<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Aug 19, 2014, at 11:44 AM, Burke, Jeff <<a href="mailto:jburke@remap.ucla.edu">jburke@remap.ucla.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>Hi Yingdi,</div>
<div>Thanks for the reply – comments below.</div>
<div>Jeff</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);">
<span style="font-weight:bold">From: </span>Yingdi Yu <<a href="mailto:yingdi@cs.ucla.edu">yingdi@cs.ucla.edu</a>><br>
<span style="font-weight:bold">Date: </span>Tue, 19 Aug 2014 11:25:42 -0500<br>
<span style="font-weight:bold">To: </span>Jeff Burke <<a href="mailto:jburke@remap.ucla.edu">jburke@remap.ucla.edu</a>><br>
<span style="font-weight:bold">Cc: </span>Alexander Afanasyev <<a href="mailto:alexander.afanasyev@ucla.edu">alexander.afanasyev@ucla.edu</a>>, Steve DiBenedetto <<a href="mailto:dibenede@cs.colostate.edu">dibenede@cs.colostate.edu</a>>, "<a href="mailto:nfd-dev@lists.cs.ucla.edu">nfd-dev@lists.cs.ucla.edu</a>"
<<a href="mailto:nfd-dev@lists.cs.ucla.edu">nfd-dev@lists.cs.ucla.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Nfd-dev] Intended scope of client.conf<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<br>
<div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Hi Jeff,</div>
<div><br>
</div>
<div>On Aug 18, 2014, at 4:35 PM, Burke, Jeff <<a href="mailto:jburke@remap.ucla.edu">jburke@remap.ucla.edu</a>> wrote:</div>
</div>
</span></span></div>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">So, the idea is that
<i>client.conf </i>provides per-user configuration for NDN applications that gives the
<i>default</i> keystore and mechanism for connecting to the local daemon. For now, the default keystore specified in this configuration must be used if an application wants to interact with the identities/keys manipulated by the ndnsec tools. </div>
<div style="font-family: Calibri, sans-serif; font-size: 14px;">Is that the right way to state it? </div>
</div>
</blockquote>
<div><br>
</div>
<div>This client.conf is the configuration file of ndn-cxx, so all apps (including ndnsec) compiled against ndn-cxx will use the keystore info in this file as the default configuration. If an app wants to access the identities/keys created through ndn-cxx,
the paths in the conf file should be the right place to go.</div>
</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>Alex's <a href="http://redmine.named-data.net/issues/1850">Issue #1850</a> suggests a stronger idea - that
<i>client.conf </i>is for all libraries / applications interacting locally with NFD/NRD. Is that correct? </div></div></blockquote><div><br></div><div>It is for "all" libraries (applications).</div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;"><div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>
<div><br>
</div>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">- NFD and NRD use their own system-wide configuration file, not client.conf. The unix socket they use is defined in their nfd.conf file. But where is the keystore for the keys used by NFD and
NRD, and how is it configured? I couldn't find this in the developers guide. </div>
</div>
</blockquote>
<div><br>
</div>
<div>NFD and NRD are built against ndn-cxx, so they use the keystore info in the client.conf. We will clarify that in the dev guide.</div>
</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>I'm still not sure that I understand why NFD/NRD should use a user's ~/.ndn/client.conf for their identity, if they are system-wide services. This means that NFD and NRD will have different identities/signing keys on the same host if they are started
by different users? Shouldn't the daemon's identities be stable per-host unless changed by the owner/operator? </div></div></blockquote><div><br></div><div>I think the fact that NFD and NRD are using ~/.ndn/client.conf is just an artifact of your installation. They are not suppose to be running as normal user. One is running as root, the other should be some special user (ndn user if using Ubuntu PPA or macports). In either case, ~/.ndn/client.conf should refer to different locations and there is "system-wide" /etc/ndn/client.conf (or /usr/local/etc/ndn/client.conf, depending on your installation) which kicks in when ~/.ndn/client.conf doesn't exist.</div><div><br></div><div>One more thing. Both ubuntu and macports are using trick with updating HOME variable before starting nfd, nrd, and all other daemons. This ensures that deamons/apps don't share client.conf and security credentials.</div><div><br></div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;"><div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">- It is assumed that there is only one installation of NFD/NRD per host. So, shouldn't the socket configuration and protocol be per-host rather than per user? I understand that for convenience
they may be in client.conf, but want to confirm...</div>
</div>
</blockquote>
<div><br>
</div>
<div>We may have per-host config for socket, but for keystore info, it might be better to keep per-user configuration.</div>
</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>If NFD/NRD are system-wide services, what is the motivation for this? (If they always ran under their own user, and the keystore was that of the NFD "user" this would make sense to me. But, this is not the default behavior yet.)</div></div></blockquote><div><br></div><div>System-wide services do not (not suposed to) use user's client.conf.</div><div><br></div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;"><div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">perhaps their should be a client-default.conf in the same place as nfd.conf, and just override it from ~/.ndn/client.conf? </div>
</div>
</blockquote>
<div><br>
</div>
<div>I think a client-default.conf is possible if we set user's home directory as the default path to keystore. </div>
</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>Yes, makes sense. I'm not sure it's necessary if the NRD/NFD identity issue is solved in a different way.</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">- There is an operator identity created by default at the time of installation of NFD/NRD. This seems to be associated with the user who installed the software. For NDN applications that run
under other (non-root) users, is the idea that they can use their own client.conf settings, but the operator of the machine will need to authorize their key to sign things like prefix registration commands for the daemon? </div>
</div>
</blockquote>
<div><br>
</div>
Ideally yes, but command interest validation is turned off.</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>Yes, but hopefully not for long :) </div>
<div><br>
</div>
<div>It seems like there is a potential bottleneck here, where on a multi-user host the operator will need to manually sign each user's key before they can register prefixes, which is a basic part of NDN communication. Perhaps there should be an optional
configuration mechanism available that automatically signs the keys of all authenticated users (who optionally are members of some group) on the host.</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">- Because it uses ndn-cxx, <i>ndnsec </i>manipulates the PIB/TPM for the current user, based on the settings in that user's client.conf. Is that correct? This may need to be clarified in the
documentation. Also, ndnsec-list does not seem to take into account the TPM setting, it just lists all of the keys in the PIB for the user. Perhaps it could indicate which TPM they are stored in, to aid debugging? </div>
</div>
</blockquote>
<div><br>
</div>
ndn-cxx internally maintains the consistency between PIB and TPM. Right now ndn-cxx assumed that there is only one TPM for one PIB, so we do not list the TPM information for each key. But I think we may need the TPM info when PIB handles multiple TPMs at the
same time.</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>Ok. This causes some problems with NFD/NRD and probably other applications in cases where you are experimenting with two different TPMs. See
<a href="http://redmine.named-data.net/issues/1889">Bug #1889</a>. </div></div></blockquote><div><br></div><div>It was never intended to use multiple TPMs in the first place. It just a current accident that we have multiple ones and behavior is not defined if there is a mix up.</div><div><br></div><div>---</div><div>Alex</div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>Thanks!</div>
<div>Jeff</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
</div>
<div>Yingdi<br>
<div><br>
</div>
<br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px;">Thanks,</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px;">Jeff</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px;"><br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px;">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);">
<span style="font-weight:bold">From: </span>Alex Afanasyev <<a href="mailto:alexander.afanasyev@ucla.edu">alexander.afanasyev@ucla.edu</a>><br>
<span style="font-weight:bold">Date: </span>Mon, 18 Aug 2014 15:49:59 -0500<br>
<span style="font-weight:bold">To: </span>Steve DiBenedetto <<a href="mailto:dibenede@cs.colostate.edu">dibenede@cs.colostate.edu</a>><br>
<span style="font-weight:bold">Cc: </span>Jeff Burke <<a href="mailto:jburke@remap.ucla.edu">jburke@remap.ucla.edu</a>>, "<a href="mailto:nfd-dev@lists.cs.ucla.edu">nfd-dev@lists.cs.ucla.edu</a>" <<a href="mailto:nfd-dev@lists.cs.ucla.edu">nfd-dev@lists.cs.ucla.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Nfd-dev] Intended scope of client.conf<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;" type="cite">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<br>
<div>
<div>On Aug 18, 2014, at 3:38 PM, Steve DiBenedetto <<a href="mailto:dibenede@cs.colostate.edu">dibenede@cs.colostate.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div><br class="Apple-interchange-newline">
On Aug 18, 2014, at 2:25 PM, Burke, Jeff <<a href="mailto:jburke@remap.UCLA.EDU">jburke@remap.UCLA.EDU</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<span id="OLK_SRC_BODY_SECTION">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>Hi folks,</div>
<div><br>
</div>
<div>Is there any specification for the purpose and scope of client.conf. E.g., how it can be located, what can be specified there, and what code should pay attention to it?</div>
</div>
</span></div>
</blockquote>
<div><br>
</div>
<div>I'm not aware of a full specification for the current client.conf. Here's the original client.conf redmine issue that covers file format, location, and some parameters: <a href="http://redmine.named-data.net/issues/1364">http://redmine.named-data.net/issues/1364</a><span class="Apple-converted-space"> </span>.</div>
</div>
</blockquote>
<div><br>
</div>
<div>This is basically the spec. A new addition that was made long time ago was part of <a href="http://redmine.named-data.net/issues/1532">http://redmine.named-data.net/issues/1532</a> and is documented in <a href="http://redmine.named-data.net/projects/ndn-cxx/wiki/KeyChainConf">http://redmine.named-data.net/projects/ndn-cxx/wiki/KeyChainConf</a></div>
<div><br>
</div>
<div>---</div>
<div>Alex</div>
<br>
<blockquote type="cite">
<div style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div><br>
</div>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<span id="OLK_SRC_BODY_SECTION">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div> </div>
<div><br>
</div>
<div>We need to consider how to handle this specification in the NDN-CCL libraries, and would prefer to work from a design specification rather than existing code in ndn-cxx. For code like ndn-js, it may not always apply, so we need to understand defaults
and assumptions, too. </div>
<div><br>
</div>
<div>Please see:</div>
<div><a href="http://redmine.named-data.net/issues/1850">http://redmine.named-data.net/issues/1850</a></div>
<div><br>
</div>
<div>Thanks,</div>
<div>Jeff</div>
<div><br>
</div>
</div>
</span></div>
_______________________________________________<br>
Nfd-dev mailing list<br>
<a href="mailto:Nfd-dev@lists.cs.ucla.edu">Nfd-dev@lists.cs.ucla.edu</a><br>
<a href="http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev">http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev</a><br>
</blockquote>
</div>
<br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">_______________________________________________</span><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Nfd-dev
mailing list</span><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<a href="mailto:Nfd-dev@lists.cs.ucla.edu" style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Nfd-dev@lists.cs.ucla.edu</a><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<a href="http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev" style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev</a></blockquote>
</div>
<br>
</div>
</div>
</blockquote>
</span></div>
_______________________________________________<br>
Nfd-dev mailing list<br>
<a href="mailto:Nfd-dev@lists.cs.ucla.edu">Nfd-dev@lists.cs.ucla.edu</a><br>
<a href="http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev">http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
</span>
</div>
</blockquote></div><br></body></html>