netcat | Simple netcat on go | Networking library

Ugh! Found it.

It looks like echo adds a trailing newline to the string, whereas printf does NOT, and this trailing newline character is interfering with the device's ability to parse the command. If I forcefully add it (a newline char, \n) to the end of the printf cmd, then it fails too--meaning the device will not respond to the command as expected:

If you try to debug a script with xdebug_info() in it, it will tell you exactly what Xdebug tried to do, if anything at all.

You can also make a log file by setting xdebug.log=/tmp/xdebug.log and xdebug.log_level=10, and then this log file will show even greater detail as to what went on.

Please note that although a connection can be open, you might not have the right process. Port 9000 is also used by PHP-FPM, which is why Xdebug 3 now uses 9003 by default.

Since your method would accept an object node as an input so you can do something like this:

This is a ncat limitation.

Let's use strace to look into what ncat is up to. Conveniently, strace has -e option to filter system calls, e.g. -e %net for logging network-related syscalls. Let's start the server first:

Now works. I added time.sleep(0.2) after each sendall in rce.py

Network policies and services are two different and independent Kubernetes resources.

Service is:

An abstract way to expose an application running on a set of Pods as a network service.

Good explanation from the Kubernetes docs:

Kubernetes Pods are created and destroyed to match the state of your cluster. Pods are nonpermanent resources. If you use a Deployment to run your app, it can create and destroy Pods dynamically.

Each Pod gets its own IP address, however in a Deployment, the set of Pods running in one moment in time could be different from the set of Pods running that application a moment later.

This leads to a problem: if some set of Pods (call them "backends") provides functionality to other Pods (call them "frontends") inside your cluster, how do the frontends find out and keep track of which IP address to connect to, so that the frontend can use the backend part of the workload?

Enter Services.

Also another good explanation in this answer.

For production you should use a workload resources instead of creating pods directly:

Pods are generally not created directly and are created using workload resources. See Working with Pods for more information on how Pods are used with workload resources. Here are some examples of workload resources that manage one or more Pods:

• Deployment
• StatefulSet
• DaemonSet

And use services to make requests to your application.

Network policies are used to control traffic flow:

If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you might consider using Kubernetes NetworkPolicies for particular applications in your cluster.

Network policies target pods, not services (an abstraction). Check this answer and this one.

Regarding your examples - your network policy is correct (as I tested it below). The problem is that your cluster may not be compatible:

For Network Policies to take effect, your cluster needs to run a network plugin which also enforces them. Project Calico or Cilium are plugins that do so. This is not the default when creating a cluster!

Test on kubeadm cluster with Calico plugin -> I created similar pods as you did, but I changed container part:

You could build and publish your own container image if you wanted with a dockerfile like this

Netcat works on your Windows machine for the same reason that MailKit works on your Windows machine.

Your Windows machine has an unblock route to the mail server.

Your Ubuntu server, on the other hand, does not have an unblocked route to the mail server, so it fails to connect there.

You need to figure out your firewall and/or routing tables on your Ubuntu server and fix that to allow connecting to the mail server.

I think I see what is going on in the source, but i have not run the framework to confirm it.

It looks like mininet inatalls a NAT rule for every node: