71 lines
3.3 KiB
Plaintext
71 lines
3.3 KiB
Plaintext
security
|
|
{
|
|
; Security section defines the trust model that NRD should use. It consists of rules and
|
|
; trust-anchors, which are briefly defined in this file. For more details please see the
|
|
; following wiki:
|
|
; http://redmine.named-data.net/projects/ndn-cpp-dev/wiki/CommandValidatorConf
|
|
;
|
|
; A trust-anchor is a pre-trusted certificate. It is usually stored in a file in the
|
|
; same directory as this config file. You can download the NDN testbed root certificate as the
|
|
; trust anchor, or you can dump an existing certificate from your system as a trust anchor:
|
|
; $ ndnsec cert-dump /example/certificate/name > trust-anchor.cert
|
|
; or you can generate a self-signed certificate as a trust anchor:
|
|
; $ ndnsec key-gen /example/identity/name > trust-anchor.cert
|
|
; See comments in trust-anchor section for configuration details.
|
|
;
|
|
; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the rules defined
|
|
; here. A rule can be broken into two parts: matching & checking. A packet will be matched against
|
|
; rules from the first to the last until a matched rule is encountered. The matched rule will be
|
|
; used to check the packet. If a packet does not match any rule, it will be treated as invalid.
|
|
; The matching part of a rule consists of `for` and `filter` sections. They collectively define
|
|
; which packets can be checked with this rule. `for` defines packet type (data or interest),
|
|
; while `filter` defines conditions on other properties of a packet. Right now, you can only
|
|
; define conditions on packet name, and you can only specify ONLY ONE filter for packet name.
|
|
; The checking part of a rule consists of `checker`, which defines the conditions that a VALID
|
|
; packet MUST have. See comments in checker section for more details.
|
|
|
|
rule
|
|
{
|
|
id "NRD Prefix Registration Command Rule" ; rule id
|
|
for interest ; this rule is used to validate interests
|
|
filter
|
|
{
|
|
type name ; condition on interest name (w/o signature)
|
|
regex ^[<localhop><localhost>]<nrd>[<register><unregister>]<>{3}$
|
|
}
|
|
checker
|
|
{
|
|
type customized
|
|
sig-type rsa-sha256 ; interest must have a rsa-sha256 signature
|
|
key-locator
|
|
{
|
|
type name ; key locator must be the certificate name of
|
|
; the signing key
|
|
regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
|
|
}
|
|
}
|
|
}
|
|
rule
|
|
{
|
|
id "Testbed Hierarchy Rule" ; rule id
|
|
for data ; this rule is used to validate data
|
|
filter
|
|
{
|
|
type name ; condition on data name
|
|
regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
|
|
}
|
|
checker
|
|
{
|
|
type hierarchical ; the certificate name of the signing key and
|
|
; the data name must follow the hierarchical model
|
|
sig-type rsa-sha256 ; data must have a rsa-sha256 signature
|
|
}
|
|
}
|
|
trust-anchor
|
|
{
|
|
type file ; trust anchor is stored in a file
|
|
file-name "trust-anchor.cert" ; the file name, by default this file should be placed in the
|
|
; same folder as this config file.
|
|
}
|
|
}
|