nat: Test for a bug inside the TLV definition for GSM 08.08

The 0x1 inside a CIC IE could indicate a new IE... add test data
and test case to verify that the patching works correctly.

2 files changed, 22 insertions, 3 deletions

diff --git a/openbsc/tests/bsc-nat/bsc_data.c b/openbsc/tests/bsc-nat/bsc_data.c
index 1bc15c873..f4dba0a3c 100644
--- a/openbsc/tests/bsc-nat/bsc_data.c
+++ b/openbsc/tests/bsc-nat/bsc_data.c
@@ -86,7 +86,7 @@ static const uint8_t ass_cmd[] = {
 0x00, 0x12, 0xfd, 0x06,
 0x00, 0x00, 0x49, 0x00, 0x01, 0x0b, 0x00, 0x09,
 0x01, 0x0b, 0x03, 0x01, 0x0a, 0x11, 0x01, 0x00,
-0x15 };
+0x01 };
 
 /* identity response */
 static const uint8_t id_resp[] = {
diff --git a/openbsc/tests/bsc-nat/bsc_nat_test.c b/openbsc/tests/bsc-nat/bsc_nat_test.c
index e1a17acc9..4ab44de2f 100644
--- a/openbsc/tests/bsc-nat/bsc_nat_test.c
+++ b/openbsc/tests/bsc-nat/bsc_nat_test.c
@@ -446,13 +446,22 @@ static void test_mgcp_ass_tracking(void)
 	msg = msgb_alloc(4096, "foo");
 	copy_to_msg(msg, ass_cmd, sizeof(ass_cmd));
 	parsed = bsc_nat_parse(msg);
+
+	if (msg->l2h[16] != 0 ||
+	    msg->l2h[17] != 0x1) {
+		fprintf(stderr, "Input is not as expected.. %s 0x%x\n",
+			hexdump(msg->l2h, msgb_l2len(msg)),
+			msg->l2h[17]);
+		abort();
+	}
+
 	if (bsc_mgcp_assign_patch(&con, msg) != 0) {
 		fprintf(stderr, "Failed to handle assignment.\n");
 		abort();
 	}
 
-	if (con.msc_endp != 21) {
-		fprintf(stderr, "Timeslot should be 21.\n");
+	if (con.msc_endp != 1) {
+		fprintf(stderr, "Timeslot should be 1.\n");
 		abort();
 	}
 
@@ -465,6 +474,16 @@ static void test_mgcp_ass_tracking(void)
 		abort();
 	}
 
+	int multiplex, timeslot;
+	mgcp_endpoint_to_timeslot(0x1b, &multiplex, &timeslot);
+
+	uint16_t cic = htons(timeslot & 0x1f);
+	if (memcmp(&cic, &msg->l2h[16], sizeof(cic)) != 0) {
+		fprintf(stderr, "Message was not patched properly\n");
+		fprintf(stderr, "data cic: 0x%x %s\n", cic, hexdump(msg->l2h, msgb_l2len(msg)));
+		abort();
+	}
+
 	talloc_free(parsed);
 
 	bsc_mgcp_dlcx(&con);