Replacing a Radvision ECS Gatekeeper with a GNU Gatekeeper

In many cases GnuGk can act as a drop-in replacement for the ECS Gatekeeper. I just noticed one strange thing: Radvision MCUs seem to register endpoint aliases instead of prefixes with the ECS and the ECS treats registrations from MCUs as prefixes. To fix that, you can simply assign prefixes to the MCU in your GNU Gatekeeper configuration and everything works like before.

Voila!

GNU Gatekeeper 3.8 released

I am pleased to announce a new release of the GNU Gatekeeper, version 3.8, available from https://www.gnugk.org/h323download.html.

This release includes source code sutitable for (Linux, Windows, MacOS, FreeBsd, NetBSD, OpenBSD and Solaris) and executables for Linux.

In addition to the new GnuGk version, I'm also happy to announce the general availability of the new Web Interface.


In response to the current wave of H.323 spam / hacking GnuGk 3.8 has a number of improvements to security related features:

• endpoint IDs are now completely random and not as easily guessable as they were before
• GnuGk is now using better random numbers in security relevant places
• new authentication modules using LUA scripts called LuaAuth
• new switch [RasSrv::ARQFeatures] CheckSenderIP=1 to make sure ARQs  come from the same IP as the initial registration
• FileIPAuth is now able to check ARQ messages
• AliasAuth updated to work with H.460.18 endpoint
• PrefixAuth was extended to support unregistered calls
• SQLAuth can now operate on SrcInfo fields using %{SrcInfo}
• improvements to the addpasswd utility.

Other new non-security related features include:

• The CatchAll policy now rewrites the destination alias which makes it easier to send CatchAll calls to MCU rooms.
• You can now filter out whole capability classes, eg. all video or H.239 capabilities if some of your endpoints have trouble handling them
• A new switch [Gatekeeper::Main] MinH323Version= lets you set the H.323 version GnuGk identifies itself as using (up to the latest version 7). This is mainly to deal with endpoint that switch features when they believe they are talking to older endpoints (which one shouldn't be doing...)
• a number bugs and crashes fixed

GNU Gatekeeper 3.7 released

Version 3.7 of the GNU Gatekeeper is out!

Please download it from https://www.gnugk.org/h323download.html

This is mainly a bugfix release that corrects a number of errors and
crashes (see below).

Please follow these compile instructions:
https://www.gnugk.org/compiling-gnugk.html

Enjoy!


Change log:

• allow Comment= in all sections
• new status port command: "debug cfg all" to print the full configuration
• stub code to fake support for Avaya 2.16.840.1.114187.1.3 authentication  (disabled by default)
• BUGFIX(Neighbor.cxx) fix outbound rules for GWRewriteE164 with neighbors
• BUGFIX(RasSrv.cxx) fix crash on shutdown
• BUGFIX(gkauth.cxx) for passwort auth look at correct src or dest info
• BUGFIX(Toolkit.cxx) more flexible column handling for [SQLConfig] PermanentEndpountsQuery, document priority and vendor info setting
• BUGFIX(gksql_sqlite.cxx) return empty string for NULL columns, like the other DB drivers do
• BUGFIX(RasTbl.cxx) fix formatting of PrintAllRegistrations and PrintAllRegistrationsVerbose
• BUGFIX(GkStatus.cxx) better handling when status clients don't quit properly
• BUGFIX(Toolkit.cxx) fix selection of reply address for IPv6

Monitoring the GNU Gatekeeper

When you run GnuGk in production, it is important to integrate it into your overall network monitoring to ensure its always running and to see the current throughput.

Your choices are basically

• SNMP
• custom plugins that connect to GnuGk's status port

For Nagois or Icinga its probably best to use GnuGk's SNMP support.

On the website there are also a few a few sample plugins for OpenSource Monitoring tools that don't support SNMP so well.

GNU Gatekeeper 3.6

Version 3.6 of the GNU gatekeeper has been released.

Please download the source code from
https://www.gnugk.org/h323download.html

This version contains support for Polycom's domain##alias addressing, a
new policy to route by URI prefix, better config checking, fixes for
H.460.19 port detection and a number of other bugfixes and smaller
features.

I'm trying to cut down on the time I have to spend on each release, so
I will only provide executable to support client for this version.

Please follow these instructions to compile GnuGk yourself:
https://www.gnugk.org/compiling-gnugk.html

Full change log:

• support Polycom's domain##alias addressing in DNS policy
• new command line switch: --strict (don't start with config errors)
• new routing policy [Routing::URIService] to define service specific URI routing policy.
• allow SendTo= without AlternateGKs= switch
• new switch [EP::...] ForceGateway=1 to treat an endpoint as a gateway
• new switch [EP::...] AddCallingPartyToSourceAddress=1
• new switch [EP::...] DisableCallCreditCapabilities=1
• verify the correct payloadType on H.460.19 keep-alive packets (disable with [Proxy] CheckH46019KeepAlivePT=0)
• support libssh 0.6.x
• BUGFIX(ProxyChannel.cxx) fix memory leak on TLS errors
• BUGFIX(RasTbl.cxx) use 64bit numbers for AddNumbers= ranges
• BUGFIX(RasSrv.cxx) fill destCallSignallAddress in answer ACF in direct mode
• BUGFIX(RasSrv.cxx) fix callSignalPort in LCF when H.460.22 is enabled
• BUGFIX(ProxyChannel.cxx) read ProxyHandlerHighPrio switch earlier
• BUGFIX(ProxyChannel.cxx) wait 4 sec before using regular RTP packets for H.460.19 port detection
• BUGFIX(gk.cxx) small fixes for MacOSX

Enjoy!

Free mobile H.323 endpoints

While it is hard to find good H.323 endpoints for PCs that are free, there are a number of free mobile apps available that work very well with GnuGk.

Polycom RealPresence Mobile (iOS and Android)

Skip the login for the RealPresence server and set a gatekeeper in the H.323 settings.

http://support.polycom.com/PolycomService/support/us/support/video/realpresence_mobile/realpresence_mobile.html

Sony IPELA Communications Mobile (iOS and Android)

Don't be scared away by the Japanese description in the Play Store, the app works in English.

https://itunes.apple.com/us/app/ipela-communication-mobile/id836335177?mt=8

https://play.google.com/store/apps/details?id=com.sony.mobile.ep

Radvision BeeHD (iOS)

https://itunes.apple.com/de/app/beehd/id639912661?mt=8

Does anybody know other mobile endpoints that I missed ?

Whats new in GnuGk 3.5 ? Part 3: Performance

To avoid the performance hit that happens on Linux when your GNU Gatekeeper gets swapped out on a busy server, GnuGk 3.5  has a new command line switch to lock GnuGk in memory (--mlock).

As a tool to allow you to better monitor your call volume, the call statistics on the status port will now show the peak number of calls in addition to the current load. This is an important piece of data to plan socket and thread allocation for your configuration.

GnuGk 3.5 will now also run on certain Linux server virtualization platforms that don't give GnuGk full control over thread prioritization, even when running under the root user. Now you can turn off setting the proxy handler thread to high priority and GnuGk will start as it should. Use the ProxyHandlerHighPrio switch if your GnuGk dies on startup with a PTLib assertion "pthread_setschedparam failed".

[RoutedMode]
ProxyHandlerHighPrio=0

If you run a high load GnuGk installation or if you are concerned about performance, please contact me to have a chat.