- h323implementers - lists.packetizer.com

GNU Gatekeeper 4.8 released
by Jan Willamowius 17 Jan '18

17 Jan '18

Hi, I have just released GNU Gatekeeper version 4.8. This version has many new features. You can download the new version from https://www.gnugk.org/h323download.html Overview: New maintenance mode: When you need to take down your GnuGk server (eg. for an OS update), you can switch GnuGk to maintenance mode where it will only allow ongoing calls to finish and automatically redirects all idle endpoints to an alternate GnuGk server. The status port command is "MaintenanceMode <alternate IP>". Detailed information about ongoing calls: You can now display lots of information about each ongoing call (codecs, bandwidth used, IPs etc.). The web interface has been extended to to show this information. See https://www.gnugk.org/images/web7.jpg Easier installation on AWS and inside docker containers. You can now let GnuGk automatically detect the public IP of your AWS server, even from within a docker container. You can also automatically insert your public/external IP into your trace file names to store logs from many servers in the same directory. Extended API: Call routing with external applications has been expanded. You can now set the display names for participants and desired reject codes on the status port. You can also access the vendor information of all registered endpoints. The web interface has been extended to provide this information, too. HttpPasswordAuth has been greatly extended to fetch password information from backend servers. We now use curl to support https and you can add many new placeholders in your queries. Extended screening and rewriting of display names and calling party names. Important bug fixes: Multiplexed RTP is now much more robust and password authentication to parent gatekeepers has been fixed. There are also interop fixes for TCP keep-alives. Please see the full change log below for more details. Changes from 4.7 to 4.8 ======================= - HttpPasswordAuth: support https and add new placeholders - PrintAllRegistrationsVerbose now also shows the endpoint vendor - new status port command: MaintenanceMode - new status port command: PrintCallInfo - allow placeholder %{gkip} and %{external-ip} in [LogFile] Filename= - fetch AWS public/elastic IP if ExternalIP=AWSPublicIP - new commandline switch: -e / --externalip - extend status port command RouteReject to set reject reason - extend status port commands RouteToAlias, RouteToGateway etc. to set display IE for calling and called - new switch: [LogFile] DeleteOnRotation=1 to delete the old logfile when rotating instead of renaming it - new switches: [RoutedMode] AppendToCallingPartyNumberIE= / PrependToCallingPartyNumberIE= to add any string before or after the calling party number IE when ScreenCallingPartyNumberIE=RegisteredAlias - when [RoutedMode] ScreenCallingPartyNumberIE= is set to RegisteredAlias, GnuGk sets calling party number IE to the registered alias (forced screening) - delete DisplayIE when [RoutedMode] ScreenDisplayIE=Delete - new switch [Endpoint] Authenicators= - new default: [RoutedMode] GnuGkTcpKeepAliveMethodH225=EmptyFacility - new default: [RoutedMode] H460KeepAliveMethodH225=EmptyFacility for Cisco interop - new setting "None" for keep-alive methods - BUGFIX(ProxyChannel.cxx) fix bugs in H.460.19 RTP multiplexing - BUGFIX(ProxyChannel.cxx) don't send H.460 keep-alive to non-H.460 party when calling H.460 party - BUGFIX(Routing.cxx) show called port in RouteRequests (as documented) - BUGFIX(GkClient.*) fix password authentication with parent - BUGFIX(Routing.cxx) remove semicolon and pipe chars from vendor string in RouteRequests - better handling of IPv6 GRQ without RAS address - BUGFIX(ProxyChannel.cxx) turn off encryption proxy if DH key is negotiated, but TCS doesn't contain any H.235 entries - BUGFIX(ProxyChannel.cxx) fix running in proxy mode on FreeBSD when one Home IP is set - BUGFIX(ProxyChannel.cxx) fix DisableSettingUDPSourceIP=1 for Windows, NetBSD, OpenBSD and Solaris - BUGFIX(yasocket.cxx) fix LARGE_FDSET for NetBSD, OpenBSD and Solaris -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: https://www.gnugk.org Support: https://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 4.7 has been released (security update)
by Jan Willamowius 21 Sep '17

21 Sep '17

Hi, GNU Gatekeeper version 4.7 has just been released. This version is purely a security update and has no new features. All users are encouraged to update, especially if you use port detection (IgnoreSignaledIPs=1) you should update ASAP. It has been discovered that GnuGk is vulnerable in some configurations for RTP bleed attacks (https://rtpbleed.com/). By updating to version 4.7 only the first packets in each media stream influence the media destination. To further secure your configuration, you can set [Proxy] RestrictRTPSources=Net to only accept RTP from the same class C network that the call signaling came from. Please beware that this may break a few valid calls where this condition isn't met. You can download the new version from https://www.gnugk.org/h323download.html Please see the full change log below. Changes from 4.6 to 4.7 ======================= - fixes for RTP Bleed - new switch [Proxy] RestrictRTPSources=IP or Net to limit accepting RTP from the call signal IPs or the respective class C network - new switch [Proxy] LegacyPortDetection=1 to keep port detection help for some very old and broken endpoints that will make your gatekeeper vulnerable to RTP Bleed attacks - BUGFIX(ProxyChannel.cxx) replace @ip or ip## from aliases when using RedirectCallsToGkIP - BUGFIX(ProxyChannel.cxx) better initialization of sendmsg() structs - new command line option: now you can use -S instead of --strict (needed on BSD systems) -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: https://www.gnugk.org Support: https://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 4.6 is out
by Jan Willamowius 04 Sep '17

04 Sep '17

Hi, I'm happy to announce that GNU Gatekeeper version 4.6 has just been released. This version has a few new features as well as bug fixes. New features: - least used routing: distribute calls evenly between gateways or MCUs (new switch [RasSrv::ARQFeatures] LeastUsedRouting=1) - ability to log to the Unix syslog instead of the trace file (new switch [LogFile] TraceToSyslog=1) - new authentication module TwoAliasAuth this is not very safe, but you can use it with endpoints that do not support any password transmission - new switch [CTI::MakeCall] Bandwidth= to set the maximum bandwidth for the calls generated by the GnuGk status port API - status port command: UnregisterEP <ep-id> - a number of switches to fine tune TCP keepalives - new switch to remove load balancers from the call path ([RoutedMode] RedirectCallsToGkIP=1) Bug fixes: - fixed TCP keepalive for H.460 calls - fixes to port detection for unregistered calls - audio fix when GnuGk adds encryption to calls - many smaller fixes You can download the new version from https://www.gnugk.org/h323download.html Please see the full change log below. Changes from 4.5 to 4.6 ======================= - new switch: [RoutedMode] RedirectCallsToGkIP=1 - new switches: [RoutedMode] H460KeepAliveMethodH225=, H460KeepAliveMethodH245=, GnuGkTcpKeepAliveMethodH225=, GnuGkTcpKeepAliveMethodH245= - BUGFIX(ProxyChannel.cxx) TCP keep-alives for H.460.18 calls weren't always enabled correctly - don't open a status port listener if [Gatekeeper::Main] StatusPort=0 - BUGFIX(Toolkit.cxx) remove trailing chars before checking for DefaultDomain - add callID to H.245 trace messages for easier debugging - BUGFIX(ProxyChannel.cxx) forward ReleaseComplete from remaining party while doing call reroute - BUGFIX(ProxyChannel.cxx) drop un-en/decryptable RTP packets at end of call when adding encryption - new status port command: UnregisterEP <ep-id> - BUGFIX(RasSrv.cxx) remove IPv6 addresses before processing RRQs when IPv6 is not enabled - send Facility message as as non-H.460.18 keep-alive for H.225 - send non-standard H.245 userIndication as non-H.460.18 keep-alive for H.245 - new switch [RoutedMode] DisableGnuGkH245TcpKeepAlive=1 - new switch [LogFile] TraceToSyslog=1 to send trace output to syslog (Unix only) - BUGFIX(ProxyChannel.cxx) fix port detection for re-opened channels with IgnoreSignaledIPs=1 - new switch [CTI::MakeCall] Bandwidth= to set the maximum bandwidth for the call - new switch [RasSrv::ARQFeatures] LeastUsedRouting=1 to select the least used gateway - new authentication module TwoAliasAuth -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: https://www.gnugk.org Support: https://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 4.5 released
by Jan Willamowius 16 Mar '17

16 Mar '17

Hi, I'm proud to announce that GNU Gatekeeper 4.5 has been released. The most important change is the implementation of TCP keepalives for H.460.18 (bugfix) and optionally for all kinds of calls (feature). This is really important for NAT traversal. In addition to the keepalives there are a number of bugfixes and a few minor feature additions (see the change notes below). You can download the new version from https://www.gnugk.org/h323download.html Please see the full change log below. Changes from 4.4 to 4.5 ======================= - new feature to send H.225 and H.245 keep-alives for all calls, enable with [RoutedMode] EnableGnuGkTcpKeepAlive=1, set interval with GnuGkTcpKeepAliveInterval=n - BUGFIX(ProxyChannel.cxx) send H.225 and H.245 keep-alives when acting as H.460.18 client - BUGFIX(ProxyChannel.cxx) disable RTP/RTCP port check for IPs in AllowedSignalIPs= when doing port detection - [Proxy] AllowedSignalIPs= can now process a list of networks - add shortcurt 'rl' for status port command 'rotatelog' - new switch [CallTable] SetCalledStationIdToDialedIP=1 - new switch [CallTable] UseDestCallSignalIPAsDialedNumber=1 to place the destSignalIP into the %{DialedNumber} field if no dialed number is available in the ARQ / Setup - BUGFIX(ProxyChannel.cxx) fix crash on invalid sourceCallSignalAddress - add optional parameter for call transfer method to MakeCall status port command - BUGFIX(Toolkit.*) fix bug in IP comparison - BUGFIX(Toolkit.*) the internal networks configured with the [Proxy] InternalNetworks switch were added to the detected internal networks and didn't replace them, now they replace them as documented -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: https://www.gnugk.org Support: https://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 4.4 released
by Jan Willamowius 06 Jan '17

06 Jan '17

Hi, GNU Gatekeeper 4.4 was released today. This is mainly a bug fix release with only 2 new features. If you use SSH on your status port you are urged to update as soon as possible and also if you use LUA scripting. Two serious bugs have been fixed for these features where GnuGk can be crashed remotely. A new feature is the RequireOneNet policy that allows you to restrict access to publicly accessible traversal gatekeepers. Now you can easily define that one end of all calls must terminate in one of your own networks and prevent abuse of your resources by 3rd parties. The other new feature is a significant improvement to the MakeCall command on the status port. It is now able to establish video calls and supports virtually all endpoints by using GnuGk's call reroute feature. Changed config switches: - [Proxy] ProxyForNAT now defaults to OFF - [CTI::MakeCall] DisableFastStart has been removed, fastStart is now always disabled You can download the new version from http://www.gnugk.org/h323download.html Please see the full change log below. These know bugs haven't been addressed, yet: - when GnuGk acts as a H.460.18 client (as client in a H.460.18 traversal zone with another gatekeeper or as child gatekeeper), it currently does not send a keep-alive on the Q.931 TCP connection during a call - bandwidth management currently only applies to calls from registered endpoints and ignores unregistered calls completely Changes from 4.3 to 4.4 ======================= - [CTI::MakeCall] TransferMethod can now also be Reroute, DisableFastStart switch removed - BUGFIX(MakeCall.cxx) fix MakeCall bearer capabilities to support video calls - BUGFIX(ProxyChannel.cxx) don't send Notify after call Reroute: Polycom RealPresense starts a flood of Status messages - BUGFIX(GkStatus.cxx) call ssh_init() and ssh_finalize() only on application start and shutdown - BUGFIX(ProxyChannel.cxx) fix IP check for IgnoreSignaledPrivateH239IPs= switch - new accounting/authentication policy RequireOneNet - pass full RRQ message to LuaAuth - BUGFIX(ProxyChannel.cxx) when opening a port from a PortRange fails, try next port regardless of errno - BUGFIX(lua.cxx) add mutex for LUA interpreter, because it is not thread safe - added message type parameter in RouteRequest event (ARQ, Setup, LRQ) - BUGFIX(yasocket.cxx) fix UDP with LARGE_FDSET on Solaris, OpenBSD and NetBSD - BUGFIX(RasTbl.cxx) fix crash on invalid AliasTypeFilter setting - changed default setting: [Proxy] ProxyForNAT now defaults to off, if you want to keep the previous behaviour, please set it explicitely -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 4.3 released
by Jan Willamowius 16 Nov '16

16 Nov '16

Hi, I'm happy to announce the release of GNU Gatekeeper 4.3. This new version contains a number bug fixes and some security fixes. Fuzzy testing surfaced methods to crash GnuGk remotely, causing at least a denial of service. So all users are encouraged to update. The most notable new feature are probably the events for Setup messages on the status port so now you can see all calls. In addition, LuaAuth has been given access to more information about received messages and can end your status port sessions with Ctrl-C now. Important bug fixes are in the H.460 NAT traversal code where sometimes keep-alive intervals could be too long in older versions and a bug where GnuGk might have missed port re-negotiations in some cases. The IgnoreSignaledIPs port detection code also has a few bug fixes to detect cases where it should be turned off automatically because its either not needed because the parties use another form of NAT traversal or non-symmetric ports where the detection algorithm may cause more harm than good. You can download the new version from http://www.gnugk.org/h323download.html Please see the full change log below. Enjoy! Changes from 4.2 to 4.3 ======================= - BUGFIX(ProxyChannel.cxx, gkh235.cxx, gkauth.h) fix crashes found with PROTOS - new authentication policies LuaPasswordAuth, HttpPasswordAuth - BUGFIX(configure.in) fix check for LUA 5.2 or higher - connection to the status port can now also be ended with Ctrl-C - new switch [Routing::DNS] RewriteARQDestination= to preserve URLs in ARQs - disable IgnoreSignaledIPs when one party is not using the same RTP ports for forward and reverse channels in same RTP session - BUGFIX(RasTbl.cxx) don't allow higher TTL for H.460.18 registrations than set by H46018KeepAliveInterval= switch - add variables message, srcInfo and vendor to LuaAuth - print message on status port when Setup is received - BUGFIX(ProxyChannel.cxx) disregard IgnoreSignaledIPs=1 switch when caller supports some form of NAT traversal (to avoid both sides waiting for first RTP packet) - BUGFIX(ProxyChannel.cxx) enable H.245 tunneling for H.460.17 even when Innovaphone forgets the flag - BUGFIX(ProxyChannel.cxx) make sure CRV is 0 for all RAS messages when using H.460.17 even when they relate to a call - BUGFIX(ProxyChannel.cxx) re-do H.460.19 port detection when a new logical channel is opened on the same port - print number of CPU cores and thread configuration on startup - BUGFIX(RasTbl.cxx) fix display of H.460.17 for registrations on status port - BUGFIX(ProxyChannel.cxx) fix dead lock causing reroutes to fail -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 4.2 released
by Jan Willamowius 31 May '16

31 May '16

Hi, I'm happy to announce the release of GNU Gatekeeper 4.2. Version 4.2 is mainly a bug fix release. A bug in proxying H.239 connections through NAT has been fixes as well as a number of possible crashes and a few other small bugs. The main functional change is that GnuGk's old NAT traversal method is now disabled by default. Everybody should use H.460.x. If you want keep using the old NAT traversal method, you can re-enable it with [RoutedMode] EnableGnuGkNATTraversal=1 [Endpoint] EnableGnuGkNATTraversal=1. You can download the new version from http://www.gnugk.org/h323download.html Please see the full change log attached below. Enjoy! -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584 Changes from 4.1 to 4.2 ======================= - BUGFIX(ProxyChannel.cxx) fix H.239 forwarding issue in call where only one side uses H.460.19 - BUGFIX(configure.in) make sure LUA test fails for versions below 5.2 - BUGFIX(gkh235.cxx) small fix with password auth - BUGFIX(ProxyChannel.cxx) apply codec filtering also to receiveAndTransmit capabilities - BUGFIX(ProxyChannel.cxx) fix crash in RTP multiplexing - BUGFIX(ProxyChannel.cxx) fix crash when using H.245 tunneling translation - BUGFIX(gk.cxx) fix shutdown on NetBSD 7 - BUGFIX(ProxyChannel.cxx) fix compile on NetBSD 7 - new switch: [RoutedMode] FilterVideoFastUpdatePicture= to reduce the number of update requests from endpoints - disable SSLv3 when using TLS - BUGFIX(ProxyChannel.cxx) fix crash in call cleanup - support ON and OFF event in LuaAcct - BUGFIX(sqlacct.*) implement ON and OFF event as documented - new switches [RoutedMode] EnableGnuGkNATTraversal=1 and [Endpoint] EnableGnuGkNATTraversal=1 to keep GnuGk's old NAT traversal method enabled

1 0

回复： hi
by 陈炳锡-阳阳谷信息科技 30 May '16

30 May '16

thanks you , but i am using h323plus 1.26.0 now. and i find the way to send data by default is UDP, how to set it to TCP and There is no detailed instructions for use. ------------------ 原始邮件 ------------------ 发件人: "Robert Jongbloed";<robertj(a)voxlucida.com.au>; 发送时间: 2016年5月26日(星期四) 晚上6:31 收件人: "h323implementers"<h323implementers-bounces(a)lists.packetizer.com>; "h323implementers"<h323implementers(a)lists.packetizer.com>; 主题: Re: [h323implementers] hi If you really are using openh323, it has not been active for many years now. You should use either H323Plus or OPAL voip depending on your needs. ----------Robert Jongbloed Vox Lucida Pty. Ltd. -----Original message----- From: 陈炳锡-阳阳谷信息科技 Sent: Thursday, 26th May 2016, 19:40 To: h323implementers Subject: [h323implementers] hi hi is it a bug of OpenH323? i have a problem in using openh323, in the OpenH323 transmission channel, i am send more than 65K of the size of the data, it will not be sent out.

2 2

回复：RE: 回复： hi
by 陈炳锡-阳阳谷信息科技 26 May '16

26 May '16

------------------ 原始邮件 ------------------ 发件人: "Robert Jongbloed";<robertj(a)voxlucida.com.au>; 发送时间: 2016年5月27日(星期五) 上午10:31 收件人: "陈炳锡-阳阳谷信息科技"<2355282402(a)qq.com>; 主题: RE: 回复： [h323implementers] hi Then please ask your question on the H323plus mailing list: http://www.h323plus.org/lists.html ----------Robert Jongbloed Vox Lucida Pty. Ltd. -----Original message----- From: 陈炳锡-阳阳谷信息科技 Sent: Friday, 27th May 2016, 10:55 To: Robert Jongbloed Subject: 回复： [h323implementers] hi thanks you , but i am using h323plus 1.26.0 now. ------------------ 原始邮件 ------------------ 发件人: "Robert Jongbloed";<robertj(a)voxlucida.com.au>; 发送时间: 2016年5月26日(星期四) 晚上6:31 收件人: "h323implementers"<h323implementers-bounces(a)lists.packetizer.com>; "h323implementers"<h323implementers(a)lists.packetizer.com>; 主题: Re: [h323implementers] hi If you really are using openh323, it has not been active for many years now. You should use either H323Plus or OPAL voip depending on your needs. ----------Robert Jongbloed Vox Lucida Pty. Ltd. -----Original message----- From: 陈炳锡-阳阳谷信息科技 Sent: Thursday, 26th May 2016, 19:40 To: h323implementers Subject: [h323implementers] hi hi is it a bug of OpenH323? i have a problem in using openh323, in the OpenH323 transmission channel, i am send more than 65K of the size of the data, it will not be sent out.

1 0

hi
by 陈炳锡-阳阳谷信息科技 26 May '16

26 May '16

hi is it a bug of OpenH323? i have a problem in using openh323, in the OpenH323 transmission channel, i am send more than 65K of the size of the data, it will not be sent out.

2 1