pyndn.security.policy package

Submodules

pyndn.security.policy.certificate_cache module

class pyndn.security.policy.certificate_cache.CertificateCache[source]

Bases: object

deleteCertificate(certificateName)[source]

Remove a certificate from the cache. Does nothing if it is not present.

Parameters:certificateName (Name) – The name of the certificate to remove. Assumes there is no timestamp in the name.
getCertificate(certificateName)[source]

Fetch a certificate from the cache.

Parameters:certificateName (Name) – The name of the certificate to remove. Assumes there is no timestamp in the name.
insertCertificate(certificate)[source]

Insert the certificate into the cache. Assumes the timestamp is not yet removed. :param IdentityCertificate certificate: The certificate to insert.

reset()[source]

Clear all certificates from the store.

pyndn.security.policy.config_policy_manager module

class pyndn.security.policy.config_policy_manager.ConfigPolicyManager(configFileName=None, certificateCache=None, searchDepth=5, graceInterval=3000, keyTimestampTtl=3600000, maxTrackedKeys=1000)[source]

Bases: pyndn.security.policy.policy_manager.PolicyManager

Create a new ConfigPolicyManager which will act on the rules specified in the configuration and download unknown certificates when necessary. If certificateCache is a CertificateCache (or omitted) this creates a security v1 PolicyManager to verify certificates in format v1. To verify certificates in format v2, use a CertificateCacheV2 for the certificateCache.

Parameters:
  • configFileName (str) – (optional) If not None or empty, the path to the configuration file containing verification rules. Otherwise, you should separately call load().
  • certificateCache (CertificateCache or CertificateCacheV2) – (optional) A CertificateCache to hold known certificates. If certificateCache is a CertificateCache (or omitted or None) this creates a security v1 PolicyManager to verify certificates in format v1. If this is a CertificateCacheV2, verify certificates in format v2. If omitted or None, create an internal v1 CertificateCache.
  • searchDepth (int) – (optional) The maximum number of links to follow when verifying a certificate chain.
  • graceInterval (int) – (optional) The window of time difference (in milliseconds) allowed between the timestamp of the first interest signed with a new public key and the validation time. If omitted, use a default value.
  • keyTimestampTtl (int) – (optional) How long a public key’s last-used timestamp is kept in the store (milliseconds). If omitted, use a default value.
  • maxTrackedKeys (int) – (optional) The maximum number of public key use timestamps to track.
checkSigningPolicy(dataName, certificateName)[source]

Override to always indicate that the signing certificate name and data name satisfy the signing policy.

Parameters:
  • dataName (Name) – The name of data to be signed.
  • certificateName (Name) – The name of signing certificate.
Returns:

True to indicate that the signing certificate can be used to sign the data.
Return type:

boolean
checkVerificationPolicy(dataOrInterest, stepCount, onVerified, onValidationFailed, wireFormat=None)[source]

If there is a rule matching the data or interest, and the matching certificate is missing, download it. If there is no matching rule, verification fails. Otherwise, verify the signature using the public key in the IdentityStorage.

Parameters:
  • dataOrInterest (Data or Interest) – The Data object or interest with the signature to check.
  • stepCount (int) – The number of verification steps that have been done, used to track the verification progress.
  • onVerified (function object) – If the signature is verified, this calls onVerified(dataOrInterest). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
  • onValidationFailed (function object) – If the signature check fails, this calls onValidationFailed(dataOrInterest, reason). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
Returns:

None for no further step for looking up a certificate chain.
Return type:

ValidationRequest
load(configFileNameOrInput, inputName=None)[source]

Call reset() and load the configuration rules from the file name or the input string. There are two forms: load(configFileName) reads configFileName from the file system. load(input, inputName) reads from the input, in which case inputName is used only for log messages, etc.

Parameters:
  • configFileName (str) – The path to the file containing configuration rules.
  • input (str) – The contents of the configuration rules, with lines separated by NL or CR/NL.
  • inputName (str) – Use with input for log messages, etc.
requireVerify(dataOrInterest)[source]

If the configuration file contains the trust anchor ‘any’, nothing is verified.

reset()[source]

Reset the certificate cache and other fields to the constructor state.

skipVerifyAndTrust(dataOrInterest)[source]

If the configuration file contains the trust anchor ‘any’, nothing is verified.

class pyndn.security.policy.config_policy_manager.TrustAnchorRefreshManager(isSecurityV1)[source]

Bases: object

Manages the trust-anchor certificates, including refresh.

addDirectory(directoryName, refreshPeriod)[source]
getCertificate(certificateName)[source]
Parameters:certificateName (Name) –
Return type:IdentityCertificate
getCertificateV2(certificateName)[source]
Parameters:certificateName (Name) –
Return type:CertificateV2
static loadCertificateV2FromFile(filename)[source]
Parameters:filename (str) –
Return type:CertificateV2
static loadIdentityCertificateFromFile(filename)[source]
Parameters:filename (str) –
Return type:IdentityCertificate
refreshAnchors()[source]

pyndn.security.policy.no_verify_policy_manager module

class pyndn.security.policy.no_verify_policy_manager.NoVerifyPolicyManager[source]

Bases: pyndn.security.policy.policy_manager.PolicyManager

checkSigningPolicy(dataName, certificateName)[source]

Override to always indicate that the signing certificate name and data name satisfy the signing policy.

Parameters:
  • dataName (Name) – The name of data to be signed.
  • certificateName (Name) – The name of signing certificate.
Returns:

True to indicate that the signing certificate can be used to sign the data.
Return type:

boolean
checkVerificationPolicy(dataOrInterest, stepCount, onVerified, onValidationFailed, wireFormat=None)[source]

Override to call onVerified(dataOrInterest) and to indicate no further verification step.

Parameters:
  • dataOrInterest (Data or Interest) – The Data object or interest with the signature (to ignore).
  • stepCount (int) – The number of verification steps that have been done, used to track the verification progress. (stepCount is ignored.)
  • onVerified (function object) – This does override to call onVerified(dataOrInterest). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
  • onValidationFailed (function object) – Override to ignore this.
Returns:

None for no further step for looking up a certificate chain.
Return type:

ValidationRequest
inferSigningIdentity(dataName)[source]

Override to indicate that the signing identity cannot be inferred.

Parameters:dataName (Name) – The name of data to be signed.
Returns:An empty name because cannot infer.
Return type:Name
requireVerify(dataOrInterest)[source]

Override to return false for no verification rule for the received data or signed interest.

Parameters:dataOrInterest (Data or Interest) – The received data packet or interest.
Returns:False.
Return type:boolean
skipVerifyAndTrust(dataOrInterest)[source]

Override to always skip verification and trust as valid.

Parameters:dataOrInterest (Data or Interest) – The received data packet or interest.
Returns:True.
Return type:boolean

pyndn.security.policy.policy_manager module

class pyndn.security.policy.policy_manager.PolicyManager[source]

Bases: object

checkSigningPolicy(dataName, certificateName)[source]

Check if the signing certificate name and data name satisfy the signing policy. Your derived class should override.

Parameters:
  • dataName (Name) – The name of data to be signed.
  • certificateName (Name) – The name of signing certificate.
Returns:

True if the signing certificate can be used to sign the data, otherwise False.
Return type:

bool
Raises:

RuntimeError – for unimplemented if the derived class does not override.
checkVerificationPolicy(dataOrInterest, stepCount, onVerified, onValidationFailed, wireFormat=None)[source]

Check whether the received data packet or interest complies with the verification policy, and get the indication of the next verification step. Your derived class should override.

Parameters:
  • dataOrInterest (Data or Interest) – The Data object or interest with the signature to check.
  • stepCount (int) – The number of verification steps that have been done, used to track the verification progress.
  • onVerified (function object) – If the signature is verified, this calls onVerified(dataOrInterest). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
  • onValidationFailed (function object) – If the signature check fails, this calls onValidationFailed(dataOrInterest, reason). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
Returns:

The indication of next verification step, or None if there is no further step.
Return type:

ValidationRequest
Raises:

RuntimeError – for unimplemented if the derived class does not override.
inferSigningIdentity(dataName)[source]

Infer the signing identity name according to the policy. If the signing identity cannot be inferred, return an empty name. Your derived class should override.

Parameters:dataName (Name) – The name of data to be signed.
Returns:The signing identity or an empty name if cannot infer.
Return type:Name
Raises:RuntimeError – for unimplemented if the derived class does not override.
requireVerify(dataOrInterest)[source]

Check if this PolicyManager has a verification rule for the received data packet or signed interest. Your derived class should override.

Parameters:dataOrInterest (Data or Interest) – The received data packet or interest.
Returns:True if the data or interest must be verified, otherwise False.
Return type:bool
Raises:RuntimeError – for unimplemented if the derived class does not override.
skipVerifyAndTrust(dataOrInterest)[source]

Check if the received data packet or signed interest can escape from verification and be trusted as valid. Your derived class should override.

Parameters:dataOrInterest (Data or Interest) – The received data packet or interest.
Returns:True if the data or interest does not need to be verified to be trusted as valid, otherwise False.
Return type:bool
Raises:RuntimeError – for unimplemented if the derived class does not override.
static verifySignature(signature, signedBlob, publicKeyDer)[source]

Check the type of signature and use the publicKeyDer to verify the signedBlob using the appropriate signature algorithm.

Parameters:
  • signature (Signature) – An object of a subclass of Signature, e.g. Sha256WithRsaSignature.
  • signedBlob (SignedBlob) – the SignedBlob with the signed portion to verify.
  • publicKeyDer (Blob) – The DER-encoded public key used to verify the signature. This is ignored if the signature type does not require a public key.
Returns:

True if the signature verifies, False if not.
Return type:

bool
Raises:

SecurityException if the signature type is not recognized or if publicKeyDer can’t be decoded.

pyndn.security.policy.self_verify_policy_manager module

This module defines the SelfVerifyPolicyManager class which implements a PolicyManager to look in the storage for the public key with the name in the KeyLocator (if available) and use it to verify the data packet or signed interest, without searching a certificate chain. If the public key can’t be found, the verification fails.

class pyndn.security.policy.self_verify_policy_manager.SelfVerifyPolicyManager(storage=None)[source]

Bases: pyndn.security.policy.policy_manager.PolicyManager

Create a new SelfVerifyPolicyManager which will look up the public key in the given storage.

Parameters:storage (IdentityStorage or PibImpl) – (optional) The IdentityStorage or PibImpl for looking up the public key. This object must remain valid during the life of this SelfVerifyPolicyManager. If omitted, then don’t look for a public key with the name in the KeyLocator and rely on the KeyLocator having the full public key DER.
checkSigningPolicy(dataName, certificateName)[source]

Override to always indicate that the signing certificate name and data name satisfy the signing policy.

Parameters:
  • dataName (Name) – The name of data to be signed.
  • certificateName (Name) – The name of signing certificate.
Returns:

True to indicate that the signing certificate can be used to sign the data.
Return type:

boolean
checkVerificationPolicy(dataOrInterest, stepCount, onVerified, onValidationFailed, wireFormat=None)[source]

Look in the storage for the public key with the name in the KeyLocator (if available) and use it to verify the data packet or signed interest. If the public key can’t be found, call onValidationFailed.

Parameters:
  • dataOrInterest (Data or Interest) – The Data object or interest with the signature to check.
  • stepCount (int) – The number of verification steps that have been done, used to track the verification progress.
  • onVerified (function object) – If the signature is verified, this calls onVerified(dataOrInterest). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
  • onValidationFailed (function object) – If the signature check fails, this calls onValidationFailed(dataOrInterest, reason). NOTE: The library will log any exceptions raised by this callback, but for better error handling the callback should catch and properly handle any exceptions.
Returns:

None for no further step for looking up a certificate chain.
Return type:

ValidationRequest
inferSigningIdentity(dataName)[source]

Override to indicate that the signing identity cannot be inferred.

Parameters:dataName (Name) – The name of data to be signed.
Returns:An empty name because cannot infer.
Return type:Name
requireVerify(dataOrInterest)[source]

Always return true to use the self-verification rule for the received data packet or signed interest.

Parameters:dataOrInterest (Data or Interest) – The received data packet or interest.
Returns:True.
Return type:boolean
skipVerifyAndTrust(dataOrInterest)[source]

Never skip verification.

Parameters:dataOrInterest (Data or Interest) – The received data packet or interest.
Returns:False.
Return type:boolean

pyndn.security.policy.validation_request module

This module defines the ValidationRequest class which is used to return information from PolicyManager.checkVerificationPolicy.

class pyndn.security.policy.validation_request.ValidationRequest(interest, onVerified, onValidationFailed, retry, stepCount)[source]

Bases: object

Create a new ValidationRequest with the given values.

Parameters:
  • interest (Interest) – An interest for fetching more data.
  • onVerified (function object) – If the signature is verified, this calls onVerified(data).
  • onValidationFailed (function object) – If the signature check fails, this calls onValidationFailed(data, reason).
  • retry (int) –
  • stepCount (int) – The number of verification steps that have been done, used to track the verification progress.

Module contents