472 lines
17 KiB
Plaintext
472 lines
17 KiB
Plaintext
; The general section contains global settings for the nfd process.
|
|
general
|
|
{
|
|
; Specify a user and/or group for NFD to drop privileges to
|
|
; when not performing privileged tasks. NFD does not drop
|
|
; privileges by default.
|
|
|
|
; user ndn-user
|
|
; group ndn-user
|
|
}
|
|
|
|
log
|
|
{
|
|
; default_level specifies the logging level for modules
|
|
; that are not explicitly named. All debugging levels
|
|
; listed above the selected value are enabled.
|
|
;
|
|
; Valid values:
|
|
;
|
|
; NONE ; no messages
|
|
; ERROR ; error messages
|
|
; WARN ; warning messages
|
|
; INFO ; informational messages (default)
|
|
; DEBUG ; debugging messages
|
|
; TRACE ; trace messages (most verbose)
|
|
; ALL ; all messages
|
|
|
|
default_level INFO
|
|
|
|
; You may override default_level by assigning a logging level
|
|
; to the desired module name. Module names can be found in two ways:
|
|
;
|
|
; Run:
|
|
; nfd --modules
|
|
;
|
|
; Or look for NFD_LOG_INIT(<module name>) statements in source files.
|
|
; Note that the "nfd." prefix can be omitted.
|
|
;
|
|
; Example module-level settings:
|
|
;
|
|
; FibManager DEBUG
|
|
; Forwarder INFO
|
|
}
|
|
|
|
; The forwarder section contains settings that affect the core forwarding behavior of nfd.
|
|
forwarder
|
|
{
|
|
; Specify the HopLimit that is added to incoming Interests without a HopLimit element.
|
|
; A value of 0 disables adding the HopLimit.
|
|
; Must be between 0 and 255. The default is 0.
|
|
default_hop_limit 0
|
|
}
|
|
|
|
; The tables section configures the CS, PIT, FIB, Strategy Choice, and Measurements
|
|
tables
|
|
{
|
|
; Content Store capacity limit in number of packets.
|
|
; The default is 65536, equivalent to about 500MB with 8KB packet size.
|
|
cs_max_packets 65536
|
|
|
|
; Content Store replacement policy.
|
|
; Available policies are: priority_fifo, lru
|
|
cs_policy lru
|
|
|
|
; Set a policy to decide whether to cache or drop unsolicited Data.
|
|
; Available policies are: drop-all, admit-local, admit-network, admit-all
|
|
cs_unsolicited_policy drop-all
|
|
|
|
; Set the forwarding strategy for the specified prefixes:
|
|
; <prefix> <strategy>
|
|
strategy_choice
|
|
{
|
|
/ /localhost/nfd/strategy/best-route
|
|
/localhost /localhost/nfd/strategy/multicast
|
|
/localhost/nfd /localhost/nfd/strategy/best-route
|
|
/ndn/broadcast /localhost/nfd/strategy/multicast
|
|
}
|
|
|
|
; Declare network region names
|
|
; These are used for mobility support. An Interest carrying a Link object is
|
|
; assumed to have reached the producer region if any delegation name in the
|
|
; Link object is a prefix of any region name.
|
|
network_region
|
|
{
|
|
; /example/region1
|
|
; /example/region2
|
|
}
|
|
}
|
|
|
|
; The face_system section defines what faces and channels are created.
|
|
face_system
|
|
{
|
|
; This section contains options that apply to multiple face protocols.
|
|
general
|
|
{
|
|
enable_congestion_marking yes ; set to 'no' to disable congestion marking on supported faces, default 'yes'
|
|
}
|
|
|
|
; The unix section contains settings for Unix stream faces and channels.
|
|
; A Unix channel is always listening; delete the unix section to disable
|
|
; Unix stream faces and channels.
|
|
unix
|
|
{
|
|
; The default transport is unix:///run/nfd.sock (on Linux) or unix:///var/run/nfd.sock (on
|
|
; other platforms). This should match the "transport" field in client.conf for ndn-cxx. If you
|
|
; wish to use TCP instead of Unix sockets with ndn-cxx, change "transport" to an appropriate
|
|
; TCP FaceUri.
|
|
path @UNIX_SOCKET_PATH@ ; Unix stream listener path
|
|
}
|
|
|
|
; The tcp section contains settings for TCP faces and channels.
|
|
tcp
|
|
{
|
|
listen yes ; set to 'no' to disable TCP listener, default 'yes'
|
|
port 6363 ; TCP listener port number
|
|
enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
|
|
enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
|
|
|
|
; A TCP face has local scope if the local and remote IP addresses match the whitelist but not the blacklist
|
|
local
|
|
{
|
|
whitelist
|
|
{
|
|
subnet 127.0.0.0/8
|
|
subnet ::1/128
|
|
}
|
|
blacklist
|
|
{
|
|
}
|
|
}
|
|
}
|
|
|
|
; The udp section contains settings for UDP faces and channels.
|
|
udp
|
|
{
|
|
; UDP unicast settings.
|
|
listen yes ; set to 'no' to disable UDP listener, default 'yes'
|
|
port 6363 ; UDP listener port number
|
|
enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
|
|
enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
|
|
|
|
; Time (in seconds) before closing an idle UDP unicast face.
|
|
; The actual timeout will occur anytime between idle_timeout and 2*idle_timeout.
|
|
; The default is 600 (10 minutes).
|
|
idle_timeout 600
|
|
|
|
; Maximum payload size for outgoing packets on unicast faces, used in NDNLPv2 fragmentation.
|
|
; This must be between 64 and 8800. The default is 8800.
|
|
; This value excludes IPv4/IPv6/UDP headers. On an Ethernet link of MTU=1500, setting this
|
|
; to 1452 would leave enough room for IP+UDP headers and prevent IP fragmentation.
|
|
; This option is not changable during runtime configuration reload, but the MTU of an
|
|
; individual face can be updated via NFD Management Protocol or the 'nfdc' tool.
|
|
unicast_mtu 8800
|
|
|
|
; UDP multicast settings.
|
|
; By default, NFD creates one UDP multicast face per NIC.
|
|
;
|
|
; In multi-homed Linux machines these settings will NOT work without
|
|
; root or setting the appropriate permissions:
|
|
;
|
|
; sudo setcap cap_net_raw=eip /path/to/nfd
|
|
;
|
|
mcast yes ; set to 'no' to disable UDP multicast, default 'yes'
|
|
mcast_group 224.0.23.170 ; UDP multicast group (IPv4)
|
|
mcast_port 56363 ; UDP multicast port number (IPv4)
|
|
mcast_group_v6 ff02::1234 ; UDP multicast group (IPv6)
|
|
mcast_port_v6 56363 ; UDP multicast port number (IPv6)
|
|
mcast_ad_hoc no ; set to 'yes' to make all UDP multicast faces "ad hoc", default 'no'
|
|
|
|
; Whitelist and blacklist can contain, in no particular order:
|
|
; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
|
|
; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
|
|
; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
|
|
; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
|
|
; - a single asterisk ('*') that matches all interfaces
|
|
; By default, all interfaces are whitelisted.
|
|
whitelist
|
|
{
|
|
*
|
|
}
|
|
blacklist
|
|
{
|
|
}
|
|
}
|
|
|
|
; The ether section contains settings for Ethernet faces and channels.
|
|
; These settings will NOT work without root or setting the appropriate
|
|
; permissions:
|
|
;
|
|
; sudo setcap cap_net_raw,cap_net_admin=eip /path/to/nfd
|
|
;
|
|
; You may need to install a package to use setcap:
|
|
;
|
|
; **Ubuntu:**
|
|
;
|
|
; sudo apt install libcap2-bin
|
|
;
|
|
; **Mac OS X:**
|
|
;
|
|
; curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
|
|
; tar zxvf ChmodBPF.tar.gz
|
|
; open ChmodBPF/Install\ ChmodBPF.app
|
|
;
|
|
; or manually:
|
|
;
|
|
; sudo chgrp admin /dev/bpf*
|
|
; sudo chmod g+rw /dev/bpf*
|
|
;
|
|
@IF_HAVE_LIBPCAP@ether
|
|
@IF_HAVE_LIBPCAP@{
|
|
@IF_HAVE_LIBPCAP@ ; Ethernet unicast settings.
|
|
@IF_HAVE_LIBPCAP@ listen yes ; set to 'no' to disable Ethernet listener, default 'yes'
|
|
@IF_HAVE_LIBPCAP@
|
|
@IF_HAVE_LIBPCAP@ ; Time (in seconds) before closing an idle Ethernet unicast face.
|
|
@IF_HAVE_LIBPCAP@ ; The actual timeout will occur anytime between idle_timeout and 2*idle_timeout.
|
|
@IF_HAVE_LIBPCAP@ ; The default is 600 (10 minutes).
|
|
@IF_HAVE_LIBPCAP@ idle_timeout 600
|
|
@IF_HAVE_LIBPCAP@
|
|
@IF_HAVE_LIBPCAP@ ; Ethernet multicast settings.
|
|
@IF_HAVE_LIBPCAP@ ; By default, NFD creates one Ethernet multicast face per NIC.
|
|
@IF_HAVE_LIBPCAP@ mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
|
|
@IF_HAVE_LIBPCAP@ mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
|
|
@IF_HAVE_LIBPCAP@ mcast_ad_hoc no ; set to 'yes' to make all Ethernet multicast faces "ad hoc", default 'no'
|
|
@IF_HAVE_LIBPCAP@
|
|
@IF_HAVE_LIBPCAP@ ; Whitelist and blacklist can contain, in no particular order:
|
|
@IF_HAVE_LIBPCAP@ ; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
|
|
@IF_HAVE_LIBPCAP@ ; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
|
|
@IF_HAVE_LIBPCAP@ ; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
|
|
@IF_HAVE_LIBPCAP@ ; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
|
|
@IF_HAVE_LIBPCAP@ ; - a single asterisk ('*') that matches all interfaces
|
|
@IF_HAVE_LIBPCAP@ ; By default, all interfaces are whitelisted.
|
|
@IF_HAVE_LIBPCAP@ whitelist
|
|
@IF_HAVE_LIBPCAP@ {
|
|
@IF_HAVE_LIBPCAP@ *
|
|
@IF_HAVE_LIBPCAP@ }
|
|
@IF_HAVE_LIBPCAP@ blacklist
|
|
@IF_HAVE_LIBPCAP@ {
|
|
@IF_HAVE_LIBPCAP@ }
|
|
@IF_HAVE_LIBPCAP@}
|
|
|
|
; The websocket section contains settings for WebSocket faces and channels.
|
|
@IF_HAVE_WEBSOCKET@websocket
|
|
@IF_HAVE_WEBSOCKET@{
|
|
@IF_HAVE_WEBSOCKET@ listen yes ; set to 'no' to disable WebSocket listener, default 'yes'
|
|
@IF_HAVE_WEBSOCKET@ port 9696 ; WebSocket listener port number
|
|
@IF_HAVE_WEBSOCKET@ enable_v4 yes ; set to 'no' to disable listening on IPv4 socket, default 'yes'
|
|
@IF_HAVE_WEBSOCKET@ enable_v6 yes ; set to 'no' to disable listening on IPv6 socket, default 'yes'
|
|
@IF_HAVE_WEBSOCKET@}
|
|
|
|
; The netdev_bound section defines faces bound to netdevices.
|
|
netdev_bound
|
|
{
|
|
; A rule consists of a whitelist, a blacklist, and a set of remote FaceUris, and will cause the
|
|
; creation of zero or more faces bound to netdevices. One face will be created per accepted
|
|
; netdev per remote. There can be any number of rules in the netdev_bound section.
|
|
|
|
; rule
|
|
; {
|
|
; ; Remote FaceUri to which the netdev-bound faces will connect.
|
|
; ; Rule can contain multiple remotes. One face will be created for each remote.
|
|
; ; All FaceUris must be in canonical form. Currently only udp4 and udp6 are supported.
|
|
; remote udp4://192.0.2.1:6363
|
|
;
|
|
; ; Whitelist and blacklist can contain, in no particular order:
|
|
; ; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
|
|
; ; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
|
|
; ; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
|
|
; ; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
|
|
; ; - a single asterisk ('*') that matches all interfaces
|
|
; ; By default, all interfaces are whitelisted.
|
|
; whitelist
|
|
; {
|
|
; *
|
|
; }
|
|
; blacklist
|
|
; {
|
|
; }
|
|
; }
|
|
}
|
|
}
|
|
|
|
; The authorizations section grants privileges to authorized keys.
|
|
authorizations
|
|
{
|
|
; An authorize section grants privileges to a NDN certificate.
|
|
authorize
|
|
{
|
|
; If you do not already have NDN certificate, you can generate
|
|
; one with the following commands.
|
|
;
|
|
; 1. Generate and install a self-signed identity certificate:
|
|
;
|
|
; ndnsec key-gen /$(whoami) | ndnsec cert-install -
|
|
;
|
|
; Note that the argument to 'ndnsec key-gen' will be the identity name of
|
|
; the new key (in this case, /your-username). Identities are hierarchical
|
|
; NDN names and may have multiple components (e.g., /ndn/ucla/edu/alice).
|
|
; You may create additional keys and identities as needed.
|
|
;
|
|
; 2. Export the certificate to a file:
|
|
;
|
|
; ndnsec cert-dump -i /$(whoami) > default.ndncert
|
|
; sudo mkdir -p @SYSCONFDIR@/ndn/keys
|
|
; sudo mv default.ndncert @SYSCONFDIR@/ndn/keys/default.ndncert
|
|
;
|
|
; The "certfile" field below specifies the default key directory for
|
|
; your machine. You may move your newly created key to the location it
|
|
; specifies or path.
|
|
|
|
; certfile keys/default.ndncert ; NDN identity certificate file
|
|
certfile any ; "any" authorizes command interests signed under any certificate,
|
|
; i.e., no actual validation.
|
|
privileges ; set of privileges granted to this identity
|
|
{
|
|
faces
|
|
fib
|
|
cs
|
|
strategy-choice
|
|
}
|
|
}
|
|
|
|
; You may have multiple authorize sections that specify additional
|
|
; certificates and their privileges.
|
|
|
|
; authorize
|
|
; {
|
|
; certfile keys/this_cert_does_not_exist.ndncert
|
|
; authorize
|
|
; privileges
|
|
; {
|
|
; faces
|
|
; }
|
|
; }
|
|
}
|
|
|
|
rib
|
|
{
|
|
; The following localhost_security allows anyone to register routing entries in local RIB
|
|
localhost_security
|
|
{
|
|
trust-anchor
|
|
{
|
|
type any
|
|
}
|
|
}
|
|
|
|
; localhop_security should be enabled when NFD runs on a hub.
|
|
; "/localhop/nfd/fib" command prefix will be disabled when localhop_security section is missing.
|
|
; localhop_security
|
|
; {
|
|
; ; This section defines the trust model for NFD RIB Management. It consists of rules and
|
|
; ; trust-anchors, which are briefly defined in this file. For more information refer to
|
|
; ; validator configuration file format documentation:
|
|
; ;
|
|
; ; https://docs.named-data.net/ndn-cxx/current/tutorials/security-validator-config.html
|
|
; ;
|
|
; ; A trust-anchor is a pre-trusted certificate. This can be any certificate that is the
|
|
; ; root of certification chain (e.g., NDN testbed root certificate) or an existing
|
|
; ; default system certificate `default.ndncert`.
|
|
; ;
|
|
; ; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the
|
|
; ; rules defined here. A rule can be broken into two parts: matching & checking. A packet
|
|
; ; will be matched against rules from the first to the last until a matched rule is
|
|
; ; encountered. The matched rule will be used to check the packet. If a packet does not
|
|
; ; match any rule, it will be treated as invalid. The matching part of a rule consists
|
|
; ; of `for` and `filter` sections. They collectively define which packets can be checked
|
|
; ; with this rule. `for` defines packet type (data or interest) and `filter` defines
|
|
; ; conditions on other properties of a packet. Right now, you can only define conditions
|
|
; ; on packet name, and you can only specify ONLY ONE filter for packet name. The
|
|
; ; checking part of a rule consists of `checker`, which defines the conditions that a
|
|
; ; VALID packet MUST have. See comments in checker section for more details.
|
|
;
|
|
; rule
|
|
; {
|
|
; id "RIB Command Interest"
|
|
; for interest
|
|
; ; match Commmand Interest name (either in v0.3 or v0.2 format)
|
|
; filter
|
|
; {
|
|
; type name
|
|
; regex ^<localhop><nfd><rib>[<register><unregister>]<>{1,3}$
|
|
; }
|
|
; checker
|
|
; {
|
|
; type customized
|
|
; sig-type ecdsa-sha256
|
|
; ; KeyLocator must be either a key name or a certificate name
|
|
; key-locator
|
|
; {
|
|
; type name
|
|
; regex ^<>*<KEY><>{1,3}$
|
|
; }
|
|
; }
|
|
; }
|
|
; rule
|
|
; {
|
|
; id "NDN Testbed Certificate Hierarchy"
|
|
; for data
|
|
; ; match certificate name only
|
|
; filter
|
|
; {
|
|
; type name
|
|
; regex ^<>*<KEY><>{3}$
|
|
; }
|
|
; checker
|
|
; {
|
|
; type customized
|
|
; sig-type ecdsa-sha256
|
|
; key-locator
|
|
; {
|
|
; type name
|
|
; ; issuer subject name must be a prefix of issued certificate name
|
|
; hyper-relation
|
|
; {
|
|
; k-regex ^(<>*)<KEY><>{1,3}$
|
|
; k-expand \\1
|
|
; h-relation is-prefix-of
|
|
; p-regex ^(<>*)$
|
|
; p-expand \\1
|
|
; }
|
|
; }
|
|
; }
|
|
; }
|
|
; trust-anchor
|
|
; {
|
|
; type file
|
|
; ; certificate path, relative to this config file
|
|
; file-name keys/default.ndncert
|
|
; }
|
|
; ; trust-anchor entry may be repeated to specify multiple trust anchors
|
|
; }
|
|
|
|
; The following localhop_security should be enabled when NFD runs on a hub,
|
|
; which accepts all remote registrations and is a short-term solution.
|
|
; localhop_security
|
|
; {
|
|
; trust-anchor
|
|
; {
|
|
; type any
|
|
; }
|
|
; }
|
|
|
|
; The following prefix_announcement_validation accepts any prefix announcement
|
|
prefix_announcement_validation
|
|
{
|
|
trust-anchor
|
|
{
|
|
type any
|
|
}
|
|
}
|
|
|
|
auto_prefix_propagate
|
|
{
|
|
cost 15 ; forwarding cost of prefix registered on remote router
|
|
timeout 10000 ; timeout (in milliseconds) of prefix registration command for propagation
|
|
|
|
refresh_interval 300 ; interval (in seconds) before refreshing the propagation
|
|
; This setting should be less than face_system.udp.idle_time,
|
|
; so that the face is kept alive on the remote router.
|
|
|
|
base_retry_wait 50 ; base wait time (in seconds) before retrying propagation
|
|
max_retry_wait 3600 ; maximum wait time (in seconds) before retrying propagation
|
|
; for consequent retries, the wait time before each retry is calculated based on the back-off
|
|
; policy. Initially, the wait time is set to base_retry_wait, then it will be doubled for every
|
|
; retry unless beyond the max_retry_wait, in which case max_retry_wait is set as the wait time.
|
|
}
|
|
|
|
; If enabled, routes registered with origin=client (typically from auto_prefix_propagate)
|
|
; will be readvertised into local NLSR daemon.
|
|
readvertise_nlsr no
|
|
}
|