cam: remove xpt_polled_action
ClosedPublic
Actions

	Show First 20 Lines • Show All 46 Lines • ▼ Show 20 Lines

	'''			'''

	toc::[]			toc::[]

	[[problem]]			[[problem]]
	== The Problem			== The Problem

	First, lets assume you have <<ipsec-install>>.			First, lets assume you have crossref::ipsec-must[ipsec-install].
	How do you know it is <<caveat>>? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right.			How do you know it is crossref::ipsec-must[caveat]? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right.
	man:netstat[1] will list it. But can you independently confirm it?			man:netstat[1] will list it. But can you independently confirm it?

	[[solution]]			[[solution]]
	== The Solution			== The Solution

	First, some crypto-relevant info theory:			First, some crypto-relevant info theory:

	. Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol;			. Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol;
	. Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy.			. Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy.

	Suppose you could measure the entropy of the data to- and from- your network interface.			Suppose you could measure the entropy of the data to- and from- your network interface.
	Then you could see the difference between unencrypted data and encrypted data.			Then you could see the difference between unencrypted data and encrypted data.
	This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable.			This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable.

	[[MUST]]			[[MUST]]
	=== MUST			=== MUST

	Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample.			Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample.
	It uses a compression-like algorithm.			It uses a compression-like algorithm.
	<<code>> for a variant which measures successive (~quarter megabyte) chunks of a file.			crossref::ipsec-must[code] for a variant which measures successive (~quarter megabyte) chunks of a file.

	[[tcpdump]]			[[tcpdump]]
	=== Tcpdump			=== Tcpdump

	We also need a way to capture the raw network data.			We also need a way to capture the raw network data.
	A program called man:tcpdump[1] lets you do this, if you have enabled the _Berkeley Packet Filter_ interface in your <<kernel>>.			A program called man:tcpdump[1] lets you do this, if you have enabled the
				_Berkeley Packet Filter_ interface in your crossref::ipsec-must[kernel].

	The command:			The command:

	[source,shell]			[source,shell]
	....			....
	tcpdump -c 4000 -s 10000 -w dumpfile.bin			tcpdump -c 4000 -s 10000 -w dumpfile.bin
	....			....

	will capture 4000 raw packets to _dumpfile.bin_.			will capture 4000 raw packets to _dumpfile.bin_.
	Up to 10,000 bytes per packet will be captured in this example.			Up to 10,000 bytes per packet will be captured in this example.

	[[experiment]]			[[experiment]]
	== The Experiment			== The Experiment

	Here is the experiment:			Here is the experiment:

	[.procedure]			[.procedure]
	====			====
	. Open a window to an IPsec host and another window to an insecure host.			. Open a window to an IPsec host and another window to an insecure host.
	. Now start <<tcpdump>>.			. Now start crossref::ipsec-must[tcpdump].
	. In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop.			. In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop.
	. Now run <<code>> on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value.			. Now run crossref::ipsec-must[code] on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value.
	+			+
	[source,shell]			[source,shell]
	....			....
	% tcpdump -c 4000 -s 10000 -w ipsecdemo.bin			% tcpdump -c 4000 -s 10000 -w ipsecdemo.bin
	% uliscan ipsecdemo.bin			% uliscan ipsecdemo.bin
	Uliscan 21 Dec 98			Uliscan 21 Dec 98
	L=8 256 258560			L=8 256 258560
	Measuring file ipsecdemo.bin			Measuring file ipsecdemo.bin
	▲ Show 20 Lines • Show All 182 Lines • Show Last 20 Lines

View Options

sys/cam/cam_xpt_periph.h

	Show First 20 Lines • Show All 46 Lines • ▼ Show 20 Lines

	'''			'''

	toc::[]			toc::[]

	[[problem]]			[[problem]]
	== The Problem			== The Problem

	First, lets assume you have <<ipsec-install>>.			First, lets assume you have crossref::ipsec-must[ipsec-install].
	How do you know it is <<caveat>>? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right.			How do you know it is crossref::ipsec-must[caveat]? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right.
	man:netstat[1] will list it. But can you independently confirm it?			man:netstat[1] will list it. But can you independently confirm it?

	[[solution]]			[[solution]]
	== The Solution			== The Solution

	First, some crypto-relevant info theory:			First, some crypto-relevant info theory:

	. Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol;			. Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol;
	. Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy.			. Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy.

	Suppose you could measure the entropy of the data to- and from- your network interface.			Suppose you could measure the entropy of the data to- and from- your network interface.
	Then you could see the difference between unencrypted data and encrypted data.			Then you could see the difference between unencrypted data and encrypted data.
	This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable.			This would be true even if some of the data in "encrypted mode" was not encrypted---as the outermost IP header must be if the packet is to be routable.

	[[MUST]]			[[MUST]]
	=== MUST			=== MUST

	Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample.			Ueli Maurer's "Universal Statistical Test for Random Bit Generators"(https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf[MUST]) quickly measures the entropy of a sample.
	It uses a compression-like algorithm.			It uses a compression-like algorithm.
	<<code>> for a variant which measures successive (~quarter megabyte) chunks of a file.			crossref::ipsec-must[code] for a variant which measures successive (~quarter megabyte) chunks of a file.

	[[tcpdump]]			[[tcpdump]]
	=== Tcpdump			=== Tcpdump

	We also need a way to capture the raw network data.			We also need a way to capture the raw network data.
	A program called man:tcpdump[1] lets you do this, if you have enabled the _Berkeley Packet Filter_ interface in your <<kernel>>.			A program called man:tcpdump[1] lets you do this, if you have enabled the
				_Berkeley Packet Filter_ interface in your crossref::ipsec-must[kernel].

	The command:			The command:

	[source,shell]			[source,shell]
	....			....
	tcpdump -c 4000 -s 10000 -w dumpfile.bin			tcpdump -c 4000 -s 10000 -w dumpfile.bin
	....			....

	will capture 4000 raw packets to _dumpfile.bin_.			will capture 4000 raw packets to _dumpfile.bin_.
	Up to 10,000 bytes per packet will be captured in this example.			Up to 10,000 bytes per packet will be captured in this example.

	[[experiment]]			[[experiment]]
	== The Experiment			== The Experiment

	Here is the experiment:			Here is the experiment:

	[.procedure]			[.procedure]
	====			====
	. Open a window to an IPsec host and another window to an insecure host.			. Open a window to an IPsec host and another window to an insecure host.
	. Now start <<tcpdump>>.			. Now start crossref::ipsec-must[tcpdump].
	. In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop.			. In the "secure" window, run the UNIX(R) command man:yes[1], which will stream the `y` character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop.
	. Now run <<code>> on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value.			. Now run crossref::ipsec-must[code] on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the "normal" connection has 29% (2.1) of the expected value.
	+			+
	[source,shell]			[source,shell]
	....			....
	% tcpdump -c 4000 -s 10000 -w ipsecdemo.bin			% tcpdump -c 4000 -s 10000 -w ipsecdemo.bin
	% uliscan ipsecdemo.bin			% uliscan ipsecdemo.bin
	Uliscan 21 Dec 98			Uliscan 21 Dec 98
	L=8 256 258560			L=8 256 258560
	Measuring file ipsecdemo.bin			Measuring file ipsecdemo.bin
	▲ Show 20 Lines • Show All 182 Lines • Show Last 20 Lines

cam: remove xpt_polled_actionClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 89821

sys/cam/cam_xpt.c

sys/cam/cam_xpt_periph.h

cam: remove xpt_polled_action
ClosedPublic
Actions

Revision Contents
Changeset List