NFD » ndn-cxx

In my latest implementation, the design has been adjusted: Validator is split from the ValidationPolicy. ValidationPolicy determines whether data/interest can be signed by the key name specified in the KeyLocator field, Validator performs actual signature verification, key retrieval, etc.

Here is the high-level interface:

/**
 * @brief Abstraction that implements validation policy for Data and Interest packets
 */
class ValidationPolicy
{
public:
  using ValidationContinuation = std::function<void(const shared_ptr<ValidationState>& state,
                                                    const shared_ptr<KeyRequest>& keyRequest)>;

  /**
   * @brief Check @p data against the policy
   *
   * Semantics of checkPolicy has changed from v1::Validator
   * - If packet violates policy, the policy should call `state.fail` with appropriate error
   *   code and error description.
   * - If packet conforms to the policy and no further key retrievals are necessary,
   *   the policy should call continueValidation(state, nullptr)
   * - If packet conforms to the policy and key needs to be fetched, the policy should call
   *   continueValidation(state, <appropriate-key-request-instance>)
   */
  virtual void
  checkPolicy(const Data& data, const shared_ptr<ValidationState>& state,
              const ValidationContinuation& continueValidation) = 0;

  /**
   * @brief Check @p interest against the policy
   *
   * Semantics of checkPolicy has changed from v1::Validator
   * - If packet violates policy, the policy should call `state.fail` with appropriate error
   *   code and error description.
   * - If packet conforms to the policy and no further key retrievals are necessary,
   *   the policy should call continueValidation(state, nullptr)
   * - If packet conforms to the policy and key needs to be fetched, the policy should call
   *   continueValidation(state, <appropriate-key-request-instance>)
   */
  virtual void
  checkPolicy(const Interest& interest, const shared_ptr<ValidationState>& state,
              const ValidationContinuation& continueValidation) = 0;
};

/**
 * @brief Interface for validating data and interest packets.
 *
 * A validator can either operate in online mode or offline mode:
 * - In online mode (a pointer to a valid Face instance passed to the constructor): certificates
 *   missing in the local cache will be retrieved from the network
 * - In offline mode (nullptr passed to the constructor): only local cache will be used, failing
 *   validation if some certificates are missing.
 *
 * Every time a validation process initiated, it creates a ValidationState that exist until
 * validation finishes either with success of failure.  This instance ensures that each key is
 * requested no more than once.
 *
 * A validator has a trust anchor cache to save static and dynamic trust anchors, a verified
 * key cache for saving keys that is already verified and an unverified key cache for saving
 * prefetched but not yet verified keys.
 */
class Validator : noncopyable
{
public:
  /**
   * @brief Validator constructor.
   *
   * @param policy Validation policy to be associated with the validator
   * @param face Pointer to face for fetching keys from network.  If provided, the Validator
   *             operates in online mode; otherwise, the Validator operates in offline mode.
   */
  explicit
  Validator(unique_ptr<ValidationPolicy> policy, Face* face = nullptr);

  /**
   * @brief Validate Data and trigger either success callback or failure callback.
   *
   * @param data       Data to check.
   * @param successCb  Callback when @p data is validated.
   * @param failureCb  Callback when @p data is not validated.
   */
  void
  validate(const Data& data,
           const DataValidationSuccessCallback& successCb,
           const DataValidationFailureCallback& failureCb);

  /**
   * @brief Validate Interest and trigger either success callback or failure callback.
   *
   * @param interest   Interest to check.
   * @param successCb  Callback when @p interest is validated.
   * @param failureCb  Callback when @p interest is not validated.
   */
  void
  validate(const Interest& interest,
           const InterestValidationSuccessCallback& successCb,
           const InterestValidationFailureCallback& failureCb);
};

There is no open Change on Gerrit for this issue. Further ValidationPolicy work is being performed in #3920.