rtp_relay: use the opposite tag when creating the peer leg in request

When request_route lazily creates the peer leg for an unestablished RTP
relay session, the local leg is already matched by the From tag. The
peer leg therefore needs the opposite tag (To tag) so the internal leg
map stays consistent.

Thanks to @sindy39 on GitHub for reporting it in #3884.

Author: razvancrainea

modules/rtp_relay/rtp_relay.c

@@ -465,7 +465,11 @@ static struct rtp_relay_leg *pv_get_rtp_relay_leg(struct sip_msg *msg,
 			if (!peer) {
 				if (!set)
 					return NULL;
-				peer = rtp_relay_new_leg(ctx, &get_from(msg)->tag_value, RTP_RELAY_ALL_BRANCHES);
+				if (route_type == BRANCH_ROUTE)
+					tag = get_from(msg)->tag_value;
+				else
+					tag = get_to(msg)->tag_value;
+				peer = rtp_relay_new_leg(ctx, &tag, RTP_RELAY_ALL_BRANCHES);
 				if (!peer) {
 					LM_ERR("cannot create a new leg\n");
 					return NULL;