gpproxy: Route BSSGP STATUS with PDU_IN_ERROR containing a TMSI

Derive a foreign TLLI from a TMSI and route the message according to it
Fixes TC_status_sig_ul_tmsi

Related: OS#4892
Change-Id: Iebda9e9fd433cd28c0f657adc4d475d4e6e247ba
diff --git a/src/gb_proxy.c b/src/gb_proxy.c
index a45a83f..1e8bc96 100644
--- a/src/gb_proxy.c
+++ b/src/gb_proxy.c
@@ -1003,10 +1003,16 @@
 	if (rc < 0)
 		return rc;
 
-	if (TLVP_PRESENT(&tp_inner[0], BSSGP_IE_TLLI))
+	if (TLVP_PRESENT(&tp_inner[0], BSSGP_IE_TLLI)) {
 		*tlli = osmo_load32be(TLVP_VAL(&tp_inner[0], BSSGP_IE_TLLI));
-	else
+	} else if (TLVP_PRESENT(&tp_inner[0], BSSGP_IE_TMSI)) {
+		/* we treat the TMSI like a TLLI and extract the NRI from it */
+		*tlli = osmo_load32be(TLVP_VAL(&tp_inner[0], BSSGP_IE_TMSI));
+		/* Convert the TMSI into a FOREIGN TLLI so it is routed appropriately */
+		*tlli = gprs_tmsi2tlli(*tlli, TLLI_FOREIGN);
+	} else {
 		return -ENOENT;
+	}
 
 	return 0;
 }