mncc: introduce 'struct gsm_mncc_bridge' for MNCC_BRIDGE

When a MNCC handler wants to issue the MNCC_BRIDGE primitive
overt the MNCC interface, this was not possible so far via the
MNCC socket.   This primitive was so far only available from the
internal MNCC handler, more or less by accident I suppose.  The reason
for this is in the way the array of two call references had been passed
into mncc_tx_to_cc().
diff --git a/openbsc/include/openbsc/mncc.h b/openbsc/include/openbsc/mncc.h
index 2a170cd..10192ad 100644
--- a/openbsc/include/openbsc/mncc.h
+++ b/openbsc/include/openbsc/mncc.h
@@ -191,6 +191,11 @@
 	uint32_t	payload_msg_type;
 };
 
+struct gsm_mncc_bridge {
+	uint32_t	msg_type;
+	uint32_t	callref[2];
+};
+
 const char *get_mncc_name(int value);
 void mncc_set_cause(struct gsm_mncc *data, int loc, int val);
 void cc_tx_to_mncc(struct gsm_network *net, struct msgb *msg);
diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c
index 7db7586..9d7e2aa 100644
--- a/openbsc/src/libmsc/gsm_04_08.c
+++ b/openbsc/src/libmsc/gsm_04_08.c
@@ -1662,10 +1662,10 @@
 }
 
 /* bridge channels of two transactions */
-static int tch_bridge(struct gsm_network *net, uint32_t *refs)
+static int tch_bridge(struct gsm_network *net, struct gsm_mncc_bridge *bridge)
 {
-	struct gsm_trans *trans1 = trans_find_by_callref(net, refs[0]);
-	struct gsm_trans *trans2 = trans_find_by_callref(net, refs[1]);
+	struct gsm_trans *trans1 = trans_find_by_callref(net, bridge->callref[0]);
+	struct gsm_trans *trans2 = trans_find_by_callref(net, bridge->callref[1]);
 
 	if (!trans1 || !trans2)
 		return -EIO;
diff --git a/openbsc/src/libmsc/mncc_builtin.c b/openbsc/src/libmsc/mncc_builtin.c
index 7d5a7f1..77df6fb 100644
--- a/openbsc/src/libmsc/mncc_builtin.c
+++ b/openbsc/src/libmsc/mncc_builtin.c
@@ -186,7 +186,7 @@
 	struct gsm_mncc connect_ack, frame_recv;
 	struct gsm_network *net = call->net;
 	struct gsm_call *remote;
-	uint32_t refs[2];
+	struct gsm_mncc_bridge bridge = { .msg_type = MNCC_BRIDGE };
 
 	/* acknowledge connect */
 	memset(&connect_ack, 0, sizeof(struct gsm_mncc));
@@ -202,19 +202,19 @@
 	mncc_tx_to_cc(remote->net, MNCC_SETUP_RSP, connect);
 
 	/* bridge tch */
-	refs[0] = call->callref;
-	refs[1] = call->remote_ref;
+	bridge.callref[0] = call->callref;
+	bridge.callref[1] = call->remote_ref;
 	DEBUGP(DMNCC, "(call %x) Bridging with remote.\n", call->callref);
 
 	/* in direct mode, we always have to bridge the channels */
 	if (ipacc_rtp_direct)
-		return mncc_tx_to_cc(call->net, MNCC_BRIDGE, refs);
+		return mncc_tx_to_cc(call->net, MNCC_BRIDGE, &bridge);
 
 	/* proxy mode */
 	if (!net->handover.active) {
 		/* in the no-handover case, we can bridge, i.e. use
 		 * the old RTP proxy code */
-		return mncc_tx_to_cc(call->net, MNCC_BRIDGE, refs);
+		return mncc_tx_to_cc(call->net, MNCC_BRIDGE, &bridge);
 	} else {
 		/* in case of handover, we need to re-write the RTP
 		 * SSRC, sequence and timestamp values and thus