Networking on August Feng

Debugging a race condition in HTTP and TCP

Mon, 25 May 2026 00:00:00 +0000

About

I developed a terraform provider for the Anki Connect plugin so that I can author and manage my flash cards programatically using Terraform.

Hint: The Anki Connect is an Anki add-on that deploys a web API to interact with the data in Anki.

After a certain number of cards, the provider began experiencing intermittent connection errors:

╷
│ Error: Error reading note deck
│ 
│   with anki_note.what_is_the_inversion_after_63,
│   on chords.tf line 14, in resource "anki_note" "what_is_the_inversion_after_63":
│   14: resource "anki_note" "what_is_the_inversion_after_63" {
│ 
│ get decks: failed to execute request: Post "http://localhost:8765": read tcp 127.0.0.1:49802->127.0.0.1:8765: read: connection reset by peer
│

Critically thinking about logs

The Anki Connect plugin is the server, and it listens on port 8765.

You can cURL unix sockets

Wed, 26 Feb 2025 00:00:00 +0000

About

The docker API is hosted by default on a unix socket. It's mostly HTTP REST APIs, so let's cURL it.

cURL only

The cURL cli supports unix sockets.

  curl --unix-socket /var/run/docker.sock http:/localhost/images/json | jq

cURL with pipes

nc

We can chain a series of nc processes but the traffic is unable to flow back to the caller.

  nc -l 1234 | nc -U /var/run/docker.sock

When we curl http://localhost:1234/images/json, the response will be sent to the stdout connected to the second nc process instead of making its way back to the curl process.

Allowed HTTP Request Header Types

Sun, 09 Feb 2025 00:00:00 +0000

About

I'm trying to build a reverse proxy but it seems that there are some constraints on the headers that we can add to a HttpRequestMessage.

open System.Net.Http

let client = new HttpClient()

let request = new HttpRequestMessage(HttpMethod.Post, "https://example.com")

let tryAddHeader (message : HttpRequestMessage) (k : string) (v : string) =
    match message.Headers.TryAddWithoutValidation(k,v) with
    | true -> ()
    | false -> eprintfn $"Failed to add header: {k}."

let addHeader (message : HttpRequestMessage) (k : string) (v : string) =
    message.Headers.Add(k,v)

tryAddHeader request "Content-Type" "text/plain" // XXX: Failed to add header: Content-Type.
tryAddHeader request "Content-Length" "7" // XXX: Failed to add header: Content-Length.

addHeader request "Content-Length" "7" // XXX: throws an exception.

let response = client.Send(request)

Allowed Headers

The TryAddWithoutValidation will verify whether the header is allowed before adding it.

A study on tcp sequence numbers

Sun, 02 Feb 2025 00:00:00 +0000

Relative sequence numbers

Let's simulate a some TCP traffic between a server (nc -l 1234) and client (echo foobar | nc localhost 1234).

If we dump this with tcpdump -i lo port 1234, we'll see that the sequence numbers reset to 1 after the initial handshake is completed.

1. 22:57:07.921614 IP localhost.47162 > localhost.1234: Flags [S], seq 934227076, win 65495, options [mss 65495,sackOK,TS val 2756153644 ecr 0,nop,wscale 7], length 0
2. 22:57:07.921626 IP localhost.1234 > localhost.47162: Flags [S.], seq 2435073417, ack 934227077, win 65483, options [mss 65495,sackOK,TS val 2756153644 ecr 2756153644,nop,wscale 7], length 0
3. 22:57:07.921636 IP localhost.47162 > localhost.1234: Flags [.], ack 1, win 512, options [nop,nop,TS val 2756153644 ecr 2756153644], length 0
4. 22:57:07.921688 IP localhost.47162 > localhost.1234: Flags [P.], seq 1:8, ack 1, win 512, options [nop,nop,TS val 2756153644 ecr 2756153644], length 7
5. 22:57:07.921692 IP localhost.1234 > localhost.47162: Flags [.], ack 8, win 512, options [nop,nop,TS val 2756153644 ecr 2756153644], length 0
6. 22:57:07.921700 IP localhost.47162 > localhost.1234: Flags [F.], seq 8, ack 1, win 512, options [nop,nop,TS val 2756153644 ecr 2756153644], length 0
7. 22:57:07.921758 IP localhost.1234 > localhost.47162: Flags [F.], seq 1, ack 9, win 512, options [nop,nop,TS val 2756153644 ecr 2756153644], length 0
8. 22:57:07.921781 IP localhost.47162 > localhost.1234: Flags [.], ack 2, win 512, options [nop,nop,TS val 2756153644 ecr 2756153644], length 0

Note that I've enumerated the packets to help with illustration in the following sections.

Using SRTP

Tue, 20 Jun 2023 00:00:00 +0000

F#7 introduced a friendlier syntax for using SRTP. The constraints can now be specified in the function signature rather in the body.

  type Foo =
      { Bar: string
        Baz: string -> string }

  // before F# 7.0
  let inline runv1 foo : string * string =
      (^a: (member Bar: string) foo), (^a: (member Baz: (string -> string)) foo) "helloworld"

  // after F# 7.0
  let inline runv2<'T when 'T : (member Bar: string)
      and  'T : (member Baz: (string -> string))> (foo : 'T) : string * string =
      foo.Bar, foo.Baz "helloworld"

  [<EntryPoint>]
  let main _ =
      let foo = { Bar = "helloworld", Baz = id }
      runv1 foo |> printfn "%A"
      runv2 foo |> printfn "%A"
      0

Uncovering iptables in GKE

Tue, 30 May 2023 00:00:00 +0000

About

This is a quick walkthrough on the plumbing for routing cluster-level traffic of a private GKE cluster to the GCP managed control plane.

Walkthrough

find ip range of control plane

This is the subnet for the control plane, in a VPC from a GCP managed project. Private clusters are connected to it via a VPC Network Peering connection.

  gcloud container clusters describe ${cluster} --zone ${zone} --format json | jq '.privateClusterConfig.masterIpv4CidrBlock' # 10.0.0.0/28

find cluster ip of kube-apiserver

  kubectl -n default get svc kubernetes # 10.210.34.1

connect to a node

The first step is to connect to a node in the cluster.

netcat on MacOS vs Linux

Mon, 01 Jan 0001 00:00:00 +0000

MacOS

When we run a TCP server (nc -l 1234) with nc and send it traffic with a client (echo foobar | nc localhost 1234) nc , the client will exist.

Linux

When we run a TCP server (nc -l 1234) with nc and send it traffic with a client (echo foobar | nc localhost 1234) nc , the client will not exit.

We need to include the -N flag when running nc.