From e740665cabf3915137bb228a70ab7cc379c86417 Mon Sep 17 00:00:00 2001
From: Pau Espin Pedrol <pespin@sysmocom.de>
Date: Tue, 4 Oct 2022 11:58:56 +0200
Subject: [PATCH] Fix regression in detection of legacy dummy packets

A commit refactored this code around one year ago, which broke osmux
detection of dummy messages. This commit partially reverts the earlier
commit and rearranges the existing code to make it more robust.

Fixes: b3d14eb552cba1c58970acf90dae1bee291d5293
Change-Id: Iedf085932c45af5d13e04e56a4cd1082de81d869
---
 include/osmocom/mgcp/mgcp_network.h |  3 ++-
 src/libosmo-mgcp/mgcp_osmux.c       | 30 +++++++----------------------
 2 files changed, 9 insertions(+), 24 deletions(-)

diff --git a/include/osmocom/mgcp/mgcp_network.h b/include/osmocom/mgcp/mgcp_network.h
index 5668711e4..854c92d4a 100644
--- a/include/osmocom/mgcp/mgcp_network.h
+++ b/include/osmocom/mgcp/mgcp_network.h
@@ -9,7 +9,8 @@
 
 /* The following constant defines an RTP dummy payload that is used for
  * "UDP Hole Punching" (NAT) */
-static const char rtp_dummy_payload[] = { 0x23 };
+#define MGCP_DUMMY_LOAD 0x23
+static const char rtp_dummy_payload[] = { MGCP_DUMMY_LOAD };
 
 /* Check if the data in a given message buffer matches the rtp dummy payload
  * defined above */
diff --git a/src/libosmo-mgcp/mgcp_osmux.c b/src/libosmo-mgcp/mgcp_osmux.c
index aae957976..23e4dad8f 100644
--- a/src/libosmo-mgcp/mgcp_osmux.c
+++ b/src/libosmo-mgcp/mgcp_osmux.c
@@ -363,30 +363,14 @@ static int endp_osmux_state_check(struct mgcp_endpoint *endp, struct mgcp_conn_r
 	}
 }
 
-static int osmux_legacy_dummy_parse_cid(const struct osmo_sockaddr *rem_addr, struct msgb *msg,
-					uint8_t *osmux_cid)
-{
-	if (msg->len < 1 + sizeof(*osmux_cid)) {
-		LOGP(DOSMUX, LOGL_ERROR,
-		     "Discarding truncated Osmux dummy load: %s\n", osmo_hexdump(msg->data, msg->len));
-		return -1;
-	}
-
-	/* extract the osmux CID from the dummy message */
-	memcpy(osmux_cid, &msg->data[1], sizeof(*osmux_cid));
-	return 0;
-}
-
-/* This is called from the bsc-nat */
-static int osmux_handle_dummy(struct mgcp_trunk *trunk, const struct osmo_sockaddr *rem_addr,
+/* Old versions of osmux used to send dummy packets [0x23 0x<CID>] to punch the
+ * hole in the NAT. Let's handle them speficially. */
+static int osmux_handle_legacy_dummy(struct mgcp_trunk *trunk, const struct osmo_sockaddr *rem_addr,
 			      struct msgb *msg)
 {
-	uint8_t osmux_cid;
+	uint8_t osmux_cid = msg->data[1];
 	struct mgcp_conn_rtp *conn;
 
-	if (osmux_legacy_dummy_parse_cid(rem_addr, msg, &osmux_cid) < 0)
-		goto out;
-
 	conn = osmux_conn_lookup(trunk, osmux_cid, rem_addr);
 	if (!conn) {
 		LOGP(DOSMUX, LOGL_DEBUG,
@@ -426,9 +410,9 @@ static int osmux_read_fd_cb(struct osmo_fd *ofd, unsigned int what)
 		goto out;
 	}
 
-	/* not any further processing dummy messages */
-	if (mgcp_is_rtp_dummy_payload(msg))
-		return osmux_handle_dummy(trunk, &rem_addr, msg);
+	/* Catch legacy dummy message and process them separately: */
+	if (msg->len == 2 && msg->data[0] == MGCP_DUMMY_LOAD)
+		return osmux_handle_legacy_dummy(trunk, &rem_addr, msg);
 
 	rem = msg->len;
 	while((osmuxh = osmux_xfrm_output_pull(msg)) != NULL) {