ndn_security/
profile.rs

1use std::sync::Arc;
2
3use crate::Validator;
4
5/// Configures how the engine validates Data packet signatures.
6///
7/// Security is default-on in NDN. Use `Disabled` only for benchmarking
8/// or isolated lab environments.
9pub enum SecurityProfile {
10    /// Full chain validation with cert fetching and hierarchical trust.
11    ///
12    /// This is the default. When a `SecurityManager` is set on the builder,
13    /// the engine wires a `Validator` with:
14    /// - `TrustSchema::hierarchical()` (data and key share first component)
15    /// - Shared `CertCache` from the `SecurityManager`
16    /// - Trust anchors from the `SecurityManager`
17    /// - `CertFetcher` for missing certificates
18    ///
19    /// **When no `SecurityManager` is set**, the engine falls back to
20    /// `AcceptSigned` behaviour: each Data packet's signature is verified
21    /// cryptographically but namespace hierarchy is not enforced. This keeps
22    /// security on by default even without a configured trust anchor.
23    ///
24    /// Use [`Disabled`](Self::Disabled) to explicitly turn off all validation.
25    Default,
26
27    /// Verify that signatures are present and cryptographically valid,
28    /// but skip trust schema and chain walking.
29    ///
30    /// Useful for testing or deployments where any valid signature
31    /// is sufficient (e.g., all participants share a trust domain).
32    AcceptSigned,
33
34    /// No validation — all Data packets pass through unchecked.
35    ///
36    /// Must be explicitly set. Use only for benchmarking or isolated
37    /// lab environments where security is irrelevant.
38    Disabled,
39
40    /// Custom validator provided by the caller.
41    ///
42    /// Full control over trust schema, cert cache, trust anchors,
43    /// and chain depth. For advanced use cases.
44    Custom(Arc<Validator>),
45}
ndn_security/profile.rs

ndn_security/
profile.rs
