Page MenuHomeFreeBSD
Differential D22381

Use __ as the separator for the exported vars in bsd.compiler/linker.mk
ClosedPublic
Actions

Authored by arichardson on Nov 15 2019, 3:41 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Apr 16, 9:01 PM
Unknown Object (File)
Tue, Apr 15, 11:36 AM
Unknown Object (File)
Mon, Apr 14, 10:58 AM
Unknown Object (File)
Mar 12 2025, 10:34 PM
Unknown Object (File)
Mar 8 2025, 8:50 AM
Unknown Object (File)
Feb 17 2025, 3:10 PM
Unknown Object (File)
Jan 30 2025, 5:17 AM
Unknown Object (File)
Jan 25 2025, 10:32 PM
View All 51 Files
Subscribers
imp

Details

Reviewers
bdrewery
emaste
Commits
rS354736: Use __ as the separator for the exported vars in bsd.compiler/linker.mk
Summary

By using '__' instead of '.' as the separator we can also support systems
that use dash as /bin/sh (it's the default shell on Ubuntu/Debian). Dash
will unset any environment variables that use a non alphanumeric+undedscore
character and therefore submakes will fail to import the COMPILER_*
variables if we use '.' as the separator.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 27534
Build 25758: arc lint + arc unit

Revision Contents
Changeset List

PathSize
share/
mk/
10 lines
10 lines

Diff 64372

View Options

share/mk/bsd.compiler.mk

Show First 20 Lines • Show All 46 Lines • ▼ Show 20 Lines
''' '''
toc::[] toc::[]
[[problem]] [[problem]]
== The Problem == The Problem
First, lets assume you have <<ipsec-install>>. First, lets assume you have crossref::ipsec-must[ipsec-install].
How do you know it is <<caveat>>? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right. How do you know it is crossref::ipsec-must[caveat]? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right.
man:netstat[1] will list it. But can you independently confirm it? man:netstat[1] will list it. But can you independently confirm it?
[[solution]] [[solution]]
== The Solution == The Solution
First, some crypto-relevant info theory: First, some crypto-relevant info theory:
. Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol; . Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol;
. Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy. . Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy.
Suppose you could measure the entropy of the data to- and from- your network interface. Suppose you could measure the entropy of the data to- and from- your network interface.
Then you could see the difference between unencrypted data and encrypted data. Then you could see the difference between unencrypted data and encrypted data.
This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable. This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable.
[[MUST]] [[MUST]]
=== MUST === MUST
Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample. Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample.
It uses a compression-like algorithm. It uses a compression-like algorithm.
<<code>> for a variant which measures successive (~quarter megabyte) chunks of a file. crossref::ipsec-must[code] for a variant which measures successive (~quarter megabyte) chunks of a file.
[[tcpdump]] [[tcpdump]]
=== Tcpdump === Tcpdump
We also need a way to capture the raw network data. We also need a way to capture the raw network data.
A program called man:tcpdump[1] lets you do this, if you have enabled the _Berkeley Packet Filter_ interface in your <<kernel>>. A program called man:tcpdump[1] lets you do this, if you have enabled the
_Berkeley Packet Filter_ interface in your crossref::ipsec-must[kernel].
The command: The command:
[source,shell] [source,shell]
.... ....
tcpdump -c 4000 -s 10000 -w dumpfile.bin tcpdump -c 4000 -s 10000 -w dumpfile.bin
.... ....
will capture 4000 raw packets to _dumpfile.bin_. will capture 4000 raw packets to _dumpfile.bin_.
Up to 10,000 bytes per packet will be captured in this example. Up to 10,000 bytes per packet will be captured in this example.
[[experiment]] [[experiment]]
== The Experiment == The Experiment
Here is the experiment: Here is the experiment:
[.procedure] [.procedure]
==== ====
. Open a window to an IPsec host and another window to an insecure host. . Open a window to an IPsec host and another window to an insecure host.
. Now start <<tcpdump>>. . Now start crossref::ipsec-must[tcpdump].
. In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop. . In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop.
. Now run <<code>> on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value. . Now run crossref::ipsec-must[code] on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value.
+ +
[source,shell] [source,shell]
.... ....
% tcpdump -c 4000 -s 10000 -w ipsecdemo.bin % tcpdump -c 4000 -s 10000 -w ipsecdemo.bin
% uliscan ipsecdemo.bin % uliscan ipsecdemo.bin
Uliscan 21 Dec 98 Uliscan 21 Dec 98
L=8 256 258560 L=8 256 258560
Measuring file ipsecdemo.bin Measuring file ipsecdemo.bin
▲ Show 20 Lines • Show All 182 Lines • Show Last 20 Lines
View Options

share/mk/bsd.linker.mk

Show First 20 Lines • Show All 46 Lines • ▼ Show 20 Lines
''' '''
toc::[] toc::[]
[[problem]] [[problem]]
== The Problem == The Problem
First, lets assume you have <<ipsec-install>>. First, lets assume you have crossref::ipsec-must[ipsec-install].
How do you know it is <<caveat>>? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right. How do you know it is crossref::ipsec-must[caveat]? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right.
man:netstat[1] will list it. But can you independently confirm it? man:netstat[1] will list it. But can you independently confirm it?
[[solution]] [[solution]]
== The Solution == The Solution
First, some crypto-relevant info theory: First, some crypto-relevant info theory:
. Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol; . Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol;
. Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy. . Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy.
Suppose you could measure the entropy of the data to- and from- your network interface. Suppose you could measure the entropy of the data to- and from- your network interface.
Then you could see the difference between unencrypted data and encrypted data. Then you could see the difference between unencrypted data and encrypted data.
This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable. This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable.
[[MUST]] [[MUST]]
=== MUST === MUST
Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample. Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample.
It uses a compression-like algorithm. It uses a compression-like algorithm.
<<code>> for a variant which measures successive (~quarter megabyte) chunks of a file. crossref::ipsec-must[code] for a variant which measures successive (~quarter megabyte) chunks of a file.
[[tcpdump]] [[tcpdump]]
=== Tcpdump === Tcpdump
We also need a way to capture the raw network data. We also need a way to capture the raw network data.
A program called man:tcpdump[1] lets you do this, if you have enabled the _Berkeley Packet Filter_ interface in your <<kernel>>. A program called man:tcpdump[1] lets you do this, if you have enabled the
_Berkeley Packet Filter_ interface in your crossref::ipsec-must[kernel].
The command: The command:
[source,shell] [source,shell]
.... ....
tcpdump -c 4000 -s 10000 -w dumpfile.bin tcpdump -c 4000 -s 10000 -w dumpfile.bin
.... ....
will capture 4000 raw packets to _dumpfile.bin_. will capture 4000 raw packets to _dumpfile.bin_.
Up to 10,000 bytes per packet will be captured in this example. Up to 10,000 bytes per packet will be captured in this example.
[[experiment]] [[experiment]]
== The Experiment == The Experiment
Here is the experiment: Here is the experiment:
[.procedure] [.procedure]
==== ====
. Open a window to an IPsec host and another window to an insecure host. . Open a window to an IPsec host and another window to an insecure host.
. Now start <<tcpdump>>. . Now start crossref::ipsec-must[tcpdump].
. In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop. . In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop.
. Now run <<code>> on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value. . Now run crossref::ipsec-must[code] on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value.
+ +
[source,shell] [source,shell]
.... ....
% tcpdump -c 4000 -s 10000 -w ipsecdemo.bin % tcpdump -c 4000 -s 10000 -w ipsecdemo.bin
% uliscan ipsecdemo.bin % uliscan ipsecdemo.bin
Uliscan 21 Dec 98 Uliscan 21 Dec 98
L=8 256 258560 L=8 256 258560
Measuring file ipsecdemo.bin Measuring file ipsecdemo.bin
▲ Show 20 Lines • Show All 182 Lines • Show Last 20 Lines