Interface for validating data and interest packets. More...

#include <validator.hpp>

Inheritance diagram for ndn::security::v2::Validator:

Collaboration diagram for ndn::security::v2::Validator:

Public Member Functions
	Validator (unique_ptr< ValidationPolicy > policy, unique_ptr< CertificateFetcher > certFetcher)
	Validator constructor. More...

	~Validator ()

void	setMaxDepth (size_t depth)
	Set the maximum depth of the certificate chain. More...

size_t	getMaxDepth () const

void	validate (const Data &data, const DataValidationSuccessCallback &successCb, const DataValidationFailureCallback &failureCb)
	Asynchronously validate `data`. More...

void	validate (const Interest &interest, const InterestValidationSuccessCallback &successCb, const InterestValidationFailureCallback &failureCb)
	Asynchronously validate `interest`. More...

void	loadAnchor (const std::string &groupId, Certificate &&cert)
	load static trust anchor. More...

void	loadAnchor (const std::string &groupId, const std::string &certfilePath, time::nanoseconds refreshPeriod, bool isDir=false)
	load dynamic trust anchors. More...

void	cacheVerifiedCertificate (Certificate &&cert)
	Cache verified `cert` a period of time (1 hour) More...

const Certificate *	findTrustedCert (const Interest &interestForCert) const
	Find a trusted certificate in trust anchor container or in verified cache. More...

bool	isCertKnown (const Name &certPrefix) const
	Check if certificate exists in verified, unverified cache, or in the set of trust anchors. More...

void	cacheUnverifiedCert (Certificate &&cert)
	Cache unverified certificate for a period of time (5 minutes) More...

const TrustAnchorContainer &	getTrustAnchors () const

const CertificateCache &	getVerifiedCertCache () const

const CertificateCache &	getUnverifiedCertCache () const

Protected Member Functions
void	cacheVerifiedCert (Certificate &&cert)
	Cache verified certificate a period of time (1 hour) More...

Protected Attributes
TrustAnchorContainer	m_trustAnchors

CertificateCache	m_verifiedCertCache

CertificateCache	m_unverifiedCertCache

Detailed Description

Interface for validating data and interest packets.

Every time a validation process initiated, it creates a ValidationState that exist until validation finishes with either success or failure. This state serves several purposes:

record Interest or Data packet being validated
record failure callback
record certificates in the certification chain for the Interest or Data packet being validated
record names of the requested certificates to detect loops in the certificate chain
keep track of the validation chain size (aka validation "depth")

During validation, policy and/or key fetcher can augment validation state with policy- and fetcher-specific information using ndn::Tag's.

A validator has a trust anchor cache to save static and dynamic trust anchors, a verified certificate cache for saving certificates that are already verified and an unverified certificate cache for saving prefetched but not yet verified certificates.

Todo:

Limit the maximum time the validation process is allowed to run before declaring failure

Ability to customize maximum lifetime for trusted and untrusted certificate caches. Current implementation hard-codes them to be 1 hour and 5 minutes.

Definition at line 61 of file v2/validator.hpp.

Constructor & Destructor Documentation

ndn::security::v2::Validator::Validator	(	unique_ptr< ValidationPolicy >	policy,
		unique_ptr< CertificateFetcher >	certFetcher
	)

Validator constructor.

Parameters

policy	Validation policy to be associated with the validator
certFetcher	Certificate fetcher implementation.

Definition at line 37 of file v2/validator.cpp.

ndn::security::v2::Validator::~Validator ( )

default

Member Function Documentation

void ndn::security::v2::CertificateStorage::cacheUnverifiedCert ( Certificate && cert )

inherited

Cache unverified certificate for a period of time (5 minutes)

Parameters

cert	The certificate packet

Todo:: Add ability to customize time period

Definition at line 74 of file certificate-storage.cpp.

void ndn::security::v2::CertificateStorage::cacheVerifiedCert ( Certificate && cert )

protectedinherited

Cache verified certificate a period of time (1 hour)

Parameters

cert	The certificate packet

Todo:: Add ability to customize time period

Definition at line 68 of file certificate-storage.cpp.

void ndn::security::v2::Validator::cacheVerifiedCertificate ( Certificate && cert )

Cache verified cert a period of time (1 hour)

Todo:: Add ability to customize time period

Definition at line 179 of file v2/validator.cpp.

const Certificate * ndn::security::v2::CertificateStorage::findTrustedCert ( const Interest & interestForCert ) const

inherited

Find a trusted certificate in trust anchor container or in verified cache.

Parameters

interestForCert Interest for certificate

Returns: found certificate, nullptr if not found.

Note: The returned pointer may get invalidated after next findTrustedCert or findCert calls.

Definition at line 35 of file certificate-storage.cpp.

size_t ndn::security::v2::Validator::getMaxDepth ( ) const

Returns: The maximum depth of the certificate chain

Definition at line 56 of file v2/validator.cpp.

const TrustAnchorContainer & ndn::security::v2::CertificateStorage::getTrustAnchors ( ) const

inherited

Returns: Trust anchor container

Definition at line 80 of file certificate-storage.cpp.

const CertificateCache & ndn::security::v2::CertificateStorage::getUnverifiedCertCache ( ) const

inherited

Returns: Unverified certificate cache

Definition at line 92 of file certificate-storage.cpp.

const CertificateCache & ndn::security::v2::CertificateStorage::getVerifiedCertCache ( ) const

inherited

Returns: Verified certificate cache

Definition at line 86 of file certificate-storage.cpp.

bool ndn::security::v2::CertificateStorage::isCertKnown ( const Name & certPrefix ) const

inherited

Check if certificate exists in verified, unverified cache, or in the set of trust anchors.

Definition at line 47 of file certificate-storage.cpp.

void ndn::security::v2::Validator::loadAnchor	(	const std::string &	groupId,
		Certificate &&	cert
	)

load static trust anchor.

Static trust anchors are permanently associated with the validator and never expire.

Parameters

groupId	Certificate group id.
cert	Certificate to load as a trust anchor.

Definition at line 166 of file v2/validator.cpp.

void ndn::security::v2::Validator::loadAnchor	(	const std::string &	groupId,
		const std::string &	certfilePath,
		time::nanoseconds	refreshPeriod,
		bool	isDir = `false`
	)

load dynamic trust anchors.

Dynamic trust anchors are associated with the validator for as long as the underlying trust anchor file (set of files) exist(s).

Parameters

groupId	Certificate group id, must not be empty.
certfilePath	Specifies the path to load the trust anchors.
refreshPeriod	Refresh period for the trust anchors, must be positive.
isDir	Tells whether the path is a directory or a single file.

Definition at line 172 of file v2/validator.cpp.

void ndn::security::v2::Validator::setMaxDepth ( size_t depth )

Set the maximum depth of the certificate chain.

Definition at line 50 of file v2/validator.cpp.

void ndn::security::v2::Validator::validate	(	const Data &	data,
		const DataValidationSuccessCallback &	successCb,
		const DataValidationFailureCallback &	failureCb
	)

Asynchronously validate data.

Note: successCb and failureCb must not be nullptr

Definition at line 62 of file v2/validator.cpp.

void ndn::security::v2::Validator::validate	(	const Interest &	interest,
		const InterestValidationSuccessCallback &	successCb,
		const InterestValidationFailureCallback &	failureCb
	)

Asynchronously validate interest.

Note: successCb and failureCb must not be nullptr

Definition at line 82 of file v2/validator.cpp.

Field Documentation

TrustAnchorContainer ndn::security::v2::CertificateStorage::m_trustAnchors

protectedinherited

Definition at line 122 of file certificate-storage.hpp.

CertificateCache ndn::security::v2::CertificateStorage::m_unverifiedCertCache

protectedinherited

Definition at line 124 of file certificate-storage.hpp.

CertificateCache ndn::security::v2::CertificateStorage::m_verifiedCertCache

protectedinherited

Definition at line 123 of file certificate-storage.hpp.

ndn-cxx: NDN C++ library with eXperimental eXtensions 0.5.1 documentation

Public Member Functions

Protected Member Functions

Protected Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Field Documentation