- h323implementers - lists.packetizer.com

GNU Gatekeeper 4.1 released
by Jan Willamowius 16 Feb '16

16 Feb '16

Hi, I'm happy to announce the availability of GNU Gatekeeper 4.1. This is mainly a bug fix release. If you are using GnuGk as a server in a traversal zone or if you do H.239 presentations with Avaya endpoints, you are strongly encouraged to update. This version also fixes a memory leak that mainly affects long running gatekeepers with a lot of RAS traffic. Some of the bugs were long standing, so if you skipped some previous releases, this is really a good time to update. The main new feature in this release is expanded LUA support. Besides LUA authentication and LUA routing, there is now a LuaAcct module that allows you to run a script on every accounting event of your choice. Please see the updated manual for details. You can download the new version from http://www.gnugk.org/h323download.html Please see the full change log attached to the end of this mail. My support website https://www.willamowius.com also got a face lift. Please check it out as well. Enjoy! -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584 Changes from 4.0 to 4.1 ======================= - BUGFIX(ProxyChannel.cxx) fix crash processing Setup - BUGFIX(RasSrv.cxx) update IP/port of traversal neighbor on every SCI, not only on IP changes - new status port command: PrintNeighbors - BUGFIX(ProxyChannel.cxx) fix H.239 inside multiplePayloadStream from Avaya XT5000 with H.460.19 - new accounting module: LuaAcct - LUA: new library "gnugk" to allow access to GnuGk functionality - BUGFIX(configure) set all detected options in gnugkbuildopts.h on Unix - BUGFIX(ProxyChannel.cxx) removing H.235 capabilities might have skipped items - BUGFIX(lua.cxx) initialize all LUA variables for LUA routing - status port configuration (MaxStatusClients, StatusEventBacklog, StatusEventBacklogRegex) now changable at runtime - BUGFIX(GkStatus.cxx) fix StatusEventBacklogRegex for patterns that start at the beginning of the event line - BUGFIX(ProxyChannel.cxx) use RealPresence Group 0-Byte keep-alive for IgnoreSignaledH239PrivateIPs (needs LARGE_FDSET to work) - new switches to set database connect and read timeout (only used by MySQL for now) - new switch to set worker thread idle timeout: [Gatekeeper::Main] WorkerThreadIdleTimeout= - BUGFIX(gk.cxx) better test for gatekeeper shutdown - BUGFIX(Routing.cxx) fix fromIP for ARQ and LRQ RouteRequests - BUGFIX(gkauth.cxx) only call Q.931 checks when activated - BUGFIX(Routing.cxx) fix RouteRequest from unregistered caller who doesn't provide any alias - new switch: [RoutedMode] DisableSettingUDPSourceIP=1

1 0

GNU Gatekeeper 4.0 released
by Jan Willamowius 03 Dec '15

03 Dec '15

I am pleased to announce the release of GNU Gatekeeper 4.0. It is now available from http://www.gnugk.org/h323download.html. This release includes source code suitable for Linux, Windows, MacOS X, FreeBSD, NetBSD, OpenBSD and Solaris and executables for Linux. GnuGk 4.0 includes many new features as well as some important bug fixes, but remains fully compatible with your previous configuration files. Whats new ? - rewrite of the H.235 password authentication - much better interoperability and much more secure (it is high time to get ride of MD5 based authentication!) - IP authentication for all RAS and Q.931 messages - important IPv6 updates and fixes - support for TCS0 call transfers ("reroute") that can be initiated from applications - better NAT traversal support for unregistered endpoints - better blocking of spam calls using SQLAuth - per endpoint codec filtering - DisplayIE rewriting - more secure handling of status port passwords (only hash stored) - important fix for ODBC database driver - CalledPartyNumber IE rewriting for better Polycom interoperability - bug fixes Some of the new 4.0 features are discussed in more detail this blog post: http://blog.gnugk.org/2015/11/gnu-gatekeeper-40-features.html The full change log is appended below. Regards, Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584 Changes from 3.9 to 4.0 ======================= - [...PasswordAuth] CheckID switch is now deprecated, use [H235] CheckSendersID instead - provide vendor informations from ARQ or Setup as %{Vendor} in SQLAuth CallQuery - prepend timestamp to events in status port backlog - BUGFIX(Routing.cxx) remove newlines from vendor string before sending out RouteRequest to virtual queue - BUGFIX(gksql_odbc.cxx) fix DSN initialization when having multiple DSNs at the same time - new switch: [RoutedMode] UpdateCalledPartyToH225Destination=1 to always rewrite the CalledPartyNumberIE in Setup to the first E.164 of the H.225 destinationAddress - BUGFIX(ProxyChannel.cxx) fix crash on shutdown - new settings for [RoutedMode] ScreenDisplayIE=: 'Calling', 'Called', 'CallingCalled' to set the DisplayIE to the (rewritten) caller ID - new switch: [RoutedMode] AppendToDisplayIE= to add a string to the DisplayIE when ScreenDisplayIE= is on - changed default: H.460.18 keep-alive in traversal zone between neighbors now defaults to 19 sec (was 29) - new switch: [RoutedMode] H46018KeepAliveInterval= - BUGFIX(ProxyChannel.cxx) better port detection for H.239 when IgnoreSignaledPrivateH239IPs=1 - BUGFIX(gkacct.cxx) %{caller-port} and %{called-port} now default to "0" instead of the empty string when not available (eg. in direct mode) to avoid SQL errors when they are stored in a numeric column - BUGFIX(RasSrv.cxx) fix additive registration with parent gatekeeper - BUGFIX(ProxyChannel.cxx) fix IPv6 dual-stack proxy on Linux and Windows - dump file descriptor usage on USR2 signal (Linux only) - new switch [RoutedMode] DisableFastStart=1 - support for H.235.1, incl. setting and checking tokens in all RAS and Q.931 messages - extend SimplePasswordAuth and FileIPAuth to all RAS and all Q.931 messages - store only PBKDF2 hash for [GkStatus::Auth] password in config, not a recoverable password - BUGFIX(ProxyChannel.cxx) fix crash when receiving message without UUIE - new switch [EP::] DisabledCodecs= - much improved TCS0 3rd-party call transfer using 'Reroute' command on status port - BUGFIX(Routing.cxx) add field for destination alias in ARQ if missing and a dynamic routing policy sets it - BUGFIX(ProxyChannel.cxx) fix crash in H.235 Media for endpoints with more than 64 capability entries in TCS - new switch [Proxy] AllowSignaledIPs= to skip to skip auto-detect for network when IgnoreSignaledIPs=1

1 0

GNU Gatekeeper 3.9 is available
by Jan Willamowius 10 Jul '15

10 Jul '15

I am pleased to announce a new release of the GNU Gatekeeper, version 3.9, now available from http://www.gnugk.org/h323download.html. This release includes source code suitable for Linux, Windows, MacOS X, FreeBSD, NetBSD, OpenBSD and Solaris and executables for Linux. -- Jan Whats new in GnuGk 3.9 ? - bug fixes, including a crash and hanging status port on Windows servers - a new IP/port detection algorithm for endpoints behind NAT that works well even with unregistered (!) endpoint H.460 NAT traversal requires all endpoints to register with their gatekeeper. Thus users have to enter IPs in config dialogs etc. With this new port detection, they can start making calls right away to <alias>@<gatekeeper IP> or <gatekeeper IP>##<alias>. - neighbor pings to speed up call routing if your neighbors are frequently down Neighbors get pinged with an LRQ and if they don't respond with either LCF or LRJ GnuGk will skip them in the call routing without waiting for a timeout. - geo-blocking with the GeoIPAuth policy, you can allow or block calls based on the location of the IP - status port event back log When you connect to the status port to diagnose an issue, the relevant events are already gone. With this new feature you can tell GnuGk to save the last n events and show them later on. This way you can take a look at eg. the last 100 failed registrations etc. - QoS DiffServ marking for RAS, H.225 and H.245 messages (based on a patch provided by Vidyo) Now you can set the DiffServ class for signaling messages. Previously you could only mark RTP packets. - support for H.235.TSSM H.235 needs time synchronization between gatekeeper and endpoints and the proposed H.235.TSSM standard provides a means for endpoints to detect that they are not in sync with the gatekeeper and apply a time offset. Download from http://www.gnugk.org/h323download.html -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

GNU Gatekeeper 3.8 is available
by Jan Willamowius 05 Jan '15

05 Jan '15

I am pleased to announce a new release of the GNU Gatekeeper, version 3.8, now available from http://www.gnugk.org/h323download.html. Please see the attached notes for details. This release includes source code suitable for (Linux, Windows, MacOS, FreeBSD, NetBSD, OpenBSD and Solaris) and executables for Linux. -- Jan Whats new in GnuGk 3.8 ? In response to the current wave of H.323 spam / hacking GnuGk 3.8 has a number of improvements to security related features and older versions should be updated. - endpoint IDs are now completely random and not as easily guessable as they were before - GnuGk is now using better random numbers in security relevant places - new authentication modules using LUA scripts called LuaAuth - new switch [RasSrv::ARQFeatures] CheckSenderIP=1 to make sure ARQs come from the same IP as the initial registration - FileIPAuth is now able to check ARQ messages - AliasAuth updated to work with H.460.18 endpoint - PrefixAuth was extended to support unregistered calls - SQLAuth can now operate on SrcInfo fields using %{SrcInfo} - improvements to the addpasswd utility for the new web interface Other new non-security related features include: - The CatchAll policy now rewrites the destination alias which makes it easier to send CatchAll calls to MCU rooms. - You can now filter out whole capability classes, eg. all video or H.239 capabilities if some of your endpoints have trouble handling them - A new switch [Gatekeeper::Main] MinH323Version= lets you set the H.323 version GnuGk identifies itself as using (up to the latest version 7). This is mainly to deal with endpoint that switch features when they believe they are talking to older endpoints (which one shouldn't be doing...) - a number bugs and crashes fixed Download from http://www.gnugk.org/h323download.html -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

cryptoTokens & md5 password
by Артем Глумов 13 Sep '14

13 Sep '14

Hi! I'm developing h323 gatekeeper implementation and now I have to make authorization check on it usign H323-ID/password pair in cryptoTokens. As I understood, to make encrypted token (I use md5) we have to know password and some other data. To check cryptoToken in side of the gatekeeper I have to make the same encrypted token and compare them. So this is the question: does it means, that I have to save opened password or password, encrypted by some cipher, but I can not use md5-encrypted passwords (because I cannot decrypt them to make cryptoToken). Or there are some another way to provide an authorisation usign cryptoTokens and keep only hash of password on the gk-side? Artyom Glumov.

1 0

GNU Gatekeeper 3.7 has been released
by Jan Willamowius 15 Aug '14

15 Aug '14

Hi, I'm happy to announce version 3.7 of the GNU Gatekeeper. http://www.gnugk.org/h323download.html This is mainly a bugfix release that corrects a number of errors and crashes (see below). Please follow these compile instructions: http://www.gnugk.org/compiling-gnugk.html Enjoy! Detailed change log: - allow Comment= in all sections - new status port command: "debug cfg all" to print the full configuration - stub code to fake support for Avaya 2.16.840.1.114187.1.3 authentication (disabled by default) - BUGFIX(Neighbor.cxx) fix outbound rules for GWRewriteE164 with neighbors - BUGFIX(RasSrv.cxx) fix crash on shutdown - BUGFIX(gkauth.cxx) for passwort auth look at correct src or dest info - BUGFIX(Toolkit.cxx) more flexible column handling for [SQLConfig] PermanentEndpountsQuery, document priority and vendor info setting - BUGFIX(gksql_sqlite.cxx) return empty string for NULL columns, like the other DB drivers do - BUGFIX(RasTbl.cxx) fix formatting of PrintAllRegistrations and PrintAllRegistrationsVerbose - BUGFIX(GkStatus.cxx) better handling when status clients don't quit properly - BUGFIX(Toolkit.cxx) fix selection of reply address for IPv6 -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

H.323 Update Following the Sapporo Meeting
by Paul E. Jones 19 Jul '14

19 Jul '14

Folks, The most recent ITU-T SG16 meeting was held in Sapporo, Japan 30 June - 11 July 2014. Perhaps most significant at this meeting relating to H.323 is the fact that we approved two new Recommendations related to Telepresence systems: * ITU-T Rec. F.734, "Definitions, requirements, and use cases for Telepresence Systems" ITU-T Rec. H.420, "Telepresence System * Architecture" Progress was also made on revisions to each of the core H.323 Recommendations, namely H.323, H.225.0, and H.245. Some of the enhancements introduced are to support Telepresence systems, including the CLUE signaling channel. Support for the WebRTC Data Channel was also introduced in H.245. Of course, the work on Telepresence and WebRTC support is not complete, but progress is being made. We also adopted baseline text for the end-to-end Session Identifier, which is work that was initiated a few years ago. The work is being progressed in both the IETF and ITU in parallel, with the IETF work nearing completion. This work will allow for the identification of a communication session end-to-end from the point of origin to the point of termination, even if the call is carried over a mixture of H.323 and SIP networks. I have updated the document status page here: http://www.packetizer.com/ipmc/h323/doc_status.html. This shows the current status of the various H.323-related work items in ITU-T SG16. Best regards, Paul E. Jones http://paulej.com/

1 0

GNU Gatekeeper 3.6 has been released
by Jan Willamowius 07 May '14

07 May '14

Hi, I'm happy to announce version 3.6 of the GNU Gatekeeper. http://www.gnugk.org/h323download.html This version contains support for Polycom's domain##alias addressing, a new policy to route by URI prefix, better config checking, fixes for H.460.19 port detection and a number of other bugfixes and smaller features. I'm trying to cut down on the time I have to spend on each release, so I will only provide executable to support client for this version. Please follow these instructions to compile GnuGk yourself: http://www.gnugk.org/compiling-gnugk.html Detailed change log: - support Polycom's domain##alias addressing in DNS policy - new command line switch: --strict (don't start with config errors) - new routing policy [Routing::URIService] to define service specific URI routing policy. - allow SendTo= without AlternateGKs= switch - new switch [EP::...] ForceGateway=1 to treat an endpoint as a gateway - new switch [EP::...] AddCallingPartyToSourceAddress=1 - new switch [EP::...] DisableCallCreditCapabilities=1 - verify the correct payloadType on H.460.19 keep-alive packets (disable with [Proxy] CheckH46019KeepAlivePT=0) - support libssh 0.6.x - BUGFIX(ProxyChannel.cxx) fix memory leak on TLS errors - BUGFIX(RasTbl.cxx) use 64bit numbers for AddNumbers= ranges - BUGFIX(RasSrv.cxx) fill destCallSignallAddress in answer ACF in direct mode - BUGFIX(RasSrv.cxx) fix callSignalPort in LCF when H.460.22 is enabled - BUGFIX(ProxyChannel.cxx) read ProxyHandlerHighPrio switch earlier - BUGFIX(ProxyChannel.cxx) wait 4 sec before using regular RTP packets for H.460.19 port detection - BUGFIX(gk.cxx) small fixes for MacOSX -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0

NSA H.323 surveilance
by Jan Willamowius 14 Mar '14

14 Mar '14

Hi, The Intercept just published a few very interesting slides how the NSA intercepts H.323 (and SIP and Skype) VoIP traffic: https://firstlook.org/theintercept/document/2014/03/12/vpn-voip-exploitatio… Notice how the HAMMERSTEIN component on page 4 "processes" the call signaling as man-in-the-middle. This would pretty much match the attack I have been warning about previously when I wrote "Why your AES encryption might be worth nothing". http://www.gnugk.org/h323-encryption.html Another interesting fact seems to be that they targeted H.323 and SIP before taking on Skype (bottom of page 2). Regards, Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan(a)willamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

2 2

GNU Gatekeeper 3.5 released
by Jan Willamowius 02 Jan '14

02 Jan '14

Dear community, I'm happy to announce the release of GNU Gatekeeper version 3.5. The new version brings a number of new features as well as a number of important bug fixes and a few changes in configuration options. As usual, you can download the source code and executable for Linux, Windows, FreeBSD, OpenBSD, NetBSD and Solaris from http://www.gnugk.org/h323download.html Regards, Jan New features: - implement H.460.22 to negotiate the use of TLS - language based routing (using the upcoming H.323v8) - new command line switch -mlock to prevent GnuGk from being swapped out - new section [ModeVendorSelection] to set proxy mode based on endpoint vendor support for challenge/response authentication using DES-ECB, eg. from Avaya endpoints - new switch [RoutedMode] FilterEmptyFacility= (Avaya interop) - new switch [RoutedMode] ProxyHandlerHighPrio=0 to avoid setting the proxy handler to high priority; needed to run GnuGk on certain virtualization platforms - print number of proxied calls and peak number of calls in statistics on status port - new switch [RoutedMode] H46023ForceNat - new switch [RewriteSourceAddress] TreatNumberURIDialedDigits - more detailed codec descriptions in %{codec} and Radius attribute - process multiple terminal-alias VSA from Radius - extend [GkStatus::Message] for URQ Configuration changes: - changed default call signaling port from 1721 to 1720 - replace H235HalfCallMediaStrength= switch with H235HalfCallMaxTokenLength= - disable use of SHA1 for TLS by default, the new switch [TLS] CipherList= can be used to customize the cipher selection And a number of bug fixes (see changes.txt for all the details). -- Jan Willamowius, Founder of the GNU Gatekeeper Project Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Relaxed Communications GmbH Frahmredder 91 22393 Hamburg Geschäftsführer: Jan Willamowius HRB 125261 (Amtsgericht Hamburg) USt-IdNr: DE286003584

1 0