Thursday, September 21, 2017

GNU Gatekeeper 4.7 (security update)

This version is purely a security update and has no new features. All users are encouraged to update, especially if you use port detection (IgnoreSignaledIPs=1) you should update ASAP.

It has been discovered that GnuGk is vulnerable in some configurations for RTP bleed attacks ( By updating to version 4.7 only the first packets in each media stream influence the media destination.

To further secure your configuration, you can set


to only accept RTP from the same class C network that the call signaling came from. Please beware that this may break a few valid calls where this condition isn't met.

You can download the new version from

Please see the full change log below.

Changes from 4.6 to 4.7
  • fixes for RTP Bleed
  • new switch [Proxy] RestrictRTPSources=IP or Net to limit accepting RTP from the call signal IPs or the respective class C network
  • new switch [Proxy] LegacyPortDetection=1 to keep port detection help for some very old and broken endpoints that will make your gatekeeper vulnerable to RTP Bleed attacks
  • BUGFIX(ProxyChannel.cxx) replace @ip or ip## from aliases when using RedirectCallsToGkIP
  • BUGFIX(ProxyChannel.cxx) better initialization of sendmsg() structs
  • new command line option: now you can use -S instead of --strict (needed on BSD systems)

Monday, September 4, 2017

GNU Gatekeeper 4.6 is out

I'm happy to announce that GNU Gatekeeper version 4.6 has just been

This version has a few new features as well as bug fixes.

New features:
  • least used routing: distribute calls evenly between gateways or MCUs (new switch [RasSrv::ARQFeatures] LeastUsedRouting=1)
  • ability to log to the Unix syslog instead of the trace file (new switch [LogFile] TraceToSyslog=1)
  • new authentication module TwoAliasAuth this is not very safe, but you can use it with endpoints that do not support any password transmission
  • new switch [CTI::MakeCall] Bandwidth= to set the maximum bandwidth  for the calls generated by the GnuGk status port API
  • new status port command: UnregisterEP <ep-id>
  • a number of switches to fine tune TCP keepalives
  • new switch to remove load balancers from the call path ([RoutedMode] RedirectCallsToGkIP=1)

Bug fixes:
  • fixed TCP keepalive for H.460 calls (important!)
  • fixes to port detection for unregistered calls
  • audio fix when GnuGk adds encryption to calls
  • many smaller fixes

You can download the new version from

Please see the full change log below.

Changes from 4.5 to 4.6

  • new switch: [RoutedMode] RedirectCallsToGkIP=1
  • new switches: [RoutedMode] H460KeepAliveMethodH225=, H460KeepAliveMethodH245=, GnuGkTcpKeepAliveMethodH225=, GnuGkTcpKeepAliveMethodH245=
  • BUGFIX(ProxyChannel.cxx) TCP keep-alives for H.460.18 calls weren't always  enabled correctly
  • don't open a status port listener if [Gatekeeper::Main] StatusPort=0
  • BUGFIX(Toolkit.cxx) remove trailing chars before checking for DefaultDomain
  • add callID to H.245 trace messages for easier debugging
  • BUGFIX(ProxyChannel.cxx) forward ReleaseComplete from remaining party while doing call reroute
  • BUGFIX(ProxyChannel.cxx) drop un-en/decryptable RTP packets at end of call  when adding encryption
  • new status port command: UnregisterEP <ep-id>
  • BUGFIX(RasSrv.cxx) remove IPv6 addresses before processing RRQs when IPv6 is not enabled
  • send Facility message as as non-H.460.18 keep-alive for H.225
  • send non-standard H.245 userIndication as non-H.460.18 keep-alive for H.245
  • new switch [RoutedMode] DisableGnuGkH245TcpKeepAlive=1
  • new switch [LogFile] TraceToSyslog=1 to send trace output to syslog (Unix only)
  • BUGFIX(ProxyChannel.cxx) fix port detection for re-opened channels with IgnoreSignaledIPs=1
  • new switch [CTI::MakeCall] Bandwidth= to set the maximum bandwidth for the call
  • new switch [RasSrv::ARQFeatures] LeastUsedRouting=1 to select the least used gateway
  • new authentication module TwoAliasAuth

Wednesday, April 19, 2017

User Poll 2017

Could everybody please give some feedback how you like GnuGk and it can be improved ?

I have compiled a quick poll. Please feel free to add any other suggestions you may have.

In the past, these surveys have always been a great inspiration.
Please keep the feedback coming.

Thanks for your time!

Friday, March 17, 2017

GNU Gatekeeper 4.5 released

The most important change is the implementation of TCP keepalives for H.460.18 (bugfix) and optionally for all kinds of calls (feature). This is really important for NAT traversal.

In addition to the keepalives there are a number of bugfixes and a few minor feature additions (see the change notes below).

You can download the new version from

Full change log from 4.4 to 4.5

  • new feature to send H.225 and H.245 keep-alives for all calls, enable with [RoutedMode] EnableGnuGkTcpKeepAlive=1, set interval with GnuGkTcpKeepAliveInterval=n
  • BUGFIX(ProxyChannel.cxx) send H.225 and H.245 keep-alives when acting as H.460.18 client
  • BUGFIX(ProxyChannel.cxx) disable RTP/RTCP port check for IPs in AllowedSignalIPs= when doing port detection
  • [Proxy] AllowedSignalIPs= can now process a list of networks
  • add shortcurt 'rl' for status port command 'rotatelog'
  • new switch [CallTable] SetCalledStationIdToDialedIP=1
  • new switch [CallTable] UseDestCallSignalIPAsDialedNumber=1 to place the destSignalIP into the %{DialedNumber} field if no dialed number is available in the ARQ / Setup
  • BUGFIX(ProxyChannel.cxx) fix crash on invalid sourceCallSignalAddress
  • add optional parameter for call transfer method to MakeCall status port command
  • BUGFIX(Toolkit.*) fix bug in IP comparison
  • BUGFIX(Toolkit.*) the internal networks configured with the [Proxy] InternalNetworks switch were added to the detected internal networks and didn't replace them, now they replace them as documented

Friday, January 6, 2017

GNU Gatekeeper 4.4 released

GNU Gatekeeper 4.4 was released today. This is mainly a bug fix release
with only 2 new features.

If you use SSH on your status port you are urged to update as soon as
possible and also if you use LUA scripting. Two serious bugs have been
fixed for these features where GnuGk can be crashed remotely.

A new feature is the RequireOneNet policy that allows you to restrict
access to publicly accessible traversal gatekeepers. Now you can easily
define that one end of all calls must terminate in one of your own
networks and prevent abuse of your resources by 3rd parties.

The other new feature is a significant improvement to the MakeCall
command on the status port. It is now able to establish video calls and
supports virtually all endpoints by using GnuGk's call reroute feature.

Changed config switches:
  • [Proxy] ProxyForNAT now defaults to OFF
  • [CTI::MakeCall] DisableFastStart has been removed, fastStart is now always disabled

You can download the new version from

Please see the full change log below.

These know bugs haven't been addressed, yet:
  • when GnuGk acts as a H.460.18 client (as client in a H.460.18 traversal zone with another gatekeeper or as child gatekeeper), it currently does not send a keep-alive on the Q.931 TCP connection  during a call
  • bandwidth management currently only applies to calls from registered endpoints and ignores unregistered calls completely

Changes from 4.3 to 4.4
  • [CTI::MakeCall] TransferMethod can now also be Reroute, DisableFastStart switch removed
  • BUGFIX(MakeCall.cxx) fix MakeCall bearer capabilities to support video calls
  • BUGFIX(ProxyChannel.cxx) don't send Notify after call Reroute: Polycom RealPresens  starts a flood of Status messages
  • BUGFIX(GkStatus.cxx) call ssh_init() and ssh_finalize() only on application start and shutdown
  • BUGFIX(ProxyChannel.cxx) fix IP check for IgnoreSignaledPrivateH239IPs= switch
  • new accounting/authentication policy RequireOneNet
  • pass full RRQ message to LuaAuth
  • BUGFIX(ProxyChannel.cxx) when opening a port from a PortRange fails, try next port  regardless of errno
  • BUGFIX(lua.cxx) add mutex for LUA interpreter, because it is not thread safe
  • added message type parameter in RouteRequest event (ARQ, Setup, LRQ)
  • BUGFIX(yasocket.cxx) fix UDP with LARGE_FDSET on Solaris, OpenBSD and NetBSD
  • BUGFIX(RasTbl.cxx) fix crash on invalid AliasTypeFilter setting
  • changed default setting: [Proxy] ProxyForNAT now defaults to off, if you want to keep the previous behaviour, please set it explicitely