	unsigned int pt;
+
+	/*! the MGCP 'a=fmtp:N <...>' string, e.g. "mode-set=1,2,3;octet-align=0". */
+	char fmtp[256];
 };

-struct mgcp_response_head {
-	int response_code;
-	mgcp_trans_id_t trans_id;
-	char comment[MGCP_COMMENT_MAXLEN];
-	char conn_id[MGCP_CONN_ID_MAXLEN];
-	char endpoint[MGCP_ENDPOINT_MAXLEN];
-	bool x_osmo_osmux_use;
-	uint8_t x_osmo_osmux_cid;
-};
-
-struct mgcp_response {
-	char *body;
-	struct mgcp_response_head head;
-	uint16_t audio_port;
-	char audio_ip[INET6_ADDRSTRLEN];
-	unsigned int ptime;
-	enum mgcp_codecs codecs[MGCP_MAX_CODECS];
-	unsigned int codecs_len;
-	struct ptmap ptmap[MGCP_MAX_CODECS];
-	unsigned int ptmap_len;
-};
+int ptmap_cmp(const struct ptmap *a, const struct ptmap *b);

 enum mgcp_verb {
 	MGCP_VERB_CRCX,
@@ -102,38 +92,8 @@ enum mgcp_verb {
 	MGCP_VERB_RSIP,
 };

-#define MGCP_MSG_PRESENCE_ENDPOINT	0x0001
-#define MGCP_MSG_PRESENCE_CALL_ID	0x0002
-#define MGCP_MSG_PRESENCE_CONN_ID	0x0004
-#define MGCP_MSG_PRESENCE_AUDIO_IP	0x0008
-#define MGCP_MSG_PRESENCE_AUDIO_PORT	0x0010
-#define MGCP_MSG_PRESENCE_CONN_MODE	0x0020
-#define MGCP_MSG_PRESENCE_X_OSMO_OSMUX_CID 0x4000
-#define MGCP_MSG_PRESENCE_X_OSMO_IGN	0x8000
-
-struct mgcp_msg {
-	enum mgcp_verb verb;
-	/* See MGCP_MSG_PRESENCE_* constants */
-	uint32_t presence;
-	char endpoint[MGCP_ENDPOINT_MAXLEN];
-	unsigned int call_id;
-	char *conn_id;
-	uint16_t audio_port;
-	char *audio_ip;
-	enum mgcp_connection_mode conn_mode;
-	unsigned int ptime;
-	enum mgcp_codecs codecs[MGCP_MAX_CODECS];
-	unsigned int codecs_len;
-	struct ptmap ptmap[MGCP_MAX_CODECS];
-	unsigned int ptmap_len;
-	uint32_t x_osmo_ign;
-	bool x_osmo_osmux_use;
-	int x_osmo_osmux_cid; /* -1 is wildcard */
-	bool param_present;
-	struct mgcp_codec_param param;
-};
-
-void mgcp_client_conf_init(struct mgcp_client_conf *conf);
+struct mgcp_client_conf *mgcp_client_conf_alloc(void *ctx);
+void mgcp_client_conf_init(struct mgcp_client_conf *conf) OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use mgcp_client_conf_alloc() (or even better, switch to the mgcp_client_pool API!)");
 void mgcp_client_vty_init(void *talloc_ctx, int node, struct mgcp_client_conf *conf);
 int mgcp_client_config_write(struct vty *vty, const char *indent);
 struct mgcp_client_conf *mgcp_client_conf_actual(struct mgcp_client *mgcp);
@@ -153,20 +113,8 @@ const char *mgcp_client_rtpbridge_wildcard(const struct mgcp_client *mgcp);
 const char *mgcp_client_e1_epname(void *ctx, const struct mgcp_client *mgcp, uint8_t trunk_id, uint8_t ts,
 				  uint8_t rate, uint8_t offset);

-/* Invoked when an MGCP response is received or sending failed.  When the
- * response is passed as NULL, this indicates failure during transmission. */
-typedef void (* mgcp_response_cb_t )(struct mgcp_response *response, void *priv);
-int mgcp_response_parse_params(struct mgcp_response *r);
-
-int mgcp_client_tx(struct mgcp_client *mgcp, struct msgb *msg,
-		   mgcp_response_cb_t response_cb, void *priv);
-int mgcp_client_cancel(struct mgcp_client *mgcp, mgcp_trans_id_t trans_id);
-
 enum mgcp_connection_mode;

-struct msgb *mgcp_msg_gen(struct mgcp_client *mgcp, struct mgcp_msg *mgcp_msg);
-mgcp_trans_id_t mgcp_msg_trans_id(struct msgb *msg);
-
 extern const struct value_string mgcp_client_connection_mode_strs[];
 static inline const char *mgcp_client_cmode_name(enum mgcp_connection_mode mode)
 {
--- a/include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h
+++ b/include/osmocom/mgcp_client/mgcp_client_endpoint_fsm.h
@@ -45,6 +45,7 @@ static inline void osmo_mgcpc_ep_ci_dlcx(struct osmo_mgcpc_ep_ci *ci)
 void osmo_mgcpc_ep_clear(struct osmo_mgcpc_ep *ep);

 const char *osmo_mgcpc_ep_name(const struct osmo_mgcpc_ep *ep);
+const char *osmo_mgcpc_ep_local_name(const struct osmo_mgcpc_ep *ep);
 const char *osmo_mgcpc_ep_ci_name(const struct osmo_mgcpc_ep_ci *ci);
 const char *osmo_mgcpc_ep_ci_id(const struct osmo_mgcpc_ep_ci *ci);
 struct mgcp_client *osmo_mgcpc_ep_client(const struct osmo_mgcpc_ep *ep);
--- a/include/osmocom/mgcp_client/mgcp_client_fsm.h
+++ b/include/osmocom/mgcp_client/mgcp_client_fsm.h
@@ -29,11 +29,11 @@ struct mgcp_conn_peer {
 	/*! RTP packetization interval (optional) */
 	unsigned int ptime;

-	/*! RTP codec list (optional) */
-	enum mgcp_codecs codecs[MGCP_MAX_CODECS];
-
-	/*! Number of codecs in RTP codec list (optional) */
-	unsigned int codecs_len;
+	/*! Deprecated. Use only ptmap[].codec in new code. */
+	enum mgcp_codecs codecs[MGCP_MAX_CODECS]
+		OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use ptmap[i].codec instead");
+	unsigned int codecs_len
+		OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use ptmap[] and ptmap_len instead");

 	/*! RTP payload type map (optional, only needed when payload types are
 	 * used that differ from what IANA/3GPP defines) */
@@ -57,18 +57,23 @@ struct mgcp_conn_peer {
 	 * address is set. If != MGCP_CONN_NONE, force this conn mode. */
 	enum mgcp_connection_mode conn_mode;

-	/*! If the codec requires additional format parameters (fmtp), those cann be set here, see also
-	 * mgcp_common.h */
-	bool param_present;
-	struct mgcp_codec_param param;
+	/*! Deprectated, use ptmap[].fmtp instead.
+	 * Global codec params. In case the codec requires additional format parameters (fmtp), those can be set
+	 * here, see also mgcp_common.h. The format parameters will be applied on all codecs where applicable. */
+	bool param_present OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use ptmap[].fmtp instead");
+	struct mgcp_codec_param param OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use ptmap[].fmtp instead");
 };

 struct osmo_fsm_inst *mgcp_conn_create(struct mgcp_client *mgcp, struct osmo_fsm_inst *parent_fi, uint32_t parent_term_evt,
-				       uint32_t parent_evt, struct mgcp_conn_peer *conn_peer);
-int mgcp_conn_modify(struct osmo_fsm_inst *fi, uint32_t parent_evt, struct mgcp_conn_peer *conn_peer);
-void mgcp_conn_delete(struct osmo_fsm_inst *fi);
+				       uint32_t parent_evt, struct mgcp_conn_peer *conn_peer)
+	OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use osmo_mgcpc_ep_alloc() and osmo_mgcpc_ep_ci_add() instead");
+int mgcp_conn_modify(struct osmo_fsm_inst *fi, uint32_t parent_evt, struct mgcp_conn_peer *conn_peer)
+	OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use osmo_mgcpc_ep_ci_request() instead");
+void mgcp_conn_delete(struct osmo_fsm_inst *fi)
+	OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use osmo_mgcpc_ep_ci_dlcx() instead");

-const char *mgcp_conn_get_ci(struct osmo_fsm_inst *fi);
+const char *mgcp_conn_get_ci(struct osmo_fsm_inst *fi)
+	OSMO_DEPRECATED_OUTSIDE_LIBOSMOMGCPCLIENT("use osmo_mgcpc_ep_ci.mgcp_ci_str instead");
 struct mgcp_client *mgcp_conn_get_client(struct osmo_fsm_inst *fi);

 const char *osmo_mgcpc_conn_peer_name(const struct mgcp_conn_peer *info);
--- a/include/osmocom/mgcp_client/mgcp_client_internal.h
+++ b/include/osmocom/mgcp_client/mgcp_client_internal.h
@@ -1,6 +1,7 @@
 #pragma once

-#include <osmocom/core/write_queue.h>
+#include <osmocom/core/osmo_io.h>
+#include <osmocom/core/timer.h>

 #define MSGB_CB_MGCP_TRANS_ID 0

@@ -12,18 +13,39 @@ struct reset_ep {

 struct mgcp_client {
 	struct mgcp_client_conf actual;
-	struct osmo_wqueue wq;
+	struct osmo_io_fd *iofd;
 	mgcp_trans_id_t next_trans_id;
 	struct llist_head responses_pending;
-	struct llist_head inuse_endpoints;
 	struct mgcp_client_pool_member *pool_member;
+	struct osmo_timer_list keepalive_tx_timer;
+	struct osmo_timer_list keepalive_rx_timer;
+	bool conn_up;
 };

-struct mgcp_inuse_endpoint {
-	struct llist_head entry;
-	uint16_t id;
+struct mgcp_response_head {
+	int response_code;
+	mgcp_trans_id_t trans_id;
+	char comment[MGCP_COMMENT_MAXLEN];
+	char conn_id[MGCP_CONN_ID_MAXLEN];
+	char endpoint[MGCP_ENDPOINT_MAXLEN];
+	bool x_osmo_osmux_use;
+	uint8_t x_osmo_osmux_cid;
 };

+struct mgcp_response {
+	char *body;
+	struct mgcp_response_head head;
+	uint16_t audio_port;
+	char audio_ip[INET6_ADDRSTRLEN];
+	unsigned int ptime;
+	struct ptmap ptmap[MGCP_MAX_CODECS];
+	unsigned int ptmap_len;
+};
+
+/* Invoked when an MGCP response is received or sending failed.  When the
+ * response is passed as NULL, this indicates failure during transmission. */
+typedef void (*mgcp_response_cb_t)(struct mgcp_response *response, void *priv);
+
 struct mgcp_response_pending {
 	struct llist_head entry;

@@ -39,3 +61,41 @@ struct mgcp_response_pending * mgcp_client_pending_add(
 					mgcp_trans_id_t trans_id,
 					mgcp_response_cb_t response_cb,
 					void *priv);
+
+#define MGCP_MSG_PRESENCE_ENDPOINT	0x0001
+#define MGCP_MSG_PRESENCE_CALL_ID	0x0002
+#define MGCP_MSG_PRESENCE_CONN_ID	0x0004
+#define MGCP_MSG_PRESENCE_AUDIO_IP	0x0008
+#define MGCP_MSG_PRESENCE_AUDIO_PORT	0x0010
+#define MGCP_MSG_PRESENCE_CONN_MODE	0x0020
+#define MGCP_MSG_PRESENCE_X_OSMO_OSMUX_CID 0x4000
+#define MGCP_MSG_PRESENCE_X_OSMO_IGN	0x8000
+
+struct mgcp_msg {
+	enum mgcp_verb verb;
+	/* See MGCP_MSG_PRESENCE_* constants */
+	uint32_t presence;
+	char endpoint[MGCP_ENDPOINT_MAXLEN];
+	unsigned int call_id;
+	char *conn_id;
+	uint16_t audio_port;
+	char *audio_ip;
+	enum mgcp_connection_mode conn_mode;
+	unsigned int ptime;
+	struct ptmap ptmap[MGCP_MAX_CODECS];
+	unsigned int ptmap_len;
+	uint32_t x_osmo_ign;
+	bool x_osmo_osmux_use;
+	int x_osmo_osmux_cid; /* -1 is wildcard */
+	bool param_present;
+	struct mgcp_codec_param param;
+};
+
+int mgcp_response_parse_params(struct mgcp_response *r);
+
+int mgcp_client_tx(struct mgcp_client *mgcp, struct msgb *msg,
+		   mgcp_response_cb_t response_cb, void *priv);
+int mgcp_client_cancel(struct mgcp_client *mgcp, mgcp_trans_id_t trans_id);
+
+struct msgb *mgcp_msg_gen(struct mgcp_client *mgcp, struct mgcp_msg *mgcp_msg);
+mgcp_trans_id_t mgcp_msg_trans_id(struct msgb *msg);
--- a/include/osmocom/mgcp_client/mgcp_client_pool.h
+++ b/include/osmocom/mgcp_client/mgcp_client_pool.h
@@ -2,6 +2,8 @@

 #include <stdbool.h>

+#include <osmocom/vty/vty.h>
+
 struct mgcp_client;
 struct mgcp_client_pool;
 struct mgcp_client_pool_member;
@@ -12,6 +14,7 @@ void mgcp_client_pool_vty_init(int parent_node, int mgw_node, const char *indent
 int mgcp_client_pool_config_write(struct vty *vty, const char *indent);
 unsigned int mgcp_client_pool_connect(struct mgcp_client_pool *pool);
 void mgcp_client_pool_register_single(struct mgcp_client_pool *pool, struct mgcp_client *mgcp_client);
+bool mgcp_client_pool_empty(const struct mgcp_client_pool *pool);

 struct mgcp_client *mgcp_client_pool_get(struct mgcp_client_pool *pool);
 void mgcp_client_pool_put(struct mgcp_client *mgcp_client);
--- a/include/osmocom/sdp/Makefile.am
+++ b/include/osmocom/sdp/Makefile.am
@@ -0,0 +1,3 @@
+noinst_HEADERS = \
+	sdp_internal.h \
+	$(NULL)
--- a/include/osmocom/sdp/fmtp.h
+++ b/include/osmocom/sdp/fmtp.h
@@ -0,0 +1,34 @@
+/* Public API for codec management in SDP messages: managing SDP fmtp strings. */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <stdint.h>
+
+bool osmo_sdp_fmtp_get_val(char *val, size_t val_size, const char *fmtp, const char *option_name);
+int64_t osmo_sdp_fmtp_get_int(const char *fmtp, const char *option_name, int64_t default_value);
+
+bool osmo_sdp_fmtp_amr_is_octet_aligned(const char *fmtp);
+bool osmo_sdp_fmtp_amr_match(const char *a, const char *b);
--- a/include/osmocom/sdp/sdp_codec.h
+++ b/include/osmocom/sdp/sdp_codec.h
@@ -0,0 +1,126 @@
+/* Public API for codec management in SDP messages. */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#pragma once
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/talloc.h>
+
+/* RFC-8866 5.14 and 6.6.
+ *
+ * Represent the items describing an SDP codec entry, as in:
+ *
+ *   m=audio 1234 RTP/AVP <payload_type>
+ *   a=rtpmap:<payload_type> <encoding-name>/<clock-rate>
+ *   a=fmtp:<payload_type> <fmtp>
+ *
+ * For example:
+ *
+ *   m=audio 1234 RTP/AVP 98
+ *   a=rtpmap:98 AMR/8000
+ *   a=fmtp:98 octet-align=1;mode-set=0,2,4,7
+ */
+struct osmo_sdp_codec {
+	/* Payload type number ("payload-type"), like 3 for GSM-FR. Limited to 0..127. */
+	int8_t payload_type;
+
+	/* Encoding name like "GSM", "AMR", "GSM-EFR".
+	 *
+	 * RFC-8866 defines no length limit on the encoding name. This API leaves it up to the caller to provide
+	 * sufficient space, via the SDP_SIZES_* definitions.
+	 *
+	 * encoding-name = token
+	 * token = 1*(token-char)
+	 * token-char = ALPHA / DIGIT
+	 *                    / "!" / "#" / "$" / "%" / "&"
+	 *                    / "'" ; (single quote)
+	 *                    / "*" / "+" / "-" / "." / "^" / "_"
+	 *                    / "`" ; (Grave accent)
+	 */
+	char *encoding_name;
+
+	/* Samplerate ("clock-rate"), usually 8000 for GSM. */
+	unsigned int rate;
+
+	/* Codec parameters as supplied in SDP line 'a=fmtp:<payload-type> <format-specific-params>'. This holds only
+	 * the 'format-specific-params' bytestring. For example, for SDP line 'a=fmtp:123 param1=val1;param2=val2', this
+	 * holds only the , "param1=val1;param2=val2" part. For the buffer size, see fmtp_size. */
+	char *fmtp;
+
+	/* Entry used by osmo_sdp_codec_list. */
+	struct llist_head entry;
+
+	/* For future extension, always set to false. */
+	bool v2;
+};
+
+struct osmo_sdp_codec *osmo_sdp_codec_alloc(void *ctx);
+
+int osmo_sdp_codec_set(struct osmo_sdp_codec *c,
+		       int8_t payload_type, const char *encoding_name, unsigned int rate, const char *fmtp);
+int osmo_sdp_codec_set_encoding_name(struct osmo_sdp_codec *c, const char *encoding_name);
+int osmo_sdp_codec_set_fmtp(struct osmo_sdp_codec *c, const char *fmtp);
+
+bool osmo_sdp_codec_is_set(const struct osmo_sdp_codec *a);
+
+int osmo_sdp_codec_to_str_buf(char *buf, size_t buflen, const struct osmo_sdp_codec *codec);
+char *osmo_sdp_codec_to_str_c(void *ctx, const struct osmo_sdp_codec *codec);
+
+int osmo_sdp_codec_from_str(struct osmo_sdp_codec *dst, const char *str, int str_len);
+
+enum osmo_sdp_cmp {
+	OSMO_SDP_CMP_IGNORE = 0,
+	OSMO_SDP_CMP_EQUIVALENT,
+	OSMO_SDP_CMP_EXACT,
+};
+
+/*! Indicate how to match SDP codecs to various osmo_sdp_*() functions.
+ * Callers may define own flags, or use predefined instances:
+ * osmo_sdp_codec_cmp_exact, osmo_sdp_codec_cmp_equivalent, ...
+ *
+ * For example, to trigger some action if any item has changed, set all items to true / OSMO_SDP_CMP_EXACT (see
+ * osmo_sdp_codec_cmp_exact).
+ * To find codecs that are the same between two SDP sessions, set payload_type=false and fmtp=OSMO_SDP_CMP_EQUIVALENT
+ * (see osmo_sdp_codec_cmp_equivalent).
+ * To just list all contained "AMR" codecs, set only encoding_name=true (see osmo_sdp_codec_cmp_name).
+ */
+struct osmo_sdp_codec_cmp_flags {
+	/*! true = compare payload type numbers 1:1; false = ignore. */
+	bool payload_type;
+	/*! true = compare encoding_name 1:1; false = ignore. */
+	bool encoding_name;
+	/*! true = compare rate 1:1; false = ignore. */
+	bool rate;
+	/*! OSMO_SDP_CMP_IGNORE = ignore fmtp;
+	 * OSMO_SDP_CMP_EQUIVALENT = use osmo_sdp_fmtp_amr_match() for AMR, otherwise compare 1:1;
+	 * OSMO_SDP_CMP_EXACT = compare 1:1.
+	 */
+	enum osmo_sdp_cmp fmtp;
+};
+
+extern const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_exact;
+extern const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_equivalent;
+extern const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_name;
+
+int osmo_sdp_codec_cmp(const struct osmo_sdp_codec *a, const struct osmo_sdp_codec *b,
+		       const struct osmo_sdp_codec_cmp_flags *cmp);
--- a/include/osmocom/sdp/sdp_codec_list.h
+++ b/include/osmocom/sdp/sdp_codec_list.h
@@ -0,0 +1,69 @@
+/* Public API for codec management in SDP messages: list of struct osmo_sdp_codec. */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#pragma once
+
+#include <osmocom/sdp/sdp_codec.h>
+
+struct osmo_sdp_codec_list {
+	struct llist_head list;
+
+	/* For future extension, always set to false. */
+	bool v2;
+};
+
+struct osmo_sdp_codec_list *osmo_sdp_codec_list_alloc(void *ctx);
+void osmo_sdp_codec_list_free_items(struct osmo_sdp_codec_list *codec_list);
+
+int8_t osmo_sdp_codec_list_get_unused_dyn_pt_nr(const struct osmo_sdp_codec_list *codec_list, int8_t suggest_pt_nr);
+
+struct osmo_sdp_codec *osmo_sdp_codec_list_add_empty(struct osmo_sdp_codec_list *codec_list);
+struct osmo_sdp_codec *osmo_sdp_codec_list_add(struct osmo_sdp_codec_list *codec_list,
+					       const struct osmo_sdp_codec *codec,
+					       const struct osmo_sdp_codec_cmp_flags *once, bool pick_unused_pt_nr);
+
+int osmo_sdp_codec_list_remove(struct osmo_sdp_codec_list *codec_list, const struct osmo_sdp_codec *codec,
+			       const struct osmo_sdp_codec_cmp_flags *cmpf);
+void osmo_sdp_codec_list_remove_entry(struct osmo_sdp_codec *codec);
+
+int osmo_sdp_codec_list_to_str_buf(char *buf, size_t buflen, const struct osmo_sdp_codec_list *codec_list, bool summarize);
+char *osmo_sdp_codec_list_to_str_c(void *ctx, const struct osmo_sdp_codec_list *codec_list, bool summarize);
+
+struct osmo_sdp_codec *osmo_sdp_codec_list_first(const struct osmo_sdp_codec_list *list);
+int osmo_sdp_codec_list_move_to_first(struct osmo_sdp_codec_list *codec_list, const struct osmo_sdp_codec *codec,
+				      const struct osmo_sdp_codec_cmp_flags *cmpf);
+
+#define osmo_sdp_codec_list_foreach(STRUCT_SDP_CODEC_P, SDP_CODEC_LIST) \
+	llist_for_each_entry(STRUCT_SDP_CODEC_P, &(SDP_CODEC_LIST)->list, entry)
+#define osmo_sdp_codec_list_foreach_safe(STRUCT_SDP_CODEC_P, SAFE_P, SDP_CODEC_LIST) \
+	llist_for_each_entry_safe(STRUCT_SDP_CODEC_P, SAFE_P, &(SDP_CODEC_LIST)->list, entry)
+
+int osmo_sdp_codec_list_cmp(const struct osmo_sdp_codec_list *a, const struct osmo_sdp_codec_list *b,
+			    const struct osmo_sdp_codec_cmp_flags *cmpf);
+
+void osmo_sdp_codec_list_intersection(struct osmo_sdp_codec_list *dst, const struct osmo_sdp_codec_list *other,
+				      const struct osmo_sdp_codec_cmp_flags *cmpf,
+				      bool translate_payload_type_numbers);
+
+struct osmo_sdp_codec *osmo_sdp_codec_list_by_payload_type(struct osmo_sdp_codec_list *codec_list, int8_t payload_type);
+bool osmo_sdp_codec_list_is_empty(const struct osmo_sdp_codec_list *codec_list);
--- a/include/osmocom/sdp/sdp_internal.h
+++ b/include/osmocom/sdp/sdp_internal.h
@@ -0,0 +1,11 @@
+/* Internal header for non-public API shared across .c files */
+#pragma once
+
+struct token {
+	const char *start;
+	const char *end;
+};
+
+/* Copy a string from [start,end[, return as talloc allocated under ctx in *dst.
+ * If *dst is non-NULL, talloc_free(*dst) first. */
+void token_copy(void *ctx, char **dst, const struct token *t);
--- a/include/osmocom/sdp/sdp_msg.h
+++ b/include/osmocom/sdp/sdp_msg.h
@@ -0,0 +1,98 @@
+/* Public API for SDP message encoding and decoding */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#pragma once
+
+#include <osmocom/core/sockaddr_str.h>
+
+#include <osmocom/sdp/sdp_codec.h>
+#include <osmocom/sdp/sdp_codec_list.h>
+
+/* Media Direction Attributes "a=recvonly", "a=sendrecv", "a=sendonly", "a=inactive" RFC-8866 6.7. */
+enum osmo_sdp_media_direcion_e {
+	OSMO_SDP_MDIR_UNSET = 0,
+	OSMO_SDP_MDIR_RECVONLY = 1,
+	OSMO_SDP_MDIR_SENDRECV = 2,
+	OSMO_SDP_MDIR_SENDONLY = 3,
+	OSMO_SDP_MDIR_INACTIVE = 4,
+};
+
+/* Session Description Protocol (SDP) message, RFC-8866. */
+struct osmo_sdp_msg {
+	/* 5.2 Origin ("o="). */
+	struct {
+		struct osmo_sockaddr_str addr;
+		char *username;
+		char *sess_id;
+		char *sess_version;
+	} origin;
+
+	/* 5.3 Session Name ("s="). */
+	char *session_name;
+
+	/* 5.7 Connection Information ("c=") and port from 5.14 Media Descriptions ("m="). */
+	struct osmo_sockaddr_str rtp;
+
+	/* 5.9. Time Active ("t="). */
+	struct {
+		int64_t start;
+		int64_t stop;
+	} time_active;
+
+	/* 6.4 "a=ptime:<val>". */
+	unsigned int ptime;
+
+	/* 6.7 "a=sendrecv"... */
+	enum osmo_sdp_media_direcion_e media_direction;
+
+	/* List of codecs defined in the SDP message.
+	 * This should not be NULL -- osmo_sdp_msg_alloc() returns an empty osmo_sdp_codec_list instance, ready for
+	 * adding codecs.
+	 * Combination of:
+	 * - payload_type numbers from 5.14 Media Descriptions ("m="),
+	 * - 6.6 "a=rtpmap",
+	 * - 6.15 Format Parameters "a=fmtp".
+	 */
+	struct osmo_sdp_codec_list *codecs;
+
+	/* For future extension, always set to false. */
+	bool v2;
+};
+
+struct osmo_sdp_err {
+	int rc;
+	/* Point at the position that caused the error, in the src string. */
+	const char *at_input_str;
+	/* Nr of characters at *src_str that are relevant to the error. */
+	size_t at_input_str_len;
+};
+
+struct osmo_sdp_msg *osmo_sdp_msg_alloc(void *ctx);
+
+struct osmo_sdp_msg *osmo_sdp_msg_decode(void *ctx, const char *src, struct osmo_sdp_err *err);
+
+int osmo_sdp_msg_encode_buf(char *dst, size_t dst_size, const struct osmo_sdp_msg *sdp);
+char *osmo_sdp_msg_encode_c(void *ctx, const struct osmo_sdp_msg *sdp);
+
+int osmo_sdp_msg_to_str_buf(char *buf, size_t buflen, const struct osmo_sdp_msg *sdp, bool summarize);
+char *osmo_sdp_msg_to_str_c(void *ctx, const struct osmo_sdp_msg *sdp, bool summarize);
--- a/include/osmocom/sdp/sdp_strings.h
+++ b/include/osmocom/sdp/sdp_strings.h
@@ -0,0 +1,39 @@
+/* Central definition of string tokens used for parsing and composing SDP messages */
+#pragma once
+
+#define OSMO_SDP_STR_MEDIA "m"
+#define OSMO_SDP_STR_ATTRIB "a"
+#define OSMO_SDP_STR_TIME_ACTIVE "t"
+
+#define OSMO_SDP_STR_RTPMAP "rtpmap"
+#define OSMO_SDP_STR_FMTP "fmtp"
+#define OSMO_SDP_STR_PTIME "ptime"
+
+/*! "a=foo:" */
+#define OSMO_SDP_A_PREFIX(STR) OSMO_SDP_STR_ATTRIB "=" STR ":"
+
+/*! "a=fmtp:" */
+#define OSMO_SDP_STR_A_FMTP OSMO_SDP_A_PREFIX(OSMO_SDP_STR_FMTP)
+
+/* Media Direction Attributes "a=recvonly", "a=sendrecv", "a=sendonly", "a=inactive" RFC-8866 6.7. */
+#define OSMO_SDP_STR_RECVONLY "recvonly"
+#define OSMO_SDP_STR_SENDRECV "sendrecv"
+#define OSMO_SDP_STR_SENDONLY "sendonly"
+#define OSMO_SDP_STR_INACTIVE "inactive"
+
+/* AMR related tokens */
+
+#define OSMO_SDP_STR_AMR_OCTET_ALIGN "octet-align"
+
+/*! "octet-align=1" */
+#define OSMO_SDP_STR_AMR_OCTET_ALIGN_1  OSMO_SDP_STR_AMR_OCTET_ALIGN "=1"
+
+/*! "octet-align=0".
+ * According to spec [1], "octet-align=0" is identical to omitting 'octet-align' entirely. In Osmocom practice, whether
+ * or not "octet-align=0" is present can make a big difference for osmo-mgw versions 1.12 and older, which do not heed
+ * [1].
+ *
+ * spec [1]: RFC4867, see details in description of osmo_sdp_fmtp_amr_is_octet_aligned().
+ */
+#define OSMO_SDP_STR_AMR_OCTET_ALIGN_0  OSMO_SDP_STR_AMR_OCTET_ALIGN "=0"
+
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -15,6 +15,7 @@ AM_CFLAGS = \

 # Libraries
 SUBDIRS = \
+	libosmo-sdp \
 	libosmo-mgcp-client \
 	libosmo-mgcp \
 	$(NULL)
--- a/src/libosmo-mgcp-client/Makefile.am
+++ b/src/libosmo-mgcp-client/Makefile.am
@@ -19,7 +19,7 @@ AM_LDFLAGS = \

 # This is not at all related to the release version, but a range of supported
 # API versions. Read TODO_RELEASE in the source tree's root!
-MGCP_CLIENT_LIBVERSION=11:0:0
+MGCP_CLIENT_LIBVERSION=13:0:1

 lib_LTLIBRARIES = \
 	libosmo-mgcp-client.la \
@@ -40,6 +40,7 @@ libosmo_mgcp_client_la_LDFLAGS = \
 	$(NULL)

 libosmo_mgcp_client_la_LIBADD = \
+	$(top_builddir)/src/libosmo-sdp/libosmo-sdp.la \
 	$(LIBOSMOCORE_LIBS) \
 	$(LIBOSMOVTY_LIBS) \
 	$(NULL)
--- a/src/libosmo-mgcp-client/mgcp_client.c
+++ b/src/libosmo-mgcp-client/mgcp_client.c
--- a/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c
+++ b/src/libosmo-mgcp-client/mgcp_client_endpoint_fsm.c
@@ -173,6 +173,30 @@ const char *osmo_mgcpc_ep_name(const struct osmo_mgcpc_ep *ep)
 	return osmo_fsm_inst_name(ep->fi);
 }

+/*! Get "local endpoint name" part of the endpoint name: (local-endpoint-name@domain-name)
+ *
+ * \param ep  The MGCP Endpoint
+ * \returns the local endpoint name if found, NULL on error.
+ */
+const char *osmo_mgcpc_ep_local_name(const struct osmo_mgcpc_ep *ep)
+{
+	static char buf[1024];
+	const char *sep;
+
+	OSMO_ASSERT(ep);
+	sep = strchr(ep->endpoint, '@');
+	if (!sep) {
+		OSMO_STRLCPY_ARRAY(buf, ep->endpoint);
+		return buf;
+	}
+	if (sep - ep->endpoint >= sizeof(buf))
+		return NULL;
+
+	memcpy(buf, ep->endpoint, sep - ep->endpoint);
+	buf[sep - ep->endpoint] = '\0';
+	return buf;
+}
+
 const char *mgcp_conn_peer_name(const struct mgcp_conn_peer *info)
 {
 	/* I'd be fine with a smaller buffer and accept truncation, but gcc possibly refuses to build if
@@ -509,10 +533,42 @@ static void on_success(struct osmo_mgcpc_ep_ci *ci, void *data)
 	       mgcp_conn_peer_name(ci->got_port_info? &ci->rtp_info : NULL),
 	       ci->notify.fi ? "" : " (not sending a notification)");

+	/* Below ordering is a delicate decision:
+	 *
+	 * We want to
+	 * - emit the resulting event to ci->notify.fi,
+	 * - check whether we want to tx the next pending MGCP message.
+	 * Both these steps may terminate (=deallocate) the ep.
+	 * So whichever one goes first may cause a use-after-free in the other.
+	 *
+	 * When dispatching the FSM event, we don't get an rc indicating dealloc of the FSM -- it may deallocate and we
+	 * cannot tell. The common mechanism for that is osmo_fsm_set_dealloc_ctx(OTC_SELECT) and query the still
+	 * allocated FSM state after termination (here we would check 'if (ci->ep != NULL)'), but we cannot assume the
+	 * caller has actually set up an osmo_fsm_set_dealloc_ctx(). At time of writing, e.g. osmo-hnbgw does not use
+	 * it.
+	 *
+	 * In osmo_mgcpc_ep_fsm_check_state_chg_after_response(), we do get an rc: false means FSM has terminated.
+	 * On termination, the ep emits a term event to the FSM's parent.
+	 * That may cause the notify.fi to be terminated in turn, depending on how the caller set things up.
+	 * So: we cannot store notify.fi before, then call osmo_mgcpc_ep_fsm_check_state_chg_after_response(), and then
+	 * emit the event, because notify.fi may have deallocated. We cannot look up whether
+	 * osmo_mgcpc_ep_cancel_notify() has been called, because ci may have deallocated along with ci->ep.
+	 *
+	 * We have to skip emitting below success event in case the ep is now terminated.
+	 * - It may be the final DLCX OK: not a problem, osmo_mgcpc_ep_ci_dlcx() has no notify args on purpose, so we do
+	 *   make all callers not set a notify event for DLCX by design. notify.fi should always be NULL when the final
+	 *   DLCX OK terminates the local endpoint state.
+	 * - It may also be sudden termination due to a bad problem, in which case we shouldn't emit success.
+	 *   The osmo_fsm_inst.parent_term_event should suffice as feedback to the caller.
+	 */
+
+	if (osmo_mgcpc_ep_fsm_check_state_chg_after_response(ci->ep->fi) == false) {
+		/* false means, the ci->ep has been terminated. */
+		return;
+	}
+
 	if (ci->notify.fi)
 		osmo_fsm_inst_dispatch(ci->notify.fi, ci->notify.success, ci->notify.data);
-
-	osmo_mgcpc_ep_fsm_check_state_chg_after_response(ci->ep->fi);
 }

 /*! Return the MGW's local RTP port information for this connection, i.e. the local port that MGW is receiving on, as
@@ -662,11 +718,11 @@ void osmo_mgcpc_ep_ci_request(struct osmo_mgcpc_ep_ci *ci,
 	osmo_strlcpy(cleared_ci.mgcp_ci_str, ci->mgcp_ci_str, sizeof(cleared_ci.mgcp_ci_str));
 	*ci = cleared_ci;

-	LOG_CI_VERB(ci, LOGL_DEBUG, "notify=%s\n", osmo_fsm_inst_name(ci->notify.fi));
-
 	if (verb_info)
 		ci->verb_info = *verb_info;

+	LOG_CI_VERB(ci, LOGL_DEBUG, "notify=%s\n", osmo_fsm_inst_name(ci->notify.fi));
+
 	if (ep->endpoint[0]) {
 		if (ci->verb_info.endpoint[0] && strcmp(ci->verb_info.endpoint, ep->endpoint))
 			LOG_CI(ci, LOGL_ERROR,
--- a/src/libosmo-mgcp-client/mgcp_client_fsm.c
+++ b/src/libosmo-mgcp-client/mgcp_client_fsm.c
@@ -19,6 +19,7 @@
 */

 #include <osmocom/mgcp_client/mgcp_client.h>
+#include <osmocom/mgcp_client/mgcp_client_internal.h>
 #include <osmocom/mgcp_client/mgcp_client_fsm.h>
 #include <osmocom/core/utils.h>
 #include <osmocom/core/fsm.h>
@@ -114,12 +115,10 @@ static void make_crcx_msg(struct mgcp_msg *mgcp_msg, struct mgcp_conn_peer *info
 		.call_id = info->call_id,
 		.conn_mode = MGCP_CONN_RECV_ONLY,
 		.ptime = info->ptime,
-		.codecs_len = info->codecs_len,
 		.ptmap_len = info->ptmap_len,
 		.param_present = info->param_present
 	};
 	osmo_strlcpy(mgcp_msg->endpoint, info->endpoint, MGCP_ENDPOINT_MAXLEN);
-	memcpy(mgcp_msg->codecs, info->codecs, sizeof(mgcp_msg->codecs));
 	memcpy(mgcp_msg->ptmap, info->ptmap, sizeof(mgcp_msg->ptmap));
 	memcpy(&mgcp_msg->param, &info->param, sizeof(mgcp_msg->param));

@@ -136,10 +135,19 @@ static void make_crcx_msg(struct mgcp_msg *mgcp_msg, struct mgcp_conn_peer *info

 static void add_audio(struct mgcp_msg *mgcp_msg, struct mgcp_conn_peer *info)
 {
-	mgcp_msg->presence |= MGCP_MSG_PRESENCE_AUDIO_IP | MGCP_MSG_PRESENCE_AUDIO_PORT;
-	mgcp_msg->audio_ip = info->addr;
-	mgcp_msg->audio_port = info->port;
-	mgcp_msg->conn_mode = MGCP_CONN_RECV_SEND;
+	bool ip_is_set = info->addr[0] != '\0' &&
+			 strncmp(info->addr, "::", sizeof(info->addr)) != 0 &&
+			 strncmp(info->addr, "0.0.0.0", sizeof(info->addr)) != 0;
+	if (ip_is_set) {
+		mgcp_msg->presence |= MGCP_MSG_PRESENCE_AUDIO_IP;
+		mgcp_msg->audio_ip = info->addr;
+	}
+	if (info->port) {
+		mgcp_msg->presence |= MGCP_MSG_PRESENCE_AUDIO_PORT;
+		mgcp_msg->audio_port = info->port;
+	}
+	if (ip_is_set && info->port)
+		mgcp_msg->conn_mode = MGCP_CONN_RECV_SEND;
 }

 static void set_conn_mode(struct mgcp_msg *mgcp_msg, struct mgcp_conn_peer *peer)
@@ -163,12 +171,10 @@ static struct msgb *make_mdcx_msg(struct mgcp_ctx *mgcp_ctx)
 		.audio_ip = mgcp_ctx->conn_peer_local.addr,
 		.audio_port = mgcp_ctx->conn_peer_local.port,
 		.ptime = mgcp_ctx->conn_peer_local.ptime,
-		.codecs_len = mgcp_ctx->conn_peer_local.codecs_len,
 		.ptmap_len = mgcp_ctx->conn_peer_local.ptmap_len,
 		.param_present = mgcp_ctx->conn_peer_local.param_present
 	};
 	osmo_strlcpy(mgcp_msg.endpoint, mgcp_ctx->conn_peer_remote.endpoint, MGCP_ENDPOINT_MAXLEN);
-	memcpy(mgcp_msg.codecs, mgcp_ctx->conn_peer_local.codecs, sizeof(mgcp_msg.codecs));
 	memcpy(mgcp_msg.ptmap, mgcp_ctx->conn_peer_local.ptmap, sizeof(mgcp_msg.ptmap));
 	memcpy(&mgcp_msg.param, &mgcp_ctx->conn_peer_local.param, sizeof(mgcp_ctx->conn_peer_local.param));

@@ -221,8 +227,7 @@ static void fsm_crcx_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 			 mgcp_ctx->conn_peer_local.endpoint);

 		make_crcx_msg(&mgcp_msg, &mgcp_ctx->conn_peer_local);
-		if (mgcp_ctx->conn_peer_local.port)
-			add_audio(&mgcp_msg, &mgcp_ctx->conn_peer_local);
+		add_audio(&mgcp_msg, &mgcp_ctx->conn_peer_local);
 		set_conn_mode(&mgcp_msg, &mgcp_ctx->conn_peer_local);

 		msg = mgcp_msg_gen(mgcp_ctx->mgcp, &mgcp_msg);
@@ -364,13 +369,21 @@ static void fsm_ready_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	switch (event) {
 	case EV_MDCX:
 		msg = make_mdcx_msg(mgcp_ctx);
-		OSMO_ASSERT(msg);
+		if (!msg) {
+			/* make_mdcx_msg() should already have logged the error */
+			osmo_fsm_inst_term(fi, OSMO_FSM_TERM_ERROR, NULL);
+			return;
+		}
 		rc = mgcp_client_tx(mgcp, msg, mgw_mdcx_resp_cb, fi);
 		new_state = ST_MDCX_RESP;
 		break;
 	case EV_DLCX:
 		msg = make_dlcx_msg(mgcp_ctx);
-		OSMO_ASSERT(msg);
+		if (!msg) {
+			/* make_dlcx_msg() should already have logged the error */
+			osmo_fsm_inst_term(fi, OSMO_FSM_TERM_ERROR, NULL);
+			return;
+		}
 		rc = mgcp_client_tx(mgcp, msg, mgw_dlcx_resp_cb, fi);
 		new_state = ST_DLCX_RESP;
 		break;
@@ -611,6 +624,72 @@ static struct osmo_fsm fsm_mgcp_client = {
 	.log_subsys = DLMGCP,
 };

+/* Provide backwards compat for deprecated conn_peer->codecs[]: when the caller passes in an mgcp_conn_peer instance
+ * that has codecs[] set, apply it to ptmap[] instead. */
+static void mgcp_conn_peer_compat(struct mgcp_conn_peer *conn_peer)
+{
+	struct ptmap ptmap[MGCP_MAX_CODECS];
+	unsigned int ptmap_len;
+
+	if (!conn_peer->codecs_len)
+		return;
+
+	/* Before dropping codecs[], codecs[] would indicate the order in which the codecs should appear in SDP. ptmap[]
+	 * would indicate payload type numbers when not using a default payload type number (may omit entries).
+	 * Now, ptmap[] just indicates both at the same time; codecs[] should be empty, and ptmap[] lists all codecs.
+	 * So if any codecs[] are present, recreate ptmap[] in the order of codecs[]. */
+
+	ptmap_len = 0;
+	for (int i = 0; i < conn_peer->codecs_len; i++) {
+		enum mgcp_codecs codec = conn_peer->codecs[i];
+		struct ptmap *found = NULL;
+
+		/* Look up whether a specific pt was indicated for this codec */
+		for (int p = 0; p < conn_peer->ptmap_len; p++) {
+			if (conn_peer->ptmap[p].codec != codec)
+				continue;
+			found = &conn_peer->ptmap[p];
+			break;
+		}
+		if (found) {
+			ptmap[ptmap_len] = *found;
+		} else {
+			ptmap[ptmap_len] = (struct ptmap){
+				.codec = codec,
+				/* some enum mgcp_codecs correspond to their standard PT nr, so for compat: */
+				.pt = codec,
+			};
+		}
+		ptmap_len++;
+	}
+
+	/* Are there any entries in the old ptmap that were omitted by codecs[]? */
+	for (int p = 0; p < conn_peer->ptmap_len; p++) {
+		bool exists = false;
+		for (int i = 0; i < ptmap_len; i++) {
+			if (ptmap_cmp(&ptmap[i], &conn_peer->ptmap[p]))
+				continue;
+			exists = true;
+			break;
+		}
+
+		if (exists)
+			continue;
+
+		if (ptmap_len >= ARRAY_SIZE(ptmap))
+			break;
+
+		/* Not present yet, add it to the end */
+		ptmap[ptmap_len] = conn_peer->ptmap[p];
+		ptmap_len++;
+	}
+
+	/* Use the new ptmap[], and clear out legacy codecs[]. */
+	memcpy(conn_peer->ptmap, ptmap, sizeof(conn_peer->ptmap));
+	conn_peer->ptmap_len = ptmap_len;
+	conn_peer->codecs_len = 0;
+}
+
 /*! allocate FSM, and create a new connection on the MGW.
 *  \param[in] mgcp MGCP client descriptor.
 *  \param[in] parent_fi Parent FSM instance.
@@ -625,6 +704,7 @@ struct osmo_fsm_inst *mgcp_conn_create(struct mgcp_client *mgcp, struct osmo_fsm
 	struct osmo_fsm_inst *fi;
 	struct in6_addr ip_test;

+	mgcp_conn_peer_compat(conn_peer);

 	OSMO_ASSERT(parent_fi);
 	OSMO_ASSERT(mgcp);
@@ -664,6 +744,8 @@ int mgcp_conn_modify(struct osmo_fsm_inst *fi, uint32_t parent_evt, struct mgcp_
 	struct mgcp_ctx *mgcp_ctx = fi->priv;
 	struct in6_addr ip_test;

+	mgcp_conn_peer_compat(conn_peer);
+
 	OSMO_ASSERT(mgcp_ctx);
 	OSMO_ASSERT(conn_peer);

--- a/src/libosmo-mgcp-client/mgcp_client_pool.c
+++ b/src/libosmo-mgcp-client/mgcp_client_pool.c
@@ -75,6 +75,11 @@ void mgcp_client_pool_register_single(struct mgcp_client_pool *pool, struct mgcp
 	pool->mgcp_client_single = mgcp_client;
 }

+bool mgcp_client_pool_empty(const struct mgcp_client_pool *pool)
+{
+	return llist_empty(&pool->member_list);
+}
+
 /*! Lookup the selected MGCP client config by its reference number */
 struct mgcp_client_pool_member *mgcp_client_pool_find_member_by_nr(struct mgcp_client_pool *pool, unsigned int nr)
 {
@@ -89,7 +94,7 @@ struct mgcp_client_pool_member *mgcp_client_pool_find_member_by_nr(struct mgcp_c
 }

 /* Not every pool member may have a functional MGCP client, we will run through the pool once until we meet a
- * pool member that is suitable (has a client, is not blocked, has a low load). */
+ * pool member that is suitable (is not blocked, has a client with a working link, has a low load). */
 static struct mgcp_client_pool_member *mgcp_client_pool_pick(struct mgcp_client_pool *pool)
 {
 	struct mgcp_client_pool_member *pool_member;
@@ -98,14 +103,15 @@ static struct mgcp_client_pool_member *mgcp_client_pool_pick(struct mgcp_client_

 	llist_for_each_entry(pool_member, &pool->member_list, list) {
 		n_pool_members++;
-		if (pool_member->blocked == false && pool_member->client) {
+		bool conn_up = pool_member->client && pool_member->client->conn_up;
+		if (pool_member->blocked == false && conn_up) {
 			if (!pool_member_picked)
 				pool_member_picked = pool_member;
 			else if (pool_member_picked->refcount > pool_member->refcount)
 				pool_member_picked = pool_member;
 		} else {
-			LOGPPMGW(pool_member, LOGL_DEBUG, "%s -- MGW %u is unusable (blocked=%u, cli=%u)\n",
-				 __func__, pool_member->nr, pool_member->blocked, !!pool_member->client);
+			LOGPPMGW(pool_member, LOGL_DEBUG, "%s -- MGW %u is unusable (blocked=%u, cli=%u, link=%u)\n",
+				 __func__, pool_member->nr, pool_member->blocked, !!pool_member->client, conn_up);
 		}
 	}

--- a/src/libosmo-mgcp-client/mgcp_client_vty.c
+++ b/src/libosmo-mgcp-client/mgcp_client_vty.c
@@ -1,5 +1,5 @@
 /* MGCP client interface to quagga VTY */
-/* (C) 2016 by sysmocom s.m.f.c. GmbH <info@sysmocom.de>
+/* (C) 2016 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
 * Based on OpenBSC interface to quagga VTY (libmsc/vty_interface_layer3.c)
 * (C) 2009 by Harald Welte <laforge@gnumonks.org>
 * (C) 2009-2011 by Holger Hans Peter Freyther
@@ -28,6 +28,7 @@
 #include <osmocom/vty/command.h>
 #include <osmocom/vty/misc.h>
 #include <osmocom/core/utils.h>
+#include <osmocom/core/timer.h>

 #include <osmocom/mgcp_client/mgcp_client.h>
 #include <osmocom/mgcp_client/mgcp_client_internal.h>
@@ -48,7 +49,7 @@ static struct mgcp_client_conf *global_mgcp_client_conf = NULL;
 /* Pointer to the MGCP pool that is managed by mgcp_client_pool_vty_init() */
 static struct mgcp_client_pool *global_mgcp_client_pool = NULL;

-struct mgcp_client_conf *get_mgcp_client_config(struct vty *vty)
+static struct mgcp_client_conf *get_mgcp_client_config(struct vty *vty)
 {
 	if (global_mgcp_client_pool && vty->node == global_mgcp_client_pool->vty_node->node)
 		return vty->index;
@@ -61,6 +62,30 @@ struct mgcp_client_conf *get_mgcp_client_config(struct vty *vty)
 	return global_mgcp_client_conf;
 }

+static struct mgcp_client *get_mgcp_client(struct vty *vty)
+{
+	struct mgcp_client_conf *conf = get_mgcp_client_config(vty);
+	struct mgcp_client_pool_member *pool_member;
+
+	if (global_mgcp_client_pool && vty->node == global_mgcp_client_pool->vty_node->node) {
+		llist_for_each_entry(pool_member, &global_mgcp_client_pool->member_list, list) {
+			/* Find matching the conf pointer: */
+			if (&pool_member->conf != conf)
+				continue;
+			return pool_member->client;
+		}
+	}
+
+	/* Global single MGCP config, deprecated: */
+	vty_out(vty, "%% MGCP commands outside of 'mgw' nodes are deprecated. "
+		"You should consider reading the User Manual and migrating to 'mgw' node.%s",
+		VTY_NEWLINE);
+
+	/* There's no way to obtain the struct mgcp_client in old interface, but anyway it's deprecated. */
+	return NULL;
+}
+
+
 DEFUN(cfg_mgw_local_ip, cfg_mgw_local_ip_cmd,
      "local-ip " VTY_IPV46_CMD,
      "local bind to connect to MGW from\n"
@@ -280,6 +305,91 @@ ALIAS_DEPRECATED(cfg_mgw_no_reset_ep_name,
      NO_STR MGW_STR "remove an endpoint name from the reset-endpoint list, e.g. 'rtpbridge/*'\n"
      "Endpoint name, e.g. 'rtpbridge/*' or 'ds/e1-0/s-3/su16-4'.\n")

+DEFUN(cfg_mgw_mgw_keepalive_req_interval,
+      cfg_mgw_mgw_keepalive_req_interval_cmd,
+      "keepalive request-interval <0-4294967295>",
+      "Monitor if the MGCP link against MGW is still usable\n"
+      "Send an MGCP command to the MGW at given interval if no other commands are sent\n"
+      "The interval at which send MGCP commands (s), 0 to disable\n")
+{
+	struct mgcp_client_conf *conf = get_mgcp_client_config(vty);
+	struct mgcp_client *mgcp = get_mgcp_client(vty);
+
+	conf->keepalive.req_interval_sec = atoi(argv[0]);
+
+	if (!mgcp)
+		return CMD_SUCCESS;
+
+	/* If client already exists, apply the change immediately if possible: */
+	mgcp->actual.keepalive.req_interval_sec = atoi(argv[0]);
+	if (mgcp->iofd) { /* UDP MGCP socket connected */
+		if (mgcp->actual.keepalive.req_interval_sec > 0) {
+			/* Re-schedule: */
+			osmo_timer_schedule(&mgcp->keepalive_tx_timer, mgcp->actual.keepalive.req_interval_sec, 0);
+		} else {
+			if (osmo_timer_pending(&mgcp->keepalive_tx_timer))
+				osmo_timer_del(&mgcp->keepalive_tx_timer);
+			/* Assume link is UP by default, so that this MGW can be selected: */
+			mgcp->conn_up = true;
+		}
+	} /* else: wait until connect() to do first scheduling */
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgw_mgw_keepalive_req_endpoint,
+      cfg_mgw_mgw_keepalive_req_endpoint_cmd,
+      "keepalive request-endpoint NAME",
+      "Monitor if the MGCP link against MGW is still usable\n"
+      "Use a given endpoint name when sending an MGCP command to the MGW for keepalive purposes\n"
+      "The name of the endpoint to use\n")
+{
+	struct mgcp_client_conf *conf = get_mgcp_client_config(vty);
+	struct mgcp_client *mgcp = get_mgcp_client(vty);
+
+	OSMO_STRLCPY_ARRAY(conf->keepalive.req_endpoint_name, argv[0]);
+
+	if (!mgcp)
+		return CMD_SUCCESS;
+
+	/* If client already exists, apply the change immediately if possible: */
+	OSMO_STRLCPY_ARRAY(mgcp->actual.keepalive.req_endpoint_name, argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgw_mgw_keepalive_timeout,
+      cfg_mgw_mgw_keepalive_timeout_cmd,
+      "keepalive timeout <0-4294967295>",
+      "Monitor if the MGCP link against MGW is still usable\n"
+      "Consider the link to the MGW to be down after time without receiving any message from it\n"
+      "The timeout (s), 0 to disable\n")
+{
+	struct mgcp_client_conf *conf = get_mgcp_client_config(vty);
+	struct mgcp_client *mgcp = get_mgcp_client(vty);
+
+	conf->keepalive.timeout_sec = atoi(argv[0]);
+
+	if (!mgcp)
+		return CMD_SUCCESS;
+
+	/* If client already exists, apply the change immediately if possible: */
+	mgcp->actual.keepalive.timeout_sec = atoi(argv[0]);
+	if (mgcp->iofd) { /* UDP MGCP socket connected */
+		if (mgcp->actual.keepalive.timeout_sec > 0) {
+			/* Re-schedule: */
+			osmo_timer_schedule(&mgcp->keepalive_rx_timer, mgcp->actual.keepalive.timeout_sec, 0);
+		} else {
+			if (osmo_timer_pending(&mgcp->keepalive_rx_timer))
+				osmo_timer_del(&mgcp->keepalive_rx_timer);
+			/* Assume link is UP by default, so that this MGW can be selected: */
+			mgcp->conn_up = true;
+		}
+	} /* else: wait until connect() to do first scheduling */
+
+	return CMD_SUCCESS;
+}
+
 static int config_write(struct vty *vty, const char *indent, struct mgcp_client_conf *conf)
 {
 	const char *addr;
@@ -317,6 +427,17 @@ static int config_write(struct vty *vty, const char *indent, struct mgcp_client_
 	llist_for_each_entry(reset_ep, &conf->reset_epnames, list)
 		vty_out(vty, "%s%sreset-endpoint %s%s", indent, mgw_prefix, reset_ep->name, VTY_NEWLINE);

+	if (conf->keepalive.req_interval_sec != 0)
+		vty_out(vty, "%s%skeepalive request-interval %u%s", indent, mgw_prefix,
+			conf->keepalive.req_interval_sec, VTY_NEWLINE);
+	if (strncmp(conf->keepalive.req_endpoint_name, MGCP_CLIENT_KEEPALIVE_DEFAULT_ENDP,
+		    sizeof(conf->keepalive.req_endpoint_name)) != 0)
+		vty_out(vty, "%s%skeepalive request-endpoint %s%s", indent,  mgw_prefix,
+			conf->keepalive.req_endpoint_name, VTY_NEWLINE);
+	if (conf->keepalive.timeout_sec != 0)
+		vty_out(vty, "%s%skeepalive timeout %u%s", indent,  mgw_prefix,
+			conf->keepalive.timeout_sec, VTY_NEWLINE);
+
 	return CMD_SUCCESS;
 }

@@ -347,6 +468,9 @@ static void vty_init_common(void *talloc_ctx, int node)
 	install_lib_element(node, &cfg_mgw_mgw_endpoint_domain_name_cmd);
 	install_lib_element(node, &cfg_mgw_mgw_reset_ep_name_cmd);
 	install_lib_element(node, &cfg_mgw_mgw_no_reset_ep_name_cmd);
+	install_lib_element(node, &cfg_mgw_mgw_keepalive_req_interval_cmd);
+	install_lib_element(node, &cfg_mgw_mgw_keepalive_req_endpoint_cmd);
+	install_lib_element(node, &cfg_mgw_mgw_keepalive_timeout_cmd);

 	osmo_fsm_vty_add_cmds();
 }
@@ -553,8 +677,13 @@ DEFUN(mgw_show, mgw_show_cmd, "show mgw-pool", SHOW_STR "Display information abo
 	}

 	llist_for_each_entry(pool_member, &global_mgcp_client_pool->member_list, list) {
+		const struct mgcp_client *cli = pool_member->client;
 		vty_out(vty, "%%  MGW %s%s", mgcp_client_pool_member_name(pool_member), VTY_NEWLINE);
-		vty_out(vty, "%%   mgcp-client:   %s%s", pool_member->client ? "connected" : "disconnected",
+		vty_out(vty, "%%   MGCP link:     %s,%s%s",
+			cli && cli->iofd ? "connected" : "disconnected",
+			cli && cli->conn_up ?
+				((cli->actual.keepalive.timeout_sec > 0) ? "UP" : "MAYBE") :
+				"DOWN",
 			VTY_NEWLINE);
 		vty_out(vty, "%%   service:       %s%s", pool_member->blocked ? "blocked" : "unblocked", VTY_NEWLINE);
 		vty_out(vty, "%%   ongoing calls: %u%s", pool_member->refcount, VTY_NEWLINE);
--- a/src/libosmo-mgcp/Makefile.am
+++ b/src/libosmo-mgcp/Makefile.am
@@ -19,15 +19,15 @@ AM_LDFLAGS = \
 	$(COVERAGE_LDFLAGS) \
 	$(NULL)

-noinst_LIBRARIES = \
-	libosmo-mgcp.a \
+noinst_LTLIBRARIES = \
+	libosmo-mgcp.la \
 	$(NULL)

 noinst_HEADERS = \
 	g711common.h \
 	$(NULL)

-libosmo_mgcp_a_SOURCES = \
+libosmo_mgcp_la_SOURCES = \
 	mgcp_protocol.c \
 	mgcp_network.c \
 	mgcp_vty.c \
@@ -43,3 +43,13 @@ libosmo_mgcp_a_SOURCES = \
 	mgcp_e1.c \
 	mgcp_iuup.c \
 	$(NULL)
+
+libosmo_mgcp_la_LIBADD = \
+	$(top_builddir)/src/libosmo-sdp/libosmo-sdp.la \
+	$(LIBOSMOCORE_LIBS) \
+	$(LIBOSMOGSM_LIBS) \
+	$(LIBOSMOVTY_LIBS) \
+	$(LIBOSMONETIF_LIBS) \
+	$(LIBOSMOABIS_LIBS) \
+	$(LIBOSMOTRAU_LIBS) \
+	$(NULL)
--- a/src/libosmo-mgcp/mgcp_codec.c
+++ b/src/libosmo-mgcp/mgcp_codec.c
@@ -24,6 +24,10 @@
 #include <osmocom/mgcp/mgcp_endp.h>
 #include <osmocom/mgcp/mgcp_trunk.h>
 #include <osmocom/mgcp/mgcp_codec.h>
+
+#include <osmocom/sdp/sdp_strings.h>
+#include <osmocom/sdp/fmtp.h>
+
 #include <errno.h>

 /* Helper function to dump codec information of a specified codec to a printable
@@ -116,9 +120,9 @@ void mgcp_codec_reset_all(struct mgcp_conn_rtp *conn)
 *  \param[out] conn related rtp-connection.
 *  \param[in] payload_type codec type id (e.g. 3 for GSM, -1 when undefined).
 *  \param[in] audio_name audio codec name, in uppercase (e.g. "GSM/8000/1").
- *  \param[in] param optional codec parameters (set to NULL when unused).
+ *  \param[in] fmtp optional codec parameters (set to NULL when unused).
 *  \returns 0 on success, -EINVAL on failure. */
-int mgcp_codec_add(struct mgcp_conn_rtp *conn, int payload_type, const char *audio_name, const struct mgcp_codec_param *param)
+int mgcp_codec_add2(struct mgcp_conn_rtp *conn, int payload_type, const char *audio_name, const char *fmtp)
 {
 	int rate;
 	int channels;
@@ -261,12 +265,16 @@ int mgcp_codec_add(struct mgcp_conn_rtp *conn, int payload_type, const char *aud
 		}
 	}

-	/* Copy over optional codec parameters */
-	if (param) {
-		codec->param = *param;
-		codec->param_present = true;
-	} else
-		codec->param_present = false;
+	if (fmtp) {
+		OSMO_STRLCPY_ARRAY(codec->fmtp, fmtp);
+		if (strlen(codec->fmtp) != strlen(fmtp)) {
+			LOGP(DLMGCP, LOGL_ERROR, "fmtp too long: %zu > %zu\n", strlen(fmtp), strlen(codec->fmtp));
+			/* let's just hope what is there is still useful, worst case the call's audio doesn't work */
+		}
+	}
+
+	/* legacy */
+	codec->param_present = false;

 	conn->end.codecs_assigned++;
 	return 0;
@@ -276,104 +284,33 @@ error:
 	return -EINVAL;
 }

-/* Check if the given codec is applicable on the specified endpoint
- * Helper function for mgcp_codec_decide() */
-static bool is_codec_compatible(const struct mgcp_endpoint *endp, const struct mgcp_rtp_codec *codec)
-{
-	/* A codec name must be set, if not, this might mean that the codec
-	 * (payload type) that was assigned is unknown to us so we must stop
-	 * here. */
-	if (!strlen(codec->subtype_name))
-		return false;
-
-	/* FIXME: implement meaningful checks to make sure that the given codec
-	 * is compatible with the given endpoint */
-
-	return true;
-}
-
-/*! Decide for one suitable codec
- *  \param[in] conn related rtp-connection.
+/*! Legacy compat, use mgcp_codec_add2() instead to be able to pass any fmtp besides AMR octet-align=1.
+ * Add codec configuration depending on payload type and/or codec name. This
+ *  function uses the input parameters to extrapolate the full codec information.
+ *  \param[out] codec configuration (caller provided memory).
+ *  \param[out] conn related rtp-connection.
+ *  \param[in] payload_type codec type id (e.g. 3 for GSM, -1 when undefined).
+ *  \param[in] audio_name audio codec name, in uppercase (e.g. "GSM/8000/1").
+ *  \param[in] param optional codec parameters (set to NULL when unused).
 *  \returns 0 on success, -EINVAL on failure. */
-int mgcp_codec_decide(struct mgcp_conn_rtp *conn)
+int mgcp_codec_add(struct mgcp_conn_rtp *conn, int payload_type, const char *audio_name, const struct mgcp_codec_param *param)
 {
-	struct mgcp_rtp_end *rtp;
-	unsigned int i;
-	struct mgcp_endpoint *endp;
-	bool codec_assigned = false;
+	const char *fmtp = NULL;
+	if (param && param->amr_octet_aligned_present)
+		fmtp = (param->amr_octet_aligned ? OSMO_SDP_STR_AMR_OCTET_ALIGN_1 : OSMO_SDP_STR_AMR_OCTET_ALIGN_0);

-	endp = conn->conn->endp;
-	rtp = &conn->end;
-
-	/* This function works on the results the SDP/LCO parser has extracted
-	 * from the MGCP message. The goal is to select a suitable codec for
-	 * the given connection. When transcoding is available, the first codec
-	 * from the codec list is taken without further checking. When
-	 * transcoding is not available, then the choice must be made more
-	 * carefully. Each codec in the list is checked until one is found that
-	 * is rated compatible. The rating is done by the helper function
-	 * is_codec_compatible(), which does the actual checking. */
-	for (i = 0; i < rtp->codecs_assigned; i++) {
-		/* When no transcoding is available, avoid codecs that would
-		 * require transcoding. */
-		if (endp->trunk->no_audio_transcoding && !is_codec_compatible(endp, &rtp->codecs[i])) {
-			LOGP(DLMGCP, LOGL_NOTICE, "transcoding not available, skipping codec: %d/%s\n",
-			     rtp->codecs[i].payload_type, rtp->codecs[i].subtype_name);
-			continue;
-		}
-
-		rtp->codec = &rtp->codecs[i];
-		codec_assigned = true;
-		break;
-	}
-
-	/* FIXME: To the reviewes: This is problematic. I do not get why we
-	 * need to reset the packet_duration_ms depending on the codec
-	 * selection. I thought it were all 20ms? Is this to address some
-	 * cornercase. (This piece of code was in the code path before,
-	 * together with the note: "TODO/XXX: Store this per codec and derive
-	 * it on use" */
-	if (codec_assigned) {
-		if (rtp->maximum_packet_time >= 0
-		    && rtp->maximum_packet_time * rtp->codec->frame_duration_den >
-		    rtp->codec->frame_duration_num * 1500)
-			rtp->packet_duration_ms = 0;
-
-		return 0;
-	}
-
-	return -EINVAL;
+	return mgcp_codec_add2(conn, payload_type, audio_name, fmtp);
 }

-/* Check if the codec has a specific AMR mode (octet-aligned or bandwith-efficient) set. */
-bool mgcp_codec_amr_align_mode_is_indicated(const struct mgcp_rtp_codec *codec)
-{
-	if (codec->param_present == false)
-		return false;
-	if (!codec->param.amr_octet_aligned_present)
-		return false;
-	if (strcmp(codec->subtype_name, "AMR") != 0)
-		return false;
-	return true;
-}
-
-/* Return true if octet-aligned is set in the given codec. Default to octet-aligned=0, i.e. bandwidth-efficient mode.
- * See RFC4867 "RTP Payload Format for AMR and AMR-WB" sections "8.1. AMR Media Type Registration" and "8.2. AMR-WB
- * Media Type Registration":
- *
- *    octet-align: Permissible values are 0 and 1.  If 1, octet-aligned
- *                 operation SHALL be used.  If 0 or if not present,
- *                 bandwidth-efficient operation is employed.
- *
- * https://tools.ietf.org/html/rfc4867
- */
 bool mgcp_codec_amr_is_octet_aligned(const struct mgcp_rtp_codec *codec)
 {
-	if (!codec->param_present)
-		return false;
-	if (!codec->param.amr_octet_aligned_present)
-		return false;
-	return codec->param.amr_octet_aligned;
+	/* Legacy */
+	if (!codec->fmtp[0]
+	    && codec->param_present
+	    && codec->param.amr_octet_aligned_present)
+		return codec->param.amr_octet_aligned;
+
+	return osmo_sdp_fmtp_amr_is_octet_aligned(codec->fmtp);
 }

 /* Compare two codecs, all parameters must match up */
@@ -411,10 +348,20 @@ static bool codecs_convertible(struct mgcp_rtp_codec *codec_a, struct mgcp_rtp_c
 	/* OsmoMGW currently has no ability to transcode from one codec to another. However OsmoMGW is still able to
 	 * translate between different payload formats as long as the encoded voice data itself does not change.
 	 * Therefore we must insist on equal codecs but still allow different payload formatting. */
+
+	/* In 3G IuUP, AMR may be encapsulated in IuFP, this means even though the codec name and negotiated rate is
+	 * different, the formatting can still be converted by OsmoMGW. Therefore we won't insist on equal
+	 * subtype_name and rate if we detect IuFP and AMR is used on the same tandem. */
+	if (strcmp(codec_a->subtype_name, "AMR") == 0 && strcmp(codec_b->subtype_name, "VND.3GPP.IUFP") == 0)
+		goto iufp;
+	if (strcmp(codec_a->subtype_name, "VND.3GPP.IUFP") == 0 && strcmp(codec_b->subtype_name, "AMR") == 0)
+		goto iufp;
+
 	if (strcmp(codec_a->subtype_name, codec_b->subtype_name))
 		return false;
 	if (codec_a->rate != codec_b->rate)
 		return false;
+iufp:
 	if (codec_a->channels != codec_b->channels)
 		return false;
 	if (codec_a->frame_duration_num != codec_b->frame_duration_num)
@@ -425,11 +372,30 @@ static bool codecs_convertible(struct mgcp_rtp_codec *codec_a, struct mgcp_rtp_c
 	return true;
 }

-/*! For a given codec, find a convertible codec in the given connection.
- *  \param[in] conn connection to search for a convertible codec
- *  \param[in] codec for which a convertible codec shall be found.
- *  \returns codec on success, -NULL on failure. */
-struct mgcp_rtp_codec *mgcp_codec_find_convertible(struct mgcp_conn_rtp *conn, struct mgcp_rtp_codec *codec)
+struct mgcp_rtp_codec *mgcp_codec_find_same(struct mgcp_conn_rtp *conn, struct mgcp_rtp_codec *codec)
+{
+	struct mgcp_rtp_end *rtp_end;
+	unsigned int i;
+	unsigned int codecs_assigned;
+
+	rtp_end = &conn->end;
+
+	/* Use the codec information from the source and try to find the equivalent of it on the destination side. In
+	 * the first run we will look for an exact match. */
+	codecs_assigned = rtp_end->codecs_assigned;
+	OSMO_ASSERT(codecs_assigned <= MGCP_MAX_CODECS);
+	for (i = 0; i < codecs_assigned; i++) {
+		if (codecs_same(codec, &rtp_end->codecs[i])) {
+			return &rtp_end->codecs[i];
+			break;
+		}
+	}
+
+	return NULL;
+}
+
+/* For a given codec, find a convertible codec in the given connection. */
+static struct mgcp_rtp_codec *codec_find_convertible(struct mgcp_conn_rtp *conn, struct mgcp_rtp_codec *codec)
 {
 	struct mgcp_rtp_end *rtp_end;
 	unsigned int i;
@@ -440,27 +406,96 @@ struct mgcp_rtp_codec *mgcp_codec_find_convertible(struct mgcp_conn_rtp *conn, s

 	/* Use the codec information from the source and try to find the equivalent of it on the destination side. In
 	 * the first run we will look for an exact match. */
+	codec_convertible = mgcp_codec_find_same(conn, codec);
+	if (codec_convertible)
+		return codec_convertible;
+
+	/* In case we weren't able to find an exact match, we will try to find a match that is the same codec, but the
+	 * payload format may be different. This alternative will require a frame format conversion (i.e. AMR bwe->oe) */
 	codecs_assigned = rtp_end->codecs_assigned;
 	OSMO_ASSERT(codecs_assigned <= MGCP_MAX_CODECS);
 	for (i = 0; i < codecs_assigned; i++) {
-		if (codecs_same(codec, &rtp_end->codecs[i])) {
+		if (codecs_convertible(codec, &rtp_end->codecs[i])) {
 			codec_convertible = &rtp_end->codecs[i];
 			break;
 		}
 	}

-	/* In case we weren't able to find an exact match, we will try to find a match that is the same codec, but the
-	 * payload format may be different. This alternative will require a frame format conversion (i.e. AMR bwe->oe) */
-	if (!codec_convertible) {
-		for (i = 0; i < codecs_assigned; i++) {
-			if (codecs_convertible(codec, &rtp_end->codecs[i])) {
-				codec_convertible = &rtp_end->codecs[i];
-				break;
-			}
+	return codec_convertible;
+}
+
+/*! Decide for one suitable codec on both of the given connections. In case a destination connection is not available,
+ *  a tentative decision is made.
+ *  \param[inout] conn_src related rtp-connection.
+ *  \param[inout] conn_dst related destination rtp-connection (NULL if not present).
+ *  \returns 0 on success, -EINVAL on failure. */
+int mgcp_codec_decide(struct mgcp_conn_rtp *conn_src, struct mgcp_conn_rtp *conn_dst)
+{
+	unsigned int i;
+
+	/* In case no destination connection is available (yet), or in case the destination connection exists but has
+	 * no codecs assigned, we are forced to make a simple tentative decision:
+	 * We just use the first codec of the source connection (conn_src) */
+	OSMO_ASSERT(conn_src->end.codecs_assigned <= MGCP_MAX_CODECS);
+	if (!conn_dst || conn_dst->end.codecs_assigned == 0) {
+		if (conn_src->end.codecs_assigned >= 1) {
+			conn_src->end.codec = &conn_src->end.codecs[0];
+			return 0;
+		} else
+			return -EINVAL;
+	}
+
+	/* Compare all codecs of the source connection (conn_src) to the codecs of the destination connection (conn_dst). In case
+	 * of a match set this codec on both connections. This would be an ideal selection since no codec conversion would be
+	 * required. */
+	for (i = 0; i < conn_src->end.codecs_assigned; i++) {
+		struct mgcp_rtp_codec *codec_conn_src = &conn_src->end.codecs[i];
+		struct mgcp_rtp_codec *codec_conn_dst = mgcp_codec_find_same(conn_dst, codec_conn_src);
+		if (codec_conn_dst) {
+			/* We found the a codec that is exactly the same (same codec, same payload format etc.) on both
+			 * sides. We now set this codec on both connections. */
+			conn_dst->end.codec = codec_conn_dst;
+			conn_src->end.codec = codec_conn_src;
+			return 0;
 		}
 	}

-	return codec_convertible;
+	/* In case we could not find a codec that is exactly the same, let's at least try to find a codec that we are able
+	 * to convert. */
+	for (i = 0; i < conn_src->end.codecs_assigned; i++) {
+		struct mgcp_rtp_codec *codec_conn_src = &conn_src->end.codecs[i];
+		struct mgcp_rtp_codec *codec_conn_dst = codec_find_convertible(conn_dst, codec_conn_src);
+		if (codec_conn_dst) {
+			/* We found the a codec that we can convert to. Set each side to its codec. */
+			conn_dst->end.codec = codec_conn_dst;
+			conn_src->end.codec = codec_conn_src;
+			return 0;
+		}
+	}
+
+	if (conn_dst->end.codecs_assigned)
+		conn_dst->end.codec = &conn_dst->end.codecs[0];
+	else
+		return -EINVAL;
+
+	if (conn_src->end.codecs_assigned)
+		conn_src->end.codec = &conn_src->end.codecs[0];
+	else
+		return -EINVAL;
+
+	return 0;
+}
+
+/* Check if the codec has a specific AMR mode (octet-aligned or bandwith-efficient) set. */
+bool mgcp_codec_amr_align_mode_is_indicated(const struct mgcp_rtp_codec *codec)
+{
+	if (!codec->fmtp[0]) {
+		/* Legacy */
+		return codec->param_present && codec->param.amr_octet_aligned_present;
+	}
+
+	/* Just check for presence, not the actual value. */
+	return osmo_sdp_fmtp_get_val(NULL, 0, codec->fmtp, OSMO_SDP_STR_AMR_OCTET_ALIGN);
 }

 /* Find the payload type number configured for a specific codec by SDP.
--- a/src/libosmo-mgcp/mgcp_conn.c
+++ b/src/libosmo-mgcp/mgcp_conn.c
@@ -106,12 +106,10 @@ static int mgcp_rtp_conn_init(struct mgcp_conn_rtp *conn_rtp, struct mgcp_conn *
 	/* backpointer to the generic part of the connection */
 	conn->u.rtp.conn = conn;

-	end->rtp.fd = -1;
-	end->rtcp.fd = -1;
+	end->rtp = NULL;
+	end->rtcp = NULL;
 	memset(&end->addr, 0, sizeof(end->addr));
 	end->rtcp_port = 0;
-	talloc_free(end->fmtp_extra);
-	end->fmtp_extra = NULL;

 	/* Set default values */
 	end->frames_per_packet = 0;	/* unknown */
@@ -173,8 +171,8 @@ struct mgcp_conn *mgcp_conn_alloc(void *ctx, struct mgcp_endpoint *endp,
 	struct mgcp_conn *conn;
 	int rc;

-	/* Do not allow more then two connections */
-	if (llist_count(&endp->conns) >= endp->type->max_conns)
+	/* Do not allow more than the maximum number of connections */
+	if (endp->type->max_conns > 0 && llist_count(&endp->conns) >= endp->type->max_conns)
 		return NULL;

 	/* Create new connection and add it to the list */
@@ -358,53 +356,37 @@ char *mgcp_conn_dump(struct mgcp_conn *conn)
 {
 	static char str[sizeof(conn->name)+sizeof(conn->id)+256];
 	char ipbuf[INET6_ADDRSTRLEN];
+	struct osmo_strbuf sb = { .buf = str, .len = sizeof(str) };

-	if (!conn) {
-		snprintf(str, sizeof(str), "(null connection)");
-		return str;
-	}
+	if (!conn)
+		return "NULL";

 	switch (conn->type) {
 	case MGCP_CONN_TYPE_RTP:
+		OSMO_STRBUF_PRINTF(sb, "(%s/%s C:%s r=%s:%u<->l=%s:%u",
+				   conn->name,
+				   mgcp_conn_rtp_type_name(conn->type),
+				   conn->id,
+				   osmo_sockaddr_ntop(&conn->u.rtp.end.addr.u.sa, ipbuf) ? : "NULL",
+				   osmo_sockaddr_port(&conn->u.rtp.end.addr.u.sa),
+				   conn->u.rtp.end.local_addr ? : "NULL",
+				   conn->u.rtp.end.local_port);
+
 		switch (conn->u.rtp.type) {
-		case MGCP_RTP_DEFAULT:
-			/* Dump RTP connection */
-			snprintf(str, sizeof(str), "(%s/rtp, id:0x%s, ip:%s, "
-				"rtp:%u rtcp:%u)",
-				conn->name, conn->id,
-				osmo_sockaddr_ntop(&conn->u.rtp.end.addr.u.sa, ipbuf),
-				osmo_sockaddr_port(&conn->u.rtp.end.addr.u.sa),
-				ntohs(conn->u.rtp.end.rtcp_port));
-			break;
 		case MGCP_RTP_OSMUX:
-			snprintf(str, sizeof(str), "(%s/osmux, id:0x%s, ip:%s, "
-				"port:%u CID:%u)",
-				conn->name, conn->id,
-				osmo_sockaddr_ntop(&conn->u.rtp.end.addr.u.sa, ipbuf),
-				osmo_sockaddr_port(&conn->u.rtp.end.addr.u.sa),
-				conn->u.rtp.osmux.local_cid);
-			break;
-		case MGCP_RTP_IUUP:
-			snprintf(str, sizeof(str), "(%s/iuup, id:0x%s, ip:%s, "
-				"port:%u)",
-				conn->name, conn->id,
-				osmo_sockaddr_ntop(&conn->u.rtp.end.addr.u.sa, ipbuf),
-				osmo_sockaddr_port(&conn->u.rtp.end.addr.u.sa));
+			OSMO_STRBUF_PRINTF(sb, " CID=%u", conn->u.rtp.osmux.local_cid);
 			break;
 		default:
-			/* Should not happen, we should be able to dump
-			 * every possible connection type. */
-			snprintf(str, sizeof(str), "(unknown conn_rtp connection type %u)",
-				 conn->u.rtp.type);
 			break;
 		}
+
+		OSMO_STRBUF_PRINTF(sb, ")");
 		break;

 	default:
 		/* Should not happen, we should be able to dump
 		 * every possible connection type. */
-		snprintf(str, sizeof(str), "(unknown connection type)");
-		break;
+		return "(unknown connection type)";
 	}

 	return str;
@@ -441,3 +423,10 @@ struct mgcp_conn *mgcp_conn_get_oldest(struct mgcp_endpoint *endp)

 	return llist_last_entry(&endp->conns, struct mgcp_conn, entry);
 }
+
+const struct value_string mgcp_conn_rtp_type_names[] = {
+	{ MGCP_RTP_DEFAULT, "rtp" },
+	{ MGCP_RTP_OSMUX, "osmux" },
+	{ MGCP_RTP_IUUP, "iuup" },
+	{}
+};
--- a/src/libosmo-mgcp/mgcp_e1.c
+++ b/src/libosmo-mgcp/mgcp_e1.c
@@ -301,7 +301,6 @@ static void sync_frame_out_cb(void *user_data, const ubit_t *bits, unsigned int

 	mgcp_send(endp, 1, NULL, msg, &conn_dst->u.rtp, &conn_dst->u.rtp);

-	msgb_free(msg);
 	return;
 skip:
 	rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, E1_I460_TRAU_RX_FAIL_CTR));
--- a/src/libosmo-mgcp/mgcp_endp.c
+++ b/src/libosmo-mgcp/mgcp_endp.c
@@ -38,7 +38,6 @@
 const struct mgcp_endpoint_typeset ep_typeset = {
 	/* Specify endpoint properties for RTP endpoint */
 	.rtp = {
-		.max_conns = 2,
 		.dispatch_rtp_cb = mgcp_dispatch_rtp_bridge_cb,
 		.cleanup_cb = mgcp_cleanup_rtp_bridge_cb,
 	},
@@ -229,6 +228,17 @@ bool mgcp_endp_is_wildcarded(const char *epname)
 	return false;
 }

+/*! Check if the given epname refers to a "null" endpoint.
+ *  \param[in] epname endpoint name to check
+ *  \returns true if epname refers to "null"" endpoint, else false. */
+bool mgcp_endp_is_null(const char *epname)
+{
+	if (strncasecmp(epname, "null@", 5) == 0)
+		return true;
+
+	return false;
+}
+
 /*! Find an endpoint by its name on a specified trunk.
 *  \param[out] cause pointer to store cause code, can be NULL.
 *  \param[in] epname endpoint name to lookup.
--- a/src/libosmo-mgcp/mgcp_iuup.c
+++ b/src/libosmo-mgcp/mgcp_iuup.c
@@ -311,7 +311,6 @@ static int bridge_iuup_to_rtp_peer(struct mgcp_conn_rtp *conn_rtp_src, struct mg
 	};

 	rc = mgcp_send(conn_rtp_dst->conn->endp, true, NULL, msg, conn_rtp_src, conn_rtp_dst);
-	msgb_free(msg);
 	return rc;
 }

@@ -469,7 +468,7 @@ static int mgcp_send_iuup(struct mgcp_endpoint *endp, struct msgb *msg,
 	struct rtp_hdr *hdr = (struct rtp_hdr *)msgb_data(msg);
 	int buflen = msgb_length(msg);
 	char *dest_name;
-	int len;
+	int rc;

 	OSMO_ASSERT(conn_src);
 	OSMO_ASSERT(conn_dst);
@@ -506,6 +505,7 @@ static int mgcp_send_iuup(struct mgcp_endpoint *endp, struct msgb *msg,
 	hdr->timestamp = osmo_htonl(mgcp_get_current_ts(rtp_end->codec->rate));
 	hdr->sequence = osmo_htons(rtp_state->alt_rtp_tx_sequence);
 	hdr->ssrc = rtp_state->alt_rtp_tx_ssrc;
+	rtp_state->alt_rtp_tx_sequence++;

 	LOGPENDP(endp, DRTP, LOGL_DEBUG,
 		 "process/send IuUP to %s %s rtp_port:%u rtcp_port:%u\n",
@@ -513,19 +513,17 @@ static int mgcp_send_iuup(struct mgcp_endpoint *endp, struct msgb *msg,
 		 osmo_sockaddr_port(&rtp_end->addr.u.sa), ntohs(rtp_end->rtcp_port));

 	/* Forward a copy of the RTP data to a debug ip/port */
-	forward_data_tap(rtp_end->rtp.fd, &conn_src->tap_out,
-		     msg);
+	forward_data_tap(rtp_end->rtp, &conn_src->tap_out, msg);

-	len = mgcp_udp_send(rtp_end->rtp.fd, &rtp_end->addr, (char *)hdr, buflen);
+	rc = mgcp_udp_send(rtp_end->rtp, &rtp_end->addr, (char *)hdr, buflen);

-	if (len <= 0)
-		return len;
+	if (rc < 0)
+		return rc;

 	rtpconn_rate_ctr_add(conn_dst, endp, RTP_PACKETS_TX_CTR, 1);
-	rtpconn_rate_ctr_add(conn_dst, endp, RTP_OCTETS_TX_CTR, len);
-	rtp_state->alt_rtp_tx_sequence++;
+	rtpconn_rate_ctr_add(conn_dst, endp, RTP_OCTETS_TX_CTR, buflen);

-	return len;
+	return 0;
 }

 /* Received TNL primitive from IuUP layer FSM, transmit it further down to the
@@ -640,7 +638,7 @@ free_ret:
 }

 /* Build IuUP RNL Data primitive from msg containing an incoming RTP pkt from
- * peer and send it down the IuUP layer towards the destination as IuUP/RTP: */
+ * peer and send it down the IuUP layer towards the destination as IuUP/RTP. Takes ownership of msg. */
 int mgcp_conn_iuup_send_rtp(struct mgcp_conn_rtp *conn_src_rtp, struct mgcp_conn_rtp *conn_dest_rtp, struct msgb *msg)
 {
 	struct osmo_iuup_rnl_prim *irp;
--- a/src/libosmo-mgcp/mgcp_msg.c
+++ b/src/libosmo-mgcp/mgcp_msg.c
@@ -75,7 +75,7 @@ void mgcp_disp_msg(unsigned char *message, unsigned int len, char *preamble)
 }

 /*! Parse connection mode.
- *  \param[in] mode as string (recvonly, sendrecv, sendonly or loopback)
+ *  \param[in] mode as string (recvonly, sendrecv, sendonly confecho or loopback)
 *  \param[in] endp pointer to endpoint (only used for log output)
 *  \param[out] associated connection to be modified accordingly
 *  \returns 0 on success, -1 on error */
@@ -100,6 +100,8 @@ int mgcp_parse_conn_mode(const char *mode, struct mgcp_endpoint *endp,
 		conn->mode = MGCP_CONN_RECV_SEND;
 	else if (strcasecmp(mode, "sendonly") == 0)
 		conn->mode = MGCP_CONN_SEND_ONLY;
+	else if (strcasecmp(mode, "confecho") == 0)
+		conn->mode = MGCP_CONN_CONFECHO;
 	else if (strcasecmp(mode, "loopback") == 0)
 		conn->mode = MGCP_CONN_LOOPBACK;
 	else {
--- a/src/libosmo-mgcp/mgcp_network.c
+++ b/src/libosmo-mgcp/mgcp_network.c
@@ -4,6 +4,7 @@
 /*
 * (C) 2009-2012 by Holger Hans Peter Freyther <zecke@selfish.org>
 * (C) 2009-2012 by On-Waves
+ * (C) 2013-2024 by sysmocom - s.f.m.c. GmbH
 * All Rights Reserved
 *
 * This program is free software; you can redistribute it and/or modify
@@ -70,6 +71,18 @@ void rtpconn_rate_ctr_inc(struct mgcp_conn_rtp *conn_rtp, struct mgcp_endpoint *
 	rtpconn_rate_ctr_add(conn_rtp, endp, id, 1);
 }

+/* wrapper around libosmocore msgb_copy_c, which [at least before libosmocore.git Change-Id
+ * I68328adb952ca8833ba047cb3b49ccc6f8a1f1b5] doesn't copy the cb */
+static inline struct msgb *mgw_msgb_copy_c(void *ctx, struct msgb *msg, const char *name)
+{
+	struct msgb *msg2 = msgb_copy_c(ctx, msg, name);
+	if (OSMO_UNLIKELY(!msg2))
+		return NULL;
+
+	memcpy(msg2->cb, msg->cb, sizeof(msg2->cb));
+	return msg2;
+}
+
 static int rx_rtp(struct msgb *msg);

 bool mgcp_rtp_end_remote_addr_available(const struct mgcp_rtp_end *rtp_end)
@@ -404,15 +417,12 @@ static int align_rtp_timestamp_offset(const struct mgcp_endpoint *endp,
 /*! dummy callback to disable transcoding (see also cfg->rtp_processing_cb).
 *  \param[in] associated endpoint.
 *  \param[in] destination RTP end.
- *  \param[in,out] pointer to buffer with voice data.
- *  \param[in] voice data length.
- *  \param[in] maximum size of caller provided voice data buffer.
+ *  \param[in,out] msg message bufffer containing data. Function might change length.
 *  \returns ignores input parameters, return always 0. */
 int mgcp_rtp_processing_default(struct mgcp_endpoint *endp,
 				struct mgcp_rtp_end *dst_end,
-				char *data, int *len, int buf_size)
+				struct msgb *msg)
 {
-	LOGPENDP(endp, DRTP, LOGL_DEBUG, "transcoding disabled\n");
 	return 0;
 }

@@ -429,18 +439,6 @@ int mgcp_setup_rtp_processing_default(struct mgcp_endpoint *endp,
 	return 0;
 }

-void mgcp_get_net_downlink_format_default(struct mgcp_endpoint *endp,
-					  const struct mgcp_rtp_codec **codec,
-					  const char **fmtp_extra,
-					  struct mgcp_conn_rtp *conn)
-{
-	LOGPENDP(endp, DRTP, LOGL_DEBUG, "conn:%s using format defaults\n",
-		 mgcp_conn_dump(conn->conn));
-
-	*codec = conn->end.codec;
-	*fmtp_extra = conn->end.fmtp_extra;
-}
-
 void mgcp_rtp_annex_count(const struct mgcp_endpoint *endp,
 			  struct mgcp_rtp_state *state, const uint16_t seq,
 			  const int32_t transit, const uint32_t ssrc,
@@ -492,32 +490,24 @@ void mgcp_rtp_annex_count(const struct mgcp_endpoint *endp,

 /* There may be different payload type numbers negotiated for two connections.
 * Patch the payload type of an RTP packet so that it uses the payload type
- * that is valid for the destination connection (conn_dst) */
-static int mgcp_patch_pt(struct mgcp_conn_rtp *conn_src, struct mgcp_conn_rtp *conn_dst, struct msgb *msg)
+ * of the codec that is set for the destination connection (conn_dst) */
+static int mgcp_patch_pt(struct mgcp_conn_rtp *conn_dst, struct msgb *msg)
 {
 	struct rtp_hdr *rtp_hdr;
-	struct mgcp_rtp_codec *codec_src;
-	struct mgcp_rtp_codec *codec_dst;

 	if (msgb_length(msg) < sizeof(struct rtp_hdr)) {
-		LOG_CONN_RTP(conn_src, LOGL_ERROR, "RTP packet too short (%u < %zu)\n",
+		LOG_CONN_RTP(conn_dst, LOGL_NOTICE, "RTP packet too short (%u < %zu)\n",
 			     msgb_length(msg), sizeof(struct rtp_hdr));
 		return -EINVAL;
 	}
 	rtp_hdr = (struct rtp_hdr *)msgb_data(msg);

-	/* Find the codec information that is used on the source side */
-	codec_src = mgcp_codec_from_pt(conn_src, rtp_hdr->payload_type);
-	if (!codec_src)
+	if (!conn_dst->end.codec) {
+		LOG_CONN_RTP(conn_dst, LOGL_NOTICE, "no codec set on destination connection!\n");
 		return -EINVAL;
+	}
+	rtp_hdr->payload_type = (uint8_t) conn_dst->end.codec->payload_type;

-	/* Lookup a suitable codec in the destination connection. (The codec must be of the same type or at least
-	 * convertible) */
-	codec_dst = mgcp_codec_find_convertible(conn_dst, codec_src);
-	if (!codec_dst)
-		return -EINVAL;
-
-	rtp_hdr->payload_type = (uint8_t) codec_dst->payload_type;
 	return 0;
 }

@@ -805,16 +795,18 @@ static int amr_oa_check(char *data, int len)

 /* Forward data to a debug tap. This is debug function that is intended for
 * debugging the voice traffic with tools like gstreamer */
-void forward_data_tap(int fd, struct mgcp_rtp_tap *tap, struct msgb *msg)
+void forward_data_tap(struct osmo_io_fd *iofd, struct mgcp_rtp_tap *tap, struct msgb *msg)
 {
 	int rc;

 	if (!tap->enabled)
 		return;

-	rc = sendto(fd, msgb_data(msg), msgb_length(msg), 0, (struct sockaddr *)&tap->forward,
-		    sizeof(tap->forward));
+	struct msgb *msg2 = msgb_copy(msg, "RTP TAP Tx");
+	if (!msg2)
+		return;

+	rc = osmo_iofd_sendto_msgb(iofd, msg2, 0, &tap->forward);
 	if (rc < 0)
 		LOGP(DRTP, LOGL_ERROR,
 		     "Forwarding tapped (debug) voice data failed.\n");
@@ -842,32 +834,27 @@ static int check_rtp_origin(struct mgcp_conn_rtp *conn, struct osmo_sockaddr *ad
 {
 	char ipbuf[INET6_ADDRSTRLEN];

-	if (osmo_sockaddr_is_any(&conn->end.addr) != 0) {
-		switch (conn->conn->mode) {
-		case MGCP_CONN_LOOPBACK:
-			/* HACK: for IuUP, we want to reply with an IuUP Initialization ACK upon the first RTP
-			 * message received. We currently hackishly accomplish that by putting the endpoint in
-			 * loopback mode and patching over the looped back RTP message to make it look like an
-			 * ack. We don't know the femto cell's IP address and port until the RAB Assignment
-			 * Response is received, but the nano3G expects an IuUP Initialization Ack before it even
-			 * sends the RAB Assignment Response. Hence, if the remote address is 0.0.0.0 and the
-			 * MGCP port is in loopback mode, allow looping back the packet to any source. */
-			LOGPCONN(conn->conn, DRTP, LOGL_ERROR,
-				 "In loopback mode and remote address not set:"
-				 " allowing data from address: %s\n",
-				 osmo_sockaddr_ntop(&addr->u.sa, ipbuf));
-			return 0;
-
-		default:
-			/* Receiving early media before the endpoint is configured. Instead of logging
-			 * this as an error that occurs on every call, keep it more low profile to not
-			 * confuse humans with expected errors. */
+	if (osmo_sockaddr_is_any(&conn->end.addr) != 0 ||
+	    osmo_sockaddr_port(&conn->end.addr.u.sa) == 0) {
+		if (mgcp_conn_rtp_is_iuup(conn) && !conn->iuup.configured) {
+			/* Allow IuUP Initialization to get through even if we don't have a remote address set yet.
+			 * This is needed because hNodeB doesn't announce its IuUP remote IP addr to the MGCP client
+			 * (RAB Assignment Response at HNBGW) until it has gone through IuUP Initialization against
+			 * this MGW here. Hence the MGW may not yet know the remote IuUP address and port at the time
+			 * of receiving IuUP Initialization from the hNodeB.
+			 */
 			LOGPCONN(conn->conn, DRTP, LOGL_INFO,
-				 "Rx RTP from %s, but remote address not set:"
-				 " dropping early media\n",
-				 osmo_sockaddr_ntop(&addr->u.sa, ipbuf));
-			return -1;
+				 "Rx RTP from %s: allowing unknown src for IuUP Initialization\n",
+				 osmo_sockaddr_to_str(addr));
+			return 0;
 		}
+		/* Receiving early media before the endpoint is configured. Instead of logging
+		 * this as an error that occurs on every call, keep it more low profile to not
+		 * confuse humans with expected errors. */
+		LOGPCONN(conn->conn, DRTP, LOGL_INFO,
+			 "Rx RTP from %s, but remote address not set: dropping early media\n",
+			 osmo_sockaddr_to_str(addr));
+		return -1;
 	}

 	/* Note: Check if the inbound RTP data comes from the same host to
@@ -879,11 +866,8 @@ static int check_rtp_origin(struct mgcp_conn_rtp *conn, struct osmo_sockaddr *ad
 	     memcmp(&conn->end.addr.u.sin6.sin6_addr, &addr->u.sin6.sin6_addr,
 		    sizeof(struct in6_addr)))) {
 		LOGPCONN(conn->conn, DRTP, LOGL_ERROR,
-			 "data from wrong address: %s, ",
-			 osmo_sockaddr_ntop(&addr->u.sa, ipbuf));
-		LOGPC(DRTP, LOGL_ERROR, "expected: %s\n",
-		      osmo_sockaddr_ntop(&conn->end.addr.u.sa, ipbuf));
-		LOGPCONN(conn->conn, DRTP, LOGL_ERROR, "packet tossed\n");
+			 "data from wrong src %s, expected IP Address %s. Packet tossed.\n",
+			 osmo_sockaddr_to_str(addr), osmo_sockaddr_ntop(&conn->end.addr.u.sa, ipbuf));
 		return -1;
 	}

@@ -894,12 +878,9 @@ static int check_rtp_origin(struct mgcp_conn_rtp *conn, struct osmo_sockaddr *ad
 	if (osmo_sockaddr_port(&conn->end.addr.u.sa) != osmo_sockaddr_port(&addr->u.sa) &&
 	    ntohs(conn->end.rtcp_port) != osmo_sockaddr_port(&addr->u.sa)) {
 		LOGPCONN(conn->conn, DRTP, LOGL_ERROR,
-			 "data from wrong source port: %d, ",
-			 osmo_sockaddr_port(&addr->u.sa));
-		LOGPC(DRTP, LOGL_ERROR,
-		      "expected: %d for RTP or %d for RTCP\n",
-		      osmo_sockaddr_port(&conn->end.addr.u.sa), ntohs(conn->end.rtcp_port));
-		LOGPCONN(conn->conn, DRTP, LOGL_ERROR, "packet tossed\n");
+			 "data from wrong src %s, expected port: %u for RTP or %u for RTCP. Packet tossed.\n",
+			 osmo_sockaddr_to_str(addr), osmo_sockaddr_port(&conn->end.addr.u.sa),
+			 ntohs(conn->end.rtcp_port));
 		return -1;
 	}

@@ -997,7 +978,7 @@ static int check_rtp(struct mgcp_conn_rtp *conn_src, struct msgb *msg)
 	return 0;
 }

-/*! Dispatch msg bridged from the sister conn in the endpoint.
+/*! Dispatch msg bridged from the sister conn in the endpoint. Takes ownership of msgb.
 *  \param[in] conn_dst The destination conn that should handle and transmit the content to
 *			its peer outside MGW.
 *  \param[in] msg msgb containing an RTP pkt received by the sister conn in the endpoint,
@@ -1019,8 +1000,10 @@ static int mgcp_conn_rtp_dispatch_rtp(struct mgcp_conn_rtp *conn_dst, struct msg
 	/* Before we try to deliver the packet, we check if the destination
 	 * port and IP-Address make sense at all. If not, we will be unable
 	 * to deliver the packet. */
-	if (check_rtp_destin(conn_dst) != 0)
+	if (check_rtp_destin(conn_dst) != 0) {
+		msgb_free(msg);
 		return -1;
+	}

 	/* Depending on the RTP connection type, deliver the RTP packet to the
 	 * destination connection. */
@@ -1055,39 +1038,46 @@ static int mgcp_conn_rtp_dispatch_rtp(struct mgcp_conn_rtp *conn_dst, struct msg
 	 * be discarded, this should not happen, normally the MGCP type
 	 * should be properly set */
 	LOGPENDP(endp, DRTP, LOGL_ERROR, "bad MGCP type -- data discarded!\n");
-
+	msgb_free(msg);
 	return -1;
 }

-/*! send udp packet.
- *  \param[in] fd associated file descriptor.
+/*! send message buffer via udp socket.  If it succeeds, it takes ownership of the msgb and internally calls
+ *  msgb_free() after the aynchronous sendto() completes.  In case of error, the msgb is still owned by the
+ *  caller and must be free'd accordingly.
+ *  \param[in] iofd associated file descriptor.
+ *  \param[in] addr destination ip-address.
+ *  \param[in] msg message buffer that holds the data to be send.
+ *  \returns 0 in case of success (takes msgb ownership), -1 on error (doesn't take msgb ownership). */
+static int mgcp_udp_send_msg(struct osmo_io_fd *iofd, const struct osmo_sockaddr *addr, struct msgb *msg)
+{
+	LOGP(DRTP, LOGL_DEBUG, "sending %d bytes length packet to %s ...\n", msgb_length(msg),
+	     osmo_sockaddr_to_str(addr));
+
+	return osmo_iofd_sendto_msgb(iofd, msg, 0, addr);
+}
+
+/*! send udp packet from raw buffer/length.
+ *  \param[in] iofd associated file descriptor.
 *  \param[in] addr destination ip-address.
 *  \param[in] buf buffer that holds the data to be send.
 *  \param[in] len length of the data to be sent.
- *  \returns bytes sent, -1 on error. */
-int mgcp_udp_send(int fd, const struct osmo_sockaddr *addr, const char *buf, int len)
+ *  \returns 0 in case of success, -1 on error. */
+int mgcp_udp_send(struct osmo_io_fd *iofd, const struct osmo_sockaddr *addr, const char *buf, int len)
 {
-	char ipbuf[INET6_ADDRSTRLEN];
-	size_t addr_len;
+	struct msgb *msg = msgb_alloc_c(iofd, len, "mgcp_udp_send");
+	if (!msg)
+		return -ENOMEM;
+	memcpy(msg->tail, buf, len);
+	msgb_put(msg, len);

-	LOGP(DRTP, LOGL_DEBUG,
-	     "sending %i bytes length packet to %s:%u ...\n", len,
-	     osmo_sockaddr_ntop(&addr->u.sa, ipbuf),
-	     osmo_sockaddr_port(&addr->u.sa));
-
-	if (addr->u.sa.sa_family == AF_INET6) {
-		addr_len = sizeof(addr->u.sin6);
-	} else {
-		addr_len = sizeof(addr->u.sin);
-	}
-
-	return sendto(fd, buf, len, 0, &addr->u.sa, addr_len);
+	return mgcp_udp_send_msg(iofd, addr, msg);
 }

 /*! send RTP dummy packet (to keep NAT connection open).
 *  \param[in] endp mcgp endpoint that holds the RTP connection.
 *  \param[in] conn associated RTP connection.
- *  \returns bytes sent, -1 on error. */
+ *  \returns 0 in case of success, -1 on error. */
 int mgcp_send_dummy(struct mgcp_endpoint *endp, struct mgcp_conn_rtp *conn)
 {
 	int rc;
@@ -1109,8 +1099,7 @@ int mgcp_send_dummy(struct mgcp_endpoint *endp, struct mgcp_conn_rtp *conn)
 	if (mgcp_conn_rtp_is_iuup(conn))
 		rc = mgcp_conn_iuup_send_dummy(conn);
 	else
-		rc = mgcp_udp_send(conn->end.rtp.fd, &conn->end.addr,
-				   rtp_dummy_payload, sizeof(rtp_dummy_payload));
+		rc = mgcp_udp_send(conn->end.rtp, &conn->end.addr, rtp_dummy_payload, sizeof(rtp_dummy_payload));

 	if (rc == -1)
 		goto failed;
@@ -1121,10 +1110,10 @@ int mgcp_send_dummy(struct mgcp_endpoint *endp, struct mgcp_conn_rtp *conn)
 	was_rtcp = 1;
 	rtcp_addr = conn->end.addr;
 	osmo_sockaddr_set_port(&rtcp_addr.u.sa, ntohs(conn->end.rtcp_port));
-	rc = mgcp_udp_send(conn->end.rtcp.fd, &rtcp_addr,
+	rc = mgcp_udp_send(conn->end.rtcp, &rtcp_addr,
 			   rtp_dummy_payload, sizeof(rtp_dummy_payload));

-	if (rc >= 0)
+	if (rc == 0)
 		return rc;

 failed:
@@ -1135,15 +1124,14 @@ failed:
 	return -1;
 }

-/*! Send RTP/RTCP data to a specified destination connection.
+/*! Send RTP/RTCP data to a specified destination connection. Takes ownership of msg.
 *  \param[in] endp associated endpoint (for configuration, logging).
 *  \param[in] is_rtp flag to specify if the packet is of type RTP or RTCP.
- *  \param[in] spoofed source address (set to NULL to disable).
- *  \param[in] buf buffer that contains the RTP/RTCP data.
- *  \param[in] len length of the buffer that contains the RTP/RTCP data.
+ *  \param[in] addr spoofed source address (set to NULL to disable).
+ *  \param[in] msg message buffer that contains the RTP/RTCP data.
 *  \param[in] conn_src associated source connection.
 *  \param[in] conn_dst associated destination connection.
- *  \returns 0 on success, -1 on ERROR. */
+ *  \returns 0 on success, negative on ERROR. */
 int mgcp_send(struct mgcp_endpoint *endp, int is_rtp, struct osmo_sockaddr *addr,
 	      struct msgb *msg, struct mgcp_conn_rtp *conn_src,
 	      struct mgcp_conn_rtp *conn_dst)
@@ -1173,18 +1161,10 @@ int mgcp_send(struct mgcp_endpoint *endp, int is_rtp, struct osmo_sockaddr *addr
 	 * IuUP -> AMR: calls this function, skip patching if conn_src is IuUP.
 	 * {AMR or IuUP} -> IuUP: calls mgcp_udp_send() directly, skipping this function: No need to examine dst. */
 	if (is_rtp && !mgcp_conn_rtp_is_iuup(conn_src)) {
-		rc = mgcp_patch_pt(conn_src, conn_dst, msg);
-		if (rc < 0) {
-			/* FIXME: It is legal that the payload type on the egress connection is
-			 * different from the payload type that has been negotiated on the
-			 * ingress connection. Essentially the codecs are the same so we can
-			 * match them and patch the payload type. However, if we can not find
-			 * the codec pendant (everything ist equal except the PT), we are of
-			 * course unable to patch the payload type. A situation like this
-			 * should not occur if transcoding is consequently avoided. Until
-			 * we have transcoding support in osmo-mgw we can not resolve this. */
-			LOGPENDP(endp, DRTP, LOGL_DEBUG,
-				 "can not patch PT because no suitable egress codec was found.\n");
+		if (mgcp_patch_pt(conn_dst, msg) < 0) {
+			LOGPENDP(endp, DRTP, LOGL_NOTICE, "unable to patch payload type RTP packet, discarding...\n");
+			msgb_free(msg);
+			return -EINVAL;
 		}
 	}

@@ -1209,70 +1189,67 @@ int mgcp_send(struct mgcp_endpoint *endp, int is_rtp, struct osmo_sockaddr *addr
 			 osmo_sockaddr_port(&rtp_end->addr.u.sa), ntohs(rtp_end->rtcp_port)
 		    );
 	} else if (is_rtp) {
-		int cont;
-		int nbytes = 0;
-		int buflen = msgb_length(msg);
-
 		/* Make sure we have a valid RTP header, in cases where no RTP
 		 * header is present, we will generate one. */
 		gen_rtp_header(msg, rtp_end, rtp_state);

-		do {
-			/* Run transcoder */
-			cont = endp->trunk->cfg->rtp_processing_cb(endp, rtp_end, (char *)msgb_data(msg), &buflen, RTP_BUF_SIZE);
-			if (cont < 0)
-				break;
+		/* Run transcoder */
+		rc = endp->trunk->cfg->rtp_processing_cb(endp, rtp_end, msg);
+		if (rc < 0) {
+			LOGPENDP(endp, DRTP, LOGL_ERROR, "Error %d during transcoding\n", rc);
+			msgb_free(msg);
+			return rc;
+		}

-			if (addr)
-				mgcp_patch_and_count(endp, rtp_state, rtp_end,
-						     addr, msg);
+		if (addr)
+			mgcp_patch_and_count(endp, rtp_state, rtp_end, addr, msg);

-			if (mgcp_conn_rtp_is_iuup(conn_dst) || mgcp_conn_rtp_is_iuup(conn_src)) {
-				/* the iuup code will correctly transform to the correct AMR mode */
-			} else if (mgcp_codec_amr_align_mode_is_indicated(conn_dst->end.codec)) {
-				rc = amr_oa_bwe_convert(endp, msg,
-							conn_dst->end.codec->param.amr_octet_aligned);
-				if (rc < 0) {
-					LOGPENDP(endp, DRTP, LOGL_ERROR,
-						 "Error in AMR octet-aligned <-> bandwidth-efficient mode conversion (target=%s)\n",
-						 conn_dst->end.codec->param.amr_octet_aligned ? "octet-aligned" : "bandwidth-efficient");
-					break;
-				}
-			} else if (rtp_end->rfc5993_hr_convert &&
-				   strcmp(conn_src->end.codec->subtype_name, "GSM-HR-08") == 0) {
-				rc = rfc5993_hr_convert(endp, msg);
-				if (rc < 0) {
-					LOGPENDP(endp, DRTP, LOGL_ERROR, "Error while converting to GSM-HR-08\n");
-					break;
-				}
+		if (mgcp_conn_rtp_is_iuup(conn_dst) || mgcp_conn_rtp_is_iuup(conn_src)) {
+			/* the iuup code will correctly transform to the correct AMR mode */
+		} else if (mgcp_codec_amr_align_mode_is_indicated(conn_dst->end.codec)) {
+			bool oa = mgcp_codec_amr_is_octet_aligned(conn_dst->end.codec);
+			rc = amr_oa_bwe_convert(endp, msg, oa);
+			if (rc < 0) {
+				LOGPENDP(endp, DRTP, LOGL_ERROR,
+					 "Error in AMR octet-aligned <-> bandwidth-efficient mode conversion (target=%s)\n",
+					 oa ? "octet-aligned" : "bandwidth-efficient");
+				msgb_free(msg);
+				return rc;
 			}
+		} else if (rtp_end->rfc5993_hr_convert &&
+			   strcmp(conn_src->end.codec->subtype_name, "GSM-HR-08") == 0) {
+			rc = rfc5993_hr_convert(endp, msg);
+			if (rc < 0) {
+				LOGPENDP(endp, DRTP, LOGL_ERROR, "Error while converting to GSM-HR-08\n");
+				msgb_free(msg);
+				return rc;
+			}
+		}

-			LOGPENDP(endp, DRTP, LOGL_DEBUG,
-				 "process/send to %s %s "
-				 "rtp_port:%u rtcp_port:%u\n",
-				 dest_name,
-				 osmo_sockaddr_ntop(&rtp_end->addr.u.sa, ipbuf),
-				 osmo_sockaddr_port(&rtp_end->addr.u.sa), ntohs(rtp_end->rtcp_port)
-				);
+		LOGPENDP(endp, DRTP, LOGL_DEBUG,
+			 "process/send to %s %s "
+			 "rtp_port:%u rtcp_port:%u\n",
+			 dest_name,
+			 osmo_sockaddr_ntop(&rtp_end->addr.u.sa, ipbuf),
+			 osmo_sockaddr_port(&rtp_end->addr.u.sa), ntohs(rtp_end->rtcp_port)
+			);

-			/* Forward a copy of the RTP data to a debug ip/port */
-			forward_data_tap(rtp_end->rtp.fd, &conn_src->tap_out,
-				     msg);
+		/* Forward a copy of the RTP data to a debug ip/port */
+		forward_data_tap(rtp_end->rtp, &conn_src->tap_out, msg);

-			len = mgcp_udp_send(rtp_end->rtp.fd, &rtp_end->addr,
-					    (char *)msgb_data(msg), msgb_length(msg));
+		len = msgb_length(msg);

-			if (len <= 0)
-				return len;
+		rc = mgcp_udp_send_msg(rtp_end->rtp, &rtp_end->addr, msg);
+		if (rc < 0) {
+			msgb_free(msg);
+			return rc;
+		}

-			rtpconn_rate_ctr_inc(conn_dst, endp, RTP_PACKETS_TX_CTR);
-			rtpconn_rate_ctr_add(conn_dst, endp, RTP_OCTETS_TX_CTR, len);
-			rtp_state->alt_rtp_tx_sequence++;
+		rtpconn_rate_ctr_inc(conn_dst, endp, RTP_PACKETS_TX_CTR);
+		rtpconn_rate_ctr_add(conn_dst, endp, RTP_OCTETS_TX_CTR, len);
+		rtp_state->alt_rtp_tx_sequence++;

-			nbytes += len;
-			buflen = cont;
-		} while (buflen > 0);
-		return nbytes;
+		return 0;
 	} else if (!trunk->omit_rtcp) {
 		struct osmo_sockaddr rtcp_addr = rtp_end->addr;
 		osmo_sockaddr_set_port(&rtcp_addr.u.sa, rtp_end->rtcp_port);
@@ -1283,19 +1260,54 @@ int mgcp_send(struct mgcp_endpoint *endp, int is_rtp, struct osmo_sockaddr *addr
 			 osmo_sockaddr_port(&rtcp_addr.u.sa)
 			);

-		len = mgcp_udp_send(rtp_end->rtcp.fd, &rtcp_addr,
-				    (char *)msgb_data(msg), msgb_length(msg));
+		len = msgb_length(msg);
+
+		rc = mgcp_udp_send_msg(rtp_end->rtcp, &rtcp_addr, msg);
+		if (rc < 0) {
+			msgb_free(msg);
+			return rc;
+		}

 		rtpconn_rate_ctr_inc(conn_dst, endp, RTP_PACKETS_TX_CTR);
 		rtpconn_rate_ctr_add(conn_dst, endp, RTP_OCTETS_TX_CTR, len);
 		rtp_state->alt_rtp_tx_sequence++;

-		return len;
+		return 0;
 	}

+	msgb_free(msg);
 	return 0;
 }

+/*! determine if there's only a single recipient in endp for data received via conn_src.
+ *  The function returns NULL in case there is no recipient, or in case there are multiple recipients.
+ *  \param endp The MGCP endpoint whose connections to analyze
+ *  \param conn_src The source MGCP connection [which shall not count in results]
+ *  \returns recipient donnection if there is only one; NULL in case there are multiple */
+static struct mgcp_conn *rtpbridge_get_only_recipient(struct mgcp_endpoint *endp, struct mgcp_conn *conn_src)
+{
+	struct mgcp_conn *conn_ret = NULL;
+	struct mgcp_conn *conn_dst;
+
+	llist_for_each_entry(conn_dst, &endp->conns, entry) {
+		if (conn_dst == conn_src)
+			continue;
+		switch (conn_dst->mode) {
+		case MGCP_CONN_SEND_ONLY:
+		case MGCP_CONN_RECV_SEND:
+		case MGCP_CONN_CONFECHO:
+			if (conn_ret)
+				return NULL;
+			conn_ret = conn_dst;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return conn_ret;
+}
+
 /*! Dispatch incoming RTP packet to opposite RTP connection.
 * \param[in] msg Message buffer to bridge, coming from source connection.
 *            msg shall contain "struct osmo_rtp_msg_ctx *" attached in
@@ -1308,8 +1320,10 @@ int mgcp_dispatch_rtp_bridge_cb(struct msgb *msg)
 	struct mgcp_conn_rtp *conn_src = mc->conn_src;
 	struct mgcp_conn *conn = conn_src->conn;
 	struct mgcp_conn *conn_dst;
+	struct mgcp_endpoint *endp = conn->endp;
 	struct osmo_sockaddr *from_addr = mc->from_addr;
 	char ipbuf[INET6_ADDRSTRLEN];
+	int rc = 0;

 	/*! NOTE: This callback function implements the endpoint specific
 	 *  dispatch behaviour of an rtp bridge/proxy endpoint. It is assumed
@@ -1341,36 +1355,56 @@ int mgcp_dispatch_rtp_bridge_cb(struct msgb *msg)
 		return mgcp_conn_rtp_dispatch_rtp(conn_src, msg);
 	}

-	/* Find a destination connection. */
-	/* NOTE: This code path runs every time an RTP packet is received. The
-	 * function mgcp_find_dst_conn() we use to determine the detination
-	 * connection will iterate the connection list inside the endpoint.
-	 * Since list iterations are quite costly, we will figure out the
-	 * destination only once and use the optional private data pointer of
-	 * the connection to cache the destination connection pointer. */
-	if (!conn->priv) {
-		conn_dst = mgcp_find_dst_conn(conn);
-		conn->priv = conn_dst;
+	/* If the mode does not allow receiving RTP, we are done. */
+	switch (conn->mode) {
+	case MGCP_CONN_RECV_ONLY:
+	case MGCP_CONN_RECV_SEND:
+	case MGCP_CONN_CONFECHO:
+		break;
+	default:
+		return rc;
+	}
+
+	/* All the use cases above are 1:1 where we have one source msgb and we're sending that to one
+	 * destination.  msgb ownership had been passed to the respective _*dospatch_rtp() function.
+	 * In the cases below, we actually [can] have multiple recipients, so we copy the original msgb
+	 * for each of the recipients. */
+
+	/* If the mode is "confecho", send RTP back to the sender. */
+	if (conn->mode == MGCP_CONN_CONFECHO) {
+		struct msgb *msg2 = mgw_msgb_copy_c(conn, msg, "RTP confecho");
+		if (OSMO_LIKELY(msg2))
+			rc = mgcp_conn_rtp_dispatch_rtp(conn_src, msg2);
+	}
+
+	conn_dst = rtpbridge_get_only_recipient(endp, conn);
+	if (OSMO_LIKELY(conn_dst)) {
+		/* we only have a single recipient and cann hence send the original msgb without copying */
+		rc = mgcp_conn_rtp_dispatch_rtp(&conn_dst->u.rtp, msg);
 	} else {
-		conn_dst = (struct mgcp_conn *)conn->priv;
+		/* Dispatch RTP packet to all other connection(s) that send audio. */
+		llist_for_each_entry(conn_dst, &endp->conns, entry) {
+			struct msgb *msg2;
+			if (conn_dst == conn)
+				continue;
+			switch (conn_dst->mode) {
+			case MGCP_CONN_SEND_ONLY:
+			case MGCP_CONN_RECV_SEND:
+			case MGCP_CONN_CONFECHO:
+				/* we have multiple recipients and must make copies for each recipient */
+				msg2 = mgw_msgb_copy_c(conn_dst, msg, "RTP Tx copy");
+				if (OSMO_LIKELY(msg2))
+					rc = mgcp_conn_rtp_dispatch_rtp(&conn_dst->u.rtp, msg2);
+				break;
+			default:
+				break;
+			}
+		}
+		/* as we only sent copies in the previous llist_for_each_entry() loop, we must free the
+		 * original one */
+		msgb_free(msg);
 	}
-
-	/* There is no destination conn, stop here */
-	if (!conn_dst) {
-		LOGPCONN(conn, DRTP, LOGL_DEBUG,
-			 "no connection to forward an incoming RTP packet to\n");
-		return -1;
-	}
-
-	/* The destination conn is not an RTP connection */
-	if (conn_dst->type != MGCP_CONN_TYPE_RTP) {
-		LOGPCONN(conn, DRTP, LOGL_ERROR,
-			 "unable to find suitable destination conn\n");
-		return -1;
-	}
-
-	/* Dispatch RTP packet to destination RTP connection */
-	return mgcp_conn_rtp_dispatch_rtp(&conn_dst->u.rtp, msg);
+	return rc;
 }

 /*! dispatch incoming RTP packet to E1 subslot, handle RTCP packets locally.
@@ -1440,7 +1474,7 @@ void mgcp_cleanup_e1_bridge_cb(struct mgcp_endpoint *endp, struct mgcp_conn *con
 }

 /* Handle incoming RTP data from NET */
-static int rtp_data_net(struct osmo_fd *fd, unsigned int what)
+static void rtp_recvfrom_cb(struct osmo_io_fd *iofd, int res, struct msgb *msg, const struct osmo_sockaddr *saddr)
 {
 	/* NOTE: This is a generic implementation. RTP data is received. In
 	 * case of loopback the data is just sent back to its origin. All
@@ -1451,49 +1485,34 @@ static int rtp_data_net(struct osmo_fd *fd, unsigned int what)

 	struct mgcp_conn_rtp *conn_src;
 	struct mgcp_endpoint *endp;
-	struct osmo_sockaddr addr;
-	socklen_t slen = sizeof(addr);
-	char ipbuf[INET6_ADDRSTRLEN];
-	int ret;
 	enum rtp_proto proto;
 	struct osmo_rtp_msg_ctx *mc;
-	struct msgb *msg;
-	int rc;

-	conn_src = (struct mgcp_conn_rtp *)fd->data;
+	conn_src = (struct mgcp_conn_rtp *) osmo_iofd_get_data(iofd);
 	OSMO_ASSERT(conn_src);
 	endp = conn_src->conn->endp;
 	OSMO_ASSERT(endp);
-	msg = msgb_alloc_c(endp->trunk, RTP_BUF_SIZE, "RTP-rx");

-	proto = (fd == &conn_src->end.rtp)? MGCP_PROTO_RTP : MGCP_PROTO_RTCP;
+	proto = (iofd == conn_src->end.rtp) ? MGCP_PROTO_RTP : MGCP_PROTO_RTCP;

-	ret = recvfrom(fd->fd, msgb_data(msg), msg->data_len, 0, (struct sockaddr *)&addr.u.sa, &slen);
-
-	if (ret <= 0) {
-		LOG_CONN_RTP(conn_src, LOGL_ERROR, "recvfrom error: %s\n", strerror(errno));
-		rc = -1;
-		goto out;
+	if (res <= 0) {
+		LOG_CONN_RTP(conn_src, LOGL_ERROR, "recvfrom error: %s\n", strerror(-res));
+		goto out_free;
 	}

-	msgb_put(msg, ret);
-
-	LOG_CONN_RTP(conn_src, LOGL_DEBUG, "%s: rx %u bytes from %s:%u\n",
+	LOG_CONN_RTP(conn_src, LOGL_DEBUG, "%s: rx %u bytes from %s\n",
 		     proto == MGCP_PROTO_RTP ? "RTP" : "RTCP",
-		     msgb_length(msg), osmo_sockaddr_ntop(&addr.u.sa, ipbuf),
-		     osmo_sockaddr_port(&addr.u.sa));
+		     msgb_length(msg), osmo_sockaddr_to_str(saddr));

 	if ((proto == MGCP_PROTO_RTP && check_rtp(conn_src, msg))
 	    || (proto == MGCP_PROTO_RTCP && check_rtcp(conn_src, msg))) {
 		/* Logging happened in the two check_ functions */
-		rc = -1;
-		goto out;
+		goto out_free;
 	}

 	if (mgcp_is_rtp_dummy_payload(msg)) {
 		LOG_CONN_RTP(conn_src, LOGL_DEBUG, "rx dummy packet (dropped)\n");
-		rc = 0;
-		goto out;
+		goto out_free;
 	}

 	/* Since the msgb remains owned and freed by this function, the msg ctx data struct can just be on the stack and
@@ -1502,7 +1521,7 @@ static int rtp_data_net(struct osmo_fd *fd, unsigned int what)
 	*mc = (struct osmo_rtp_msg_ctx){
 		.proto = proto,
 		.conn_src = conn_src,
-		.from_addr = &addr,
+		.from_addr = (struct osmo_sockaddr *) saddr,
 	};
 	LOG_CONN_RTP(conn_src, LOGL_DEBUG, "msg ctx: %d %p %s\n",
 		     mc->proto, mc->conn_src,
@@ -1517,16 +1536,17 @@ static int rtp_data_net(struct osmo_fd *fd, unsigned int what)
 	/* FIXME: count RTP and RTCP separately, also count IuUP payload-less separately */

 	/* Forward a copy of the RTP data to a debug ip/port */
-	forward_data_tap(fd->fd, &conn_src->tap_in, msg);
+	forward_data_tap(iofd, &conn_src->tap_in, msg);

-	rc = rx_rtp(msg);
+	rx_rtp(msg);
+	return;

-out:
+out_free:
 	msgb_free(msg);
-	return rc;
 }

-/* Note: This function is able to handle RTP and RTCP */
+/* Note: This function is able to handle RTP and RTCP. msgb ownership is transferred, so this function or its
+ * downstream consumers must make sure to [eventually] free the msgb. */
 static int rx_rtp(struct msgb *msg)
 {
 	struct osmo_rtp_msg_ctx *mc = OSMO_RTP_MSG_CTX(msg);
@@ -1539,22 +1559,25 @@ static int rx_rtp(struct msgb *msg)

 	/* Check if the origin of the RTP packet seems plausible */
 	if (!trunk->rtp_accept_all && check_rtp_origin(conn_src, from_addr))
-		return -1;
+		goto out_free;

 	/* Handle AMR frame format conversion (octet-aligned vs. bandwith-efficient) */
-	if (mc->proto == MGCP_PROTO_RTP &&
-	    mgcp_codec_amr_align_mode_is_indicated(conn_src->end.codec)) {
+	if (mc->proto == MGCP_PROTO_RTP
+	    && conn_src->end.codec
+	    && mgcp_codec_amr_align_mode_is_indicated(conn_src->end.codec)) {
+		bool src_oa;
 		/* Make sure that the incoming AMR frame format matches the frame format that the call agent has
 		 * communicated via SDP when the connection was created/modfied. */
 		int oa = amr_oa_check((char*)msgb_data(msg), msgb_length(msg));
 		if (oa < 0)
-			return -1;
-		if (((bool)oa) != conn_src->end.codec->param.amr_octet_aligned) {
+			goto out_free;
+		src_oa = mgcp_codec_amr_is_octet_aligned(conn_src->end.codec);
+		if (((bool)oa) != src_oa) {
 			LOG_CONN_RTP(conn_src, LOGL_NOTICE,
 				     "rx_rtp(%u bytes): Expected RTP AMR octet-aligned=%u but got octet-aligned=%u."
 				     " check the config of your call-agent!\n",
-				     msgb_length(msg), conn_src->end.codec->param.amr_octet_aligned, oa);
-			return -1;
+				     msgb_length(msg), src_oa, oa);
+			goto out_free;
 		}
 	}

@@ -1563,17 +1586,36 @@ static int rx_rtp(struct msgb *msg)
 	/* Execute endpoint specific implementation that handles the
 	 * dispatching of the RTP data */
 	return conn->endp->type->dispatch_rtp_cb(msg);
+out_free:
+	msgb_free(msg);
+	return -1;
 }

+static void rtp_sendto_cb(struct osmo_io_fd *iofd, int res, struct msgb *msg, const struct osmo_sockaddr *daddr)
+{
+	/* nothing; osmo_io takes care of msgb_free */
+	if (res < 0) {
+		struct mgcp_conn_rtp *conn_rtp = (struct mgcp_conn_rtp *) osmo_iofd_get_data(iofd);
+		int priv_nr = osmo_iofd_get_priv_nr(iofd);
+		char errbuf[129];
+		strerror_r(-res, errbuf, sizeof(errbuf));
+		LOG_CONN_RTP(conn_rtp, LOGL_ERROR, "%s sendto(%s) failed: %s\n", priv_nr ? "RTCP" : "RTP",
+			 osmo_sockaddr_to_str(daddr), errbuf);
+	}
+}
+
+static const struct osmo_io_ops rtp_ioops = {
+	.recvfrom_cb = rtp_recvfrom_cb,
+	.sendto_cb = rtp_sendto_cb,
+};
+
 /*! bind RTP port to osmo_fd.
 *  \param[in] source_addr source (local) address to bind on.
- *  \param[in] fd associated file descriptor.
 *  \param[in] port to bind on.
 *  \param[in] dscp IP DSCP value to use.
 *  \param[in] prio socket priority to use.
- *  \returns 0 on success, -1 on ERROR. */
-int mgcp_create_bind(const char *source_addr, struct osmo_fd *fd, int port, uint8_t dscp,
-		     uint8_t prio)
+ *  \returns file descriptor on success, -1 on ERROR. */
+int mgcp_create_bind(const char *source_addr, int port, uint8_t dscp, uint8_t prio)
 {
 	int rc;

@@ -1581,47 +1623,50 @@ int mgcp_create_bind(const char *source_addr, struct osmo_fd *fd, int port, uint
 			     NULL, 0, OSMO_SOCK_F_BIND | OSMO_SOCK_F_DSCP(dscp) |
 			     OSMO_SOCK_F_PRIO(prio));
 	if (rc < 0) {
-		LOGP(DRTP, LOGL_ERROR, "failed to bind UDP port (%s:%i).\n",
+		LOGP(DRTP, LOGL_ERROR, "failed to bind UDP port (%s:%d).\n",
 		     source_addr, port);
 		return -1;
 	}
-	fd->fd = rc;
-	LOGP(DRTP, LOGL_DEBUG, "created socket + bound UDP port (%s:%i).\n", source_addr, port);
+	LOGP(DRTP, LOGL_DEBUG, "created socket + bound UDP port (%s:%d).\n", source_addr, port);

-	return 0;
+	return rc;
 }

 /* Bind RTP and RTCP port (helper function for mgcp_bind_net_rtp_port()) */
 static int bind_rtp(struct mgcp_config *cfg, const char *source_addr,
 		    struct mgcp_rtp_end *rtp_end, struct mgcp_endpoint *endp)
 {
+	int rc, rtp_fd, rtcp_fd;
+
 	/* NOTE: The port that is used for RTCP is the RTP port incremented by one
 	 * (e.g. RTP-Port = 16000 ==> RTCP-Port = 16001) */

-	if (mgcp_create_bind(source_addr, &rtp_end->rtp, rtp_end->local_port,
-			     cfg->endp_dscp, cfg->endp_priority) != 0) {
+	rc = mgcp_create_bind(source_addr, rtp_end->local_port, cfg->endp_dscp, cfg->endp_priority);
+	if (rc < 0) {
 		LOGPENDP(endp, DRTP, LOGL_ERROR,
 			 "failed to create RTP port: %s:%d\n",
 			 source_addr, rtp_end->local_port);
 		goto cleanup0;
 	}
+	rtp_fd = rc;

-	if (mgcp_create_bind(source_addr, &rtp_end->rtcp, rtp_end->local_port + 1,
-			     cfg->endp_dscp, cfg->endp_priority) != 0) {
+	rc = mgcp_create_bind(source_addr, rtp_end->local_port + 1, cfg->endp_dscp, cfg->endp_priority);
+	if (rc < 0) {
 		LOGPENDP(endp, DRTP, LOGL_ERROR,
 			 "failed to create RTCP port: %s:%d\n",
 			 source_addr, rtp_end->local_port + 1);
 		goto cleanup1;
 	}
+	rtcp_fd = rc;

-	if (osmo_fd_register(&rtp_end->rtp) != 0) {
+	if (osmo_iofd_register(rtp_end->rtp, rtp_fd) < 0) {
 		LOGPENDP(endp, DRTP, LOGL_ERROR,
 			 "failed to register RTP port %d\n",
 			 rtp_end->local_port);
 		goto cleanup2;
 	}

-	if (osmo_fd_register(&rtp_end->rtcp) != 0) {
+	if (osmo_iofd_register(rtp_end->rtcp, rtcp_fd) != 0) {
 		LOGPENDP(endp, DRTP, LOGL_ERROR,
 			 "failed to register RTCP port %d\n",
 			 rtp_end->local_port + 1);
@@ -1631,13 +1676,11 @@ static int bind_rtp(struct mgcp_config *cfg, const char *source_addr,
 	return 0;

 cleanup3:
-	osmo_fd_unregister(&rtp_end->rtp);
+	osmo_iofd_unregister(rtp_end->rtp);
 cleanup2:
-	close(rtp_end->rtcp.fd);
-	rtp_end->rtcp.fd = -1;
+	close(rtcp_fd);
 cleanup1:
-	close(rtp_end->rtp.fd);
-	rtp_end->rtp.fd = -1;
+	close(rtp_fd);
 cleanup0:
 	return -1;
 }
@@ -1656,7 +1699,8 @@ int mgcp_bind_net_rtp_port(struct mgcp_endpoint *endp, int rtp_port,
 	snprintf(name, sizeof(name), "%s-%s", conn->conn->name, conn->conn->id);
 	end = &conn->end;

-	if (end->rtp.fd != -1 || end->rtcp.fd != -1) {
+	if ((end->rtp && osmo_iofd_get_fd(end->rtp) != -1) ||
+	    (end->rtcp && osmo_iofd_get_fd(end->rtcp) != -1)) {
 		LOGPENDP(endp, DRTP, LOGL_ERROR, "%u was already bound on conn:%s\n",
 			 rtp_port, mgcp_conn_dump(conn->conn));

@@ -1669,8 +1713,18 @@ int mgcp_bind_net_rtp_port(struct mgcp_endpoint *endp, int rtp_port,
 	}

 	end->local_port = rtp_port;
-	osmo_fd_setup(&end->rtp, -1, OSMO_FD_READ, rtp_data_net, conn, 0);
-	osmo_fd_setup(&end->rtcp, -1, OSMO_FD_READ, rtp_data_net, conn, 0);
+	end->rtp = osmo_iofd_setup(conn->conn, -1, name, OSMO_IO_FD_MODE_RECVFROM_SENDTO, &rtp_ioops, conn);
+	if (!end->rtp)
+		return -EIO;
+	osmo_iofd_set_alloc_info(end->rtp, RTP_BUF_SIZE, 0);
+	end->rtcp = osmo_iofd_setup(conn->conn, -1, name, OSMO_IO_FD_MODE_RECVFROM_SENDTO, &rtp_ioops, conn);
+	if (!end->rtcp) {
+		osmo_iofd_free(end->rtp);
+		end->rtp = NULL;
+		return -EIO;
+	}
+	osmo_iofd_set_alloc_info(end->rtcp, RTP_BUF_SIZE, 0);
+	osmo_iofd_set_priv_nr(end->rtcp, 1); /* we use priv_nr as identifier for RTCP */

 	return bind_rtp(endp->trunk->cfg, conn->end.local_addr, end, endp);
 }
@@ -1679,15 +1733,13 @@ int mgcp_bind_net_rtp_port(struct mgcp_endpoint *endp, int rtp_port,
 *  \param[in] end RTP end */
 void mgcp_free_rtp_port(struct mgcp_rtp_end *end)
 {
-	if (end->rtp.fd != -1) {
-		osmo_fd_unregister(&end->rtp);
-		close(end->rtp.fd);
-		end->rtp.fd = -1;
+	if (end->rtp) {
+		osmo_iofd_free(end->rtp);
+		end->rtp = NULL;
 	}

-	if (end->rtcp.fd != -1) {
-		osmo_fd_unregister(&end->rtcp);
-		close(end->rtcp.fd);
-		end->rtcp.fd = -1;
+	if (end->rtcp) {
+		osmo_iofd_free(end->rtcp);
+		end->rtcp = NULL;
 	}
 }
--- a/src/libosmo-mgcp/mgcp_osmux.c
+++ b/src/libosmo-mgcp/mgcp_osmux.c
@@ -1,6 +1,7 @@
 /*
 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@gnumonks.org>
 * (C) 2012-2013 by On Waves ehf <http://www.on-waves.com>
+ * (C) 2013-2024 by sysmocom - s.f.m.c. GmbH
 * All rights not specifically granted under this license are reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
@@ -13,9 +14,11 @@
 #include <string.h> /* for memcpy */
 #include <stdlib.h> /* for abs */
 #include <inttypes.h> /* for PRIu64 */
+#include <unistd.h> /* for PRIu64 */
 #include <netinet/in.h>
 #include <osmocom/core/msgb.h>
 #include <osmocom/core/socket.h>
+#include <osmocom/core/osmo_io.h>
 #include <osmocom/core/talloc.h>

 #include <osmocom/netif/osmux.h>
@@ -30,8 +33,8 @@
 #include <osmocom/mgcp/mgcp_endp.h>
 #include <osmocom/mgcp/mgcp_trunk.h>

-static struct osmo_fd osmux_fd_v4;
-static struct osmo_fd osmux_fd_v6;
+static struct osmo_io_fd *osmux_fd_v4;
+static struct osmo_io_fd *osmux_fd_v6;

 static LLIST_HEAD(osmux_handle_list);

@@ -76,34 +79,31 @@ static void rtpconn_osmux_rate_ctr_inc(struct mgcp_conn_rtp *conn_rtp, int id)
 static void osmux_deliver_cb(struct msgb *batch_msg, void *data)
 {
 	struct osmux_handle *handle = data;
-	socklen_t dest_len;
-	int rc, fd;
-	struct mgcp_trunk *trunk = (struct mgcp_trunk *)osmux_fd_v4.data;
+	int rc;
+	struct osmo_io_fd *iofd;
+	struct mgcp_trunk *trunk = (struct mgcp_trunk *) osmo_iofd_get_data(osmux_fd_v4);
 	struct rate_ctr_group *all_osmux_stats = trunk->ratectr.all_osmux_conn_stats;

 	switch (handle->rem_addr.u.sa.sa_family) {
 	case AF_INET6:
-		dest_len = sizeof(handle->rem_addr.u.sin6);
-		fd = osmux_fd_v6.fd;
+		iofd = osmux_fd_v6;
 		break;
 	case AF_INET:
 	default:
-		dest_len = sizeof(handle->rem_addr.u.sin);
-		fd = osmux_fd_v4.fd;
+		iofd = osmux_fd_v4;
 		break;
 	}
-	rc = sendto(fd, batch_msg->data, batch_msg->len, 0,
-		    (struct sockaddr *)&handle->rem_addr.u.sa, dest_len);
+	rc = osmo_iofd_sendto_msgb(iofd, batch_msg, 0, &handle->rem_addr);
 	if (rc < 0) {
 		char errbuf[129];
-		strerror_r(errno, errbuf, sizeof(errbuf));
+		strerror_r(-rc, errbuf, sizeof(errbuf));
 		LOGP(DOSMUX, LOGL_NOTICE, "osmux sendto(%s) failed: %s\n",
 			 osmo_sockaddr_to_str(&handle->rem_addr), errbuf);
 		rate_ctr_inc(rate_ctr_group_get_ctr(all_osmux_stats, OSMUX_DROPPED_PACKETS_CTR));
+		msgb_free(batch_msg);
 	} else {
 		rate_ctr_inc(rate_ctr_group_get_ctr(all_osmux_stats, OSMUX_PACKETS_TX_CTR));
 	}
-	msgb_free(batch_msg);
 }

 /* Lookup existing OSMUX handle for specified destination address. */
@@ -204,17 +204,17 @@ osmux_handle_find_or_create(const struct mgcp_trunk *trunk, const struct osmo_so
 	return h->in;
 }

-/*! send RTP packet through OSMUX connection.
+/*! send RTP packet through OSMUX connection. Takes ownership of msg.
 *  \param[in] conn associated RTP connection
 *  \param[in] msg msgb containing an RTP AMR packet
 *  \returns 0 on success, -1 on ERROR */
 int conn_osmux_send_rtp(struct mgcp_conn_rtp *conn, struct msgb *msg)
 {
 	int ret;
-	struct msgb *msg2;

 	if (!conn->end.output_enabled) {
 		rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_DROPPED_CTR);
+		msgb_free(msg);
 		return -1;
 	}

@@ -222,22 +222,19 @@ int conn_osmux_send_rtp(struct mgcp_conn_rtp *conn, struct msgb *msg)
 		LOGPCONN(conn->conn, DOSMUX, LOGL_INFO, "forwarding RTP to Osmux conn not yet enabled, dropping (cid=%d)\n",
 		conn->osmux.remote_cid);
 		rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_DROPPED_CTR);
+		msgb_free(msg);
 		return -1;
 	}

-	/* msg is not owned by us and will be freed by the caller stack upon return: */
-	msg2 = msgb_copy_c(conn->conn, msg, "osmux-rtp-send");
-	if (!msg2)
-		return -1;
-
 	/* Osmux implementation works with AMR OA only, make sure we convert to it if needed: */
-	if (amr_oa_bwe_convert(conn->conn->endp, msg2, true) < 0) {
+	if (amr_oa_bwe_convert(conn->conn->endp, msg, true) < 0) {
 		LOGPCONN(conn->conn, DOSMUX, LOGL_ERROR,
 			 "Error converting to AMR octet-aligned mode\n");
+		msgb_free(msg);
 		return -1;
 	}

-	while ((ret = osmux_xfrm_input(conn->osmux.in, msg2, conn->osmux.remote_cid)) > 0) {
+	while ((ret = osmux_xfrm_input(conn->osmux.in, msg, conn->osmux.remote_cid)) > 0) {
 		/* batch full, build and deliver it */
 		osmux_xfrm_input_deliver(conn->osmux.in);
 	}
@@ -245,7 +242,7 @@ int conn_osmux_send_rtp(struct mgcp_conn_rtp *conn, struct msgb *msg)
 		rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_DROPPED_CTR);
 	} else {
 		rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_CTR);
-		rtpconn_osmux_rate_ctr_add(conn, OSMUX_AMR_OCTETS_TX_CTR, msgb_length(msg2) - sizeof(struct rtp_hdr));
+		rtpconn_osmux_rate_ctr_add(conn, OSMUX_AMR_OCTETS_TX_CTR, msgb_length(msg) - sizeof(struct rtp_hdr));
 	}
 	return 0;
 }
@@ -325,29 +322,7 @@ static void scheduled_from_osmux_tx_rtp_cb(struct msgb *msg, void *data)
 	};

 	endp->type->dispatch_rtp_cb(msg);
-	msgb_free(msg);
-}
-
-static struct msgb *osmux_recv(struct osmo_fd *ofd, struct osmo_sockaddr *addr)
-{
-	struct msgb *msg;
-	socklen_t slen = sizeof(addr->u.sas);
-	int ret;
-
-	msg = msgb_alloc(4096, "OSMUX");
-	if (!msg) {
-		LOGP(DOSMUX, LOGL_ERROR, "cannot allocate message\n");
-		return NULL;
-	}
-	ret = recvfrom(ofd->fd, msg->data, msg->data_len, 0, &addr->u.sa, &slen);
-	if (ret <= 0) {
-		msgb_free(msg);
-		LOGP(DOSMUX, LOGL_ERROR, "cannot receive message\n");
-		return NULL;
-	}
-	msgb_put(msg, ret);
-
-	return msg;
+	/* dispatch_rtp_cb() has taken ownership of the msgb */
 }

 /* To be called every time some AMR data is received on a connection
@@ -445,22 +420,16 @@ out:
 }

 #define osmux_chunk_length(msg, rem) ((rem) - (msg)->len)
-static int osmux_read_fd_cb(struct osmo_fd *ofd, unsigned int what)
+static void osmux_recvfrom_cb(struct osmo_io_fd *iofd, int res, struct msgb *msg, const struct osmo_sockaddr *rem_addr)
 {
-	struct msgb *msg;
 	struct osmux_hdr *osmuxh;
-	struct osmo_sockaddr rem_addr;
-	uint32_t rem;
-	struct mgcp_trunk *trunk = ofd->data;
+	struct mgcp_trunk *trunk = osmo_iofd_get_data(iofd);
 	struct rate_ctr_group *all_rtp_stats = trunk->ratectr.all_osmux_conn_stats;
+	uint32_t rem;
 	char addr_str[64];

-	msg = osmux_recv(ofd, &rem_addr);
-	if (!msg)
-		return -1;
-
 	rate_ctr_inc(rate_ctr_group_get_ctr(all_rtp_stats, OSMUX_PACKETS_RX_CTR));
-	osmo_sockaddr_to_str_buf(addr_str, sizeof(addr_str), &rem_addr);
+	osmo_sockaddr_to_str_buf(addr_str, sizeof(addr_str), rem_addr);

 	if (trunk->cfg->osmux.usage == OSMUX_USAGE_OFF) {
 		LOGP(DOSMUX, LOGL_ERROR,
@@ -470,14 +439,16 @@ static int osmux_read_fd_cb(struct osmo_fd *ofd, unsigned int what)
 	}

 	/* Catch legacy dummy message and process them separately: */
-	if (msg->len == 2 && msg->data[0] == MGCP_DUMMY_LOAD)
-		return osmux_handle_legacy_dummy(trunk, &rem_addr, msg);
+	if (msg->len == 2 && msg->data[0] == MGCP_DUMMY_LOAD) {
+		osmux_handle_legacy_dummy(trunk, rem_addr, msg);
+		return;
+	}

 	rem = msg->len;
 	while((osmuxh = osmux_xfrm_output_pull(msg)) != NULL) {
 		struct mgcp_conn_rtp *conn_src;
 		conn_src = osmux_conn_lookup(trunk, osmuxh->circuit_id,
-					     &rem_addr);
+					     rem_addr);
 		if (!conn_src) {
 			LOGP(DOSMUX, LOGL_DEBUG,
 			     "Cannot find a src conn for %s CID=%d\n",
@@ -485,7 +456,7 @@ static int osmux_read_fd_cb(struct osmo_fd *ofd, unsigned int what)
 			goto next;
 		}

-		if (conn_osmux_event_data_received(conn_src, &rem_addr) < 0)
+		if (conn_osmux_event_data_received(conn_src, rem_addr) < 0)
 			goto next;

 		mgcp_conn_watchdog_kick(conn_src->conn);
@@ -499,58 +470,94 @@ next:
 	}
 out:
 	msgb_free(msg);
-	return 0;
 }

+static void osmux_sendto_cb(struct osmo_io_fd *iofd, int res, struct msgb *msg, const struct osmo_sockaddr *rem_addr)
+{
+	/* nothing; osmo_io takes care of msgb_free */
+	if (res < 0) {
+		struct mgcp_trunk *trunk = (struct mgcp_trunk *) osmo_iofd_get_data(iofd);
+		struct rate_ctr_group *all_osmux_stats = trunk->ratectr.all_osmux_conn_stats;
+		char errbuf[129];
+		strerror_r(-res, errbuf, sizeof(errbuf));
+		LOGP(DOSMUX, LOGL_NOTICE, "osmux sendto(%s) failed: %s\n", osmo_sockaddr_to_str(rem_addr), errbuf);
+		rate_ctr_inc(rate_ctr_group_get_ctr(all_osmux_stats, OSMUX_DROPPED_PACKETS_CTR));
+	}
+}
+
+static const struct osmo_io_ops osmux_ioops = {
+	.recvfrom_cb = osmux_recvfrom_cb,
+	.sendto_cb = osmux_sendto_cb,
+};
+
 int osmux_init(struct mgcp_trunk *trunk)
 {
-	int ret;
+	int ret, fd;
 	struct mgcp_config *cfg = trunk->cfg;

 	/* So far we only support running on one trunk: */
 	OSMO_ASSERT(trunk == mgcp_trunk_by_num(cfg, MGCP_TRUNK_VIRTUAL, MGCP_VIRT_TRUNK_ID));

-	osmo_fd_setup(&osmux_fd_v4, -1, OSMO_FD_READ, osmux_read_fd_cb, trunk, 0);
-	osmo_fd_setup(&osmux_fd_v6, -1, OSMO_FD_READ, osmux_read_fd_cb, trunk, 0);
+	osmux_fd_v4 = osmo_iofd_setup(trunk, -1, "osmux_fd_v4", OSMO_IO_FD_MODE_RECVFROM_SENDTO, &osmux_ioops, trunk);
+	if (!osmux_fd_v4)
+		goto out;
+	osmo_iofd_set_alloc_info(osmux_fd_v4, 4096, 0);

 	if (cfg->osmux.local_addr_v4) {
-		ret = mgcp_create_bind(cfg->osmux.local_addr_v4, &osmux_fd_v4, cfg->osmux.local_port,
+		ret = mgcp_create_bind(cfg->osmux.local_addr_v4, cfg->osmux.local_port,
 					cfg->endp_dscp, cfg->endp_priority);
 		if (ret < 0) {
 			LOGP(DOSMUX, LOGL_ERROR, "Cannot bind OSMUX IPv4 socket to %s:%u\n",
 			     cfg->osmux.local_addr_v4, cfg->osmux.local_port);
-			return ret;
+			goto out_free_v4;
 		}
+		fd = ret;

-		ret = osmo_fd_register(&osmux_fd_v4);
+		ret = osmo_iofd_register(osmux_fd_v4, fd);
 		if (ret < 0) {
-			LOGP(DOSMUX, LOGL_ERROR, "Cannot register OSMUX IPv4 socket %s\n",
-			     osmo_sock_get_name2(osmux_fd_v4.fd));
-			return ret;
+			LOGP(DOSMUX, LOGL_ERROR, "Cannot register OSMUX IPv4 socket %s\n", osmo_sock_get_name2(fd));
+			close(fd);
+			goto out_free_v4;
 		}
-		LOGP(DOSMUX, LOGL_INFO, "OSMUX IPv4 socket listening on %s\n",
-		     osmo_sock_get_name2(osmux_fd_v4.fd));
+		LOGP(DOSMUX, LOGL_INFO, "OSMUX IPv4 socket listening on %s\n", osmo_sock_get_name2(fd));
 	}
+
+	osmux_fd_v6 = osmo_iofd_setup(trunk, -1, "osmux_fd_v6", OSMO_IO_FD_MODE_RECVFROM_SENDTO, &osmux_ioops, trunk);
+	if (!osmux_fd_v6)
+		goto out_free_v4;
+	osmo_iofd_set_alloc_info(osmux_fd_v6, 4096, 0);
+
 	if (cfg->osmux.local_addr_v6) {
-		ret = mgcp_create_bind(cfg->osmux.local_addr_v6, &osmux_fd_v6, cfg->osmux.local_port,
+		ret = mgcp_create_bind(cfg->osmux.local_addr_v6, cfg->osmux.local_port,
 					cfg->endp_dscp, cfg->endp_priority);
 		if (ret < 0) {
 			LOGP(DOSMUX, LOGL_ERROR, "Cannot bind OSMUX IPv6 socket to [%s]:%u\n",
 			     cfg->osmux.local_addr_v6, cfg->osmux.local_port);
-			return ret;
+			goto out_free_v6;
 		}
+		fd = ret;

-		ret = osmo_fd_register(&osmux_fd_v6);
+		ret = osmo_iofd_register(osmux_fd_v6, fd);
 		if (ret < 0) {
-			LOGP(DOSMUX, LOGL_ERROR, "Cannot register OSMUX IPv6 socket %s\n",
-			     osmo_sock_get_name2(osmux_fd_v6.fd));
-			return ret;
+			LOGP(DOSMUX, LOGL_ERROR, "Cannot register OSMUX IPv6 socket %s\n", osmo_sock_get_name2(fd));
+			close(fd);
+			goto out_free_v6;
 		}
-		LOGP(DOSMUX, LOGL_INFO, "OSMUX IPv6 socket listening on %s\n",
-		     osmo_sock_get_name2(osmux_fd_v6.fd));
+		LOGP(DOSMUX, LOGL_INFO, "OSMUX IPv6 socket listening on %s\n", osmo_sock_get_name2(fd));
 	}
 	cfg->osmux.initialized = true;
 	return 0;
+
+out_free_v6:
+	/* osmo_iofd_free performs unregister + close */
+	osmo_iofd_free(osmux_fd_v6);
+	osmux_fd_v6 = NULL;
+out_free_v4:
+	/* osmo_iofd_free performs unregister + close */
+	osmo_iofd_free(osmux_fd_v4);
+	osmux_fd_v4 = NULL;
+out:
+	return -1;
 }

 /*! relase OSXMUX cid, that had been allocated to this connection.
@@ -688,7 +695,7 @@ void conn_osmux_disable(struct mgcp_conn_rtp *conn)

 /*! send RTP dummy packet to OSMUX connection port.
 *  \param[in] conn associated RTP connection
- *  \returns bytes sent, -1 on error */
+ *  \returns 0 in case of success, -1 on error */
 int osmux_send_dummy(struct mgcp_conn_rtp *conn)
 {
 	char ipbuf[INET6_ADDRSTRLEN];
@@ -716,7 +723,7 @@ int osmux_send_dummy(struct mgcp_conn_rtp *conn)
 		 osmo_sockaddr_ntop(&conn->end.addr.u.sa, ipbuf),
 		 osmo_sockaddr_port(&conn->end.addr.u.sa), conn->osmux.remote_cid);

-	return mgcp_udp_send(osmux_fd_v4.fd, &conn->end.addr, (char *)osmuxh, buf_len);
+	return mgcp_udp_send(osmux_fd_v4, &conn->end.addr, (char *)osmuxh, buf_len);
 }

 /* Keeps track of locally allocated Osmux circuit ID. +7 to round up to 8 bit boundary. */
--- a/src/libosmo-mgcp/mgcp_protocol.c
+++ b/src/libosmo-mgcp/mgcp_protocol.c
@@ -86,6 +86,9 @@ struct mgcp_request_data {
 	/* set to true when the request has been classified as wildcarded */
 	bool wildcarded;

+	/* Set to true when the request is targeted at the "null" endpoint */
+	bool null_endp;
+
 	/* contains cause code in case of problems during endp/trunk resolution */
 	int mgcp_cause;
 };
@@ -390,7 +393,10 @@ struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg)
 	/* Locate endpoint and trunk, if no endpoint can be located try at least to identify the trunk. */
 	rq.pdata = &pdata;
 	rq.wildcarded = mgcp_endp_is_wildcarded(pdata.epname);
-	rq.endp = mgcp_endp_by_name(&rc, pdata.epname, pdata.cfg);
+	if (!rq.wildcarded)
+		rq.null_endp = mgcp_endp_is_null(pdata.epname);
+	if (!rq.null_endp)
+		rq.endp = mgcp_endp_by_name(&rc, pdata.epname, pdata.cfg);
 	rq.mgcp_cause = rc;
 	if (!rq.endp) {
 		rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_GENERAL_RX_FAIL_NO_ENDPOINT));
@@ -407,14 +413,14 @@ struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg)
 				     rq.name, pdata.epname);
 				return create_err_response(cfg, NULL, -rq.mgcp_cause, rq.name, pdata.trans);
 			}
-		} else {
+		} else if (!rq.null_endp) {
 			/* If the endpoint name suggests that the request refers to a specific endpoint, then the
 			 * request cannot be handled and we must stop early. */
 			LOGP(DLMGCP, LOGL_NOTICE,
 			     "%s: cannot find endpoint \"%s\", cause=%d -- abort\n", rq.name,
 			     pdata.epname, -rq.mgcp_cause);
 			return create_err_response(cfg, NULL, -rq.mgcp_cause, rq.name, pdata.trans);
-		}
+		} /* else: Handle special "null" endpoint below (with rq.endp=NULL, rq.trunk=NULL) */
 	} else {
 		osmo_strlcpy(debug_last_endpoint_name, rq.endp->name, sizeof(debug_last_endpoint_name));
 		rq.trunk = rq.endp->trunk;
@@ -460,6 +466,11 @@ struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg)
 static struct msgb *handle_audit_endpoint(struct mgcp_request_data *rq)
 {
 	LOGPENDP(rq->endp, DLMGCP, LOGL_NOTICE, "AUEP: auditing endpoint ...\n");
+
+	/* Auditing "null" endpoint is allowed for keepalive purposes. There's no rq->endp nor rq->trunk in this case. */
+	if (rq->null_endp)
+		return create_ok_response(rq->pdata->cfg, NULL, 200, "AUEP", rq->pdata->trans);
+
 	if (!rq->endp || !mgcp_endp_avail(rq->endp)) {
 		LOGPENDP(rq->endp, DLMGCP, LOGL_ERROR, "AUEP: selected endpoint not available!\n");
 		return create_err_response(rq->trunk, NULL, 501, "AUEP", rq->pdata->trans);
@@ -661,8 +672,8 @@ static int set_local_cx_options(void *ctx, struct mgcp_lco *lco,
 		case 'a':
 			/* FIXME: LCO also supports the negotiation of more than one codec.
 			 * (e.g. a:PCMU;G726-32) But this implementation only supports a single
-			 * codec only. */
-			if (sscanf(lco_id + 1, ":%16[^,]", codec) == 1) {
+			 * codec only. Ignoring all but the first codec. */
+			if (sscanf(lco_id + 1, ":%16[^,;]", codec) == 1) {
 				talloc_free(lco->codec);
 				/* MGCP header is case insensive, and we'll need
 				   codec in uppercase when using it later: */
@@ -761,6 +772,9 @@ static int handle_codec_info(struct mgcp_conn_rtp *conn,
 			     struct mgcp_request_data *rq, int have_sdp, bool crcx)
 {
 	struct mgcp_endpoint *endp = rq->endp;
+	struct mgcp_conn *conn_dst;
+	struct mgcp_conn_rtp *conn_dst_rtp;
+
 	int rc;
 	char *cmd;

@@ -802,8 +816,15 @@ static int handle_codec_info(struct mgcp_conn_rtp *conn,
 			goto error;
 	}

+	/* Try to find an destination RTP connection that we can include in the codec decision. */
+	conn_dst = mgcp_find_dst_conn(conn->conn);
+	if (conn_dst && conn_dst->type == MGCP_CONN_TYPE_RTP)
+		conn_dst_rtp = &conn_dst->u.rtp;
+	else
+		conn_dst_rtp = NULL;
+
 	/* Make codec decision */
-	if (mgcp_codec_decide(conn) != 0)
+	if (mgcp_codec_decide(conn, conn_dst_rtp) != 0)
 		goto error;

 	return 0;
@@ -845,7 +866,7 @@ static struct msgb *handle_create_con(struct mgcp_request_data *rq)
 	struct mgcp_parse_data *pdata = rq->pdata;
 	struct mgcp_trunk *trunk = rq->trunk;
 	struct mgcp_endpoint *endp = rq->endp;
-	struct rate_ctr_group *rate_ctrs = trunk->ratectr.mgcp_crcx_ctr_group;
+	struct rate_ctr_group *rate_ctrs;
 	int error_code = 400;
 	const char *local_options = NULL;
 	const char *callid = NULL;
@@ -859,6 +880,14 @@ static struct msgb *handle_create_con(struct mgcp_request_data *rq)

 	LOGPENDP(endp, DLMGCP, LOGL_NOTICE, "CRCX: creating new connection ...\n");

+	if (rq->null_endp) {
+		/* trunk not available so rate_ctr aren't available either. */
+		LOGP(DLMGCP, LOGL_ERROR, "CRCX: Not allowed in 'null' endpoint!\n");
+		return create_err_response(pdata->cfg, NULL, 502, "CRCX", pdata->trans);
+	}
+
+	rate_ctrs = trunk->ratectr.mgcp_crcx_ctr_group;
+
 	/* we must have a free ep */
 	if (!endp) {
 		rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_CRCX_FAIL_AVAIL));
@@ -938,7 +967,7 @@ mgcp_header_done:
 	}

 	/* Check if we are able to accept the creation of another connection */
-	if (llist_count(&endp->conns) >= endp->type->max_conns) {
+	if (endp->type->max_conns > 0 && llist_count(&endp->conns) >= endp->type->max_conns) {
 		LOGPENDP(endp, DLMGCP, LOGL_ERROR,
 			"CRCX: endpoint full, max. %i connections allowed!\n",
 			endp->type->max_conns);
@@ -1047,9 +1076,6 @@ mgcp_header_done:
 		rc = mgcp_conn_iuup_init(conn);
 	}

-	conn->end.fmtp_extra = talloc_strdup(trunk->endpoints,
-					     trunk->audio_fmtp_extra);
-
 	if (pdata->cfg->force_ptime) {
 		conn->end.packet_duration_ms = pdata->cfg->force_ptime;
 		conn->end.force_output_ptime = 1;
@@ -1057,17 +1083,6 @@ mgcp_header_done:

 	mgcp_rtp_end_config(endp, 0, &conn->end);

-	/* check connection mode setting */
-	if (conn->conn->mode != MGCP_CONN_LOOPBACK
-	    && conn->conn->mode != MGCP_CONN_RECV_ONLY
-	    && osmo_sockaddr_port(&conn->end.addr.u.sa) == 0) {
-		LOGPCONN(_conn, DLMGCP, LOGL_ERROR,
-			 "CRCX: selected connection mode type requires an opposite end!\n");
-		error_code = 527;
-		rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_CRCX_FAIL_NO_REMOTE_CONN_DESC));
-		goto error2;
-	}
-
 	/* Find a local address for conn based on policy and initial SDP remote
 	   information, then find a free port for it */
 	if (mgcp_get_local_addr(conn->end.local_addr, conn) < 0) {
@@ -1105,6 +1120,7 @@ mgcp_header_done:

 	LOGPCONN(_conn, DLMGCP, LOGL_NOTICE,
 		 "CRCX: connection successfully created\n");
+
 	rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_CRCX_SUCCESS));
 	mgcp_endp_update(endp);

@@ -1124,7 +1140,7 @@ static struct msgb *handle_modify_con(struct mgcp_request_data *rq)
 	struct mgcp_parse_data *pdata = rq->pdata;
 	struct mgcp_trunk *trunk = rq->trunk;
 	struct mgcp_endpoint *endp = rq->endp;
-	struct rate_ctr_group *rate_ctrs = trunk->ratectr.mgcp_mdcx_ctr_group;
+	struct rate_ctr_group *rate_ctrs;
 	char new_local_addr[INET6_ADDRSTRLEN];
 	int error_code = 500;
 	int silent = 0;
@@ -1139,6 +1155,14 @@ static struct msgb *handle_modify_con(struct mgcp_request_data *rq)

 	LOGPENDP(endp, DLMGCP, LOGL_NOTICE, "MDCX: modifying existing connection ...\n");

+	if (rq->null_endp) {
+		/* trunk not available so rate_ctr aren't available either. */
+		LOGP(DLMGCP, LOGL_ERROR, "MDCX: Not allowed in 'null' endpoint!\n");
+		return create_err_response(pdata->cfg, NULL, 502, "MDCX", pdata->trans);
+	}
+
+	rate_ctrs = trunk->ratectr.mgcp_mdcx_ctr_group;
+
 	/* Prohibit wildcarded requests */
 	if (rq->wildcarded) {
 		LOGPENDP(endp, DLMGCP, LOGL_ERROR,
@@ -1256,17 +1280,10 @@ mgcp_header_done:
 		error_code = rc;
 		goto error3;
 	}
-
-	/* check connection mode setting */
-	if (conn->conn->mode != MGCP_CONN_LOOPBACK
-	    && conn->conn->mode != MGCP_CONN_RECV_ONLY
-	    && !mgcp_rtp_end_remote_addr_available(&conn->end)) {
-		LOGPCONN(conn->conn, DLMGCP, LOGL_ERROR,
-			 "MDCX: selected connection mode type requires an opposite end!\n");
-		error_code = 527;
-		rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_MDCX_FAIL_NO_REMOTE_CONN_DESC));
-		goto error3;
-	}
+	/* Upgrade the conn type RTP_DEFAULT->RTP_IUUP if needed based on requested codec: */
+	/* TODO: "codec" probably needs to be moved from endp to conn */
+	if (conn->type == MGCP_RTP_DEFAULT && strcmp(conn->end.codec->subtype_name, "VND.3GPP.IUFP") == 0)
+		rc = mgcp_conn_iuup_init(conn);

 	if (mgcp_conn_rtp_is_osmux(conn)) {
 		OSMO_ASSERT(conn->osmux.local_cid_allocated);
@@ -1350,7 +1367,7 @@ static struct msgb *handle_delete_con(struct mgcp_request_data *rq)
 	struct mgcp_parse_data *pdata = rq->pdata;
 	struct mgcp_trunk *trunk = rq->trunk;
 	struct mgcp_endpoint *endp = rq->endp;
-	struct rate_ctr_group *rate_ctrs = trunk->ratectr.mgcp_dlcx_ctr_group;
+	struct rate_ctr_group *rate_ctrs;
 	int error_code = 400;
 	int silent = 0;
 	char *line;
@@ -1360,10 +1377,18 @@ static struct msgb *handle_delete_con(struct mgcp_request_data *rq)
 	unsigned int i;

 	/* NOTE: In this handler we can not take it for granted that the endp
-	 * pointer will be populated, however a trunk is always guaranteed. */
+	 * pointer will be populated, however a trunk is always guaranteed (except for 'null' endp).
+	 */

 	LOGPEPTR(endp, trunk, DLMGCP, LOGL_NOTICE, "DLCX: deleting connection(s) ...\n");

+	if (rq->null_endp) {
+		/* trunk not available so rate_ctr aren't available either. */
+		LOGP(DLMGCP, LOGL_ERROR, "DLCX: Not allowed in 'null' endpoint!\n");
+		return create_err_response(pdata->cfg, NULL, 502, "DLCX", pdata->trans);
+	}
+
+	rate_ctrs = trunk->ratectr.mgcp_dlcx_ctr_group;
 	if (endp && !mgcp_endp_avail(endp)) {
 		rate_ctr_inc(rate_ctr_group_get_ctr(rate_ctrs, MGCP_DLCX_FAIL_AVAIL));
 		LOGPENDP(endp, DLMGCP, LOGL_ERROR,
@@ -1514,6 +1539,12 @@ static struct msgb *handle_rsip(struct mgcp_request_data *rq)

 	LOGP(DLMGCP, LOGL_NOTICE, "RSIP: resetting all endpoints ...\n");

+	if (rq->null_endp) {
+		/* trunk not available so rate_ctr aren't available either. */
+		LOGP(DLMGCP, LOGL_ERROR, "RSIP: Not allowed in 'null' endpoint!\n");
+		return create_err_response(rq->pdata->cfg, NULL, 502, "RSIP", rq->pdata->trans);
+	}
+
 	if (rq->pdata->cfg->reset_cb)
 		rq->pdata->cfg->reset_cb(rq->endp->trunk);
 	return NULL;
@@ -1539,6 +1570,12 @@ static struct msgb *handle_noti_req(struct mgcp_request_data *rq)

 	LOGP(DLMGCP, LOGL_NOTICE, "RQNT: processing request for notification ...\n");

+	if (rq->null_endp) {
+		/* trunk not available so rate_ctr aren't available either. */
+		LOGP(DLMGCP, LOGL_ERROR, "RQNT: Not allowed in 'null' endpoint!\n");
+		return create_err_response(rq->pdata->cfg, NULL, 502, "RQNT", rq->pdata->trans);
+	}
+
 	for_each_line(line, rq->pdata->save) {
 		switch (toupper(line[0])) {
 		case 'S':
@@ -1651,8 +1688,6 @@ struct mgcp_config *mgcp_config_alloc(void)
 	cfg->rtp_processing_cb = &mgcp_rtp_processing_default;
 	cfg->setup_rtp_processing_cb = &mgcp_setup_rtp_processing_default;

-	cfg->get_net_downlink_format_cb = &mgcp_get_net_downlink_format_default;
-
 	INIT_LLIST_HEAD(&cfg->trunks);

 	/* Allocate virtual trunk */
--- a/src/libosmo-mgcp/mgcp_sdp.c
+++ b/src/libosmo-mgcp/mgcp_sdp.c
@@ -35,6 +35,9 @@
 #include <osmocom/mgcp/mgcp_sdp.h>
 #include <osmocom/mgcp/mgcp_protocol.h>

+#include <osmocom/sdp/fmtp.h>
+#include <osmocom/sdp/sdp_strings.h>
+
 #include <errno.h>
 #include <stdlib.h>
 #include <limits.h>
@@ -55,7 +58,7 @@ struct sdp_rtp_map {
 };
 struct sdp_fmtp_param {
 	int payload_type;
-	struct mgcp_codec_param param;
+	const char *fmtp;
 };


@@ -195,11 +198,7 @@ static int fmtp_from_sdp(void *ctx, struct sdp_fmtp_param *fmtp_param, char *sdp
 {
 	char *str;
 	char *str_ptr;
-	char *param_str;
 	unsigned int pt;
-	unsigned int count = 0;
-	char delimiter;
-	unsigned int amr_octet_aligned;

 	memset(fmtp_param, 0, sizeof(*fmtp_param));

@@ -218,40 +217,13 @@ static int fmtp_from_sdp(void *ctx, struct sdp_fmtp_param *fmtp_param, char *sdp
 		goto error;
 	fmtp_param->payload_type = pt;

-	/* Advance pointer to the beginning of the parameter section and
-	 * tokenize string */
+	/* Advance pointer to the beginning of the parameter section */
 	str_ptr = strstr(str_ptr, " ");
 	if (!str_ptr)
 		goto error;
 	str_ptr++;

-	param_str = strtok(str_ptr, " ");
-	if (!param_str)
-		goto exit;
-
-	while (1) {
-		/* Make sure that we don't get trapped in an endless loop */
-		if (count > 256)
-			goto error;
-
-		/* Chop off delimiters ';' at the end */
-		delimiter = str_ptr[strlen(str_ptr) - 1];
-		if (delimiter == ';' || delimiter == ',')
-			str_ptr[strlen(str_ptr) - 1] = '\0';
-
-		/* AMR octet aligned parameter (see also RFC 3267, section 8.3) */
-		if (sscanf(param_str, "octet-align=%d", &amr_octet_aligned) == 1) {
-			fmtp_param->param.amr_octet_aligned_present = true;
-			fmtp_param->param.amr_octet_aligned = false;
-			if (amr_octet_aligned == 1)
-				fmtp_param->param.amr_octet_aligned = true;
-		}
-
-		param_str = strtok(NULL, " ");
-		if (!param_str)
-			break;
-		count++;
-	}
+	fmtp_param->fmtp = talloc_strdup(ctx, str_ptr);

 exit:
 	talloc_free(str);
@@ -299,13 +271,13 @@ static int audio_ip_from_sdp(struct osmo_sockaddr *dst_addr, char *sdp)

 /* Pick optional fmtp parameters by payload type, if there are no fmtp
 * parameters, a nullpointer is returned */
-static struct mgcp_codec_param *param_by_pt(int pt, struct sdp_fmtp_param *fmtp_params, unsigned int fmtp_params_len)
+static const char *param_by_pt(int pt, struct sdp_fmtp_param *fmtp_params, unsigned int fmtp_params_len)
 {
 	unsigned int i;

 	for (i = 0; i < fmtp_params_len; i++) {
 		if (fmtp_params[i].payload_type == pt)
-			return &fmtp_params[i].param;
+			return fmtp_params[i].fmtp;
 	}

 	return NULL;
@@ -326,7 +298,6 @@ int mgcp_parse_sdp_data(const struct mgcp_endpoint *endp,
 	unsigned int codecs_used = 0;
 	struct sdp_fmtp_param fmtp_params[MGCP_MAX_CODECS];
 	unsigned int fmtp_used = 0;
-	struct mgcp_codec_param *codec_param;
 	char ipbuf[INET6_ADDRSTRLEN];
 	char *line;
 	unsigned int i;
@@ -421,8 +392,8 @@ int mgcp_parse_sdp_data(const struct mgcp_endpoint *endp,

 	/* Store parsed codec information */
 	for (i = 0; i < codecs_used; i++) {
-		codec_param = param_by_pt(codecs[i].payload_type, fmtp_params, fmtp_used);
-		rc = mgcp_codec_add(conn, codecs[i].payload_type, codecs[i].map_line, codec_param);
+		const char *fmtp = param_by_pt(codecs[i].payload_type, fmtp_params, fmtp_used);
+		rc = mgcp_codec_add2(conn, codecs[i].payload_type, codecs[i].map_line, fmtp);
 		if (rc < 0)
 			LOGPENDP(endp, DLMGCP, LOGL_NOTICE, "failed to add codec\n");
 	}
@@ -436,10 +407,12 @@ int mgcp_parse_sdp_data(const struct mgcp_endpoint *endp,
 	if (codecs_used == 0)
 		LOGPC(DLMGCP, LOGL_NOTICE, "none");
 	for (i = 0; i < codecs_used; i++) {
-		LOGPC(DLMGCP, LOGL_NOTICE, "%d=%s",
+		LOGPC(DLMGCP, LOGL_NOTICE, " %d=%s%s%s%s",
 		      rtp->codecs[i].payload_type,
-		      strlen(rtp->codecs[i].subtype_name) ? rtp->codecs[i].subtype_name : "unknown");
-		LOGPC(DLMGCP, LOGL_NOTICE, " ");
+		      strlen(rtp->codecs[i].subtype_name) ? rtp->codecs[i].subtype_name : "unknown",
+		      rtp->codecs[i].fmtp[0] ? ",fmtp='" : "",
+		      rtp->codecs[i].fmtp,
+		      rtp->codecs[i].fmtp[0] ? "'" : "");
 	}
 	LOGPC(DLMGCP, LOGL_NOTICE, "\n");

@@ -488,55 +461,21 @@ static int add_audio(struct msgb *sdp, int *payload_types, unsigned int payload_
 }

 /* Add fmtp strings to sdp payload */
-static int add_fmtp(struct msgb *sdp, struct sdp_fmtp_param *fmtp_params, unsigned int fmtp_params_len,
-		    const char *fmtp_extra)
+static int add_fmtp(struct msgb *sdp, struct sdp_fmtp_param *fmtp_params, unsigned int fmtp_params_len)
 {
 	unsigned int i;
 	int rc;
-	int fmtp_extra_pt = -1;
-	char *fmtp_extra_pars = "";
-
-	/* When no fmtp parameters ara available but an fmtp extra string
-	 * is configured, just add the fmtp extra string */
-	if (fmtp_params_len == 0 && fmtp_extra) {
-		return msgb_printf(sdp, "%s\r\n", fmtp_extra);
-	}
-
-	/* When there is fmtp extra configured we dissect it in order to drop
-	 * in the configured extra parameters at the right place when
-	 * generating the fmtp strings. */
-	if (fmtp_extra) {
-		if (sscanf(fmtp_extra, "a=fmtp:%d ", &fmtp_extra_pt) != 1)
-			fmtp_extra_pt = -1;
-
-		fmtp_extra_pars = strstr(fmtp_extra, " ");
-
-		if (!fmtp_extra_pars)
-			fmtp_extra_pars = "";
-		else
-			fmtp_extra_pars++;
-	}

 	for (i = 0; i < fmtp_params_len; i++) {
+		bool first = true;
 		rc = msgb_printf(sdp, "a=fmtp:%u", fmtp_params[i].payload_type);
 		if (rc < 0)
 			return -EINVAL;

 		/* Add amr octet align parameter */
-		if (fmtp_params[i].param.amr_octet_aligned_present) {
-			if (fmtp_params[i].param.amr_octet_aligned)
-				rc = msgb_printf(sdp, " octet-align=1");
-			else
-				rc = msgb_printf(sdp, " octet-align=0");
-			if (rc < 0)
-				return -EINVAL;
-		}
-
-		/* Append extra parameters from fmtp extra */
-		if (fmtp_params[i].payload_type == fmtp_extra_pt) {
-			rc = msgb_printf(sdp, " %s", fmtp_extra_pars);
-			if (rc < 0)
-				return -EINVAL;
+		if (fmtp_params[i].fmtp) {
+			msgb_printf(sdp, "%s%s", first ? " " : ";", fmtp_params[i].fmtp);
+			first = false;
 		}

 		rc = msgb_printf(sdp, "\r\n");
@@ -558,10 +497,8 @@ int mgcp_write_response_sdp(const struct mgcp_endpoint *endp,
 			    const char *addr)
 {
 	const struct mgcp_rtp_codec *codec;
-	const char *fmtp_extra;
 	const char *audio_name;
 	int payload_type;
-	struct sdp_fmtp_param fmtp_param;
 	int rc;
 	int payload_types[1];
 	int local_port;
@@ -574,10 +511,7 @@ int mgcp_write_response_sdp(const struct mgcp_endpoint *endp,
 	OSMO_ASSERT(sdp);
 	OSMO_ASSERT(addr);

-	/* FIXME: constify endp and conn args in get_net_donwlink_format_cb() */
-	endp->trunk->cfg->get_net_downlink_format_cb((struct mgcp_endpoint *)endp,
-					      &codec, &fmtp_extra,
-					      (struct mgcp_conn_rtp *)conn);
+	codec = conn->end.codec;

 	audio_name = codec->audio_name;
 	payload_type = codec->payload_type;
@@ -613,13 +547,23 @@ int mgcp_write_response_sdp(const struct mgcp_endpoint *endp,
 				goto buffer_too_small;
 		}

-		if (codec->param_present) {
-			fmtp_param.payload_type = payload_type;
-			fmtp_param.param = codec->param;
-			fmtp_params[0] = fmtp_param;
+		if (codec->fmtp[0]) {
+			fmtp_params[0] = (struct sdp_fmtp_param){
+				.payload_type = payload_type,
+				.fmtp = codec->fmtp,
+			};
 			fmtp_params_len = 1;
+		} else if (codec->param_present) {
+			/* Legacy */
+			fmtp_params[0] = (struct sdp_fmtp_param){
+				.payload_type = payload_type,
+			};
+			fmtp_params_len = 1;
+			fmtp_params[0].fmtp = (codec->param.amr_octet_aligned ?
+					       OSMO_SDP_STR_AMR_OCTET_ALIGN_1 : OSMO_SDP_STR_AMR_OCTET_ALIGN_0);
 		}
-		rc = add_fmtp(sdp, fmtp_params, fmtp_params_len, fmtp_extra);
+
+		rc = add_fmtp(sdp, fmtp_params, fmtp_params_len);
 		if (rc < 0)
 			goto buffer_too_small;
 	}
--- a/src/libosmo-mgcp/mgcp_vty.c
+++ b/src/libosmo-mgcp/mgcp_vty.c
@@ -111,17 +111,12 @@ static int config_write_mgcp(struct vty *vty)
 			VTY_NEWLINE);
 	} else
 		vty_out(vty, " no rtp-patch%s", VTY_NEWLINE);
-	if (trunk->audio_fmtp_extra)
-		vty_out(vty, " sdp audio fmtp-extra %s%s",
-			trunk->audio_fmtp_extra, VTY_NEWLINE);
 	vty_out(vty, " %ssdp audio-payload send-ptime%s",
 		trunk->audio_send_ptime ? "" : "no ", VTY_NEWLINE);
 	vty_out(vty, " %ssdp audio-payload send-name%s",
 		trunk->audio_send_name ? "" : "no ", VTY_NEWLINE);
 	vty_out(vty, " number endpoints %u%s",
 		trunk->v.vty_number_endpoints, VTY_NEWLINE);
-	vty_out(vty, " %sallow-transcoding%s",
-		trunk->no_audio_transcoding ? "no " : "", VTY_NEWLINE);
 	if (strlen(g_cfg->call_agent_addr))
 		vty_out(vty, " call-agent ip %s%s", g_cfg->call_agent_addr,
 			VTY_NEWLINE);
@@ -189,7 +184,7 @@ static void dump_rtp_end(struct vty *vty, struct mgcp_conn_rtp *conn)
 		"   Payload Type: %d Rate: %u Channels: %d %s"
 		"   Frame Duration: %u Frame Denominator: %u%s"
 		"   FPP: %d Packet Duration: %u%s"
-		"   FMTP-Extra: %s Audio-Name: %s Sub-Type: %s%s"
+		"   Audio-Name: %s Sub-Type: %s%s"
 		"   Output-Enabled: %d Force-PTIME: %d%s",
 		tx_packets->current, tx_bytes->current, VTY_NEWLINE,
 		rx_packets->current, rx_bytes->current, VTY_NEWLINE,
@@ -200,7 +195,7 @@ static void dump_rtp_end(struct vty *vty, struct mgcp_conn_rtp *conn)
 		codec->payload_type, codec->rate, codec->channels, VTY_NEWLINE,
 		codec->frame_duration_num, codec->frame_duration_den,
 		VTY_NEWLINE, end->frames_per_packet, end->packet_duration_ms,
-		VTY_NEWLINE, end->fmtp_extra, codec->audio_name,
+		VTY_NEWLINE, codec->audio_name,
 		codec->subtype_name, VTY_NEWLINE, end->output_enabled,
 		end->force_output_ptime, VTY_NEWLINE);
 	if (mgcp_conn_rtp_is_osmux(conn)) {
@@ -513,6 +508,7 @@ DEFUN_DEPRECATED(cfg_mgcp_bind_early,
 		 BIND_STR
 		 "Bind local ports on start up\n" "Bind on demand\n" "Bind on startup\n")
 {
+	vty_out(vty, "%% Deprecated 'bind early (0|1)' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -682,53 +678,40 @@ DEFUN_USRATTR(cfg_mgcp_no_rtp_force_ptime,
 	return CMD_SUCCESS;
 }

-DEFUN_USRATTR(cfg_mgcp_sdp_fmtp_extra,
-	      cfg_mgcp_sdp_fmtp_extra_cmd,
-	      X(MGW_CMD_ATTR_NEWCONN),
-	      "sdp audio fmtp-extra .NAME",
-	      "Add extra fmtp for the SDP file\n" "Audio\n" "Fmtp-extra\n"
-	      "Extra Information\n")
-{
-	struct mgcp_trunk *trunk = mgcp_trunk_by_num(g_cfg, MGCP_TRUNK_VIRTUAL, MGCP_VIRT_TRUNK_ID);
-	OSMO_ASSERT(trunk);
-	char *txt = argv_concat(argv, argc, 0);
-	if (!txt)
-		return CMD_WARNING;
-
-	osmo_talloc_replace_string(g_cfg, &trunk->audio_fmtp_extra, txt);
-	talloc_free(txt);
-	return CMD_SUCCESS;
-}
-
-DEFUN_USRATTR(cfg_mgcp_allow_transcoding,
-	      cfg_mgcp_allow_transcoding_cmd,
-	      X(MGW_CMD_ATTR_NEWCONN),
-	      "allow-transcoding", "Allow transcoding\n")
-{
-	struct mgcp_trunk *trunk = mgcp_trunk_by_num(g_cfg, MGCP_TRUNK_VIRTUAL, MGCP_VIRT_TRUNK_ID);
-	OSMO_ASSERT(trunk);
-	trunk->no_audio_transcoding = 0;
-	return CMD_SUCCESS;
-}
-
-DEFUN_USRATTR(cfg_mgcp_no_allow_transcoding,
-	      cfg_mgcp_no_allow_transcoding_cmd,
-	      X(MGW_CMD_ATTR_NEWCONN),
-	      "no allow-transcoding", NO_STR "Allow transcoding\n")
-{
-	struct mgcp_trunk *trunk = mgcp_trunk_by_num(g_cfg, MGCP_TRUNK_VIRTUAL, MGCP_VIRT_TRUNK_ID);
-	OSMO_ASSERT(trunk);
-	trunk->no_audio_transcoding = 1;
-	return CMD_SUCCESS;
-}
-
 #define SDP_STR "SDP File related options\n"
 #define AUDIO_STR "Audio payload options\n"
+
+DEFUN_DEPRECATED(cfg_mgcp_sdp_fmtp_extra,
+	      cfg_mgcp_sdp_fmtp_extra_cmd,
+	      "sdp audio fmtp-extra .NAME",
+	      SDP_STR AUDIO_STR "Deprecated, without effect since osmo-mgw v1.13\n" "Deprecated, without effect\n")
+{
+	vty_out(vty, "%% deprecated: the config option 'sdp audio fmtp-extra' has been removed.%s", VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+DEFUN_DEPRECATED(cfg_mgcp_allow_transcoding,
+		  cfg_mgcp_allow_transcoding_cmd,
+		  "allow-transcoding", "Allow transcoding\n")
+{
+	vty_out(vty, "%% Deprecated 'allow-transcoding' config no longer has any effect%s", VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+DEFUN_DEPRECATED(cfg_mgcp_no_allow_transcoding,
+		 cfg_mgcp_no_allow_transcoding_cmd,
+		 "no allow-transcoding", NO_STR "Allow transcoding\n")
+{
+	vty_out(vty, "%% Deprecated 'no allow-transcoding' config no longer has any effect%s", VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
 DEFUN_DEPRECATED(cfg_mgcp_sdp_payload_number,
      cfg_mgcp_sdp_payload_number_cmd,
      "sdp audio-payload number <0-255>",
      SDP_STR AUDIO_STR "Number\n" "Payload number\n")
 {
+	vty_out(vty, "%% Deprecated 'sdp audio-payload number <0-255>' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -742,6 +725,7 @@ DEFUN_DEPRECATED(cfg_mgcp_sdp_payload_name,
      "sdp audio-payload name NAME",
      SDP_STR AUDIO_STR "Name\n" "Payload name\n")
 {
+	vty_out(vty, "%% Deprecated 'sdp audio-payload name NAME' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -802,6 +786,7 @@ DEFUN_DEPRECATED(cfg_mgcp_loop,
 		 "loop (0|1)",
 		 "Loop audio for all endpoints on main trunk\n" "Don't Loop\n" "Loop\n")
 {
+	vty_out(vty, "%% Deprecated 'loop (0|1)' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -1066,30 +1051,17 @@ static int config_write_trunk(struct vty *vty)
 				VTY_NEWLINE);
 		} else
 			vty_out(vty, "  no rtp-patch%s", VTY_NEWLINE);
-		if (trunk->audio_fmtp_extra)
-			vty_out(vty, "   sdp audio fmtp-extra %s%s",
-				trunk->audio_fmtp_extra, VTY_NEWLINE);
-		vty_out(vty, "  %sallow-transcoding%s",
-			trunk->no_audio_transcoding ? "no " : "", VTY_NEWLINE);
 	}

 	return CMD_SUCCESS;
 }

-DEFUN_USRATTR(cfg_trunk_sdp_fmtp_extra,
+DEFUN_DEPRECATED(cfg_trunk_sdp_fmtp_extra,
 	      cfg_trunk_sdp_fmtp_extra_cmd,
-	      X(MGW_CMD_ATTR_NEWCONN),
 	      "sdp audio fmtp-extra .NAME",
-	      "Add extra fmtp for the SDP file\n" "Audio\n" "Fmtp-extra\n"
-	      "Extra Information\n")
+	      SDP_STR AUDIO_STR "Deprecated, without effect since osmo-mgw v1.13\n" "Deprecated, without effect\n")
 {
-	struct mgcp_trunk *trunk = vty->index;
-	char *txt = argv_concat(argv, argc, 0);
-	if (!txt)
-		return CMD_WARNING;
-
-	osmo_talloc_replace_string(g_cfg, &trunk->audio_fmtp_extra, txt);
-	talloc_free(txt);
+	vty_out(vty, "%% deprecated: the config option 'sdp audio fmtp-extra' has been removed.%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -1098,6 +1070,7 @@ DEFUN_DEPRECATED(cfg_trunk_payload_number,
      "sdp audio-payload number <0-255>",
      SDP_STR AUDIO_STR "Number\n" "Payload Number\n")
 {
+	vty_out(vty, "%% Deprecated 'sdp audio-payload number <0-255>' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -1110,6 +1083,7 @@ DEFUN_DEPRECATED(cfg_trunk_payload_name,
      "sdp audio-payload name NAME",
      SDP_STR AUDIO_STR "Payload\n" "Payload Name\n")
 {
+	vty_out(vty, "%% Deprecated 'sdp audio-payload name NAME' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -1122,6 +1096,7 @@ DEFUN_DEPRECATED(cfg_trunk_loop,
 		 "loop (0|1)",
 		 "Loop audio for all endpoints on this trunk\n" "Don't Loop\n" "Loop\n")
 {
+	vty_out(vty, "%% Deprecated 'loop (0|1)' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

@@ -1319,23 +1294,19 @@ DEFUN_ATTR(cfg_trunk_no_rtp_keepalive,
 	return CMD_SUCCESS;
 }

-DEFUN_USRATTR(cfg_trunk_allow_transcoding,
-	      cfg_trunk_allow_transcoding_cmd,
-	      X(MGW_CMD_ATTR_NEWCONN),
-	      "allow-transcoding", "Allow transcoding\n")
+DEFUN_DEPRECATED(cfg_trunk_allow_transcoding,
+		 cfg_trunk_allow_transcoding_cmd,
+		 "allow-transcoding", "Allow transcoding\n")
 {
-	struct mgcp_trunk *trunk = vty->index;
-	trunk->no_audio_transcoding = 0;
+	vty_out(vty, "%% Deprecated 'allow-transcoding' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

-DEFUN_USRATTR(cfg_trunk_no_allow_transcoding,
-	      cfg_trunk_no_allow_transcoding_cmd,
-	      X(MGW_CMD_ATTR_NEWCONN),
-	      "no allow-transcoding", NO_STR "Allow transcoding\n")
+DEFUN_DEPRECATED(cfg_trunk_no_allow_transcoding,
+		 cfg_trunk_no_allow_transcoding_cmd,
+		 "no allow-transcoding", NO_STR "Allow transcoding\n")
 {
-	struct mgcp_trunk *trunk = vty->index;
-	trunk->no_audio_transcoding = 1;
+	vty_out(vty, "%% Deprecated 'no allow-transcoding' config no longer has any effect%s", VTY_NEWLINE);
 	return CMD_SUCCESS;
 }

--- a/src/libosmo-sdp/Makefile.am
+++ b/src/libosmo-sdp/Makefile.am
@@ -0,0 +1,28 @@
+AM_CPPFLAGS = \
+	$(all_includes) \
+	-I$(top_srcdir)/include \
+	-I$(top_builddir) \
+	$(NULL)
+
+AM_CFLAGS = \
+	-Wall \
+	$(LIBOSMOCORE_CFLAGS) \
+	$(TALLOC_CFLAGS) \
+	$(NULL)
+
+noinst_LTLIBRARIES = \
+	libosmo-sdp.la \
+	$(NULL)
+
+libosmo_sdp_la_SOURCES = \
+	sdp_codec.c \
+	sdp_codec_list.c \
+	sdp_msg.c \
+	sdp_internal.c \
+	fmtp.c \
+	$(NULL)
+
+libosmo_sdp_la_LIBADD = \
+	$(LIBOSMOCORE_LIBS) \
+	$(TALLOC_LIBS) \
+	$(NULL)
--- a/src/libosmo-sdp/fmtp.c
+++ b/src/libosmo-sdp/fmtp.c
@@ -0,0 +1,193 @@
+/*
+ * (C) 2023-2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Neels Hofmeyr
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include <string.h>
+#include <ctype.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/sdp/sdp_strings.h>
+#include <osmocom/sdp/fmtp.h>
+
+/* End of current fmtp parameter. Return a pointer to the next ';' character, if present, or the terminating '\0'. */
+static const char *osmo_sdp_fmtp_end(const char *fmtp)
+{
+	if (!fmtp)
+		return NULL;
+	for (; *fmtp && *fmtp != ';'; fmtp++);
+	return fmtp;
+}
+
+/* Start of next fmtp parameter. Return a pointer to the first character of the next fmtp parameter's name, or the
+ * terminating '\0'. */
+static const char *osmo_sdp_fmtp_next(const char *fmtp)
+{
+	if (!fmtp)
+		return NULL;
+	fmtp = osmo_sdp_fmtp_end(fmtp);
+	for (; *fmtp && (*fmtp == ';' || isspace(*fmtp)); fmtp++);
+	return fmtp;
+}
+
+/*! Parse a given SDP fmtp value string, returning the value of a specific option, if present.
+ *
+ * Example:
+ *
+ *   const char *fmtp_vals = "octet-align=1;mode-set=0,2,4,7";
+ *
+ *   char mode_set_str[23];
+ *   if (osmo_sdp_fmtp_get_val(mode_set_str, sizeof(mode_set_str), fmtp_vals, "mode-set")) {
+ *           // option 'mode-set' is present, now mode_set_str == "0,2,4,7"
+ *           use_modeset(mode_set_str);
+ *   } else {
+ *           // if 'mode-set' were not present...
+ *           use_modeset(MY_DEFAULT_MODESET);
+ *   }
+ *
+ * \param[out] val  Buffer to write the option's value to.
+ * \param[in] val_size  Space available in val.
+ * \param[in] fmtp  fmtp value string to parse -- must not contain the "a=fmtp:N " prefix, only the value part.
+ * \param[in] option_name  Which fmtp option to get the value for.
+ * \return true when the option was found, false when it was not present.
+ */
+bool osmo_sdp_fmtp_get_val(char *val, size_t val_size, const char *fmtp, const char *option_name)
+{
+	const char *pos = fmtp;
+	const char *end;
+	int option_name_len = strlen(option_name);
+	for (; pos && *pos; pos = osmo_sdp_fmtp_next(pos)) {
+		if (!osmo_str_startswith(pos, option_name))
+			continue;
+		pos += option_name_len;
+		if (*pos != '=')
+			continue;
+		pos++;
+		break;
+	}
+
+	if (!pos || !*pos)
+		return false;
+
+	end = osmo_sdp_fmtp_end(pos);
+	OSMO_ASSERT(end);
+	if (val && val_size)
+		osmo_strlcpy(val, pos, OSMO_MIN(val_size, end - pos + 1));
+	return true;
+}
+
+/*! Parse a given SDP fmtp value string, returning the value of a specific integer option, if present.
+ *
+ * Example:
+ *
+ *   const char *fmtp_vals = "octet-align=1;mode-set=0,2,4,7";
+ *   bool oa = osmo_sdp_fmtp_get_int(fmtp_vals, OSMO_SDP_AMR_OCTET_ALIGN_NAME, 1);
+ *
+ * \param[in] fmtp  fmtp value string to parse -- must not contain the "a=fmtp:N " prefix, only the value part.
+ * \param[in] option_name  Which fmtp option to get the value for.
+ * \param[in] default_value  If option_name is not present or cannot be parsed as integer, return this instead.
+ * \return the integer value when the option was found and actually an integer, default_value otherwise.
+ */
+int64_t osmo_sdp_fmtp_get_int(const char *fmtp, const char *option_name, int64_t default_value)
+{
+	char val[128];
+	if (!osmo_sdp_fmtp_get_val(val, sizeof(val), fmtp, option_name))
+		return default_value;
+	if (!val[0])
+		return default_value;
+	int64_t i;
+	if (osmo_str_to_int64(&i, val, 10, INT64_MIN, INT64_MAX)) {
+		/* error parsing number */
+		return default_value;
+	}
+	return i;
+}
+
+/*! Return true if octet-align is present and set to 1 in the given AMR related fmtp value.
+ * Default to octet-align=0, i.e. bandwidth-efficient mode.
+ *
+ * See RFC4867 "RTP Payload Format for AMR and AMR-WB" sections "8.1. AMR Media Type Registration" and "8.2. AMR-WB
+ * Media Type Registration":
+ *
+ *    octet-align: Permissible values are 0 and 1.  If 1, octet-align
+ *                 operation SHALL be used.  If 0 or if not present,
+ *                 bandwidth-efficient operation is employed.
+ *
+ * https://tools.ietf.org/html/rfc4867
+ */
+bool osmo_sdp_fmtp_amr_is_octet_aligned(const char *fmtp)
+{
+	return osmo_sdp_fmtp_get_int(fmtp, OSMO_SDP_STR_AMR_OCTET_ALIGN, 0) == 1;
+}
+
+static void strip_whitespace(char *str)
+{
+	char *i = str;
+	char *o = str;
+	for (; *i; i++, o++) {
+		while (isspace(*i))
+			i++;
+		*o = *i;
+		if (!*i)
+			break;
+	}
+}
+
+/* Return true when the two AMR type fmtp strings can be considered equivalent.
+ * - Omission of octet-align is equivalent to having octet-align=0 present (0 is the default).
+ * - Omission of 'mode-set' means, match any and all codec modes. So if either a or b have no 'mode-set', it's a match.
+ *   If both have 'mode-set' present, they must be identical to match. Do not sort the mode-set string, but strip
+ *   whitespace.
+ * - TODO all other parameters are currently completely ignored.
+ */
+bool osmo_sdp_fmtp_amr_match(const char *a, const char *b)
+{
+	char a_modeset[32] = {};
+	char b_modeset[32] = {};
+	bool a_ok;
+	bool b_ok;
+
+	if (!a)
+		a = "";
+	if (!b)
+		b = "";
+
+	/* octet-align=1. Omission means octet-align=0 */
+	if (osmo_sdp_fmtp_amr_is_octet_aligned(a) != osmo_sdp_fmtp_amr_is_octet_aligned(b))
+		return false;
+
+	/* mode-set=0,1,2,3,4,5,6,7 */
+	a_ok = osmo_sdp_fmtp_get_val(a_modeset, sizeof(a_modeset), a, "mode-set");
+	b_ok = osmo_sdp_fmtp_get_val(b_modeset, sizeof(b_modeset), b, "mode-set");
+	if (a_ok && b_ok) {
+		/* Strip whitespace: We don't know what remote SDP peers may throw at us. There could be whitespace
+		 * around the separators like 'mode-set=2,3 ; octet-align=1', which may show up here as whitespace in
+		 * the value string as "2,3 ", which would mismatch "2,3". */
+		strip_whitespace(a_modeset);
+		strip_whitespace(b_modeset);
+		if (strcmp(a_modeset, b_modeset))
+			return false;
+	}
+
+	/* TODO: treat other AMR traits, see RFC4867 8.1. Maybe generically match all values that are present?
+	 * So far we have no need for other values than octet-align and mode-set. */
+
+	/* No mismatch found, it's a match */
+	return true;
+}
--- a/src/libosmo-sdp/sdp_codec.c
+++ b/src/libosmo-sdp/sdp_codec.c
@@ -0,0 +1,251 @@
+/* Codec management in SDP messages. */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <ctype.h>
+
+#include <osmocom/core/utils.h>
+
+#include <osmocom/sdp/fmtp.h>
+#include <osmocom/sdp/sdp_codec.h>
+#include <osmocom/sdp/sdp_internal.h>
+
+struct osmo_sdp_codec *osmo_sdp_codec_alloc(void *ctx)
+{
+	return talloc_zero(ctx, struct osmo_sdp_codec);
+}
+
+int osmo_sdp_codec_set(struct osmo_sdp_codec *c,
+		       int8_t payload_type, const char *encoding_name, unsigned int rate, const char *fmtp)
+{
+	c->rate = rate;
+	osmo_sdp_codec_set_encoding_name(c, encoding_name);
+	osmo_sdp_codec_set_fmtp(c, fmtp);
+	c->payload_type = payload_type;
+	return 0;
+}
+
+int osmo_sdp_codec_set_encoding_name(struct osmo_sdp_codec *c, const char *encoding_name)
+{
+	osmo_talloc_replace_string(c, &c->encoding_name, encoding_name);
+	return 0;
+}
+
+int osmo_sdp_codec_set_fmtp(struct osmo_sdp_codec *c, const char *fmtp)
+{
+	osmo_talloc_replace_string(c, &c->fmtp, fmtp);
+	return 0;
+}
+
+bool osmo_sdp_codec_is_set(const struct osmo_sdp_codec *a)
+{
+	return a && a->encoding_name && a->encoding_name[0];
+}
+
+int osmo_sdp_codec_to_str_buf(char *buf, size_t buflen, const struct osmo_sdp_codec *codec)
+{
+	struct osmo_strbuf sb = { .buf = buf, .len = buflen };
+	if (!codec) {
+		OSMO_STRBUF_PRINTF(sb, "NULL");
+		return sb.chars_needed;
+	}
+	if (codec->encoding_name && codec->encoding_name[0])
+		OSMO_STRBUF_PRINTF(sb, "%s", codec->encoding_name);
+	if (codec->rate != 8000)
+		OSMO_STRBUF_PRINTF(sb, "/%u", codec->rate);
+	if (codec->fmtp && codec->fmtp[0])
+		OSMO_STRBUF_PRINTF(sb, ":%s", codec->fmtp);
+	OSMO_STRBUF_PRINTF(sb, "#%d", codec->payload_type);
+	return sb.chars_needed;
+}
+
+char *osmo_sdp_codec_to_str_c(void *ctx, const struct osmo_sdp_codec *codec)
+{
+	OSMO_NAME_C_IMPL(ctx, 32, "osmo_sdp_codec_to_str_c-ERROR", osmo_sdp_codec_to_str_buf, codec)
+}
+
+/*! Parse a codec string as from osmo_sdp_codec_to_str_buf() back to an osmo_sdp_codec struct.
+ * Write the parsed result to *dst, using ctx as talloc parent.
+ * The input string is like <encoding_name>[:<fmtp-string>][#<payload-type-nr>]
+ * for example:
+ *    "FOO:my-fmtp=1;my-other-fmtp=2#42"
+ * Note that ';' are separators only within the fmtp string. This function does not separate those. In above example,
+ * the fmtp string part is "my-fmtp=val;my-other-fmtp=val2" and ends up in dst->ftmp as-is.
+ * Parse at most str_len characters, or the entire string when str_len < 0 or str_len > strlen(str).
+ * Return 0 on success, negative on failure. */
+int osmo_sdp_codec_from_str(struct osmo_sdp_codec *dst, const char *str, int str_len)
+{
+	const char *pos = str;
+	const char *str_end = str + (str_len >= 0 ? str_len : strlen(str));
+	const char *p2;
+
+	struct token token_encoding_name = {};
+	struct token token_rate = {};
+	struct token token_fmtp = {};
+	struct token token_payload_type = {};
+
+	struct token *new_t = NULL;
+	/* start with the encoding name */
+	struct token *t = &token_encoding_name;
+	t->start = pos;
+
+	for (; pos < str_end; pos++) {
+		new_t = NULL;
+		switch (*pos) {
+		case '/':
+			new_t = &token_rate;
+			break;
+		case ':':
+			new_t = &token_fmtp;
+			break;
+		case '#':
+			/* count this '#' only if there is no other one following. It might be part of a fmtp. */
+			for (p2 = pos + 1; p2 < str_end; p2++)
+				if (*p2 == '#')
+					break;
+			if (p2 < str_end && *p2 == '#')
+				break;
+			/* This is the last '#' in the string. Count it only when a digit follows. */
+			if (!isdigit(pos[1]))
+				break;
+			new_t = &token_payload_type;
+			break;
+		default:
+			break;
+		}
+		if (!new_t)
+			continue;
+		/* If we already have a token for a start character, don't start it again. These may be part of a fmtp
+		 * string. */
+		if (new_t == t)
+			continue;
+		t->end = pos;
+		t = new_t;
+		t->start = pos + 1;
+	}
+	t->end = pos;
+
+	token_copy(dst, &dst->encoding_name, &token_encoding_name);
+	if (token_rate.start)
+		dst->rate = atoi(token_rate.start);
+	else
+		dst->rate = 8000;
+	token_copy(dst, &dst->fmtp, &token_fmtp);
+	if (token_payload_type.start)
+		dst->payload_type = atoi(token_payload_type.start);
+	return 0;
+}
+
+/* Compare both payload type number and fmtp string 1:1 */
+const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_exact = {
+	.payload_type = true,
+	.encoding_name = true,
+	.rate = true,
+	.fmtp = OSMO_SDP_CMP_EXACT,
+};
+
+/* Ignore payload type number; compare fmtp string by meaning when possible, else 1:1 */
+const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_equivalent = {
+	.payload_type = false,
+	.encoding_name = true,
+	.rate = true,
+	.fmtp = OSMO_SDP_CMP_EQUIVALENT,
+};
+
+/* Compare only encoding name */
+const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_name = {
+	.payload_type = false,
+	.encoding_name = true,
+	.rate = false,
+	.fmtp = OSMO_SDP_CMP_IGNORE,
+};
+
+extern const struct osmo_sdp_codec_cmp_flags osmo_sdp_codec_cmp_equivalent;
+static inline int strcmp_safe(const char *a, const char *b)
+{
+	return strcmp(a ? : "", b ? : "");
+}
+
+/*! Compare encoding name, rate and fmtp, returning cmp result: -1 if a < b, 0 if a == b, 1 if a > b.
+ * Compare as defined in 'cmp':
+ * If cmpf->payload_type is false, ignore payload_type numbers.
+ * If cmpf->rate is false, ignore rate.
+ * If cmpf->fmtp is OSMO_SDP_CMP_IGNORE, ignore fmtp strings.
+ * If cmpf->fmtp is OSMO_SDP_CMP_EXACT, use strcmp() to match fmtp 1:1.
+ * If cmpf->fmtp is OSMO_SDP_CMP_EQUIVALENT, use specific fmtp knowledge to match equivalent entries;
+ *  - AMR fmtp matching is done by osmo_sdp_fmtp_amr_match().
+ *  - for all others, still compare fmtp 1:1.
+ */
+int osmo_sdp_codec_cmp(const struct osmo_sdp_codec *a, const struct osmo_sdp_codec *b,
+		       const struct osmo_sdp_codec_cmp_flags *cmpf)
+{
+	int cmp;
+	if (a == b)
+		return 0;
+	if (!a)
+		return -1;
+	if (!b)
+		return 1;
+
+	if (!cmpf)
+		cmpf = &osmo_sdp_codec_cmp_exact;
+
+	if (cmpf->encoding_name) {
+		cmp = strcmp_safe(a->encoding_name, b->encoding_name);
+		if (cmp)
+			return cmp;
+	}
+
+	if (cmpf->rate) {
+		cmp = OSMO_CMP(a->rate, b->rate);
+		if (cmp)
+			return cmp;
+	}
+
+	switch (cmpf->fmtp) {
+	default:
+	case OSMO_SDP_CMP_EXACT:
+		cmp = strcmp_safe(a->fmtp, b->fmtp);
+		break;
+
+	case OSMO_SDP_CMP_EQUIVALENT:
+		/* In case of AMR, allow logical matching; we only need to do that if the strings differ. */
+		cmp = strcmp_safe(a->fmtp, b->fmtp);
+		if (cmp
+		    && !strcmp_safe("AMR", a->encoding_name)
+		    && osmo_sdp_fmtp_amr_match(a->fmtp, b->fmtp))
+			cmp = 0;
+		break;
+
+	case OSMO_SDP_CMP_IGNORE:
+		cmp = 0;
+		break;
+	}
+	if (cmp)
+		return cmp;
+
+	if (cmpf->payload_type)
+		cmp = OSMO_CMP(a->payload_type, b->payload_type);
+
+	return cmp;
+}
--- a/src/libosmo-sdp/sdp_codec_list.c
+++ b/src/libosmo-sdp/sdp_codec_list.c
@@ -0,0 +1,367 @@
+/* Codec management in SDP messages. */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <string.h>
+
+#include <osmocom/core/utils.h>
+
+#include <osmocom/sdp/sdp_codec_list.h>
+
+struct osmo_sdp_codec_list *osmo_sdp_codec_list_alloc(void *ctx)
+{
+	struct osmo_sdp_codec_list *codec_list = talloc_zero(ctx, struct osmo_sdp_codec_list);
+	INIT_LLIST_HEAD(&codec_list->list);
+	return codec_list;
+}
+
+/*! Free all items contained in this list, do not free the list itself (leave an empty list). */
+void osmo_sdp_codec_list_free_items(struct osmo_sdp_codec_list *codec_list)
+{
+	struct osmo_sdp_codec *c;
+	while ((c = osmo_sdp_codec_list_first(codec_list))) {
+		osmo_sdp_codec_list_remove_entry(c);
+		talloc_free(c);
+	}
+}
+
+struct osmo_sdp_codec *osmo_sdp_codec_list_add_empty(struct osmo_sdp_codec_list *codec_list)
+{
+	struct osmo_sdp_codec *c = osmo_sdp_codec_alloc(codec_list);
+	llist_add_tail(&c->entry, &codec_list->list);
+	return c;
+}
+
+int8_t osmo_sdp_codec_list_get_unused_dyn_pt_nr(const struct osmo_sdp_codec_list *codec_list, int8_t suggest_pt_nr)
+{
+	bool present[127 - 96 + 1] = {};
+	const struct osmo_sdp_codec *c;
+	bool suggest_pt_nr_exists = false;
+	int i;
+
+	osmo_sdp_codec_list_foreach (c, codec_list) {
+		if (c->payload_type >= 96 && c->payload_type <= 127)
+			present[c->payload_type - 96] = true;
+		if (c->payload_type == suggest_pt_nr)
+			suggest_pt_nr_exists = true;
+	}
+
+	if (!suggest_pt_nr_exists)
+		return suggest_pt_nr;
+
+	/* The desired number is already taken, see which of the dynamic types is not taken yet */
+	for (i = 96; i <= 127; i++) {
+		/* For dynamic allocations, skip these predefined numbers, taken from enum mgcp_codecs:
+		 * CODEC_GSMEFR_8000_1 = 110,	3GPP TS 48.103 table 5.4.2.2.1
+		 * CODEC_GSMHR_8000_1 = 111,	3GPP TS 48.103 table 5.4.2.2.1
+		 * CODEC_AMR_8000_1 = 112,		3GPP TS 48.103 table 5.4.2.2.1
+		 * CODEC_AMRWB_16000_1 = 113,	3GPP TS 48.103 table 5.4.2.2.1
+		 * CODEC_CLEARMODE = 120,		3GPP TS 48.103 table 5.4.2.2.1
+		 */
+		if (i >= 110 && i <= 113)
+			continue;
+		else if (i == 120)
+			continue;
+
+		if (!present[i - 96])
+			return i;
+	}
+
+	return -1;
+}
+
+/*! Allocate a new entry in codec_list and copy codec's values to it.
+ * If once is NULL, unconditionally add a new codec entry.
+ * If once is non-NULL, do not add a new entry when the list already contains a matching entry; for determining a match,
+ * use the once->flags. For example, if once = &osmo_sdp_codec_cmp_equivalent, look up if codec_list has a similar
+ * codec, and add the new entry only if it is not listed.
+ * See osmo_sdp_codec_cmp() and osmo_sdp_fmtp_amr_match() for details.
+ * Return the new entry, or the equivalent entry already present in the list.
+ */
+struct osmo_sdp_codec *osmo_sdp_codec_list_add(struct osmo_sdp_codec_list *codec_list,
+					       const struct osmo_sdp_codec *codec,
+					       const struct osmo_sdp_codec_cmp_flags *once, bool pick_unused_pt_nr)
+{
+	struct osmo_sdp_codec *new_entry;
+	int8_t payload_type;
+
+	if (once) {
+		struct osmo_sdp_codec *c;
+		osmo_sdp_codec_list_foreach (c, codec_list)
+			if (!osmo_sdp_codec_cmp(codec, c, once))
+				return c;
+	}
+
+	/* Adjust payload_type number? */
+	payload_type = codec->payload_type;
+	if (pick_unused_pt_nr)
+		payload_type = osmo_sdp_codec_list_get_unused_dyn_pt_nr(codec_list, payload_type);
+
+	/* Take provided values, possibly modified payload_type */
+	new_entry = osmo_sdp_codec_list_add_empty(codec_list);
+	osmo_sdp_codec_set(new_entry, payload_type, codec->encoding_name, codec->rate, codec->fmtp);
+
+	return new_entry;
+}
+
+/*! Remove and free all entries from the codec_list that match the given codec according to osmo_sdp_codec_cmp(cmpf).
+ * Return the number of entries freed. */
+int osmo_sdp_codec_list_remove(struct osmo_sdp_codec_list *codec_list, const struct osmo_sdp_codec *codec,
+			       const struct osmo_sdp_codec_cmp_flags *cmpf)
+{
+	struct osmo_sdp_codec *i, *j;
+	int count = 0;
+	osmo_sdp_codec_list_foreach_safe (i, j, codec_list) {
+		if (osmo_sdp_codec_cmp(i, codec, cmpf))
+			continue;
+		osmo_sdp_codec_list_remove_entry(i);
+		talloc_free(i);
+		count++;
+	}
+	return count;
+}
+
+/*! Unlink an osmo_sdp_codec from an osmo_sdp_codec_list, if the codec instance is part of a list. Do not free the
+ * struct osmo_sdp_codec.
+ */
+void osmo_sdp_codec_list_remove_entry(struct osmo_sdp_codec *codec)
+{
+	/* The codec is not part of a list in these cases:
+	 * After talloc_zero(), next == NULL.
+	 * After llist_del(), next == LLIST_POISON1. */
+	if (codec->entry.next != NULL
+	    && codec->entry.next != (struct llist_head *)LLIST_POISON1)
+		llist_del(&codec->entry);
+}
+
+static inline int strcmp_safe(const char *a, const char *b)
+{
+	return strcmp(a ? : "", b ? : "");
+}
+
+/*! Short single-line representation of a list of SDP audio codecs, convenient for logging.
+ * If summarize == true, collapse variants of the same encoding_name (in practice, don't show all of the various AMR
+ * fmtp permutations). If summarize == false, print each and every codec in full.
+ */
+int osmo_sdp_codec_list_to_str_buf(char *buf, size_t buflen, const struct osmo_sdp_codec_list *codec_list, bool summarize)
+{
+	struct osmo_strbuf sb = { .buf = buf, .len = buflen };
+	const struct osmo_sdp_codec *codec;
+	bool first;
+
+	if (llist_empty(&codec_list->list)) {
+		OSMO_STRBUF_PRINTF(sb, "(no-codecs)");
+		return sb.chars_needed;
+	}
+
+	if (!summarize) {
+		first = true;
+		osmo_sdp_codec_list_foreach (codec, codec_list) {
+			if (!first)
+				OSMO_STRBUF_PRINTF(sb, " ");
+			OSMO_STRBUF_APPEND(sb, osmo_sdp_codec_to_str_buf, codec);
+			first = false;
+		}
+		return sb.chars_needed;
+	}
+
+	/* summarize */
+	first = true;
+	osmo_sdp_codec_list_foreach (codec, codec_list) {
+		const struct osmo_sdp_codec *c2;
+		int count = 0;
+		bool various_pt = false;
+
+		/* When this encoding name has been handled before, skip it now. */
+		osmo_sdp_codec_list_foreach (c2, codec_list) {
+			if (c2 == codec)
+				break;
+			if (!strcmp_safe(codec->encoding_name, c2->encoding_name)) {
+				count = 1;
+				break;
+			}
+		}
+		if (count)
+			continue;
+
+		/* Not seen this encoding_name before, count total occurences */
+		count = 0;
+		osmo_sdp_codec_list_foreach (c2, codec_list) {
+			if (!strcmp_safe(codec->encoding_name, c2->encoding_name)) {
+				count++;
+				if (codec->payload_type != c2->payload_type)
+					various_pt = true;
+			}
+		}
+
+		if (!first)
+			OSMO_STRBUF_PRINTF(sb, " ");
+		if (count > 1)
+			OSMO_STRBUF_PRINTF(sb, "%d*", count);
+		OSMO_STRBUF_PRINTF(sb, "%s", codec->encoding_name);
+		if (!various_pt)
+			OSMO_STRBUF_PRINTF(sb, "#%d", codec->payload_type);
+		first = false;
+	}
+	return sb.chars_needed;
+}
+
+char *osmo_sdp_codec_list_to_str_c(void *ctx, const struct osmo_sdp_codec_list *codec_list, bool summarize)
+{
+	OSMO_NAME_C_IMPL(ctx, 128, "osmo_sdp_codec_list_to_str_c-ERROR", osmo_sdp_codec_list_to_str_buf, codec_list, summarize)
+}
+
+/*! Return first entry, or NULL if the list is empty. */
+struct osmo_sdp_codec *osmo_sdp_codec_list_first(const struct osmo_sdp_codec_list *list)
+{
+	return llist_first_entry_or_null(&list->list, struct osmo_sdp_codec, entry);
+}
+
+/*! Move entries matching 'codec' to the front of the list. Matching is done via osmo_sdp_codec_cmp(cmpf).
+ * Return the number of matches that are now at the front of the list.
+ */
+int osmo_sdp_codec_list_move_to_first(struct osmo_sdp_codec_list *codec_list, const struct osmo_sdp_codec *codec,
+				      const struct osmo_sdp_codec_cmp_flags *cmpf)
+{
+	struct llist_head *head = &codec_list->list;
+	struct osmo_sdp_codec *i, *j;
+	int matches_found = 0;
+	osmo_sdp_codec_list_foreach_safe (i, j, codec_list) {
+		if (osmo_sdp_codec_cmp(codec, i, cmpf))
+			continue;
+		/* It's a match, move to the head */
+		osmo_sdp_codec_list_remove_entry(i);
+		llist_add(&i->entry, head);
+		matches_found++;
+		/* If more matches show up later, add them *after* the one just moved to the front. */
+		head = &i->entry;
+	}
+
+	return matches_found;
+}
+
+/*! Compare two lists of SDP codecs, returning cmp result: -1 if a < b, 0 if a == b, 1 if a > b.
+ * The two lists are compared in order, item by item, using osmo_sdp_codec_cmp(cmpf).
+ */
+int osmo_sdp_codec_list_cmp(const struct osmo_sdp_codec_list *a, const struct osmo_sdp_codec_list *b,
+			    const struct osmo_sdp_codec_cmp_flags *cmpf)
+{
+	const struct llist_head *a_start;
+	const struct llist_head *a_pos;
+	const struct llist_head *b_start;
+	const struct llist_head *b_pos;
+	int cmp;
+
+	/* NULL pointer == empty list */
+	if (a && llist_empty(&a->list))
+		a = NULL;
+	if (b && llist_empty(&a->list))
+		b = NULL;
+
+	/* are one or both empty? */
+	if (a == b)
+		return 0;
+	if (!a)
+		return -1;
+	if (!b)
+		return 1;
+
+	/* compare item by item */
+	a_start = &a->list;
+	a_pos = a_start->next;
+	b_start = &b->list;
+	b_pos = b_start->next;
+
+	for (; a_pos != a_start; a_pos = a_pos->next, b_pos = b_pos->next) {
+		const struct osmo_sdp_codec *codec_a;
+		const struct osmo_sdp_codec *codec_b;
+
+		if (b_pos == b_start) {
+			/* there is an entry in a, but b has already ended. mismatch. */
+			return 1;
+		}
+
+		codec_a = llist_entry(a_pos, struct osmo_sdp_codec, entry);
+		codec_b = llist_entry(b_pos, struct osmo_sdp_codec, entry);
+		cmp = osmo_sdp_codec_cmp(codec_a, codec_b, cmpf);
+		if (cmp)
+			return cmp;
+	}
+
+	if (b_pos != b_start) {
+		/* 'a' has ended, but 'b' has more items. mismatch. */
+		return -1;
+	}
+
+	/* full match. */
+	return 0;
+}
+
+/*! Leave only those codecs in 'dst' that are also present in 'other'.
+ * The matching is made by osmo_sdp_codec_cmp(cmpf).
+ * If translate_payload_type_numbers has an effect if 'dst' and 'other' have mismatching payload_type numbers for the
+ * same SDP codec descriptions. If translate_payload_type_numbers is true, take the payload_type numbers from 'other'.
+ * If false, keep payload_type numbers in 'dst' unchanged. */
+void osmo_sdp_codec_list_intersection(struct osmo_sdp_codec_list *dst, const struct osmo_sdp_codec_list *other,
+				      const struct osmo_sdp_codec_cmp_flags *cmpf,
+				      bool translate_payload_type_numbers)
+{
+	struct osmo_sdp_codec *i, *j;
+	osmo_sdp_codec_list_foreach_safe (i, j, dst) {
+		struct osmo_sdp_codec *o;
+		struct osmo_sdp_codec *match = NULL;
+		osmo_sdp_codec_list_foreach (o, other) {
+			if (osmo_sdp_codec_cmp(i, o, cmpf))
+				continue;
+			match = o;
+			break;
+		}
+
+		if (!match) {
+			osmo_sdp_codec_list_remove_entry(i);
+			talloc_free(i);
+			continue;
+		}
+
+		if (translate_payload_type_numbers)
+			i->payload_type = match->payload_type;
+	}
+}
+
+/* Find an entry for the given payload_type number in the given list of codecs. */
+struct osmo_sdp_codec *osmo_sdp_codec_list_by_payload_type(struct osmo_sdp_codec_list *codec_list, int8_t payload_type)
+{
+	struct osmo_sdp_codec *codec;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		if (codec->payload_type == payload_type)
+			return codec;
+	}
+	return NULL;
+}
+
+bool osmo_sdp_codec_list_is_empty(const struct osmo_sdp_codec_list *codec_list)
+{
+	if (!codec_list)
+		return true;
+	return llist_empty(&codec_list->list);
+}
--- a/src/libosmo-sdp/sdp_internal.c
+++ b/src/libosmo-sdp/sdp_internal.c
@@ -0,0 +1,47 @@
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stddef.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/sdp/sdp_internal.h>
+
+/* Copy a string from t->start to t->end, return as talloc allocated under ctx in *dst.
+ * If *dst is non-NULL, talloc_free(*dst) first. */
+void token_copy(void *ctx, char **dst, const struct token *t)
+{
+	size_t len;
+	if (*dst)
+		talloc_free(*dst);
+	if (!t->start || !(t->end > t->start)) {
+		*dst = NULL;
+		return;
+	}
+
+	len = t->end - t->start;
+	*dst = talloc_size(ctx, len + 1);
+	osmo_strlcpy(*dst, t->start, len + 1);
+	talloc_set_name_const(*dst, *dst);
+}
--- a/src/libosmo-sdp/sdp_msg.c
+++ b/src/libosmo-sdp/sdp_msg.c
@@ -0,0 +1,471 @@
+/* Implementation for SDP message encoding and decoding */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <inttypes.h>
+#include <errno.h>
+#include <ctype.h>
+
+#include <osmocom/core/utils.h>
+
+#include <osmocom/sdp/sdp_msg.h>
+#include <osmocom/sdp/sdp_strings.h>
+#include <osmocom/sdp/sdp_internal.h>
+
+static const char * const mdir_str[] = {
+	[OSMO_SDP_MDIR_UNSET] = "-",
+	[OSMO_SDP_MDIR_SENDONLY] = OSMO_SDP_STR_SENDONLY,
+	[OSMO_SDP_MDIR_RECVONLY] = OSMO_SDP_STR_RECVONLY,
+	[OSMO_SDP_MDIR_SENDRECV] = OSMO_SDP_STR_SENDRECV,
+	[OSMO_SDP_MDIR_INACTIVE] = OSMO_SDP_STR_INACTIVE,
+};
+
+/*! Convert struct osmo_sdp_msg to the actual SDP protocol representation. */
+int osmo_sdp_msg_encode_buf(char *dst, size_t dst_size, const struct osmo_sdp_msg *sdp)
+{
+	const struct osmo_sdp_codec *codec;
+	struct osmo_strbuf sb = { .buf = dst, .len = dst_size };
+	const char *oip;
+	char oipv;
+	const char *ip;
+	char ipv;
+
+	if (!sdp) {
+		OSMO_STRBUF_PRINTF(sb, "%s", "");
+		return sb.chars_needed;
+	}
+
+	oip = sdp->origin.addr.ip[0] ? sdp->origin.addr.ip : "0.0.0.0";
+	oipv = (osmo_ip_str_type(oip) == AF_INET6) ? '6' : '4';
+
+	ip = sdp->rtp.ip[0] ? sdp->rtp.ip : "0.0.0.0";
+	ipv = (osmo_ip_str_type(oip) == AF_INET6) ? '6' : '4';
+
+	OSMO_STRBUF_PRINTF(sb,
+			   "v=0\r\n"
+			   "o=%s %s %s IN IP%c %s\r\n"
+			   "s=%s\r\n"
+			   "c=IN IP%c %s\r\n"
+			   "t=%"PRId64" %"PRId64"\r\n"
+			   "m=audio %d RTP/AVP",
+			   sdp->origin.username ? : "libosmo-sdp",
+			   sdp->origin.sess_id ? : "0", sdp->origin.sess_version ? : "0",
+			   oipv, oip,
+			   sdp->session_name ? : "-",
+			   ipv, ip,
+			   sdp->time_active.start,
+			   sdp->time_active.stop,
+			   sdp->rtp.port);
+
+	/* Append all payload type numbers to 'm=audio <port> RTP/AVP 3 4 112' line */
+	osmo_sdp_codec_list_foreach(codec, sdp->codecs)
+		OSMO_STRBUF_PRINTF(sb, " %d", codec->payload_type);
+	OSMO_STRBUF_PRINTF(sb, "\r\n");
+
+	/* Add details for all codecs */
+	osmo_sdp_codec_list_foreach(codec, sdp->codecs) {
+		if (!osmo_sdp_codec_is_set(codec))
+			continue;
+		OSMO_STRBUF_PRINTF(sb, OSMO_SDP_A_PREFIX(OSMO_SDP_STR_RTPMAP) "%d %s/%d\r\n", codec->payload_type, codec->encoding_name,
+				   codec->rate > 0 ? codec->rate : 8000);
+		if (codec->fmtp && codec->fmtp[0])
+			OSMO_STRBUF_PRINTF(sb, OSMO_SDP_A_PREFIX(OSMO_SDP_STR_FMTP) "%d %s\r\n", codec->payload_type, codec->fmtp);
+	}
+
+	if (sdp->ptime)
+		OSMO_STRBUF_PRINTF(sb, OSMO_SDP_A_PREFIX(OSMO_SDP_STR_PTIME) "%d\r\n", sdp->ptime);
+
+	if (sdp->media_direction != OSMO_SDP_MDIR_UNSET && sdp->media_direction < ARRAY_SIZE(mdir_str))
+		OSMO_STRBUF_PRINTF(sb, "a=%s\r\n", mdir_str[sdp->media_direction]);
+
+	return sb.chars_needed;
+}
+
+char *osmo_sdp_msg_encode_c(void *ctx, const struct osmo_sdp_msg *sdp)
+{
+	OSMO_NAME_C_IMPL(ctx, 256, "osmo_sdp_msg_to_str_c-ERROR", osmo_sdp_msg_encode_buf, sdp)
+}
+
+/* Return the first line ending (or the end of the string) at or after the given string position. */
+const char *get_line_end(const char *src)
+{
+	const char *line_end = strchr(src, '\r');
+	if (!line_end)
+		line_end = strchr(src, '\n');
+	if (!line_end)
+		line_end = src + strlen(src);
+	return line_end;
+}
+
+static bool str_is_attrib(const char *str, const char *attrib_name, char expect_next_char)
+{
+	char next_c;
+	if (!osmo_str_startswith(str, attrib_name))
+		return false;
+	next_c = str[strlen(attrib_name)];
+	if (expect_next_char == next_c)
+		return true;
+	/* Treat \0 as equivalent with line end */
+	if (!expect_next_char && (next_c == '\r' || next_c == '\n'))
+		return true;
+	/* It started with the string, but continued otherwise */
+	return false;
+}
+
+static enum osmo_sdp_media_direcion_e check_for_media_direction(const char *str)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(mdir_str); i++) {
+		if (i == OSMO_SDP_MDIR_UNSET)
+			continue;
+		if (str_is_attrib(str, mdir_str[i], 0))
+			return i;
+	}
+	return OSMO_SDP_MDIR_UNSET;
+}
+
+static struct osmo_sdp_codec *find_or_create_payload_type(struct osmo_sdp_msg *sdp, unsigned int payload_type)
+{
+	struct osmo_sdp_codec *codec;
+	codec = osmo_sdp_codec_list_by_payload_type(sdp->codecs, payload_type);
+	if (!codec) {
+		codec = osmo_sdp_codec_list_add_empty(sdp->codecs);
+		codec->payload_type = payload_type;
+		codec->rate = 8000;
+	}
+	return codec;
+}
+
+
+/* parse a line like 'a=rtpmap:0 PCMU/8000', 'a=fmtp:112 octet-align=1; mode-set=4', 'a=ptime:20'.
+ * The src should point at the character after 'a=', e.g. at the start of 'rtpmap', 'fmtp', 'ptime'
+ */
+int sdp_parse_attrib(struct osmo_sdp_msg *sdp, const char *src)
+{
+	unsigned int payload_type;
+	struct osmo_sdp_codec *codec;
+	enum osmo_sdp_media_direcion_e mdir;
+	const char *line_end = get_line_end(src);
+
+	if (str_is_attrib(src, OSMO_SDP_STR_RTPMAP, ':')) {
+		/* "a=rtpmap:96 AMR/8000" */
+		struct token audio_name;
+		const char *slash;
+		if (sscanf(src, OSMO_SDP_STR_RTPMAP ":%u", &payload_type) != 1)
+			return -EINVAL;
+
+		codec = find_or_create_payload_type(sdp, payload_type);
+
+		audio_name.start = strchr(src, ' ');
+		if (!audio_name.start)
+			return -EINVAL;
+		audio_name.start++;
+		if (audio_name.start >= get_line_end(src))
+			return -EINVAL;
+
+		slash = strchr(audio_name.start, '/');
+
+		audio_name.end = slash ? : line_end;
+		token_copy(codec, &codec->encoding_name, &audio_name);
+
+		if (audio_name.end >= line_end) {
+			/* There should be a "/8000" here. If it is missing, let's not be strict about it. */
+			codec->rate = 8000;
+		} else {
+			unsigned int channels = 1;
+			if (sscanf(audio_name.end, "/%u/%u", &codec->rate, &channels) < 1)
+				return -EINVAL;
+
+			if (channels != 1)
+				return -ENOTSUP;
+		}
+	}
+
+	else if (str_is_attrib(src, OSMO_SDP_STR_FMTP, ':')) {
+		/* "a=fmtp:112 octet-align=1;mode-set=0,1,2,3" */
+		struct token fmtp_str;
+		const char *line_end = get_line_end(src);
+		if (sscanf(src, OSMO_SDP_STR_FMTP ":%u", &payload_type) != 1)
+			return -EINVAL;
+
+		codec = find_or_create_payload_type(sdp, payload_type);
+
+		fmtp_str.start = strchr(src, ' ');
+		if (!fmtp_str.start)
+			return -EINVAL;
+		fmtp_str.start++;
+		if (fmtp_str.start >= line_end)
+			return -EINVAL;
+
+		fmtp_str.end = line_end;
+		token_copy(codec, &codec->fmtp, &fmtp_str);
+	}
+
+	else if (str_is_attrib(src, OSMO_SDP_STR_PTIME, ':')) {
+		/* "a=ptime:20" */
+		if (sscanf(src, OSMO_SDP_STR_PTIME ":%u", &sdp->ptime) != 1)
+			return -EINVAL;
+
+	}
+
+	/* "a=sendrecv" ... */
+	else if ((mdir = check_for_media_direction(src)) != OSMO_SDP_MDIR_UNSET) {
+		sdp->media_direction = mdir;
+	}
+
+	return 0;
+}
+
+static const struct value_string fixed_payload_types[] = {
+	{ 0, "PCMU" },
+	{ 3, "GSM" },
+	{ 8, "PCMA" },
+	{ 18, "G729" },
+	{ 110, "GSM-EFR" },
+	{ 111, "GSM-HR-08" },
+	{ 112, "AMR" },
+	{ 113, "AMR-WB" },
+	{}
+};
+
+/* Parse a line like 'm=audio 16398 RTP/AVP 0 3 8 96 112', starting after the '=' */
+static int sdp_parse_media_description(struct osmo_sdp_msg *sdp, const char *src)
+{
+	unsigned int port;
+	int i;
+	const char *payload_type_str;
+	const char *line_end = get_line_end(src);
+	if (sscanf(src, "audio %u RTP/AVP", &port) < 1)
+		return -ENOTSUP;
+
+	if (port > 0xffff)
+		return -EINVAL;
+
+	sdp->rtp.port = port;
+
+	/* skip "audio 12345 RTP/AVP ", i.e. 3 spaces on */
+	payload_type_str = src;
+	for (i = 0; i < 3; i++) {
+		payload_type_str = strchr(payload_type_str, ' ');
+		if (!payload_type_str)
+			return -EINVAL;
+		while (*payload_type_str == ' ')
+			payload_type_str++;
+		if (payload_type_str >= line_end)
+			return -EINVAL;
+	}
+
+	/* Parse listing of payload type numbers after "RTP/AVP" */
+	while (payload_type_str < line_end) {
+		unsigned int payload_type;
+		struct osmo_sdp_codec *codec;
+		const char *encoding_name;
+		if (sscanf(payload_type_str, "%u", &payload_type) < 1)
+			return -EINVAL;
+
+		codec = find_or_create_payload_type(sdp, payload_type);
+
+		/* Fill in encoding name for fixed payload types */
+		encoding_name = get_value_string_or_null(fixed_payload_types, codec->payload_type);
+		if (encoding_name)
+			osmo_talloc_replace_string(codec, &codec->encoding_name, encoding_name);
+
+		payload_type_str = strchr(payload_type_str, ' ');
+		if (!payload_type_str)
+			payload_type_str = line_end;
+		while (*payload_type_str == ' ')
+			payload_type_str++;
+	}
+
+	return 0;
+}
+
+/* parse a line like 'c=IN IP4 192.168.11.151' starting after the '=' */
+static int sdp_parse_connection_info(struct osmo_sdp_msg *sdp, const char *src)
+{
+	char ipv[10];
+	char addr_str[INET6_ADDRSTRLEN];
+	if (sscanf(src, "IN %s %s", ipv, addr_str) < 2)
+		return -EINVAL;
+
+	if (strcmp(ipv, "IP4") && strcmp(ipv, "IP6"))
+		return -ENOTSUP;
+
+	return osmo_sockaddr_str_from_str(&sdp->rtp, addr_str, sdp->rtp.port);
+}
+
+static void next_token(struct token *t, const char *str, const char *end)
+{
+	t->start = str;
+	while (*t->start == ' ' && t->start < end)
+		t->start++;
+	t->end = t->start;
+	while (*t->end != ' ' && t->end < end)
+		t->end++;
+}
+
+/* parse a line like 'o=jdoe 3724394400 3724394405 IN IP4 198.51.100.1' starting after the '=' */
+static int sdp_parse_origin(struct osmo_sdp_msg *sdp, const char *src)
+{
+	struct token t;
+	char addr_str[INET6_ADDRSTRLEN + 1] = {};
+	const char *line_end = get_line_end(src);
+
+	next_token(&t, src, line_end);
+	token_copy(sdp, &sdp->origin.username, &t);
+
+	next_token(&t, t.end, line_end);
+	token_copy(sdp, &sdp->origin.sess_id, &t);
+
+	next_token(&t, t.end, line_end);
+	token_copy(sdp, &sdp->origin.sess_version, &t);
+
+	next_token(&t, t.end, line_end);
+	if (strncmp("IN", t.start, t.end - t.start))
+		return -ENOTSUP;
+
+	next_token(&t, t.end, line_end);
+	if (strncmp("IP4", t.start, t.end - t.start)
+	    && strncmp("IP6", t.start, t.end - t.start))
+		return -ENOTSUP;
+
+	next_token(&t, t.end, line_end);
+	osmo_strlcpy(addr_str, t.start, OSMO_MIN(sizeof(addr_str), t.end - t.start + 1));
+	return osmo_sockaddr_str_from_str(&sdp->origin.addr, addr_str, 0);
+}
+
+static int sdp_parse_session_name(struct osmo_sdp_msg *sdp, const char *src)
+{
+	const char *line_end = get_line_end(src);
+	if (sdp->session_name)
+		talloc_free(sdp->session_name);
+	if (line_end <= src)
+		sdp->session_name = NULL;
+	else
+		sdp->session_name = talloc_strndup(sdp, src, line_end - src);
+	return 0;
+}
+
+struct osmo_sdp_msg *osmo_sdp_msg_alloc(void *ctx)
+{
+	struct osmo_sdp_msg *sdp;
+	sdp = talloc_zero(ctx, struct osmo_sdp_msg);
+	sdp->codecs = osmo_sdp_codec_list_alloc(sdp);
+	return sdp;
+}
+
+/* Parse SDP string into struct osmo_sdp_msg. Return 0 on success, negative on error.
+ * Return a new osmo_sdp_msg instance allocated from ctx, or NULL on error.
+ * When NULL is returned and if err is non-NULL, details of the error are returned in err->*.
+ */
+struct osmo_sdp_msg *osmo_sdp_msg_decode(void *ctx, const char *src, struct osmo_sdp_err *err)
+{
+	struct osmo_sdp_msg *sdp;
+	const char *pos;
+
+	if (err)
+		*err = (struct osmo_sdp_err){};
+
+	sdp = osmo_sdp_msg_alloc(ctx);
+
+	for (pos = src; pos && *pos; pos++) {
+		char attrib;
+		int rc = 0;
+
+		if (*pos == '\r' || *pos == '\n')
+			continue;
+
+		/* Expecting only lines starting with 'X='. Not being too strict about it is probably alright. */
+		if (pos[1] != '=')
+			goto next_line;
+
+		attrib = *pos;
+		pos += 2;
+		switch (attrib) {
+			/* a=... */
+			case 'a':
+				rc = sdp_parse_attrib(sdp, pos);
+				break;
+			case 'm':
+				rc = sdp_parse_media_description(sdp, pos);
+				break;
+			case 'c':
+				rc = sdp_parse_connection_info(sdp, pos);
+				break;
+			case 'o':
+				rc = sdp_parse_origin(sdp, pos);
+				break;
+			case 's':
+				rc = sdp_parse_session_name(sdp, pos);
+				break;
+			default:
+				/* ignore any other parameters */
+				break;
+		}
+
+		if (rc) {
+			if (err) {
+				const char *line_end = get_line_end(pos);
+				/* shift back to include the 'x=' part as well */
+				pos -= 2;
+				*err = (struct osmo_sdp_err){
+					.rc = rc,
+					.at_input_str = pos,
+					.at_input_str_len = line_end - pos,
+				};
+			}
+			talloc_free(sdp);
+			return NULL;
+		}
+
+next_line:
+		pos = strstr(pos, "\r\n");
+		if (!pos)
+			break;
+	}
+
+	return sdp;
+}
+
+/*! Short single-line representation of an SDP message, convenient for logging.
+ * To obtain a valid SDP message, use osmo_sdp_msg_encode_buf() instead.
+ */
+int osmo_sdp_msg_to_str_buf(char *buf, size_t buflen, const struct osmo_sdp_msg *sdp, bool summarize)
+{
+       struct osmo_strbuf sb = { .buf = buf, .len = buflen };
+       if (!sdp) {
+               OSMO_STRBUF_PRINTF(sb, "NULL");
+               return sb.chars_needed;
+       }
+
+       OSMO_STRBUF_PRINTF(sb, OSMO_SOCKADDR_STR_FMT, OSMO_SOCKADDR_STR_FMT_ARGS(&sdp->rtp));
+       OSMO_STRBUF_PRINTF(sb, "{");
+       OSMO_STRBUF_APPEND(sb, osmo_sdp_codec_list_to_str_buf, sdp->codecs, summarize);
+       OSMO_STRBUF_PRINTF(sb, "}");
+       return sb.chars_needed;
+}
+
+char *osmo_sdp_msg_to_str_c(void *ctx, const struct osmo_sdp_msg *sdp, bool summarize)
+{
+       OSMO_NAME_C_IMPL(ctx, 128, "sdp_msg_to_str_c-ERROR", osmo_sdp_msg_to_str_buf, sdp, summarize)
+}
--- a/src/osmo-mgw/Makefile.am
+++ b/src/osmo-mgw/Makefile.am
@@ -25,12 +25,6 @@ osmo_mgw_SOURCES = \
 	$(NULL)

 osmo_mgw_LDADD = \
-	$(top_builddir)/src/libosmo-mgcp/libosmo-mgcp.a \
-	$(LIBOSMOCORE_LIBS) \
-	$(LIBOSMOVTY_LIBS) \
-	$(LIBOSMOGSM_LIBS) \
+	$(top_builddir)/src/libosmo-mgcp/libosmo-mgcp.la \
 	$(LIBOSMOCTRL_LIBS) \
-	$(LIBOSMONETIF_LIBS) \
-	$(LIBOSMOABIS_LIBS) \
-	$(LIBOSMOTRAU_LIBS) \
 	$(NULL)
--- a/src/osmo-mgw/mgw_main.c
+++ b/src/osmo-mgw/mgw_main.c
@@ -280,6 +280,31 @@ int mgcp_vty_go_parent(struct vty *vty)
 	return vty->node;
 }

+static void signal_handler(int signum)
+{
+	fprintf(stdout, "signal %u received\n", signum);
+
+	switch (signum) {
+	case SIGABRT:
+		/* in case of abort, we want to obtain a talloc report and
+		 * then run default SIGABRT handler, who will generate coredump
+		 * and abort the process. abort() should do this for us after we
+		 * return, but program wouldn't exit if an external SIGABRT is
+		 * received.
+		 */
+		talloc_report(tall_vty_ctx, stderr);
+		talloc_report_full(tall_mgw_ctx, stderr);
+		signal(SIGABRT, SIG_DFL);
+		raise(SIGABRT);
+		break;
+	case SIGUSR1:
+		talloc_report(tall_vty_ctx, stderr);
+		talloc_report_full(tall_mgw_ctx, stderr);
+		break;
+	default:
+		break;
+	}
+}

 static struct vty_app_info vty_info = {
 	.name 		= "OsmoMGW",
@@ -328,6 +353,8 @@ int main(int argc, char **argv)

 	msgb_talloc_ctx_init(tall_mgw_ctx, 0);

+	signal(SIGABRT, &signal_handler);
+	signal(SIGUSR1, &signal_handler);
 	osmo_init_ignore_signals();
 	osmo_init_logging2(tall_mgw_ctx, &log_info);
 	libosmo_abis_init(tall_mgw_ctx);
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -1,6 +1,7 @@
 SUBDIRS = \
 	mgcp_client \
 	mgcp \
+	sdp \
 	$(NULL)

 # The `:;' works around a Bash 3.2 bug when the output is not writeable.
@@ -34,11 +35,11 @@ DISTCLEANFILES = \
 	$(NULL)

 if ENABLE_EXT_TESTS
-python-tests: $(BUILT_SOURCES)
+python-tests: $(top_builddir)/src/osmo-mgw/osmo-mgw
 	osmotestvty.py -p $(abs_top_srcdir) -w $(abs_top_builddir) -v
 	osmotestconfig.py -p $(abs_top_srcdir) -w $(abs_top_builddir) -v
 else
-python-tests: $(BUILT_SOURCES)
+python-tests:
 	echo "Not running python-based tests (determined at configure-time)"
 endif

--- a/tests/mgcp/Makefile.am
+++ b/tests/mgcp/Makefile.am
@@ -34,7 +34,7 @@ mgcp_test_SOURCES = \
 	$(NULL)

 mgcp_test_LDADD = \
-	$(top_builddir)/src/libosmo-mgcp/libosmo-mgcp.a \
+	$(top_builddir)/src/libosmo-mgcp/libosmo-mgcp.la \
 	$(LIBOSMOCORE_LIBS) \
 	$(LIBOSMOVTY_LIBS) \
 	$(LIBOSMOGSM_LIBS) \
@@ -45,3 +45,6 @@ mgcp_test_LDADD = \
 	$(LIBOSMONETIF_LIBS) \
 	-lm  \
 	$(NULL)
+
+update_exp:
+	$(builddir)/mgcp_test >$(srcdir)/mgcp_test.ok
--- a/tests/mgcp/mgcp_test.c
+++ b/tests/mgcp/mgcp_test.c
@@ -77,6 +77,8 @@ static void test_strline(void)
 #define AUEP1_RET "500 158663169 FAIL\r\n"
 #define AUEP2	"AUEP 18983213 ds/e1-2/1@mgw MGCP 1.0\r\n"
 #define AUEP2_RET "500 18983213 FAIL\r\n"
+#define AUEP_NULL "AUEP 18983215 null@mgw MGCP 1.0\r\n"
+#define AUEP_NULL_RET "200 18983215 OK\r\n"
 #define EMPTY	"\r\n"
 #define EMPTY_RET NULL
 #define SHORT	"CRCX \r\n"
@@ -101,7 +103,7 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16002 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX3A_RET \
 	"200 18983215 OK\r\n" \
@@ -113,7 +115,7 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16002 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX3_FMTP_RET \
 	"200 18983215 OK\r\n" \
@@ -125,41 +127,49 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16006 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=fmtp:126 0/1/2\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_ADDR0000 \
 	"MDCX 18983216 1@mgw MGCP 1.0\r\n" \
-	"M: sendrecv\r" \
+	"M: sendrecv\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: p:20, a:AMR, nt:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 0.0.0.0\r\n" \
 	"c=IN IP4 0.0.0.0\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_ADDR0000_RET \
-	"527 18983216 FAIL\r\n"
+	"200 18983216 OK\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"o=- %s 23 IN IP4 0.0.0.0\r\n" \
+	"s=-\r\n" \
+	"c=IN IP4 0.0.0.0\r\n" \
+	"t=0 0\r\n" \
+	"m=audio 16002 RTP/AVP 99\r\n" \
+	"a=rtpmap:99 AMR/8000\r\n" \
+	"a=ptime:20\r\n"

 #define MDCX4 \
 	"MDCX 18983217 1@mgw MGCP 1.0\r\n" \
-	"M: sendrecv\r" \
+	"M: sendrecv\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: p:20, a:AMR, nt:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 5.6.7.8\r\n" \
 	"c=IN IP4 5.6.7.8\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_RET(Ident) \
 	"200 " Ident " OK\r\n" \
@@ -171,7 +181,7 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16002 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_RO_RET(Ident) \
 	"200 " Ident " OK\r\n" \
@@ -183,87 +193,87 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16002 RTP/AVP 112\r\n" \
 	"a=rtpmap:112 AMR\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_PT1 \
 	"MDCX 18983218 1@mgw MGCP 1.0\r\n" \
-	"M: SENDRECV\r" \
+	"M: SENDRECV\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: p:20-40, a:AMR, nt:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 5.6.7.8\r\n" \
 	"c=IN IP4 5.6.7.8\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_PT2 \
 	"MDCX 18983219 1@mgw MGCP 1.0\r\n" \
-	"M: sendrecv\r" \
+	"M: sendrecv\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: p:20-20, a:AMR, nt:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 5.6.7.8\r\n" \
 	"c=IN IP4 5.6.7.8\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_PT3 \
 	"MDCX 18983220 1@mgw MGCP 1.0\r\n" \
-	"M: sendrecv\r" \
+	"M: sendrecv\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: a:AMR, nt:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 5.6.7.8\r\n" \
 	"c=IN IP4 5.6.7.8\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 /* Test different upper/lower case in options */
 #define MDCX4_PT4 \
 	"MDCX 18983221 1@mgw MGCP 1.0\r\n" \
-	"m: sendrecv\r" \
+	"m: sendrecv\r\n" \
 	"c: 2\r\n" \
 	"i: %s\r\n" \
 	"l: A:amr, NT:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 5.6.7.8\r\n" \
 	"c=IN IP4 5.6.7.8\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_SO \
 	"MDCX 18983222 1@mgw MGCP 1.0\r\n" \
-	"M: sendonly\r" \
+	"M: sendonly\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: p:20, a:AMR, nt:IN\r\n" \
-	"\n" \
+	"\r\n" \
 	"v=0\r\n" \
 	"o=- %s 23 IN IP4 5.6.7.8\r\n" \
 	"c=IN IP4 5.6.7.8\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 4441 RTP/AVP 99\r\n" \
 	"a=rtpmap:99 AMR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define MDCX4_RO \
 	"MDCX 18983223 1@mgw MGCP 1.0\r\n" \
-	"M: recvonly\r" \
+	"M: recvonly\r\n" \
 	"C: 2\r\n" \
 	"I: %s\r\n" \
 	"L: p:20, a:AMR, nt:IN\r\n"
@@ -274,6 +284,12 @@ static void test_strline(void)

 #define MDCX_TOO_LONG_CI_RET "510 18983224 FAIL\r\n"

+#define MDCX_NULL \
+	"MDCX 9 null@mgw MGCP 1.0\r\n" \
+	"I: %s\n"
+
+#define MDCX_NULL_RET "502 9 FAIL\r\n"
+
 #define SHORT2	"CRCX 1"
 #define SHORT2_RET "510 000000 FAIL\r\n"
 #define SHORT3	"CRCX 1 1@mgw"
@@ -290,7 +306,7 @@ static void test_strline(void)
 	"c=IN IP4 123.12.12.123\r\n" \
 	"m=audio 5904 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_RET \
 	"200 2 OK\r\n" \
@@ -303,7 +319,7 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16002 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_RET_NO_RTPMAP \
 	"200 2 OK\r\n" \
@@ -315,7 +331,7 @@ static void test_strline(void)
 	"c=IN IP4 0.0.0.0\r\n" \
 	"t=0 0\r\n" \
 	"m=audio 16002 RTP/AVP 97\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_FMTP_RET \
 	"200 2 OK\r\n" \
@@ -328,18 +344,17 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16006 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=fmtp:126 0/1/2\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_ZYN \
-	"CRCX 2 1@mgw MGCP 1.0\r" \
-	"M: recvonly\r" \
+	"CRCX 2 1@mgw MGCP 1.0\r\n" \
+	"M: recvonly\r\n" \
 	"C: 2\r\n" \
-	"\n" \
-	"v=0\r" \
-	"c=IN IP4 123.12.12.123\r" \
-	"m=audio 5904 RTP/AVP 97\r" \
-	"a=rtpmap:97 GSM-EFR/8000\r"
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"m=audio 5904 RTP/AVP 97\r\n" \
+	"a=rtpmap:97 GSM-EFR/8000\r\n"

 #define CRCX_ZYN_RET \
 	"200 2 OK\r\n" \
@@ -365,7 +380,7 @@ static void test_strline(void)
 	"c=IN IP4 123.12.12.123\r\n" \
 	"m=audio 5904 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_X_OSMO_IGN_RET \
 	"200 2 OK\r\n" \
@@ -378,7 +393,95 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16010 RTP/AVP 97\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"
+
+#define CRCX_PORT_0 \
+	"CRCX 3 1@mgw MGCP 1.0\r\n" \
+	"m: recvonly\r\n" \
+	"C: 2\r\n" \
+	"L: p:20\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"m=audio 0 RTP/AVP 97\r\n" \
+	"a=rtpmap:97 GSM-EFR/8000\r\n" \
+	"a=ptime:20\r\n"
+
+#define CRCX_PORT_0_RET \
+	"200 3 OK\r\n" \
+	"I: %s\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"o=- %s 23 IN IP4 0.0.0.0\r\n" \
+	"s=-\r\n" \
+	"c=IN IP4 0.0.0.0\r\n" \
+	"t=0 0\r\n" \
+	"m=audio 16014 RTP/AVP 97\r\n" \
+	"a=rtpmap:97 GSM-EFR/8000\r\n" \
+	"a=ptime:20\r\n"
+
+#define CRCX_PORT_0_IUFP \
+	"CRCX 4 1@mgw MGCP 1.0\r\n" \
+	"m: recvonly\r\n" \
+	"C: 2\r\n" \
+	"L: p:20\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"m=audio 0 RTP/AVP 96\r\n" \
+	"a=rtpmap:96 VND.3GPP.IUFP/16000\r\n" \
+	"a=ptime:20\r\n"
+
+#define CRCX_PORT_0_IUFP_RET \
+	"200 4 OK\r\n" \
+	"I: %s\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"o=- %s 23 IN IP4 0.0.0.0\r\n" \
+	"s=-\r\n" \
+	"c=IN IP4 0.0.0.0\r\n" \
+	"t=0 0\r\n" \
+	"m=audio 16016 RTP/AVP 96\r\n" \
+	"a=rtpmap:96 VND.3GPP.IUFP/16000\r\n" \
+	"a=ptime:20\r\n"
+
+/* Do a CRCX in m=sendrecv */
+#define CRCX_PORT_0_IUFP_SENDRECV \
+	"CRCX 4 1@mgw MGCP 1.0\r\n" \
+	"M: sendrecv\r\n" \
+	"C: 2\r\n" \
+	"L: p:20\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"m=audio 0 RTP/AVP 96\r\n" \
+	"a=rtpmap:96 VND.3GPP.IUFP/16000\r\n" \
+	"a=ptime:20\r\n"
+
+/* Do a CRCX using sendrecv mode in the SDP part */
+#define CRCX_PORT_0_IUFP_SENDRECV2 \
+	"CRCX 4 1@mgw MGCP 1.0\r\n" \
+	"C: 2\r\n" \
+	"L: p:20\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"a=sendrecv\r\n" \
+	"m=audio 0 RTP/AVP 96\r\n" \
+	"a=rtpmap:96 VND.3GPP.IUFP/16000\r\n" \
+	"a=ptime:20\r\n"
+
+/* Do a CRCX entirely omitting a mode, i.e. implcit sendrecv */
+#define CRCX_PORT_0_IUFP_SENDRECV3 \
+	"CRCX 4 1@mgw MGCP 1.0\r\n" \
+	"C: 2\r\n" \
+	"L: p:20\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"m=audio 0 RTP/AVP 96\r\n" \
+	"a=rtpmap:96 VND.3GPP.IUFP/16000\r\n" \
+	"a=ptime:20\r\n"

 #define DLCX \
 	"DLCX 7 1@mgw MGCP 1.0\r\n" \
@@ -392,6 +495,13 @@ static void test_strline(void)
 #define DLCX_RET_OSMUX DLCX_RET \
 	"X-Osmo-CP: EC TI=0, TO=0\r\n"

+#define DLCX_NULL \
+	"DLCX 8 null@mgw MGCP 1.0\r\n" \
+	"I: %s\r\n" \
+	"C: 2\r\n"
+
+#define DLCX_NULL_RET "502 8 FAIL\r\n"
+
 #define RQNT \
 	"RQNT 186908780 1@mgw MGCP 1.0\r\n" \
 	"X: B244F267488\r\n" \
@@ -405,6 +515,13 @@ static void test_strline(void)
 #define RQNT1_RET "200 186908780 OK\r\n"
 #define RQNT2_RET "200 186908781 OK\r\n"

+#define RQNT_NULL \
+	"RQNT 186908782 null@mgw MGCP 1.0\r\n" \
+	"X: B244F267488\r\n" \
+	"S: D/9\r\n"
+
+#define RQNT_NULL_RET "502 186908782 FAIL\r\n"
+
 #define PTYPE_IGNORE 0		/* == default initializer */
 #define PTYPE_NONE 128
 #define PTYPE_NYI  PTYPE_NONE
@@ -421,7 +538,7 @@ static void test_strline(void)
 	"m=audio 5904 RTP/AVP 18 97\r\n" \
 	"a=rtpmap:18 G729/8000\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_MULT_2 \
 	"CRCX 2 2@mgw MGCP 1.0\r\n" \
@@ -436,7 +553,7 @@ static void test_strline(void)
 	"a=rtpmap:18 G729/8000\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
 	"a=rtpmap:101 FOO/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_MULT_3 \
 	"CRCX 2 3@mgw MGCP 1.0\r\n" \
@@ -451,7 +568,7 @@ static void test_strline(void)
 	"a=rtpmap:18 G729/8000\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
 	"a=rtpmap:101 FOO/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_MULT_4 \
 	"CRCX 2 4@mgw MGCP 1.0\r\n" \
@@ -466,7 +583,7 @@ static void test_strline(void)
 	"a=rtpmap:18 G729/8000\r\n" \
 	"a=rtpmap:97 GSM-EFR/8000\r\n" \
 	"a=rtpmap:101 FOO/8000\r\n" \
-	"a=ptime:40\r\n"
+	"a=ptime:20\r\n"

 #define CRCX_MULT_GSM_EXACT \
 	"CRCX 259260421 5@mgw MGCP 1.0\r\n" \
@@ -530,7 +647,7 @@ static void test_strline(void)
 	"t=0 0\r\n" \
 	"m=audio 16012 RTP/AVP 111\r\n" \
 	"a=rtpmap:111 AMR/8000/1\r\n" \
-	"a=fmtp:111 octet-align=1\r\n" \
+	"a=fmtp:111 mode-change-capability=2; octet-align=1\r\n" \
 	"a=ptime:20\r\n"

 #define CRCX_NO_LCO_NO_SDP_RET \
@@ -545,12 +662,25 @@ static void test_strline(void)
 	"m=audio 16008 RTP/AVP 0\r\n" \
 	"a=ptime:20\r\n"

+#define CRCX_NULL \
+	"CRCX 2 null@mgw MGCP 1.0\r\n" \
+	"m: recvonly\r\n" \
+	"C: 2\r\n" \
+	"L: p:20\r\n" \
+	"\r\n" \
+	"v=0\r\n" \
+	"c=IN IP4 123.12.12.123\r\n" \
+	"m=audio 5904 RTP/AVP 97\r\n" \
+	"a=rtpmap:97 GSM-EFR/8000\r\n" \
+	"a=ptime:20\r\n"
+
+#define CRCX_NULL_RET "502 2 FAIL\r\n"
+
 struct mgcp_test {
 	const char *name;
 	const char *req;
 	const char *exp_resp;
 	int ptype;
-	const char *extra_fmtp;
 };

 static const struct mgcp_test tests[] = {
@@ -578,14 +708,23 @@ static const struct mgcp_test tests[] = {
 	{"RQNT1", RQNT, RQNT1_RET},
 	{"RQNT2", RQNT2, RQNT2_RET},
 	{"DLCX", DLCX, DLCX_RET, PTYPE_IGNORE},
-	{"CRCX", CRCX, CRCX_FMTP_RET, 97,.extra_fmtp = "a=fmtp:126 0/1/2"},
-	{"MDCX3", MDCX3, MDCX3_FMTP_RET, PTYPE_NONE,.extra_fmtp =
-	 "a=fmtp:126 0/1/2"},
-	{"DLCX", DLCX, DLCX_RET, PTYPE_IGNORE,.extra_fmtp = "a=fmtp:126 0/1/2"},
+	{"CRCX", CRCX, CRCX_FMTP_RET, 97},
+	{"MDCX3", MDCX3, MDCX3_FMTP_RET, PTYPE_NONE},
+	{"DLCX", DLCX, DLCX_RET, PTYPE_IGNORE},
 	{"CRCX", CRCX_NO_LCO_NO_SDP, CRCX_NO_LCO_NO_SDP_RET, 97},
 	{"CRCX", CRCX_X_OSMO_IGN, CRCX_X_OSMO_IGN_RET, 97},
 	{"MDCX_TOO_LONG_CI", MDCX_TOO_LONG_CI, MDCX_TOO_LONG_CI_RET},
 	{"CRCX", CRCX_AMR_WITH_FMTP, CRCX_AMR_WITH_FMTP_RET},
+	{"AUEP_NULL", AUEP_NULL, AUEP_NULL_RET},
+	{"CRCX_NULL", CRCX_NULL, CRCX_NULL_RET},
+	{"MDCX_NULL", MDCX_NULL, MDCX_NULL_RET},
+	{"DLCX_NULL", DLCX_NULL, DLCX_NULL_RET},
+	{"RQNT_NULL", RQNT_NULL, RQNT_NULL_RET},
+	{"CRCX_PORT_0", CRCX_PORT_0, CRCX_PORT_0_RET, 97},
+	{"CRCX_PORT_0_IUFP", CRCX_PORT_0_IUFP, CRCX_PORT_0_IUFP_RET, 96},
+	{"CRCX_PORT_0_IUFP_SENDRECV", CRCX_PORT_0_IUFP_SENDRECV, CRCX_PORT_0_IUFP_RET, 96},
+	{"CRCX_PORT_0_IUFP_SENDRECV2", CRCX_PORT_0_IUFP_SENDRECV2, CRCX_PORT_0_IUFP_RET, 96},
+	{"CRCX_PORT_0_IUFP_SENDRECV3", CRCX_PORT_0_IUFP_SENDRECV3, CRCX_PORT_0_IUFP_RET, 96},
 };

 static const struct mgcp_test retransmit[] = {
@@ -616,12 +755,13 @@ static struct msgb *create_msg(const char *str, const char *conn_id)

 static int dummy_packets = 0;
 /* override and forward */
-ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
-	       const struct sockaddr *dest_addr, socklen_t addrlen)
+int osmo_iofd_sendto_msgb(struct osmo_io_fd *iofd, struct msgb *msg, int flags, const struct osmo_sockaddr *addr)
 {
 	uint32_t dest_host =
-	    htonl(((struct sockaddr_in *)dest_addr)->sin_addr.s_addr);
-	int dest_port = htons(((struct sockaddr_in *)dest_addr)->sin_port);
+	    htonl(((struct sockaddr_in *)addr)->sin_addr.s_addr);
+	int dest_port = htons(((struct sockaddr_in *)addr)->sin_port);
+	const uint8_t *buf = msgb_data(msg);
+	size_t len = msgb_length(msg);

 	if (len == sizeof(rtp_dummy_payload)
 	    && memcmp(buf, rtp_dummy_payload, sizeof(rtp_dummy_payload)) == 0) {
@@ -635,6 +775,8 @@ ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
 	OSMO_ASSERT(dest_host);
 	OSMO_ASSERT(dest_port);

+	msgb_free(msg);
+
 	return len;
 }

@@ -790,9 +932,6 @@ static void test_messages(void)

 		dummy_packets = 0;

-		osmo_talloc_replace_string(cfg, &trunk->audio_fmtp_extra,
-					   t->extra_fmtp);
-
 		inp = create_msg(t->req, last_conn_id);
 		msg = mgcp_handle_message(cfg, inp);
 		msgb_free(inp);
@@ -804,6 +943,7 @@ static void test_messages(void)
 			}
 		} else if (check_response(msg->data, t->exp_resp) != 0) {
 			printf("%s failed.\n", t->name);
+			fflush(stdout);
 			OSMO_ASSERT(false);
 		}

@@ -1467,7 +1607,6 @@ static void test_multilple_codec(void)
 	/* Allocate 5@mgw and let osmo-mgw pick a codec from the list */
 	last_endpoint[0] = '\0';
 	inp = create_msg(CRCX_MULT_GSM_EXACT, NULL);
-	trunk->no_audio_transcoding = 1;
 	resp = mgcp_handle_message(cfg, inp);
 	OSMO_ASSERT(get_conn_id_from_response(resp->data, conn_id,
 					      sizeof(conn_id)) == 0);
@@ -1511,7 +1650,6 @@ static void test_multilple_codec(void)

 	last_endpoint[0] = '\0';
 	inp = create_msg(CRCX_MULT_GSM_EXACT, NULL);
-	trunk->no_audio_transcoding = 0;
 	resp = mgcp_handle_message(cfg, inp);
 	OSMO_ASSERT(get_conn_id_from_response(resp->data, conn_id,
 					      sizeof(conn_id)) == 0);
@@ -1769,26 +1907,25 @@ static const struct mgcp_codec_param amr_param_octet_aligned_unset = {
 	.amr_octet_aligned_present = false,
 };

-struct testcase_mgcp_codec_find_convertible_codec {
+struct testcase_mgcp_codec_decide_codec {
 	int payload_type;
 	const char *audio_name;
 	const struct mgcp_codec_param *param;
 	int expect_rc;
 };

-struct testcase_mgcp_codec_find_convertible_expect {
-	bool end;
+struct testcase_mgcp_codec_decide_expect {
 	int payload_type_map[2];
 };

-struct testcase_mgcp_codec_find_convertible {
+struct testcase_mgcp_codec_decide {
 	const char *descr;
 	/* two conns on an endpoint, each with N configured codecs */
-	struct testcase_mgcp_codec_find_convertible_codec codecs[2][10];
-	struct testcase_mgcp_codec_find_convertible_expect expect[32];
+	struct testcase_mgcp_codec_decide_codec codecs[2][10];
+	struct testcase_mgcp_codec_decide_expect expect[2];
 };

-static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_convertible_cases[] = {
+static const struct testcase_mgcp_codec_decide test_mgcp_codec_find_convertible_cases[] = {
 	{
 		.descr = "same order, but differing payload type numbers",
 		.codecs = {
@@ -1805,10 +1942,7 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		},
 		.expect = {
 			{ .payload_type_map = {112, 96}, },
-			{ .payload_type_map = {0, 0}, },
-			{ .payload_type_map = {111, 97} },
-			{ .payload_type_map = {123, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {112, 96}, },
 		},
 	},
 	{
@@ -1826,11 +1960,8 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 			},
 		},
 		.expect = {
-			{ .payload_type_map = {112, 96}, },
 			{ .payload_type_map = {0, 0}, },
-			{ .payload_type_map = {111, 97} },
-			{ .payload_type_map = {123, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {111, 97}, },
 		},
 	},
 	{
@@ -1848,11 +1979,8 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 			},
 		},
 		.expect = {
-			{ .payload_type_map = {96, 97}, },
-			{ .payload_type_map = {97, 96}, },
 			{ .payload_type_map = {0, 0}, },
-			{ .payload_type_map = {123, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {96, 97}, },
 		},
 	},
 	{
@@ -1868,10 +1996,8 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 			},
 		},
 		.expect = {
-			{ .payload_type_map = {112, -EINVAL}, },
-			{ .payload_type_map = {0, -EINVAL}, },
-			{ .payload_type_map = {111, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {-EINVAL, -EINVAL}, },
+			{ .payload_type_map = {-EINVAL, 96}, },
 		},
 	},
 	{
@@ -1888,13 +2014,11 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		},
 		.expect = {
 			{ .payload_type_map = {112, -EINVAL}, },
-			{ .payload_type_map = {0, -EINVAL}, },
-			{ .payload_type_map = {111, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {-EINVAL, -EINVAL}, },
 		},
 	},
 	{
-		.descr = "test AMR with differing octet-aligned settings",
+		.descr = "test AMR with differing octet-aligned settings (both <-> both)",
 		.codecs = {
 			{
 				{ 111, "AMR/8000", &amr_param_octet_aligned_true, },
@@ -1908,8 +2032,38 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		.expect = {
 			{ .payload_type_map = {111, 121}, },
 			{ .payload_type_map = {112, 122} },
-			{ .payload_type_map = {123, -EINVAL} },
-			{ .end = true },
+		},
+	},
+	{
+		.descr = "test AMR with differing octet-aligned settings (oa <-> both)",
+		.codecs = {
+			{
+				{ 111, "AMR/8000", &amr_param_octet_aligned_true, },
+			},
+			{
+				{ 122, "AMR/8000", &amr_param_octet_aligned_false, },
+				{ 121, "AMR/8000", &amr_param_octet_aligned_true, },
+			},
+		},
+		.expect = {
+			{ .payload_type_map = {111, 121}, },
+			{ .payload_type_map = {111, 121}, },
+		},
+	},
+	{
+		.descr = "test AMR with differing octet-aligned settings (bwe <-> both)",
+		.codecs = {
+			{
+				{ 112, "AMR/8000", &amr_param_octet_aligned_false, },
+			},
+			{
+				{ 122, "AMR/8000", &amr_param_octet_aligned_false, },
+				{ 121, "AMR/8000", &amr_param_octet_aligned_true, },
+			},
+		},
+		.expect = {
+			{ .payload_type_map = {112, 122}, },
+			{ .payload_type_map = {112, 122}, },
 		},
 	},
 	{
@@ -1924,8 +2078,7 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		},
 		.expect = {
 			{ .payload_type_map = {111, 122}, },
-			{ .payload_type_map = {55, -EINVAL}, },
-			{ .end = true },
+			{ .payload_type_map = {111, 122}, },
 		},
 	},
 	{
@@ -1940,8 +2093,7 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		},
 		.expect = {
 			{ .payload_type_map = {111, 122}, },
-			{ .payload_type_map = {55, -EINVAL}, },
-			{ .end = true },
+			{ .payload_type_map = {111, 122}, },
 		},
 	},
 	{
@@ -1957,8 +2109,7 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		.expect = {
 			/* Note: Both 111, anbd 112 will translate to 122. The translation from 112 */
 			{ .payload_type_map = {112, 122} },
-			{ .payload_type_map = {55, -EINVAL}, },
-			{ .end = true },
+			{ .payload_type_map = {112, 122}, },
 		},
 	},
 	{
@@ -1974,8 +2125,7 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		.expect = {
 			/* Note: Both 111, anbd 112 will translate to 122. The translation from 112 */
 			{ .payload_type_map = {112, 122} },
-			{ .payload_type_map = {55, -EINVAL}, },
-			{ .end = true },
+			{ .payload_type_map = {112, 122}, },
 		},
 	},
 	{
@@ -1993,11 +2143,8 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 			},
 		},
 		.expect = {
-			{ .payload_type_map = {112, 96}, },
 			{ .payload_type_map = {0, 0}, },
-			{ .payload_type_map = {111, 97} },
-			{ .payload_type_map = {123, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {111, 97}, },
 		},
 	},
 	{
@@ -2015,11 +2162,8 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 			},
 		},
 		.expect = {
-			{ .payload_type_map = {112, 96}, },
 			{ .payload_type_map = {0, 0}, },
-			{ .payload_type_map = {111, 97} },
-			{ .payload_type_map = {123, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {111, 97}, },
 		},
 	},
 	{
@@ -2037,70 +2181,98 @@ static const struct testcase_mgcp_codec_find_convertible test_mgcp_codec_find_co
 		},
 		.expect = {
 			{ .payload_type_map = {111, 121}, },
-			{ .payload_type_map = {112, -EINVAL} },
-			{ .payload_type_map = {113, -EINVAL} },
-			{ .end = true },
+			{ .payload_type_map = {111, 121} },
 		},
 	},
 };

-static int pt_translate(struct mgcp_conn_rtp *conn, unsigned int index_src, unsigned int index_dst, int payload_type)
+static bool codec_decision(struct mgcp_conn_rtp *conn, unsigned int index_conn_src, unsigned int index_conn_dst,
+			   const struct testcase_mgcp_codec_decide_expect *expect)
 {
-	struct mgcp_rtp_codec *codec_src = NULL;
-	struct mgcp_rtp_codec *codec_dst = NULL;
-	struct mgcp_conn_rtp *conn_src = &conn[index_src];
-	struct mgcp_conn_rtp *conn_dst = &conn[index_dst];
+	bool ok = true;
+	int payload_type_conn_src;
+	int payload_type_conn_dst;

-	/* Find the codec information that is used on the source side */
-	codec_src = mgcp_codec_from_pt(conn_src, payload_type);
-	if (!codec_src) {
-		printf(" - mgcp_codec_from_pt(conn%u, %d) -> NO RESULT\n", index_src, payload_type);
-		return -EINVAL;
-	}
-	printf(" - mgcp_codec_from_pt(conn%u, %d) -> %s\n", index_src, payload_type, codec_src->subtype_name);
+	printf(" - mgcp_codec_decide(&conn[%u], &conn[%u]):\n", index_conn_src, index_conn_dst);
+	if (mgcp_codec_decide(&conn[index_conn_src], &conn[index_conn_dst]) != 0) {
+		if (expect->payload_type_map[index_conn_src] == -EINVAL
+		    && expect->payload_type_map[index_conn_dst] == -EINVAL)
+			printf("    codec decision failed (expected)!\n");
+		else {
+			printf("    ERROR: codec decision failed!\n");
+			ok = false;
+		}
+	} else {
+		printf("    Codec decision result:\n");
+		if (conn[index_conn_src].end.codec) {
+			payload_type_conn_src = conn[index_conn_src].end.codec->payload_type;
+			printf("    conn[%u]: codec:%s, pt:%d\n",
+			       index_conn_src, conn[index_conn_src].end.codec->subtype_name, payload_type_conn_src);
+		} else {
+			payload_type_conn_src = -EINVAL;
+			printf("    conn[%u]: codec:none, pt:none\n", index_conn_src);
+		}

-	codec_dst = mgcp_codec_find_convertible(conn_dst, codec_src);
-	if (!codec_dst) {
-		printf(" - mgcp_codec_find_convertible(conn%u, %s) -> NO RESULT\n", index_dst, codec_src->subtype_name);
-		return -EINVAL;
+		if (conn[index_conn_dst].end.codec) {
+			payload_type_conn_dst = conn[index_conn_dst].end.codec->payload_type;
+			printf("    conn[%u]: codec:%s, pt:%d\n",
+			       index_conn_dst, conn[index_conn_dst].end.codec->subtype_name,
+			       payload_type_conn_dst);
+		} else {
+			payload_type_conn_dst = -EINVAL;
+			printf("    conn[%u]: codec:none, pt:none\n", index_conn_dst);
+		}
+
+		if (payload_type_conn_src != expect->payload_type_map[index_conn_src]) {
+			printf("    ERROR: conn[%u] unexpected codec decision, expected pt=%d, got pt=%d\n",
+			       index_conn_src, expect->payload_type_map[index_conn_src], payload_type_conn_src);
+			ok = false;
+		}
+
+		if (payload_type_conn_dst != expect->payload_type_map[index_conn_dst]) {
+			printf("    ERROR: conn[%u] unexpected codec decision, expected pt=%d, got pt=%d\n",
+			       index_conn_dst, expect->payload_type_map[index_conn_dst],
+			       payload_type_conn_dst);
+			ok = false;
+		}
 	}
-	printf(" - mgcp_codec_find_convertible(conn%u, %s) -> %s -> %u\n",
-	       index_dst, codec_src->subtype_name, codec_dst->subtype_name, codec_dst->payload_type);
-	return codec_dst->payload_type;
+
+	return ok;
 }

-static void test_mgcp_codec_find_convertible(void)
+static void test_mgcp_codec_decide(void)
 {
 	int i;
-	bool ok = true;
+	bool ok_all = true;
 	printf("\nTesting mgcp_codec_find_convertible()\n");

 	for (i = 0; i < ARRAY_SIZE(test_mgcp_codec_find_convertible_cases); i++) {
-		const struct testcase_mgcp_codec_find_convertible *t = &test_mgcp_codec_find_convertible_cases[i];
-		struct mgcp_conn_rtp conn[2] = {};
+		const struct testcase_mgcp_codec_decide *t = &test_mgcp_codec_find_convertible_cases[i];
+		struct mgcp_conn_rtp conn[2] = { };
 		int rc;
 		int conn_i;
 		int c;
+		bool ok = true;

 		printf("#%d: %s\n", i, t->descr);

+		/* Build testvector (add codecs to conn, set properties etc... */
 		for (conn_i = 0; conn_i < 2; conn_i++) {
 			printf(" - add codecs on conn%d:\n", conn_i);
 			for (c = 0; c < ARRAY_SIZE(t->codecs[conn_i]); c++) {
-				const struct testcase_mgcp_codec_find_convertible_codec *codec = &t->codecs[conn_i][c];
+				const struct testcase_mgcp_codec_decide_codec *codec = &t->codecs[conn_i][c];
 				if (!codec->audio_name)
 					break;

-				rc = mgcp_codec_add(&conn[conn_i], codec->payload_type, codec->audio_name, codec->param);
+				rc = mgcp_codec_add(&conn[conn_i], codec->payload_type, codec->audio_name,
+						    codec->param);

 				printf("   %2d: %3d %s%s  -> rc=%d\n", c, codec->payload_type, codec->audio_name,
 				       codec->param ?
-					       (codec->param->amr_octet_aligned_present?
-							(codec->param->amr_octet_aligned ?
-								" octet-aligned=1" : " octet-aligned=0")
-							: " octet-aligned=unset")
-						: "",
-						rc);
+				       (codec->param->amr_octet_aligned_present ?
+					(codec->param->amr_octet_aligned ? " octet-aligned=1" : " octet-aligned=0")
+					: " octet-aligned=unset")
+				       : "", rc);
 				if (rc != codec->expect_rc) {
 					printf("     ERROR: expected rc=%d\n", codec->expect_rc);
 					ok = false;
@@ -2110,35 +2282,23 @@ static void test_mgcp_codec_find_convertible(void)
 				printf("    (none)\n");
 		}

-		for (c = 0; c < ARRAY_SIZE(t->expect); c++) {
-			const struct testcase_mgcp_codec_find_convertible_expect *expect = &t->expect[c];
-			int result;
+		/* Run codec decision and check expectation */
+		if (!codec_decision(conn, 0, 1, &t->expect[0]))
+			ok = false;

-			if (expect->end)
-				break;
+		if (!codec_decision(conn, 1, 0, &t->expect[1]))
+			ok = false;

-			result = pt_translate(conn, 0, 1, expect->payload_type_map[0]);
-			if (result != expect->payload_type_map[1]) {
-				printf("     ERROR: expected -> %d\n", expect->payload_type_map[1]);
-				ok = false;
-			}
+		if (ok)
+			printf(" ===> SUCCESS: codec decision as expected!\n");
+		else
+			printf(" ===> FAIL: unexpected codec decision!\n");

-			/* If the expected result is an error, don't do reverse map test */
-			if (expect->payload_type_map[1] < 0)
-				continue;
-
-			result = pt_translate(conn, 1, 0, expect->payload_type_map[1]);
-			if (result != expect->payload_type_map[0]) {
-				printf("     ERROR: expected -> %d\n", expect->payload_type_map[0]);
-				ok = false;
-			}
-		}
-
-		for (conn_i = 0; conn_i < 2; conn_i++)
-			mgcp_codec_reset_all(&conn[conn_i]);
+		if (!ok)
+			ok_all = false;
 	}

-	OSMO_ASSERT(ok);
+	OSMO_ASSERT(ok_all);
 }

 void test_conn_id_matching(void)
@@ -2295,7 +2455,7 @@ int main(int argc, char **argv)
 	test_osmux_cid();
 	test_get_lco_identifier();
 	test_check_local_cx_options(ctx);
-	test_mgcp_codec_find_convertible();
+	test_mgcp_codec_decide();
 	test_conn_id_matching();
 	test_e1_trunk_nr_from_epname();
 	test_mgcp_is_rtp_dummy_payload();
--- a/tests/mgcp/mgcp_test.ok
+++ b/tests/mgcp/mgcp_test.ok
@@ -73,7 +73,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-a=ptime:40
+a=ptime:20

 ---------8<---------
 checking response:
@@ -101,40 +101,42 @@ Testing MDCX4_ADDR000
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983216 1@mgw MGCP 1.0
-M: sendrecv
+M: sendrecv
+C: 2
 I: %s
 L: p:20, a:AMR, nt:IN
-L: p:20, a:AMR, nt:IN
+
 v=0
 o=- %s 23 IN IP4 0.0.0.0
 c=IN IP4 0.0.0.0
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-a=rtpmap:99 AMR/8000
+a=ptime:20

 ---------8<---------
 checking response:
-checking response:
+using message with patched conn_id for comparison
 Response matches our expectations.
-Response matches our expectations.
+(response contains a connection id)

 ================================================
 Testing MDCX4
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983217 1@mgw MGCP 1.0
-MDCX 18983217 1@mgw MGCP 1.0
+M: sendrecv
+C: 2
 I: %s
 L: p:20, a:AMR, nt:IN
-I: %s
+
 v=0
 o=- %s 23 IN IP4 5.6.7.8
 c=IN IP4 5.6.7.8
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-m=audio 4441 RTP/AVP 99
+a=ptime:20

 ---------8<---------
 checking response:
@@ -148,17 +150,18 @@ Testing MDCX4_PT1
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983218 1@mgw MGCP 1.0
---------8<---------
+M: SENDRECV
+C: 2
 I: %s
 L: p:20-40, a:AMR, nt:IN
-C: 2
+
 v=0
 o=- %s 23 IN IP4 5.6.7.8
 c=IN IP4 5.6.7.8
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-t=0 0
+a=ptime:20

 ---------8<---------
 checking response:
@@ -172,17 +175,18 @@ Testing MDCX4_PT2
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983219 1@mgw MGCP 1.0
-creating message from statically defined input:
+M: sendrecv
+C: 2
 I: %s
 L: p:20-20, a:AMR, nt:IN
-M: sendrecv
+
 v=0
 o=- %s 23 IN IP4 5.6.7.8
 c=IN IP4 5.6.7.8
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-c=IN IP4 5.6.7.8
+a=ptime:20

 ---------8<---------
 checking response:
@@ -196,17 +200,18 @@ Testing MDCX4_PT3
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983220 1@mgw MGCP 1.0
-Testing MDCX4_PT3
+M: sendrecv
+C: 2
 I: %s
 L: a:AMR, nt:IN
-MDCX 18983220 1@mgw MGCP 1.0
+
 v=0
 o=- %s 23 IN IP4 5.6.7.8
 c=IN IP4 5.6.7.8
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-o=- %s 23 IN IP4 5.6.7.8
+a=ptime:20

 ---------8<---------
 checking response:
@@ -220,17 +225,18 @@ Testing MDCX4_PT4
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983221 1@mgw MGCP 1.0
-================================================
+m: sendrecv
+c: 2
 i: %s
 l: A:amr, NT:IN
---------8<---------
+
 v=0
 o=- %s 23 IN IP4 5.6.7.8
 c=IN IP4 5.6.7.8
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-v=0
+a=ptime:20

 ---------8<---------
 checking response:
@@ -244,17 +250,18 @@ Testing MDCX4_SO
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983222 1@mgw MGCP 1.0
-
+M: sendonly
+C: 2
 I: %s
 L: p:20, a:AMR, nt:IN
-creating message from statically defined input:
+
 v=0
 o=- %s 23 IN IP4 5.6.7.8
 c=IN IP4 5.6.7.8
 t=0 0
 m=audio 4441 RTP/AVP 99
 a=rtpmap:99 AMR/8000
-
+a=ptime:20

 ---------8<---------
 checking response:
@@ -267,7 +274,8 @@ Testing MDCX4_RO
 creating message from statically defined input:
 ---------8<---------
 MDCX 18983223 1@mgw MGCP 1.0
-(response contains a connection id)
+M: recvonly
+C: 2
 I: %s
 L: p:20, a:AMR, nt:IN

@@ -296,9 +304,15 @@ Response matches our expectations.
 Testing CRCX_ZYN
 creating message from statically defined input:
 ---------8<---------
-using message as statically defined for comparison
+CRCX 2 1@mgw MGCP 1.0
+M: recvonly
+C: 2
+
+v=0
+c=IN IP4 123.12.12.123
+m=audio 5904 RTP/AVP 97
+a=rtpmap:97 GSM-EFR/8000

-(response does not contain a connection id)
 ---------8<---------
 checking response:
 using message with patched conn_id for comparison
@@ -414,7 +428,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-================================================
+a=ptime:20

 ---------8<---------
 checking response:
@@ -479,7 +493,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-Testing CRCX
+a=ptime:20

 ---------8<---------
 checking response:
@@ -525,6 +539,184 @@ Response matches our expectations.
 (response contains a connection id)
 Dummy packets: 2

+================================================
+Testing AUEP_NULL
+creating message from statically defined input:
+---------8<---------
+AUEP 18983215 null@mgw MGCP 1.0
+
+---------8<---------
+checking response:
+using message as statically defined for comparison
+Response matches our expectations.
+(response does not contain a connection id)
+
+================================================
+Testing CRCX_NULL
+creating message from statically defined input:
+---------8<---------
+CRCX 2 null@mgw MGCP 1.0
+m: recvonly
+C: 2
+L: p:20
+
+v=0
+c=IN IP4 123.12.12.123
+m=audio 5904 RTP/AVP 97
+a=rtpmap:97 GSM-EFR/8000
+a=ptime:20
+
+---------8<---------
+checking response:
+using message as statically defined for comparison
+Response matches our expectations.
+(response does not contain a connection id)
+
+================================================
+Testing MDCX_NULL
+creating message from statically defined input:
+---------8<---------
+MDCX 9 null@mgw MGCP 1.0
+I: %s
+
+---------8<---------
+checking response:
+using message as statically defined for comparison
+Response matches our expectations.
+(response does not contain a connection id)
+
+================================================
+Testing DLCX_NULL
+creating message from statically defined input:
+---------8<---------
+DLCX 8 null@mgw MGCP 1.0
+I: %s
+C: 2
+
+---------8<---------
+checking response:
+using message as statically defined for comparison
+Response matches our expectations.
+(response does not contain a connection id)
+
+================================================
+Testing RQNT_NULL
+creating message from statically defined input:
+---------8<---------
+RQNT 186908782 null@mgw MGCP 1.0
+X: B244F267488
+S: D/9
+
+---------8<---------
+checking response:
+using message as statically defined for comparison
+Response matches our expectations.
+(response does not contain a connection id)
+
+================================================
+Testing CRCX_PORT_0
+creating message from statically defined input:
+---------8<---------
+CRCX 3 1@mgw MGCP 1.0
+m: recvonly
+C: 2
+L: p:20
+
+v=0
+c=IN IP4 123.12.12.123
+m=audio 0 RTP/AVP 97
+a=rtpmap:97 GSM-EFR/8000
+a=ptime:20
+
+---------8<---------
+checking response:
+using message with patched conn_id for comparison
+Response matches our expectations.
+(response contains a connection id)
+
+================================================
+Testing CRCX_PORT_0_IUFP
+creating message from statically defined input:
+---------8<---------
+CRCX 4 1@mgw MGCP 1.0
+m: recvonly
+C: 2
+L: p:20
+
+v=0
+c=IN IP4 123.12.12.123
+m=audio 0 RTP/AVP 96
+a=rtpmap:96 VND.3GPP.IUFP/16000
+a=ptime:20
+
+---------8<---------
+checking response:
+using message with patched conn_id for comparison
+Response matches our expectations.
+(response contains a connection id)
+
+================================================
+Testing CRCX_PORT_0_IUFP_SENDRECV
+creating message from statically defined input:
+---------8<---------
+CRCX 4 1@mgw MGCP 1.0
+M: sendrecv
+C: 2
+L: p:20
+
+v=0
+c=IN IP4 123.12.12.123
+m=audio 0 RTP/AVP 96
+a=rtpmap:96 VND.3GPP.IUFP/16000
+a=ptime:20
+
+---------8<---------
+checking response:
+using message with patched conn_id for comparison
+Response matches our expectations.
+(response contains a connection id)
+
+================================================
+Testing CRCX_PORT_0_IUFP_SENDRECV2
+creating message from statically defined input:
+---------8<---------
+CRCX 4 1@mgw MGCP 1.0
+C: 2
+L: p:20
+
+v=0
+c=IN IP4 123.12.12.123
+a=sendrecv
+m=audio 0 RTP/AVP 96
+a=rtpmap:96 VND.3GPP.IUFP/16000
+a=ptime:20
+
+---------8<---------
+checking response:
+using message with patched conn_id for comparison
+Response matches our expectations.
+(response contains a connection id)
+
+================================================
+Testing CRCX_PORT_0_IUFP_SENDRECV3
+creating message from statically defined input:
+---------8<---------
+CRCX 4 1@mgw MGCP 1.0
+C: 2
+L: p:20
+
+v=0
+c=IN IP4 123.12.12.123
+m=audio 0 RTP/AVP 96
+a=rtpmap:96 VND.3GPP.IUFP/16000
+a=ptime:20
+
+---------8<---------
+checking response:
+using message with patched conn_id for comparison
+Response matches our expectations.
+(response contains a connection id)
+
 ================================================
 Testing CRCX
 creating message from statically defined input:
@@ -538,7 +730,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-================================================
+a=ptime:20

 ---------8<---------
 checking response:
@@ -556,7 +748,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-Response matches our expectations.
+a=ptime:20

 ---------8<---------
 checking response:
@@ -668,7 +860,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-Response matches our expectations.
+a=ptime:20

 ---------8<---------
 creating message from statically defined input:
@@ -1122,7 +1314,7 @@ c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 18 97
 a=rtpmap:18 G729/8000
 a=rtpmap:97 GSM-EFR/8000
-creating message from statically defined input:
+a=ptime:20

 ---------8<---------
 creating message from statically defined input:
@@ -1139,7 +1331,7 @@ m=audio 5904 RTP/AVP 18 97 101
 a=rtpmap:18 G729/8000
 a=rtpmap:97 GSM-EFR/8000
 a=rtpmap:101 FOO/8000
---------8<---------
+a=ptime:20

 ---------8<---------
 creating message from statically defined input:
@@ -1156,7 +1348,7 @@ m=audio 5904 RTP/AVP
 a=rtpmap:18 G729/8000
 a=rtpmap:97 GSM-EFR/8000
 a=rtpmap:101 FOO/8000
---------8<---------
+a=ptime:20

 ---------8<---------
 creating message from statically defined input:
@@ -1173,7 +1365,7 @@ m=audio 5904 RTP/AVP 18
 a=rtpmap:18 G729/8000
 a=rtpmap:97 GSM-EFR/8000
 a=rtpmap:101 FOO/8000
---------8<---------
+a=ptime:20

 ---------8<---------
 creating message from statically defined input:
@@ -1255,7 +1447,7 @@ v=0
 c=IN IP4 123.12.12.123
 m=audio 5904 RTP/AVP 97
 a=rtpmap:97 GSM-EFR/8000
-Testing no sequence flow on initial packet
+a=ptime:20

 ---------8<---------
 checking response:
@@ -1286,19 +1478,15 @@ Testing mgcp_codec_find_convertible()
    0:  96 AMR/8000/1 octet-aligned=1  -> rc=0
    1:   0 PCMU/8000/1  -> rc=0
    2:  97 GSM-HR-08/8000/1  -> rc=0
-p10, aPCMU -> (null)
-'10,a :PCMU' -> '(null)'
-
-Testing mgcp_codec_find_convertible()
-#0: same order, but differing payload type numbers
- - add codecs on conn0:
-    0: 112 AMR/8000/1 octet-aligned=1  -> rc=0
-    1:   0 PCMU/8000/1  -> rc=0
-    2: 111 GSM-HR-08/8000/1  -> rc=0
- - add codecs on conn1:
-    0:  96 AMR/8000/1 octet-aligned=1  -> rc=0
-    1:   0 PCMU/8000/1  -> rc=0
-    2:  97 GSM-HR-08/8000/1  -> rc=0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:112
+    conn[1]: codec:AMR, pt:96
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:96
+    conn[0]: codec:AMR, pt:112
+ ===> SUCCESS: codec decision as expected!
 #1: different order and different payload type numbers
 - add codecs on conn0:
    0:   0 PCMU/8000/1  -> rc=0
@@ -1308,19 +1496,15 @@ Testing mgcp_codec_find_convertible()
    0:  97 GSM-HR-08/8000/1  -> rc=0
    1:   0 PCMU/8000/1  -> rc=0
    2:  96 AMR/8000/1 octet-aligned=1  -> rc=0
- - mgcp_codec_find_convertible(conn1, GSM-HR-08) -> GSM-HR-08 -> 97
- - mgcp_codec_from_pt(conn1, 97) -> GSM-HR-08
- - mgcp_codec_find_convertible(conn0, GSM-HR-08) -> GSM-HR-08 -> 111
- - mgcp_codec_from_pt(conn0, 123) -> NO RESULT
-#1: different order and different payload type numbers
- - add codecs on conn0:
-    0:   0 PCMU/8000/1  -> rc=0
-    1: 111 GSM-HR-08/8000/1  -> rc=0
-    2: 112 AMR/8000/1 octet-aligned=1  -> rc=0
- - add codecs on conn1:
-    0:  97 GSM-HR-08/8000/1  -> rc=0
-    1:   0 PCMU/8000/1  -> rc=0
-    2:  96 AMR/8000/1 octet-aligned=1  -> rc=0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:PCMU, pt:0
+    conn[1]: codec:PCMU, pt:0
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:GSM-HR-08, pt:97
+    conn[0]: codec:GSM-HR-08, pt:111
+ ===> SUCCESS: codec decision as expected!
 #2: both sides have the same payload_type numbers assigned to differing codecs
 - add codecs on conn0:
    0:   0 PCMU/8000/1  -> rc=0
@@ -1330,19 +1514,15 @@ Testing mgcp_codec_find_convertible()
    0:  97 GSM-HR-08/8000/1  -> rc=0
    1:   0 PCMU/8000/1  -> rc=0
    2:  96 AMR/8000/1 octet-aligned=1  -> rc=0
- - mgcp_codec_find_convertible(conn1, GSM-HR-08) -> GSM-HR-08 -> 97
- - mgcp_codec_from_pt(conn1, 97) -> GSM-HR-08
- - mgcp_codec_find_convertible(conn0, GSM-HR-08) -> GSM-HR-08 -> 111
- - mgcp_codec_from_pt(conn0, 123) -> NO RESULT
-#2: both sides have the same payload_type numbers assigned to differing codecs
- - add codecs on conn0:
-    0:   0 PCMU/8000/1  -> rc=0
-    1:  96 GSM-HR-08/8000/1  -> rc=0
-    2:  97 AMR/8000/1 octet-aligned=1  -> rc=0
- - add codecs on conn1:
-    0:  97 GSM-HR-08/8000/1  -> rc=0
-    1:   0 PCMU/8000/1  -> rc=0
-    2:  96 AMR/8000/1 octet-aligned=1  -> rc=0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:PCMU, pt:0
+    conn[1]: codec:PCMU, pt:0
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:GSM-HR-08, pt:97
+    conn[0]: codec:GSM-HR-08, pt:96
+ ===> SUCCESS: codec decision as expected!
 #3: conn0 has no codecs
 - add codecs on conn0:
    (none)
@@ -1350,9 +1530,13 @@ Testing mgcp_codec_find_convertible()
    0:  96 AMR/8000/1 octet-aligned=1  -> rc=0
    1:   0 PCMU/8000/1  -> rc=0
    2:  97 GSM-HR-08/8000/1  -> rc=0
- - mgcp_codec_find_convertible(conn0, AMR) -> AMR -> 97
- - mgcp_codec_from_pt(conn0, 0) -> PCMU
- - mgcp_codec_find_convertible(conn1, PCMU) -> PCMU -> 0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    codec decision failed (expected)!
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:96
+    conn[0]: codec:none, pt:none
+ ===> SUCCESS: codec decision as expected!
 #4: conn1 has no codecs
 - add codecs on conn0:
    0: 112 AMR/8000/1 octet-aligned=1  -> rc=0
@@ -1360,69 +1544,116 @@ Testing mgcp_codec_find_convertible()
    2: 111 GSM-HR-08/8000/1  -> rc=0
 - add codecs on conn1:
    (none)
-    0:  96 AMR/8000/1 octet-aligned=1  -> rc=0
-    1:   0 PCMU/8000/1  -> rc=0
-    2:  97 GSM-HR-08/8000/1  -> rc=0
- - mgcp_codec_from_pt(conn0, 112) -> NO RESULT
- - mgcp_codec_from_pt(conn0, 0) -> NO RESULT
- - mgcp_codec_from_pt(conn0, 111) -> NO RESULT
-#4: conn1 has no codecs
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:112
+    conn[1]: codec:none, pt:none
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    codec decision failed (expected)!
+ ===> SUCCESS: codec decision as expected!
+#5: test AMR with differing octet-aligned settings (both <-> both)
 - add codecs on conn0:
    0: 111 AMR/8000 octet-aligned=1  -> rc=0
    1: 112 AMR/8000 octet-aligned=0  -> rc=0
 - add codecs on conn1:
    0: 122 AMR/8000 octet-aligned=0  -> rc=0
    1: 121 AMR/8000 octet-aligned=1  -> rc=0
- - mgcp_codec_from_pt(conn0, 112) -> AMR
- - mgcp_codec_find_convertible(conn1, AMR) -> NO RESULT
- - mgcp_codec_from_pt(conn0, 0) -> PCMU
- - mgcp_codec_find_convertible(conn1, PCMU) -> NO RESULT
- - mgcp_codec_from_pt(conn0, 111) -> GSM-HR-08
- - mgcp_codec_find_convertible(conn1, GSM-HR-08) -> NO RESULT
-#5: test AMR with differing octet-aligned settings
- - add codecs on conn0:
-    0: 111 AMR/8000 octet-aligned=1  -> rc=0
-    1: 112 AMR/8000 octet-aligned=0  -> rc=0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:111
+    conn[1]: codec:AMR, pt:121
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:122
+    conn[0]: codec:AMR, pt:112
+ ===> SUCCESS: codec decision as expected!
+#6: test AMR with differing octet-aligned settings (oa <-> both)
+ - add codecs on conn0:
+    0: 111 AMR/8000 octet-aligned=1  -> rc=0
+ - add codecs on conn1:
+    0: 122 AMR/8000 octet-aligned=0  -> rc=0
+    1: 121 AMR/8000 octet-aligned=1  -> rc=0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:111
+    conn[1]: codec:AMR, pt:121
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:121
+    conn[0]: codec:AMR, pt:111
+ ===> SUCCESS: codec decision as expected!
+#7: test AMR with differing octet-aligned settings (bwe <-> both)
+ - add codecs on conn0:
+    0: 112 AMR/8000 octet-aligned=0  -> rc=0
+ - add codecs on conn1:
+    0: 122 AMR/8000 octet-aligned=0  -> rc=0
+    1: 121 AMR/8000 octet-aligned=1  -> rc=0
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:112
+    conn[1]: codec:AMR, pt:122
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:122
+    conn[0]: codec:AMR, pt:112
+ ===> SUCCESS: codec decision as expected!
+#8: test AMR with missing octet-aligned settings (oa <-> unset)
 - add codecs on conn0:
    0: 111 AMR/8000 octet-aligned=1  -> rc=0
 - add codecs on conn1:
    0: 122 AMR/8000 octet-aligned=unset  -> rc=0
- - mgcp_codec_find_convertible(conn1, AMR) -> AMR -> 121
- - mgcp_codec_from_pt(conn1, 121) -> AMR
- - mgcp_codec_find_convertible(conn0, AMR) -> AMR -> 111
- - mgcp_codec_from_pt(conn0, 112) -> AMR
- - mgcp_codec_find_convertible(conn1, AMR) -> AMR -> 122
- - mgcp_codec_from_pt(conn1, 122) -> AMR
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:111
+    conn[1]: codec:AMR, pt:122
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:122
+    conn[0]: codec:AMR, pt:111
+ ===> SUCCESS: codec decision as expected!
+#9: test AMR with missing octet-aligned settings (bwe <-> unset)
 - add codecs on conn0:
    0: 111 AMR/8000 octet-aligned=0  -> rc=0
 - add codecs on conn1:
    0: 122 AMR/8000 octet-aligned=unset  -> rc=0
-    0: 111 AMR/8000 octet-aligned=1  -> rc=0
- - add codecs on conn1:
-    0: 122 AMR/8000 octet-aligned=unset  -> rc=0
- - mgcp_codec_from_pt(conn0, 111) -> AMR
- - mgcp_codec_find_convertible(conn1, AMR) -> AMR -> 122
- - mgcp_codec_from_pt(conn1, 122) -> AMR
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:111
+    conn[1]: codec:AMR, pt:122
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:122
+    conn[0]: codec:AMR, pt:111
+ ===> SUCCESS: codec decision as expected!
+#10: test AMR with NULL param (oa <-> null)
 - add codecs on conn0:
    0: 112 AMR/8000 octet-aligned=1  -> rc=0
 - add codecs on conn1:
    0: 122 AMR/8000  -> rc=0
-    0: 111 AMR/8000 octet-aligned=0  -> rc=0
- - add codecs on conn1:
-    0: 122 AMR/8000 octet-aligned=unset  -> rc=0
- - mgcp_codec_from_pt(conn0, 111) -> AMR
- - mgcp_codec_find_convertible(conn1, AMR) -> AMR -> 122
- - mgcp_codec_from_pt(conn1, 122) -> AMR
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:112
+    conn[1]: codec:AMR, pt:122
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:122
+    conn[0]: codec:AMR, pt:112
+ ===> SUCCESS: codec decision as expected!
+#11: test AMR with NULL param (bwe <-> null)
 - add codecs on conn0:
    0: 112 AMR/8000 octet-aligned=0  -> rc=0
 - add codecs on conn1:
    0: 122 AMR/8000  -> rc=0
-    0: 112 AMR/8000 octet-aligned=1  -> rc=0
- - add codecs on conn1:
-    0: 122 AMR/8000  -> rc=0
- - mgcp_codec_from_pt(conn0, 112) -> AMR
- - mgcp_codec_find_convertible(conn1, AMR) -> AMR -> 122
- - mgcp_codec_from_pt(conn1, 122) -> AMR
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:AMR, pt:112
+    conn[1]: codec:AMR, pt:122
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:AMR, pt:122
+    conn[0]: codec:AMR, pt:112
+ ===> SUCCESS: codec decision as expected!
+#12: match FOO/8000/1 and FOO/8000 as identical, single channel is implicit
 - add codecs on conn0:
    0:   0 PCMU/8000/1  -> rc=0
    1: 111 GSM-HR-08/8000/1  -> rc=0
@@ -1431,20 +1662,16 @@ Testing mgcp_codec_find_convertible()
    0:  97 GSM-HR-08/8000  -> rc=0
    1:   0 PCMU/8000  -> rc=0
    2:  96 AMR/8000 octet-aligned=1  -> rc=0
- - mgcp_codec_find_convertible(conn1, AMR) -> AMR -> 122
- - mgcp_codec_from_pt(conn1, 122) -> AMR
- - mgcp_codec_find_convertible(conn0, AMR) -> AMR -> 112
- - mgcp_codec_from_pt(conn0, 55) -> NO RESULT
-#10: match FOO/8000/1 and FOO/8000 as identical, single channel is implicit
- - add codecs on conn0:
-    0:   0 PCMU/8000/1  -> rc=0
-    1: 111 GSM-HR-08/8000/1  -> rc=0
-    2: 112 AMR/8000/1 octet-aligned=1  -> rc=0
- - add codecs on conn1:
-    0:  97 GSM-HR-08/8000  -> rc=0
-    1:   0 PCMU/8000  -> rc=0
-    2:  96 AMR/8000 octet-aligned=1  -> rc=0
- - mgcp_codec_from_pt(conn0, 112) -> AMR
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:PCMU, pt:0
+    conn[1]: codec:PCMU, pt:0
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:GSM-HR-08, pt:97
+    conn[0]: codec:GSM-HR-08, pt:111
+ ===> SUCCESS: codec decision as expected!
+#13: match FOO/8000/1 and FOO as identical, 8k and single channel are implicit
 - add codecs on conn0:
    0:   0 PCMU/8000/1  -> rc=0
    1: 111 GSM-HR-08/8000/1  -> rc=0
@@ -1453,20 +1680,16 @@ Testing mgcp_codec_find_convertible()
    0:  97 GSM-HR-08  -> rc=0
    1:   0 PCMU  -> rc=0
    2:  96 AMR octet-aligned=1  -> rc=0
- - mgcp_codec_find_convertible(conn1, GSM-HR-08) -> GSM-HR-08 -> 97
- - mgcp_codec_from_pt(conn1, 97) -> GSM-HR-08
- - mgcp_codec_find_convertible(conn0, GSM-HR-08) -> GSM-HR-08 -> 111
- - mgcp_codec_from_pt(conn0, 123) -> NO RESULT
-#11: match FOO/8000/1 and FOO as identical, 8k and single channel are implicit
- - add codecs on conn0:
-    0:   0 PCMU/8000/1  -> rc=0
-    1: 111 GSM-HR-08/8000/1  -> rc=0
-    2: 112 AMR/8000/1 octet-aligned=1  -> rc=0
- - add codecs on conn1:
-    0:  97 GSM-HR-08  -> rc=0
-    1:   0 PCMU  -> rc=0
-    2:  96 AMR octet-aligned=1  -> rc=0
- - mgcp_codec_from_pt(conn0, 112) -> AMR
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:PCMU, pt:0
+    conn[1]: codec:PCMU, pt:0
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:GSM-HR-08, pt:97
+    conn[0]: codec:GSM-HR-08, pt:111
+ ===> SUCCESS: codec decision as expected!
+#14: test whether channel number matching is waterproof
 - add codecs on conn0:
    0: 111 GSM-HR-08/8000  -> rc=0
    1: 112 GSM-HR-08/8000/2  -> rc=-22
@@ -1474,12 +1697,15 @@ Testing mgcp_codec_find_convertible()
 - add codecs on conn1:
    0: 122 GSM-HR-08/8000/2  -> rc=-22
    1: 121 GSM-HR-08/8000/1  -> rc=0
- - mgcp_codec_from_pt(conn0, 111) -> GSM-HR-08
- - mgcp_codec_find_convertible(conn1, GSM-HR-08) -> GSM-HR-08 -> 97
- - mgcp_codec_from_pt(conn1, 97) -> GSM-HR-08
- - mgcp_codec_find_convertible(conn0, GSM-HR-08) -> GSM-HR-08 -> 111
- - mgcp_codec_from_pt(conn0, 123) -> NO RESULT
-#12: test whether channel number matching is waterproof
+ - mgcp_codec_decide(&conn[0], &conn[1]):
+    Codec decision result:
+    conn[0]: codec:GSM-HR-08, pt:111
+    conn[1]: codec:GSM-HR-08, pt:121
+ - mgcp_codec_decide(&conn[1], &conn[0]):
+    Codec decision result:
+    conn[1]: codec:GSM-HR-08, pt:121
+    conn[0]: codec:GSM-HR-08, pt:111
+ ===> SUCCESS: codec decision as expected!

 Testing test_conn_id_matching
 needle='23AB' found '000023AB'
--- a/tests/mgcp_client/mgcp_client_test.c
+++ b/tests/mgcp_client/mgcp_client_test.c
@@ -73,7 +73,7 @@ static struct msgb *from_str(const char *str)
 	return msg;
 }

-static struct mgcp_client_conf conf;
+static struct mgcp_client_conf *conf;
 struct mgcp_client *mgcp = NULL;

 static int reply_to(mgcp_trans_id_t trans_id, int code, const char *comment,
@@ -107,9 +107,6 @@ void test_response_cb(struct mgcp_response *response, void *priv)
 	printf("  audio_port = %u\n", response->audio_port);
 	printf("  audio_ip = %s\n", response->audio_ip);
 	printf("  ptime = %u\n", response->ptime);
-	printf("  codecs_len = %u\n", response->codecs_len);
-	for(i=0;i<response->codecs_len;i++)
-		printf("  codecs[%u] = %u\n", i, response->codecs[i]);
 	printf("  ptmap_len = %u\n", response->ptmap_len);
 	for(i=0;i<response->ptmap_len;i++) {
 		printf("  ptmap[%u].codec = %u\n", i, response->ptmap[i].codec);
@@ -149,12 +146,11 @@ void test_mgcp_msg(void)
 		.conn_id = "11",
 		.conn_mode = MGCP_CONN_RECV_SEND,
 		.ptime = 20,
-		.codecs[0] = CODEC_GSM_8000_1,
-		.codecs[1] = CODEC_AMR_8000_1,
-		.codecs[2] = CODEC_GSMEFR_8000_1,
-		.codecs_len = 1,
-		.ptmap[0].codec = CODEC_GSMEFR_8000_1,
-		.ptmap[0].pt = 96,
+		.ptmap = {
+			{ .codec = CODEC_GSM_8000_1, .pt = CODEC_GSM_8000_1 },
+			{ .codec = CODEC_AMR_8000_1, .pt = CODEC_AMR_8000_1 },
+			{ .codec = CODEC_GSMEFR_8000_1, .pt = 96 },
+		},
 		.ptmap_len = 1,
 		.x_osmo_ign = MGCP_X_OSMO_IGN_CALLID,
 		.x_osmo_osmux_cid = -1, /* wildcard */
@@ -162,7 +158,7 @@ void test_mgcp_msg(void)

 	if (mgcp)
 		talloc_free(mgcp);
-	mgcp = mgcp_client_init(ctx, &conf);
+	mgcp = mgcp_client_init(ctx, conf);

 	printf("\n");

@@ -179,9 +175,9 @@ void test_mgcp_msg(void)
 	mgcp_msg.presence =
 	    (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID |
 	     MGCP_MSG_PRESENCE_CONN_ID | MGCP_MSG_PRESENCE_CONN_MODE);
-	mgcp_msg.codecs_len = 2;
+	mgcp_msg.ptmap_len = 2;
 	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	mgcp_msg.codecs_len = 1;
+	mgcp_msg.ptmap_len = 1;
 	printf("%s\n", (char *)msg->data);

 	printf("Generated CRCX message (three codecs, one with custom pt):\n");
@@ -189,9 +185,9 @@ void test_mgcp_msg(void)
 	mgcp_msg.presence =
 	    (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID |
 	     MGCP_MSG_PRESENCE_CONN_ID | MGCP_MSG_PRESENCE_CONN_MODE);
-	mgcp_msg.codecs_len = 3;
+	mgcp_msg.ptmap_len = 3;
 	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	mgcp_msg.codecs_len = 1;
+	mgcp_msg.ptmap_len = 1;
 	printf("%s\n", (char *)msg->data);

 	printf("Generated MDCX message:\n");
@@ -209,9 +205,9 @@ void test_mgcp_msg(void)
 	    (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID |
 	     MGCP_MSG_PRESENCE_CONN_ID | MGCP_MSG_PRESENCE_CONN_MODE |
 	     MGCP_MSG_PRESENCE_AUDIO_IP | MGCP_MSG_PRESENCE_AUDIO_PORT);
-	mgcp_msg.codecs_len = 2;
+	mgcp_msg.ptmap_len = 2;
 	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	mgcp_msg.codecs_len = 1;
+	mgcp_msg.ptmap_len = 1;
 	printf("%s\n", (char *)msg->data);

 	printf("Generated MDCX message (three codecs, one with custom pt):\n");
@@ -220,9 +216,9 @@ void test_mgcp_msg(void)
 	    (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID |
 	     MGCP_MSG_PRESENCE_CONN_ID | MGCP_MSG_PRESENCE_CONN_MODE |
 	     MGCP_MSG_PRESENCE_AUDIO_IP | MGCP_MSG_PRESENCE_AUDIO_PORT);
-	mgcp_msg.codecs_len = 3;
+	mgcp_msg.ptmap_len = 3;
 	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	mgcp_msg.codecs_len = 1;
+	mgcp_msg.ptmap_len = 1;
 	printf("%s\n", (char *)msg->data);

 	printf("Generated DLCX message:\n");
@@ -330,8 +326,10 @@ void test_mgcp_client_cancel(void)
 		.presence = (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID
 			     | MGCP_MSG_PRESENCE_CONN_ID | MGCP_MSG_PRESENCE_CONN_MODE),
 		.ptime = 20,
-		.codecs[0] = CODEC_AMR_8000_1,
-		.codecs_len = 1
+		.ptmap = {
+			{ .codec = CODEC_AMR_8000_1, .pt = CODEC_AMR_8000_1 },
+		},
+		.ptmap_len = 1
 	};

 	printf("\n%s():\n", __func__);
@@ -339,7 +337,7 @@ void test_mgcp_client_cancel(void)

 	if (mgcp)
 		talloc_free(mgcp);
-	mgcp = mgcp_client_init(ctx, &conf);
+	mgcp = mgcp_client_init(ctx, conf);

 	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
 	trans_id = mgcp_msg_trans_id(msg);
@@ -531,7 +529,7 @@ void test_sdp_section_start(void)
 	OSMO_ASSERT(!failures);
 }

-static void test_map_pt_to_codec(void)
+static void test_map_str_to_codec(void)
 {
 	/* Full form */
 	OSMO_ASSERT(map_str_to_codec("PCMU/8000/1") == CODEC_PCMU_8000_1);
@@ -630,7 +628,7 @@ void test_mgcp_client_e1_epname(void)

 	if (mgcp)
 		talloc_free(mgcp);
-	mgcp = mgcp_client_init(ctx, &conf);
+	mgcp = mgcp_client_init(ctx, conf);

 	/* Valid endpoint names */
 	epname = (char *)mgcp_client_e1_epname(ctx, mgcp, 1, 15, 64, 0);
@@ -675,6 +673,214 @@ void test_mgcp_client_e1_epname(void)
 	OSMO_ASSERT(epname == NULL);
 }

+struct parse_response_test {
+	const char *body;
+	int expect_rc;
+	struct mgcp_response expect_params;
+};
+
+static struct parse_response_test parse_response_tests[] = {
+	{
+		.body = "200 2 OK\r\n"
+			"I: foo\r\n"
+			"\r\n"
+			"v=0\r\n"
+			"o=- name 23 IN IP4 0.0.0.0\r\n"
+			"s=-\r\n"
+			"c=IN IP4 1.2.3.4\r\n"
+			"t=0 0\r\n"
+			"m=audio 23 RTP/AVP 112 3\r\n" /* <-- implicit: 3 = GSM-FR */
+			"a=rtpmap:112 AMR/8000\r\n"
+			"a=ptime:20\r\n",
+		.expect_rc = 0,
+		.expect_params = {
+			.audio_port = 23,
+			.audio_ip = "1.2.3.4",
+			.ptmap = {
+				{ .codec = CODEC_AMR_8000_1, .pt = 112 },
+				{ .codec = CODEC_GSM_8000_1, .pt = 3 },
+			},
+			.ptmap_len = 2,
+		},
+	},
+	{
+		.body = "200 2 OK\r\n"
+			"I: foo\r\n"
+			"\r\n"
+			"v=0\r\n"
+			"o=- name 23 IN IP4 0.0.0.0\r\n"
+			"s=-\r\n"
+			"c=IN IP4 1.2.3.4\r\n"
+			"t=0 0\r\n"
+			"m=audio 23 RTP/AVP 112 3\r\n"
+			"a=rtpmap:112 AMR/8000\r\n"
+			"a=rtpmap:3 GSM/8000\r\n" /* 3 == GSM-FR implicitly, is an explicit entry a problem? */
+			"a=ptime:20\r\n",
+		.expect_rc = 0,
+		.expect_params = {
+			.audio_port = 23,
+			.audio_ip = "1.2.3.4",
+			.ptmap = {
+				{ .codec = CODEC_AMR_8000_1, .pt = 112 },
+				{ .codec = CODEC_GSM_8000_1, .pt = 3 }, /* no, not a problem */
+			},
+			.ptmap_len = 2,
+		},
+	},
+	{
+		.body = "200 2 OK\r\n"
+			"I: foo\r\n"
+			"\r\n"
+			"v=0\r\n"
+			"o=- name 23 IN IP4 0.0.0.0\r\n"
+			"s=-\r\n"
+			"c=IN IP4 1.2.3.4\r\n"
+			"t=0 0\r\n"
+			"m=audio 23 RTP/AVP 3\r\n" /* <-- 112 is missing here. Will it still appear? */
+			"a=rtpmap:112 AMR/8000\r\n"
+			"a=ptime:20\r\n",
+		.expect_rc = 0,
+		.expect_params = {
+			.audio_port = 23,
+			.audio_ip = "1.2.3.4",
+			.ptmap = {
+				{ .codec = CODEC_GSM_8000_1, .pt = 3 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 112 }, /* <-- yes, it was added to the end. */
+			},
+			.ptmap_len = 2,
+		},
+	},
+	{
+		/* test MGCP_MAX_CODECS */
+		.body = "200 2 OK\r\n"
+			"I: foo\r\n"
+			"\r\n"
+			"v=0\r\n"
+			"o=- name 23 IN IP4 0.0.0.0\r\n"
+			"s=-\r\n"
+			"c=IN IP4 1.2.3.4\r\n"
+			"t=0 0\r\n"
+			"m=audio 23 RTP/AVP 101 102 103 104 105 106 107 108 109 110\r\n" /* <-- 10 codecs max */
+			"a=rtpmap:101 AMR/8000\r\n"
+			"a=rtpmap:102 AMR/8000\r\n"
+			"a=rtpmap:103 AMR/8000\r\n"
+			"a=rtpmap:104 AMR/8000\r\n"
+			"a=rtpmap:105 AMR/8000\r\n"
+			"a=rtpmap:106 AMR/8000\r\n"
+			"a=rtpmap:107 AMR/8000\r\n"
+			"a=rtpmap:108 AMR/8000\r\n"
+			"a=rtpmap:109 AMR/8000\r\n"
+			"a=rtpmap:110 AMR/8000\r\n"
+			"a=ptime:20\r\n",
+		.expect_rc = 0,
+		.expect_params = {
+			.audio_port = 23,
+			.audio_ip = "1.2.3.4",
+			.ptmap = {
+				{ .codec = CODEC_AMR_8000_1, .pt = 101 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 102 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 103 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 104 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 105 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 106 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 107 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 108 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 109 },
+				{ .codec = CODEC_AMR_8000_1, .pt = 110 },
+			},
+			.ptmap_len = 10,
+		},
+	},
+	{
+		/* test MGCP_MAX_CODECS */
+		.body = "200 2 OK\r\n"
+			"I: foo\r\n"
+			"\r\n"
+			"v=0\r\n"
+			"o=- name 23 IN IP4 0.0.0.0\r\n"
+			"s=-\r\n"
+			"c=IN IP4 1.2.3.4\r\n"
+			"t=0 0\r\n"
+			"m=audio 23 RTP/AVP 101 102 103 104 105 106 107 108 109 110 3\r\n" /* <-- 11 > MGCP_MAX_CODECS */
+			"a=rtpmap:101 AMR/8000\r\n"
+			"a=rtpmap:102 AMR/8000\r\n"
+			"a=rtpmap:103 AMR/8000\r\n"
+			"a=rtpmap:104 AMR/8000\r\n"
+			"a=rtpmap:105 AMR/8000\r\n"
+			"a=rtpmap:106 AMR/8000\r\n"
+			"a=rtpmap:107 AMR/8000\r\n"
+			"a=rtpmap:108 AMR/8000\r\n"
+			"a=rtpmap:109 AMR/8000\r\n"
+			"a=rtpmap:110 AMR/8000\r\n"
+			"a=ptime:20\r\n",
+		.expect_rc = -EINVAL,
+	},
+};
+
+static void test_parse_response(void)
+{
+	int i;
+	int failures = 0;
+
+	for (i = 0; i < ARRAY_SIZE(parse_response_tests); i++) {
+		int rc;
+		struct parse_response_test *t = &parse_response_tests[i];
+		struct mgcp_response *r = talloc_zero(ctx, struct mgcp_response);
+		int p;
+
+		r->body = talloc_strdup(r, t->body);
+
+		//printf("\n%s() test [%d]:\n", __func__, i);
+		fprintf(stderr, "\n%s() test [%d]:\n", __func__, i);
+		fprintf(stderr, "body: \"%s\"\n", osmo_escape_str(r->body, -1));
+
+		rc = mgcp_response_parse_params(r);
+
+		fprintf(stderr, "got rc=%d\n", rc);
+		if (rc != t->expect_rc) {
+			fprintf(stderr, "FAIL: Expected rc=%d\n", t->expect_rc);
+			failures++;
+		}
+		if (rc) {
+			talloc_free(r);
+			continue;
+		}
+
+		fprintf(stderr, "got audio_ip=\"%s\"\n", r->audio_ip);
+		if (strcmp(r->audio_ip, t->expect_params.audio_ip)) {
+			fprintf(stderr, "FAIL: Expected audio_ip=\"%s\"\n", t->expect_params.audio_ip);
+			failures++;
+		}
+		fprintf(stderr, "got audio_port=%u\n", r->audio_port);
+		if (r->audio_port != t->expect_params.audio_port) {
+			fprintf(stderr, "FAIL: Expected audio_port=%u\n", t->expect_params.audio_port);
+			failures++;
+		}
+
+		for (p = 0; p < r->ptmap_len; p++) {
+			struct ptmap *got = &r->ptmap[p];
+			struct ptmap *expect = NULL;
+			fprintf(stderr, "  %d %s\n", got->pt, osmo_mgcpc_codec_name(got->codec));
+			if (p >= t->expect_params.ptmap_len) {
+				fprintf(stderr, "    - ERROR: too many codec entries\n");
+				failures++;
+				continue;
+			}
+			expect = &t->expect_params.ptmap[p];
+			if (ptmap_cmp(got, expect)) {
+				fprintf(stderr, "    - ERROR: expected: %d %s\n",
+					expect->pt, osmo_mgcpc_codec_name(expect->codec));
+				failures++;
+			}
+		}
+
+		talloc_free(r);
+	}
+
+	OSMO_ASSERT(!failures);
+}
+
+
 static const struct log_info_cat log_categories[] = {
 };

@@ -697,15 +903,17 @@ int main(int argc, char **argv)

 	log_set_category_filter(osmo_stderr_target, DLMGCP, 1, LOGL_DEBUG);

-	mgcp_client_conf_init(&conf);
+	conf = mgcp_client_conf_alloc(ctx);

 	test_mgcp_msg();
 	test_mgcp_client_cancel();
 	test_sdp_section_start();
 	test_map_codec_to_pt_and_map_pt_to_codec();
-	test_map_pt_to_codec();
+	test_map_str_to_codec();
 	test_mgcp_client_e1_epname();

+	test_parse_response();
+
 	printf("Done\n");
 	fprintf(stderr, "Done\n");
 	return EXIT_SUCCESS;
--- a/tests/mgcp_client/mgcp_client_test.err
+++ b/tests/mgcp_client/mgcp_client_test.err
@@ -1,5 +1,5 @@
 DLMGCP MGW(mgw) MGCP client: using endpoint domain '@mgw'
-DLMGCP MGW(mgw) Message buffer to small, can not generate MGCP message (SDP)
+DLMGCP MGW(mgw) Message buffer too small, can not generate MGCP message (SDP)
 DLMGCP MGW(mgw) Failed to add SDP, can not generate MGCP message

 test_mgcp_client_cancel():
@@ -11,6 +11,7 @@ DLMGCP MGW(mgw) Cannot cancel, no such transaction: 1
 - cancel succeeds
 DLMGCP MGW(mgw) Canceled transaction 1
 - late response gets discarded
+DLMGCP MGW(mgw) MGCP link to MGW now considered UP
 DLMGCP MGW(mgw) MGCP client: Rx 200 1 OK
 DLMGCP MGW(mgw) Cannot find matching MGCP transaction for trans_id 1
 - canceling again does nothing
@@ -136,4 +137,51 @@ DLMGCP MGW(mgw) Cannot compose MGCP e1-endpoint name (ds/e1-15/s-1/su128-0@mgw),
 DLMGCP MGW(mgw) Cannot compose MGCP e1-endpoint name (ds/e1-15/s-1/su8-16@mgw), rate(8)/offset(16) combination is invalid!
 DLMGCP MGW(mgw) Cannot compose MGCP e1-endpoint name (ds/e1-15/s-0/su8-2@mgw), E1-timeslot number (0) is invalid!
 DLMGCP MGW(mgw) Cannot compose MGCP e1-endpoint name (ds/e1-15/s-64/su8-2@mgw), E1-timeslot number (64) is invalid!
+
+test_parse_response() test [0]:
+body: "200 2 OK\r\nI: foo\r\n\r\nv=0\r\no=- name 23 IN IP4 0.0.0.0\r\ns=-\r\nc=IN IP4 1.2.3.4\r\nt=0 0\r\nm=audio 23 RTP/AVP 112 3\r\na=rtpmap:112 AMR/8000\r\na=ptime:20\r\n"
+got rc=0
+got audio_ip="1.2.3.4"
+got audio_port=23
+  112 AMR/8000/1
+  3 GSM/8000/1
+
+test_parse_response() test [1]:
+body: "200 2 OK\r\nI: foo\r\n\r\nv=0\r\no=- name 23 IN IP4 0.0.0.0\r\ns=-\r\nc=IN IP4 1.2.3.4\r\nt=0 0\r\nm=audio 23 RTP/AVP 112 3\r\na=rtpmap:112 AMR/8000\r\na=rtpmap:3 GSM/8000\r\na=ptime:20\r\n"
+got rc=0
+got audio_ip="1.2.3.4"
+got audio_port=23
+  112 AMR/8000/1
+  3 GSM/8000/1
+
+test_parse_response() test [2]:
+body: "200 2 OK\r\nI: foo\r\n\r\nv=0\r\no=- name 23 IN IP4 0.0.0.0\r\ns=-\r\nc=IN IP4 1.2.3.4\r\nt=0 0\r\nm=audio 23 RTP/AVP 3\r\na=rtpmap:112 AMR/8000\r\na=ptime:20\r\n"
+DLMGCP error in MGCP message: 'a=rtpmap:112' has no matching entry in 'm=audio ... 112'
+got rc=0
+got audio_ip="1.2.3.4"
+got audio_port=23
+  3 GSM/8000/1
+  112 AMR/8000/1
+
+test_parse_response() test [3]:
+body: "200 2 OK\r\nI: foo\r\n\r\nv=0\r\no=- name 23 IN IP4 0.0.0.0\r\ns=-\r\nc=IN IP4 1.2.3.4\r\nt=0 0\r\nm=audio 23 RTP/AVP 101 102 103 104 105 106 107 108 109 110\r\na=rtpmap:101 AMR/8000\r\na=rtpmap:102 AMR/8000\r\na=rtpmap:103 AMR/8000\r\na=rtpmap:104 AMR/8"
+got rc=0
+got audio_ip="1.2.3.4"
+got audio_port=23
+  101 AMR/8000/1
+  102 AMR/8000/1
+  103 AMR/8000/1
+  104 AMR/8000/1
+  105 AMR/8000/1
+  106 AMR/8000/1
+  107 AMR/8000/1
+  108 AMR/8000/1
+  109 AMR/8000/1
+  110 AMR/8000/1
+
+test_parse_response() test [4]:
+body: "200 2 OK\r\nI: foo\r\n\r\nv=0\r\no=- name 23 IN IP4 0.0.0.0\r\ns=-\r\nc=IN IP4 1.2.3.4\r\nt=0 0\r\nm=audio 23 RTP/AVP 101 102 103 104 105 106 107 108 109 110 3\r\na=rtpmap:101 AMR/8000\r\na=rtpmap:102 AMR/8000\r\na=rtpmap:103 AMR/8000\r\na=rtpmap:104 AMR"
+DLMGCP SDP: can parse only up to 10 payload type numbers
+DLMGCP Failed to parse SDP parameter payload types (RTP/AVP)
+got rc=-22
 Done
--- a/tests/sdp/Makefile.am
+++ b/tests/sdp/Makefile.am
@@ -0,0 +1,62 @@
+AM_CPPFLAGS = \
+	$(all_includes) \
+	-I$(top_srcdir)/include \
+	-I$(top_builddir)/include \
+	-I$(top_srcdir) \
+	$(NULL)
+
+AM_CFLAGS = \
+	-Wall \
+	-ggdb3 \
+	$(LIBOSMOCORE_CFLAGS) \
+	$(COVERAGE_CFLAGS) \
+	$(NULL)
+
+AM_LDFLAGS = \
+	$(COVERAGE_LDFLAGS) \
+	-no-install \
+	$(NULL)
+
+EXTRA_DIST = \
+	sdp_fmtp_test.ok \
+	sdp_fmtp_test.err \
+	sdp_codec_test.ok \
+	sdp_codec_test.err \
+	$(NULL)
+
+check_PROGRAMS = \
+	sdp_fmtp_test \
+	sdp_codec_test \
+	sdp_msg_test \
+	$(NULL)
+
+sdp_fmtp_test_SOURCES = \
+	sdp_fmtp_test.c \
+	$(NULL)
+
+sdp_fmtp_test_LDADD = \
+	$(top_builddir)/src/libosmo-sdp/libosmo-sdp.la \
+	$(NULL)
+
+sdp_codec_test_SOURCES = \
+	sdp_codec_test.c \
+	$(NULL)
+
+sdp_codec_test_LDADD = \
+	$(top_builddir)/src/libosmo-sdp/libosmo-sdp.la \
+	$(LIBOSMOCORE_LIBS) \
+	$(NULL)
+
+sdp_msg_test_SOURCES = \
+	sdp_msg_test.c \
+	$(NULL)
+
+sdp_msg_test_LDADD = \
+	$(top_builddir)/src/libosmo-sdp/libosmo-sdp.la \
+	$(LIBOSMOCORE_LIBS) \
+	$(NULL)
+
+update_exp:
+	$(builddir)/sdp_fmtp_test >$(srcdir)/sdp_fmtp_test.ok 2>$(srcdir)/sdp_fmtp_test.err
+	$(builddir)/sdp_codec_test >$(srcdir)/sdp_codec_test.ok 2>$(srcdir)/sdp_codec_test.err
+	$(builddir)/sdp_msg_test >$(srcdir)/sdp_msg_test.ok 2>$(srcdir)/sdp_msg_test.err
--- a/tests/sdp/sdp_codec_test.c
+++ b/tests/sdp/sdp_codec_test.c
@@ -0,0 +1,645 @@
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <osmocom/sdp/sdp_codec_list.h>
+#include <osmocom/sdp/fmtp.h>
+
+void *test_ctx = NULL;
+
+static void report_callback(const void *ptr, int depth, int max_depth, int is_ref, void *priv)
+{
+        const char *name = talloc_get_name(ptr);
+	printf(" |%*s%3zu %s\n", depth, "", talloc_total_blocks(ptr), name);
+}
+
+/* Print a talloc report that is reproducible for test output verification. It contains no pointer addresses. */
+#define report(CTX) _report(CTX, #CTX)
+static void _report(void *ctx, const char *label)
+{
+	fflush(stdout);
+	fflush(stderr);
+	printf("%s\n", label);
+        talloc_report_depth_cb(ctx, 0, 100, report_callback, NULL);
+	fflush(stdout);
+}
+
+struct codec_test {
+	struct osmo_sdp_codec set;
+	int expect_rc;
+	const char *expect_str;
+	bool expect_is_set;
+};
+
+struct codec_test codec_tests[] = {
+	{
+		.set = { 23, "encoding-name", 8000, NULL },
+		.expect_str = "encoding-name#23",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 112, "AMR", 8000, "octet-align=1;mode-set=0,2,4" },
+		.expect_str = "AMR:octet-align=1;mode-set=0,2,4#112",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 96, "AMR", 8000, "mode-set=0,2,4;octet-align=1" },
+		.expect_str = "AMR:mode-set=0,2,4;octet-align=1#96",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 114, "AMR", 8000, "mode-set=0,2,4" },
+		.expect_str = "AMR:mode-set=0,2,4#114",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 97, "AMR", 8000, "mode-set=0,2,4;octet-align=0" },
+		.expect_str = "AMR:mode-set=0,2,4;octet-align=0#97",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 98, "AMR", 8000, "octet-align=1" },
+		.expect_str = "AMR:octet-align=1#98",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 96, "AMR-WB", 16000 },
+		.expect_str = "AMR-WB/16000#96",
+		.expect_is_set = true,
+	},
+	{
+		.set = { 3, "GSM", 8000 },
+		.expect_str = "GSM#3",
+		.expect_is_set = true,
+	},
+	{
+		.set = { },
+		.expect_str = "/0#0",
+		.expect_is_set = false,
+	},
+	{
+		.set = { 112, NULL, 8000, "octet-align=1" },
+		.expect_str = ":octet-align=1#112",
+		.expect_is_set = false,
+	},
+	{
+		.set = { 112, "", 8000, "octet-align=1" },
+		.expect_str = ":octet-align=1#112",
+		.expect_is_set = false,
+	},
+};
+
+void test_codec(void)
+{
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+
+	struct codec_test *t;
+	struct codec_test *t2;
+
+	printf("\n\n--- %s()\n", __func__);
+	printf("- osmo_sdp_codec_set():\n");
+	for (t = codec_tests; (t - codec_tests) < ARRAY_SIZE(codec_tests); t++) {
+		struct osmo_sdp_codec *codec = osmo_sdp_codec_alloc(ctx);
+		char *str;
+		bool is_set;
+
+		osmo_sdp_codec_set(codec, t->set.payload_type, t->set.encoding_name, t->set.rate, t->set.fmtp);
+
+		str = osmo_sdp_codec_to_str_c(ctx, codec);
+		printf("osmo_sdp_codec_set [%d] '%s'\n", (int)(t - codec_tests), str);
+		if (strcmp(str, t->expect_str))
+			printf("  *** ERROR: expected '%s'\n", t->expect_str);
+
+		if (!osmo_sdp_codec_cmp(codec, &t->set, &osmo_sdp_codec_cmp_exact))
+			printf("  osmo_sdp_codec_cmp() ok\n");
+		else
+			printf("  osmo_sdp_codec_cmp() *** ERROR: mismatches original values\n");
+
+		is_set = osmo_sdp_codec_is_set(codec);
+		printf("  osmo_sdp_codec_is_set() = %s\n", is_set ? "true" : "false");
+		if (is_set != t->expect_is_set)
+			printf("    *** ERROR: expected is_set = %s\n", t->expect_is_set ? "true" : "false");
+
+		if (is_set != osmo_sdp_codec_is_set(&t->set))
+			printf("    *** ERROR: is_set(copy) != is_set(orig)\n");
+
+		talloc_free(str);
+		talloc_free(codec);
+		if (talloc_total_blocks(ctx) != 1)
+			printf("  *** ERROR: ctx has %zu items, should be 1\n", talloc_total_blocks(ctx));
+	}
+
+	printf("\n- osmo_sdp_codec_cmp(equivalent):\n");
+	for (t = codec_tests; (t - codec_tests) < ARRAY_SIZE(codec_tests); t++) {
+		for (t2 = codec_tests; (t2 - codec_tests) < ARRAY_SIZE(codec_tests); t2++) {
+			int cmp = osmo_sdp_codec_cmp(&t->set, &t2->set, &osmo_sdp_codec_cmp_equivalent);
+			int reverse_cmp = osmo_sdp_codec_cmp(&t2->set, &t->set, &osmo_sdp_codec_cmp_equivalent);
+			printf("  %s %s %s %s %s\n",
+			       osmo_sdp_codec_to_str_c(ctx, &t->set),
+			       (cmp == 0) ? "=="
+			       : ((cmp < 0) ? "<" : ">"),
+			       osmo_sdp_codec_to_str_c(ctx, &t2->set),
+			       (reverse_cmp == 0) ? "=="
+			       : ((reverse_cmp < 0) ? "<" : ">"),
+			       osmo_sdp_codec_to_str_c(ctx, &t->set));
+
+			if (reverse_cmp != -cmp)
+				printf("    *** ERROR: osmo_sdp_codec_cmp(reverse args) == %d, expected %d\n",
+				       reverse_cmp, -cmp);
+
+			talloc_free_children(ctx);
+		}
+	}
+
+	printf("\n- osmo_sdp_codec_from_str():\n");
+	for (t = codec_tests; (t - codec_tests) < ARRAY_SIZE(codec_tests); t++) {
+		struct osmo_sdp_codec *codec = osmo_sdp_codec_alloc(ctx);
+		int rc = osmo_sdp_codec_from_str(codec, t->expect_str, -1);
+		printf("  osmo_sdp_codec_from_str('%s') rc=%d",
+		       t->expect_str, rc);
+		if (!rc) {
+			printf(" res=%s", osmo_sdp_codec_to_str_c(ctx, codec));
+			rc = osmo_sdp_codec_cmp(codec, &t->set, &osmo_sdp_codec_cmp_exact);
+			if (rc)
+				printf(" *** ERROR: osmo_sdp_codec_cmp(res,orig) = %d", rc);
+		}
+		printf("\n");
+		talloc_free_children(ctx);
+	}
+
+	talloc_free(ctx);
+}
+
+void test_codec_list(void)
+{
+	void *list_ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+	int i;
+	int rc;
+	struct osmo_sdp_codec *codec;
+
+	const struct osmo_sdp_codec all_codecs[] = {
+		{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+		{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+		{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+	};
+
+	struct osmo_sdp_codec_list *codec_list;
+
+	printf("\n\n--- %s()\n", __func__);
+
+	codec_list = osmo_sdp_codec_list_alloc(list_ctx);
+	printf("osmo_sdp_codec_list_first() = %s\n",
+	       osmo_sdp_codec_to_str_c(print_ctx, osmo_sdp_codec_list_first(codec_list)));
+	report(list_ctx);
+
+	for (i = 0; i < ARRAY_SIZE(all_codecs); i++) {
+		struct osmo_sdp_codec *added = osmo_sdp_codec_list_add(codec_list, &all_codecs[i], NULL, false);
+		printf("[%d] osmo_sdp_codec_list_add(%s)\n", i, osmo_sdp_codec_to_str_c(print_ctx, added));
+	}
+
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	printf("osmo_sdp_codec_list_first() = %s\n",
+	       osmo_sdp_codec_to_str_c(print_ctx, osmo_sdp_codec_list_first(codec_list)));
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	printf("\n");
+	printf("- add same entries again with once=exact, nothing should change\n");
+	for (i = 0; i < ARRAY_SIZE(all_codecs); i++) {
+		struct osmo_sdp_codec *added = osmo_sdp_codec_list_add(codec_list, &all_codecs[i],
+								       &osmo_sdp_codec_cmp_exact, false);
+		printf("[] osmo_sdp_codec_list_add(%s)\n", osmo_sdp_codec_to_str_c(print_ctx, added));
+	}
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	printf("\n");
+	printf("- add same entries again with once=NULL, duplicates are added\n");
+	for (i = 0; i < ARRAY_SIZE(all_codecs); i++) {
+		struct osmo_sdp_codec *added = osmo_sdp_codec_list_add(codec_list, &all_codecs[i], NULL, false);
+		printf("[] osmo_sdp_codec_list_add(%s)\n", osmo_sdp_codec_to_str_c(print_ctx, added));
+	}
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	printf("\n");
+	printf("- add same entries again with once=NULL,pick_unused_pt_nr=true, duplicates are added with new #nr\n");
+	for (i = 0; i < ARRAY_SIZE(all_codecs); i++) {
+		struct osmo_sdp_codec *added = osmo_sdp_codec_list_add(codec_list, &all_codecs[i], NULL, true);
+		printf("[] osmo_sdp_codec_list_add(%s)\n", osmo_sdp_codec_to_str_c(print_ctx, added));
+	}
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	printf("\n");
+	printf("- remove all 'GSM#3' entries, with osmo_sdp_codec_cmp_exact\n");
+	rc = osmo_sdp_codec_list_remove(codec_list, &all_codecs[1], &osmo_sdp_codec_cmp_exact);
+	printf("  osmo_sdp_codec_list_remove() = %d\n", rc);
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	printf("- remove all 'GSM' entries, with osmo_sdp_codec_cmp_equivalent\n");
+	rc = osmo_sdp_codec_list_remove(codec_list, &all_codecs[1], &osmo_sdp_codec_cmp_equivalent);
+	printf("  osmo_sdp_codec_list_remove() = %d\n", rc);
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	rc = osmo_sdp_codec_list_move_to_first(codec_list, &all_codecs[0], &osmo_sdp_codec_cmp_equivalent);
+	printf("- osmo_sdp_codec_list_move_to_first('%s', equivalent) = %d\n",
+	       osmo_sdp_codec_to_str_c(print_ctx, &all_codecs[0]), rc);
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+
+	printf("- osmo_sdp_codec_list_free_items()\n");
+	osmo_sdp_codec_list_free_items(codec_list);
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, codec_list) {
+		printf("codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+	printf("  %d entries\n", i);
+	report(list_ctx);
+
+	printf("osmo_sdp_codec_list_to_str_c(summarize=true):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, true));
+	printf("osmo_sdp_codec_list_to_str_c(summarize=false):\n '%s'\n",
+	       osmo_sdp_codec_list_to_str_c(print_ctx, codec_list, false));
+
+	talloc_free(print_ctx);
+	talloc_free(list_ctx);
+}
+
+static struct osmo_sdp_codec_list *init_codec_list(void *ctx, const struct osmo_sdp_codec *init_array)
+{
+	struct osmo_sdp_codec_list *dst = osmo_sdp_codec_list_alloc(ctx);
+	for (; osmo_sdp_codec_is_set(init_array); init_array++)
+		osmo_sdp_codec_list_add(dst, init_array, NULL, false);
+	return dst;
+}
+
+void test_codec_list_cmp(void)
+{
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+	int i;
+
+	const struct osmo_sdp_codec codec_a[] = {
+		{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+		{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+		{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		{}
+	};
+
+	const struct osmo_sdp_codec codec_b[][5] = {
+		/* same */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* different payload_type */
+		{
+			{ .payload_type = 96, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* AMR fmtp in different order */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "mode-set=0,2,4;octet-align=1" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* different AMR mode-set */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=7" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* empty AMR mode-set */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* different AMR octet-align */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=0;mode-set=0,2,4" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* omitted AMR octet-align is identical to octet-align=0 */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "mode-set=0,2,4" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* different order */
+		{
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+		},
+
+		/* one less item */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+		},
+
+		/* one more item */
+		{
+			{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+			{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+			{ .payload_type = 110, .encoding_name = "GSM-EFR", .rate = 8000 },
+		},
+	};
+
+	const struct osmo_sdp_codec_cmp_flags *test_cmpf[] = {
+		&osmo_sdp_codec_cmp_name,
+		&osmo_sdp_codec_cmp_equivalent,
+		&osmo_sdp_codec_cmp_exact,
+	};
+
+	printf("\n\n--- %s()\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(codec_b); i++) {
+		struct osmo_sdp_codec_list *list_a = init_codec_list(ctx, codec_a);
+		struct osmo_sdp_codec_list *list_b = init_codec_list(ctx, codec_b[i]);
+		int j;
+
+		printf("A = %s\n", osmo_sdp_codec_list_to_str_c(print_ctx, list_a, false));
+		printf("B = %s\n", osmo_sdp_codec_list_to_str_c(print_ctx, list_b, false));
+
+		for (j = 0; j < ARRAY_SIZE(test_cmpf); j++) {
+			const struct osmo_sdp_codec_cmp_flags *cmpf = test_cmpf[j];
+			int cmp = osmo_sdp_codec_list_cmp(list_a, list_b, cmpf);
+			int reverse_cmp = osmo_sdp_codec_list_cmp(list_b, list_a, cmpf);
+			printf("  cmpf[%d]: payload_type=%s rate=%s fmtp=%d: A %s B %s A\n",
+			       j,
+			       cmpf->payload_type ? "true" : "false",
+			       cmpf->rate ? "true" : "false",
+			       cmpf->fmtp,
+			       (cmp == 0) ? "=="
+				       : ((cmp < 0) ? "<" : ">"),
+			       (reverse_cmp == 0) ? "=="
+				       : ((reverse_cmp < 0) ? "<" : ">"));
+
+			if (reverse_cmp != -cmp)
+				printf("    *** ERROR: osmo_sdp_codec_list_cmp(reverse args) == %d, expected %d\n",
+				       reverse_cmp, -cmp);
+		}
+
+		talloc_free(list_a);
+		talloc_free(list_b);
+
+		if (talloc_total_blocks(ctx) != 1) {
+			printf("ERROR: memleak:\n");
+			report(ctx);
+		}
+		printf("\n");
+
+		talloc_free_children(print_ctx);
+	}
+
+	talloc_free(print_ctx);
+	talloc_free(ctx);
+}
+
+void test_codec_list_intersection(void)
+{
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+	int i;
+
+	const struct osmo_sdp_codec codec_a[] = {
+		{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+		{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+		{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		{}
+	};
+
+	const struct osmo_sdp_codec codec_b[][5] = {
+		/* same */
+		{
+			{ .payload_type = 96, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+			{ .payload_type = 97, .encoding_name = "GSM", .rate = 8000 },
+			{ .payload_type = 98, .encoding_name = "GSM-HR-08", .rate = 8000 },
+		},
+
+		/* same in different order */
+		{
+			{ .payload_type = 98, .encoding_name = "GSM-HR-08", .rate = 8000 },
+			{ .payload_type = 96, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+			{ .payload_type = 97, .encoding_name = "GSM", .rate = 8000 },
+		},
+
+		/* two matches */
+		{
+			{ .payload_type = 98, .encoding_name = "GSM-HR-08", .rate = 8000 },
+			{ .payload_type = 110, .encoding_name = "GSM-EFR", .rate = 8000 },
+			{ .payload_type = 97, .encoding_name = "GSM", .rate = 8000 },
+		},
+
+		/* no match */
+		{
+			{ .payload_type = 97, .encoding_name = "AMR-WB", .rate = 16000 },
+			{ .payload_type = 98, .encoding_name = "FOO", .rate = 8000 },
+			{ .payload_type = 110, .encoding_name = "GSM-EFR", .rate = 8000 },
+		},
+
+	};
+
+	printf("\n\n--- %s()\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(codec_b); i++) {
+		struct osmo_sdp_codec_list *list_a = init_codec_list(ctx, codec_a);
+		struct osmo_sdp_codec_list *list_b = init_codec_list(ctx, codec_b[i]);
+
+		printf("A = %s\n", osmo_sdp_codec_list_to_str_c(print_ctx, list_a, false));
+		printf("B = %s\n", osmo_sdp_codec_list_to_str_c(print_ctx, list_b, false));
+
+		osmo_sdp_codec_list_intersection(list_a, list_b, &osmo_sdp_codec_cmp_equivalent, false);
+		printf("osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=false)\n = %s\n",
+		       osmo_sdp_codec_list_to_str_c(print_ctx, list_a, false));
+
+		talloc_free(list_a);
+		list_a = init_codec_list(ctx, codec_a);
+
+		osmo_sdp_codec_list_intersection(list_a, list_b, &osmo_sdp_codec_cmp_equivalent, true);
+		printf("osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=true)\n = %s\n",
+		       osmo_sdp_codec_list_to_str_c(print_ctx, list_a, false));
+
+		talloc_free(list_a);
+		list_a = init_codec_list(ctx, codec_a);
+
+		osmo_sdp_codec_list_intersection(list_b, list_a, &osmo_sdp_codec_cmp_equivalent, false);
+		printf("osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=false)\n = %s\n",
+		       osmo_sdp_codec_list_to_str_c(print_ctx, list_b, false));
+
+		talloc_free(list_a);
+		list_a = init_codec_list(ctx, codec_a);
+
+		osmo_sdp_codec_list_intersection(list_b, list_a, &osmo_sdp_codec_cmp_equivalent, true);
+		printf("osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=true)\n = %s\n",
+		       osmo_sdp_codec_list_to_str_c(print_ctx, list_b, false));
+
+		talloc_free(list_a);
+		talloc_free(list_b);
+
+		if (talloc_total_blocks(ctx) != 1) {
+			printf("ERROR: memleak:\n");
+			report(ctx);
+		}
+		printf("\n");
+
+		talloc_free_children(print_ctx);
+	}
+
+	talloc_free(print_ctx);
+	talloc_free(ctx);
+}
+
+
+struct my_obj {
+	struct osmo_sdp_codec *codec;
+	struct osmo_sdp_codec_list *codec_list;
+};
+
+struct my_obj *my_obj_alloc(void *ctx)
+{
+	struct my_obj *o = talloc_zero(ctx, struct my_obj);
+	o->codec_list = osmo_sdp_codec_list_alloc(o);
+	return o;
+}
+
+void test_obj_members(void)
+{
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+	int i;
+	struct osmo_sdp_codec *codec;
+
+	struct my_obj *o;
+
+	printf("\n\n--- %s()\n", __func__);
+	o = my_obj_alloc(ctx);
+
+	o->codec = osmo_sdp_codec_alloc(o);
+	osmo_sdp_codec_set(o->codec, 96, "AMR", 8000, "octet-align=1");
+
+	printf("o->codec = %s\n", osmo_sdp_codec_to_str_c(print_ctx, o->codec));
+	report(ctx);
+
+	osmo_sdp_codec_list_add(o->codec_list, o->codec, false, false);
+	osmo_sdp_codec_list_add(o->codec_list, o->codec, false, true);
+	i = 0;
+	osmo_sdp_codec_list_foreach(codec, o->codec_list) {
+		printf("o->codec_list[%d] = %s\n", i++, osmo_sdp_codec_to_str_c(print_ctx, codec));
+	}
+
+	report(ctx);
+	printf("talloc_free(o)\n");
+	talloc_free(o);
+	report(ctx);
+	talloc_free(ctx);
+	talloc_free(print_ctx);
+}
+
+typedef void (*test_func_t)(void);
+test_func_t test_func[] = {
+	test_codec,
+	test_codec_list,
+	test_codec_list_cmp,
+	test_codec_list_intersection,
+	test_obj_members,
+};
+
+int main(void)
+{
+	int i;
+	test_ctx = talloc_named_const(NULL, 0, "sdp_codec_test");
+
+	for (i = 0; i < ARRAY_SIZE(test_func); i++) {
+
+		test_func[i]();
+
+		if (talloc_total_blocks(test_ctx) != 1) {
+			talloc_report_full(test_ctx, stderr);
+			printf("ERROR after test %d: memory leak\n", i);
+			return -1;
+		}
+	}
+
+	talloc_free(test_ctx);
+	return 0;
+}
--- a/tests/sdp/sdp_codec_test.err
+++ b/tests/sdp/sdp_codec_test.err
--- a/tests/sdp/sdp_codec_test.ok
+++ b/tests/sdp/sdp_codec_test.ok
@@ -0,0 +1,538 @@
+
+
+--- test_codec()
+- osmo_sdp_codec_set():
+osmo_sdp_codec_set [0] 'encoding-name#23'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [1] 'AMR:octet-align=1;mode-set=0,2,4#112'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [2] 'AMR:mode-set=0,2,4;octet-align=1#96'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [3] 'AMR:mode-set=0,2,4#114'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [4] 'AMR:mode-set=0,2,4;octet-align=0#97'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [5] 'AMR:octet-align=1#98'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [6] 'AMR-WB/16000#96'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [7] 'GSM#3'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = true
+osmo_sdp_codec_set [8] '/0#0'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = false
+osmo_sdp_codec_set [9] ':octet-align=1#112'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = false
+osmo_sdp_codec_set [10] ':octet-align=1#112'
+  osmo_sdp_codec_cmp() ok
+  osmo_sdp_codec_is_set() = false
+
+- osmo_sdp_codec_cmp(equivalent):
+  encoding-name#23 == encoding-name#23 == encoding-name#23
+  encoding-name#23 > AMR:octet-align=1;mode-set=0,2,4#112 < encoding-name#23
+  encoding-name#23 > AMR:mode-set=0,2,4;octet-align=1#96 < encoding-name#23
+  encoding-name#23 > AMR:mode-set=0,2,4#114 < encoding-name#23
+  encoding-name#23 > AMR:mode-set=0,2,4;octet-align=0#97 < encoding-name#23
+  encoding-name#23 > AMR:octet-align=1#98 < encoding-name#23
+  encoding-name#23 > AMR-WB/16000#96 < encoding-name#23
+  encoding-name#23 > GSM#3 < encoding-name#23
+  encoding-name#23 > /0#0 < encoding-name#23
+  encoding-name#23 > :octet-align=1#112 < encoding-name#23
+  encoding-name#23 > :octet-align=1#112 < encoding-name#23
+  AMR:octet-align=1;mode-set=0,2,4#112 < encoding-name#23 > AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 == AMR:octet-align=1;mode-set=0,2,4#112 == AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 == AMR:mode-set=0,2,4;octet-align=1#96 == AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 > AMR:mode-set=0,2,4#114 < AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 > AMR:mode-set=0,2,4;octet-align=0#97 < AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 == AMR:octet-align=1#98 == AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 < AMR-WB/16000#96 > AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 < GSM#3 > AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 > /0#0 < AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 > :octet-align=1#112 < AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:octet-align=1;mode-set=0,2,4#112 > :octet-align=1#112 < AMR:octet-align=1;mode-set=0,2,4#112
+  AMR:mode-set=0,2,4;octet-align=1#96 < encoding-name#23 > AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 == AMR:octet-align=1;mode-set=0,2,4#112 == AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 == AMR:mode-set=0,2,4;octet-align=1#96 == AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 > AMR:mode-set=0,2,4#114 < AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 > AMR:mode-set=0,2,4;octet-align=0#97 < AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 == AMR:octet-align=1#98 == AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 < AMR-WB/16000#96 > AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 < GSM#3 > AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 > /0#0 < AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 > :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4;octet-align=1#96 > :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=1#96
+  AMR:mode-set=0,2,4#114 < encoding-name#23 > AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 < AMR:octet-align=1;mode-set=0,2,4#112 > AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 < AMR:mode-set=0,2,4;octet-align=1#96 > AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 == AMR:mode-set=0,2,4#114 == AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 == AMR:mode-set=0,2,4;octet-align=0#97 == AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 < AMR:octet-align=1#98 > AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 < AMR-WB/16000#96 > AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 < GSM#3 > AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 > /0#0 < AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 > :octet-align=1#112 < AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4#114 > :octet-align=1#112 < AMR:mode-set=0,2,4#114
+  AMR:mode-set=0,2,4;octet-align=0#97 < encoding-name#23 > AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 < AMR:octet-align=1;mode-set=0,2,4#112 > AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 < AMR:mode-set=0,2,4;octet-align=1#96 > AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 == AMR:mode-set=0,2,4#114 == AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 == AMR:mode-set=0,2,4;octet-align=0#97 == AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 < AMR:octet-align=1#98 > AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 < AMR-WB/16000#96 > AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 < GSM#3 > AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 > /0#0 < AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 > :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:mode-set=0,2,4;octet-align=0#97 > :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=0#97
+  AMR:octet-align=1#98 < encoding-name#23 > AMR:octet-align=1#98
+  AMR:octet-align=1#98 == AMR:octet-align=1;mode-set=0,2,4#112 == AMR:octet-align=1#98
+  AMR:octet-align=1#98 == AMR:mode-set=0,2,4;octet-align=1#96 == AMR:octet-align=1#98
+  AMR:octet-align=1#98 > AMR:mode-set=0,2,4#114 < AMR:octet-align=1#98
+  AMR:octet-align=1#98 > AMR:mode-set=0,2,4;octet-align=0#97 < AMR:octet-align=1#98
+  AMR:octet-align=1#98 == AMR:octet-align=1#98 == AMR:octet-align=1#98
+  AMR:octet-align=1#98 < AMR-WB/16000#96 > AMR:octet-align=1#98
+  AMR:octet-align=1#98 < GSM#3 > AMR:octet-align=1#98
+  AMR:octet-align=1#98 > /0#0 < AMR:octet-align=1#98
+  AMR:octet-align=1#98 > :octet-align=1#112 < AMR:octet-align=1#98
+  AMR:octet-align=1#98 > :octet-align=1#112 < AMR:octet-align=1#98
+  AMR-WB/16000#96 < encoding-name#23 > AMR-WB/16000#96
+  AMR-WB/16000#96 > AMR:octet-align=1;mode-set=0,2,4#112 < AMR-WB/16000#96
+  AMR-WB/16000#96 > AMR:mode-set=0,2,4;octet-align=1#96 < AMR-WB/16000#96
+  AMR-WB/16000#96 > AMR:mode-set=0,2,4#114 < AMR-WB/16000#96
+  AMR-WB/16000#96 > AMR:mode-set=0,2,4;octet-align=0#97 < AMR-WB/16000#96
+  AMR-WB/16000#96 > AMR:octet-align=1#98 < AMR-WB/16000#96
+  AMR-WB/16000#96 == AMR-WB/16000#96 == AMR-WB/16000#96
+  AMR-WB/16000#96 < GSM#3 > AMR-WB/16000#96
+  AMR-WB/16000#96 > /0#0 < AMR-WB/16000#96
+  AMR-WB/16000#96 > :octet-align=1#112 < AMR-WB/16000#96
+  AMR-WB/16000#96 > :octet-align=1#112 < AMR-WB/16000#96
+  GSM#3 < encoding-name#23 > GSM#3
+  GSM#3 > AMR:octet-align=1;mode-set=0,2,4#112 < GSM#3
+  GSM#3 > AMR:mode-set=0,2,4;octet-align=1#96 < GSM#3
+  GSM#3 > AMR:mode-set=0,2,4#114 < GSM#3
+  GSM#3 > AMR:mode-set=0,2,4;octet-align=0#97 < GSM#3
+  GSM#3 > AMR:octet-align=1#98 < GSM#3
+  GSM#3 > AMR-WB/16000#96 < GSM#3
+  GSM#3 == GSM#3 == GSM#3
+  GSM#3 > /0#0 < GSM#3
+  GSM#3 > :octet-align=1#112 < GSM#3
+  GSM#3 > :octet-align=1#112 < GSM#3
+  /0#0 < encoding-name#23 > /0#0
+  /0#0 < AMR:octet-align=1;mode-set=0,2,4#112 > /0#0
+  /0#0 < AMR:mode-set=0,2,4;octet-align=1#96 > /0#0
+  /0#0 < AMR:mode-set=0,2,4#114 > /0#0
+  /0#0 < AMR:mode-set=0,2,4;octet-align=0#97 > /0#0
+  /0#0 < AMR:octet-align=1#98 > /0#0
+  /0#0 < AMR-WB/16000#96 > /0#0
+  /0#0 < GSM#3 > /0#0
+  /0#0 == /0#0 == /0#0
+  /0#0 < :octet-align=1#112 > /0#0
+  /0#0 < :octet-align=1#112 > /0#0
+  :octet-align=1#112 < encoding-name#23 > :octet-align=1#112
+  :octet-align=1#112 < AMR:octet-align=1;mode-set=0,2,4#112 > :octet-align=1#112
+  :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=1#96 > :octet-align=1#112
+  :octet-align=1#112 < AMR:mode-set=0,2,4#114 > :octet-align=1#112
+  :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=0#97 > :octet-align=1#112
+  :octet-align=1#112 < AMR:octet-align=1#98 > :octet-align=1#112
+  :octet-align=1#112 < AMR-WB/16000#96 > :octet-align=1#112
+  :octet-align=1#112 < GSM#3 > :octet-align=1#112
+  :octet-align=1#112 > /0#0 < :octet-align=1#112
+  :octet-align=1#112 == :octet-align=1#112 == :octet-align=1#112
+  :octet-align=1#112 == :octet-align=1#112 == :octet-align=1#112
+  :octet-align=1#112 < encoding-name#23 > :octet-align=1#112
+  :octet-align=1#112 < AMR:octet-align=1;mode-set=0,2,4#112 > :octet-align=1#112
+  :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=1#96 > :octet-align=1#112
+  :octet-align=1#112 < AMR:mode-set=0,2,4#114 > :octet-align=1#112
+  :octet-align=1#112 < AMR:mode-set=0,2,4;octet-align=0#97 > :octet-align=1#112
+  :octet-align=1#112 < AMR:octet-align=1#98 > :octet-align=1#112
+  :octet-align=1#112 < AMR-WB/16000#96 > :octet-align=1#112
+  :octet-align=1#112 < GSM#3 > :octet-align=1#112
+  :octet-align=1#112 > /0#0 < :octet-align=1#112
+  :octet-align=1#112 == :octet-align=1#112 == :octet-align=1#112
+  :octet-align=1#112 == :octet-align=1#112 == :octet-align=1#112
+
+- osmo_sdp_codec_from_str():
+  osmo_sdp_codec_from_str('encoding-name#23') rc=0 res=encoding-name#23
+  osmo_sdp_codec_from_str('AMR:octet-align=1;mode-set=0,2,4#112') rc=0 res=AMR:octet-align=1;mode-set=0,2,4#112
+  osmo_sdp_codec_from_str('AMR:mode-set=0,2,4;octet-align=1#96') rc=0 res=AMR:mode-set=0,2,4;octet-align=1#96
+  osmo_sdp_codec_from_str('AMR:mode-set=0,2,4#114') rc=0 res=AMR:mode-set=0,2,4#114
+  osmo_sdp_codec_from_str('AMR:mode-set=0,2,4;octet-align=0#97') rc=0 res=AMR:mode-set=0,2,4;octet-align=0#97
+  osmo_sdp_codec_from_str('AMR:octet-align=1#98') rc=0 res=AMR:octet-align=1#98
+  osmo_sdp_codec_from_str('AMR-WB/16000#96') rc=0 res=AMR-WB/16000#96
+  osmo_sdp_codec_from_str('GSM#3') rc=0 res=GSM#3
+  osmo_sdp_codec_from_str('/0#0') rc=0 res=/0#0
+  osmo_sdp_codec_from_str(':octet-align=1#112') rc=0 res=:octet-align=1#112
+  osmo_sdp_codec_from_str(':octet-align=1#112') rc=0 res=:octet-align=1#112
+
+
+--- test_codec_list()
+osmo_sdp_codec_list_first() = NULL
+list_ctx
+ |  2 test_codec_list
+ |   1 struct osmo_sdp_codec_list
+[0] osmo_sdp_codec_list_add(AMR:octet-align=1;mode-set=0,2,4#112)
+[1] osmo_sdp_codec_list_add(GSM#3)
+[2] osmo_sdp_codec_list_add(GSM-HR-08#111)
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = GSM#3
+codec_list[2] = GSM-HR-08#111
+osmo_sdp_codec_list_first() = AMR:octet-align=1;mode-set=0,2,4#112
+list_ctx
+ |  9 test_codec_list
+ |   8 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ 'AMR#112 GSM#3 GSM-HR-08#111'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111'
+
+- add same entries again with once=exact, nothing should change
+[] osmo_sdp_codec_list_add(AMR:octet-align=1;mode-set=0,2,4#112)
+[] osmo_sdp_codec_list_add(GSM#3)
+[] osmo_sdp_codec_list_add(GSM-HR-08#111)
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = GSM#3
+codec_list[2] = GSM-HR-08#111
+list_ctx
+ |  9 test_codec_list
+ |   8 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ 'AMR#112 GSM#3 GSM-HR-08#111'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111'
+
+- add same entries again with once=NULL, duplicates are added
+[] osmo_sdp_codec_list_add(AMR:octet-align=1;mode-set=0,2,4#112)
+[] osmo_sdp_codec_list_add(GSM#3)
+[] osmo_sdp_codec_list_add(GSM-HR-08#111)
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = GSM#3
+codec_list[2] = GSM-HR-08#111
+codec_list[3] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[4] = GSM#3
+codec_list[5] = GSM-HR-08#111
+list_ctx
+ | 16 test_codec_list
+ |  15 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ '2*AMR#112 2*GSM#3 2*GSM-HR-08#111'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111'
+
+- add same entries again with once=NULL,pick_unused_pt_nr=true, duplicates are added with new #nr
+[] osmo_sdp_codec_list_add(AMR:octet-align=1;mode-set=0,2,4#96)
+[] osmo_sdp_codec_list_add(GSM#97)
+[] osmo_sdp_codec_list_add(GSM-HR-08#98)
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = GSM#3
+codec_list[2] = GSM-HR-08#111
+codec_list[3] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[4] = GSM#3
+codec_list[5] = GSM-HR-08#111
+codec_list[6] = AMR:octet-align=1;mode-set=0,2,4#96
+codec_list[7] = GSM#97
+codec_list[8] = GSM-HR-08#98
+list_ctx
+ | 23 test_codec_list
+ |  22 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ '3*AMR 3*GSM 3*GSM-HR-08'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#96 GSM#97 GSM-HR-08#98'
+
+- remove all 'GSM#3' entries, with osmo_sdp_codec_cmp_exact
+  osmo_sdp_codec_list_remove() = 2
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = GSM-HR-08#111
+codec_list[2] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[3] = GSM-HR-08#111
+codec_list[4] = AMR:octet-align=1;mode-set=0,2,4#96
+codec_list[5] = GSM#97
+codec_list[6] = GSM-HR-08#98
+list_ctx
+ | 19 test_codec_list
+ |  18 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    2 struct osmo_sdp_codec
+ |     1 GSM
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ '3*AMR 3*GSM-HR-08 GSM#97'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#112 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#96 GSM#97 GSM-HR-08#98'
+- remove all 'GSM' entries, with osmo_sdp_codec_cmp_equivalent
+  osmo_sdp_codec_list_remove() = 1
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = GSM-HR-08#111
+codec_list[2] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[3] = GSM-HR-08#111
+codec_list[4] = AMR:octet-align=1;mode-set=0,2,4#96
+codec_list[5] = GSM-HR-08#98
+list_ctx
+ | 17 test_codec_list
+ |  16 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ '3*AMR 3*GSM-HR-08'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#112 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#96 GSM-HR-08#98'
+- osmo_sdp_codec_list_move_to_first('AMR:octet-align=1;mode-set=0,2,4#112', equivalent) = 3
+codec_list[0] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[1] = AMR:octet-align=1;mode-set=0,2,4#112
+codec_list[2] = AMR:octet-align=1;mode-set=0,2,4#96
+codec_list[3] = GSM-HR-08#111
+codec_list[4] = GSM-HR-08#111
+codec_list[5] = GSM-HR-08#98
+list_ctx
+ | 17 test_codec_list
+ |  16 struct osmo_sdp_codec_list
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+ |    2 struct osmo_sdp_codec
+ |     1 GSM-HR-08
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1;mode-set=0,2,4
+ |     1 AMR
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ '3*AMR 3*GSM-HR-08'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ 'AMR:octet-align=1;mode-set=0,2,4#112 AMR:octet-align=1;mode-set=0,2,4#112 AMR:octet-align=1;mode-set=0,2,4#96 GSM-HR-08#111 GSM-HR-08#111 GSM-HR-08#98'
+- osmo_sdp_codec_list_free_items()
+  0 entries
+list_ctx
+ |  2 test_codec_list
+ |   1 struct osmo_sdp_codec_list
+osmo_sdp_codec_list_to_str_c(summarize=true):
+ '(no-codecs)'
+osmo_sdp_codec_list_to_str_c(summarize=false):
+ '(no-codecs)'
+
+
+--- test_codec_list_cmp()
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A == B == A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A == B == A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1;mode-set=0,2,4#96 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A == B == A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A > B < A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:mode-set=0,2,4;octet-align=1#112 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A == B == A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A > B < A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1;mode-set=7#112 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A < B > A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A < B > A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1#112 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A == B == A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A > B < A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=0;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A > B < A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A > B < A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+  cmpf[0]: payload_type=false rate=false fmtp=0: A == B == A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A > B < A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A > B < A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = GSM#3 GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#112
+  cmpf[0]: payload_type=false rate=false fmtp=0: A < B > A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A < B > A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A < B > A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3
+  cmpf[0]: payload_type=false rate=false fmtp=0: A > B < A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A > B < A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A > B < A
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111 GSM-EFR#110
+  cmpf[0]: payload_type=false rate=false fmtp=0: A < B > A
+  cmpf[1]: payload_type=false rate=true fmtp=1: A < B > A
+  cmpf[2]: payload_type=true rate=true fmtp=2: A < B > A
+
+
+
+--- test_codec_list_intersection()
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR:octet-align=1;mode-set=0,2,4#96 GSM#97 GSM-HR-08#98
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=false)
+ = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=true)
+ = AMR:octet-align=1;mode-set=0,2,4#96 GSM#97 GSM-HR-08#98
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=false)
+ = AMR:octet-align=1;mode-set=0,2,4#96 GSM#97 GSM-HR-08#98
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=true)
+ = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = GSM-HR-08#98 AMR:octet-align=1;mode-set=0,2,4#96 GSM#97
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=false)
+ = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=true)
+ = AMR:octet-align=1;mode-set=0,2,4#96 GSM#97 GSM-HR-08#98
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=false)
+ = GSM-HR-08#98 AMR:octet-align=1;mode-set=0,2,4#96 GSM#97
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=true)
+ = GSM-HR-08#111 AMR:octet-align=1;mode-set=0,2,4#112 GSM#3
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = GSM-HR-08#98 GSM-EFR#110 GSM#97
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=false)
+ = GSM#3 GSM-HR-08#111
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=true)
+ = GSM#97 GSM-HR-08#98
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=false)
+ = GSM-HR-08#98 GSM#97
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=true)
+ = GSM-HR-08#111 GSM#3
+
+A = AMR:octet-align=1;mode-set=0,2,4#112 GSM#3 GSM-HR-08#111
+B = AMR-WB/16000#97 FOO#98 GSM-EFR#110
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=false)
+ = (no-codecs)
+osmo_sdp_codec_list_intersection(A, B, equivalent, translate_pt=true)
+ = (no-codecs)
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=false)
+ = (no-codecs)
+osmo_sdp_codec_list_intersection(B, A, equivalent, translate_pt=true)
+ = (no-codecs)
+
+
+
+--- test_obj_members()
+o->codec = AMR:octet-align=1#96
+ctx
+ |  6 test_obj_members
+ |   5 struct my_obj
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1
+ |     1 AMR
+ |    1 struct osmo_sdp_codec_list
+o->codec_list[0] = AMR:octet-align=1#96
+o->codec_list[1] = AMR:octet-align=1#97
+ctx
+ | 12 test_obj_members
+ |  11 struct my_obj
+ |    3 struct osmo_sdp_codec
+ |     1 octet-align=1
+ |     1 AMR
+ |    7 struct osmo_sdp_codec_list
+ |     3 struct osmo_sdp_codec
+ |      1 octet-align=1
+ |      1 AMR
+ |     3 struct osmo_sdp_codec
+ |      1 octet-align=1
+ |      1 AMR
+talloc_free(o)
+ctx
+ |  1 test_obj_members
--- a/tests/sdp/sdp_fmtp_test.c
+++ b/tests/sdp/sdp_fmtp_test.c
@@ -0,0 +1,126 @@
+#include <inttypes.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/application.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/sdp/fmtp.h>
+
+struct get_val_test {
+	const char *fmtp_string;
+	const char *val_name;
+	bool expect_rc;
+	const char *expect_val;
+};
+
+const struct get_val_test get_val_tests[] = {
+	{
+		"foo=123;bar=success;baz=456", "foo",
+		true, "123"
+	},
+	{
+		"foo=123;bar=success;baz=456", "bar",
+		true, "success"
+	},
+	{
+		"foo=123;bar=success;baz=456", "baz",
+		true, "456"
+	},
+};
+
+void test_get_val(void)
+{
+	int i;
+	printf("\n--- %s()\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(get_val_tests); i++) {
+		const struct get_val_test *t = &get_val_tests[i];
+		char val[128] = {};
+		bool rc = osmo_sdp_fmtp_get_val(val, sizeof(val), t->fmtp_string, t->val_name);
+		bool ok;
+		printf("osmo_sdp_fmtp_get_val('%s', '%s') rc=%s",
+		       t->fmtp_string, t->val_name,
+		       rc ? "true" : "false");
+		if (rc)
+			printf(" val='%s'", val);
+		ok = true;
+		if (rc != t->expect_rc) {
+			printf(" ERROR: expected rc=%s", t->expect_rc ? "true" : "false");
+			ok = false;
+		}
+		if (t->expect_val && strcmp(val, t->expect_val)) {
+			printf(" ERROR: expected val='%s'", t->expect_val);
+			ok = false;
+		}
+		if (ok)
+			printf(" ok");
+		printf("\n");
+	}
+	printf("\n--- %s() DONE\n", __func__);
+}
+
+struct get_int_test {
+	const char *fmtp_string;
+	const char *val_name;
+	int64_t defval;
+	int64_t expect_rc;
+};
+
+const struct get_int_test get_int_tests[] = {
+	{
+		"foo=123;bar=success;baz=456", "foo", -1,
+		123
+	},
+	{
+		"foo=123;bar=success;baz=456", "bar", -1,
+		-1
+	},
+	{
+		"foo=123;bar=success;baz=456", "baz", -1,
+		456
+	},
+};
+
+void test_get_int(void)
+{
+	int i;
+	printf("\n--- %s()\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(get_int_tests); i++) {
+		const struct get_int_test *t = &get_int_tests[i];
+		int64_t rc = osmo_sdp_fmtp_get_int(t->fmtp_string, t->val_name, t->defval);
+		printf("osmo_sdp_fmtp_get_int('%s', '%s') rc=%"PRId64,
+		       t->fmtp_string, t->val_name, rc);
+		if (rc != t->expect_rc) {
+			printf(" ERROR: expected rc=%"PRId64, t->expect_rc);
+		}
+		else {
+			printf(" ok");
+		}
+		printf("\n");
+	}
+	printf("\n--- %s() DONE\n", __func__);
+}
+
+static const struct log_info_cat log_categories[] = {
+};
+
+const struct log_info log_info = {
+        .cat = log_categories,
+        .num_cat = ARRAY_SIZE(log_categories),
+};
+
+int main(void)
+{
+	void *ctx = talloc_named_const(NULL, 1, "sdp_fmtp_test");
+
+	osmo_init_logging2(ctx, &log_info);
+	log_set_print_filename2(osmo_stderr_target, LOG_FILENAME_NONE);
+	log_set_print_timestamp(osmo_stderr_target, 0);
+	log_set_use_color(osmo_stderr_target, 0);
+	log_set_print_category_hex(osmo_stderr_target, 0);
+	log_set_print_category(osmo_stderr_target, 1);
+
+	test_get_val();
+	test_get_int();
+	return 0;
+}
--- a/tests/sdp/sdp_fmtp_test.err
+++ b/tests/sdp/sdp_fmtp_test.err
--- a/tests/sdp/sdp_fmtp_test.ok
+++ b/tests/sdp/sdp_fmtp_test.ok
@@ -0,0 +1,14 @@
+
+--- test_get_val()
+osmo_sdp_fmtp_get_val('foo=123;bar=success;baz=456', 'foo') rc=true val='123' ok
+osmo_sdp_fmtp_get_val('foo=123;bar=success;baz=456', 'bar') rc=true val='success' ok
+osmo_sdp_fmtp_get_val('foo=123;bar=success;baz=456', 'baz') rc=true val='456' ok
+
+--- test_get_val() DONE
+
+--- test_get_int()
+osmo_sdp_fmtp_get_int('foo=123;bar=success;baz=456', 'foo') rc=123 ok
+osmo_sdp_fmtp_get_int('foo=123;bar=success;baz=456', 'bar') rc=-1 ok
+osmo_sdp_fmtp_get_int('foo=123;bar=success;baz=456', 'baz') rc=456 ok
+
+--- test_get_int() DONE
--- a/tests/sdp/sdp_msg_test.c
+++ b/tests/sdp/sdp_msg_test.c
@@ -0,0 +1,764 @@
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <osmocom/sdp/sdp_msg.h>
+
+void *test_ctx = NULL;
+
+static void report_callback(const void *ptr, int depth, int max_depth, int is_ref, void *priv)
+{
+        const char *name = talloc_get_name(ptr);
+	printf(" |%*s%3zu %s\n", depth, "", talloc_total_blocks(ptr), name);
+}
+
+/* Print a talloc report that is reproducible for test output verification. It contains no pointer addresses. */
+#define report(CTX) _report(CTX, #CTX)
+static void _report(void *ctx, const char *label)
+{
+	fflush(stdout);
+	fflush(stderr);
+	printf("%s\n", label);
+        talloc_report_depth_cb(ctx, 0, 100, report_callback, NULL);
+	fflush(stdout);
+}
+
+static void dump_sdp(const char *str, const char *prefix)
+{
+	while (str && *str) {
+		const char *line_end = str;
+		while (*line_end && *line_end != '\r' && *line_end != '\n')
+			line_end++;
+		while (*line_end == '\r' || *line_end == '\n')
+			line_end++;
+		printf("%s%s\n", prefix, osmo_escape_str(str, line_end - str));
+		str = line_end;
+	}
+}
+
+struct sdp_msg_test_data {
+	const char *sdp_input;
+	const char *expect_sdp_str;
+};
+
+static const struct sdp_msg_test_data sdp_msg_tests[] = {
+	{
+		"v=0\r\n"
+		"o=- 5628250 5628250 IN IP4 192.168.11.121\r\n"
+		"s=-\r\n"
+		"c=IN IP4 192.168.11.121\r\n"
+		"t=0 0\r\n"
+		"m=audio 10020 RTP/AVP 18 0 2 4 8 96 97 98 100 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:2 G726-32/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:96 G726-40/8000\r\n"
+		"a=rtpmap:97 G726-24/8000\r\n"
+		"a=rtpmap:98 G726-16/8000\r\n"
+		"a=rtpmap:100 NSE/8000\r\n"
+		"a=fmtp:100 192-193\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		"a=ptime:20\r\n"
+		"a=sendrecv\r\n"
+		,
+	},
+	{
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.151\r\n"
+		"t=0 0\r\n"
+		"m=audio 16398 RTP/AVP 98\r\n"
+		"a=rtpmap:98 AMR/8000\r\n"
+		"a=fmtp:98 octet-align=1; mode-set=4\r\n"
+		"a=ptime:20\r\n"
+		"a=rtcp:16399 IN IP4 192.168.11.151\r\n"
+		,
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.151\r\n"
+		"t=0 0\r\n"
+		"m=audio 16398 RTP/AVP 98\r\n"
+		"a=rtpmap:98 AMR/8000\r\n"
+		"a=fmtp:98 octet-align=1; mode-set=4\r\n"
+		"a=ptime:20\r\n"
+		/* The rtcp line is dropped, not supported yet */
+	},
+	{
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.140\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 18 0 4 8 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		"a=sendrecv\r\n"
+		"a=rtcp:30437\r\n"
+		"a=ptime:20\r\n"
+		,
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.140\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 18 0 4 8 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		/* a=sendrecv ends up further below */
+		/* The rtcp line is dropped, not supported yet */
+		"a=ptime:20\r\n"
+		"a=sendrecv\r\n"
+		,
+	},
+	{
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.140\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 18 0 4 8 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		"a=recvonly\r\n"
+		"a=rtcp:30437\r\n"
+		"a=ptime:20\r\n"
+		,
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.140\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 18 0 4 8 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		/* a=recvonly ends up further below */
+		/* The rtcp line is dropped, not supported yet */
+		"a=ptime:20\r\n"
+		"a=recvonly\r\n"
+		,
+	},
+	{
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.140\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 18 0 4 8 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		"a=ptime:20\r\n"
+		"a=sendonly\r\n"
+		,
+	},
+	{
+		"v=0\r\n"
+		"o=FooBar 1565090289 1565090290 IN IP4 192.168.11.151\r\n"
+		"s=FooBar\r\n"
+		"c=IN IP4 192.168.11.140\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 18 0 4 8 101\r\n"
+		"a=rtpmap:18 G729/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:4 G723/8000\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:101 telephone-event/8000\r\n"
+		"a=fmtp:101 0-15\r\n"
+		"a=ptime:20\r\n"
+		"a=inactive\r\n"
+		,
+	},
+};
+
+static void test_parse_and_compose(void)
+{
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+	int i;
+	bool ok = true;
+
+	printf("\n\n%s\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(sdp_msg_tests); i++) {
+		const struct sdp_msg_test_data *t = &sdp_msg_tests[i];
+		struct osmo_sdp_msg *sdp_msg;
+		char str[1024];
+		const char *expect;
+		struct osmo_sdp_err err;
+
+		printf("\n[%d]\n", i);
+		dump_sdp(t->sdp_input, "sdp input: ");
+
+		sdp_msg = osmo_sdp_msg_decode(ctx, t->sdp_input, &err);
+
+		if (err.rc) {
+			printf("ERROR: %s at %s\n", strerror(abs(err.rc)),
+			       osmo_quote_cstr_c(print_ctx, err.at_input_str, err.at_input_str_len));
+			ok = false;
+		}
+		printf("parsed SDP message %s\n", osmo_sdp_msg_to_str_c(print_ctx, sdp_msg, false));
+
+		osmo_sdp_msg_encode_buf(str, sizeof(str), sdp_msg);
+		dump_sdp(str, "osmo_sdp_msg_encode_buf: ");
+		expect = t->expect_sdp_str ? : t->sdp_input;
+		if (strcmp(str, expect)) {
+			int j;
+			ok = false;
+			printf("ERROR:\n");
+			dump_sdp(expect, "expect: ");
+			for (j = 0; expect[j]; j++) {
+				if (expect[j] != str[j]) {
+					printf("ERROR at position %d, at:\n", j);
+					dump_sdp(str + j, "     mismatch: ");
+					break;
+				}
+			}
+		} else
+			printf("[%d] ok\n", i);
+
+		report(ctx);
+		printf("talloc_free(sdp_msg)\n");
+		talloc_free(sdp_msg);
+		report(ctx);
+
+		if (talloc_total_blocks(ctx) != 1) {
+			printf("ERROR: memleak\n");
+			talloc_free_children(ctx);
+		}
+		printf("\n");
+	}
+
+	OSMO_ASSERT(ok);
+	talloc_free(ctx);
+	talloc_free(print_ctx);
+}
+
+struct intersect_test_data {
+	const char *descr;
+	const char *sdp_msg_a;
+	const char *sdp_msg_b;
+	const char *expect_intersection;
+};
+
+#define SDP_1 \
+		"v=0\r\n" \
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n" \
+		"s=GSM Call\r\n" \
+		"c=IN IP4 23.42.23.42\r\n" \
+		"t=0 0\r\n" \
+		"m=audio 30436 RTP/AVP 112 3 111 110\r\n" \
+		"a=rtpmap:112 AMR/8000\r\n" \
+		"a=fmtp:112 octet-align=1\r\n" \
+		"a=rtpmap:3 GSM/8000\r\n" \
+		"a=rtpmap:111 GSM-HR-08/8000\r\n" \
+		"a=rtpmap:110 GSM-EFR/8000\r\n" \
+		"a=ptime:20\r\n"
+
+#define SDP_2 \
+		"v=0\r\n" \
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n" \
+		"s=GSM Call\r\n" \
+		"c=IN IP4 23.42.23.42\r\n" \
+		"t=0 0\r\n" \
+		"m=audio 30436 RTP/AVP 112 110\r\n" \
+		"a=rtpmap:112 AMR/8000\r\n" \
+		"a=fmtp:112 octet-align=1\r\n" \
+		"a=rtpmap:110 GSM-EFR/8000\r\n" \
+		"a=ptime:20\r\n"
+
+#define SDP_3 \
+		"v=0\r\n" \
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n" \
+		"s=GSM Call\r\n" \
+		"c=IN IP4 23.42.23.42\r\n" \
+		"t=0 0\r\n" \
+		"m=audio 30436 RTP/AVP 3 111 123\r\n" \
+		"a=rtpmap:3 GSM/8000\r\n" \
+		"a=rtpmap:111 GSM-HR-08/8000\r\n" \
+		"a=rtpmap:123 FOO/8000\r\n" \
+		"a=ptime:20\r\n"
+
+#define SDP_4 \
+		"v=0\r\n" \
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n" \
+		"s=GSM Call\r\n" \
+		"c=IN IP4 23.42.23.42\r\n" \
+		"t=0 0\r\n" \
+		"m=audio 30436 RTP/AVP 3 111\r\n" \
+		"a=rtpmap:3 GSM/8000\r\n" \
+		"a=rtpmap:111 GSM-HR-08/8000\r\n" \
+		"a=ptime:20\r\n"
+
+#define SDP_5 \
+		"v=0\r\n" \
+		"o=libosmo-sdp 0 0 IN IP4 0.0.0.0\r\n" \
+		"s=GSM Call\r\n" \
+		"c=IN IP4 0.0.0.0\r\n" \
+		"t=0 0\r\n" \
+		"m=audio 0 RTP/AVP 112 113 110 3 111\r\n" \
+		"a=rtpmap:112 AMR/8000\r\n" \
+		"a=fmtp:112 octet-align=1;mode-set=0,1,2,3\r\n" \
+		"a=rtpmap:113 AMR-WB/8000\r\n" \
+		"a=fmtp:113 octet-align=1\r\n" \
+		"a=rtpmap:110 GSM-EFR/8000\r\n" \
+		"a=rtpmap:3 GSM/8000\r\n" \
+		"a=rtpmap:111 GSM-HR-08/8000\r\n" \
+		"a=ptime:20\r\n"
+
+static const struct intersect_test_data intersect_tests[] = {
+	{
+		"identical codecs lead to no change"
+		,
+		SDP_1
+		,
+		"c=IN IP4 5.6.7.8\r\n" \
+		"m=audio 12345 RTP/AVP 112 3 111 110\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		,
+		SDP_1
+	},
+	{
+		"identical codecs in different order also lead to no change"
+		,
+		SDP_1
+		,
+		"c=IN IP4 5.6.7.8\r\n" \
+		"m=audio 12345 RTP/AVP 3 110 111 112\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		,
+		SDP_1
+	},
+	{
+		"identical codecs with mismatching payload type numbers also lead to no change"
+		,
+		SDP_1
+		,
+		"c=IN IP4 5.6.7.8\r\n" \
+		"m=audio 12345 RTP/AVP 96 97 98 99\r\n"
+		"a=rtpmap:96 GSM/8000\r\n"
+		"a=rtpmap:97 GSM-EFR/8000\r\n"
+		"a=rtpmap:98 GSM-HR-08/8000\r\n"
+		"a=rtpmap:99 AMR/8000\r\n"
+		"a=fmtp:99 octet-align=1\r\n"
+		,
+		SDP_1
+	},
+	{
+		"identical codecs plus some extra codecs also lead to no change"
+		,
+		SDP_1
+		,
+		"c=IN IP4 5.6.7.8\r\n" \
+		"m=audio 12345 RTP/AVP 8 0 96 97 98 99\r\n"
+		"a=rtpmap:8 PCMA/8000\r\n"
+		"a=rtpmap:0 PCMU/8000\r\n"
+		"a=rtpmap:96 GSM/8000\r\n"
+		"a=rtpmap:97 GSM-EFR/8000\r\n"
+		"a=rtpmap:98 GSM-HR-08/8000\r\n"
+		"a=rtpmap:99 AMR/8000\r\n"
+		"a=fmtp:99 octet-align=1\r\n"
+		,
+		SDP_1
+	},
+	{
+		"some codecs removed",
+		SDP_1,
+		SDP_2,
+		SDP_2,
+	},
+	{
+		"other codecs removed",
+		SDP_1,
+		SDP_3,
+		SDP_4,
+	},
+	{
+		"all codecs removed",
+		SDP_1
+		,
+		"s=empty"
+		,
+		"v=0\r\n" \
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n" \
+		"s=GSM Call\r\n" \
+		"c=IN IP4 23.42.23.42\r\n" \
+		"t=0 0\r\n" \
+		"m=audio 30436 RTP/AVP\r\n" \
+		"a=ptime:20\r\n"
+	},
+	{
+		"some real world test case",
+		SDP_5, SDP_5, SDP_5,
+	},
+};
+
+static const char *sdp_msg_logstr(const struct osmo_sdp_msg *sdp_msg)
+{
+	static char buf[1024];
+	osmo_sdp_msg_encode_buf(buf, sizeof(buf), sdp_msg);
+	return buf;
+}
+
+static void test_intersect(void)
+{
+	int i;
+	bool ok = true;
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+
+	printf("\n\n%s\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(intersect_tests); i++) {
+		const struct intersect_test_data *t = &intersect_tests[i];
+		struct osmo_sdp_msg *sdp_msg_a = NULL;
+		struct osmo_sdp_msg *sdp_msg_b = NULL;
+		char str[1024];
+		printf("\n[%d] %s\n", i, t->descr);
+		dump_sdp(t->sdp_msg_a, "SDP A: ");
+		dump_sdp(t->sdp_msg_b, " SDP B: ");
+
+		sdp_msg_a = osmo_sdp_msg_decode(ctx, t->sdp_msg_a, NULL);
+		if (!sdp_msg_a) {
+			printf("ERROR parsing SDP A\n");
+			break;
+		}
+		dump_sdp(sdp_msg_logstr(sdp_msg_a), "parsed SDP A: ");
+
+		sdp_msg_b = osmo_sdp_msg_decode(ctx, t->sdp_msg_b, NULL);
+		if (!sdp_msg_b) {
+			printf("ERROR parsing SDP B\n");
+			break;
+		}
+		dump_sdp(sdp_msg_logstr(sdp_msg_b), "parsed SDP B: ");
+
+		osmo_sdp_codec_list_intersection(sdp_msg_a->codecs, sdp_msg_b->codecs,
+						 &osmo_sdp_codec_cmp_equivalent,
+						 false);
+		osmo_sdp_msg_encode_buf(str, sizeof(str), sdp_msg_a);
+		dump_sdp(str, "intersection(a,b): ");
+		if (strcmp(str, t->expect_intersection)) {
+			int j;
+			ok = false;
+			printf("ERROR:\n");
+			dump_sdp(t->expect_intersection, "expect_intersection: ");
+			for (j = 0; t->expect_intersection[j]; j++) {
+				if (t->expect_intersection[j] != str[j]) {
+					printf("ERROR at position %d, at:\n", j);
+					dump_sdp(str + j, "     mismatch: ");
+					break;
+				}
+			}
+		} else
+			printf("[%d] ok\n", i);
+
+		report(ctx);
+		printf("talloc_free(sdp_msg_a)\n");
+		talloc_free(sdp_msg_a);
+		report(ctx);
+		printf("talloc_free(sdp_msg_b)\n");
+		talloc_free(sdp_msg_b);
+		report(ctx);
+
+		if (talloc_total_blocks(ctx) != 1) {
+			printf("ERROR: memleak\n");
+			talloc_free_children(ctx);
+		}
+		printf("\n");
+	}
+
+	OSMO_ASSERT(ok);
+	talloc_free(ctx);
+}
+
+struct sdp_select_test_data {
+	const char *sdp;
+	const struct osmo_sdp_codec_cmp_flags *cmpf;
+	const struct osmo_sdp_codec select;
+	const char *expect_sdp;
+};
+
+static const struct osmo_sdp_codec_cmp_flags pt_only = { .payload_type = true };
+
+static const struct sdp_select_test_data sdp_select_tests[] = {
+	{
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 112 3 111 110\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=ptime:20\r\n"
+		,
+		&pt_only,
+		{ .payload_type = 112, },
+		NULL
+	},
+	{
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 112 3 111 110\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=ptime:20\r\n"
+		,
+		&pt_only,
+		{ .payload_type = 3, },
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 3 112 111 110\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=ptime:20\r\n"
+	},
+	{
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 112 3 111 110\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=ptime:20\r\n"
+		,
+		&pt_only,
+		{ .payload_type = 111, },
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 111 112 3 110\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=ptime:20\r\n"
+	},
+	{
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 112 3 111 110\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=ptime:20\r\n"
+		,
+		&pt_only,
+		{ .payload_type = 110, },
+		"v=0\r\n"
+		"o=libosmo-sdp 0 0 IN IP4 23.42.23.42\r\n"
+		"s=GSM Call\r\n"
+		"c=IN IP4 23.42.23.42\r\n"
+		"t=0 0\r\n"
+		"m=audio 30436 RTP/AVP 110 112 3 111\r\n"
+		"a=rtpmap:110 GSM-EFR/8000\r\n"
+		"a=rtpmap:112 AMR/8000\r\n"
+		"a=fmtp:112 octet-align=1\r\n"
+		"a=rtpmap:3 GSM/8000\r\n"
+		"a=rtpmap:111 GSM-HR-08/8000\r\n"
+		"a=ptime:20\r\n"
+	},
+
+};
+
+static void test_select(void)
+{
+	int i;
+	bool ok = true;
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+
+	printf("\n\n%s\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(sdp_select_tests); i++) {
+		const struct sdp_select_test_data *t = &sdp_select_tests[i];
+		struct osmo_sdp_msg *sdp_msg;
+		char buf[1024];
+		const char *expect_sdp;
+
+		printf("\n[%d]\n", i);
+		sdp_msg = osmo_sdp_msg_decode(ctx, t->sdp, NULL);
+		if (!sdp_msg) {
+			printf("ERROR parsing SDP\n");
+			break;
+		}
+		printf("SDP: %s\n", osmo_sdp_codec_list_to_str_c(print_ctx, sdp_msg->codecs, false));
+
+		printf("Select: %s\n", osmo_sdp_codec_to_str_c(print_ctx, &t->select));
+		osmo_sdp_codec_list_move_to_first(sdp_msg->codecs, &t->select, t->cmpf);
+
+		printf("SDP: %s\n", osmo_sdp_codec_list_to_str_c(print_ctx, sdp_msg->codecs, false));
+		osmo_sdp_msg_encode_buf(buf, sizeof(buf), sdp_msg);
+
+		expect_sdp = t->expect_sdp ? : t->sdp;
+		if (strcmp(buf, expect_sdp)) {
+			int j;
+			ok = false;
+			printf("ERROR:\n");
+			dump_sdp(buf, "selection result: ");
+			dump_sdp(expect_sdp, "expect result: ");
+			for (j = 0; expect_sdp[j]; j++) {
+				if (expect_sdp[j] != buf[j]) {
+					printf("ERROR at position %d, at:\n", j);
+					dump_sdp(buf + j, "     mismatch: ");
+					break;
+				}
+			}
+		} else
+			printf("[%d] ok\n", i);
+
+		report(ctx);
+		printf("talloc_free(sdp_msg)\n");
+		talloc_free(sdp_msg);
+		report(ctx);
+		if (talloc_total_blocks(ctx) != 1) {
+			printf("ERROR: memleak\n");
+			talloc_free_children(ctx);
+		}
+		printf("\n");
+		talloc_free_children(print_ctx);
+	}
+
+	OSMO_ASSERT(ok);
+	talloc_free(ctx);
+	talloc_free(print_ctx);
+}
+
+
+struct my_obj {
+	struct osmo_sdp_msg *sdp_msg;
+};
+
+static struct my_obj *my_obj_alloc(void *ctx)
+{
+	struct my_obj *o = talloc_zero(ctx, struct my_obj);
+	return o;
+}
+
+static void test_obj_members(void)
+{
+	void *ctx = talloc_named_const(test_ctx, 0, __func__);
+	void *print_ctx = talloc_named_const(test_ctx, 0, "print");
+	int i;
+
+	struct my_obj *o;
+
+	printf("\n\n--- %s()\n", __func__);
+	o = my_obj_alloc(ctx);
+
+	o->sdp_msg = osmo_sdp_msg_alloc(o);
+
+	printf("o->sdp_msg = '%s'\n", osmo_sdp_msg_encode_c(print_ctx, o->sdp_msg));
+	report(ctx);
+
+	const struct osmo_sdp_codec all_codecs[] = {
+		{ .payload_type = 112, .encoding_name = "AMR", .rate = 8000, .fmtp = "octet-align=1;mode-set=0,2,4" },
+		{ .payload_type = 3, .encoding_name = "GSM", .rate = 8000 },
+		{ .payload_type = 111, .encoding_name = "GSM-HR-08", .rate = 8000 },
+	};
+
+	for (i = 0; i < ARRAY_SIZE(all_codecs); i++)
+		osmo_sdp_codec_list_add(o->sdp_msg->codecs, &all_codecs[i], false, false);
+
+	printf("o->sdp_msg = '%s'\n", osmo_sdp_msg_encode_c(print_ctx, o->sdp_msg));
+
+	report(ctx);
+	printf("talloc_free(o)\n");
+	talloc_free(o);
+	report(ctx);
+	talloc_free(ctx);
+	talloc_free(print_ctx);
+}
+
+typedef void (*test_func_t)(void);
+
+static const test_func_t test_func[] = {
+	test_parse_and_compose,
+	test_intersect,
+	test_select,
+	test_obj_members,
+};
+
+int main(void)
+{
+	int i;
+	test_ctx = talloc_named_const(NULL, 0, "sdp_codec_test");
+
+	for (i = 0; i < ARRAY_SIZE(test_func); i++) {
+
+		test_func[i]();
+
+		if (talloc_total_blocks(test_ctx) != 1) {
+			talloc_report_full(test_ctx, stderr);
+			printf("ERROR after test %d: memory leak\n", i);
+			return -1;
+		}
+	}
+
+	talloc_free(test_ctx);
+	return 0;
+}
--- a/tests/sdp/sdp_msg_test.err
+++ b/tests/sdp/sdp_msg_test.err
--- a/tests/sdp/sdp_msg_test.ok
+++ b/tests/sdp/sdp_msg_test.ok
--- a/tests/testsuite.at
+++ b/tests/testsuite.at
@@ -13,3 +13,24 @@ AT_KEYWORDS([mgcp])
 cat $abs_srcdir/mgcp/mgcp_test.ok > expout
 AT_CHECK([$abs_top_builddir/tests/mgcp/mgcp_test], [], [expout], [ignore])
 AT_CLEANUP
+
+AT_SETUP([sdp_fmtp])
+AT_KEYWORDS([sdp_fmtp])
+cat $abs_srcdir/sdp/sdp_fmtp_test.ok > expout
+cat $abs_srcdir/sdp/sdp_fmtp_test.err > experr
+AT_CHECK([$abs_top_builddir/tests/sdp/sdp_fmtp_test], [], [expout], [experr])
+AT_CLEANUP
+
+AT_SETUP([sdp_codec])
+AT_KEYWORDS([sdp_codec])
+cat $abs_srcdir/sdp/sdp_codec_test.ok > expout
+cat $abs_srcdir/sdp/sdp_codec_test.err > experr
+AT_CHECK([$abs_top_builddir/tests/sdp/sdp_codec_test], [], [expout], [experr])
+AT_CLEANUP
+
+AT_SETUP([sdp_msg])
+AT_KEYWORDS([sdp_msg])
+cat $abs_srcdir/sdp/sdp_msg_test.ok > expout
+cat $abs_srcdir/sdp/sdp_msg_test.err > experr
+AT_CHECK([$abs_top_builddir/tests/sdp/sdp_msg_test], [], [expout], [experr])
+AT_CLEANUP