Add parallel NDNd network and Go NDNCERT CAs

.gitignore

@@ -2,4 +2,5 @@ __pycache__/
 dist/
 secrets.yml
 .env
-root-ca-home/
+root-ca-home/
+ndnd-root-ca-home/

README.md

@@ -69,6 +69,10 @@ docker compose exec -e HOME=/testbed/root-ca-home master ndnsec list -c
 
 Each node runs the pinned `ndnd-repo` container with identity `<default_prefix>/ndnd/repo` (e.g. `/ndn/edu/ucla/ndnd/repo`). Master generates a dedicated key, obtains a certificate from the local site CA, and installs the public chain selected by `globals.ndnd_repo_anchors`. The repo can write only its keychain and storage; it has no access to CA private keys or master renewal scripts.
 
+## NDNd Distance Vector
+
+Nodes with `ndnd_enabled: true` run the NDNd forwarder and a separate `ndnd dv` router. The router connects only to the forwarder's `/run/ndnd/ndnd.sock` and exchanges DV traffic over the forwarder's UDP listener on port 6364; it does not use NFD's socket or NLSR. Router identities are root-signed as `<default_prefix>/32=DV`, and each router has permanent UDP neighbor links to the other NDNd-enabled nodes.
+
 ## NDNd Merkle
 
 Only UCLA runs the `ndnd-merkle` container, selected by `services.ndnd-merkle.hosts: [UCLA]` in `config.yml`, with identity `/ndn/edu/ucla/ndnd/merkle`. Master automatically provisions and renews its dedicated site-issued certificate using the same testbed anchors as the repo. Its trust schema permits testbed-certified users to append under their own identities and only the log key to sign responses. History persists in `dist/ndnd-merkle/storage`.
@@ -144,3 +148,70 @@ sudo systemctl enable unattended-upgrades
 sudo systemctl start unattended-upgrades
 sudo unattended-upgrades --debug
 ```
+
+## NDNd status
+
+The NDNd forwarder, DV router, status server, CA services, and `/ndnd` Merkle log
+use the digest-pinned DV2 staging image configured in Compose. The `/ndnd`
+repository retains its separately pinned DV2 image.
+Upgrade the forwarder, DV router, and status server together; the DV2 BIFT
+management dataset uses TLV encoding. Both repository configurations explicitly
+supply their management trust schema.
+
+The NFD-connected `ndnd-repo` retains the October 22 image because DV2's local
+prefix advertising uses the DV management API instead of NFD RIB registration.
+The NFD-connected Merkle log also retains the October 22 image.
+
+On hosts with `ndnd_enabled: true`, Caddy exposes:
+
+- `/ndnd-status/`: HTML status page.
+- `/ndnd-status/status.xml`: XML status report.
+- `/ndnd-status/status.json`: JSON status report.
+
+For example: `https://suns.cs.ucla.edu/ndnd-status/status.json`.
+
+The renderer compiles `templates/ndnd-dv/dv-schema.lvs.j2` for both DV and the
+status server. It permits only inventoried NDNd router certificates, issued
+directly by the `/ndnd` root, to sign their routing and status datasets. DV
+explicitly loads this schema; the status server receives the same schema and
+the public root certificate in PEM format through a separate read-only mount.
+It has no access to router private keys. Changes to either status trust file
+cause the existing renderer to restart the status server.
+The same compiled schema is published at `/file-server/ndnd/dv-schema.tlv`,
+matching the schema URL in the NDNd CA profile.
+
+The status server validates `/<router>/32=DV/32=STATUS` before including the
+routing dataset. It does not fall back to an unrestricted schema. The local
+DV summary remains available if the signed dataset cannot be validated; check
+the status server logs and the report's routing state in that case.
+
+
+## NDNd network bridge
+
+NDNd-enabled sites bridge the two forwarders locally over UDP. NFD sends `/ndnd`
+Interests to NDNd through a capture route, excluding inherited root routes, and
+advertises `/ndnd` through NLSR. NDNd installs a `/ndn` PET
+next hop toward NFD and advertises it through DV. Producers still register on
+the network matching their top-level prefix; the bridge does not redistribute
+producer registrations or change application trust policies.
+
+Each enabled host needs a unique, stable `ndnd_bier_index`. The forwarder loads
+that index at startup, and `framework/ndnd-network-init.py` registers the same
+router-to-index inventory on every node and rebuilds the BIFT. Both cron scripts
+run this initializer after service updates. It binds announcements to permanent
+UDP faces, restores entries after restarts, and reloads NDNd-connected producers
+when their forwarder's startup time changes. The NFD-connected repository and
+Merkle service are outside that restart group.
+
+NDNd uses the NLSR neighbor connections between enabled sites. DV2 currently
+uses a fixed cost of 1 per link; it does not use NLSR's configured link costs.
+
+To reconcile a running node manually from its checkout:
+
+```bash
+docker compose exec -T -e PWD="$PWD" master python3 framework/ndnd-network-init.py
+```
+
+The bridge has static routes. An abrupt peer failure does not automatically
+withdraw its gateway advertisement; alternative gateway advertisements alone do
+not guarantee immediate failover. Gateway health tracking is not implemented here.

anchors/ndnd-go-root.base64

@@ -0,0 +1 @@
+BugHIwgEbmRuZAgDS0VZCAiErVznAwK56QgCTkE2CAAAAaFYpS5aFAkYAQIZBAA27oAVLDAqMAUGAytlcAMhAOi1L42QxRzGB/yMvduMM19dM3ukSmyubURXLZG9RvY1FkYbAQUcFwcVCARuZG5kCANLRVkICIStXOcDArnp/QD9Jv0A/g8yMDI2MTAyMFQwOTI5NDL9AP8PMjAyNzEwMjBUMDkyOTQyF0Aj+qOlJSdFN9wGXmnobfYLUmjqNikwnydWB6qUAmp1EGZN5d3q8kcQ5By/6B44uzeVau5TksFdwRZKoB7HtxwE

config.yml

@@ -6,6 +6,42 @@ host_vars_path: host_vars
 
 # This must match exactly with the docker-compose.yml file
 services:
+  ndnd:
+    enabled_by: ndnd_enabled
+    profile: ndnd
+    template_path: templates/ndnd
+    render_path: dist/ndnd
+
+  ndnd-dv:
+    enabled_by: ndnd_enabled
+    profile: ndnd
+    template_path: templates/ndnd-dv
+    render_path: dist/ndnd-dv-independent
+
+  ndnd-http-status-server:
+    enabled_by: ndnd_enabled
+    profile: ndnd
+    template_path: templates/ndnd-http-status-server
+    render_path: dist/ndnd-http-status-server
+
+  ndnd-go-ca:
+    enabled_by: ndnd_enabled
+    profile: ndnd-go-ca
+    template_path: templates/ndnd-site-ca
+    render_path: dist/ndnd-site-ca-config
+
+  ndnd-go-root-ca:
+    hosts: [UCLA]
+    profile: ndnd-go-root-ca
+    template_path: templates/ndnd-go-ca
+    render_path: dist/ndnd-go-root-config
+
+  ndnd-root-http-ca:
+    hosts: [UCLA]
+    profile: ndnd-go-root-ca
+    template_path: templates/ndnd-root-http-ca
+    render_path: dist/ndnd-go-root-config
+
   caddy:
     template_path: templates/caddy
     render_path: dist/caddy
@@ -39,12 +75,25 @@ services:
     template_path: templates/ndnd-repo
     render_path: dist/ndnd-repo
 
+  ndnd-network-repo:
+    enabled_by: ndnd_enabled
+    profile: ndnd
+    template_path: templates/ndnd-network-repo
+    render_path: dist/ndnd-network-repo
+
   ndnd-merkle:
     hosts: [UCLA]
     profile: merkle-log
     template_path: templates/ndnd-merkle
     render_path: dist/ndnd-merkle
 
+  ndnd-network-merkle:
+    hosts: [UCLA]
+    enabled_by: ndnd_enabled
+    profile: ndnd-merkle-log
+    template_path: templates/ndnd-network-merkle
+    render_path: dist/ndnd-network-merkle
+
   ndncert:
     template_path: templates/ndncert
     render_path: dist/ndncert
@@ -74,6 +123,21 @@ globals:
   # Explicitly select the active root; retain additional roots here during rollover.
   ndnd_repo_anchors:
     - anchors/ndn-testbed-root.ndncert.2204.base64
+  ndnd_udp_port: 6364
+  ndnd_dv_network: /ndnd
+  ndnd_ca_host: UCLA
+  ndnd_ca_image: ghcr.io/named-data/ndnd:dv2-staging@sha256:aba4d409d0f3ed2a7b134bd5d0ade0e0c9c37ad55e69254951c306f961b36d5b
+  ndnd_ca_info: "NDNd Testbed Go CA"
+  ndnd_ca_max_validity_period: "7776000"
+  ndnd_ca_max_suffix_length: "5"
+  ndnd_ca_supported_challenges: [email, dns]
+  ndnd_site_ca_supported_challenges: [email]
+  ndnd_root_certificate_url: https://suns.cs.ucla.edu/file-server/ndnd/ndnd-root.ndncert
+  ndnd_root_certificate_sha256: c020b0ddf2c82dcbdbb8339bc63d8a63d8fece4be41d3f69097cd3185dd47889
+  ndnd_root_http_ca_url: https://suns.cs.ucla.edu/ndnd-ca
+  ndnd_root_anchor_path: anchors/ndnd-go-root.base64
+  ndnd_trust_schema_url: https://suns.cs.ucla.edu/file-server/ndnd/dv-schema.tlv
+  ndnd_root_http_ca_internal_url: http://ndnd-root-http-ca:8777
 
 # Declare variables available for each host
 # You can use lint.py to check variables, their types and
@@ -97,8 +161,12 @@ variables:
   memsize: number
   neighbors: dict
   position: list
+  ndnd_ca_prefix: "?string"
   hr_angle: number
   hr_radius: number
   ethernet_device: string
   is_root_ca: "?boolean"
   is_status_page: "?boolean"
+  ndnd_enabled: "?boolean"
+  ndnd_router_prefix: "?string"
+  ndnd_bier_index: "?number"