nat/ussd: Add an example of the USSD gateway side-channel

This adds a very basic, use once example in python on how to connect
and deal with the app specific payload and messages. The code is not
complete as the invokeId should be patched according to the initial
invoke. This excercise is left to future readers of that code.
diff --git a/openbsc/contrib/nat/ussd_example.py b/openbsc/contrib/nat/ussd_example.py
new file mode 100644
index 0000000..8f7a58d
--- /dev/null
+++ b/openbsc/contrib/nat/ussd_example.py
@@ -0,0 +1,65 @@
+#!/usr/bin/env python2.7
+
+"""
+AGPLv3+ 2016 Copyright Holger Hans Peter Freyther
+
+Example of how to connect to the USSD side-channel and how to respond
+with a fixed message.
+"""
+
+import socket
+import struct
+
+ussdSocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ussdSocket.connect(('127.0.0.1', 5001))
+
+def send_dt1(dstref, data):
+    dlen = struct.pack('B', len(data)).encode('hex')
+    hex = '06' + dstref.encode('hex') + '00' + '01' + dlen + data.encode('hex')
+    pdata = hex.decode('hex')
+    out = struct.pack('>HB', len(pdata), 0xfd) + pdata
+    ussdSocket.send(out)
+
+def send_rel(srcref, dstref):
+    hex = '04' + dstref.encode('hex') + srcref.encode('hex') + '000100'
+    pdata = hex.decode('hex')
+    out = struct.pack('>HB', len(pdata), 0xfd) + pdata
+    ussdSocket.send(out)
+
+def recv_one():
+    plen = ussdSocket.recv(3)
+    (plen,ptype) = struct.unpack(">HB", plen)
+    data = ussdSocket.recv(plen)
+
+    return ptype, data
+
+# Assume this is the ID request
+data = ussdSocket.recv(4)
+ussdSocket.send("\x00\x08\xfe\x05\x00" + "\x05\x01" + "ussd")
+#                      ^len                ^len of tag ... and ignore
+
+# Expect a fake message. see struct ipac_msgt_sccp_state
+ptype, data = recv_one()
+print("%d %s" % (ptype, data.encode('hex')))
+(srcref, dstref, transid, invokeid) = struct.unpack("<3s3sBB", data[1:9])
+print("New transID %d invoke %d" % (transid, invokeid))
+
+# Expect a the invocation.. todo.. extract invoke id
+ptype, data = recv_one()
+print("%d %s" % (ptype, data.encode('hex')))
+
+# Reply with BSSAP + GSM 04.08 + MAP portion
+#                                    00 == invoke id     0f == DCS
+res = "01002a9b2a0802e1901c22a220020100301b02013b301604010f041155e7d2f9bc3a41412894991c06a9c9a713"
+send_dt1(dstref, res.decode('hex'))
+
+clear = "000420040109"
+send_dt1(dstref, clear.decode('hex'))
+
+# should be the clear complete
+send_rel(srcref, dstref)
+
+# Give it some time to handle connection shutdown properly
+print("Gracefully sleeping")
+import time
+time.sleep(3)