Wireshark 2 is out - including H.323 over IPv6 decoding

Wireshark 2 has been released. It includes decoding of H.323 over IPv6 wich didn't work properly in all previous version.

Wireshark 2 has a new UI that takes a moment to get used to, but also includes a version with the 'lecacy' UI if you need to get things donme in a hurry and can't fuss with the new UI right now.

New GNU Gatekeeper 4.0 Features

H.235 password authentication

Until now, GnuGk only supported MD5 password tokens well. The password
only secured RRQ and ARQ messages in the direction from the endpoint to
the gatekeeper and MD5 is considered a pretty weak algorithm. MD5
tokens are widely supported by vendors and are usually called "H.235",
but strictly speaking they aren't part of any ITU spec.

The new implementation in GnuGk closely follows the H.235.1
specification. It secures all RAS (RRQ, ARQ, BRQ, DRQ etc.) and all
Q.931 (Setup, Alerting etc.) messages. It also secures both directions,
so the gatekeeper can check every message if it is really from the
endpoint and also the endpoint can make sure its really talking to its
gatekeeper.

The interpretation of H.235.1 varies between vendors (or their
implementation is just buggy, your call). Thats why GnuGk defaults to
rather strict checks, but has configuration switches ([H235] config
section) to enable interoperability with vendor implementations.

During development I ran tests with AudioCodes, Polycom, Inovaphone and
H323Plus endpoints.

For example if you are using a AudioCodes gateway, you should set

[Gatekeeper::Auth]
SimplePasswordAuth=required;RRQ,ARQ,DRQ,RAI,Setup,Alerting,Connect,ReleaseComplete,Facility

[H235]
UseEndpointIdentifier=1
RequireH2351GeneralID=0
FullQ931Checking=1
You can even tighten security with CheckID=1 in [SimplePasswordAuth].

Per endpoint codec filtering

Suppose you have this MCU, that works fine when endpoints use H.263,
but a lot of calls using H.264 fail. Now you can simply disable H.264
in your GnuGk config, even if that MCU doesn't give you that option:

[RoutedMode]
H245Routed=1

[EP::MyMCU]
DisabledCodecs=genericVideoCapability
Now that MCU can't negotiate H.264 any more and all calls will use
H.263. All other endpoint can still use all codecs.

Or suppose you have a Radvision MCU that is rather strict about using
symmetric codecs. Many endpoints don't handle symmetric codec
requirements correctly, but it often helps to simply disable H.239 if
you aren't using it away:

[EP::RadvisionMCU]
DisabledCodecs=extendedVideoCapability;genericControlCapability
If all your endpoints follow all the specs, you'll probably never need
this feature. Unfortunately not all do and thats when this feature
comes in handy.

IPv6 and IPv4-IPv6 conversion

Actually this is not a new feature in GnuGk 4.0, but 4.0 brings some
significant bug fixes and improvements.

We all know IPv6 will come some day, but hasn't so far, because some
equipment still works better with IPv4 or some network doesn't support
it, yet etc.

With GnuGk, you don't have to convert your network to IPv6, you can
simply add it as another option and GnuGk will convert between IPv4 and
IPv6 whenever necessary. So you can keep all your legacy endpoints that
only support IPv4 and still have them reach other endpoints that work
on IPv6.

I would suggest you give IPv6 a try in your network now, before things
get very urgent and must be done in a rush.

The config part in GnuGk is rather easy:

[Gatekeeper::Main]
EnableIPv6=1
In all places where you can put an IPv4 address, you can also place an
IPv6 address.

BTW: If you want to see your IPv6 H.323 calls in Wireshark, you need a
new version. I worked with the Wireshark developers to get the
disection fixed. That patch will probably be in 2.0.0rc1.

GNU Gatekeeper 3.9 released

I am pleased to announce a new release of the GNU Gatekeeper,
version 3.9, now available from https://www.gnugk.org/h323download.html.

This release includes source code suitable for Linux, Windows, MacOS X,
FreeBSD, NetBSD, OpenBSD and Solaris and executables for Linux.


Whats new in GnuGk 3.9 ?

• bug fixes, including a crash and hanging status port on Windows servers
• a new IP/port detection algorithm for endpoints behind NAT that works  well even with unregistered (!) endpoint
• neighbor pings to speed up call routing if your neighbors are frequently down
• geo-blocking: with the GeoIPAuth policy, you can allow or block calls based on the location of the IP
• status port event back log: When you connect to the status port to diagnose an issue, the relevant events are already gone. With this new feature you can tell GnuGk to save the last n events and show them later on. This way you can take a look at eg. the last 100 failed registrations etc.
• QoS DiffServ marking for RAS, H.225 and H.245 messages (based on patch provided by Vidyo) Now you can set the DiffServ class for signaling messages. Previously you could only mark RTP packets.
• support for H.235.TSSM: H.235 needs time synchronization between gatekeeper and endpoints and the proposed H.235.TSSM standard provides a means for endpoints to detect that they are not in sync with the gatekeeper and apply a time offset.

Replacing a Radvision ECS Gatekeeper with a GNU Gatekeeper

In many cases GnuGk can act as a drop-in replacement for the ECS Gatekeeper. I just noticed one strange thing: Radvision MCUs seem to register endpoint aliases instead of prefixes with the ECS and the ECS treats registrations from MCUs as prefixes. To fix that, you can simply assign prefixes to the MCU in your GNU Gatekeeper configuration and everything works like before.

Voila!

GNU Gatekeeper 3.8 released

I am pleased to announce a new release of the GNU Gatekeeper, version 3.8, available from https://www.gnugk.org/h323download.html.

This release includes source code sutitable for (Linux, Windows, MacOS, FreeBsd, NetBSD, OpenBSD and Solaris) and executables for Linux.

In addition to the new GnuGk version, I'm also happy to announce the general availability of the new Web Interface.


In response to the current wave of H.323 spam / hacking GnuGk 3.8 has a number of improvements to security related features:

• endpoint IDs are now completely random and not as easily guessable as they were before
• GnuGk is now using better random numbers in security relevant places
• new authentication modules using LUA scripts called LuaAuth
• new switch [RasSrv::ARQFeatures] CheckSenderIP=1 to make sure ARQs  come from the same IP as the initial registration
• FileIPAuth is now able to check ARQ messages
• AliasAuth updated to work with H.460.18 endpoint
• PrefixAuth was extended to support unregistered calls
• SQLAuth can now operate on SrcInfo fields using %{SrcInfo}
• improvements to the addpasswd utility.

Other new non-security related features include:

• The CatchAll policy now rewrites the destination alias which makes it easier to send CatchAll calls to MCU rooms.
• You can now filter out whole capability classes, eg. all video or H.239 capabilities if some of your endpoints have trouble handling them
• A new switch [Gatekeeper::Main] MinH323Version= lets you set the H.323 version GnuGk identifies itself as using (up to the latest version 7). This is mainly to deal with endpoint that switch features when they believe they are talking to older endpoints (which one shouldn't be doing...)
• a number bugs and crashes fixed

GNU Gatekeeper 3.7 released

Version 3.7 of the GNU Gatekeeper is out!

Please download it from https://www.gnugk.org/h323download.html

This is mainly a bugfix release that corrects a number of errors and
crashes (see below).

Please follow these compile instructions:
https://www.gnugk.org/compiling-gnugk.html

Enjoy!


Change log:

• allow Comment= in all sections
• new status port command: "debug cfg all" to print the full configuration
• stub code to fake support for Avaya 2.16.840.1.114187.1.3 authentication  (disabled by default)
• BUGFIX(Neighbor.cxx) fix outbound rules for GWRewriteE164 with neighbors
• BUGFIX(RasSrv.cxx) fix crash on shutdown
• BUGFIX(gkauth.cxx) for passwort auth look at correct src or dest info
• BUGFIX(Toolkit.cxx) more flexible column handling for [SQLConfig] PermanentEndpountsQuery, document priority and vendor info setting
• BUGFIX(gksql_sqlite.cxx) return empty string for NULL columns, like the other DB drivers do
• BUGFIX(RasTbl.cxx) fix formatting of PrintAllRegistrations and PrintAllRegistrationsVerbose
• BUGFIX(GkStatus.cxx) better handling when status clients don't quit properly
• BUGFIX(Toolkit.cxx) fix selection of reply address for IPv6

Monitoring the GNU Gatekeeper

When you run GnuGk in production, it is important to integrate it into your overall network monitoring to ensure its always running and to see the current throughput.

Your choices are basically

• SNMP
• custom plugins that connect to GnuGk's status port

For Nagois or Icinga its probably best to use GnuGk's SNMP support.

On the website there are also a few a few sample plugins for OpenSource Monitoring tools that don't support SNMP so well.