gk-proxy, test-gk — H.323 Gatekeeper RAS proxy
gk-proxy [-hv] [-d ] dbglev-f cfgfile
test-gk [-hv] [-d ] dbglev-f [cfgfile-r] [-t ]test_expr
The gk-proxy provides H.323 Registration, Admission and Status (RAS) proxying service. It allows clients in local network to register at gatekeepers and to request them to manage H.323 connections.
Program test-gk tests syntax and partially semantics of the configuration; for test expression syntax, see test-expr(5).
The gk-proxy reads its configuration file
and starts receiving
datagrams on UDP sockets (address/port couples) specified by the
listen-on configuration directive (see listen-on(5)).
It also maintains a list of active sessions with two connections
(one from the client, the other to the server).
When a datagram arrives,
the proxy checks its source and destination addresses
and tries to assign the datagram to an existing session.
If a match is found,
the datagram is passed to a peer belonging to the session.
If no session matches and ACL allow it, a new session is created.
Otherwise, the datagram is dropped.
The proxy usually runs as two processes
(not counting the configuration resolving process - see resolving(7)): the single child process
manages all the sessions and the parent process manages the child and
restarts it after a failure, see also udpserver(7).
Format of the proxy configuration file is described in gk-proxy.cfg(5).
The maximum number of concurrent active sessions is set
by the configuration directive max-sessions.
The proxy registers all clients in a special memory mapped file.
Its name must be specified in map-file configuration item.
Contents of the file is used by the h323-proxy for decision
about H.323 connection destinations.
The gk-proxy uses single-phase ACLs
which are checked at the moment of a session establishment.
The ACL is named session-acl.
When a non-transparent session is created
(i.e., a session initiated by a datagram destined directly
to one of the sockets the gk-proxy is listening on)
and is allowed by policy, the proxy must be configured to communicate to a
specific remote server with
the plug-to configuration directive.
When a transparent session is created
(i.e., a session initiated by a datagram destined to a real server
and transparently redirected to the gk-proxy
(see transparency(7) for details), the proxy either communicates with the
destination server specified by the client or with the one defined by the
plug-to directive.
If a plug-to is applicable for a transparent
session, it has precedence over the original destination.
This means that gk-proxy will ignore
the original destination
and communicate with the plug-to server.
The proxy uses common Kernun mechanism for name resolving (see resolving(7)).
The proxy uses common Kernun mechanism for logging (see logging(7)). When a RAS request comes to the proxy, the SESSION-START (MMCG-810-I) and the ACL (MMCG-821-I) messages are logged. If the request is accepted, a new ID is assigned to it and the SESSION-INIT (MMCG-811-I) message is logged. After end of processing the set of requests from/for the client, the SESSION-END (MMCG-812-I) message is logged.
The proxy uses common Kernun mechanism for traffic shaping. For more detailed information, see traffic-shaping(7).
The proxy uses common Kernun mechanism for policy decisions about received and sent datagrams. It is described in access-control(7) and host-matching(7). For example, it is possible for gk-proxy to use the real client's address or any specified address as source address for datagrams forwarded to a server.
The gk-proxy adds many configuration
directives to the session-acl:
registerType of client registration. For details, see h323-proxy(8).
h323-addressAddress to which announced H.323 sessions are redirected. For details, see h323-proxy(8).
h323-session-timeoutTimeout to establish the H.323 session. After receiving an ARQ or ACF packet, the gk-proxy builds the NAT rule so that the following H.323 session will reach running h323-proxy. This rule must be deleted by the originator — gk-proxy. However, the gk-proxy has no information about success or failure of the H.323 session establishing. That's why there is a timeout to delete the rule. If the client starts the H.323 session within the timeout, deleting the rule will not affect the session. Otherwise, the H.323 session will not succeed. If there are problems with establishing H.323 sessions in your network, increase this timeout.
timeout.sessionThe session will be terminated if this number of seconds elapse since the session establishment.
timeout.inTimeout for datagrams from the server. If so many seconds elapse without receiving a datagram from the server, the session will be terminated.
timeout.outTimeout for datagrams from the client. If so many seconds elapse without receiving a datagram from the client, the session will be terminated.
timeout.bothTimeout for datagrams regardless their direction. If no datagram belonging to a session is received for so long time period, the session will be terminated.
-hPrint usage information.
-vDisplay version information and exit.
-d
dbglevSet debuging level to a specific number. Permitted values are 3 through to 9, 3 being the least and 9 the most verbose. See logging(7) for details. This setting is relevant only till configuration reading is finished.
-f
cfgfileRead cfgfile
for configuration information.