Merge remote branch 'origin/master' into gprs

25 files changed, 1098 insertions, 1253 deletions

diff --git a/openbsc/include/openbsc/Makefile.am b/openbsc/include/openbsc/Makefile.am
index 234354906..483997a9d 100644
--- a/openbsc/include/openbsc/Makefile.am
+++ b/openbsc/include/openbsc/Makefile.am
@@ -5,7 +5,7 @@ noinst_HEADERS = abis_nm.h abis_rsl.h db.h gsm_04_08.h gsm_data.h \
 		 ipaccess.h rs232.h openbscdefines.h rtp_proxy.h \
 		 bsc_rll.h mncc.h transaction.h ussd.h gsm_04_80.h \
 		 silent_call.h mgcp.h meas_rep.h rest_octets.h \
-		 system_information.h handover.h
+		 system_information.h handover.h mgcp_internal.h
 
 openbsc_HEADERS = gsm_04_08.h meas_rep.h
 openbscdir = $(includedir)/openbsc
diff --git a/openbsc/include/openbsc/gsm_04_08.h b/openbsc/include/openbsc/gsm_04_08.h
index ed688c264..c4018cd11 100644
--- a/openbsc/include/openbsc/gsm_04_08.h
+++ b/openbsc/include/openbsc/gsm_04_08.h
@@ -4,6 +4,7 @@
 #include <openbsc/meas_rep.h>
 
 #include <osmocore/protocol/gsm_04_08.h>
+#include <osmocore/gsm48.h>
 
 struct msgb;
 struct gsm_bts;
@@ -15,8 +16,6 @@ struct gsm_trans;
 void gsm0408_allow_everyone(int allow);
 
 int gsm0408_rcvmsg(struct msgb *msg, u_int8_t link_id);
-void gsm0408_generate_lai(struct gsm48_loc_area_id *lai48, u_int16_t mcc, 
-		u_int16_t mnc, u_int16_t lac);
 enum gsm_chan_t get_ctype_by_chreq(struct gsm_bts *bts, u_int8_t ra, int neci);
 enum gsm_chreq_reason_t get_reason_by_chreq(struct gsm_bts *bts, u_int8_t ra, int neci);
 
@@ -25,8 +24,6 @@ int gsm48_tx_mm_auth_req(struct gsm_lchan *lchan, u_int8_t *rand, int key_seq);
 int gsm48_tx_mm_auth_rej(struct gsm_lchan *lchan);
 struct msgb *gsm48_msgb_alloc(void);
 int gsm48_sendmsg(struct msgb *msg, struct gsm_trans *trans);
-int gsm48_generate_mid_from_tmsi(u_int8_t *buf, u_int32_t tmsi);
-int gsm48_generate_mid_from_imsi(u_int8_t *buf, const char* imsi);
 int gsm48_mi_to_string(char *string, const int str_len, const u_int8_t *mi, const int mi_len);
 
 int gsm48_send_rr_release(struct gsm_lchan *lchan);
@@ -47,8 +44,6 @@ int encode_bcd_number(u_int8_t *bcd_lv, u_int8_t max_len,
 int decode_bcd_number(char *output, int output_len, const u_int8_t *bcd_lv,
 		      int h_len);
 
-extern const char *gsm0408_cc_msg_names[];
-
 int send_siemens_mrpci(struct gsm_lchan *lchan, u_int8_t *classmark2_lv);
 int gsm48_paging_extract_mi(struct msgb *msg, char *mi_string, u_int8_t *mi_type);
 int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr);
diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index 2d9121873..951843ff8 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -3,14 +3,6 @@
 
 #include <sys/types.h>
 
-struct value_string {
-	unsigned int value;
-	const char *str;
-};
-
-const char *get_value_string(const struct value_string *vs, u_int32_t val);
-int get_string_value(const struct value_string *vs, const char *str);
-
 enum gsm_phys_chan_config {
 	GSM_PCHAN_NONE,
 	GSM_PCHAN_CCCH,
@@ -657,9 +649,6 @@ struct gsm_bts_trx *gsm_bts_trx_by_nr(struct gsm_bts *bts, int nr);
 struct gsm_bts *gsm_bts_by_lac(struct gsm_network *net, unsigned int lac,
 				struct gsm_bts *start_bts);
 
-char *gsm_band_name(enum gsm_band band);
-enum gsm_band gsm_band_parse(const char *mhz);
-
 extern void *tall_bsc_ctx;
 extern int ipacc_rtp_direct;
 
diff --git a/openbsc/include/openbsc/mgcp.h b/openbsc/include/openbsc/mgcp.h
index 2416fadec..f7e800bd8 100644
--- a/openbsc/include/openbsc/mgcp.h
+++ b/openbsc/include/openbsc/mgcp.h
@@ -1,8 +1,8 @@
 /* A Media Gateway Control Protocol Media Gateway: RFC 3435 */
 
 /*
- * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
- * (C) 2009 by On-Waves
+ * (C) 2009-2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by On-Waves
  * All Rights Reserved
  *
  * This program is free software; you can redistribute it and/or modify
@@ -26,8 +26,9 @@
 
 #include <osmocore/msgb.h>
 
+#include <arpa/inet.h>
+
 #define RTP_PORT_DEFAULT 4000
-extern unsigned int rtp_base_port;
 
 /**
  * Calculate the RTP audio port for the given multiplex
@@ -53,18 +54,69 @@ static inline int rtp_calculate_port(int multiplex, int base)
 	return base + (multiplex * 2);
 }
 
-int mgcp_parse_config(const char *config_file, struct gsm_network *dummy_network);
 
-struct msgb *mgcp_handle_message(struct msgb *msg);
-struct msgb *mgcp_create_rsip(void);
-int mgcp_vty_init(void);
+/*
+ * Handling of MGCP Endpoints and the MGCP Config
+ */
+struct mgcp_endpoint;
+struct mgcp_config;
 
-/* endpoint managed */
 #define MGCP_ENDP_CRCX 1
 #define MGCP_ENDP_DLCX 2
 #define MGCP_ENDP_MDCX 3
 
-typedef int (*mgcp_change)(int endpoint, int state, int local_rtp, void *);
-void mgcp_set_change_cb(mgcp_change cb, void *data);
+/*
+ * what to do with the msg?
+ *	- continue as usual?
+ *	- reject and send a failure code?
+ *	- defer? do not send anything
+ */
+#define MGCP_POLICY_CONT	4
+#define MGCP_POLICY_REJECT	5
+#define MGCP_POLICY_DEFER	6
+
+typedef int (*mgcp_change)(struct mgcp_config *cfg, int endpoint, int state, int local_rtp);
+typedef int (*mgcp_policy)(struct mgcp_config *cfg, int endpoint, int state, const char *transactio_id);
+
+struct mgcp_config {
+	int source_port;
+	char *local_ip;
+	char *source_addr;
+	unsigned int number_endpoints;
+	char *bts_ip;
+
+	struct in_addr bts_in;
+	char *audio_name;
+	int audio_payload;
+	int audio_loop;
+	int early_bind;
+	int rtp_base_port;
+
+	char *forward_ip;
+	int forward_port;
+
+	mgcp_change change_cb;
+	mgcp_policy policy_cb;
+	void *data;
+
+	struct mgcp_endpoint *endpoints;
+	unsigned int last_call_id;
+};
+
+/* config management */
+struct mgcp_config *mgcp_config_alloc(void);
+int mgcp_parse_config(const char *config_file, struct mgcp_config *cfg);
+int mgcp_vty_init(void);
+int mgcp_endpoints_allocate(struct mgcp_config *cfg);
+int mgcp_bind_rtp_port(struct mgcp_endpoint *endp, int rtp_port);
+void mgcp_free_endp(struct mgcp_endpoint *endp);
+
+/*
+ * format helper functions
+ */
+struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg);
+struct msgb *mgcp_create_rsip(void);
+struct msgb *mgcp_create_response_with_data(int code, const char *msg, const char *trans, const char *data);
+
 
 #endif
diff --git a/openbsc/include/openbsc/mgcp_internal.h b/openbsc/include/openbsc/mgcp_internal.h
new file mode 100644
index 000000000..10d0ca6ae
--- /dev/null
+++ b/openbsc/include/openbsc/mgcp_internal.h
@@ -0,0 +1,64 @@
+/* MGCP Private Data */
+
+/*
+ * (C) 2009-2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef OPENBSC_MGCP_DATA_H
+#define OPENBSC_MGCP_DATA_H
+
+#include <osmocore/select.h>
+
+#define CI_UNUSED 0
+
+struct mgcp_endpoint {
+	int ci;
+	char *callid;
+	char *local_options;
+	int conn_mode;
+
+	int bts_payload_type;
+	int net_payload_type;
+
+	/* the local rtp port we are binding to */
+	int rtp_port;
+
+	/*
+	 * RTP mangling:
+	 *  - we get RTP and RTCP to us and need to forward to the BTS
+	 *  - we get RTP and RTCP from the BTS and forward to the network
+	 */
+	struct bsc_fd local_rtp;
+	struct bsc_fd local_rtcp;
+
+	struct in_addr remote;
+	struct in_addr bts;
+
+	/* in network byte order */
+	int net_rtp, net_rtcp;
+	int bts_rtp, bts_rtcp;
+
+	/* backpointer */
+	struct mgcp_config *cfg;
+};
+
+#define ENDPOINT_NUMBER(endp) abs(endp - endp->cfg->endpoints)
+
+#endif
diff --git a/openbsc/src/Makefile.am b/openbsc/src/Makefile.am
index 06a43a087..e822634cc 100644
--- a/openbsc/src/Makefile.am
+++ b/openbsc/src/Makefile.am
@@ -44,7 +44,8 @@ ipaccess_config_LDADD = libbsc.a libmsc.a libbsc.a libvty.a -ldl -ldbi $(LIBCRYP
 
 isdnsync_SOURCES = isdnsync.c
 
-bsc_mgcp_SOURCES = mgcp/mgcp_main.c mgcp/mgcp_protocol.c debug.c telnet_interface.c
+bsc_mgcp_SOURCES = mgcp/mgcp_main.c mgcp/mgcp_protocol.c mgcp/mgcp_network.c mgcp/mgcp_vty.c \
+		   debug.c telnet_interface.c
 bsc_mgcp_LDADD = libvty.a
 
 ipaccess_proxy_SOURCES = ipaccess/ipaccess-proxy.c debug.c
diff --git a/openbsc/src/abis_rsl.c b/openbsc/src/abis_rsl.c
index aebd02c55..60e64cf8e 100644
--- a/openbsc/src/abis_rsl.c
+++ b/openbsc/src/abis_rsl.c
@@ -1,7 +1,7 @@
 /* GSM Radio Signalling Link messages on the A-bis interface 
  * 3GPP TS 08.58 version 8.6.0 Release 1999 / ETSI TS 100 596 V8.6.0 */
 
-/* (C) 2008-2009 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -40,94 +40,13 @@
 #include <openbsc/signal.h>
 #include <openbsc/meas_rep.h>
 #include <openbsc/rtp_proxy.h>
+#include <osmocore/rsl.h>
 
 #define RSL_ALLOC_SIZE		1024
 #define RSL_ALLOC_HEADROOM	128
 
 #define MAX(a, b) (a) >= (b) ? (a) : (b)
 
-static const struct tlv_definition rsl_att_tlvdef = {
-	.def = {
-		[RSL_IE_CHAN_NR]		= { TLV_TYPE_TV },
-		[RSL_IE_LINK_IDENT]		= { TLV_TYPE_TV },
-		[RSL_IE_ACT_TYPE]		= { TLV_TYPE_TV },
-		[RSL_IE_BS_POWER]		= { TLV_TYPE_TV },
-		[RSL_IE_CHAN_IDENT]		= { TLV_TYPE_TLV },
-		[RSL_IE_CHAN_MODE]		= { TLV_TYPE_TLV },
-		[RSL_IE_ENCR_INFO]		= { TLV_TYPE_TLV },
-		[RSL_IE_FRAME_NUMBER]		= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_HANDO_REF]		= { TLV_TYPE_TV },
-		[RSL_IE_L1_INFO]		= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_L3_INFO]		= { TLV_TYPE_TL16V },
-		[RSL_IE_MS_IDENTITY]		= { TLV_TYPE_TLV },
-		[RSL_IE_MS_POWER]		= { TLV_TYPE_TV },
-		[RSL_IE_PAGING_GROUP]		= { TLV_TYPE_TV },
-		[RSL_IE_PAGING_LOAD]		= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_PYHS_CONTEXT]		= { TLV_TYPE_TLV },
-		[RSL_IE_ACCESS_DELAY]		= { TLV_TYPE_TV },
-		[RSL_IE_RACH_LOAD]		= { TLV_TYPE_TLV },
-		[RSL_IE_REQ_REFERENCE]		= { TLV_TYPE_FIXED, 3 },
-		[RSL_IE_RELEASE_MODE]		= { TLV_TYPE_TV },
-		[RSL_IE_RESOURCE_INFO]		= { TLV_TYPE_TLV },
-		[RSL_IE_RLM_CAUSE]		= { TLV_TYPE_TLV },
-		[RSL_IE_STARTNG_TIME]		= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_TIMING_ADVANCE]		= { TLV_TYPE_TV },
-		[RSL_IE_UPLINK_MEAS]		= { TLV_TYPE_TLV },
-		[RSL_IE_CAUSE]			= { TLV_TYPE_TLV },
-		[RSL_IE_MEAS_RES_NR]		= { TLV_TYPE_TV },
-		[RSL_IE_MSG_ID]			= { TLV_TYPE_TV },
-		[RSL_IE_SYSINFO_TYPE]		= { TLV_TYPE_TV },
-		[RSL_IE_MS_POWER_PARAM]		= { TLV_TYPE_TLV },
-		[RSL_IE_BS_POWER_PARAM]		= { TLV_TYPE_TLV },
-		[RSL_IE_PREPROC_PARAM]		= { TLV_TYPE_TLV },
-		[RSL_IE_PREPROC_MEAS]		= { TLV_TYPE_TLV },
-		[RSL_IE_IMM_ASS_INFO]		= { TLV_TYPE_TLV },
-		[RSL_IE_SMSCB_INFO]		= { TLV_TYPE_FIXED, 23 },
-		[RSL_IE_MS_TIMING_OFFSET]	= { TLV_TYPE_TV },
-		[RSL_IE_ERR_MSG]		= { TLV_TYPE_TLV },
-		[RSL_IE_FULL_BCCH_INFO]		= { TLV_TYPE_TLV },
-		[RSL_IE_CHAN_NEEDED]		= { TLV_TYPE_TV },
-		[RSL_IE_CB_CMD_TYPE]		= { TLV_TYPE_TV },
-		[RSL_IE_SMSCB_MSG]		= { TLV_TYPE_TLV },
-		[RSL_IE_FULL_IMM_ASS_INFO]	= { TLV_TYPE_TLV },
-		[RSL_IE_SACCH_INFO]		= { TLV_TYPE_TLV },
-		[RSL_IE_CBCH_LOAD_INFO]		= { TLV_TYPE_TV },
-		[RSL_IE_SMSCB_CHAN_INDICATOR]	= { TLV_TYPE_TV },
-		[RSL_IE_GROUP_CALL_REF]		= { TLV_TYPE_TLV },
-		[RSL_IE_CHAN_DESC]		= { TLV_TYPE_TLV },
-		[RSL_IE_NCH_DRX_INFO]		= { TLV_TYPE_TLV },
-		[RSL_IE_CMD_INDICATOR]		= { TLV_TYPE_TLV },
-		[RSL_IE_EMLPP_PRIO]		= { TLV_TYPE_TV },
-		[RSL_IE_UIC]			= { TLV_TYPE_TLV },
-		[RSL_IE_MAIN_CHAN_REF]		= { TLV_TYPE_TV },
-		[RSL_IE_MR_CONFIG]		= { TLV_TYPE_TLV },
-		[RSL_IE_MR_CONTROL]		= { TLV_TYPE_TV },
-		[RSL_IE_SUP_CODEC_TYPES]	= { TLV_TYPE_TLV },
-		[RSL_IE_CODEC_CONFIG]		= { TLV_TYPE_TLV },
-		[RSL_IE_RTD]			= { TLV_TYPE_TV },
-		[RSL_IE_TFO_STATUS]		= { TLV_TYPE_TV },
-		[RSL_IE_LLP_APDU]		= { TLV_TYPE_TLV },
-		[RSL_IE_SIEMENS_MRPCI]		= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_PROXY_UDP]		= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_IPAC_BSCMPL_TOUT]	= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_REMOTE_IP]		= { TLV_TYPE_FIXED, 4 },
-		[RSL_IE_IPAC_REMOTE_PORT]	= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_IPAC_RTP_PAYLOAD]	= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_LOCAL_PORT]	= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_IPAC_SPEECH_MODE]	= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_LOCAL_IP]		= { TLV_TYPE_FIXED, 4 },
-		[RSL_IE_IPAC_CONN_ID]		= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_IPAC_RTP_CSD_FMT]	= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_RTP_JIT_BUF]	= { TLV_TYPE_FIXED, 2 },
-		[RSL_IE_IPAC_RTP_COMPR]		= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_RTP_PAYLOAD2]	= { TLV_TYPE_TV },
-		[RSL_IE_IPAC_RTP_MPLEX]		= { TLV_TYPE_FIXED, 8 },
-		[RSL_IE_IPAC_RTP_MPLEX_ID]	= { TLV_TYPE_TV },
-	},
-};
-#define rsl_tlv_parse(dec, buf, len)     \
-			tlv_parse(dec, &rsl_att_tlvdef, buf, len, 0, 0)
-
 static u_int8_t mdisc_by_msgtype(u_int8_t msg_type)
 {
 	/* mask off the transparent bit ? */
@@ -155,44 +74,6 @@ static inline void init_dchan_hdr(struct abis_rsl_dchan_hdr *dh,
 	dh->ie_chan = RSL_IE_CHAN_NR;
 }
 
-static inline void init_llm_hdr(struct abis_rsl_rll_hdr *dh,
-				  u_int8_t msg_type)
-{
-	/* dh->c.msg_discr = mdisc_by_msgtype(msg_type); */
-	dh->c.msg_discr = ABIS_RSL_MDISC_RLL;
-	dh->c.msg_type = msg_type;
-	dh->ie_chan = RSL_IE_CHAN_NR;
-	dh->ie_link_id = RSL_IE_LINK_IDENT;
-}
-
-
-/* encode channel number as per Section 9.3.1 */
-u_int8_t rsl_enc_chan_nr(u_int8_t type, u_int8_t subch, u_int8_t timeslot)
-{
-	u_int8_t ret;
-
-	ret = (timeslot & 0x07) | type;
-	
-	switch (type) {
-	case RSL_CHAN_Lm_ACCHs:
-		subch &= 0x01;
-		break;
-	case RSL_CHAN_SDCCH4_ACCH:
-		subch &= 0x07;
-		break;
-	case RSL_CHAN_SDCCH8_ACCH:
-		subch &= 0x07;
-		break;
-	default:
-		/* no subchannels allowed */
-		subch = 0x00;
-		break;
-	}
-	ret |= (subch << 3);
-
-	return ret;
-}
-
 /* determine logical channel based on TRX and channel number IE */
 struct gsm_lchan *lchan_lookup(struct gsm_bts_trx *trx, u_int8_t chan_nr)
 {
@@ -335,67 +216,6 @@ static int build_encr_info(u_int8_t *out, struct gsm_lchan *lchan)
 	return lchan->encr.key_len + 1;
 }
 
-
-static const char *rsl_err_vals[0xff] = {
-	[RSL_ERR_RADIO_IF_FAIL] =	"Radio Interface Failure",
-	[RSL_ERR_RADIO_LINK_FAIL] =	"Radio Link Failure",
-	[RSL_ERR_HANDOVER_ACC_FAIL] =	"Handover Access Failure",
-	[RSL_ERR_TALKER_ACC_FAIL] =	"Talker Access Failure",
-	[RSL_ERR_OM_INTERVENTION] =	"O&M Intervention",
-	[RSL_ERR_NORMAL_UNSPEC] =	"Normal event, unspecified",
-	[RSL_ERR_T_MSRFPCI_EXP] =	"Siemens: T_MSRFPCI Expired",
-	[RSL_ERR_EQUIPMENT_FAIL] =	"Equipment Failure",
-	[RSL_ERR_RR_UNAVAIL] =		"Radio Resource not available",
-	[RSL_ERR_TERR_CH_FAIL] =	"Terrestrial Channel Failure",
-	[RSL_ERR_CCCH_OVERLOAD] =	"CCCH Overload",
-	[RSL_ERR_ACCH_OVERLOAD] =	"ACCH Overload",
-	[RSL_ERR_PROCESSOR_OVERLOAD] =	"Processor Overload",
-	[RSL_ERR_RES_UNAVAIL] =		"Resource not available, unspecified",
-	[RSL_ERR_TRANSC_UNAVAIL] =	"Transcoding not available",
-	[RSL_ERR_SERV_OPT_UNAVAIL] =	"Service or Option not available",
-	[RSL_ERR_ENCR_UNIMPL] =		"Encryption algorithm not implemented",
-	[RSL_ERR_SERV_OPT_UNIMPL] =	"Service or Option not implemented",
-	[RSL_ERR_RCH_ALR_ACTV_ALLOC] =	"Radio channel already activated",
-	[RSL_ERR_INVALID_MESSAGE] =	"Invalid Message, unspecified",
-	[RSL_ERR_MSG_DISCR] =		"Message Discriminator Error",
-	[RSL_ERR_MSG_TYPE] =		"Message Type Error",
-	[RSL_ERR_MSG_SEQ] =		"Message Sequence Error",
-	[RSL_ERR_IE_ERROR] =		"General IE error",
-	[RSL_ERR_MAND_IE_ERROR] =	"Mandatory IE error",
-	[RSL_ERR_OPT_IE_ERROR] =	"Optional IE error",
-	[RSL_ERR_IE_NONEXIST] =		"IE non-existent",
-	[RSL_ERR_IE_LENGTH] =		"IE length error",
-	[RSL_ERR_IE_CONTENT] =		"IE content error",
-	[RSL_ERR_PROTO] =		"Protocol error, unspecified",
-	[RSL_ERR_INTERWORKING] =	"Interworking error, unspecified",
-};
-
-static const struct value_string rlm_cause_strs[] = {
-	{ RLL_CAUSE_T200_EXPIRED,	"Timer T200 expired (N200+1) times" },
-	{ RLL_CAUSE_REEST_REQ,		"Re-establishment request" },
-	{ RLL_CAUSE_UNSOL_UA_RESP,	"Unsolicited UA response" },
-	{ RLL_CAUSE_UNSOL_DM_RESP,	"Unsolicited DM response" },
-	{ RLL_CAUSE_UNSOL_DM_RESP_MF,	"Unsolicited DM response, multiple frame" },
-	{ RLL_CAUSE_UNSOL_SPRV_RESP,	"Unsolicited supervisory response" },
-	{ RLL_CAUSE_SEQ_ERR,		"Sequence Error" },
-	{ RLL_CAUSE_UFRM_INC_PARAM,	"U-Frame with incorrect parameters" },
-	{ RLL_CAUSE_SFRM_INC_PARAM,	"S-Frame with incorrect parameters" },
-	{ RLL_CAUSE_IFRM_INC_MBITS,	"I-Frame with incorrect use of M bit" },
-	{ RLL_CAUSE_IFRM_INC_LEN,	"I-Frame with incorrect length" },
-	{ RLL_CAUSE_FRM_UNIMPL,		"Fraeme not implemented" },
-	{ RLL_CAUSE_SABM_MF,		"SABM command, multiple frame established state" },
-	{ RLL_CAUSE_SABM_INFO_NOTALL,	"SABM frame with information not allowed in this state" },
-	{ 0,				NULL },
-};
-
-static const char *rsl_err_name(u_int8_t err)
-{
-	if (rsl_err_vals[err])
-		return rsl_err_vals[err];
-	else
-		return "unknown";
-}
-
 static void print_rsl_cause(int lvl, const u_int8_t *cause_v, u_int8_t cause_len)
 {
 	int i;
@@ -867,23 +687,13 @@ int rsl_siemens_mrpci(struct gsm_lchan *lchan, struct rsl_mrpci *mrpci)
 /* Chapter 8.3.1 */
 int rsl_data_request(struct msgb *msg, u_int8_t link_id)
 {
-	u_int8_t l3_len = msg->tail - (u_int8_t *)msgb_l3(msg);
-	struct abis_rsl_rll_hdr *rh;
-
 	if (msg->lchan == NULL) {
 		LOGP(DRSL, LOGL_ERROR, "cannot send DATA REQUEST to unknown lchan\n");
 		return -EINVAL;
 	}
 
-	/* First push the L3 IE tag and length */
-	msgb_tv16_push(msg, RSL_IE_L3_INFO, l3_len);
-
-	/* Then push the RSL header */
-	rh = (struct abis_rsl_rll_hdr *) msgb_push(msg, sizeof(*rh));
-	init_llm_hdr(rh, RSL_MT_DATA_REQ);
-	rh->c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
-	rh->chan_nr = lchan2chan_nr(msg->lchan);
-	rh->link_id = link_id;
+	rsl_rll_push_l3(msg, RSL_MT_DATA_REQ, lchan2chan_nr(msg->lchan),
+			link_id, 1);
 
 	msg->trx = msg->lchan->ts->trx;
 
@@ -894,15 +704,10 @@ int rsl_data_request(struct msgb *msg, u_int8_t link_id)
 /* Chapter 8.3.1 */
 int rsl_establish_request(struct gsm_lchan *lchan, u_int8_t link_id)
 {
-	struct msgb *msg = rsl_msgb_alloc();
-	struct abis_rsl_rll_hdr *rh;
-
-	rh = (struct abis_rsl_rll_hdr *) msgb_put(msg, sizeof(*rh));
-	init_llm_hdr(rh, RSL_MT_EST_REQ);
-	//rh->c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
-	rh->chan_nr = lchan2chan_nr(lchan);
-	rh->link_id = link_id;
+	struct msgb *msg;
 
+	msg = rsl_rll_simple(RSL_MT_EST_REQ, lchan2chan_nr(lchan),
+			     link_id, 0);
 	msg->trx = lchan->ts->trx;
 
 	return abis_rsl_sendmsg(msg);
@@ -915,14 +720,11 @@ int rsl_establish_request(struct gsm_lchan *lchan, u_int8_t link_id)
    lchan_free() */
 int rsl_release_request(struct gsm_lchan *lchan, u_int8_t link_id)
 {
-	struct msgb *msg = rsl_msgb_alloc();
-	struct abis_rsl_rll_hdr *rh;
 
-	rh = (struct abis_rsl_rll_hdr *) msgb_put(msg, sizeof(*rh));
-	init_llm_hdr(rh, RSL_MT_REL_REQ);
-	//rh->c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
-	rh->chan_nr = lchan2chan_nr(lchan);
-	rh->link_id = link_id;
+	struct msgb *msg;
+
+	msg = rsl_rll_simple(RSL_MT_REL_REQ, lchan2chan_nr(lchan),
+			     link_id, 0);
 	msgb_tv_put(msg, RSL_IE_RELEASE_MODE, 0);	/* normal release */
 
 	lchan->state = LCHAN_S_REL_REQ;
@@ -1432,7 +1234,7 @@ static int rsl_rx_rll_err_ind(struct msgb *msg)
 
 	LOGP(DRLL, LOGL_ERROR, "%s ERROR INDICATION cause=%s\n",
 		gsm_lchan_name(msg->lchan),
-		get_value_string(rlm_cause_strs, rlm_cause[1]));
+		get_value_string(rsl_rlm_cause_strs, rlm_cause[1]));
 
 	rll_indication(msg->lchan, rllh->link_id, BSC_RLLR_IND_ERR_IND);
 
@@ -1873,45 +1675,6 @@ int abis_rsl_rcvmsg(struct msgb *msg)
 	return rc;
 }
 
-
-/* Section 3.3.2.3 TS 05.02. I think this looks like a table */
-int rsl_ccch_conf_to_bs_cc_chans(int ccch_conf)
-{
-	switch (ccch_conf) {
-	case RSL_BCCH_CCCH_CONF_1_NC:
-		return 1;
-	case RSL_BCCH_CCCH_CONF_1_C:
-		return 1;
-	case RSL_BCCH_CCCH_CONF_2_NC:
-		return 2;
-	case RSL_BCCH_CCCH_CONF_3_NC:
-		return 3;
-	case RSL_BCCH_CCCH_CONF_4_NC:
-		return 4;
-	default:
-		return -1;
-	}
-}
-
-/* Section 3.3.2.3 TS 05.02 */
-int rsl_ccch_conf_to_bs_ccch_sdcch_comb(int ccch_conf)
-{
-	switch (ccch_conf) {
-	case RSL_BCCH_CCCH_CONF_1_NC:
-		return 0;
-	case RSL_BCCH_CCCH_CONF_1_C:
-		return 1;
-	case RSL_BCCH_CCCH_CONF_2_NC:
-		return 0;
-	case RSL_BCCH_CCCH_CONF_3_NC:
-		return 0;
-	case RSL_BCCH_CCCH_CONF_4_NC:
-		return 0;
-	default:
-		return -1;
-	}
-}
-
 /* From Table 10.5.33 of GSM 04.08 */
 int rsl_number_of_paging_subchannels(struct gsm_bts *bts)
 {
diff --git a/openbsc/src/debug.c b/openbsc/src/debug.c
index ab92a0974..f2b5ebe63 100644
--- a/openbsc/src/debug.c
+++ b/openbsc/src/debug.c
@@ -29,6 +29,7 @@
 
 #include <openbsc/debug.h>
 #include <osmocore/talloc.h>
+#include <osmocore/utils.h>
 #include <openbsc/gsm_data.h>
 #include <openbsc/gsm_subscriber.h>
 
@@ -57,32 +58,6 @@ static struct debug_category default_categories[Debug_LastEntry] = {
     [DGPRS]	= { .enabled = 1, .loglevel = LOGL_NOTICE },
 };
 
-const char *get_value_string(const struct value_string *vs, u_int32_t val)
-{
-	int i;
-
-	for (i = 0;; i++) {
-		if (vs[i].value == 0 && vs[i].str == NULL)
-			break;
-		if (vs[i].value == val)
-			return vs[i].str;
-	}
-	return "unknown";
-}
-
-int get_string_value(const struct value_string *vs, const char *str)
-{
-	int i;
-
-	for (i = 0;; i++) {
-		if (vs[i].value == 0 && vs[i].str == NULL)
-			break;
-		if (!strcasecmp(vs[i].str, str))
-			return vs[i].value;
-	}
-	return -EINVAL;
-}
-
 struct debug_info {
 	const char *name;
 	const char *color;
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index 3aebd7f5e..a41420c18 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -58,114 +58,6 @@
 
 void *tall_locop_ctx;
 
-static const struct tlv_definition rsl_att_tlvdef = {
-	.def = {
-		[GSM48_IE_MOBILE_ID]	= { TLV_TYPE_TLV },
-		[GSM48_IE_NAME_LONG]	= { TLV_TYPE_TLV },
-		[GSM48_IE_NAME_SHORT]	= { TLV_TYPE_TLV },
-		[GSM48_IE_UTC]		= { TLV_TYPE_TV },
-		[GSM48_IE_NET_TIME_TZ]	= { TLV_TYPE_FIXED, 7 },
-		[GSM48_IE_LSA_IDENT]	= { TLV_TYPE_TLV },
-
-		[GSM48_IE_BEARER_CAP]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CAUSE]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CC_CAP]	= { TLV_TYPE_TLV },
-		[GSM48_IE_ALERT]	= { TLV_TYPE_TLV },
-		[GSM48_IE_FACILITY]	= { TLV_TYPE_TLV },
-		[GSM48_IE_PROGR_IND]	= { TLV_TYPE_TLV },
-		[GSM48_IE_AUX_STATUS]	= { TLV_TYPE_TLV },
-		[GSM48_IE_NOTIFY]	= { TLV_TYPE_TV },
-		[GSM48_IE_KPD_FACILITY]	= { TLV_TYPE_TV },
-		[GSM48_IE_SIGNAL]	= { TLV_TYPE_TV },
-		[GSM48_IE_CONN_BCD]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CONN_SUB]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CALLING_BCD]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CALLING_SUB]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CALLED_BCD]	= { TLV_TYPE_TLV },
-		[GSM48_IE_CALLED_SUB]	= { TLV_TYPE_TLV },
-		[GSM48_IE_REDIR_BCD]	= { TLV_TYPE_TLV },
-		[GSM48_IE_REDIR_SUB]	= { TLV_TYPE_TLV },
-		[GSM48_IE_LOWL_COMPAT]	= { TLV_TYPE_TLV },
-		[GSM48_IE_HIGHL_COMPAT]	= { TLV_TYPE_TLV },
-		[GSM48_IE_USER_USER]	= { TLV_TYPE_TLV },
-		[GSM48_IE_SS_VERS]	= { TLV_TYPE_TLV },
-		[GSM48_IE_MORE_DATA]	= { TLV_TYPE_T },
-		[GSM48_IE_CLIR_SUPP]	= { TLV_TYPE_T },
-		[GSM48_IE_CLIR_INVOC]	= { TLV_TYPE_T },
-		[GSM48_IE_REV_C_SETUP]	= { TLV_TYPE_T },
-		[GSM48_IE_REPEAT_CIR]   = { TLV_TYPE_T },
-		[GSM48_IE_REPEAT_SEQ]   = { TLV_TYPE_T },
-		/* FIXME: more elements */
-	},
-};
-
-static const char *rr_cause_names[] = {
-	[GSM48_RR_CAUSE_NORMAL]			= "Normal event",
-	[GSM48_RR_CAUSE_ABNORMAL_UNSPEC]	= "Abnormal release, unspecified",
-	[GSM48_RR_CAUSE_ABNORMAL_UNACCT]	= "Abnormal release, channel unacceptable",
-	[GSM48_RR_CAUSE_ABNORMAL_TIMER]		= "Abnormal release, timer expired",
-	[GSM48_RR_CAUSE_ABNORMAL_NOACT]		= "Abnormal release, no activity on radio path",
-	[GSM48_RR_CAUSE_PREMPTIVE_REL]		= "Preemptive release",
-	[GSM48_RR_CAUSE_HNDOVER_IMP]		= "Handover impossible, timing advance out of range",
-	[GSM48_RR_CAUSE_CHAN_MODE_UNACCT]	= "Channel mode unacceptable",
-	[GSM48_RR_CAUSE_FREQ_NOT_IMPL]		= "Frequency not implemented",
-	[GSM48_RR_CAUSE_CALL_CLEARED]		= "Call already cleared",
-	[GSM48_RR_CAUSE_SEMANT_INCORR]		= "Semantically incorrect message",
-	[GSM48_RR_CAUSE_INVALID_MAND_INF]	= "Invalid mandatory information",
-	[GSM48_RR_CAUSE_MSG_TYPE_N]		= "Message type non-existant or not implemented",
-	[GSM48_RR_CAUSE_MSG_TYPE_N_COMPAT]	= "Message type not compatible with protocol state",
-	[GSM48_RR_CAUSE_COND_IE_ERROR]		= "Conditional IE error",
-	[GSM48_RR_CAUSE_NO_CELL_ALLOC_A]	= "No cell allocation available",
-	[GSM48_RR_CAUSE_PROT_ERROR_UNSPC]	= "Protocol error unspecified",
-};
-
-static const char *cc_state_names[] = {
-	"NULL",
-	"INITIATED",
-	"illegal state 2",
-	"MO_CALL_PROC",
-	"CALL_DELIVERED",
-	"illegal state 5",
-	"CALL_PRESENT",
-	"CALL_RECEIVED",
-	"CONNECT_REQUEST",
-	"MO_TERM_CALL_CONF",
-	"ACTIVE",
-	"DISCONNECT_REQ",
-	"DISCONNECT_IND",
-	"illegal state 13",
-	"illegal state 14",
-	"illegal state 15",
-	"illegal state 16",
-	"illegal state 17",
-	"illegal state 18",
-	"RELEASE_REQ",
-	"illegal state 20",
-	"illegal state 21",
-	"illegal state 22",
-	"illegal state 23",
-	"illegal state 24",
-	"illegal state 25",
-	"MO_ORIG_MODIFY",
-	"MO_TERM_MODIFY",
-	"CONNECT_IND",
-	"illegal state 29",
-	"illegal state 30",
-	"illegal state 31",
-};
-
-static char strbuf[64];
-
-static const char *rr_cause_name(u_int8_t cause)
-{
-	if (cause < ARRAY_SIZE(rr_cause_names) &&
-	    rr_cause_names[cause])
-		return rr_cause_names[cause];
-
-	snprintf(strbuf, sizeof(strbuf), "0x%02x", cause);
-	return strbuf;
-}
-
 int gsm0408_loc_upd_acc(struct gsm_lchan *lchan, u_int32_t tmsi);
 static int gsm48_tx_simple(struct gsm_lchan *lchan,
 			   u_int8_t pdisc, u_int8_t msg_type);
@@ -856,7 +748,7 @@ int gsm0408_loc_upd_acc(struct gsm_lchan *lchan, u_int32_t tmsi)
 	gh->msg_type = GSM48_MT_MM_LOC_UPD_ACCEPT;
 
 	lai = (struct gsm48_loc_area_id *) msgb_put(msg, sizeof(*lai));
-	gsm0408_generate_lai(lai, bts->network->country_code,
+	gsm48_generate_lai(lai, bts->network->country_code,
 		     bts->network->network_code, bts->location_area_code);
 
 	mid = msgb_put(msg, GSM48_MID_TMSI_LEN);
@@ -2092,7 +1984,7 @@ static int gsm48_cc_rx_setup(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&setup, 0, sizeof(struct gsm_mncc));
 	setup.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 	/* emergency setup is identified by msg_type */
 	if (msg_type == GSM48_MT_CC_EMERG_SETUP)
 		setup.emergency = 1;
@@ -2244,7 +2136,7 @@ static int gsm48_cc_rx_call_conf(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&call_conf, 0, sizeof(struct gsm_mncc));
 	call_conf.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 #if 0
 	/* repeat */
 	if (TLVP_PRESENT(&tp, GSM48_IE_REPEAT_CIR))
@@ -2312,7 +2204,7 @@ static int gsm48_cc_rx_alerting(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&alerting, 0, sizeof(struct gsm_mncc));
 	alerting.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 	/* facility */
 	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
 		alerting.fields |= MNCC_F_FACILITY;
@@ -2419,7 +2311,7 @@ static int gsm48_cc_rx_connect(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&connect, 0, sizeof(struct gsm_mncc));
 	connect.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 	/* use subscriber as connected party number */
 	if (trans->subscr) {
 		connect.fields |= MNCC_F_CONNECTED;
@@ -2492,7 +2384,7 @@ static int gsm48_cc_rx_disconnect(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&disc, 0, sizeof(struct gsm_mncc));
 	disc.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, GSM48_IE_CAUSE, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, GSM48_IE_CAUSE, 0);
 	/* cause */
 	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
 		disc.fields |= MNCC_F_CAUSE;
@@ -2579,7 +2471,7 @@ static int gsm48_cc_rx_release(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&rel, 0, sizeof(struct gsm_mncc));
 	rel.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 	/* cause */
 	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
 		rel.fields |= MNCC_F_CAUSE;
@@ -2667,7 +2559,7 @@ static int gsm48_cc_rx_release_compl(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&rel, 0, sizeof(struct gsm_mncc));
 	rel.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 	/* cause */
 	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
 		rel.fields |= MNCC_F_CAUSE;
@@ -2754,7 +2646,7 @@ static int gsm48_cc_rx_facility(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&fac, 0, sizeof(struct gsm_mncc));
 	fac.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, GSM48_IE_FACILITY, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, GSM48_IE_FACILITY, 0);
 	/* facility */
 	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
 		fac.fields |= MNCC_F_FACILITY;
@@ -2867,7 +2759,7 @@ static int gsm48_cc_rx_start_dtmf(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&dtmf, 0, sizeof(struct gsm_mncc));
 	dtmf.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, 0, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
 	/* keypad facility */
 	if (TLVP_PRESENT(&tp, GSM48_IE_KPD_FACILITY)) {
 		dtmf.fields |= MNCC_F_KEYPAD;
@@ -2939,7 +2831,7 @@ static int gsm48_cc_rx_modify(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&modify, 0, sizeof(struct gsm_mncc));
 	modify.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, GSM48_IE_BEARER_CAP, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, GSM48_IE_BEARER_CAP, 0);
 	/* bearer capability */
 	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
 		modify.fields |= MNCC_F_BEARER_CAP;
@@ -2981,7 +2873,7 @@ static int gsm48_cc_rx_modify_complete(struct gsm_trans *trans, struct msgb *msg
 
 	memset(&modify, 0, sizeof(struct gsm_mncc));
 	modify.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, GSM48_IE_BEARER_CAP, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, GSM48_IE_BEARER_CAP, 0);
 	/* bearer capability */
 	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
 		modify.fields |= MNCC_F_BEARER_CAP;
@@ -3021,7 +2913,7 @@ static int gsm48_cc_rx_modify_reject(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&modify, 0, sizeof(struct gsm_mncc));
 	modify.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, GSM48_IE_BEARER_CAP, GSM48_IE_CAUSE);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, GSM48_IE_BEARER_CAP, GSM48_IE_CAUSE);
 	/* bearer capability */
 	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
 		modify.fields |= GSM48_IE_BEARER_CAP;
@@ -3081,7 +2973,7 @@ static int gsm48_cc_rx_notify(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&notify, 0, sizeof(struct gsm_mncc));
 	notify.callref = trans->callref;
-//	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len);
+//	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len);
 	if (payload_len >= 1)
 		decode_notify(&notify.notify, gh->data);
 
@@ -3115,7 +3007,7 @@ static int gsm48_cc_rx_userinfo(struct gsm_trans *trans, struct msgb *msg)
 
 	memset(&user, 0, sizeof(struct gsm_mncc));
 	user.callref = trans->callref;
-	tlv_parse(&tp, &rsl_att_tlvdef, gh->data, payload_len, GSM48_IE_USER_USER, 0);
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, GSM48_IE_USER_USER, 0);
 	/* user-user */
 	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
 		user.fields |= MNCC_F_USERUSER;
@@ -3457,7 +3349,7 @@ static int gsm0408_rcv_cc(struct msgb *msg)
 		"Received '%s' from MS in state %d (%s)\n",
 		lchan->ts->trx->bts->nr, lchan->ts->trx->nr, lchan->ts->nr,
 		transaction_id, (lchan->subscr)?(lchan->subscr->extension):"-",
-		gsm0408_cc_msg_names[msg_type], trans?(trans->cc.state):0,
+		gsm48_cc_msg_names[msg_type], trans?(trans->cc.state):0,
 		cc_state_names[trans?(trans->cc.state):0]);
 
 	/* Create transaction */
diff --git a/openbsc/src/gsm_04_08_utils.c b/openbsc/src/gsm_04_08_utils.c
index 53c57cae2..68f34f409 100644
--- a/openbsc/src/gsm_04_08_utils.c
+++ b/openbsc/src/gsm_04_08_utils.c
@@ -29,6 +29,7 @@
 #include <netinet/in.h>
 
 #include <osmocore/msgb.h>
+#include <osmocore/gsm48.h>
 #include <openbsc/debug.h>
 #include <openbsc/gsm_04_08.h>
 #include <openbsc/transaction.h>
@@ -42,75 +43,6 @@
  * or should OpenBSC always act as RTP relay/proxy in between (0) ? */
 int ipacc_rtp_direct = 1;
 
-
-const char *gsm0408_cc_msg_names[] = {
-	"unknown 0x00",
-	"ALERTING",
-	"CALL_PROC",
-	"PROGRESS",
-	"ESTAB",
-	"SETUP",
-	"ESTAB_CONF",
-	"CONNECT",
-	"CALL_CONF",
-	"START_CC",
-	"unknown 0x0a",
-	"RECALL",
-	"unknown 0x0c",
-	"unknown 0x0d",
-	"EMERG_SETUP",
-	"CONNECT_ACK",
-	"USER_INFO",
-	"unknown 0x11",
-	"unknown 0x12",
-	"MODIFY_REJECT",
-	"unknown 0x14",
-	"unknown 0x15",
-	"unknown 0x16",
-	"MODIFY",
-	"HOLD",
-	"HOLD_ACK",
-	"HOLD_REJ",
-	"unknown 0x1b",
-	"RETR",
-	"RETR_ACK",
-	"RETR_REJ",
-	"MODIFY_COMPL",
-	"unknown 0x20",
-	"unknown 0x21",
-	"unknown 0x22",
-	"unknown 0x23",
-	"unknown 0x24",
-	"DISCONNECT",
-	"unknown 0x26",
-	"unknown 0x27",
-	"unknown 0x28",
-	"unknown 0x29",
-	"RELEASE_COMPL",
-	"unknown 0x2b",
-	"unknown 0x2c",
-	"RELEASE",
-	"unknown 0x2e",
-	"unknown 0x2f",
-	"unknown 0x30",
-	"STOP_DTMF",
-	"STOP_DTMF_ACK",
-	"unknown 0x33",
-	"STATUS_ENQ",
-	"START_DTMF",
-	"START_DTMF_ACK",
-	"START_DTMF_REJ",
-	"unknown 0x38",
-	"CONG_CTRL",
-	"FACILITY",
-	"unknown 0x3b",
-	"STATUS",
-	"unknown 0x3c",
-	"NOTIFY",
-	"unknown 0x3f",
-};
-
-
 struct msgb *gsm48_msgb_alloc(void)
 {
 	return msgb_alloc_headroom(GSM48_ALLOC_SIZE, GSM48_ALLOC_HEADROOM,
@@ -136,7 +68,7 @@ int gsm48_sendmsg(struct msgb *msg, struct gsm_trans *trans)
 				"Sending '%s' to MS.\n", msg->trx->bts->nr,
 				msg->trx->nr, msg->lchan->ts->nr,
 				gh->proto_discr & 0xf0,
-				gsm0408_cc_msg_names[gh->msg_type & 0x3f]);
+				gsm48_cc_msg_names[gh->msg_type & 0x3f]);
 		else
 			DEBUGP(DCC, "(bts %d trx %d ts %d pd %02x) "
 				"Sending 0x%02x to MS.\n", msg->trx->bts->nr,
@@ -149,94 +81,6 @@ int gsm48_sendmsg(struct msgb *msg, struct gsm_trans *trans)
 	return rsl_data_request(msg, 0);
 }
 
-static void to_bcd(u_int8_t *bcd, u_int16_t val)
-{
-	bcd[2] = val % 10;
-	val = val / 10;
-	bcd[1] = val % 10;
-	val = val / 10;
-	bcd[0] = val % 10;
-	val = val / 10;
-}
-
-static char bcd2char(u_int8_t bcd)
-{
-	if (bcd < 0xa)
-		return '0' + bcd;
-	else
-		return 'A' + (bcd - 0xa);
-}
-
-/* only works for numbers in ascci */
-static u_int8_t char2bcd(char c)
-{
-	return c - 0x30;
-}
-
-
-void gsm0408_generate_lai(struct gsm48_loc_area_id *lai48, u_int16_t mcc,
-			 u_int16_t mnc, u_int16_t lac)
-{
-	u_int8_t bcd[3];
-
-	to_bcd(bcd, mcc);
-	lai48->digits[0] = bcd[0] | (bcd[1] << 4);
-	lai48->digits[1] = bcd[2];
-
-	to_bcd(bcd, mnc);
-	/* FIXME: do we need three-digit MNC? See Table 10.5.3 */
-#if 0
-	lai48->digits[1] |= bcd[2] << 4;
-	lai48->digits[2] = bcd[0] | (bcd[1] << 4);
-#else
-	lai48->digits[1] |= 0xf << 4;
-	lai48->digits[2] = bcd[1] | (bcd[2] << 4);
-#endif
-
-	lai48->lac = htons(lac);
-}
-
-int gsm48_generate_mid_from_tmsi(u_int8_t *buf, u_int32_t tmsi)
-{
-	u_int32_t *tptr = (u_int32_t *) &buf[3];
-
-	buf[0] = GSM48_IE_MOBILE_ID;
-	buf[1] = GSM48_TMSI_LEN;
-	buf[2] = 0xf0 | GSM_MI_TYPE_TMSI;
-	*tptr = htonl(tmsi);
-
-	return 7;
-}
-
-int gsm48_generate_mid_from_imsi(u_int8_t *buf, const char *imsi)
-{
-	unsigned int length = strlen(imsi), i, off = 0;
-	u_int8_t odd = (length & 0x1) == 1;
-
-	buf[0] = GSM48_IE_MOBILE_ID;
-	buf[2] = char2bcd(imsi[0]) << 4 | GSM_MI_TYPE_IMSI | (odd << 3);
-
-	/* if the length is even we will fill half of the last octet */
-	if (odd)
-		buf[1] = (length + 1) >> 1;
-	else
-		buf[1] = (length + 2) >> 1;
-
-	for (i = 1; i < buf[1]; ++i) {
-		u_int8_t lower, upper;
-
-		lower = char2bcd(imsi[++off]);
-		if (!odd && off + 1 == length)
-			upper = 0x0f;
-		else
-			upper = char2bcd(imsi[++off]) & 0x0f;
-
-		buf[2 + i] = (upper << 4) | lower;
-	}
-
-	return 2 + buf[1];
-}
-
 /* Section 9.1.8 / Table 9.9 */
 struct chreq {
 	u_int8_t val;
diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c
index 3f8f3b33d..5314d1212 100644
--- a/openbsc/src/gsm_data.c
+++ b/openbsc/src/gsm_data.c
@@ -1,4 +1,4 @@
-/* (C) 2008-2009 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -29,6 +29,7 @@
 
 #include <openbsc/gsm_data.h>
 #include <osmocore/talloc.h>
+#include <osmocore/gsm_utils.h>
 #include <openbsc/abis_nm.h>
 #include <osmocore/statistics.h>
 
@@ -437,59 +438,6 @@ struct gsm_bts *gsm_bts_by_lac(struct gsm_network *net, unsigned int lac,
 	return NULL;
 }
 
-char *gsm_band_name(enum gsm_band band)
-{
-	switch (band) {
-	case GSM_BAND_450:
-		return "GSM450";
-	case GSM_BAND_480:
-		return "GSM450";
-	case GSM_BAND_750:
-		return "GSM750";
-	case GSM_BAND_810:
-		return "GSM810";
-	case GSM_BAND_850:
-		return "GSM850";
-	case GSM_BAND_900:
-		return "GSM900";
-	case GSM_BAND_1800:
-		return "DCS1800";
-	case GSM_BAND_1900:
-		return "PCS1900";
-	}
-	return "invalid";
-}
-
-enum gsm_band gsm_band_parse(const char* mhz)
-{
-	while (*mhz && !isdigit(*mhz))
-		mhz++;
-
-	if (*mhz == '\0')
-		return -EINVAL;
-
-	switch (atoi(mhz)) {
-	case 450:
-		return GSM_BAND_450;
-	case 480:
-		return GSM_BAND_480;
-	case 750:
-		return GSM_BAND_750;
-	case 810:
-		return GSM_BAND_810;
-	case 850:
-		return GSM_BAND_850;
-	case 900:
-		return GSM_BAND_900;
-	case 1800:
-		return GSM_BAND_1800;
-	case 1900:
-		return GSM_BAND_1900;
-	default:
-		return -EINVAL;
-	}
-}
-
 static const char *gsm_auth_policy_names[] = {
 	[GSM_AUTH_POLICY_CLOSED] = "closed",
 	[GSM_AUTH_POLICY_ACCEPT_ALL] = "accept-all",
diff --git a/openbsc/src/mgcp/mgcp_main.c b/openbsc/src/mgcp/mgcp_main.c
index b8d892b08..cea0ba427 100644
--- a/openbsc/src/mgcp/mgcp_main.c
+++ b/openbsc/src/mgcp/mgcp_main.c
@@ -31,7 +31,6 @@
 #include <unistd.h>
 
 #include <sys/socket.h>
-#include <arpa/inet.h>
 
 #include <openbsc/debug.h>
 #include <osmocore/msgb.h>
@@ -41,9 +40,6 @@
 #include <openbsc/mgcp.h>
 #include <openbsc/telnet_interface.h>
 
-#include <vty/command.h>
-#include <vty/vty.h>
-
 /* this is here for the vty... it will never be called */
 void subscr_put() { abort(); }
 
@@ -52,18 +48,15 @@ void subscr_put() { abort(); }
 
 #warning "Make use of the rtp proxy code"
 
-static int source_port = 2427;
-static const char *source_addr = "0.0.0.0";
 static struct bsc_fd bfd;
 static int first_request = 1;
+static struct mgcp_config *cfg;
 
 static char *config_file = "mgcp.cfg";
 
 /* used by msgb and mgcp */
 void *tall_bsc_ctx = NULL;
 
-unsigned int rtp_base_port = RTP_PORT_DEFAULT;
-
 static void print_help()
 {
 	printf("Some useful help...\n");
@@ -136,7 +129,7 @@ static int read_call_agent(struct bsc_fd *fd, unsigned int what)
 
 	/* handle message now */
 	msg->l2h = msgb_put(msg, rc);
-	resp = mgcp_handle_message(msg);
+	resp = mgcp_handle_message(cfg, msg);
 	msgb_reset(msg);
 
 	if (resp) {
@@ -147,15 +140,6 @@ static int read_call_agent(struct bsc_fd *fd, unsigned int what)
 }
 
 
-int bsc_vty_init(struct gsm_network *dummy)
-{
-	cmd_init(1);
-	vty_init();
-
-        mgcp_vty_init();
-	return 0;
-}
-
 int main(int argc, char** argv)
 {
 	struct gsm_network dummy_network;
@@ -170,10 +154,14 @@ int main(int argc, char** argv)
 	debug_add_target(stderr_target);
 	debug_set_all_filter(stderr_target, 1);
 
+	cfg = mgcp_config_alloc();
+	if (!cfg)
+		return -1;
+
 	handle_options(argc, argv);
 
 	telnet_init(&dummy_network, 4243);
-        rc = mgcp_parse_config(config_file, &dummy_network);
+        rc = mgcp_parse_config(config_file, cfg);
 	if (rc < 0)
 		return rc;
 
@@ -192,8 +180,8 @@ int main(int argc, char** argv)
 
 		memset(&addr, 0, sizeof(addr));
 		addr.sin_family = AF_INET;
-		addr.sin_port = htons(source_port);
-		inet_aton(source_addr, &addr.sin_addr);
+		addr.sin_port = htons(cfg->source_port);
+		inet_aton(cfg->source_addr, &addr.sin_addr);
 
 		if (bind(bfd.fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 			perror("Gateway failed to bind");
diff --git a/openbsc/src/mgcp/mgcp_network.c b/openbsc/src/mgcp/mgcp_network.c
new file mode 100644
index 000000000..b76ca4732
--- /dev/null
+++ b/openbsc/src/mgcp/mgcp_network.c
@@ -0,0 +1,255 @@
+/* A Media Gateway Control Protocol Media Gateway: RFC 3435 */
+/* The protocol implementation */
+
+/*
+ * (C) 2009-2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <string.h>
+#include <unistd.h>
+#include <endian.h>
+
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <osmocore/msgb.h>
+#include <osmocore/talloc.h>
+#include <osmocore/select.h>
+
+#include <openbsc/debug.h>
+#include <openbsc/mgcp.h>
+#include <openbsc/mgcp_internal.h>
+
+#warning "Make use of the rtp proxy code"
+
+/* according to rtp_proxy.c RFC 3550 */
+struct rtp_hdr {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+	u_int8_t  csrc_count:4,
+		  extension:1,
+		  padding:1,
+		  version:2;
+	u_int8_t  payload_type:7,
+		  marker:1;
+#elif __BYTE_ORDER == __BIG_ENDIAN
+	u_int8_t  version:2,
+		  padding:1,
+		  extension:1,
+		  csrc_count:4;
+	u_int8_t  marker:1,
+		  payload_type:7;
+#endif
+	u_int16_t sequence;
+	u_int32_t timestamp;
+	u_int32_t ssrc;
+} __attribute__((packed));
+
+
+enum {
+	DEST_NETWORK = 0,
+	DEST_BTS = 1,
+};
+
+enum {
+	PROTO_RTP,
+	PROTO_RTCP,
+};
+
+
+static int udp_send(int fd, struct in_addr *addr, int port, char *buf, int len)
+{
+	struct sockaddr_in out;
+	out.sin_family = AF_INET;
+	out.sin_port = port;
+	memcpy(&out.sin_addr, addr, sizeof(*addr));
+
+	return sendto(fd, buf, len, 0, (struct sockaddr *)&out, sizeof(out));
+}
+
+static void patch_payload(int payload, char *data, int len)
+{
+	struct rtp_hdr *rtp_hdr;
+
+	if (len < sizeof(*rtp_hdr))
+		return;
+
+	rtp_hdr = (struct rtp_hdr *) data;
+	rtp_hdr->payload_type = payload;
+}
+
+/*
+ * There is data coming. We will have to figure out if it
+ * came from the BTS or the MediaGateway of the MSC. On top
+ * of that we need to figure out if it was RTP or RTCP.
+ *
+ * Currently we do not communicate with the BSC so we have
+ * no idea where the BTS is listening for RTP and need to
+ * do the classic routing trick. Wait for the first packet
+ * from the BTS and then go ahead.
+ */
+static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
+{
+	char buf[4096];
+	struct sockaddr_in addr;
+	socklen_t slen = sizeof(addr);
+	struct mgcp_endpoint *endp;
+	struct mgcp_config *cfg;
+	int rc, dest, proto;
+
+	endp = (struct mgcp_endpoint *) fd->data;
+	cfg = endp->cfg;
+
+	rc = recvfrom(fd->fd, &buf, sizeof(buf), 0,
+			    (struct sockaddr *) &addr, &slen);
+	if (rc < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to receive message on: 0x%x\n",
+			ENDPOINT_NUMBER(endp));
+		return -1;
+	}
+
+	/* do not forward aynthing... maybe there is a packet from the bts */
+	if (endp->ci == CI_UNUSED) {
+		LOGP(DMGCP, LOGL_ERROR, "Unknown message on endpoint: 0x%x\n", ENDPOINT_NUMBER(endp));
+		return -1;
+	}
+
+	/*
+	 * Figure out where to forward it to. This code assumes that we
+	 * have received the Connection Modify and know who is a legitimate
+	 * partner. According to the spec we could attempt to forward even
+	 * after the Create Connection but we will not as we are not really
+	 * able to tell if this is legitimate.
+	 */
+	#warning "Slight spec violation. With connection mode recvonly we should attempt to forward."
+	dest = memcmp(&addr.sin_addr, &endp->remote, sizeof(addr.sin_addr)) == 0 &&
+                    (endp->net_rtp == addr.sin_port || endp->net_rtcp == addr.sin_port)
+			? DEST_BTS : DEST_NETWORK;
+	proto = fd == &endp->local_rtp ? PROTO_RTP : PROTO_RTCP;
+
+	/* We have no idea who called us, maybe it is the BTS. */
+	if (dest == DEST_NETWORK && (endp->bts_rtp == 0 || cfg->forward_ip)) {
+		/* it was the BTS... */
+		if (!cfg->bts_ip || memcmp(&addr.sin_addr, &cfg->bts_in, sizeof(cfg->bts_in)) == 0) {
+			if (fd == &endp->local_rtp) {
+				endp->bts_rtp = addr.sin_port;
+			} else {
+				endp->bts_rtcp = addr.sin_port;
+			}
+
+			endp->bts = addr.sin_addr;
+			LOGP(DMGCP, LOGL_NOTICE, "Found BTS for endpoint: 0x%x on port: %d/%d\n",
+				ENDPOINT_NUMBER(endp), ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp));
+		}
+	}
+
+	/* dispatch */
+	if (cfg->audio_loop)
+		dest = !dest;
+
+	if (dest == DEST_NETWORK) {
+		patch_payload(endp->net_payload_type, buf, rc);
+		return udp_send(fd->fd, &endp->remote,
+			     proto == PROTO_RTP ? endp->net_rtp : endp->net_rtcp,
+			     buf, rc);
+	} else {
+		patch_payload(endp->bts_payload_type, buf, rc);
+		return udp_send(fd->fd, &endp->bts,
+			     proto == PROTO_RTP ? endp->bts_rtp : endp->bts_rtcp,
+			     buf, rc);
+	}
+}
+
+static int create_bind(const char *source_addr, struct bsc_fd *fd, int port)
+{
+	struct sockaddr_in addr;
+	int on = 1;
+
+	fd->fd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (fd->fd < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to create UDP port.\n");
+		return -1;
+	}
+
+	setsockopt(fd->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+	memset(&addr, 0, sizeof(addr));
+	addr.sin_family = AF_INET;
+	addr.sin_port = htons(port);
+	inet_aton(source_addr, &addr.sin_addr);
+
+	if (bind(fd->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
+		return -1;
+	}
+
+	return 0;
+}
+
+static int bind_rtp(struct mgcp_endpoint *endp)
+{
+	struct mgcp_config *cfg = endp->cfg;
+
+	if (create_bind(cfg->source_addr, &endp->local_rtp, endp->rtp_port) != 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to create RTP port: %s:%d on 0x%x\n",
+		       cfg->source_addr, endp->rtp_port, ENDPOINT_NUMBER(endp));
+		goto cleanup0;
+	}
+
+	if (create_bind(cfg->source_addr, &endp->local_rtcp, endp->rtp_port + 1) != 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to create RTCP port: %s:%d on 0x%x\n",
+		       cfg->source_addr, endp->rtp_port + 1, ENDPOINT_NUMBER(endp));
+		goto cleanup1;
+	}
+
+	endp->local_rtp.cb = rtp_data_cb;
+	endp->local_rtp.data = endp;
+	endp->local_rtp.when = BSC_FD_READ;
+	if (bsc_register_fd(&endp->local_rtp) != 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to register RTP port %d on 0x%x\n",
+			endp->rtp_port, ENDPOINT_NUMBER(endp));
+		goto cleanup2;
+	}
+
+	endp->local_rtcp.cb = rtp_data_cb;
+	endp->local_rtcp.data = endp;
+	endp->local_rtcp.when = BSC_FD_READ;
+	if (bsc_register_fd(&endp->local_rtcp) != 0) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to register RTCP port %d on 0x%x\n",
+			endp->rtp_port + 1, ENDPOINT_NUMBER(endp));
+		goto cleanup3;
+	}
+
+	return 0;
+
+cleanup3:
+	bsc_unregister_fd(&endp->local_rtp);
+cleanup2:
+	close(endp->local_rtcp.fd);
+	endp->local_rtcp.fd = -1;
+cleanup1:
+	close(endp->local_rtp.fd);
+	endp->local_rtp.fd = -1;
+cleanup0:
+	return -1;
+}
+
+int mgcp_bind_rtp_port(struct mgcp_endpoint *endp, int rtp_port)
+{
+	endp->rtp_port = rtp_port;
+	return bind_rtp(endp);
+}
diff --git a/openbsc/src/mgcp/mgcp_protocol.c b/openbsc/src/mgcp/mgcp_protocol.c
index 154920271..f7ef5470d 100644
--- a/openbsc/src/mgcp/mgcp_protocol.c
+++ b/openbsc/src/mgcp/mgcp_protocol.c
@@ -2,8 +2,8 @@
 /* The protocol implementation */
 
 /*
- * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
- * (C) 2009 by On-Waves
+ * (C) 2009-2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by On-Waves
  * All Rights Reserved
  *
  * This program is free software; you can redistribute it and/or modify
@@ -30,35 +30,13 @@
 #include <limits.h>
 #include <unistd.h>
 
-#include <sys/socket.h>
-#include <arpa/inet.h>
-
 #include <openbsc/debug.h>
 #include <osmocore/msgb.h>
 #include <osmocore/talloc.h>
 #include <openbsc/gsm_data.h>
 #include <osmocore/select.h>
 #include <openbsc/mgcp.h>
-#include <openbsc/telnet_interface.h>
-
-#include <vty/command.h>
-#include <vty/vty.h>
-
-#warning "Make use of the rtp proxy code"
-
-static int source_port = 2427;
-static const char *local_ip = NULL;
-static const char *source_addr = "0.0.0.0";
-static unsigned int number_endpoints = 0;
-static const char *bts_ip = NULL;
-static struct in_addr bts_in;
-static const char *audio_name = "GSM-EFR/8000";
-static int audio_payload = 97;
-static int audio_loop = 0;
-static int early_bind = 0;
-
-static char *forward_ip = NULL;
-static int forward_port = 0;
+#include <openbsc/mgcp_internal.h>
 
 enum mgcp_connection_mode {
 	MGCP_CONN_NONE = 0,
@@ -67,47 +45,6 @@ enum mgcp_connection_mode {
 	MGCP_CONN_RECV_SEND = MGCP_CONN_RECV_ONLY | MGCP_CONN_SEND_ONLY,
 };
 
-enum {
-	DEST_NETWORK = 0,
-	DEST_BTS = 1,
-};
-
-enum {
-	PROTO_RTP,
-	PROTO_RTCP,
-};
-
-#define CI_UNUSED 0
-static unsigned int last_call_id = 0;
-
-struct mgcp_endpoint {
-	int ci;
-	char *callid;
-	char *local_options;
-	int conn_mode;
-
-	/* the local rtp port we are binding to */
-	int rtp_port;
-
-	/*
-	 * RTP mangling:
-	 *  - we get RTP and RTCP to us and need to forward to the BTS
-	 *  - we get RTP and RTCP from the BTS and forward to the network
-	 */
-	struct bsc_fd local_rtp;
-	struct bsc_fd local_rtcp;
-
-	struct in_addr remote;
-	struct in_addr bts;
-
-	/* in network byte order */
-	int net_rtp, net_rtcp;
-	int bts_rtp, bts_rtcp;
-};
-
-static struct mgcp_endpoint *endpoints = NULL;
-#define ENDPOINT_NUMBER(endp) abs(endp - endpoints)
-
 /**
  * Macro for tokenizing MGCP messages and SDP in one go.
  *
@@ -150,39 +87,36 @@ struct mgcp_msg_ptr {
 
 struct mgcp_request {
 	char *name;
-	struct msgb *(*handle_request) (struct msgb *msg);
+	struct msgb *(*handle_request) (struct mgcp_config *cfg, struct msgb *msg);
 	char *debug_name;
 };
 
 #define MGCP_REQUEST(NAME, REQ, DEBUG_NAME) \
 	{ .name = NAME, .handle_request = REQ, .debug_name = DEBUG_NAME },
 
-static struct msgb *handle_audit_endpoint(struct msgb *msg);
-static struct msgb *handle_create_con(struct msgb *msg);
-static struct msgb *handle_delete_con(struct msgb *msg);
-static struct msgb *handle_modify_con(struct msgb *msg);
-
-static mgcp_change change_cb;
-static void *change_cb_data;
+static struct msgb *handle_audit_endpoint(struct mgcp_config *cfg, struct msgb *msg);
+static struct msgb *handle_create_con(struct mgcp_config *cfg, struct msgb *msg);
+static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg);
+static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg);
 
-static int generate_call_id()
+static int generate_call_id(struct mgcp_config *cfg)
 {
 	int i;
 
 	/* use the call id */
-	++last_call_id;
+	++cfg->last_call_id;
 
 	/* handle wrap around */
-	if (last_call_id == CI_UNUSED)
-		++last_call_id;
+	if (cfg->last_call_id == CI_UNUSED)
+		++cfg->last_call_id;
 
 	/* callstack can only be of size number_of_endpoints */
 	/* verify that the call id is free, e.g. in case of overrun */
-	for (i = 1; i < number_endpoints; ++i)
-		if (endpoints[i].ci == last_call_id)
-			return generate_call_id();
+	for (i = 1; i < cfg->number_endpoints; ++i)
+		if (cfg->endpoints[i].ci == cfg->last_call_id)
+			return generate_call_id(cfg);
 
-	return last_call_id;
+	return cfg->last_call_id;
 }
 
 /* FIXIME/TODO: need to have a list of pending transactions and check that */
@@ -191,164 +125,6 @@ static unsigned int generate_transaction_id()
 	return abs(rand());
 }
 
-static int udp_send(int fd, struct in_addr *addr, int port, char *buf, int len)
-{
-	struct sockaddr_in out;
-	out.sin_family = AF_INET;
-	out.sin_port = port;
-	memcpy(&out.sin_addr, addr, sizeof(*addr));
-
-	return sendto(fd, buf, len, 0, (struct sockaddr *)&out, sizeof(out));
-}
-
-/*
- * There is data coming. We will have to figure out if it
- * came from the BTS or the MediaGateway of the MSC. On top
- * of that we need to figure out if it was RTP or RTCP.
- *
- * Currently we do not communicate with the BSC so we have
- * no idea where the BTS is listening for RTP and need to
- * do the classic routing trick. Wait for the first packet
- * from the BTS and then go ahead.
- */
-static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
-{
-	char buf[4096];
-	struct sockaddr_in addr;
-	socklen_t slen = sizeof(addr);
-	struct mgcp_endpoint *endp;
-	int rc, dest, proto;
-
-	endp = (struct mgcp_endpoint *) fd->data;
-
-	rc = recvfrom(fd->fd, &buf, sizeof(buf), 0,
-			    (struct sockaddr *) &addr, &slen);
-	if (rc < 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to receive message on: 0x%x\n",
-			ENDPOINT_NUMBER(endp));
-		return -1;
-	}
-
-	/* do not forward aynthing... maybe there is a packet from the bts */
-	if (endp->ci == CI_UNUSED) {
-		LOGP(DMGCP, LOGL_ERROR, "Unknown message on endpoint: 0x%x\n", ENDPOINT_NUMBER(endp));
-		return -1;
-	}
-
-	/*
-	 * Figure out where to forward it to. This code assumes that we
-	 * have received the Connection Modify and know who is a legitimate
-	 * partner. According to the spec we could attempt to forward even
-	 * after the Create Connection but we will not as we are not really
-	 * able to tell if this is legitimate.
-	 */
-	#warning "Slight spec violation. With connection mode recvonly we should attempt to forward."
-	dest = memcmp(&addr.sin_addr, &endp->remote, sizeof(addr.sin_addr)) == 0 &&
-                    (endp->net_rtp == addr.sin_port || endp->net_rtcp == addr.sin_port)
-			? DEST_BTS : DEST_NETWORK;
-	proto = fd == &endp->local_rtp ? PROTO_RTP : PROTO_RTCP;
-
-	/* We have no idea who called us, maybe it is the BTS. */
-	if (dest == DEST_NETWORK && (endp->bts_rtp == 0 || forward_ip)) {
-		/* it was the BTS... */
-		if (!bts_ip || memcmp(&addr.sin_addr, &bts_in, sizeof(bts_in)) == 0) {
-			if (fd == &endp->local_rtp) {
-				endp->bts_rtp = addr.sin_port;
-			} else {
-				endp->bts_rtcp = addr.sin_port;
-			}
-
-			endp->bts = addr.sin_addr;
-			LOGP(DMGCP, LOGL_NOTICE, "Found BTS for endpoint: 0x%x on port: %d/%d\n",
-				ENDPOINT_NUMBER(endp), ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp));
-		}
-	}
-
-	/* dispatch */
-	if (audio_loop)
-		dest = !dest;
-
-	if (dest == DEST_NETWORK) {
-		return udp_send(fd->fd, &endp->remote,
-			     proto == PROTO_RTP ? endp->net_rtp : endp->net_rtcp,
-			     buf, rc);
-	} else {
-		return udp_send(fd->fd, &endp->bts,
-			     proto == PROTO_RTP ? endp->bts_rtp : endp->bts_rtcp,
-			     buf, rc);
-	}
-}
-
-static int create_bind(struct bsc_fd *fd, int port)
-{
-	struct sockaddr_in addr;
-	int on = 1;
-
-	fd->fd = socket(AF_INET, SOCK_DGRAM, 0);
-	if (fd->fd < 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to create UDP port.\n");
-		return -1;
-	}
-
-	setsockopt(fd->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
-	memset(&addr, 0, sizeof(addr));
-	addr.sin_family = AF_INET;
-	addr.sin_port = htons(port);
-	inet_aton(source_addr, &addr.sin_addr);
-
-	if (bind(fd->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
-		return -1;
-	}
-
-	return 0;
-}
-
-static int bind_rtp(struct mgcp_endpoint *endp)
-{
-	if (create_bind(&endp->local_rtp, endp->rtp_port) != 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to create RTP port: %s:%d on 0x%x\n",
-		       source_addr, endp->rtp_port, ENDPOINT_NUMBER(endp));
-		goto cleanup0;
-	}
-
-	if (create_bind(&endp->local_rtcp, endp->rtp_port + 1) != 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to create RTCP port: %s:%d on 0x%x\n",
-		       source_addr, endp->rtp_port + 1, ENDPOINT_NUMBER(endp));
-		goto cleanup1;
-	}
-
-	endp->local_rtp.cb = rtp_data_cb;
-	endp->local_rtp.data = endp;
-	endp->local_rtp.when = BSC_FD_READ;
-	if (bsc_register_fd(&endp->local_rtp) != 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to register RTP port %d on 0x%x\n",
-			endp->rtp_port, ENDPOINT_NUMBER(endp));
-		goto cleanup2;
-	}
-
-	endp->local_rtcp.cb = rtp_data_cb;
-	endp->local_rtcp.data = endp;
-	endp->local_rtcp.when = BSC_FD_READ;
-	if (bsc_register_fd(&endp->local_rtcp) != 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to register RTCP port %d on 0x%x\n",
-			endp->rtp_port + 1, ENDPOINT_NUMBER(endp));
-		goto cleanup3;
-	}
-
-	return 0;
-
-cleanup3:
-	bsc_unregister_fd(&endp->local_rtp);
-cleanup2:
-	close(endp->local_rtcp.fd);
-	endp->local_rtcp.fd = -1;
-cleanup1:
-	close(endp->local_rtp.fd);
-	endp->local_rtp.fd = -1;
-cleanup0:
-	return -1;
-}
-
 /*
  * array of function pointers for handling various
  * messages. In the future this might be binary sorted
@@ -371,7 +147,7 @@ static struct msgb *mgcp_msgb_alloc(void)
 	return msg;
 }
 
-static struct msgb *send_response_with_data(int code, const char *msg, const char *trans,
+struct msgb *mgcp_create_response_with_data(int code, const char *msg, const char *trans,
 				    const char *data)
 {
 	int len;
@@ -388,22 +164,23 @@ static struct msgb *send_response_with_data(int code, const char *msg, const cha
 	}
 
 	res->l2h = msgb_put(res, len);
-	LOGP(DMGCP, LOGL_NOTICE, "Sending response: code: %d for '%s'\n", code, res->l2h);
+	LOGP(DMGCP, LOGL_DEBUG, "Sending response: code: %d for '%s'\n", code, res->l2h);
 	return res;
 }
 
-static struct msgb *send_response(int code, const char *msg, const char *trans)
+static struct msgb *create_response(int code, const char *msg, const char *trans)
 {
-	return send_response_with_data(code, msg, trans, NULL);
+	return mgcp_create_response_with_data(code, msg, trans, NULL);
 }
 
-static struct msgb *send_with_sdp(struct mgcp_endpoint *endp, const char *msg, const char *trans_id)
+static struct msgb *create_response_with_sdp(struct mgcp_endpoint *endp,
+					     const char *msg, const char *trans_id)
 {
-	const char *addr = local_ip;
+	const char *addr = endp->cfg->local_ip;
 	char sdp_record[4096];
 
 	if (!addr)
-		addr = source_addr;
+		addr = endp->cfg->source_addr;
 
 	snprintf(sdp_record, sizeof(sdp_record) - 1,
 			"I: %d\n\n"
@@ -412,8 +189,9 @@ static struct msgb *send_with_sdp(struct mgcp_endpoint *endp, const char *msg, c
 			"m=audio %d RTP/AVP %d\r\n"
 			"a=rtpmap:%d %s\r\n",
 			endp->ci, addr, endp->rtp_port,
-			audio_payload, audio_payload, audio_name);
-	return send_response_with_data(200, msg, trans_id, sdp_record);
+			endp->bts_payload_type, endp->bts_payload_type,
+		        endp->cfg->audio_name);
+	return mgcp_create_response_with_data(200, msg, trans_id, sdp_record);
 }
 
 /* send a static record */
@@ -438,7 +216,7 @@ struct msgb *mgcp_create_rsip(void)
  *   - this can be a command (four letters, space, transaction id)
  *   - or a response (three numbers, space, transaction id)
  */
-struct msgb *mgcp_handle_message(struct msgb *msg)
+struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg)
 {
         int code;
 	struct msgb *resp = NULL;
@@ -450,14 +228,14 @@ struct msgb *mgcp_handle_message(struct msgb *msg)
 
         /* attempt to treat it as a response */
         if (sscanf((const char *)&msg->data[0], "%3d %*s", &code) == 1) {
-		LOGP(DMGCP, LOGL_NOTICE, "Response: Code: %d\n", code);
+		LOGP(DMGCP, LOGL_DEBUG, "Response: Code: %d\n", code);
 	} else {
 		int i, handled = 0;
 		msg->l3h = &msg->l2h[4];
 		for (i = 0; i < ARRAY_SIZE(mgcp_requests); ++i)
 			if (strncmp(mgcp_requests[i].name, (const char *) &msg->data[0], 4) == 0) {
 				handled = 1;
-				resp = mgcp_requests[i].handle_request(msg);
+				resp = mgcp_requests[i].handle_request(cfg, msg);
 				break;
 			}
 		if (!handled) {
@@ -504,25 +282,28 @@ static int find_msg_pointers(struct msgb *msg, struct mgcp_msg_ptr *ptrs, int pt
 	return found;
 }
 
-static struct mgcp_endpoint *find_endpoint(const char *mgcp)
+static struct mgcp_endpoint *find_endpoint(struct mgcp_config *cfg, const char *mgcp)
 {
 	char *endptr = NULL;
 	unsigned int gw = INT_MAX;
 
 	gw = strtoul(mgcp, &endptr, 16);
-	if (gw == 0 || gw >= number_endpoints || strcmp(endptr, "@mgw") != 0) {
+	if (gw == 0 || gw >= cfg->number_endpoints || strcmp(endptr, "@mgw") != 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Not able to find endpoint: '%s'\n", mgcp);
 		return NULL;
 	}
 
-	return &endpoints[gw];
+	return &cfg->endpoints[gw];
 }
 
-static int analyze_header(struct msgb *msg, struct mgcp_msg_ptr *ptr, int size,
+static int analyze_header(struct mgcp_config *cfg, struct msgb *msg,
+			  struct mgcp_msg_ptr *ptr, int size,
 			  const char **transaction_id, struct mgcp_endpoint **endp)
 {
 	int found;
 
+	*transaction_id = "000000";
+
 	if (size < 3) {
 		LOGP(DMGCP, LOGL_ERROR, "Not enough space in ptr\n");
 		return -1;
@@ -530,7 +311,7 @@ static int analyze_header(struct msgb *msg, struct mgcp_msg_ptr *ptr, int size,
 
 	found = find_msg_pointers(msg, ptr, size);
 
-	if (found < 3) {
+	if (found <= 3) {
 		LOGP(DMGCP, LOGL_ERROR, "Gateway: Not enough params. Found: %d\n", found);
 		return -1;
 	}
@@ -553,7 +334,7 @@ static int analyze_header(struct msgb *msg, struct mgcp_msg_ptr *ptr, int size,
 	}
 
 	*transaction_id = (const char *)&msg->l3h[ptr[0].start];
-	*endp = find_endpoint((const char *)&msg->l3h[ptr[1].start]);
+	*endp = find_endpoint(cfg, (const char *)&msg->l3h[ptr[1].start]);
 	return *endp == NULL;
 }
 
@@ -581,20 +362,20 @@ static int verify_ci(const struct mgcp_endpoint *endp,
 	return 0;
 }
 
-static struct msgb *handle_audit_endpoint(struct msgb *msg)
+static struct msgb *handle_audit_endpoint(struct mgcp_config *cfg, struct msgb *msg)
 {
 	struct mgcp_msg_ptr data_ptrs[6];
 	int found, response;
 	const char *trans_id;
 	struct mgcp_endpoint *endp;
 
-	found = analyze_header(msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
+	found = analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
 	    response = 500;
 	else
 	    response = 200;
 
-	return send_response(response, "AUEP", trans_id);
+	return create_response(response, "AUEP", trans_id);
 }
 
 static int parse_conn_mode(const char* msg, int *conn_mode)
@@ -612,32 +393,33 @@ static int parse_conn_mode(const char* msg, int *conn_mode)
 	return ret;
 }
 
-static struct msgb *handle_create_con(struct msgb *msg)
+static struct msgb *handle_create_con(struct mgcp_config *cfg, struct msgb *msg)
 {
 	struct mgcp_msg_ptr data_ptrs[6];
 	int found, i, line_start;
 	const char *trans_id;
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
+	int port;
 
-	found = analyze_header(msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
+	found = analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
-		return send_response(500, "CRCX", trans_id);
+		return create_response(500, "CRCX", trans_id);
 
 	if (endp->ci != CI_UNUSED) {
 		LOGP(DMGCP, LOGL_ERROR, "Endpoint is already used. 0x%x\n", ENDPOINT_NUMBER(endp));
-		return send_response(500, "CRCX", trans_id);
+		return create_response(500, "CRCX", trans_id);
 	}
 
 	/* parse CallID C: and LocalParameters L: */
 	MSG_TOKENIZE_START
 	switch (msg->l3h[line_start]) {
 	case 'L':
-		endp->local_options = talloc_strdup(endpoints,
+		endp->local_options = talloc_strdup(cfg->endpoints,
 			(const char *)&msg->l3h[line_start + 3]);
 		break;
 	case 'C':
-		endp->callid = talloc_strdup(endpoints,
+		endp->callid = talloc_strdup(cfg->endpoints,
 			(const char *)&msg->l3h[line_start + 3]);
 		break;
 	case 'M':
@@ -662,33 +444,56 @@ static struct msgb *handle_create_con(struct msgb *msg)
 	memset(&endp->remote, 0, sizeof(endp->remote));
 
 	/* bind to the port now */
-	endp->rtp_port = rtp_calculate_port(ENDPOINT_NUMBER(endp), rtp_base_port);
-	if (!early_bind && bind_rtp(endp) != 0)
+	port = rtp_calculate_port(ENDPOINT_NUMBER(endp), cfg->rtp_base_port);
+	if (cfg->early_bind)
+		endp->rtp_port = port;
+	else if (mgcp_bind_rtp_port(endp, port) != 0)
 		goto error2;
 
 	/* assign a local call identifier or fail */
-	endp->ci = generate_call_id();
+	endp->ci = generate_call_id(cfg);
 	if (endp->ci == CI_UNUSED)
 		goto error2;
 
+	endp->bts_payload_type = cfg->audio_payload;
+
+	/* policy CB */
+	if (cfg->policy_cb) {
+		switch (cfg->policy_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_CRCX, trans_id)) {
+		case MGCP_POLICY_REJECT:
+			LOGP(DMGCP, LOGL_NOTICE, "CRCX rejected by policy on 0x%x\n",
+			     ENDPOINT_NUMBER(endp));
+			mgcp_free_endp(endp);
+			return create_response(500, "CRCX", trans_id);
+			break;
+		case MGCP_POLICY_DEFER:
+			/* stop processing */
+			return NULL;
+			break;
+		case MGCP_POLICY_CONT:
+			/* just continue */
+			break;
+		}
+	}
+
 	LOGP(DMGCP, LOGL_NOTICE, "Creating endpoint on: 0x%x CI: %u port: %u\n",
 		ENDPOINT_NUMBER(endp), endp->ci, endp->rtp_port);
-	if (change_cb)
-		change_cb(ENDPOINT_NUMBER(endp), MGCP_ENDP_CRCX, endp->rtp_port, change_cb_data);
+	if (cfg->change_cb)
+		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_CRCX, endp->rtp_port);
 
-	return send_with_sdp(endp, "CRCX", trans_id);
+	return create_response_with_sdp(endp, "CRCX", trans_id);
 error:
 	LOGP(DMGCP, LOGL_ERROR, "Malformed line: %s on 0x%x with: line_start: %d %d\n",
 		    hexdump(msg->l3h, msgb_l3len(msg)),
 		    ENDPOINT_NUMBER(endp), line_start, i);
-	return send_response(error_code, "CRCX", trans_id);
+	return create_response(error_code, "CRCX", trans_id);
 
 error2:
 	LOGP(DMGCP, LOGL_NOTICE, "Resource error on 0x%x\n", ENDPOINT_NUMBER(endp));
-	return send_response(error_code, "CRCX", trans_id);
+	return create_response(error_code, "CRCX", trans_id);
 }
 
-static struct msgb *handle_modify_con(struct msgb *msg)
+static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 {
 	struct mgcp_msg_ptr data_ptrs[6];
 	int found, i, line_start;
@@ -696,13 +501,13 @@ static struct msgb *handle_modify_con(struct msgb *msg)
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
 
-	found = analyze_header(msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
+	found = analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
-		return send_response(error_code, "MDCX", trans_id);
+		return create_response(error_code, "MDCX", trans_id);
 
 	if (endp->ci == CI_UNUSED) {
 		LOGP(DMGCP, LOGL_ERROR, "Endpoint is not holding a connection. 0x%x\n", ENDPOINT_NUMBER(endp));
-		return send_response(error_code, "MDCX", trans_id);
+		return create_response(error_code, "MDCX", trans_id);
 	}
 
 	MSG_TOKENIZE_START
@@ -739,11 +544,13 @@ static struct msgb *handle_modify_con(struct msgb *msg)
 		break;
 	case 'm': {
 		int port;
+		int payload;
 		const char *param = (const char *)&msg->l3h[line_start];
 
-		if (sscanf(param, "m=audio %d RTP/AVP %*d", &port) == 1) {
+		if (sscanf(param, "m=audio %d RTP/AVP %d", &port, &payload) == 2) {
 			endp->net_rtp = htons(port);
 			endp->net_rtcp = htons(port + 1);
+			endp->net_payload_type = payload;
 		}
 		break;
 	}
@@ -764,24 +571,42 @@ static struct msgb *handle_modify_con(struct msgb *msg)
 	}
 	MSG_TOKENIZE_END
 
+	/* policy CB */
+	if (cfg->policy_cb) {
+		switch (cfg->policy_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_MDCX, trans_id)) {
+		case MGCP_POLICY_REJECT:
+			LOGP(DMGCP, LOGL_NOTICE, "MDCX rejected by policy on 0x%x\n",
+			     ENDPOINT_NUMBER(endp));
+			return create_response(500, "MDCX", trans_id);
+			break;
+		case MGCP_POLICY_DEFER:
+			/* stop processing */
+			return NULL;
+			break;
+		case MGCP_POLICY_CONT:
+			/* just continue */
+			break;
+		}
+	}
+
 	/* modify */
 	LOGP(DMGCP, LOGL_NOTICE, "Modified endpoint on: 0x%x Server: %s:%u\n",
-		ENDPOINT_NUMBER(endp), inet_ntoa(endp->remote), endp->net_rtp);
-	if (change_cb)
-		change_cb(ENDPOINT_NUMBER(endp), MGCP_ENDP_MDCX, endp->rtp_port, change_cb_data);
-	return send_with_sdp(endp, "MDCX", trans_id);
+		ENDPOINT_NUMBER(endp), inet_ntoa(endp->remote), ntohs(endp->net_rtp));
+	if (cfg->change_cb)
+		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_MDCX, endp->rtp_port);
+	return create_response_with_sdp(endp, "MDCX", trans_id);
 
 error:
 	LOGP(DMGCP, LOGL_ERROR, "Malformed line: %s on 0x%x with: line_start: %d %d %d\n",
 		    hexdump(msg->l3h, msgb_l3len(msg)),
 		    ENDPOINT_NUMBER(endp), line_start, i, msg->l3h[line_start]);
-	return send_response(error_code, "MDCX", trans_id);
+	return create_response(error_code, "MDCX", trans_id);
 
 error3:
-	return send_response(error_code, "MDCX", trans_id);
+	return create_response(error_code, "MDCX", trans_id);
 }
 
-static struct msgb *handle_delete_con(struct msgb *msg)
+static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 {
 	struct mgcp_msg_ptr data_ptrs[6];
 	int found, i, line_start;
@@ -789,13 +614,13 @@ static struct msgb *handle_delete_con(struct msgb *msg)
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
 
-	found = analyze_header(msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
+	found = analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
-		return send_response(error_code, "DLCX", trans_id);
+		return create_response(error_code, "DLCX", trans_id);
 
 	if (endp->ci == CI_UNUSED) {
 		LOGP(DMGCP, LOGL_ERROR, "Endpoint is not used. 0x%x\n", ENDPOINT_NUMBER(endp));
-		return send_response(error_code, "DLCX", trans_id);
+		return create_response(error_code, "DLCX", trans_id);
 	}
 
 	MSG_TOKENIZE_START
@@ -818,327 +643,103 @@ static struct msgb *handle_delete_con(struct msgb *msg)
 	}
 	MSG_TOKENIZE_END
 
-
-	/* free the connection */
-	LOGP(DMGCP, LOGL_NOTICE, "Deleting endpoint on: 0x%x\n", ENDPOINT_NUMBER(endp));
-	endp->ci= CI_UNUSED;
-	talloc_free(endp->callid);
-	talloc_free(endp->local_options);
-
-	if (!early_bind) {
-		bsc_unregister_fd(&endp->local_rtp);
-		bsc_unregister_fd(&endp->local_rtcp);
+	/* policy CB */
+	if (cfg->policy_cb) {
+		switch (cfg->policy_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_DLCX, trans_id)) {
+		case MGCP_POLICY_REJECT:
+			LOGP(DMGCP, LOGL_NOTICE, "DLCX rejected by policy on 0x%x\n",
+			     ENDPOINT_NUMBER(endp));
+			return create_response(500, "DLCX", trans_id);
+			break;
+		case MGCP_POLICY_DEFER:
+			/* stop processing */
+			return NULL;
+			break;
+		case MGCP_POLICY_CONT:
+			/* just continue */
+			break;
+		}
 	}
 
-	endp->net_rtp = endp->net_rtcp = endp->bts_rtp = endp->bts_rtcp = 0;
-	if (change_cb)
-		change_cb(ENDPOINT_NUMBER(endp), MGCP_ENDP_DLCX, endp->rtp_port, change_cb_data);
+	/* free the connection */
+	mgcp_free_endp(endp);
+	if (cfg->change_cb)
+		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_DLCX, endp->rtp_port);
 
-	return send_response(250, "DLCX", trans_id);
+	return create_response(250, "DLCX", trans_id);
 
 error:
 	LOGP(DMGCP, LOGL_ERROR, "Malformed line: %s on 0x%x with: line_start: %d %d\n",
 		    hexdump(msg->l3h, msgb_l3len(msg)),
 		    ENDPOINT_NUMBER(endp), line_start, i);
-	return send_response(error_code, "DLCX", trans_id);
+	return create_response(error_code, "DLCX", trans_id);
 
 error3:
-	return send_response(error_code, "DLCX", trans_id);
-}
-
-/*
- * vty code for mgcp below
- */
-struct cmd_node mgcp_node = {
-	MGCP_NODE,
-	"%s(mgcp)#",
-	1,
-};
-
-static int config_write_mgcp(struct vty *vty)
-{
-	vty_out(vty, "mgcp%s", VTY_NEWLINE);
-	if (local_ip)
-		vty_out(vty, " local ip %s%s", local_ip, VTY_NEWLINE);
-	if (bts_ip)
-		vty_out(vty, "  bts ip %s%s", bts_ip, VTY_NEWLINE);
-	vty_out(vty, "  bind ip %s%s", source_addr, VTY_NEWLINE);
-	vty_out(vty, "  bind port %u%s", source_port, VTY_NEWLINE);
-	vty_out(vty, "  bind early %u%s", !!early_bind, VTY_NEWLINE);
-	vty_out(vty, "  rtp base %u%s", rtp_base_port, VTY_NEWLINE);
-	vty_out(vty, "  sdp audio payload number %u%s", audio_payload, VTY_NEWLINE);
-	vty_out(vty, "  sdp audio payload name %s%s", audio_name, VTY_NEWLINE);
-	vty_out(vty, "  loop %u%s", !!audio_loop, VTY_NEWLINE);
-	vty_out(vty, "  endpoints %u%s", number_endpoints, VTY_NEWLINE);
-	if (forward_ip)
-		vty_out(vty, " forward audio ip %s%s", forward_ip, VTY_NEWLINE);
-	if (forward_port != 0)
-		vty_out(vty, " forward audio port %d%s", forward_port, VTY_NEWLINE);
-
-	return CMD_SUCCESS;
-}
-
-DEFUN(show_mcgp, show_mgcp_cmd, "show mgcp",
-      SHOW_STR "Display information about the MGCP Media Gateway")
-{
-	int i;
-
-	vty_out(vty, "MGCP is up and running with %u endpoints:%s", number_endpoints - 1, VTY_NEWLINE);
-	for (i = 1; i < number_endpoints; ++i) {
-		struct mgcp_endpoint *endp = &endpoints[i];
-		vty_out(vty, " Endpoint 0x%.2x: CI: %d net: %u/%u bts: %u/%u%s",
-			i, endp->ci,
-			ntohs(endp->net_rtp), ntohs(endp->net_rtcp),
-			ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp), VTY_NEWLINE);
-	}
-
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp,
-      cfg_mgcp_cmd,
-      "mgcp",
-      "Configure the MGCP")
-{
-	vty->node = MGCP_NODE;
-	return CMD_SUCCESS;
+	return create_response(error_code, "DLCX", trans_id);
 }
 
-DEFUN(cfg_mgcp_local_ip,
-      cfg_mgcp_local_ip_cmd,
-      "local ip IP",
-      "Set the IP to be used in SDP records")
+struct mgcp_config *mgcp_config_alloc(void)
 {
-	local_ip = talloc_strdup(tall_bsc_ctx, argv[0]);
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_bts_ip,
-      cfg_mgcp_bts_ip_cmd,
-      "bts ip IP",
-      "Set the IP of the BTS for RTP forwarding")
-{
-	bts_ip = talloc_strdup(tall_bsc_ctx, argv[0]);
-	inet_aton(bts_ip, &bts_in);
-	return CMD_SUCCESS;
-}
+	struct mgcp_config *cfg;
 
-DEFUN(cfg_mgcp_bind_ip,
-      cfg_mgcp_bind_ip_cmd,
-      "bind ip IP",
-      "Bind the MGCP to this local addr")
-{
-	source_addr = talloc_strdup(tall_bsc_ctx, argv[0]);
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_bind_port,
-      cfg_mgcp_bind_port_cmd,
-      "bind port <0-65534>",
-      "Bind the MGCP to this port")
-{
-	unsigned int port = atoi(argv[0]);
-	if (port > 65534) {
-		vty_out(vty, "%% wrong bind port '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
+	cfg = talloc_zero(NULL, struct mgcp_config);
+	if (!cfg) {
+		LOGP(DMGCP, LOGL_FATAL, "Failed to allocate config.\n");
+		return NULL;
 	}
 
-	source_port = port;
-	return CMD_SUCCESS;
-}
+	cfg->source_port = 2427;
+	cfg->source_addr = talloc_strdup(cfg, "0.0.0.0");
+	cfg->audio_name = talloc_strdup(cfg, "GSM-EFR/8000");
+	cfg->audio_payload = 97;
+	cfg->rtp_base_port = RTP_PORT_DEFAULT;
 
-DEFUN(cfg_mgcp_bind_early,
-      cfg_mgcp_bind_early_cmd,
-      "bind early (0|1)",
-      "Bind all RTP ports early")
-{
-	unsigned int bind = atoi(argv[0]);
-	if (bind != 0 && bind != 1) {
-		vty_out(vty, "%% param must be 0 or 1.%s", VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
-	early_bind = bind == 1;
-	return CMD_SUCCESS;
+	return cfg;
 }
 
-DEFUN(cfg_mgcp_rtp_base_port,
-      cfg_mgcp_rtp_base_port_cmd,
-      "rtp base <0-65534>",
-      "Base port to use")
+int mgcp_endpoints_allocate(struct mgcp_config *cfg)
 {
-	unsigned int port = atoi(argv[0]);
-	if (port > 65534) {
-		vty_out(vty, "%% wrong base port '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
+	int i;
 
-	rtp_base_port = port;
-	return CMD_SUCCESS;
-}
+	/* Initialize all endpoints */
+	cfg->endpoints = _talloc_zero_array(cfg,
+				       sizeof(struct mgcp_endpoint),
+				       cfg->number_endpoints, "endpoints");
+	if (!cfg->endpoints)
+		return -1;
 
-DEFUN(cfg_mgcp_sdp_payload_number,
-      cfg_mgcp_sdp_payload_number_cmd,
-      "sdp audio payload number <1-255>",
-      "Set the audio codec to use")
-{
-	unsigned int payload = atoi(argv[0]);
-	if (payload > 255) {
-		vty_out(vty, "%% wrong payload number '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
+	for (i = 0; i < cfg->number_endpoints; ++i) {
+		cfg->endpoints[i].local_rtp.fd = -1;
+		cfg->endpoints[i].local_rtcp.fd = -1;
+		cfg->endpoints[i].ci = CI_UNUSED;
+		cfg->endpoints[i].cfg = cfg;
+		cfg->endpoints[i].net_payload_type = -1;
+		cfg->endpoints[i].bts_payload_type = -1;
 	}
 
-	audio_payload = payload;
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_sdp_payload_name,
-      cfg_mgcp_sdp_payload_name_cmd,
-      "sdp audio payload name NAME",
-      "Set the audio name to use")
-{
-	audio_name = talloc_strdup(tall_bsc_ctx, argv[0]);
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_loop,
-      cfg_mgcp_loop_cmd,
-      "loop (0|1)",
-      "Loop the audio")
-{
-	audio_loop = atoi(argv[0]);
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_number_endp,
-      cfg_mgcp_number_endp_cmd,
-      "number endpoints <0-65534>",
-      "The number of endpoints to allocate. This is not dynamic.")
-{
-	/* + 1 as we start counting at one */
-	number_endpoints = atoi(argv[0]) + 1;
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_forward_ip,
-      cfg_mgcp_forward_ip_cmd,
-      "forward audio ip IP",
-      "Forward packets from and to the IP. This disables most of the MGCP feature.")
-{
-	if (forward_ip)
-		talloc_free(forward_ip);
-	forward_ip = talloc_strdup(tall_bsc_ctx, argv[0]);
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_mgcp_forward_port,
-      cfg_mgcp_forward_port_cmd,
-      "forward audio port <1-15000>",
-      "Forward packets from and to the port. This disables most of the MGCP feature.")
-{
-	forward_port = atoi(argv[0]);
-	return CMD_SUCCESS;
-}
-
-int mgcp_vty_init(void)
-{
-	install_element(VIEW_NODE, &show_mgcp_cmd);
-
-	install_element(CONFIG_NODE, &cfg_mgcp_cmd);
-	install_node(&mgcp_node, config_write_mgcp);
-	install_default(MGCP_NODE);
-	install_element(MGCP_NODE, &cfg_mgcp_local_ip_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_bts_ip_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_bind_ip_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_bind_port_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_bind_early_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_rtp_base_port_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_number_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_name_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_loop_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_number_endp_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_forward_ip_cmd);
-	install_element(MGCP_NODE, &cfg_mgcp_forward_port_cmd);
 	return 0;
 }
 
-int mgcp_parse_config(const char *config_file, struct gsm_network *dummy_network)
+void mgcp_free_endp(struct mgcp_endpoint *endp)
 {
-	int i, rc;
-
-	rc = vty_read_config_file(config_file);
-	if (rc < 0) {
-		fprintf(stderr, "Failed to parse the config file: '%s'\n", config_file);
-		return rc;
-	}
-
-
-	if (!bts_ip)
-		fprintf(stderr, "No BTS ip address specified. This will allow everyone to connect.\n");
+	LOGP(DMGCP, LOGL_NOTICE, "Deleting endpoint on: 0x%x\n", ENDPOINT_NUMBER(endp));
+	endp->ci= CI_UNUSED;
 
-	endpoints = _talloc_zero_array(tall_bsc_ctx,
-				       sizeof(struct mgcp_endpoint),
-				       number_endpoints, "endpoints");
-	if (!endpoints) {
-		fprintf(stderr, "Failed to allocate endpoints: %d. Quitting.\n", number_endpoints);
-		return -1;
+	if (endp->callid) {
+		talloc_free(endp->callid);
+		endp->callid = NULL;
 	}
 
-	/* Initialize all endpoints */
-	for (i = 0; i < number_endpoints; ++i) {
-		endpoints[i].local_rtp.fd = -1;
-		endpoints[i].local_rtcp.fd = -1;
-		endpoints[i].ci = CI_UNUSED;
+	if (endp->local_options) {
+		talloc_free(endp->local_options);
+		endp->callid = NULL;
 	}
 
-	/*
-	 * This application supports two modes.
-         *    1.) a true MGCP gateway with support for AUEP, CRCX, MDCX, DLCX
-         *    2.) plain forwarding of RTP packets on the endpoints.
-	 * both modes are mutual exclusive
-	 */
-	if (forward_ip) {
-		int port = rtp_base_port;
-		if (forward_port != 0)
-			port = forward_port;
-
-		if (!early_bind) {
-			LOGP(DMGCP, LOGL_NOTICE, "Forwarding requires early bind.\n");
-			return -1;
-		}
-
-		/*
-		 * Store the forward IP and assign a ci. For early bind
-		 * the sockets will be created after this.
-		 */
-		for (i = 1; i < number_endpoints; ++i) {
-			struct mgcp_endpoint *endp = &endpoints[i];
-			inet_aton(forward_ip, &endp->remote);
-			endp->ci = CI_UNUSED + 23;
-			endp->net_rtp = htons(rtp_calculate_port(ENDPOINT_NUMBER(endp), port));
-			endp->net_rtcp = htons(rtp_calculate_port(ENDPOINT_NUMBER(endp), port) + 1);
-		}
-
-		LOGP(DMGCP, LOGL_NOTICE, "Configured for Audio Forwarding.\n");
-	}
-
-	/* early bind */
-	if (early_bind) {
-		for (i = 1; i < number_endpoints; ++i) {
-			struct mgcp_endpoint *endp = &endpoints[i];
-			endp->rtp_port = rtp_calculate_port(ENDPOINT_NUMBER(endp), rtp_base_port);
-			if (bind_rtp(endp) != 0) {
-				LOGP(DMGCP, LOGL_FATAL, "Failed to bind: %d\n", endp->rtp_port);
-				return -1;
-			}
-		}
+	if (!endp->cfg->early_bind) {
+		bsc_unregister_fd(&endp->local_rtp);
+		bsc_unregister_fd(&endp->local_rtcp);
 	}
 
-	return !!forward_ip;
-}
-
-void mgcp_set_change_cb(mgcp_change cb, void *data)
-{
-	change_cb = cb;
-	change_cb_data = data;
+	endp->net_rtp = endp->net_rtcp = endp->bts_rtp = endp->bts_rtcp = 0;
+	endp->net_payload_type = endp->bts_payload_type = -1;
 }
diff --git a/openbsc/src/mgcp/mgcp_vty.c b/openbsc/src/mgcp/mgcp_vty.c
new file mode 100644
index 000000000..f13b3cfa7
--- /dev/null
+++ b/openbsc/src/mgcp/mgcp_vty.c
@@ -0,0 +1,339 @@
+/* A Media Gateway Control Protocol Media Gateway: RFC 3435 */
+/* The protocol implementation */
+
+/*
+ * (C) 2009-2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <sys/types.h>
+
+#include <osmocore/talloc.h>
+
+#include <openbsc/debug.h>
+#include <openbsc/mgcp.h>
+#include <openbsc/mgcp_internal.h>
+
+#include <vty/command.h>
+#include <vty/vty.h>
+
+static struct mgcp_config *g_cfg = NULL;
+
+/*
+ * vty code for mgcp below
+ */
+struct cmd_node mgcp_node = {
+	MGCP_NODE,
+	"%s(mgcp)#",
+	1,
+};
+
+static int config_write_mgcp(struct vty *vty)
+{
+	vty_out(vty, "mgcp%s", VTY_NEWLINE);
+	if (g_cfg->local_ip)
+		vty_out(vty, " local ip %s%s", g_cfg->local_ip, VTY_NEWLINE);
+	if (g_cfg->bts_ip)
+		vty_out(vty, "  bts ip %s%s", g_cfg->bts_ip, VTY_NEWLINE);
+	vty_out(vty, "  bind ip %s%s", g_cfg->source_addr, VTY_NEWLINE);
+	vty_out(vty, "  bind port %u%s", g_cfg->source_port, VTY_NEWLINE);
+	vty_out(vty, "  bind early %u%s", !!g_cfg->early_bind, VTY_NEWLINE);
+	vty_out(vty, "  rtp base %u%s", g_cfg->rtp_base_port, VTY_NEWLINE);
+	vty_out(vty, "  sdp audio payload number %u%s", g_cfg->audio_payload, VTY_NEWLINE);
+	vty_out(vty, "  sdp audio payload name %s%s", g_cfg->audio_name, VTY_NEWLINE);
+	vty_out(vty, "  loop %u%s", !!g_cfg->audio_loop, VTY_NEWLINE);
+	vty_out(vty, "  endpoints %u%s", g_cfg->number_endpoints, VTY_NEWLINE);
+	if (g_cfg->forward_ip)
+		vty_out(vty, " forward audio ip %s%s", g_cfg->forward_ip, VTY_NEWLINE);
+	if (g_cfg->forward_port != 0)
+		vty_out(vty, " forward audio port %d%s", g_cfg->forward_port, VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_mcgp, show_mgcp_cmd, "show mgcp",
+      SHOW_STR "Display information about the MGCP Media Gateway")
+{
+	int i;
+
+	vty_out(vty, "MGCP is up and running with %u endpoints:%s", g_cfg->number_endpoints - 1, VTY_NEWLINE);
+	for (i = 1; i < g_cfg->number_endpoints; ++i) {
+		struct mgcp_endpoint *endp = &g_cfg->endpoints[i];
+		vty_out(vty, " Endpoint 0x%.2x: CI: %d net: %u/%u bts: %u/%u%s",
+			i, endp->ci,
+			ntohs(endp->net_rtp), ntohs(endp->net_rtcp),
+			ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp), VTY_NEWLINE);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp,
+      cfg_mgcp_cmd,
+      "mgcp",
+      "Configure the MGCP")
+{
+	vty->node = MGCP_NODE;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_local_ip,
+      cfg_mgcp_local_ip_cmd,
+      "local ip IP",
+      "Set the IP to be used in SDP records")
+{
+	if (g_cfg->local_ip)
+		talloc_free(g_cfg->local_ip);
+	g_cfg->local_ip = talloc_strdup(g_cfg, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_bts_ip,
+      cfg_mgcp_bts_ip_cmd,
+      "bts ip IP",
+      "Set the IP of the BTS for RTP forwarding")
+{
+	if (g_cfg->bts_ip)
+		talloc_free(g_cfg->bts_ip);
+	g_cfg->bts_ip = talloc_strdup(g_cfg, argv[0]);
+	inet_aton(g_cfg->bts_ip, &g_cfg->bts_in);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_bind_ip,
+      cfg_mgcp_bind_ip_cmd,
+      "bind ip IP",
+      "Bind the MGCP to this local addr")
+{
+	if (g_cfg->source_addr)
+		talloc_free(g_cfg->source_addr);
+	g_cfg->source_addr = talloc_strdup(g_cfg, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_bind_port,
+      cfg_mgcp_bind_port_cmd,
+      "bind port <0-65534>",
+      "Bind the MGCP to this port")
+{
+	unsigned int port = atoi(argv[0]);
+	if (port > 65534) {
+		vty_out(vty, "%% wrong bind port '%s'%s", argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	g_cfg->source_port = port;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_bind_early,
+      cfg_mgcp_bind_early_cmd,
+      "bind early (0|1)",
+      "Bind all RTP ports early")
+{
+	unsigned int bind = atoi(argv[0]);
+	if (bind != 0 && bind != 1) {
+		vty_out(vty, "%% param must be 0 or 1.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	g_cfg->early_bind = bind == 1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_rtp_base_port,
+      cfg_mgcp_rtp_base_port_cmd,
+      "rtp base <0-65534>",
+      "Base port to use")
+{
+	unsigned int port = atoi(argv[0]);
+	if (port > 65534) {
+		vty_out(vty, "%% wrong base port '%s'%s", argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	g_cfg->rtp_base_port = port;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_sdp_payload_number,
+      cfg_mgcp_sdp_payload_number_cmd,
+      "sdp audio payload number <1-255>",
+      "Set the audio codec to use")
+{
+	unsigned int payload = atoi(argv[0]);
+	if (payload > 255) {
+		vty_out(vty, "%% wrong payload number '%s'%s", argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	g_cfg->audio_payload = payload;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_sdp_payload_name,
+      cfg_mgcp_sdp_payload_name_cmd,
+      "sdp audio payload name NAME",
+      "Set the audio name to use")
+{
+	if (g_cfg->audio_name)
+		talloc_free(g_cfg->audio_name);
+	g_cfg->audio_name = talloc_strdup(g_cfg, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_loop,
+      cfg_mgcp_loop_cmd,
+      "loop (0|1)",
+      "Loop the audio")
+{
+	g_cfg->audio_loop = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_number_endp,
+      cfg_mgcp_number_endp_cmd,
+      "number endpoints <0-65534>",
+      "The number of endpoints to allocate. This is not dynamic.")
+{
+	/* + 1 as we start counting at one */
+	g_cfg->number_endpoints = atoi(argv[0]) + 1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_forward_ip,
+      cfg_mgcp_forward_ip_cmd,
+      "forward audio ip IP",
+      "Forward packets from and to the IP. This disables most of the MGCP feature.")
+{
+	if (g_cfg->forward_ip)
+		talloc_free(g_cfg->forward_ip);
+	g_cfg->forward_ip = talloc_strdup(g_cfg, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mgcp_forward_port,
+      cfg_mgcp_forward_port_cmd,
+      "forward audio port <1-15000>",
+      "Forward packets from and to the port. This disables most of the MGCP feature.")
+{
+	g_cfg->forward_port = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+int mgcp_vty_init(void)
+{
+	install_element(VIEW_NODE, &show_mgcp_cmd);
+
+	install_element(CONFIG_NODE, &cfg_mgcp_cmd);
+	install_node(&mgcp_node, config_write_mgcp);
+	install_default(MGCP_NODE);
+	install_element(MGCP_NODE, &cfg_mgcp_local_ip_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_bts_ip_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_bind_ip_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_bind_port_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_bind_early_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_rtp_base_port_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_number_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_name_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_loop_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_number_endp_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_forward_ip_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_forward_port_cmd);
+	return 0;
+}
+
+int mgcp_parse_config(const char *config_file, struct mgcp_config *cfg)
+{
+	int i, rc;
+
+	g_cfg = cfg;
+	rc = vty_read_config_file(config_file);
+	if (rc < 0) {
+		fprintf(stderr, "Failed to parse the config file: '%s'\n", config_file);
+		return rc;
+	}
+
+
+	if (!g_cfg->bts_ip)
+		fprintf(stderr, "No BTS ip address specified. This will allow everyone to connect.\n");
+
+	if (mgcp_endpoints_allocate(g_cfg) != 0) {
+		fprintf(stderr, "Failed to allocate endpoints: %d. Quitting.\n", g_cfg->number_endpoints);
+		return -1;
+	}
+
+	/*
+	 * This application supports two modes.
+         *    1.) a true MGCP gateway with support for AUEP, CRCX, MDCX, DLCX
+         *    2.) plain forwarding of RTP packets on the endpoints.
+	 * both modes are mutual exclusive
+	 */
+	if (g_cfg->forward_ip) {
+		int port = g_cfg->rtp_base_port;
+		if (g_cfg->forward_port != 0)
+			port = g_cfg->forward_port;
+
+		if (!g_cfg->early_bind) {
+			LOGP(DMGCP, LOGL_NOTICE, "Forwarding requires early bind.\n");
+			return -1;
+		}
+
+		/*
+		 * Store the forward IP and assign a ci. For early bind
+		 * the sockets will be created after this.
+		 */
+		for (i = 1; i < g_cfg->number_endpoints; ++i) {
+			struct mgcp_endpoint *endp = &g_cfg->endpoints[i];
+			inet_aton(g_cfg->forward_ip, &endp->remote);
+			endp->ci = CI_UNUSED + 23;
+			endp->net_rtp = htons(rtp_calculate_port(ENDPOINT_NUMBER(endp), port));
+			endp->net_rtcp = htons(rtp_calculate_port(ENDPOINT_NUMBER(endp), port) + 1);
+		}
+
+		LOGP(DMGCP, LOGL_NOTICE, "Configured for Audio Forwarding.\n");
+	}
+
+	/* early bind */
+	if (g_cfg->early_bind) {
+		for (i = 1; i < g_cfg->number_endpoints; ++i) {
+			struct mgcp_endpoint *endp = &g_cfg->endpoints[i];
+			int rtp_port;
+
+			rtp_port = rtp_calculate_port(ENDPOINT_NUMBER(endp), g_cfg->rtp_base_port);
+			if (mgcp_bind_rtp_port(endp, rtp_port) != 0) {
+				LOGP(DMGCP, LOGL_FATAL, "Failed to bind: %d\n", rtp_port);
+				return -1;
+			}
+		}
+	}
+
+	return !!g_cfg->forward_ip;
+}
+
+struct gsm_network;
+int bsc_vty_init(struct gsm_network *dummy)
+{
+	cmd_init(1);
+	vty_init();
+
+        mgcp_vty_init();
+	return 0;
+}
+
diff --git a/openbsc/src/rtp_proxy.c b/openbsc/src/rtp_proxy.c
index 9b1f4d91b..9f2e2fd76 100644
--- a/openbsc/src/rtp_proxy.c
+++ b/openbsc/src/rtp_proxy.c
@@ -19,6 +19,7 @@
  *
  */
 
+#include <endian.h>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/socket.h>
@@ -63,12 +64,21 @@ struct rtcp_hdr {
 
 /* according to RFC 3550 */
 struct rtp_hdr {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
 	u_int8_t  csrc_count:4,
 		  extension:1,
 		  padding:1,
 		  version:2;
 	u_int8_t  payload_type:7,
 		  marker:1;
+#elif __BYTE_ORDER == __BIG_ENDIAN
+	u_int8_t  version:2,
+		  padding:1,
+		  extension:1,
+		  csrc_count:4;
+	u_int8_t  marker:1,
+		  payload_type:7;
+#endif
 	u_int16_t sequence;
 	u_int32_t timestamp;
 	u_int32_t ssrc;
diff --git a/openbsc/src/sccp/sccp.c b/openbsc/src/sccp/sccp.c
index 9cd7c9c68..b1da2c721 100644
--- a/openbsc/src/sccp/sccp.c
+++ b/openbsc/src/sccp/sccp.c
@@ -471,6 +471,25 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 	return 0;
 }
 
+static int _sccp_parse_it(struct msgb *msgb, struct sccp_parse_result *result)
+{
+	static const u_int32_t header_size = sizeof(struct sccp_data_it);
+
+	struct sccp_data_it *it;
+
+	if (msgb_l2len(msgb) < header_size) {
+		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		        msgb_l2len(msgb), header_size);
+		return -1;
+	}
+
+	it = (struct sccp_data_it *) msgb->l2h;
+	result->data_len = 0;
+	result->source_local_reference = &it->source_local_reference;
+	result->destination_local_reference = &it->destination_local_reference;
+	return 0;
+}
+
 
 /*
  * Send UDT. Currently we have a fixed address...
@@ -1307,8 +1326,12 @@ int sccp_parse_header(struct msgb *msg, struct sccp_parse_result *result)
 	case SCCP_MSG_TYPE_UDT:
 		return _sccp_parse_udt(msg, result);
 		break;
+	case SCCP_MSG_TYPE_IT:
+		return _sccp_parse_it(msg, result);
+		break;
 	};
 
+	LOGP(DSCCP, LOGL_ERROR, "Unimplemented MSG Type: 0x%x\n", type);
 	return -1;
 }
 
diff --git a/openbsc/src/system_information.c b/openbsc/src/system_information.c
index b2f77706c..7015b3806 100644
--- a/openbsc/src/system_information.c
+++ b/openbsc/src/system_information.c
@@ -287,9 +287,9 @@ static int generate_si3(u_int8_t *output, struct gsm_bts *bts)
 	si3->header.system_information = GSM48_MT_RR_SYSINFO_3;
 
 	si3->cell_identity = htons(bts->cell_identity);
-	gsm0408_generate_lai(&si3->lai, bts->network->country_code,
-			     bts->network->network_code,
-			     bts->location_area_code);
+	gsm48_generate_lai(&si3->lai, bts->network->country_code,
+			   bts->network->network_code,
+			   bts->location_area_code);
 	si3->control_channel_desc = bts->si_common.chan_desc;
 	si3->cell_options = bts->si_common.cell_options;
 	si3->cell_sel_par = bts->si_common.cell_sel_par;
@@ -319,9 +319,9 @@ static int generate_si4(u_int8_t *output, struct gsm_bts *bts)
 	si4->header.skip_indicator = 0;
 	si4->header.system_information = GSM48_MT_RR_SYSINFO_4;
 
-	gsm0408_generate_lai(&si4->lai, bts->network->country_code,
-			     bts->network->network_code,
-			     bts->location_area_code);
+	gsm48_generate_lai(&si4->lai, bts->network->country_code,
+			   bts->network->network_code,
+			   bts->location_area_code);
 	si4->cell_sel_par = bts->si_common.cell_sel_par;
 	si4->rach_control = bts->si_common.rach_control;
 
@@ -384,9 +384,9 @@ static int generate_si6(u_int8_t *output, struct gsm_bts *bts)
 	si6->skip_indicator = 0;
 	si6->system_information = GSM48_MT_RR_SYSINFO_6;
 	si6->cell_identity = htons(bts->cell_identity);
-	gsm0408_generate_lai(&si6->lai, bts->network->country_code,
-			     bts->network->network_code,
-			     bts->location_area_code);
+	gsm48_generate_lai(&si6->lai, bts->network->country_code,
+			   bts->network->network_code,
+			   bts->location_area_code);
 	si6->cell_options = bts->si_common.cell_options;
 	si6->ncc_permitted = bts->si_common.ncc_permitted;
 
diff --git a/openbsc/tests/channel/Makefile.am b/openbsc/tests/channel/Makefile.am
index 8e57b8d0c..772965953 100644
--- a/openbsc/tests/channel/Makefile.am
+++ b/openbsc/tests/channel/Makefile.am
@@ -1,5 +1,5 @@
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
-AM_CFLAGS=-Wall -ggdb3
+AM_CFLAGS=-Wall -ggdb3 $(LIBOSMOCORE_CFLAGS)
 
 noinst_PROGRAMS = channel_test
 
diff --git a/openbsc/tests/db/Makefile.am b/openbsc/tests/db/Makefile.am
index 85f2c146a..6eb9180ce 100644
--- a/openbsc/tests/db/Makefile.am
+++ b/openbsc/tests/db/Makefile.am
@@ -1,5 +1,5 @@
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
-AM_CFLAGS=-Wall -ggdb3
+AM_CFLAGS=-Wall -ggdb3 $(LIBOSMOCORE_CFLAGS)
 
 noinst_PROGRAMS = db_test
 
diff --git a/openbsc/tests/debug/Makefile.am b/openbsc/tests/debug/Makefile.am
index 86cd7b323..8423fd178 100644
--- a/openbsc/tests/debug/Makefile.am
+++ b/openbsc/tests/debug/Makefile.am
@@ -1,4 +1,5 @@
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS=-Wall $(LIBOSMOCORE_CFLAGS)
 noinst_PROGRAMS = debug_test
 
 debug_test_SOURCES = debug_test.c $(top_srcdir)/src/debug.c 
diff --git a/openbsc/tests/gsm0408/Makefile.am b/openbsc/tests/gsm0408/Makefile.am
index 44ca96cf0..f98c673ea 100644
--- a/openbsc/tests/gsm0408/Makefile.am
+++ b/openbsc/tests/gsm0408/Makefile.am
@@ -1,4 +1,5 @@
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS=-Wall $(LIBOSMOCORE_CFLAGS)
 noinst_PROGRAMS = gsm0408_test
 
 gsm0408_test_SOURCES = gsm0408_test.c
diff --git a/openbsc/tests/gsm0408/gsm0408_test.c b/openbsc/tests/gsm0408/gsm0408_test.c
index bbf812965..287d4ee99 100644
--- a/openbsc/tests/gsm0408/gsm0408_test.c
+++ b/openbsc/tests/gsm0408/gsm0408_test.c
@@ -23,6 +23,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <arpa/inet.h>
+
 #include <openbsc/gsm_04_08.h>
 #include <openbsc/gsm_subscriber.h>
 #include <openbsc/debug.h>
@@ -52,13 +54,13 @@ static void test_location_area_identifier(void)
      * Test the default/test setup. Coming from
      * bsc_hack.c dumps
      */
-    gsm0408_generate_lai(&lai48, 1, 1, 1);
+    gsm48_generate_lai(&lai48, 1, 1, 1);
     COMPARE(lai48.digits[0], ==, 0x00);
     COMPARE(lai48.digits[1], ==, 0xF1);
     COMPARE(lai48.digits[2], ==, 0x10);
     COMPARE(lai48.lac, ==, htons(0x0001));
 
-    gsm0408_generate_lai(&lai48, 602, 1, 15);
+    gsm48_generate_lai(&lai48, 602, 1, 15);
     COMPARE(lai48.digits[0], ==, 0x06);
     COMPARE(lai48.digits[1], ==, 0xF2);
     COMPARE(lai48.digits[2], ==, 0x10);
@@ -97,6 +99,8 @@ int main(int argc, char** argv)
 {
 	test_location_area_identifier();
 	test_mi_functionality();
+
+	exit(0);
 }
 
 
diff --git a/openbsc/tests/sccp/Makefile.am b/openbsc/tests/sccp/Makefile.am
index 4152a9a54..b35693e82 100644
--- a/openbsc/tests/sccp/Makefile.am
+++ b/openbsc/tests/sccp/Makefile.am
@@ -1,5 +1,5 @@
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
-AM_CFLAGS=-Wall -ggdb3
+AM_CFLAGS=-Wall -ggdb3 $(LIBOSMOCORE_CFLAGS)
 
 noinst_PROGRAMS = sccp_test
 
diff --git a/openbsc/tests/sccp/sccp_test.c b/openbsc/tests/sccp/sccp_test.c
index 982c168be..eb41d3eaf 100644
--- a/openbsc/tests/sccp/sccp_test.c
+++ b/openbsc/tests/sccp/sccp_test.c
@@ -244,6 +244,52 @@ static const struct connection_test connection_tests[] = {
 	},
 };
 
+struct sccp_parse_header_result {
+	/* results */
+	int msg_type;
+	int wanted_len;
+	int src_ssn;
+	int dst_ssn;
+
+	int has_src_ref, has_dst_ref;
+	struct sccp_source_reference src_ref;
+	struct sccp_source_reference dst_ref;
+
+	/* the input */
+	const u_int8_t *input;
+	int input_len;
+};
+
+static const u_int8_t it_test[] = {
+0x10, 0x01, 0x07, 
+0x94, 0x01, 0x04, 0x00, 0x02, 0x00, 0x00, 0x00 };
+
+static const struct sccp_parse_header_result parse_result[] = {
+	{
+		.msg_type	= SCCP_MSG_TYPE_IT,
+		.wanted_len	= 0,
+		.src_ssn	= -1,
+		.dst_ssn	= -1,
+		.has_src_ref	= 1,
+		.has_dst_ref	= 1,
+
+		.src_ref	= {
+			.octet1 = 0x01,
+			.octet2 = 0x04,
+			.octet3 = 0x00
+		},
+		.dst_ref	= {
+			.octet1 = 0x01,
+			.octet2 = 0x07,
+			.octet3 = 0x94,
+		},
+
+		.input		= it_test,
+		.input_len	= sizeof(it_test),
+	},
+};
+
+
 /* testing procedure:
  *	- we will use sccp_write and see what will be set in the
  *	  outgoing callback
@@ -714,6 +760,59 @@ static void test_sccp_system_crash(void)
 	printf("survived\n");
 }
 
+static void test_sccp_parsing(void)
+{
+	for (current_test = 0; current_test < ARRAY_SIZE(parse_result); ++current_test) {
+		struct msgb *msg;
+		struct sccp_parse_result result;
+
+		msg = msgb_alloc_headroom(1024, 128, "parse-test");
+		msgb_put(msg, 1);
+		msg->l2h = msgb_put(msg, parse_result[current_test].input_len);
+		memcpy(msg->l2h, parse_result[current_test].input, msgb_l2len(msg));
+
+		memset(&result, 0, sizeof(result));
+		if (sccp_parse_header(msg, &result) != 0) {
+			fprintf(stderr, "Failed to parse test: %d\n", current_test);
+		} else {
+			if (parse_result[current_test].wanted_len != result.data_len) {
+				fprintf(stderr, "Unexpected data length.\n");
+				abort();
+			}
+
+			if (parse_result[current_test].has_src_ref) {
+				if (memcmp(result.source_local_reference,
+					   &parse_result[current_test].src_ref,
+					   sizeof(struct sccp_source_reference)) != 0) {
+					fprintf(stderr, "SRC REF did not match\n");
+					abort();
+				}
+			}
+
+			if (parse_result[current_test].has_dst_ref) {
+				if (memcmp(result.destination_local_reference,
+					   &parse_result[current_test].dst_ref,
+					   sizeof(struct sccp_source_reference)) != 0) {
+					fprintf(stderr, "DST REF did not match\n");
+					abort();
+				}
+			}
+
+			if (parse_result[current_test].src_ssn != -1) {
+				fprintf(stderr, "Not implemented.\n");
+				abort();
+			}
+
+			if (parse_result[current_test].dst_ssn != -1) {
+				fprintf(stderr, "Not implemented.\n");
+				abort();
+			}
+		}
+
+		msgb_free(msg);
+	}
+}
+
 
 int main(int argc, char **argv)
 {
@@ -722,6 +821,7 @@ int main(int argc, char **argv)
 	test_sccp_udt_communication();
 	test_sccp_connection();
 	test_sccp_system_crash();
+	test_sccp_parsing();
 	return 0;
 }