mgcp: hack RAB success from nano3G: patch first RTP payload

The ip.access nano3G needs the first RTP payload's first two bytes to read hex
'e400', or it will reject the RAB assignment. Add flag
patched_first_rtp_payload to mgcp_rtp_state to detect the first RTP payload on
a stream, and overwrite its first bytes with e400. This should probably be
configurable, but seems to not harm other femto cells (as long as we patch only
the first RTP payload in each stream). Only do this when sending to the BTS
side.

Related: OS#2459
Change-Id: I5eff04dcb0936e21690e427ae5e49228cd459bd4
diff --git a/include/openbsc/mgcp_internal.h b/include/openbsc/mgcp_internal.h
index b58eb9b..b2c2408 100644
--- a/include/openbsc/mgcp_internal.h
+++ b/include/openbsc/mgcp_internal.h
@@ -64,6 +64,7 @@
 	uint32_t stats_jitter;
 	int32_t stats_transit;
 	int stats_cycles;
+	bool patched_first_rtp_payload; /* FIXME: drop this, see OS#2459 */
 };
 
 struct mgcp_rtp_codec {
diff --git a/src/libmgcp/mgcp_network.c b/src/libmgcp/mgcp_network.c
index c9fe179..399dc8f 100644
--- a/src/libmgcp/mgcp_network.c
+++ b/src/libmgcp/mgcp_network.c
@@ -667,6 +667,19 @@
 			forward_data(rtp_end->rtp.fd, &endp->taps[tap_idx],
 				     buf, len);
 
+			/* FIXME: HACK HACK HACK. See OS#2459.
+			 * The ip.access nano3G needs the first RTP payload's first two bytes to read hex
+			 * 'e400', or it will reject the RAB assignment. It seems to not harm other femto
+			 * cells (as long as we patch only the first RTP payload in each stream).
+			 */
+			if (tap_idx == MGCP_TAP_BTS_OUT
+			    && !rtp_state->patched_first_rtp_payload) {
+				uint8_t *data = (uint8_t*)&buf[12];
+				data[0] = 0xe4;
+				data[1] = 0x00;
+				rtp_state->patched_first_rtp_payload = true;
+			}
+
 			rc = mgcp_udp_send(rtp_end->rtp.fd,
 					   &rtp_end->addr,
 					   rtp_end->rtp_port, buf, len);