IuUP hack: make RTP patching less general

We currently still patch over an RTP message to make it look like an IuUP
Initialization Ack specifically for the ip.access nano3G femto cell.

Be more specific about it:

- only patch over RTP in 'loopback' mode. osmo-msc specifically leaves the
  endpoint in loopback mode for this hack, so if we're not in 'loopback', then
  this hack is out of place.

- only patch over RTP if the header indicates an IuUP Initialization (check for
  0xe4 byte).

Change-Id: Ia9ec4debc138b34f6ca6a871a8778eafa6c0ba21
diff --git a/src/libosmo-mgcp/mgcp_network.c b/src/libosmo-mgcp/mgcp_network.c
index 7d98d07..3ac93be 100644
--- a/src/libosmo-mgcp/mgcp_network.c
+++ b/src/libosmo-mgcp/mgcp_network.c
@@ -732,11 +732,18 @@
 			 * 'e400', or it will reject the RAB assignment. It seems to not harm other femto
 			 * cells (as long as we patch only the first RTP payload in each stream).
 			 */
-			if (!rtp_state->patched_first_rtp_payload) {
+			if (!rtp_state->patched_first_rtp_payload
+			    && conn_src->conn->mode == MGCP_CONN_LOOPBACK) {
 				uint8_t *data = (uint8_t *) & buf[12];
-				data[0] = 0xe4;
-				data[1] = 0x00;
-				rtp_state->patched_first_rtp_payload = true;
+				if (data[0] == 0xe0) {
+					data[0] = 0xe4;
+					data[1] = 0x00;
+					rtp_state->patched_first_rtp_payload = true;
+					LOGP(DRTP, LOGL_DEBUG,
+					     "endpoint:0x%x Patching over first two bytes"
+					     " to fake an IuUP Initialization Ack\n",
+					     ENDPOINT_NUMBER(endp));
+				}
 			}
 
 			len = mgcp_udp_send(rtp_end->rtp.fd,