blob: 7e183588a82a356fc694f1fff502bf6fcd268d0b [file] [log] [blame]
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -06001; The general section contains settings of nfd process.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -06002; general
3; {
4; }
5
Steve DiBenedettobf6a93d2014-03-21 14:03:02 -06006log
7{
8 ; default_level specifies the logging level for modules
9 ; that are not explicitly named. All debugging levels
10 ; listed above the selected value are enabled.
11 ;
12 ; Valid values:
13 ;
14 ; NONE ; no messages
15 ; ERROR ; error messages
16 ; WARN ; warning messages
17 ; INFO ; informational messages (default)
18 ; DEBUG ; debugging messages
19 ; TRACE ; trace messages (most verbose)
20 ; ALL ; all messages
21
Alexander Afanasyev885a85b2014-04-12 21:01:13 -070022 default_level INFO
Steve DiBenedettobf6a93d2014-03-21 14:03:02 -060023
24 ; You may override default_level by assigning a logging level
25 ; to the desired module name. Module names can be found in two ways:
26 ;
27 ; Run:
28 ; nfd --modules
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -070029 ; nrd --modules
Steve DiBenedettobf6a93d2014-03-21 14:03:02 -060030 ;
31 ; Or look for NFD_LOG_INIT(<module name>) statements in .cpp files
32 ;
33 ; Example module-level settings:
34 ;
35 ; FibManager DEBUG
36 ; Forwarder INFO
37}
38
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060039; The face_system section defines what faces and channels are created.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060040face_system
41{
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060042 ; The unix section contains settings of UNIX stream faces and channels.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060043 unix
44 {
45 listen yes ; set to 'no' to disable UNIX stream listener, default 'yes'
46 path /var/run/nfd.sock ; UNIX stream listener path
47 }
48
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060049 ; The tcp section contains settings of TCP faces and channels.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060050 tcp
51 {
52 listen yes ; set to 'no' to disable TCP listener, default 'yes'
53 port 6363 ; TCP listener port number
Steve DiBenedetto95152872014-04-11 12:40:59 -060054 enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
55 enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060056 }
57
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060058 ; The udp section contains settings of UDP faces and channels.
Steve DiBenedetto95152872014-04-11 12:40:59 -060059 ; UDP channel is always listening; delete udp section to disable UDP
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060060 udp
61 {
62 port 6363 ; UDP unicast port number
Steve DiBenedetto95152872014-04-11 12:40:59 -060063 enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
64 enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060065 idle_timeout 600 ; idle time (seconds) before closing a UDP unicast face
66 keep_alive_interval 25; interval (seconds) between keep-alive refreshes
67
Alexander Afanasyev885a85b2014-04-12 21:01:13 -070068 ; UDP multicast settings
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060069 ; NFD creates one UDP multicast face per NIC
Giulio Grassi6d7176d2014-04-16 16:08:48 +020070 ;
71 ; In multi-homed Linux machines these settings will NOT work without
72 ; root or settings the appropriate permissions:
73 ;
74 ; sudo setcap cap_net_raw=eip /full/path/nfd
75 ;
Alexander Afanasyev885a85b2014-04-12 21:01:13 -070076 mcast yes ; set to 'no' to disable UDP multicast, default 'yes'
77 mcast_port 56363 ; UDP multicast port number
78 mcast_group 224.0.23.170 ; UDP multicast group (IPv4 only)
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -060079 }
80
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -060081 ; The ether section contains settings of Ethernet faces and channels.
82 ; These settings will NOT work without root or setting the appropriate
83 ; permissions:
84 ;
85 ; sudo setcap cap_net_raw,cap_net_admin=eip /full/path/nfd
86 ;
87 ; You may need to install a package to use setcap:
88 ;
89 ; **Ubuntu:**
90 ;
91 ; sudo apt-get install libcap2-bin
92 ;
93 ; **Mac OS X:**
94 ;
95 ; curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
96 ; tar zxvf ChmodBPF.tar.gz
97 ; open ChmodBPF/Install\ ChmodBPF.app
98 ;
99 ; or manually:
100 ;
101 ; sudo chgrp admin /dev/bpf*
102 ; sudo chmod g+rw /dev/bpf*
103
Alexander Afanasyev885a85b2014-04-12 21:01:13 -0700104 @IF_HAVE_LIBPCAP@ether
105 @IF_HAVE_LIBPCAP@{
106 @IF_HAVE_LIBPCAP@ ; Ethernet multicast settings
107 @IF_HAVE_LIBPCAP@ ; NFD creates one Ethernet multicast face per NIC
108 @IF_HAVE_LIBPCAP@
109 @IF_HAVE_LIBPCAP@ mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
110 @IF_HAVE_LIBPCAP@ mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
111 @IF_HAVE_LIBPCAP@}
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600112}
113
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600114; The authorizations section grants privileges to authorized keys.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600115authorizations
116{
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600117 ; An authorize section grants privileges to a NDN certificate.
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600118 authorize
119 {
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600120 ; If you do not already have NDN certificate, you can generate
121 ; one with the following commands.
122 ;
123 ; 1. Generate and install a self-signed identity certificate:
124 ;
125 ; ndnsec-keygen /`whoami` | ndnsec-install-cert -
126 ;
127 ; Note that the argument to ndnsec-key will be the identity name of the
128 ; new key (in this case, /your-username). Identities are hierarchical NDN
129 ; names and may have multiple components (e.g. `/ndn/ucla/edu/alice`).
130 ; You may create additional keys and identities as you see fit.
131 ;
132 ; 2. Dump the NDN certificate to a file:
133 ;
134 ; sudo mkdir -p @SYSCONFDIR@/ndn/keys/
135 ; ndnsec-cert-dump -i /`whoami` > default.ndncert
136 ; sudo mv default.ndncert @SYSCONFDIR@/ndn/keys/default.ndncert
137 ;
138 ; The "certfile" field below specifies the default key directory for
139 ; your machine. You may move your newly created key to the location it
140 ; specifies or path.
141
Yingdi Yuc8f214c2014-04-29 20:39:37 -0700142 ; certfile keys/default.ndncert ; NDN identity certificate file
143 certfile any ; "any" authorizes command interests signed under any certificate,
144 ; i.e., no actual validation.
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600145 privileges ; set of privileges granted to this identity
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600146 {
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600147 faces
148 fib
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600149 strategy-choice
150 }
151 }
Steve DiBenedetto1a3c6732014-03-13 06:44:05 -0600152
153 ; You may have multiple authorize sections that specify additional
154 ; certificates and their privileges.
155
Alexander Afanasyev885a85b2014-04-12 21:01:13 -0700156 ; authorize
157 ; {
158 ; certfile keys/this_cert_does_not_exist.ndncert
159 ; authorize
160 ; privileges
161 ; {
162 ; faces
163 ; }
164 ; }
Steve DiBenedetto84da5bf2014-03-11 14:51:29 -0600165}
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700166
Yingdi Yue5224e92014-04-29 18:04:02 -0700167rib
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700168{
Yingdi Yue5224e92014-04-29 18:04:02 -0700169 ; The following localhost_security allows anyone to register routing entries in local RIB
170 localhost_security
171 {
172 trust-anchor
173 {
174 type any
175 }
176 }
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700177
Yingdi Yue5224e92014-04-29 18:04:02 -0700178 ; localhop_security should be enabled when NFD runs on a hub.
179 ; "/localhop/nfd/fib" command prefix will be disabled when localhop_security section is missing.
180 ; localhop_security
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700181 ; {
Yingdi Yue5224e92014-04-29 18:04:02 -0700182 ; ; This section defines the trust model for NFD RIB Management. It consists of rules and
183 ; ; trust-anchors, which are briefly defined in this file. For more information refer to
184 ; ; manpage of ndn-validator.conf:
185 ; ;
186 ; ; man ndn-validator.conf
187 ; ;
188 ; ; A trust-anchor is a pre-trusted certificate. This can be any certificate that is the
189 ; ; root of certification chain (e.g., NDN testbed root certificate) or an existing
190 ; ; default system certificate `default.ndncert`.
191 ; ;
192 ; ; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the
193 ; ; rules defined here. A rule can be broken into two parts: matching & checking. A packet
194 ; ; will be matched against rules from the first to the last until a matched rule is
195 ; ; encountered. The matched rule will be used to check the packet. If a packet does not
196 ; ; match any rule, it will be treated as invalid. The matching part of a rule consists
197 ; ; of `for` and `filter` sections. They collectively define which packets can be checked
198 ; ; with this rule. `for` defines packet type (data or interest) and `filter` defines
199 ; ; conditions on other properties of a packet. Right now, you can only define conditions
200 ; ; on packet name, and you can only specify ONLY ONE filter for packet name. The
201 ; ; checking part of a rule consists of `checker`, which defines the conditions that a
202 ; ; VALID packet MUST have. See comments in checker section for more details.
203 ;
204 ; rule
205 ; {
206 ; id "NRD Prefix Registration Command Rule"
207 ; for interest ; rule for Interests (to validate CommandInterests)
208 ; filter
209 ; {
210 ; type name ; condition on interest name (w/o signature)
211 ; regex ^[<localhop><localhost>]<nfd><rib>[<register><unregister>]<>{3}$
212 ; }
213 ; checker
214 ; {
215 ; type customized
216 ; sig-type rsa-sha256 ; interest must have a rsa-sha256 signature
217 ; key-locator
218 ; {
219 ; type name ; key locator must be the certificate name of the
220 ; ; signing key
221 ; regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
222 ; }
223 ; }
224 ; }
225 ; rule
226 ; {
227 ; id "NDN Testbed Hierarchy Rule"
228 ; for data ; rule for Data (to validate NDN certificates)
229 ; filter
230 ; {
231 ; type name ; condition on data name
232 ; regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
233 ; }
234 ; checker
235 ; {
236 ; type hierarchical ; the certificate name of the signing key and
237 ; ; the data name must follow the hierarchical model
238 ; sig-type rsa-sha256 ; data must have a rsa-sha256 signature
239 ; }
240 ; }
241 ; trust-anchor
242 ; {
243 ; type file
244 ; file-name keys/default.ndncert ; the file name, by default this file should be placed in the
245 ; ; same folder as this config file.
246 ; }
247 ; ; trust-anchor ; Can be repeated multiple times to specify multiple trust anchors
248 ; ; {
249 ; ; type file
250 ; ; file-name keys/ndn-testbed.ndncert
251 ; ; }
Alexander Afanasyev89cf5e02014-04-17 12:08:57 -0700252 ; }
253}