<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi C<div class=""><div class=""><div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">* What was in $(man ndn-validator.conf)? It's mentioned in the NFD configuration but I can't find that manpage in NFD nor ndn-cxx.<br class=""></div></div></blockquote><div><br class=""></div><div>Thanks for reporting. This is filed as <a href="https://redmine.named-data.net/issues/4184" class="">NFD Bug 4184</a>.</div><div>I believe it refers to <a href="https://named-data.net/doc/ndn-cxx/current/tutorials/security-validator-config.html" class="">ValidatorConfig file format</a>.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">* How should I establish a trust anchor, in terms of key management? </div></div></blockquote><div><br class=""></div><div>You can create a certificate chain, including the trust anchor, with ndnsec commands.</div><div>This <a href="http://www.lists.cs.ucla.edu/pipermail/nfd-dev/2014-November/000616.html" class="">nfd-dev thread</a> may be helpful.</div><div><br class=""></div><div>I also have a blog post on <a href="https://yoursunny.com/t/2016/ndncert/" class="">how to issue and publish certificates</a> once you have the trust anchor.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">What does key rotation look like?<br class=""></div></div></blockquote><div><br class=""></div><div>There’s no key rotation. The testbed operator has to <a href="http://lists.named-data.net/mailman/private/operators/2017-March/001181.html" class="">manually renew certificate</a>, then restart affected nodes.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">* How local is localhop? In terms of topology, I gather that localhop is a neighborhood of the node, but I don't get exactly how big that should be. Should it be per-datacenter, per-country, or literally just the star of all reachable routers?<br class=""></div></div></blockquote><div><br class=""></div><div>/localhop scope refers to one network hop as seen on NDN layer.</div><div>This is defined in <a href="https://redmine.named-data.net/projects/nfd/wiki/ScopeControl" class="">namespace-based scope control</a> spec. It is a convention rather than a protocol requirement.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">* Obviously hub/backbone routers shouldn't form too-heavily-connected graphs. How practical is automatic RIB management for backbone layout? Should I hand-craft the RIBs for each backbone server instead? (Pardon the puns!)<br class=""></div></div></blockquote><div><br class=""></div><div>The <a href="https://named-data.net/publications/techreports/ndn-0042-1-asf/" class="">routing protocol</a> takes care of populating RIBs for global network.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">* Where is $(ndnsec cert-install) putting certs? Are they going into the local NFD's CS, or are they on-disk somewhere? For configuration management purposes, it'd be nice to understand that better.<br class=""></div></div></blockquote><div><br class=""></div><div>The certificates are stored in the PIB. The filesystem path for the PIB can be seen in ‘pib’ option of $HOME/.ndn/client.conf or /etc/ndn/client.conf . The default is $HOME/.ndn .</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">* How does priv-drop on NFD work?</div></div></blockquote><div><br class=""></div><div>seteuid(non-root)</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">Does NFD re-assume root as needed somehow?</div></div></blockquote><div><br class=""></div><div>Yes. It’s needed to create a new libpcap handle when a new network interface comes up.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica,Arial,sans-serif; font-size: 12px;" class="">I figure that NFD can run as user 100% of the time if I'm only asking it to listen on the local UNIX socket and high-port-numbered UDP/TCP, right?<br class=""></div></div></blockquote><div><br class=""></div><div>Kinda. The default path of Unix socket is /var/run/nfd.sock which is usually only accessible by root. This path is chosen so that an untrusted program cannot pretend to be NFD and intercept traffic from local apps. If you change this socket path in nfd.conf and client.conf, you can use Unix socket without root.</div><div>There are also limitations with Ethernet faces. See nfd.conf on workarounds.</div></div><br class=""></div><div class="">Yours, Junxiao</div></div></body></html>