Struct SecurityConfig 

pub struct SecurityConfig {

    pub identity: Option<String>,
    pub pib_path: Option<String>,
    pub trust_anchor: Option<String>,
    pub require_signed: bool,
    pub auto_init: bool,
    pub profile: String,
    pub ca_prefix: Option<String>,
    pub ca_info: String,
    pub ca_max_validity_days: u32,
    pub ca_challenges: Vec<String>,
    pub rules: Vec<TrustRuleConfig>,
    pub pib_type: String,
    pub ephemeral_prefix: Option<String>,
}

Security settings.

Fields

identity: Option<String>

NDN identity name for this router (e.g., /ndn/router1).

The corresponding key and certificate must exist in the PIB (unless auto_init is enabled).

pib_path: Option<String>

Path to the PIB directory (default: ~/.ndn/pib).

Create with ndn-ctl security init or enable auto_init.

trust_anchor: Option<String>

Path to a trust-anchor certificate file to load at startup.

Takes precedence over anchors already stored in the PIB.

require_signed: bool

Whether to require all Data packets to be signed and verified.

auto_init: bool

Automatically generate an identity and self-signed certificate on first startup if no keys exist in the PIB.

Requires identity to be set. Default: false.

profile: String

Security profile: "default", "accept-signed", or "disabled".

• "default" — full chain validation with hierarchical trust schema
• "accept-signed" — verify signatures but skip chain walking
• "disabled" — no validation (benchmarking/lab only)

Default: "default".

ca_prefix: Option<String>

NDN name prefix for the built-in NDNCERT CA, e.g. /ndn/edu/example/CA.

When set, the router registers handlers under <ca_prefix>/CA/INFO, <ca_prefix>/CA/PROBE, <ca_prefix>/CA/NEW, and <ca_prefix>/CA/CHALLENGE.

Leave unset to run in client-only mode (no CA hosted).

ca_info: String

Human-readable description of this CA, returned in CA INFO responses.

Example: "NDN Test Network CA".

ca_max_validity_days: u32

Maximum certificate lifetime (days) the CA will issue.

Requests for longer validity are silently capped to this value. Default: 365.

ca_challenges: Vec<String>

Supported NDNCERT challenge types offered by the CA.

Recognised values: "token", "pin", "possession", "email", "yubikey-hotp". Default: ["token"].

rules: Vec<TrustRuleConfig>

Static trust schema rules loaded at startup.

These are added to the active validator’s schema on startup in addition to the rules implied by the profile setting.

When profile = "default" the hierarchical rule is pre-loaded; additional [[security.rule]] entries extend it. When profile = "accept-signed" the accept-all rule is pre-loaded; additional rules are appended. When profile = "disabled" this field is ignored.

Rules can also be added or removed at runtime via the management API: /localhost/nfd/security/schema-rule-add and schema-rule-remove.

pib_type: String

Key backing store type.

• "file" — file-based PIB at pib_path (default, persisted across restarts)
• "memory" — ephemeral in-memory store; keys are lost on restart

When identity is set and the PIB cannot be opened, the router falls back to an ephemeral identity and logs a warning (or shows an interactive recovery prompt when running in a terminal).

Default: "file".

ephemeral_prefix: Option<String>

NDN name prefix for the auto-generated ephemeral identity.

When no identity is configured (or the PIB fails), an in-memory key is generated under <ephemeral_prefix>/<hostname>. If not set, the router derives the name from the system hostname (e.g. /ndn-fwd/router-host).

Set this to enforce a deterministic name for ephemeral identities, e.g. in test environments where the hostname varies.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.