Merge branch 'zecke/mgcp-transcoder'
diff --git a/openbsc/include/openbsc/bsc_nat.h b/openbsc/include/openbsc/bsc_nat.h
index 6b2a099..ff0ee48 100644
--- a/openbsc/include/openbsc/bsc_nat.h
+++ b/openbsc/include/openbsc/bsc_nat.h
@@ -190,7 +190,6 @@
 
 	/* MGCP config */
 	struct mgcp_config *mgcp_cfg;
-	struct write_queue mgcp_queue;
 	uint8_t mgcp_msg[4096];
 	int mgcp_length;
 
diff --git a/openbsc/include/openbsc/mgcp.h b/openbsc/include/openbsc/mgcp.h
index 0a00322..850396a 100644
--- a/openbsc/include/openbsc/mgcp.h
+++ b/openbsc/include/openbsc/mgcp.h
@@ -25,6 +25,7 @@
 #define OPENBSC_MGCP_H
 
 #include <osmocore/msgb.h>
+#include <osmocore/write_queue.h>
 
 #include "debug.h"
 
@@ -114,8 +115,16 @@
 	int audio_payload;
 	int audio_loop;
 
+	/* transcoder handling */
+	char *transcoder_ip;
+	struct in_addr transcoder_in;
+	int transcoder_remote_base;
+
+	struct write_queue gw_fd;
+
 	struct mgcp_port_range bts_ports;
 	struct mgcp_port_range net_ports;
+	struct mgcp_port_range transcoder_ports;
 	int endp_dscp;
 
 	/* spec handling */
@@ -137,6 +146,7 @@
 int mgcp_vty_init(void);
 int mgcp_endpoints_allocate(struct mgcp_config *cfg);
 void mgcp_free_endp(struct mgcp_endpoint *endp);
+int mgcp_reset_transcoder(struct mgcp_config *cfg);
 
 /*
  * format helper functions
diff --git a/openbsc/include/openbsc/mgcp_internal.h b/openbsc/include/openbsc/mgcp_internal.h
index 12e3ad9..7c5badc 100644
--- a/openbsc/include/openbsc/mgcp_internal.h
+++ b/openbsc/include/openbsc/mgcp_internal.h
@@ -98,6 +98,7 @@
 	/* port status for bts/net */
 	struct mgcp_rtp_end bts_end;
 	struct mgcp_rtp_end net_end;
+	struct mgcp_rtp_end transcoder_end;
 
 	/* sequence bits */
 	struct mgcp_rtp_state net_state;
@@ -123,6 +124,7 @@
 int mgcp_send_dummy(struct mgcp_endpoint *endp);
 int mgcp_bind_bts_rtp_port(struct mgcp_endpoint *endp, int rtp_port);
 int mgcp_bind_net_rtp_port(struct mgcp_endpoint *endp, int rtp_port);
+int mgcp_bind_transcoder_rtp_port(struct mgcp_endpoint *enp, int rtp_port);
 int mgcp_free_rtp_port(struct mgcp_rtp_end *end);
 
 #endif
diff --git a/openbsc/src/mgcp/mgcp_main.c b/openbsc/src/mgcp/mgcp_main.c
index e331159..08b0230 100644
--- a/openbsc/src/mgcp/mgcp_main.c
+++ b/openbsc/src/mgcp/mgcp_main.c
@@ -55,7 +55,6 @@
 
 #warning "Make use of the rtp proxy code"
 
-static struct bsc_fd bfd;
 static struct mgcp_config *cfg;
 static int reset_endpoints = 0;
 static int daemonize = 0;
@@ -147,7 +146,7 @@
 	msg = (struct msgb *) fd->data;
 
 	/* read one less so we can use it as a \0 */
-	int rc = recvfrom(bfd.fd, msg->data, msg->data_len - 1, 0,
+	int rc = recvfrom(cfg->gw_fd.bfd.fd, msg->data, msg->data_len - 1, 0,
 		(struct sockaddr *) &addr, &slen);
 	if (rc < 0) {
 		perror("Gateway failed to read");
@@ -164,7 +163,7 @@
 	msgb_reset(msg);
 
 	if (resp) {
-		sendto(bfd.fd, resp->l2h, msgb_l2len(resp), 0, (struct sockaddr *) &addr, sizeof(addr));
+		sendto(cfg->gw_fd.bfd.fd, resp->l2h, msgb_l2len(resp), 0, (struct sockaddr *) &addr, sizeof(addr));
 		msgb_free(resp);
 	}
 
@@ -228,34 +227,34 @@
 
         /* we need to bind a socket */
         if (rc == 0) {
-		bfd.when = BSC_FD_READ;
-		bfd.cb = read_call_agent;
-		bfd.fd = socket(AF_INET, SOCK_DGRAM, 0);
-		if (bfd.fd < 0) {
+		cfg->gw_fd.bfd.when = BSC_FD_READ;
+		cfg->gw_fd.bfd.cb = read_call_agent;
+		cfg->gw_fd.bfd.fd = socket(AF_INET, SOCK_DGRAM, 0);
+		if (cfg->gw_fd.bfd.fd < 0) {
 			perror("Gateway failed to listen");
 			return -1;
 		}
 
-		setsockopt(bfd.fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+		setsockopt(cfg->gw_fd.bfd.fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
 
 		memset(&addr, 0, sizeof(addr));
 		addr.sin_family = AF_INET;
 		addr.sin_port = htons(cfg->source_port);
 		inet_aton(cfg->source_addr, &addr.sin_addr);
 
-		if (bind(bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
+		if (bind(cfg->gw_fd.bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 			perror("Gateway failed to bind");
 			return -1;
 		}
 
-		bfd.data = msgb_alloc(4096, "mgcp-msg");
-		if (!bfd.data) {
+		cfg->gw_fd.bfd.data = msgb_alloc(4096, "mgcp-msg");
+		if (!cfg->gw_fd.bfd.data) {
 			fprintf(stderr, "Gateway memory error.\n");
 			return -1;
 		}
 
 
-		if (bsc_register_fd(&bfd) != 0) {
+		if (bsc_register_fd(&cfg->gw_fd.bfd) != 0) {
 			LOGP(DMGCP, LOGL_FATAL, "Failed to register the fd\n");
 			return -1;
 		}
diff --git a/openbsc/src/mgcp/mgcp_network.c b/openbsc/src/mgcp/mgcp_network.c
index 96a1865..5c57bf4 100644
--- a/openbsc/src/mgcp/mgcp_network.c
+++ b/openbsc/src/mgcp/mgcp_network.c
@@ -159,6 +159,42 @@
 	return sendto(fd, buf, len, 0,
 		      (struct sockaddr *)&tap->forward, sizeof(tap->forward));
 }
+
+static int send_transcoder(struct mgcp_endpoint *endp, int is_rtp,
+		       const char *buf, int len)
+{
+	int rc;
+	int port;
+	struct mgcp_config *cfg = endp->cfg;
+	struct sockaddr_in addr;
+
+	if (endp->transcoder_end.rtp_port == 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Transcoder port not known on 0x%x\n",
+			ENDPOINT_NUMBER(endp));
+		return -1;
+	}
+
+	port = rtp_calculate_port(ENDPOINT_NUMBER(endp), cfg->transcoder_remote_base);
+	if (!is_rtp)
+		port += 1;
+
+	addr.sin_family = AF_INET;
+	addr.sin_addr = cfg->transcoder_in;
+	addr.sin_port = htons(port);
+
+	rc = sendto(is_rtp ?
+		endp->bts_end.rtp.fd :
+		endp->bts_end.rtcp.fd, buf, len, 0,
+		(struct sockaddr *) &addr, sizeof(addr));
+
+	if (rc != len)
+		LOGP(DMGCP, LOGL_ERROR,
+			"Failed to send data to the transcoder: %s\n",
+			strerror(errno));
+
+	return rc;
+}
+
 static int send_to(struct mgcp_endpoint *endp, int dest, int is_rtp,
 		   struct sockaddr_in *addr, char *buf, int rc)
 {
@@ -339,6 +375,52 @@
 	endp->bts_end.packets += 1;
 
 	forward_data(fd->fd, &endp->taps[MGCP_TAP_BTS_IN], buf, rc);
+	if (cfg->transcoder_ip)
+		return send_transcoder(endp, proto == PROTO_RTP, &buf[0], rc);
+	else
+		return send_to(endp, DEST_NETWORK, proto == PROTO_RTP, &addr, &buf[0], rc);
+}
+
+static int rtp_data_transcoder(struct bsc_fd *fd, unsigned int what)
+{
+	char buf[4096];
+	struct sockaddr_in addr;
+	struct mgcp_endpoint *endp;
+	struct mgcp_config *cfg;
+	int rc, proto;
+
+	endp = (struct mgcp_endpoint *) fd->data;
+	cfg = endp->cfg;
+
+	rc = recevice_from(endp, fd->fd, &addr, buf, sizeof(buf));
+	if (rc <= 0)
+		return -1;
+
+	proto = fd == &endp->transcoder_end.rtp ? PROTO_RTP : PROTO_RTCP;
+
+	if (memcmp(&addr.sin_addr, &cfg->transcoder_in, sizeof(addr.sin_addr)) != 0) {
+		LOGP(DMGCP, LOGL_ERROR,
+			"Data not coming from transcoder: %s on 0x%x\n",
+			inet_ntoa(addr.sin_addr), ENDPOINT_NUMBER(endp));
+		return -1;
+	}
+
+	if (endp->transcoder_end.rtp_port != addr.sin_port &&
+	    endp->transcoder_end.rtcp_port != addr.sin_port) {
+		LOGP(DMGCP, LOGL_ERROR,
+			"Data from wrong transcoder source port %d on 0x%x\n",
+			ntohs(addr.sin_port), ENDPOINT_NUMBER(endp));
+		return -1;
+	}
+
+	/* throw away the dummy message */
+	if (rc == 1 && buf[0] == DUMMY_LOAD) {
+		LOGP(DMGCP, LOGL_NOTICE, "Filtered dummy from transcoder on 0x%x\n",
+			ENDPOINT_NUMBER(endp));
+		return 0;
+	}
+
+	endp->transcoder_end.packets += 1;
 	return send_to(endp, DEST_NETWORK, proto == PROTO_RTP, &addr, &buf[0], rc);
 }
 
@@ -453,6 +535,22 @@
 	return bind_rtp(endp->cfg, &endp->net_end, ENDPOINT_NUMBER(endp));
 }
 
+int mgcp_bind_transcoder_rtp_port(struct mgcp_endpoint *endp, int rtp_port)
+{
+	if (endp->transcoder_end.rtp.fd != -1 || endp->transcoder_end.rtcp.fd != -1) {
+		LOGP(DMGCP, LOGL_ERROR, "Previous net-port was still bound on %d\n",
+			ENDPOINT_NUMBER(endp));
+		mgcp_free_rtp_port(&endp->transcoder_end);
+	}
+
+	endp->transcoder_end.local_port = rtp_port;
+	endp->transcoder_end.rtp.cb = rtp_data_transcoder;
+	endp->transcoder_end.rtp.data = endp;
+	endp->transcoder_end.rtcp.data = endp;
+	endp->transcoder_end.rtcp.cb = rtp_data_transcoder;
+	return bind_rtp(endp->cfg, &endp->transcoder_end, ENDPOINT_NUMBER(endp));
+}
+
 int mgcp_free_rtp_port(struct mgcp_rtp_end *end)
 {
 	if (end->rtp.fd != -1) {
diff --git a/openbsc/src/mgcp/mgcp_protocol.c b/openbsc/src/mgcp/mgcp_protocol.c
index 943fd0b..d1699e1 100644
--- a/openbsc/src/mgcp/mgcp_protocol.c
+++ b/openbsc/src/mgcp/mgcp_protocol.c
@@ -89,6 +89,9 @@
 static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg);
 static struct msgb *handle_rsip(struct mgcp_config *cfg, struct msgb *msg);
 
+static void create_transcoder(struct mgcp_endpoint *endp);
+static void delete_transcoder(struct mgcp_endpoint *endp);
+
 static uint32_t generate_call_id(struct mgcp_config *cfg)
 {
 	int i;
@@ -373,7 +376,8 @@
 }
 
 static int allocate_port(struct mgcp_endpoint *endp, struct mgcp_rtp_end *end,
-			 struct mgcp_port_range *range, int for_net)
+			 struct mgcp_port_range *range,
+			 int (*alloc)(struct mgcp_endpoint *endp, int port))
 {
 	int i;
 
@@ -390,9 +394,7 @@
 		if (range->last_port >= range->range_end)
 			range->last_port = range->range_start;
 
-		rc = for_net ?
-			mgcp_bind_net_rtp_port(endp, range->last_port) :
-			mgcp_bind_bts_rtp_port(endp, range->last_port);
+		rc = alloc(endp, range->last_port);
 
 		range->last_port += 2;
 		if (rc == 0) {
@@ -402,21 +404,31 @@
 
 	}
 
-	LOGP(DMGCP, LOGL_ERROR, "Allocating a RTP/RTCP port failed 200 times 0x%x net: %d\n",
-	     ENDPOINT_NUMBER(endp), for_net);
+	LOGP(DMGCP, LOGL_ERROR, "Allocating a RTP/RTCP port failed 200 times 0x%x.\n",
+	     ENDPOINT_NUMBER(endp));
 	return -1;
 }
 
 static int allocate_ports(struct mgcp_endpoint *endp)
 {
-	if (allocate_port(endp, &endp->net_end, &endp->cfg->net_ports, 1) != 0)
+	if (allocate_port(endp, &endp->net_end, &endp->cfg->net_ports,
+			  mgcp_bind_net_rtp_port) != 0)
 		return -1;
 
-	if (allocate_port(endp, &endp->bts_end, &endp->cfg->bts_ports, 0) != 0) {
+	if (allocate_port(endp, &endp->bts_end, &endp->cfg->bts_ports,
+			  mgcp_bind_bts_rtp_port) != 0) {
 		mgcp_rtp_end_reset(&endp->net_end);
 		return -1;
 	}
 
+	if (endp->cfg->transcoder_ip &&
+	    allocate_port(endp, &endp->transcoder_end, &endp->cfg->transcoder_ports,
+			  mgcp_bind_transcoder_rtp_port) != 0) {
+		mgcp_rtp_end_reset(&endp->net_end);
+		mgcp_rtp_end_reset(&endp->bts_end);
+		return -1;
+	}
+
 	return 0;
 }
 
@@ -503,6 +515,7 @@
 			break;
 		case MGCP_POLICY_DEFER:
 			/* stop processing */
+			create_transcoder(endp);
 			return NULL;
 			break;
 		case MGCP_POLICY_CONT:
@@ -517,6 +530,7 @@
 	if (cfg->change_cb)
 		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_CRCX);
 
+	create_transcoder(endp);
 	return create_response_with_sdp(endp, "CRCX", trans_id);
 error:
 	LOGP(DMGCP, LOGL_ERROR, "Malformed line: %s on 0x%x with: line_start: %d %d\n",
@@ -710,6 +724,7 @@
 			break;
 		case MGCP_POLICY_DEFER:
 			/* stop processing */
+			delete_transcoder(endp);
 			return NULL;
 			break;
 		case MGCP_POLICY_CONT:
@@ -721,6 +736,8 @@
 	/* free the connection */
 	LOGP(DMGCP, LOGL_DEBUG, "Deleted endpoint on: 0x%x Server: %s:%u\n",
 		ENDPOINT_NUMBER(endp), inet_ntoa(endp->net_end.addr), ntohs(endp->net_end.rtp_port));
+
+	delete_transcoder(endp);
 	mgcp_free_endp(endp);
 	if (cfg->change_cb)
 		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_DLCX);
@@ -763,6 +780,7 @@
 	cfg->source_addr = talloc_strdup(cfg, "0.0.0.0");
 	cfg->audio_name = talloc_strdup(cfg, "AMR/8000");
 	cfg->audio_payload = 126;
+	cfg->transcoder_remote_base = 4000;
 
 	cfg->bts_ports.base_port = RTP_PORT_DEFAULT;
 	cfg->net_ports.base_port = RTP_PORT_NET_DEFAULT;
@@ -805,6 +823,7 @@
 		cfg->endpoints[i].cfg = cfg;
 		mgcp_rtp_end_init(&cfg->endpoints[i].net_end);
 		mgcp_rtp_end_init(&cfg->endpoints[i].bts_end);
+		mgcp_rtp_end_init(&cfg->endpoints[i].transcoder_end);
 	}
 
 	return 0;
@@ -828,6 +847,7 @@
 
 	mgcp_rtp_end_reset(&endp->bts_end);
 	mgcp_rtp_end_reset(&endp->net_end);
+	mgcp_rtp_end_reset(&endp->transcoder_end);
 
 	memset(&endp->net_state, 0, sizeof(endp->net_state));
 	memset(&endp->bts_state, 0, sizeof(endp->bts_state));
@@ -837,3 +857,109 @@
 
 	memset(&endp->taps, 0, sizeof(endp->taps));
 }
+
+/* For transcoding we need to manage an in and an output that are connected */
+static int back_channel(int endpoint)
+{
+	return endpoint + 60;
+}
+
+static int send_trans(struct mgcp_config *cfg, const char *buf, int len)
+{
+	struct sockaddr_in addr;
+
+	memset(&addr, 0, sizeof(addr));
+	addr.sin_family = AF_INET;
+	addr.sin_addr = cfg->transcoder_in;
+	addr.sin_port = htons(2427);
+	return sendto(cfg->gw_fd.bfd.fd, buf, len, 0,
+		      (struct sockaddr *) &addr, sizeof(addr));
+}
+
+static void send_msg(struct mgcp_endpoint *endp, int endpoint, int port,
+		     const char *msg, const char *mode)
+{
+	char buf[2096];
+	int len;
+
+	/* hardcoded to AMR right now, we do not know the real type at this point */
+	len = snprintf(buf, sizeof(buf),
+			"%s 42 %x@mgw MGCP 1.0\r\n"
+			"C: 4256\r\n"
+			"M: %s\r\n"
+			"\r\n"
+			"c=IN IP4 %s\r\n"
+			"m=audio %d RTP/AVP %d\r\n"
+			"a=rtpmap:%d %s\r\n",
+			msg, endpoint, mode, endp->cfg->source_addr,
+			port, endp->cfg->audio_payload,
+			endp->cfg->audio_payload, endp->cfg->audio_name);
+
+	if (len < 0)
+		return;
+
+	buf[sizeof(buf) - 1] = '\0';
+
+	send_trans(endp->cfg, buf, len);
+}
+
+static void send_dlcx(struct mgcp_endpoint *endp, int endpoint)
+{
+	char buf[2096];
+	int len;
+
+	len = snprintf(buf, sizeof(buf),
+			"DLCX 43 %x@mgw MGCP 1.0\r\n"
+			"C: 4256\r\n"
+			, endpoint);
+
+	if (len < 0)
+		return;
+
+	buf[sizeof(buf) - 1] = '\0';
+
+	send_trans(endp->cfg, buf, len);
+}
+
+static void create_transcoder(struct mgcp_endpoint *endp)
+{
+	int port;
+	int in_endp = ENDPOINT_NUMBER(endp);
+	int out_endp = back_channel(in_endp);
+
+	if (!endp->cfg->transcoder_ip)
+		return;
+
+	send_msg(endp, in_endp, endp->bts_end.local_port, "CRCX", "recvonly");
+	send_msg(endp, in_endp, endp->bts_end.local_port, "MDCX", "recvonly");
+	send_msg(endp, out_endp, endp->transcoder_end.local_port, "CRCX", "sendrecv");
+	send_msg(endp, out_endp, endp->transcoder_end.local_port, "MDCX", "sendrecv");
+
+	port = rtp_calculate_port(out_endp, endp->cfg->transcoder_remote_base);
+	endp->transcoder_end.rtp_port = htons(port);
+	endp->transcoder_end.rtcp_port = htons(port + 1);
+}
+
+static void delete_transcoder(struct mgcp_endpoint *endp)
+{
+	int in_endp = ENDPOINT_NUMBER(endp);
+	int out_endp = back_channel(in_endp);
+
+	if (!endp->cfg->transcoder_ip)
+		return;
+
+	send_dlcx(endp, in_endp);
+	send_dlcx(endp, out_endp);
+}
+
+int mgcp_reset_transcoder(struct mgcp_config *cfg)
+{
+	if (!cfg->transcoder_ip)
+		return -1;
+
+	static const char mgcp_reset[] = {
+	    "RSIP 1 13@mgw MGCP 1.0\r\n"
+	};
+
+	return send_trans(cfg, mgcp_reset, sizeof mgcp_reset -1);
+}
diff --git a/openbsc/src/mgcp/mgcp_vty.c b/openbsc/src/mgcp/mgcp_vty.c
index e86ce7d..a9845a1 100644
--- a/openbsc/src/mgcp/mgcp_vty.c
+++ b/openbsc/src/mgcp/mgcp_vty.c
@@ -78,6 +78,15 @@
 	vty_out(vty, "  number endpoints %u%s", g_cfg->number_endpoints - 1, VTY_NEWLINE);
 	if (g_cfg->call_agent_addr)
 		vty_out(vty, "  call agent ip %s%s", g_cfg->call_agent_addr, VTY_NEWLINE);
+	if (g_cfg->transcoder_ip)
+		vty_out(vty, "  transcoder-mgw %s%s", g_cfg->transcoder_ip, VTY_NEWLINE);
+
+	if (g_cfg->transcoder_ports.mode == PORT_ALLOC_STATIC)
+		vty_out(vty, "  rtp transcoder-base %u%s", g_cfg->transcoder_ports.base_port, VTY_NEWLINE);
+	else
+		vty_out(vty, "  rtp transcoder-range %u %u%s",
+			g_cfg->transcoder_ports.range_start, g_cfg->transcoder_ports.range_end, VTY_NEWLINE);
+	vty_out(vty, "  transcoder-remote-base %u%s", g_cfg->transcoder_remote_base, VTY_NEWLINE);
 
 	return CMD_SUCCESS;
 }
@@ -90,13 +99,14 @@
 	vty_out(vty, "MGCP is up and running with %u endpoints:%s", g_cfg->number_endpoints - 1, VTY_NEWLINE);
 	for (i = 1; i < g_cfg->number_endpoints; ++i) {
 		struct mgcp_endpoint *endp = &g_cfg->endpoints[i];
-		vty_out(vty, " Endpoint 0x%.2x: CI: %d net: %u/%u bts: %u/%u on %s traffic received bts: %u/%u  remote: %u/%u%s",
+		vty_out(vty, " Endpoint 0x%.2x: CI: %d net: %u/%u bts: %u/%u on %s traffic received bts: %u/%u  remote: %u/%u transcoder: %u%s",
 			i, endp->ci,
 			ntohs(endp->net_end.rtp_port), ntohs(endp->net_end.rtcp_port),
 			ntohs(endp->bts_end.rtp_port), ntohs(endp->bts_end.rtcp_port),
 			inet_ntoa(endp->bts_end.addr),
 			endp->bts_end.packets, endp->bts_state.lost_no,
 			endp->net_end.packets, endp->net_state.lost_no,
+			endp->transcoder_end.packets,
 			VTY_NEWLINE);
 	}
 
@@ -165,14 +175,28 @@
 	return CMD_WARNING;
 }
 
+static void parse_base(struct mgcp_port_range *range, const char **argv)
+{
+	unsigned int port = atoi(argv[0]);
+	range->mode = PORT_ALLOC_STATIC;
+	range->base_port = port;
+}
+
+static void parse_range(struct mgcp_port_range *range, const char **argv)
+{
+	range->mode = PORT_ALLOC_DYNAMIC;
+	range->range_start = atoi(argv[0]);
+	range->range_end = atoi(argv[1]);
+	range->last_port = g_cfg->bts_ports.range_start;
+}
+
+
 DEFUN(cfg_mgcp_rtp_bts_base_port,
       cfg_mgcp_rtp_bts_base_port_cmd,
       "rtp bts-base <0-65534>",
       "Base port to use")
 {
-	unsigned int port = atoi(argv[0]);
-	g_cfg->bts_ports.mode = PORT_ALLOC_STATIC;
-	g_cfg->bts_ports.base_port = port;
+	parse_base(&g_cfg->bts_ports, argv);
 	return CMD_SUCCESS;
 }
 
@@ -182,10 +206,7 @@
       "Range of ports to allocate for endpoints\n"
       "Start of the range of ports\n" "End of the range of ports\n")
 {
-	g_cfg->bts_ports.mode = PORT_ALLOC_DYNAMIC;
-	g_cfg->bts_ports.range_start = atoi(argv[0]);
-	g_cfg->bts_ports.range_end = atoi(argv[1]);
-	g_cfg->bts_ports.last_port = g_cfg->bts_ports.range_start;
+	parse_range(&g_cfg->bts_ports, argv);
 	return CMD_SUCCESS;
 }
 
@@ -195,10 +216,7 @@
       "Range of ports to allocate for endpoints\n"
       "Start of the range of ports\n" "End of the range of ports\n")
 {
-	g_cfg->net_ports.mode = PORT_ALLOC_DYNAMIC;
-	g_cfg->net_ports.range_start = atoi(argv[0]);
-	g_cfg->net_ports.range_end = atoi(argv[1]);
-	g_cfg->net_ports.last_port = g_cfg->net_ports.range_start;
+	parse_range(&g_cfg->net_ports, argv);
 	return CMD_SUCCESS;
 }
 
@@ -207,15 +225,32 @@
       "rtp net-base <0-65534>",
       "Base port to use for network port\n" "Port\n")
 {
-	unsigned int port = atoi(argv[0]);
-	g_cfg->net_ports.mode = PORT_ALLOC_STATIC;
-	g_cfg->net_ports.base_port = port;
+	parse_base(&g_cfg->net_ports, argv);
 	return CMD_SUCCESS;
 }
 
 ALIAS_DEPRECATED(cfg_mgcp_rtp_bts_base_port, cfg_mgcp_rtp_base_port_cmd,
       "rtp base <0-65534>", "Base port to use")
 
+DEFUN(cfg_mgcp_rtp_transcoder_range,
+      cfg_mgcp_rtp_transcoder_range_cmd,
+      "rtp transcoder-range <0-65534> <0-65534>",
+      "Range of ports to allocate for the transcoder\n"
+      "Start of the range of ports\n" "End of the range of ports\n")
+{
+	parse_range(&g_cfg->transcoder_ports, argv);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_rtp_transcoder_base,
+      cfg_mgcp_rtp_transcoder_base_cmd,
+      "rtp transcoder-base <0-65534>",
+      "Base port for the transcoder range\n" "Port\n")
+{
+	parse_base(&g_cfg->transcoder_ports, argv);
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_mgcp_rtp_ip_dscp,
       cfg_mgcp_rtp_ip_dscp_cmd,
       "rtp ip-dscp <0-255>",
@@ -282,6 +317,30 @@
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_mgcp_transcoder,
+      cfg_mgcp_transcoder_cmd,
+      "transcoder-mgw A.B.C.D",
+      "Use a MGW to detranscoder RTP\n"
+      "The IP address of the MGW")
+{
+	if (g_cfg->transcoder_ip)
+		talloc_free(g_cfg->transcoder_ip);
+	g_cfg->transcoder_ip = talloc_strdup(g_cfg, argv[0]);
+	inet_aton(g_cfg->transcoder_ip, &g_cfg->transcoder_in);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_transcoder_remote_base,
+      cfg_mgcp_transcoder_remote_base_cmd,
+      "transcoder-remote-base <0-65534>",
+      "Set the base port for the transcoder\n" "The RTP base port on the transcoder")
+{
+	g_cfg->transcoder_remote_base = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+
 DEFUN(loop_endp,
       loop_endp_cmd,
       "loop-endpoint NAME (0|1)",
@@ -396,6 +455,8 @@
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_net_base_port_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_bts_range_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_net_range_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_rtp_transcoder_range_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_rtp_transcoder_base_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_ip_dscp_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_ip_tos_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_number_cmd);
@@ -403,6 +464,8 @@
 	install_element(MGCP_NODE, &cfg_mgcp_loop_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_number_endp_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_agent_addr_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_transcoder_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_transcoder_remote_base_cmd);
 	return 0;
 }
 
@@ -455,6 +518,16 @@
 			}
 			endp->net_end.local_alloc = PORT_ALLOC_STATIC;
 		}
+
+		if (g_cfg->transcoder_ip && g_cfg->transcoder_ports.mode == PORT_ALLOC_STATIC) {
+			rtp_port = rtp_calculate_port(ENDPOINT_NUMBER(endp),
+						      g_cfg->transcoder_ports.base_port);
+			if (mgcp_bind_transcoder_rtp_port(endp, rtp_port) != 0) {
+				LOGP(DMGCP, LOGL_FATAL, "Failed to bind: %d\n", rtp_port);
+				return -1;
+			}
+			endp->transcoder_end.local_alloc = PORT_ALLOC_STATIC;
+		}
 	}
 
 	return 0;
diff --git a/openbsc/src/nat/bsc_mgcp_utils.c b/openbsc/src/nat/bsc_mgcp_utils.c
index db0fb74..b84a262 100644
--- a/openbsc/src/nat/bsc_mgcp_utils.c
+++ b/openbsc/src/nat/bsc_mgcp_utils.c
@@ -412,7 +412,7 @@
 		return;
 	}
 
-	if (write_queue_enqueue(&bsc->nat->mgcp_queue, output) != 0) {
+	if (write_queue_enqueue(&bsc->nat->mgcp_cfg->gw_fd, output) != 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to queue MGCP msg.\n");
 		msgb_free(output);
 	}
@@ -562,7 +562,7 @@
 
 	/* we do have a direct answer... e.g. AUEP */
 	if (resp) {
-		if (write_queue_enqueue(&nat->mgcp_queue, resp) != 0) {
+		if (write_queue_enqueue(&nat->mgcp_cfg->gw_fd, resp) != 0) {
 			LOGP(DMGCP, LOGL_ERROR, "Failed to enqueue msg.\n");
 			msgb_free(resp);
 		}
@@ -589,81 +589,86 @@
 {
 	int on;
 	struct sockaddr_in addr;
+	struct mgcp_config *cfg = nat->mgcp_cfg;
 
-	if (!nat->mgcp_cfg->call_agent_addr) {
+	if (!cfg->call_agent_addr) {
 		LOGP(DMGCP, LOGL_ERROR, "The BSC nat requires the call agent ip to be set.\n");
 		return -1;
 	}
 
-	if (nat->mgcp_cfg->bts_ip) {
+	if (cfg->bts_ip) {
 		LOGP(DMGCP, LOGL_ERROR, "Do not set the BTS ip for the nat.\n");
 		return -1;
 	}
 
-	nat->mgcp_queue.bfd.fd = socket(AF_INET, SOCK_DGRAM, 0);
-	if (nat->mgcp_queue.bfd.fd < 0) {
+	cfg->gw_fd.bfd.fd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (cfg->gw_fd.bfd.fd < 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to create MGCP socket. errno: %d\n", errno);
 		return -1;
 	}
 
 	on = 1;
-	setsockopt(nat->mgcp_queue.bfd.fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+	setsockopt(cfg->gw_fd.bfd.fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
 
 	addr.sin_family = AF_INET;
-	addr.sin_port = htons(nat->mgcp_cfg->source_port);
-	inet_aton(nat->mgcp_cfg->source_addr, &addr.sin_addr);
+	addr.sin_port = htons(cfg->source_port);
+	inet_aton(cfg->source_addr, &addr.sin_addr);
 
-	if (bind(nat->mgcp_queue.bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
+	if (bind(cfg->gw_fd.bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to bind. errno: %d\n", errno);
-		close(nat->mgcp_queue.bfd.fd);
-		nat->mgcp_queue.bfd.fd = -1;
+		close(cfg->gw_fd.bfd.fd);
+		cfg->gw_fd.bfd.fd = -1;
 		return -1;
 	}
 
 	addr.sin_port = htons(2727);
-	inet_aton(nat->mgcp_cfg->call_agent_addr, &addr.sin_addr);
-	if (connect(nat->mgcp_queue.bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
+	inet_aton(cfg->call_agent_addr, &addr.sin_addr);
+	if (connect(cfg->gw_fd.bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to connect to: '%s'. errno: %d\n",
-		     nat->mgcp_cfg->call_agent_addr, errno);
-		close(nat->mgcp_queue.bfd.fd);
-		nat->mgcp_queue.bfd.fd = -1;
+		     cfg->call_agent_addr, errno);
+		close(cfg->gw_fd.bfd.fd);
+		cfg->gw_fd.bfd.fd = -1;
 		return -1;
 	}
 
-	write_queue_init(&nat->mgcp_queue, 10);
-	nat->mgcp_queue.bfd.when = BSC_FD_READ;
-	nat->mgcp_queue.bfd.data = nat;
-	nat->mgcp_queue.read_cb = mgcp_do_read;
-	nat->mgcp_queue.write_cb = mgcp_do_write;
+	write_queue_init(&cfg->gw_fd, 10);
+	cfg->gw_fd.bfd.when = BSC_FD_READ;
+	cfg->gw_fd.bfd.data = nat;
+	cfg->gw_fd.read_cb = mgcp_do_read;
+	cfg->gw_fd.write_cb = mgcp_do_write;
 
-	if (bsc_register_fd(&nat->mgcp_queue.bfd) != 0) {
+	if (bsc_register_fd(&cfg->gw_fd.bfd) != 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to register MGCP fd.\n");
-		close(nat->mgcp_queue.bfd.fd);
-		nat->mgcp_queue.bfd.fd = -1;
+		close(cfg->gw_fd.bfd.fd);
+		cfg->gw_fd.bfd.fd = -1;
 		return -1;
 	}
 
 	/* some more MGCP config handling */
-	if (nat->mgcp_cfg->audio_name)
-		talloc_free(nat->mgcp_cfg->audio_name);
-	nat->mgcp_cfg->audio_name = NULL;
+	cfg->data = nat;
+	cfg->policy_cb = bsc_mgcp_policy_cb;
+	cfg->force_realloc = 1;
 
-	nat->mgcp_cfg->audio_payload = -1;
-	nat->mgcp_cfg->data = nat;
-	nat->mgcp_cfg->policy_cb = bsc_mgcp_policy_cb;
-	nat->mgcp_cfg->force_realloc = 1;
-
-	if (nat->mgcp_cfg->bts_ip)
-		talloc_free(nat->mgcp_cfg->bts_ip);
-	nat->mgcp_cfg->bts_ip = "";
+	if (cfg->bts_ip)
+		talloc_free(cfg->bts_ip);
+	cfg->bts_ip = "";
 
 	nat->bsc_endpoints = talloc_zero_array(nat,
 					       struct bsc_endpoint,
-					       nat->mgcp_cfg->number_endpoints + 1);
+					       cfg->number_endpoints + 1);
 	if (!nat->bsc_endpoints) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to allocate nat endpoints\n");
-		close(nat->mgcp_queue.bfd.fd);
-		nat->mgcp_queue.bfd.fd = -1;
+		close(cfg->gw_fd.bfd.fd);
+		cfg->gw_fd.bfd.fd = -1;
+		return -1;
+	}
+
+	if (mgcp_reset_transcoder(cfg) < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to send packet to the transcoder.\n");
+		talloc_free(nat->bsc_endpoints);
+		nat->bsc_endpoints = NULL;
+		close(cfg->gw_fd.bfd.fd);
+		cfg->gw_fd.bfd.fd = -1;
 		return -1;
 	}