- h323plus - lists.packetizer.com

GNU Gatekeeper Survey
by Jan Willamowius 08 Apr '15

08 Apr '15

Dear all, I have prepared a short survey to learn more about how you use the GNU Gatekeeper, which features you use, what might be missing etc. Please take a moment to provide some feedback for the future direction of the project: http://www.gnugk.org/survey-2015.html Thanks! Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

Nagios plugin for H.323
by Jan Willamowius 05 Feb '15

05 Feb '15

Hi, I have released a Nagios plugin to monitor H.323 devices (any H.323 gatekeeper or gateway, it doesn't have to be GnuGk). http://www.gnugk.org/nagios-h323.html It doesn't just check if the device listens to a port, but sends a real H.323 message (GRQ or LRQ) and checks if a well formed message comes back. Enjoy! -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

2 1

GNU Gatekeeper 3.8 is available
by Jan Willamowius 05 Jan '15

05 Jan '15

I am pleased to announce a new release of the GNU Gatekeeper, version 3.8, now available from http://www.gnugk.org/h323download.html. Please see the attached notes for details. This release includes source code suitable for (Linux, Windows, MacOS, FreeBSD, NetBSD, OpenBSD and Solaris) and executables for Linux. -- Jan Whats new in GnuGk 3.8 ? In response to the current wave of H.323 spam / hacking GnuGk 3.8 has a number of improvements to security related features and older versions should be updated. - endpoint IDs are now completely random and not as easily guessable as they were before - GnuGk is now using better random numbers in security relevant places - new authentication modules using LUA scripts called LuaAuth - new switch [RasSrv::ARQFeatures] CheckSenderIP=1 to make sure ARQs come from the same IP as the initial registration - FileIPAuth is now able to check ARQ messages - AliasAuth updated to work with H.460.18 endpoint - PrefixAuth was extended to support unregistered calls - SQLAuth can now operate on SrcInfo fields using %{SrcInfo} - improvements to the addpasswd utility for the new web interface Other new non-security related features include: - The CatchAll policy now rewrites the destination alias which makes it easier to send CatchAll calls to MCU rooms. - You can now filter out whole capability classes, eg. all video or H.239 capabilities if some of your endpoints have trouble handling them - A new switch [Gatekeeper::Main] MinH323Version= lets you set the H.323 version GnuGk identifies itself as using (up to the latest version 7). This is mainly to deal with endpoint that switch features when they believe they are talking to older endpoints (which one shouldn't be doing...) - a number bugs and crashes fixed Download from http://www.gnugk.org/h323download.html -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

maxBitrate in External RTP
by Ankur Deep Jaiswal 27 Aug '14

27 Aug '14

Hi, I have a doubt, How do you get Max-Bitrate supported by a Capability in H323_ExternalRTPChannel. Help appreciated. -- Ankur Deep Jaiswal

3 6

GNU Gatekeeper 3.7 has been released
by Jan Willamowius 15 Aug '14

15 Aug '14

Hi, I'm happy to announce version 3.7 of the GNU Gatekeeper. http://www.gnugk.org/h323download.html This is mainly a bugfix release that corrects a number of errors and crashes (see below). Please follow these compile instructions: http://www.gnugk.org/compiling-gnugk.html Enjoy! Detailed change log: - allow Comment= in all sections - new status port command: "debug cfg all" to print the full configuration - stub code to fake support for Avaya 2.16.840.1.114187.1.3 authentication (disabled by default) - BUGFIX(Neighbor.cxx) fix outbound rules for GWRewriteE164 with neighbors - BUGFIX(RasSrv.cxx) fix crash on shutdown - BUGFIX(gkauth.cxx) for passwort auth look at correct src or dest info - BUGFIX(Toolkit.cxx) more flexible column handling for [SQLConfig] PermanentEndpountsQuery, document priority and vendor info setting - BUGFIX(gksql_sqlite.cxx) return empty string for NULL columns, like the other DB drivers do - BUGFIX(RasTbl.cxx) fix formatting of PrintAllRegistrations and PrintAllRegistrationsVerbose - BUGFIX(GkStatus.cxx) better handling when status clients don't quit properly - BUGFIX(Toolkit.cxx) fix selection of reply address for IPv6 -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

Re: [h323plus] [Openh323gk-users] Using LibreSSL instead of OpenSSL with GnuGk / H323Plus / PTLib
by Jan Willamowius 29 Jul '14

29 Jul '14

It would be nice if PTLib would do a pgk-config check for "openssl" or "libressl" to activate the OpenSSL code. I simply named the pgk-config file for LibreSSL "openssl.pc" to work around that. To use GnuTLS for the H.323 media encryption in GnuGk and H323Plus, PSSLxxx wrappers won't help. The OpenSSL compatibility mode of GnuTLS also isn't enough. regards, Jan Robert Jongbloed wrote: > Excellent! > > Are there any tweaks to the configure.ac that should happen to find > LibreSSL? > > > And re GnuTLS, the whole point of the PSSLxxx class wrappers in PTLib > was to allow for use of other API's to OpenSSL/LibreSSL. At least as a > configure/compile time option. One of these years, someone may cough up > the time/money to actually do the implementation .... > > *Robert Jongbloed* > OPAL/OpenH323/PTLib Architect and Co-founder. > Commercial support at http://www.voxlucida.com.au > /Travelling, so email responses may be slow!/ > > Robert. On 29/07/2014 5:30 pm, Jan Willamowius wrote: > > Hi, > > > > with the bugs recently found in OpenSSL, there is some concern how many > > more issues still lurk in the old and crufty OpenSSL code. There is a > > great effort by some OpenBSD developers to fork OpenSSL into > > "LibreSSL" (www.libressl.org) and clean up the code while keeping the > > public interface stable. > > > > I did a quick check and can report that GnuGk / H323Plus / PTLib > > compile well with LibreSSL instead of OpenSSL. All I had to do was > > provide a pkg-config file. So now we have a choice which library to use. > > > > I used LibreSSL Portable 2.0.3 for my test. > > > > Another interesting project would be to use GnuTLS as a replacement, > > but thats going to require a number of code changes on our side. > > > > Regards, > > Jan > > > -- Jan Willamowius, jan(a)willamowius.de, http://www.gnugk.org/

1 0

Using LibreSSL instead of OpenSSL with GnuGk / H323Plus / PTLib
by Jan Willamowius 29 Jul '14

29 Jul '14

Hi, with the bugs recently found in OpenSSL, there is some concern how many more issues still lurk in the old and crufty OpenSSL code. There is a great effort by some OpenBSD developers to fork OpenSSL into "LibreSSL" (www.libressl.org) and clean up the code while keeping the public interface stable. I did a quick check and can report that GnuGk / H323Plus / PTLib compile well with LibreSSL instead of OpenSSL. All I had to do was provide a pkg-config file. So now we have a choice which library to use. I used LibreSSL Portable 2.0.3 for my test. Another interesting project would be to use GnuTLS as a replacement, but thats going to require a number of code changes on our side. Regards, Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

FW: [h323-announce] H.323 Update Following the Sapporo Meeting
by Simon Horne 19 Jul '14

19 Jul '14

FYI The updates will be included in H.323v8 Simon From: h323-announce-bounces(a)lists.packetizer.com [mailto:h323-announce-bounces@lists.packetizer.com] On Behalf Of Paul E. Jones Sent: Sunday, July 20, 2014 8:19 AM To: H.323 Announce List Subject: [h323-announce] H.323 Update Following the Sapporo Meeting <http://www.packetizer.com> Folks, The most recent ITU-T SG16 meeting was held in Sapporo, Japan 30 June - 11 July 2014. Perhaps most significant at this meeting relating to H.323 is the fact that we approved two new Recommendations related to Telepresence systems: * ITU-T Rec. F.734, "Definitions, requirements, and use cases for Telepresence Systems" * ITU-T Rec. H.420, "Telepresence System Architecture" Progress was also made on revisions to each of the core H.323 Recommendations, namely H.323, H.225.0, and H.245. Some of the enhancements introduced are to support Telepresence systems, including the CLUE signaling channel. Support for the WebRTC Data Channel was also introduced in H.245. Of course, the work on Telepresence and WebRTC support is not complete, but progress is being made. We also adopted baseline text for the end-to-end Session Identifier, which is work that was initiated a few years ago. The work is being progressed in both the IETF and ITU in parallel, with the IETF work nearing completion. This work will allow for the identification of a communication session end-to-end from the point of origin to the point of termination, even if the call is carried over a mixture of H.323 and SIP networks. I have updated the document status page here: http://www.packetizer.com/ipmc/h323/doc_status.html. This shows the current status of the various H.323-related work items in ITU-T SG16. Best regards, Paul E. Jones http://paulej.com/

1 0

Avaya Authentication methods
by Jan Willamowius 27 Jun '14

27 Jun '14

Hi, I was just discussing with Simon if anybody would need the Avaya authentication procedures OID 1.3.14.3.2.6 and OID 2.16.840.1.114187.1.3 in H323Plus. Both are said to be DES based, so they don't offer much security, but they can be useful with legacy equipment. I have an almost complete implementation for OID 1.3.14.3.2.6 in GnuGk, that just needs a little fleshing out for the encryption part which GnuGk doesn't need, before it can be moved into H323Plus. For OID 2.16.840.1.114187.1.3 I have some stub code that allows endpoints to register with GnuGk, but some crypto details are still uncertain. So, if anybody needs this stuff, please speak up. ;-) Cheers, Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 3.6 has been released
by Jan Willamowius 07 May '14

07 May '14

Hi, I'm happy to announce version 3.6 of the GNU Gatekeeper. http://www.gnugk.org/h323download.html This version contains support for Polycom's domain##alias addressing, a new policy to route by URI prefix, better config checking, fixes for H.460.19 port detection and a number of other bugfixes and smaller features. I'm trying to cut down on the time I have to spend on each release, so I will only provide executable to support client for this version. Please follow these instructions to compile GnuGk yourself: http://www.gnugk.org/compiling-gnugk.html Detailed change log: - support Polycom's domain##alias addressing in DNS policy - new command line switch: --strict (don't start with config errors) - new routing policy [Routing::URIService] to define service specific URI routing policy. - allow SendTo= without AlternateGKs= switch - new switch [EP::...] ForceGateway=1 to treat an endpoint as a gateway - new switch [EP::...] AddCallingPartyToSourceAddress=1 - new switch [EP::...] DisableCallCreditCapabilities=1 - verify the correct payloadType on H.460.19 keep-alive packets (disable with [Proxy] CheckH46019KeepAlivePT=0) - support libssh 0.6.x - BUGFIX(ProxyChannel.cxx) fix memory leak on TLS errors - BUGFIX(RasTbl.cxx) use 64bit numbers for AddNumbers= ranges - BUGFIX(RasSrv.cxx) fill destCallSignallAddress in answer ACF in direct mode - BUGFIX(RasSrv.cxx) fix callSignalPort in LCF when H.460.22 is enabled - BUGFIX(ProxyChannel.cxx) read ProxyHandlerHighPrio switch earlier - BUGFIX(ProxyChannel.cxx) wait 4 sec before using regular RTP packets for H.460.19 port detection - BUGFIX(gk.cxx) small fixes for MacOSX -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0