nfd: update default nfd.conf
Refs: #4646
Change-Id: Iaf77da2c58f4cd0e1a8c2aaa493b53133c1870e0
diff --git a/nfd/debian/nfd.conf b/nfd/debian/nfd.conf
index a3232d7..d309796 100644
--- a/nfd/debian/nfd.conf
+++ b/nfd/debian/nfd.conf
@@ -1,6 +1,9 @@
; The general section contains settings of nfd process.
general
{
+ ; Specify a user and/or group for NFD to drop privileges to
+ ; when not performing privileged tasks. NFD does not drop
+ ; privileges by default.
user ndn
group ndn
}
@@ -29,7 +32,8 @@
; Run:
; nfd --modules
;
- ; Or look for NFD_LOG_INIT(<module name>) statements in .cpp files
+ ; Or look for NFD_LOG_INIT(<module name>) statements in source files.
+ ; Note that the "nfd." prefix can be omitted.
;
; Example module-level settings:
;
@@ -40,11 +44,18 @@
; The tables section configures the CS, PIT, FIB, Strategy Choice, and Measurements
tables
{
-
; ContentStore size limit in number of packets
; default is 65536, about 500MB with 8KB packet size
cs_max_packets 65536
+ ; Set the CS replacement policy.
+ ; Available policies are: priority_fifo, lru
+ cs_policy lru
+
+ ; Set a policy to decide whether to cache or drop unsolicited Data.
+ ; Available policies are: drop-all, admit-local, admit-network, admit-all
+ cs_unsolicited_policy drop-all
+
; Set the forwarding strategy for the specified prefixes:
; <prefix> <strategy>
strategy_choice
@@ -69,89 +80,121 @@
; The face_system section defines what faces and channels are created.
face_system
{
- ; The unix section contains settings of Unix stream faces and channels.
- ; Unix channel is always listening; delete unix section to disable
+ ; This section contains options that apply to multiple face protocols.
+ general
+ {
+ ; Set to 'no' to disable congestion marking on supported faces, default 'yes'
+ enable_congestion_marking yes
+ }
+
+ ; The unix section contains settings for Unix stream faces and channels.
+ ; A Unix channel is always listening; delete the unix section to disable
; Unix stream faces and channels.
;
- ; The ndn-cxx library expects unix:///var/run/nfd.sock
- ; to be used as the default transport option. Please change
- ; the "transport" field in client.conf to an appropriate tcp4 FaceUri
- ; if you need to disable unix sockets.
+ ; The ndn-cxx library expects unix:///var/run/nfd.sock to be used as
+ ; the default transport option. Please change the "transport" field
+ ; in client.conf to an appropriate tcp4 FaceUri if you want to
+ ; disable Unix sockets and use TCP instead.
unix
{
path /var/run/nfd.sock ; Unix stream listener path
}
- ; The tcp section contains settings of TCP faces and channels.
+ ; The tcp section contains settings for TCP faces and channels.
tcp
{
listen yes ; set to 'no' to disable TCP listener, default 'yes'
port 6363 ; TCP listener port number
enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
+
+ ; A TCP face has local scope if the local and remote IP addresses match the whitelist but not the blacklist
+ local
+ {
+ whitelist
+ {
+ subnet 127.0.0.0/8
+ subnet ::1/128
+ }
+ blacklist
+ {
+ }
+ }
}
- ; The udp section contains settings of UDP faces and channels.
- ; UDP channel is always listening; delete udp section to disable UDP
+ ; The udp section contains settings for UDP faces and channels.
udp
{
- port 6363 ; UDP unicast port number
+ ; UDP unicast settings.
+ listen yes ; set to 'no' to disable UDP listener, default 'yes'
+ port 6363 ; UDP listener port number
enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
- ; idle time (seconds) before closing a UDP unicast face, the actual timeout would be
- ; anywhere within [idle_timeout, 2*idle_timeout), default is 600
+ ; Time (in seconds) before closing an idle UDP unicast face.
+ ; The actual timeout will occur anytime between idle_timeout and 2*idle_timeout.
+ ; The default is 600 (10 minutes).
idle_timeout 600
- keep_alive_interval 25; interval (seconds) between keep-alive refreshes
-
- ; UDP multicast settings
- ; NFD creates one UDP multicast face per NIC
- ;
- ; In multi-homed Linux machines these settings will NOT work without
- ; root or settings the appropriate permissions:
- ;
- ; sudo setcap cap_net_raw=eip /full/path/nfd
- ;
+ ; UDP multicast settings.
+ ; By default, NFD creates one UDP multicast face per NIC.
mcast yes ; set to 'no' to disable UDP multicast, default 'yes'
- mcast_port 56363 ; UDP multicast port number
- mcast_group 224.0.23.170 ; UDP multicast group (IPv4 only)
+ mcast_group 224.0.23.170 ; UDP multicast group (IPv4)
+ mcast_port 56363 ; UDP multicast port number (IPv4)
+ mcast_group_v6 ff02::1234 ; UDP multicast group (IPv6)
+ mcast_port_v6 56363 ; UDP multicast port number (IPv6)
+ mcast_ad_hoc no ; set to 'yes' to make all UDP multicast faces "ad hoc", default 'no'
+
+ ; Whitelist and blacklist can contain, in no particular order:
+ ; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
+ ; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
+ ; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
+ ; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
+ ; - a single asterisk ('*') that matches all interfaces
+ ; By default, all interfaces are whitelisted.
+ whitelist
+ {
+ *
+ }
+ blacklist
+ {
+ }
}
- ; The ether section contains settings of Ethernet faces and channels.
- ; These settings will NOT work without root or setting the appropriate
- ; permissions:
- ;
- ; sudo setcap cap_net_raw,cap_net_admin=eip /full/path/nfd
- ;
- ; You may need to install a package to use setcap:
- ;
- ; **Ubuntu:**
- ;
- ; sudo apt-get install libcap2-bin
- ;
- ; **Mac OS X:**
- ;
- ; curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
- ; tar zxvf ChmodBPF.tar.gz
- ; open ChmodBPF/Install\ ChmodBPF.app
- ;
- ; or manually:
- ;
- ; sudo chgrp admin /dev/bpf*
- ; sudo chmod g+rw /dev/bpf*
-
+ ; The ether section contains settings for Ethernet faces and channels.
ether
{
- ; Ethernet multicast settings
- ; NFD creates one Ethernet multicast face per NIC
+ ; Ethernet unicast settings.
+ listen yes ; set to 'no' to disable Ethernet listener, default 'yes'
+ ; Time (in seconds) before closing an idle Ethernet unicast face.
+ ; The actual timeout will occur anytime between idle_timeout and 2*idle_timeout.
+ ; The default is 600 (10 minutes).
+ idle_timeout 600
+
+ ; Ethernet multicast settings.
+ ; By default, NFD creates one Ethernet multicast face per NIC.
mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
+ mcast_ad_hoc no ; set to 'yes' to make all Ethernet multicast faces "ad hoc", default 'no'
+
+ ; Whitelist and blacklist can contain, in no particular order:
+ ; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
+ ; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
+ ; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
+ ; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
+ ; - a single asterisk ('*') that matches all interfaces
+ ; By default, all interfaces are whitelisted.
+ whitelist
+ {
+ *
+ }
+ blacklist
+ {
+ }
}
- ; The websocket section contains settings of WebSocket faces and channels.
-
+ ; The websocket section contains settings for WebSocket faces and channels.
websocket
{
listen yes ; set to 'no' to disable WebSocket listener, default 'yes'
@@ -170,19 +213,22 @@
certfile certs/localhost_daemons_nfd.ndncert
privileges
{
- faces
- fib
- strategy-choice
+ faces
+ fib
+ cs
+ strategy-choice
}
}
authorize
{
- certfile any
+ certfile any ; "any" authorizes command interests signed under any certificate,
+ ; i.e., no actual validation.
privileges
{
- faces
- strategy-choice
+ faces
+ cs
+ strategy-choice
}
}
@@ -217,9 +263,9 @@
; {
; ; This section defines the trust model for NFD RIB Management. It consists of rules and
; ; trust-anchors, which are briefly defined in this file. For more information refer to
- ; ; manpage of ndn-validator.conf:
+ ; ; validator configuration file format documentation:
; ;
- ; ; man ndn-validator.conf
+ ; ; https://named-data.net/doc/ndn-cxx/current/tutorials/security-validator-config.html
; ;
; ; A trust-anchor is a pre-trusted certificate. This can be any certificate that is the
; ; root of certification chain (e.g., NDN testbed root certificate) or an existing
@@ -239,13 +285,12 @@
;
; rule
; {
- ; id "NRD Prefix Registration Command Rule"
+ ; id "RIB Registration Command Rule"
; for interest ; rule for Interests (to validate CommandInterests)
; filter
; {
- ; type name ; condition on interest name (w/o signature)
- ; regex ^[<localhop><localhost>]<nfd><rib>[<register><unregister>]<>$ ; prefix before
- ; ; timestamp
+ ; type name ; condition on interest name (w/o SignatureInfo/SignatureValue)
+ ; regex ^[<localhop><localhost>]<nfd><rib>[<register><unregister>]<><><>$
; }
; checker
; {
@@ -255,7 +300,7 @@
; {
; type name ; key locator must be the certificate name of the
; ; signing key
- ; regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
+ ; regex ^<>*<KEY><>$
; }
; }
; }
@@ -266,7 +311,7 @@
; filter
; {
; type name ; condition on data name
- ; regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
+ ; regex ^<>*<KEY><><><>$
; }
; checker
; {
@@ -313,4 +358,8 @@
; policy. Initially, the wait time is set to base_retry_wait, then it will be doubled for every
; retry unless beyond the max_retry_wait, in which case max_retry_wait is set as the wait time.
}
+
+ ; If enabled, routes registered with origin=client (typically from auto_prefix_propagate)
+ ; will be readvertised into local NLSR daemon.
+ readvertise_nlsr no
}