diff --git a/daemon/call.c b/daemon/call.c
index 27d730c8d..059d2000f 100644
--- a/daemon/call.c
+++ b/daemon/call.c
@@ -1176,14 +1176,16 @@ static int get_port6(struct udp_fd *r, u_int16_t p, struct callmaster *m) {
 
 	nonblock(fd);
 	reuseaddr(fd);
-	tos = m->conf.tos;
+	ipv6only(fd, 0);
+	if (m->conf.tos)
+		setsockopt(fd, IPPROTO_IP, IP_TOS, &m->conf.tos, sizeof(m->conf.tos));
 #ifdef IPV6_TCLASS
+	tos = m->conf.tos;
 	if (tos)
 		setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &tos, sizeof(tos));
 #else
 #warning "Will not set IPv6 traffic class"
 #endif
-	ipv6only(fd, 0);
 
 	ZERO(sin);
 	sin.sin6_family = AF_INET6;
diff --git a/daemon/sdp.c b/daemon/sdp.c
index 60343acd4..50b198b32 100644
--- a/daemon/sdp.c
+++ b/daemon/sdp.c
@@ -758,15 +758,7 @@ void sdp_free(GQueue *sessions) {
 static int fill_stream_address(struct stream_input *si, struct sdp_media *media, struct sdp_ng_flags *flags) {
 	struct sdp_session *session = media->session;
 
-	if (flags->media_address.s) {
-		if (is_addr_unspecified(&flags->parsed_media_address)) {
-			if (__parse_address(&flags->parsed_media_address, NULL, NULL,
-						&flags->media_address))
-				return -1;
-		}
-		si->stream.ip46 = flags->parsed_media_address;
-	}
-	else if (!flags->trust_address) {
+	if (!flags->trust_address) {
 		if (is_addr_unspecified(&flags->parsed_received_from)) {
 			if (__parse_address(&flags->parsed_received_from, NULL, &flags->received_from_family,
 						&flags->received_from_address))
@@ -1095,7 +1087,7 @@ static int insert_ice_address_alt(struct sdp_chopper *chop, struct streamrelay *
 }
 
 static int replace_network_address(struct sdp_chopper *chop, struct network_address *address,
-		struct streamrelay *sr)
+		struct streamrelay *sr, struct sdp_ng_flags *flags)
 {
 	char buf[64];
 	int len;
@@ -1106,9 +1098,20 @@ static int replace_network_address(struct sdp_chopper *chop, struct network_addr
 	if (copy_up_to(chop, &address->address_type))
 		return -1;
 
-	mutex_lock(&sr->up->up->lock);
-	call_stream_address(buf, sr->up, SAF_NG, &len);
-	mutex_unlock(&sr->up->up->lock);
+	if (!is_addr_unspecified(&flags->parsed_media_address)) {
+		if (IN6_IS_ADDR_V4MAPPED(&flags->parsed_media_address))
+			len = sprintf(buf, "IP4 " IPF, IPP(flags->parsed_media_address.s6_addr32[3]));
+		else {
+			memcpy(buf, "IP6 ", 4);
+			inet_ntop(AF_INET6, &flags->parsed_media_address, buf + 4, sizeof(buf)-4);
+			len = strlen(buf);
+		}
+	}
+	else {
+		mutex_lock(&sr->up->up->lock);
+		call_stream_address(buf, sr->up, SAF_NG, &len);
+		mutex_unlock(&sr->up->up->lock);
+	}
 	chopper_append_dup(chop, buf, len);
 
 	if (skip_over(chop, &address->address))
@@ -1454,6 +1457,13 @@ int sdp_replace(struct sdp_chopper *chop, GQueue *sessions, struct call *call,
 	off = opmode;
 	m = call->callstreams->head;
 	do_ice = (flags->ice_force || (!has_ice(sessions) && !flags->ice_remove)) ? 1 : 0;
+	if (flags->media_address.s) {
+		if (is_addr_unspecified(&flags->parsed_media_address)) {
+			if (__parse_address(&flags->parsed_media_address, NULL, NULL,
+						&flags->media_address))
+				return -1;
+		}
+	}
 
 	for (l = sessions->head; l; l = l->next) {
 		session = l->data;
@@ -1474,11 +1484,11 @@ int sdp_replace(struct sdp_chopper *chop, GQueue *sessions, struct call *call,
 		fill_relays(&rtp, &rtcp, m, off, NULL, NULL);
 
 		if (session->origin.parsed && flags->replace_origin) {
-			if (replace_network_address(chop, &session->origin.address, rtp))
+			if (replace_network_address(chop, &session->origin.address, rtp, flags))
 				goto error;
 		}
 		if (session->connection.parsed && sess_conn) {
-			if (replace_network_address(chop, &session->connection.address, rtp))
+			if (replace_network_address(chop, &session->connection.address, rtp, flags))
 				goto error;
 		}
 
@@ -1515,7 +1525,7 @@ int sdp_replace(struct sdp_chopper *chop, GQueue *sessions, struct call *call,
 				goto error;
 
 			if (media->connection.parsed) {
-				if (replace_network_address(chop, &media->connection.address, rtp))
+				if (replace_network_address(chop, &media->connection.address, rtp, flags))
 					goto error;
 			}
 
diff --git a/debian/changelog b/debian/changelog
index 3588aaede..27ccb322a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+ngcp-mediaproxy-ng (2.3.5+0~mr3.3) unstable; urgency=low
+
+  [ Richard Fuchs ]
+  * [eec41b8] fix mem leak
+  * [3c4b387] fix the "media address" parameter to comply with the docs
+  * [0f99aea] fix simulator rtcp-mux bug
+
+  [ Sipwise Jenkins Builder ]
+
+ -- Sipwise Jenkins Builder <jenkins@sipwise.com>  Sat, 01 Feb 2014 19:48:40 +0100
+
 ngcp-mediaproxy-ng (2.3.5) unstable; urgency=low
 
   * update desired address family (based on "direction") when branching
diff --git a/el/README.md b/el/README.el.md
similarity index 100%
rename from el/README.md
rename to el/README.el.md
diff --git a/el/mediaproxy-ng.spec b/el/mediaproxy-ng.spec
index 4893b7ec8..b16763d24 100644
--- a/el/mediaproxy-ng.spec
+++ b/el/mediaproxy-ng.spec
@@ -1,12 +1,12 @@
 Name:		ngcp-mediaproxy-ng
-Version:	2.3.2
+Version:	2.3.5
 Release:	0%{?dist}
 Summary:	The Sipwise NGCP mediaproxy-ng
 
 Group:		System Environment/Daemons
 License:	GPLv3
-URL:		https://github.com/crocodilertc/mediaproxy-ng
-Source:		%{name}-%{version}.tar.gz
+URL:		https://github.com/sipwise/mediaproxy-ng
+Source0:	https://github.com/sipwise/mediaproxy-ng/archive/%{version}/%{name}-%{version}.tar.gz
 Conflicts:	%{name}-kernel < %{version}
 BuildRoot:	%(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
@@ -59,47 +59,29 @@ cd ..
 
 
 %install
-[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf "$RPM_BUILD_ROOT"
-
 # Install the userspace daemon
-mkdir -p $RPM_BUILD_ROOT/%{_sbindir}
-install -m755 daemon/mediaproxy-ng $RPM_BUILD_ROOT/%{_sbindir}/mediaproxy-ng
+install -D -p -m755 daemon/mediaproxy-ng %{buildroot}/%{_sbindir}/mediaproxy-ng
 
 ## Install the init.d script and configuration file
-mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/rc.d/init.d
-install -m755 el/mediaproxy-ng.init \
-	$RPM_BUILD_ROOT/%{_sysconfdir}/rc.d/init.d/mediaproxy-ng
-mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sysconfig
-install -m644 el/mediaproxy-ng.sysconfig \
-	$RPM_BUILD_ROOT/%{_sysconfdir}/sysconfig/mediaproxy-ng
-mkdir -p $RPM_BUILD_ROOT/%{_sharedstatedir}/mediaproxy-ng
+install -D -p -m755 el/mediaproxy-ng.init \
+	%{buildroot}/%{_sysconfdir}/rc.d/init.d/mediaproxy-ng
+install -D -p -m644 el/mediaproxy-ng.sysconfig \
+	%{buildroot}/%{_sysconfdir}/sysconfig/mediaproxy-ng
+mkdir -p %{buildroot}/%{_sharedstatedir}/mediaproxy-ng
 
 # Install the iptables plugin
-mkdir -p $RPM_BUILD_ROOT/%{_lib}/xtables
-install -m755 iptables-extension/libxt_MEDIAPROXY.so \
-	$RPM_BUILD_ROOT/%{_lib}/xtables/libxt_MEDIAPROXY.so
-
-# Install the documentation
-mkdir -p $RPM_BUILD_ROOT/%{_docdir}/%{name}-%{version}-%{release}
-install -m644 README.md \
-	$RPM_BUILD_ROOT/%{_docdir}/%{name}-%{version}-%{release}/README.md
-install -m644 debian/changelog \
-	$RPM_BUILD_ROOT/%{_docdir}/%{name}-%{version}-%{release}/changelog
-install -m644 debian/copyright \
-	$RPM_BUILD_ROOT/%{_docdir}/%{name}-%{version}-%{release}/copyright
-install -m644 el/README.md \
-	$RPM_BUILD_ROOT/%{_docdir}/%{name}-%{version}-%{release}/README.el.md
+install -D -p -m755 iptables-extension/libxt_MEDIAPROXY.so \
+	%{buildroot}/%{_lib}/xtables/libxt_MEDIAPROXY.so
 
 ## DKMS module source install
-mkdir -p $RPM_BUILD_ROOT/%{_usrsrc}/%{name}-%{version}-%{release}
-install -m644 kernel-module/Makefile \
-	 $RPM_BUILD_ROOT/%{_usrsrc}/%{name}-%{version}-%{release}/Makefile
-install -m644 kernel-module/xt_MEDIAPROXY.c \
-	 $RPM_BUILD_ROOT/%{_usrsrc}/%{name}-%{version}-%{release}/xt_MEDIAPROXY.c
-install -m644 kernel-module/xt_MEDIAPROXY.h \
-	 $RPM_BUILD_ROOT/%{_usrsrc}/%{name}-%{version}-%{release}/xt_MEDIAPROXY.h
+install -D -p -m644 kernel-module/Makefile \
+	 %{buildroot}/%{_usrsrc}/%{name}-%{version}-%{release}/Makefile
+install -D -p -m644 kernel-module/xt_MEDIAPROXY.c \
+	 %{buildroot}/%{_usrsrc}/%{name}-%{version}-%{release}/xt_MEDIAPROXY.c
+install -D -p -m644 kernel-module/xt_MEDIAPROXY.h \
+	 %{buildroot}/%{_usrsrc}/%{name}-%{version}-%{release}/xt_MEDIAPROXY.h
 sed "s/__VERSION__/%{version}-%{release}/g" debian/dkms.conf.in > \
-	$RPM_BUILD_ROOT/%{_usrsrc}/%{name}-%{version}-%{release}/dkms.conf
+	%{buildroot}/%{_usrsrc}/%{name}-%{version}-%{release}/dkms.conf
 
 
 %clean
@@ -108,13 +90,15 @@ rm -rf %{buildroot}
 
 %pre
 /usr/sbin/groupadd -r mediaproxy-ng 2> /dev/null || :
-/usr/sbin/usradd -r -g mediaproxy-ng -s /bin/false -c "mediaproxy-ng daemon" \
-	-d %{_docdir}/%{name}-%{version}-%{release} mediaproxy-ng \
+/usr/sbin/useradd -r -g mediaproxy-ng -s /sbin/nologin -c "mediaproxy-ng daemon" \
+	-d %{_sharedstatedir}/mediaproxy-ng mediaproxy-ng \
 	2> /dev/null || :
 
 
 %post
-/sbin/chkconfig --add mediaproxy-ng
+if [ $1 -eq 1 ]; then
+        /sbin/chkconfig --add %{name} || :
+fi
 
 
 %post dkms
@@ -126,8 +110,10 @@ true
 
 
 %preun
-/sbin/service mediaproxy-ng stop
-/sbin/chkconfig --del mediaproxy-ng
+if [ $1 = 0 ] ; then
+        /sbin/service %{name} stop >/dev/null 2>&1
+        /sbin/chkconfig --del %{name}
+fi
 
 
 %preun dkms
@@ -137,7 +123,6 @@ true
 
 
 %files
-%defattr(-,root,root,-)
 # Userspace daemon
 %{_sbindir}/mediaproxy-ng
 
@@ -147,21 +132,15 @@ true
 %dir %{_sharedstatedir}/mediaproxy-ng
 
 # Documentation
-%dir %{_docdir}/%{name}-%{version}-%{release}
-%doc %{_docdir}/%{name}-%{version}-%{release}/README.md
-%doc %{_docdir}/%{name}-%{version}-%{release}/changelog
-%doc %{_docdir}/%{name}-%{version}-%{release}/copyright
-%doc %{_docdir}/%{name}-%{version}-%{release}/README.el.md
+%doc LICENSE README.md el/README.el.md debian/changelog debian/copyright
 
 
 %files kernel
-%defattr(-,root,root,-)
 /%{_lib}/xtables/libxt_MEDIAPROXY.so
 
 
 %files dkms
-%defattr(-,root,root,0755)
-%{_usrsrc}/%{name}-%{version}-%{release}/
+%attr(0755,root,root) %{_usrsrc}/%{name}-%{version}-%{release}/
 
 
 %changelog
diff --git a/tests/simulator-ng.pl b/tests/simulator-ng.pl
index e0c8ba2e3..705232689 100755
--- a/tests/simulator-ng.pl
+++ b/tests/simulator-ng.pl
@@ -516,7 +516,7 @@ sub do_rtp {
 				my $dstport = $$outputs[$b][$j][0] + 1;
 				my $sendfd = $$cfds[$a][$j];
 				my $expfd = $$cfds[$b][$j];
-				if ($RTCPMUX && !$a) {
+				if ($RTCPMUX) {
 					if (!$a) {
 						$dstport--;
 						$sendfd = $$fds[$a][$j];
@@ -679,7 +679,6 @@ t=0 0
 		$sdp .= <<"!";
 m=audio $p $$tr{name} 8
 a=rtpmap:8 PCMA/8000
-a=rtcp:$cp
 !
 		if ($RTCPMUX && !$i) {
 			$sdp .= "a=rtcp-mux\n";
diff --git a/utils/ng-client b/utils/ng-client
new file mode 100755
index 000000000..ade86e2cf
--- /dev/null
+++ b/utils/ng-client
@@ -0,0 +1,98 @@
+#!/usr/bin/perl
+
+use warnings;
+use strict;
+use Bencode qw(bencode bdecode);
+use Getopt::Long;
+use Socket;
+use Socket6;
+use Data::Dumper;
+
+my %options = ('proxy-address' => 'localhost', 'proxy-port' => 2223);
+
+GetOptions(
+	'proxy-address=s'		=> \$options{'proxy-address'},
+	'proxy-port=s'			=> \$options{'proxy-port'},
+	'from-tag=s'			=> \$options{'from-tag'},
+	'to-tag=s'			=> \$options{'to-tag'},
+	'call-id=s'			=> \$options{'call-id'},
+	'protocol=s'			=> \$options{'transport protocol'},
+	'trust-address'			=> \$options{'trust address'},
+	'symmetric'			=> \$options{'symmetric'},
+	'asymmetric'			=> \$options{'asymmetric'},
+	'replace-origin'		=> \$options{'replace-origin'},
+	'replace-session-connection'	=> \$options{'replace-session connection'},
+	'client-address=s'		=> \$options{'client-address'},
+	'sdp=s'				=> \$options{'sdp'},
+	'sdp-file=s'			=> \$options{'sdp-file'},
+	'ICE=s'				=> \$options{'ICE'},
+	'force'				=> \$options{'force'},
+	'v|verbose'			=> \$options{'verbose'},
+) or die;
+
+my $cmd = shift(@ARGV) or die;
+
+my %packet = (command => $cmd);
+
+for my $x (split(',', 'from-tag,to-tag,call-id,transport protocol,media address,ICE')) {
+	defined($options{$x}) and $packet{$x} = $options{$x};
+}
+for my $x (split(',', 'trust address,symmetric,asymmetric,force')) {
+	defined($options{$x}) and push(@{$packet{flags}}, $x);
+}
+for my $x (split(',', 'origin,session connection')) {
+	defined($options{'replace-' . $x}) and push(@{$packet{replace}}, $x);
+}
+
+if (defined($options{sdp})) {
+	$packet{sdp} = $options{sdp};
+}
+elsif (defined($options{'sdp-file'})) {
+	open(F, '<', $options{'sdp-file'}) or die $!;
+	my @sdp = <F> or die $!;
+	close(F);
+	$packet{sdp} = join('', @sdp);
+}
+elsif (@ARGV && $ARGV[0] eq 'sdp') {
+	shift(@ARGV);
+	$options{'client-address'} or die;
+	my ($ca, $cp);
+	if ($ca = inet_pton(AF_INET, $options{'client-address'})) {
+		$ca = inet_ntop(AF_INET, $ca);
+		$cp = "IP4";
+	}
+	elsif ($ca = inet_pton(AF_INET6, $options{'client-address'})) {
+		$ca = inet_ntop(AF_INET6, $ca);
+		$cp = "IP6";
+	}
+	$ca or die;
+	my $sdp = "v=0\r\no=- 12345 67890 IN $cp $ca\r\ns=session\r\nc=IN $cp $ca\r\nt=0 0\r\n";
+
+	$packet{sdp} = $sdp;
+}
+
+$options{verbose} and print Dumper \%packet;
+
+my $cookie = rand() . ' ';
+my $packet = $cookie . bencode(\%packet);
+
+socket(S, AF_INET, SOCK_DGRAM, 0) or die $!;
+send(S, $packet, 0, pack_sockaddr_in($options{'proxy-port'}, inet_aton($options{'proxy-address'}))) or die $!;
+my $ret;
+recv(S, $ret, 0x10000, 0);
+$ret =~ s/^\Q$cookie\E//s or die $ret;
+my $resp = bdecode($ret, 1);
+
+#print Dumper $resp;
+#exit;
+
+exists($$resp{result}) or die Dumper $resp;
+print("Result: \"$$resp{result}\"\n");
+if ($$resp{result} eq 'error') {
+	print("Error reason: \"$$resp{'error-reason'}\"\n");
+	exit(1);
+}
+if (defined($$resp{sdp})) {
+	print("New SDP:\n-----8<-----8<-----8<-----8<-----8<-----\n$$resp{sdp}\n".
+		"----->8----->8----->8----->8----->8-----\n");
+}