blob: eb0de12087c93ee22fb29f78c6ba983d683b4ffd [file] [log] [blame]
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -06001; The general section contains settings of nfd process.
Steve DiBenedetto24b9a642014-04-07 15:45:39 -06002general
3{
4 ; Specify a user and/or group for NFD to drop privileges to
5 ; when not performing privileged tasks. NFD does not drop
6 ; privileges by default.
7
8 ; user ndn-user
9 ; group ndn-user
10}
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060011
Steve DiBenedettobf6a93d2014-03-21 14:03:02 -060012log
13{
14 ; default_level specifies the logging level for modules
15 ; that are not explicitly named. All debugging levels
16 ; listed above the selected value are enabled.
17 ;
18 ; Valid values:
19 ;
20 ; NONE ; no messages
21 ; ERROR ; error messages
22 ; WARN ; warning messages
23 ; INFO ; informational messages (default)
24 ; DEBUG ; debugging messages
25 ; TRACE ; trace messages (most verbose)
26 ; ALL ; all messages
27
Alexander Afanasyev885a85b2014-04-12 21:01:13 -070028 default_level INFO
Steve DiBenedettobf6a93d2014-03-21 14:03:02 -060029
30 ; You may override default_level by assigning a logging level
31 ; to the desired module name. Module names can be found in two ways:
32 ;
33 ; Run:
34 ; nfd --modules
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -070035 ; nrd --modules
Steve DiBenedettobf6a93d2014-03-21 14:03:02 -060036 ;
37 ; Or look for NFD_LOG_INIT(<module name>) statements in .cpp files
38 ;
39 ; Example module-level settings:
40 ;
41 ; FibManager DEBUG
42 ; Forwarder INFO
43}
44
Steve DiBenedetto3a4f83d2014-06-02 14:58:54 -060045; The tables section configures the CS, PIT, FIB, Strategy Choice, and Measurements
46tables
47{
48
49 ; ContentStore size limit in number of packets
50 ; default is 65536, about 500MB with 8KB packet size
51 cs_max_packets 65536
Steve DiBenedettoc0640f52014-11-03 15:55:43 -070052
53 ; Set the forwarding strategy for the specified prefixes:
54 ; <prefix> <strategy>
55 strategy_choice
56 {
57 / /localhost/nfd/strategy/best-route
58 /localhost /localhost/nfd/strategy/broadcast
59 /localhost/nfd /localhost/nfd/strategy/best-route
60 /ndn/broadcast /localhost/nfd/strategy/broadcast
61 }
Steve DiBenedetto3a4f83d2014-06-02 14:58:54 -060062}
63
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060064; The face_system section defines what faces and channels are created.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060065face_system
66{
Steve DiBenedettodbcb1a12014-11-17 11:04:21 -070067 ; The unix section contains settings of Unix stream faces and channels.
68 ; Unix channel is always listening; delete unix section to disable
69 ; Unix stream faces and channels.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060070 unix
71 {
Steve DiBenedettodbcb1a12014-11-17 11:04:21 -070072 path /var/run/nfd.sock ; Unix stream listener path
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060073 }
74
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060075 ; The tcp section contains settings of TCP faces and channels.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060076 tcp
77 {
78 listen yes ; set to 'no' to disable TCP listener, default 'yes'
79 port 6363 ; TCP listener port number
Steve DiBenedetto95152872014-04-11 12:40:59 -060080 enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
81 enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060082 }
83
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060084 ; The udp section contains settings of UDP faces and channels.
Steve DiBenedetto95152872014-04-11 12:40:59 -060085 ; UDP channel is always listening; delete udp section to disable UDP
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060086 udp
87 {
88 port 6363 ; UDP unicast port number
Steve DiBenedetto95152872014-04-11 12:40:59 -060089 enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
90 enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060091 idle_timeout 600 ; idle time (seconds) before closing a UDP unicast face
92 keep_alive_interval 25; interval (seconds) between keep-alive refreshes
93
Alexander Afanasyev885a85b2014-04-12 21:01:13 -070094 ; UDP multicast settings
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060095 ; NFD creates one UDP multicast face per NIC
Giulio Grassi6d7176d2014-04-16 16:08:48 +020096 ;
97 ; In multi-homed Linux machines these settings will NOT work without
98 ; root or settings the appropriate permissions:
99 ;
100 ; sudo setcap cap_net_raw=eip /full/path/nfd
101 ;
Alexander Afanasyev885a85b2014-04-12 21:01:13 -0700102 mcast yes ; set to 'no' to disable UDP multicast, default 'yes'
103 mcast_port 56363 ; UDP multicast port number
104 mcast_group 224.0.23.170 ; UDP multicast group (IPv4 only)
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600105 }
106
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600107 ; The ether section contains settings of Ethernet faces and channels.
108 ; These settings will NOT work without root or setting the appropriate
109 ; permissions:
110 ;
111 ; sudo setcap cap_net_raw,cap_net_admin=eip /full/path/nfd
112 ;
113 ; You may need to install a package to use setcap:
114 ;
115 ; **Ubuntu:**
116 ;
117 ; sudo apt-get install libcap2-bin
118 ;
119 ; **Mac OS X:**
120 ;
121 ; curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
122 ; tar zxvf ChmodBPF.tar.gz
123 ; open ChmodBPF/Install\ ChmodBPF.app
124 ;
125 ; or manually:
126 ;
127 ; sudo chgrp admin /dev/bpf*
128 ; sudo chmod g+rw /dev/bpf*
129
Alexander Afanasyev885a85b2014-04-12 21:01:13 -0700130 @IF_HAVE_LIBPCAP@ether
131 @IF_HAVE_LIBPCAP@{
132 @IF_HAVE_LIBPCAP@ ; Ethernet multicast settings
133 @IF_HAVE_LIBPCAP@ ; NFD creates one Ethernet multicast face per NIC
134 @IF_HAVE_LIBPCAP@
135 @IF_HAVE_LIBPCAP@ mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
136 @IF_HAVE_LIBPCAP@ mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
137 @IF_HAVE_LIBPCAP@}
Wentao Shang53df1632014-04-21 12:01:32 -0700138
139 ; The websocket section contains settings of WebSocket faces and channels.
140
141 @IF_HAVE_WEBSOCKET@websocket
142 @IF_HAVE_WEBSOCKET@{
143 @IF_HAVE_WEBSOCKET@ listen yes ; set to 'no' to disable WebSocket listener, default 'yes'
144 @IF_HAVE_WEBSOCKET@ port 9696 ; WebSocket listener port number
145 @IF_HAVE_WEBSOCKET@ enable_v4 yes ; set to 'no' to disable listening on IPv4 socket, default 'yes'
146 @IF_HAVE_WEBSOCKET@ enable_v6 yes ; set to 'no' to disable listening on IPv6 socket, default 'yes'
147 @IF_HAVE_WEBSOCKET@}
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600148}
149
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600150; The authorizations section grants privileges to authorized keys.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600151authorizations
152{
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600153 ; An authorize section grants privileges to a NDN certificate.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600154 authorize
155 {
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600156 ; If you do not already have NDN certificate, you can generate
157 ; one with the following commands.
158 ;
159 ; 1. Generate and install a self-signed identity certificate:
160 ;
161 ; ndnsec-keygen /`whoami` | ndnsec-install-cert -
162 ;
163 ; Note that the argument to ndnsec-key will be the identity name of the
164 ; new key (in this case, /your-username). Identities are hierarchical NDN
165 ; names and may have multiple components (e.g. `/ndn/ucla/edu/alice`).
166 ; You may create additional keys and identities as you see fit.
167 ;
168 ; 2. Dump the NDN certificate to a file:
169 ;
170 ; sudo mkdir -p @SYSCONFDIR@/ndn/keys/
171 ; ndnsec-cert-dump -i /`whoami` > default.ndncert
172 ; sudo mv default.ndncert @SYSCONFDIR@/ndn/keys/default.ndncert
173 ;
174 ; The "certfile" field below specifies the default key directory for
175 ; your machine. You may move your newly created key to the location it
176 ; specifies or path.
177
Yingdi Yuc8f214c2014-04-29 20:39:37 -0700178 ; certfile keys/default.ndncert ; NDN identity certificate file
179 certfile any ; "any" authorizes command interests signed under any certificate,
180 ; i.e., no actual validation.
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600181 privileges ; set of privileges granted to this identity
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600182 {
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600183 faces
184 fib
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600185 strategy-choice
186 }
187 }
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600188
189 ; You may have multiple authorize sections that specify additional
190 ; certificates and their privileges.
191
Alexander Afanasyev885a85b2014-04-12 21:01:13 -0700192 ; authorize
193 ; {
194 ; certfile keys/this_cert_does_not_exist.ndncert
195 ; authorize
196 ; privileges
197 ; {
198 ; faces
199 ; }
200 ; }
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600201}
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700202
Yingdi Yue5224e92014-04-29 18:04:02 -0700203rib
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700204{
Yingdi Yue5224e92014-04-29 18:04:02 -0700205 ; The following localhost_security allows anyone to register routing entries in local RIB
206 localhost_security
207 {
208 trust-anchor
209 {
210 type any
211 }
212 }
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700213
Yingdi Yue5224e92014-04-29 18:04:02 -0700214 ; localhop_security should be enabled when NFD runs on a hub.
215 ; "/localhop/nfd/fib" command prefix will be disabled when localhop_security section is missing.
216 ; localhop_security
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700217 ; {
Yingdi Yue5224e92014-04-29 18:04:02 -0700218 ; ; This section defines the trust model for NFD RIB Management. It consists of rules and
219 ; ; trust-anchors, which are briefly defined in this file. For more information refer to
220 ; ; manpage of ndn-validator.conf:
221 ; ;
222 ; ; man ndn-validator.conf
223 ; ;
224 ; ; A trust-anchor is a pre-trusted certificate. This can be any certificate that is the
225 ; ; root of certification chain (e.g., NDN testbed root certificate) or an existing
226 ; ; default system certificate `default.ndncert`.
227 ; ;
228 ; ; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the
229 ; ; rules defined here. A rule can be broken into two parts: matching & checking. A packet
230 ; ; will be matched against rules from the first to the last until a matched rule is
231 ; ; encountered. The matched rule will be used to check the packet. If a packet does not
232 ; ; match any rule, it will be treated as invalid. The matching part of a rule consists
233 ; ; of `for` and `filter` sections. They collectively define which packets can be checked
234 ; ; with this rule. `for` defines packet type (data or interest) and `filter` defines
235 ; ; conditions on other properties of a packet. Right now, you can only define conditions
236 ; ; on packet name, and you can only specify ONLY ONE filter for packet name. The
237 ; ; checking part of a rule consists of `checker`, which defines the conditions that a
238 ; ; VALID packet MUST have. See comments in checker section for more details.
239 ;
240 ; rule
241 ; {
242 ; id "NRD Prefix Registration Command Rule"
243 ; for interest ; rule for Interests (to validate CommandInterests)
244 ; filter
245 ; {
246 ; type name ; condition on interest name (w/o signature)
Yingdi Yu676a55a2014-06-18 21:09:09 -0700247 ; regex ^[<localhop><localhost>]<nfd><rib>[<register><unregister>]<>$ ; prefix before
248 ; ; timestamp
Yingdi Yue5224e92014-04-29 18:04:02 -0700249 ; }
250 ; checker
251 ; {
252 ; type customized
253 ; sig-type rsa-sha256 ; interest must have a rsa-sha256 signature
254 ; key-locator
255 ; {
256 ; type name ; key locator must be the certificate name of the
257 ; ; signing key
258 ; regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
259 ; }
260 ; }
261 ; }
262 ; rule
263 ; {
264 ; id "NDN Testbed Hierarchy Rule"
265 ; for data ; rule for Data (to validate NDN certificates)
266 ; filter
267 ; {
268 ; type name ; condition on data name
269 ; regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
270 ; }
271 ; checker
272 ; {
273 ; type hierarchical ; the certificate name of the signing key and
274 ; ; the data name must follow the hierarchical model
275 ; sig-type rsa-sha256 ; data must have a rsa-sha256 signature
276 ; }
277 ; }
278 ; trust-anchor
279 ; {
280 ; type file
281 ; file-name keys/default.ndncert ; the file name, by default this file should be placed in the
282 ; ; same folder as this config file.
283 ; }
284 ; ; trust-anchor ; Can be repeated multiple times to specify multiple trust anchors
285 ; ; {
286 ; ; type file
287 ; ; file-name keys/ndn-testbed.ndncert
288 ; ; }
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700289 ; }
290}