<div dir="ltr">Hi Jeff<div><br></div><div>Yours, Junxiao<br><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Sep 11, 2016 at 2:51 PM, Burke, Jeff <span dir="ltr"><<a href="mailto:jburke@remap.ucla.edu" target="_blank">jburke@remap.ucla.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div bgcolor="white" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Hi,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">I am trying to get a handle on automatic prefix propagation in the wild, and have three questions:
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">#1 – <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">I have a testbed cert assigned for /A/B, where A=/ndn/edu/ucla and B=jburke. I am bringing up a node that I only want to publishe content, starting with a ping server, in the namespace /A/B/C.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">So first, I make a new cert for /A/B/C and sign it with my cert for /A/B. I put the cert for /A/B/C into a repo running on my node. Then, I add a route from /A/B/C to the testbed node for /A.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Given that the trust chain is set up properly, auto-prefix propagation should take care of the rest, right?
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Unfortunately, this does not work in practice unless the cert for /A/B is
<i>also installed </i>on the node publishing /A/B/C. </span></p></div></div></blockquote><div><br></div><div>As described in <a href="https://yoursunny.com/t/2016/ndncert/">Issue Your Own NDN Certificates</a>, /A/B certificate does not need to be installed on the node publishing /A/B/C, but the certificate must be reachable from the router.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Is this a feature or a bug? I do not want that node to have access to my private key for /A/B, merely to be authorized by it for publishing /A/B/C. And I do not want to have to stand up a node to publish
/A/B just to get /A/B/C on the testbed.</span></p></div></div></blockquote><div><br></div><div>Until #2766 protocol is defined and related features are implemented, /A/B certificate must be reachable from the router. To make /A/B certificate reachable, you need to keep a node running 24x7 to publish /A/B/C certificate which is under /A/B/KEY prefix. This is the only node that needs to have /A/B private key, so that it can register /A/B back-route with auto prefix propagation to make /A/B/KEY prefix reachable from the router.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">See a long log of how I figured out this requirement at the end of the email. (Pointers to what docs I could have read to have understood this from the start would be great.)</span></p></div></div></blockquote><div><br></div><div><a href="https://yoursunny.com/t/2016/ndncert/">Issue Your Own NDN Certificates</a> has the procedure.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div><p class="MsoNormal"><span style="font-size:11pt">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">#2 – <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><u><span style="font-size:11pt">Why</span></u><span style="font-size:11pt"> must I manually register localhop/nfd, which Junxiao mentions in his article and recent emails, upon connecting to a hub for automatic prefix propagation to
work? <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">$ nfdc register /localhop/nfd udp4://<a href="http://spurs.cs.ucla.edu" target="_blank">spurs.cs.ucla.edu</a>
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Or more specifically, why is this new step explicit rather than automatic? (When would I not want it to happen? And if that’s an unlikely scenario, perhaps the more likely scenario should be default behavior?)</span></p></div></div></blockquote><div><br></div><div>Requiring /localhop/nfd to trigger auto prefix propagation because this prefix tells NFD-RIB which face is the testbed router. The resulting FIB entry is also used to forward prefix registration commands.</div><div><br></div><div>Registering /localhop/nfd is automatic if you use ndn-autoconfig program. ndn-autoconfig is designed specifically for the testbed.</div><div>nfdc works at a lower level. It has no means to know whether a registration is a testbed router.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div><p class="MsoNormal"><span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">#3 – <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Regarding both questions above, as a user of the testbed and NFD, where would I go to learn about these specifics, or to contribute corrections or examples as below? Right now, I think the detailed information
is distributed across some documentation, redmine issues and Junxiao’s articles, but it seems like we need a community-authored cookbook for working with the testbed, a FAQ, and/or some type of tutorial that is kept up to date as new features (like automatic
prefix propagation, cert requirements, etc. are put in place.) Would it make sense to start something like this?</span></p></div></div></blockquote><div><br></div><div>No. If a technology (in this case, the NDN testbed) is widely used, there will be blog posts, StackOverflow answers, and other information scattered across the Internet, and user can use search engines to find them. For example, my article <a href="https://yoursunny.com/t/2016/nfd-prefix/">Let the World Reach Your NFD</a> can be found by Google search "how to configure nfd auto prefix propagation".</div><div><br></div><div>It makes sense to index good articles in a wiki site (similar to <a href="http://www.chip-community.org/index.php/Main_Page">CHIP Community</a>) or forum (sticky posts). However, you cannot force users to contribute directly to the wiki/forum. Users can post them anywhere, and good articles are linked from the wiki/forum.</div><div>I'm already doing so on NFD wiki and nfd-dev mailing list (which I treat as a forum), but for coders (in "HOWTOs for n00b" section).</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div><p class="MsoNormal"><span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Jeff<u></u><u></u></span></p>
<p class="MsoNormal"><br></p></div></div></blockquote></div></div></div></div>