• 1 Post
  • 94 Comments
Joined 2 years ago
cake
Cake day: June 3rd, 2023

help-circle

  • I’ve used them both a good bit for D&D/TTRPG campaigns. The image generation has been great for making NPC portraits and custom magic item images. LLM’s have been pretty handy for practicing my DM-ing and improv, by asking it to act like a player and reacting to what it decides to do. And sometimes in the reverse by asking it to pitch interesting ideas for characters/dungeons/quest lines. I rarely took those in their entirety, but would often have bits and pieces I’d use.











  • To me, the potential point of confusion is referring to “sent by Ctrl+D” and things “received by the end process” as synonymous, ignoring the tty driver in between. When you Ctrl+d, you send a magic byte value to the tty master (which I would refer to as a EOF character, but I understand the argument against the terminology). On the other side of it the process doesn’t receive this value, but instead has its read call returned even if the buffer is 0.

    A simple example hopefully highlighting the difference

    Window1:
    nc -nvlp 5555 #"far nc"
    
    Window2:
    nc -nv 127.0.0.1 5555 #"local NC"
    Hi there[Enter]
    Hi [Ctrl+D]There[Ctrl+D][Enter]
    
    Window3:
    strace -p [pid of local nc]
    
    Window2:
    [Right arrow][Right arrow][Ctrl+D]
    [Ctrl+D]Uh oh[Enter]
    

    What we see is pretty much as described. From the first line, we see “Hi there\n” on the other side. For the second line, we first see "Hi " appear, then “There” then “\n”.

    From the third line, in the strace we can see the sequences representing the right-arrow key, and we can see the tty driver on the far side takes those sequences and interprets them to render the cursor two characters to the right.

    The fourth line is where it gets more interesting. We send the tty driver the EOF byte, and the tty driver interprets this and gives the current active tty client a 0-byte return to read() and assumes we have no more data to send. But unlike bash, nc doesn’t care about a 0-byte read and is still looking for more data (as we can see in the strace). But if we continue to type and send more data (the “Uh oh”), we can see in the strace that the tty never sends this to the nc. So, to some definition, we’re still sending data to the local nc, but the tty driver isn’t actually relaying it



  • Sorry, I was looking more specifically at that DNAT rule

    8   480 DNAT       6    --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2222 to:192.168.101.4:22
    

    That rule exists in the host 192.168.86.73, correct? And from the guest, 192.168.101.4 you are attempting to ssh into 192.168.86.73:2222?

    It might not be your issue (or only issue), but that DNAT rule says that if a connection comes in on port 2222, instead send it to 192.168.101.4:22. So 192.168.101.4->192.168.86.73:2222->192.168.101.4:22. I would have thought you’d want it to be a DNAT to 192.168.86.73, functionally doing port bending, so it goes 192.168.101.4->192.168.86.73:2222->192.168.86.73:22.

    That doesn’t explain the connection refused, though, based on what you’ve said; there’s some fringe possibilities, but I wouldn’t expect for your setup if you hadn’t said (like your ~/.ssh/ssh_config defining an alternate ssh port for your guest OS than 22). It’s somewhat annoying, but it might be worthwhile to do a packet capture on both ends and follow exactly where the packet is going. So a

    tcpdump -v -Nnn tcp port 22 or tcp port 2222


  • For general awareness, not all flags can match all parts of an iptables command; the part you included there with “–to offset” is only valid with the string module, and not the DNAT action. That said after playing around with it a little, iptables actually does short flag matching, so ‘DNAT --to 1.2.3.4’ ‘DNAT --to-d 1.2.3.4’ and ‘DNAT --to-destination’ are all equivalent, so not the source of your issue.

    I am having trouble following the IP scheme, though. Is your Alma guest 192.168.101.4, or is that the host IP? If it’s Alma’s and you are attempting to ssh from that IP to the host with that iptables rule, what should happen is that DNAT would then redirect that connection back to Alma. If the guest doesn’t have a :22 listener, you’d get a connection refused from itself.


  • Your hook has

    /sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT

    But I’d didn’t think that “–to” was a flag for DNAT, I thought it was “–to-destination”

    If you ‘iptables -nvL’ and ‘iptables -t nat -nvL’ do you see both your DNAT and forwarding rules (although if the default is ACCEPT and you don’t have other rules, the FORWARD one isn’t needed), and do you see the packet count for the rules increase?





  • It likely depends on the courthouse, but generally speaking you’ll show up, sign in, someone will give a little talk about how things work, and then you’ll wait in a waiting room for a few hours while various names are called. Then you’ll go into the court room and the actual jurors will get selected from the pool. They’ll ask some questions and depending on the answer some people will get removed (having a family member who’s a police officer is pretty common).

    If you’re not selected, you’ll probably go back to the waiting room to see if you get pulled for another case. If you are, you’ll sit and listen to the details of the case and eventually make a determination. Depending on the case/jurisdiction, you might also be a “backup juror” where you’ll sit through the entirety of the case, but won’t actually be part of the deliberation at the end unless another juror had to drop out for some reason.

    I ended up getting a murder trial, which was pretty interesting. Overall wasn’t a horrible experience, but definitely glad I brought a Steam Deck while I was waiting.