parse arg before add

[tinpotnick]

This allows a command line in a docker swarm yaml and the PUBLIC_IP is replaced - allowing for greater flexibility in how the command line is called.

command: 'drachtio --contact sip::9997;transport=udp,tcp --external-ip PUBLIC_IP --contact sips::443;transport=wss --external-ip PUBLIC_IP'

environment:

• CLOUD=aws

[davehorton]

It seems like the main thing you are trying to accomplish here is to be able to listen on a different udp/tcp port (9997 instead of 5060) is that right?

[mattmacadams]

It seems a bit confusing to support multiple --external-ip args supported since these can typically be rearranged without impacting the final configuration

[tinpotnick]

Sorry - not enough detail.

It is not a port issue - I can modify the port by setting the correct env variable DRACHTIO_SIP_PORT, WSS_PORT or TLS_PORT. And these all work correctly.

The problem is with Docker Swarm on EC2 (and probably similar environments).

The AWS network:

Public IP: 1.2.3.4
EC2 IP: 172.31.33.53
Docker container IP: 10.0.1.33 (running on a swarm on the EC2 instance with IP 172.31.33.53).

In this scenario, you need to obtain the public IP for Drachtio (PUBLIC_IP in entrypoint.sh) - which works as expected - and still works in the Docker Swarm. PUBLIC_IP is set to 1.2.3.4.

entrypoint.sh also obtains LOCAL_IP as 172.31.33.53 - so passes this into Drachtio. Drachtio then fails to start as it cannot bind to this IP (it would require 10.0.1.33 to work - or *). 172.31.33.53 is not a local IP inside the Swarm.

In entrypoint.sh, once it has gathered the correct values for LOCAL_IP and PUBLIC_IP you have to use --cloud-deployment to indicate that you want to construct the command line to be generated to use those values - WSS_PORT and TLS_PORT are separately done further down. But when you do this:

MYARGS+=("--contact")
MYARGS+=("sip:${LOCAL_IP}:${DRACHTIO_SIP_PORT:-5060};transport=udp,tcp")

There is no way to set LOCAL_IP as something else, such as * - or the correct local IP address.

This is the Docker Swarm stack file which fails with the bind error. Where --cloud-deployment instructs entrypoint.sh to construct the params for Drachtio.

version: "3.9"

services:

  drachtio:

    image: docker.io/tinpotnick/drachtio:test
    hostname: 'drachtio-{{.Task.Slot}}'

    command: 'drachtio --cloud-deployment'

    environment:
      - CLOUD=aws
      - DRACHTIO_ADMIN_TCP_PORT=9022
      - DRACHTIO_SECRET=cymru
      - DRACHTIO_PROMETHEUS_SCRAPE_PORT=9090
      - DRACHTIO_TLS_CERT_FILE=/var/run/secrets/wss.pem
      - DRACHTIO_TLS_CHAIN_FILE=/var/run/secrets/wss.pem
      - DRACHTIO_TLS_KEY_FILE=/var/run/secrets/wss.pem
      - DRACHTIO_MIN_TLS_VERSION=1.2

    ports:
      - target: 9997
        published: 9997
        protocol: tcp
        mode: host

      - target: 9997
        published: 9997
        protocol: udp
        mode: host

      - target: 9998
        published: 9998
        protocol: tcp
        mode: host

      - target: 443
        published: 443
        protocol: tcp
        mode: host

    networks:
      - mainnetwork

    deploy:
      mode: replicated
      replicas: 1
      placement:
        max_replicas_per_node: 1
        constraints:
          - node.labels.role == sipstack

    secrets:
      - wss.pem

This is the Docker Swarm stack file which works with the modified entrypoint.sh

version: "3.9"

services:

  drachtio:

    image: docker.io/tinpotnick/drachtio:test
    hostname: 'drachtio-{{.Task.Slot}}'

    command: 'drachtio --contact sip:*:9997;transport=udp,tcp --external-ip PUBLIC_IP --contact sips:*:443;transport=wss --external-ip PUBLIC_IP'

    environment:
      - CLOUD=aws
      - DRACHTIO_ADMIN_TCP_PORT=9022
      - DRACHTIO_SECRET=cymru
      - DRACHTIO_PROMETHEUS_SCRAPE_PORT=9090
      - DRACHTIO_TLS_CERT_FILE=/var/run/secrets/wss.pem
      - DRACHTIO_TLS_CHAIN_FILE=/var/run/secrets/wss.pem
      - DRACHTIO_TLS_KEY_FILE=/var/run/secrets/wss.pem
      - DRACHTIO_MIN_TLS_VERSION=1.2

    ports:
      - target: 9997
        published: 9997
        protocol: tcp
        mode: host

      - target: 9997
        published: 9997
        protocol: udp
        mode: host

      - target: 9998
        published: 9998
        protocol: tcp
        mode: host

      - target: 443
        published: 443
        protocol: tcp
        mode: host

    networks:
      - mainnetwork

    deploy:
      mode: replicated
      replicas: 1
      placement:
        max_replicas_per_node: 1
        constraints:
          - node.labels.role == sipstack

    secrets:
      - wss.pem

The proposed patch allows the command line to be much more configurable. In the second yaml example, add the values of either PUBLIC_IP or LOCAL_IP where you want - or simply use * to bind to all.

@mattmacadams It seems a bit confusing to support multiple --external-ip args supported since these can typically be rearranged without impacting the final configuration

Sorry - I don't understand this comment. The patch allows greater flexibility to whatever the command line needs to be and allows the insertion of the calculated IP addresses where you want them.

@davehorton - hopefully, I answered your comment above?

[mattmacadams]

I haven’t tested this, you may be able to solve for this by allowing processes to bind to non local ip addresses.

For example, adding this to sysctl.conf
net.ipv4.ip_nonlocal_bind=1

[tinpotnick]

@mattmacadams good suggestion - that gets Drachtio started as it no longer fails on bind, but Drachtio doesn't respond to anything. When I inspect the Drachtio logs a read of a SIP packet doesn't show.

It starts correctly and lists the correct ports it is listening on, but Drachtio doesn't respond.

I am not an expert on this - but I think the network stack, when t allows you to bind on a port and address (which isn't local) will only present the packet to that listening daemon if the IP and the port number are correct. Docker uses iptables to rewrite the destination address to the Docker swarm address - so the inbound packet will fail.

version: "3.9"

services:

  drachtio:

    image: docker.io/tinpotnick/drachtio:test
    hostname: 'drachtio-{{.Task.Slot}}'
    command: 'drachtio --cloud-deployment'
    
    sysctls:
      net.ipv4.ip_nonlocal_bind: '1'

    environment:
      - CLOUD=aws