VERSION 1.0.1

This version is mostly a bug fix release. It fixes a bug that could cause the service to crash on Windows while running the GUI application. It also contains a number of fixes to the Linux installer and Linux support for systemd-based init systems. It also includes a minor tweak to the multicast algorithm. Version 1.0.0 sent multicasts in a deterministic order, while this version randomizes the order. The vast majority of users will notice nothing, but this may result in superior coverage for service announcements on very large networks. It's a hard variation to test, so we're releasing like this to gather information from users about the effect. Nothing will change on small networks, and ordinary multicast functions like ARP and NDP should be unaffected. The next version will likely focus on additional improvements to Microsoft Windows support, since there are several known Windows issues in need of attention. We're working on an NDIS6-based Tap driver that should address the driver issues experienced by a small number of Windows 7 users.
Stash make-freebsd.mk in attic/ to indicate that the FreeBSD port is not done net. Coming soon!
2026-09-22 15:29:03 -07:00 · 2014-12-05 12:10:18 -08:00 · 2014-12-05 09:36:16 -08:00 · 2014-12-05 17:34:05 +00:00 · 2014-12-05 12:26:53 -05:00 · 2014-12-04 20:13:41 -05:00
131 changed files with 8587 additions and 5156 deletions
@@ -26,9 +26,20 @@
 *.cache
 *.obj
 *.tlog
+*.pid
+/*.deb
+/*.rpm
 /build-*
 /ZeroTierOneInstaller-*
 .qmake.stash
 *.autosave
 /ZeroTier One.dmg
 /root-topology/*.secret
+/testnet/local-testnet/n????
+/testnet/local-testnet/*/peers.persist
+/testnet/local-testnet/*/authtoken.secret
+/testnet/local-testnet/*/*.log
+/testnet/local-testnet/*/*.old
+/testnet/local-testnet/*/root-topology
+/testnet/local-testnet/*/local.conf
+/testnet/local-testnet/*/networks.d
@@ -9,3 +9,8 @@ endif
 ifeq ($(OSTYPE),Linux)
 	include make-linux.mk
 endif
+
+ifeq ($(OSTYPE),FreeBSD)
+	include make-freebsd.mk
+endif
+
@@ -1,18 +1,54 @@
-ZeroTier One - Ethernet Virtualization
+ZeroTier One - Network Virtualization Everywhere
 ======

-ZeroTier One is an ethernet virtualization engine. It creates virtual LANs of almost unlimited size that span physical network boundaries.
+ZeroTier One is an ethernet virtualization engine. It creates virtual switched LANs of almost unlimited size that span physical network boundaries. To the operating system these behave just like ordinary Ethernet ports. Everything just works, even as your computer moves around or your physical Internet link changes.

-The underlying protocol is peer to peer with managed anchor points ("supernodes") for instant-on communication, assisted NAT traversal, and relaying for users who cannot make P2P connections. All unicast packets are encrypted end-to-end using private keys that only you control. Multicast and broadcast work as they would on a normal LAN, except that traffic is throttled and intelligently prioritized on large networks to stay within bandwidth limits while preserving essential functionality (multicast triage algorithm). Its behavior is not unlike some enterprise-grade intelligent ethernet switches designed for huge wired networks such as university LANs.
+It's intended to replace conventional hub-and-spoke VPNs, provide provider-neutral secure private backplane networks to multi-data-center and hybrid cloud deployments, allow remote access to embedded devices, and much more.

-[Visit ZeroTier Networks on the web](https://www.zerotier.com/) for more information. Follow the [ZeroTier blog](https://www.zerotier.com/blog/) and the [GitHub project](https://github.com/zerotier/ZeroTierOne) to stay up to date. See the GitHub-hosted wiki (sidebar) for technical info and help for various platforms.
+ZeroTier uses a peer to peer network with managed anchor points ("supernodes"). These are operated by ZeroTier Networks, and are free to use. They provides instant "zero configuration" startup, NAT traversal assistance, relaying in cases where NAT traversal doesn't work, and a trusted root authority for looking up peer public keys (identities). The supernodes run the same open-source software as regular nodes, are geographically distributed across three continents, and have remained stable for over a year. [This blog post](http://adamierymenko.com/decentralization-i-want-to-believe/) discusses the design rationale in some detail. *(TL;DR: this design represents a compromise between speed and ease of use and decentralization.)*

-Auto-updating binary packages that install easily [can be found here.](https://www.zerotier.com/download.html) Packages for popular Linux distributions that neatly wrap the Linux installer/uninstaller are coming soon. If you want to build from source, clone this repository and see BUILDING.txt and RUNNING.txt. If you build manually you'll have to update manually.
+ZeroTier One encrypts all traffic end-to-end with keys that only you control. Even when traffic is traversing our network we cannot decrypt it. It's not, however, a "strong privacy" tool since it would still be possible for us (or your ISP or anyone else in between) to observe "meta-data" about your traffic. If you need *that* level of anonymity, we recommend [Tor](https://www.torproject.org) or something similar. Onion routing is the only technology we're aware of that is capable of delivering that level of end-to-end privacy protection.

-Once you are up and running, you can [create an account on the network control panel](https://www.zerotier.com/networks.html) if you want to create a private network or you can join [Earth](https://www.zerotier.com/earth.html) by running (on Linux and Mac) `sudo ./zerotier-cli join 8056c2e21c000001`. (Earth is a public virtual network, meaning that it has no access control and allows anyone to join. Make sure your system is up to date and you have no unprotected network services listening.)
+At the moment the ZeroTier wire protocol is only documented in the source (start with the comments in Packet.hpp), but more formal documentation is planned for the near future. Encapsulation overhead is comparable to IPSec or OpenVPN.

-Note: If UDP traffic over port 9993 (at a minimum) is not permitted by your local or network firewall(s), ZeroTier One will fall back to TCP tunneling to supernodes over port 443 and will not be able to make direct NAT-t connections to other peers. This fallback mode slows things down considerably. If you're getting very poor performance check your firewall settings. You can see if fallback mode is active by checking for outbound TCP connections from the zerotier-one process to port 443 on five or six hosts in the zerotier.com domain. (See Defaults.cpp for a list of these hosts.)
+[Visit ZeroTier Networks on the web](https://www.zerotier.com/) for more information. Follow the [ZeroTier blog](https://www.zerotier.com/blog/), [Twitter feed](https://twitter.com/ZeroTier) and the main [GitHub project](https://github.com/zerotier/ZeroTierOne) to stay up to date. See the GitHub-hosted wiki (sidebar) for more technical info and help for various platforms. There's also a [support portal](https://www.zerotier.com/support/) for more general information.

-Most users will use IPv4 and/or IPv6 over ZeroTier One, but since it virtualizes at the ethernet (layer 2) level it can technically host almost any protocol. Users have made classic multiplayer games work over IPX, for example. Services like DHCP and IPv6 NDP for link-local addresses can work automatically.
+### Getting Started

-The service is free for public networks and for managed private networks up to ten users. The code is open source and is licensed under the GNU GPL v3 (not LGPL). If you'd like to embed it in a closed-source commercial product, please e-mail [contact@zerotier.com](mailto:contact@zerotier.com) to discuss licensing.
+Auto-updating binary packages that install easily [can be found here](https://www.zerotier.com/download.html) for officially supported platforms. Packages for popular Linux distributions that neatly wrap the Linux installer/uninstaller are coming soon.
+
+If you want to build from source, clone this repository and see BUILDING.txt and RUNNING.txt. If you build manually you'll have to update manually, and we recommend doing so often as development is progressing very rapidly. (Protocol is pretty stable but you might miss out on new features or experience performance degradation if you're too far behind.)
+
+Once you are up and running, you have several options.
+
+ZeroTier provides ZeroTier One for free, but to help finance development and operations we have a [user-friendly freemium control panel on the web](https://www.zerotier.com/admin.html). This control panel lets you quickly and easily create your own networks, and the operation of their controller node(s) is left to us. Public networks created on our site are free, and private networks are free for up to ten devices. After that there is a monthly charge.
+
+You *only* need an account on our site if you want to use the control panel found there. Joining networks requires no account. To get authorized on a private network, just send your device's 10-digit ID to the network's administrator and they can add you.
+
+Public networks, as the name implies, can be joined without getting authorization from anyone. All you need is their 16-digit network ID. A public network called [Earth](https://www.zerotier.com/earth.html) (8056c2e21c000001) exists for everyone, but be sure your device is adequately secured and up to date before joining.
+
+Alternatively, you can run your own network configuration controller. This lets you run any network for free. To do this, start with the netconf-service/ subfolder of this project. You'll need to do a bit of system administration work and manually populate a Redis database, but it's not terribly hard if you're into that kind of thing.
+
+More products and services will be forthcoming.
+
+### Basic Troubleshooting
+
+For about 95% of users, it just works.
+
+If you are running a local system firewall, we recommend adding a rule permitting UDP port 9993 inbound and outbound. The binary Windows installer takes care of this for Windows' built-in firewall, but other platforms and third party firewall software may need this for optimal performance.
+
+ZeroTier One peers will automatically locate each other and communicate directly over a local wired LAN *if UDP port 9993 inbound is open*. If that port is filtered, they won't be able to see each others' LAN announcement packets. If you're experiencing poor performance between devices on the same physical network, check their firewall settings. Without LAN auto-location peers must attempt "loopback" NAT traversal, which sometimes fails and in any case requires that every packet traverse your external router twice.
+
+Users behind certain types of firewalls and "symmetric" NAT devices may not able able to connect to external peers directly at all. ZeroTier has limited support for port prediction and will *attempt* to traverse symmetric NATs, but this doesn't always work. If P2P connectivity fails you'll be bouncing UDP packets off our relay servers resulting in slower performance. Some NAT router(s) have a configurable NAT mode, and setting this to "full cone" will eliminate this problem. If you do this you may also see a magical improvement for things like VoIP phones, Skype, BitTorrent, WebRTC, certain games, etc., since all of these use NAT traversal techniques similar to ours.
+
+If you're interested, there's a [technical deep dive about NAT traversal on our blog](https://www.zerotier.com/blog/?p=226). A troubleshooting tool to help you diagnose NAT issues is planned for the future as are uPnP/IGD/NAT-PMP and IPv6 transport.
+
+If a firewall between you and the Internet blocks ZeroTier's UDP traffic, you will fall back to last-resort TCP tunneling to supernodes over port 443 (https impersonation). This will work almost anywhere but is *slow*. If performance seems just terrible, this is the first thing to check.
+
+Some Windows users have reported a [problem with the TAP device driver](https://github.com/zerotier/ZeroTierOne/issues/107). From user reports this seems to occur on Windows systems that have not been updated through Windows Update. While we have a fix planned, we **really** recommend keeping your system up to date for security reasons. Frankly we're a bit torn on this one. If this is truly the cause, perhaps ZeroTier failing to work on unpatched Windows systems is a feature not a bug.
+
+More help can be found in the [GitHub wiki](https://github.com/zerotier/ZeroTierOne/wiki) and the [customer support portal / knowledge base](https://www.zerotier.com/support/).
+
+The ZeroTier source code is open source and is licensed under the GNU GPL v3 (not LGPL). If you'd like to embed it in a closed-source commercial product or appliance, please e-mail [contact@zerotier.com](mailto:contact@zerotier.com) to discuss licensing.
+
+*ZeroTier is keyboard crafted with coffee and sleep deprivation in Southern California.*
@@ -0,0 +1,6 @@
+Qt GUI
+======
+
+This is the Qt GUI distributed for Mac and Windows. It should build on Linux too if you've got Qt installed.
+
+It's a bit ugly and limited and will probably eventually be replaced.
@@ -12,53 +12,58 @@ mac:QMAKE_INFO_PLIST = Info.plist
 mac:LIBS += -framework Cocoa

 SOURCES += main.cpp \
-		mainwindow.cpp \
-		aboutwindow.cpp \
-		networkwidget.cpp \
-		installdialog.cpp \
-		licensedialog.cpp \
-		onetimedialog.cpp \
+    mainwindow.cpp \
+    aboutwindow.cpp \
+    networkwidget.cpp \
+    installdialog.cpp \
+    licensedialog.cpp \
+    onetimedialog.cpp \
+    ../control/IpcConnection.cpp \
+    ../control/IpcListener.cpp \
+    ../control/NodeControlClient.cpp \
+    ../control/NodeControlService.cpp \
    ../node/C25519.cpp \
    ../node/CertificateOfMembership.cpp \
    ../node/Defaults.cpp \
+    ../node/Dictionary.cpp \
    ../node/HttpClient.cpp \
    ../node/Identity.cpp \
+    ../node/IncomingPacket.cpp \
    ../node/InetAddress.cpp \
-    ../node/IpcConnection.cpp \
-    ../node/IpcListener.cpp \
    ../node/Logger.cpp \
    ../node/Multicaster.cpp \
    ../node/Network.cpp \
    ../node/NetworkConfig.cpp \
    ../node/Node.cpp \
    ../node/NodeConfig.cpp \
+    ../node/OutboundMulticast.cpp \
    ../node/Packet.cpp \
-    ../node/PacketDecoder.cpp \
    ../node/Peer.cpp \
    ../node/Poly1305.cpp \
    ../node/RoutingTable.cpp \
    ../node/Salsa20.cpp \
    ../node/Service.cpp \
    ../node/SHA512.cpp \
-    ../node/SocketManager.cpp \
    ../node/SoftwareUpdater.cpp \
    ../node/Switch.cpp \
-    ../node/TcpSocket.cpp \
    ../node/Topology.cpp \
-    ../node/UdpSocket.cpp \
    ../node/Utils.cpp \
-    ../ext/lz4/lz4.c \
-    ../node/Dictionary.cpp
+    ../ext/lz4/lz4.c

 HEADERS  += mainwindow.h \
-		aboutwindow.h \
-		networkwidget.h \
-		installdialog.h \
-		mac_doprivileged.h \
-		licensedialog.h \
-		main.h \
-		onetimedialog.h \
+    aboutwindow.h \
+    networkwidget.h \
+    installdialog.h \
+    mac_doprivileged.h \
+    licensedialog.h \
+    main.h \
+    onetimedialog.h \
+    ../control/IpcConnection.hpp \
+    ../control/IpcListener.hpp \
+    ../control/NodeControlClient.hpp \
+    ../control/NodeControlService.hpp \
    ../node/Address.hpp \
+    ../node/AntiRecursion.hpp \
    ../node/Array.hpp \
    ../node/AtomicCounter.hpp \
    ../node/BandwidthAccount.hpp \
@@ -69,11 +74,12 @@ HEADERS  += mainwindow.h \
    ../node/Constants.hpp \
    ../node/Defaults.hpp \
    ../node/Dictionary.hpp \
+    ../node/EthernetTap.hpp \
+    ../node/EthernetTapFactory.hpp \
    ../node/HttpClient.hpp \
    ../node/Identity.hpp \
+    ../node/IncomingPacket.hpp \
    ../node/InetAddress.hpp \
-    ../node/IpcConnection.hpp \
-    ../node/IpcListener.hpp \
    ../node/Logger.hpp \
    ../node/MAC.hpp \
    ../node/Multicaster.hpp \
@@ -84,11 +90,12 @@ HEADERS  += mainwindow.h \
    ../node/Node.hpp \
    ../node/NodeConfig.hpp \
    ../node/NonCopyable.hpp \
+    ../node/OutboundMulticast.hpp \
    ../node/Packet.hpp \
-    ../node/PacketDecoder.hpp \
    ../node/Path.hpp \
    ../node/Peer.hpp \
    ../node/Poly1305.hpp \
+    ../node/RoutingTable.hpp \
    ../node/RuntimeEnvironment.hpp \
    ../node/Salsa20.hpp \
    ../node/Service.hpp \
@@ -98,15 +105,10 @@ HEADERS  += mainwindow.h \
    ../node/SocketManager.hpp \
    ../node/SoftwareUpdater.hpp \
    ../node/Switch.hpp \
-    ../node/RoutingTable.hpp \
-    ../node/TcpSocket.hpp \
    ../node/Thread.hpp \
    ../node/Topology.hpp \
-    ../node/UdpSocket.hpp \
    ../node/Utils.hpp \
-    ../ext/lz4/lz4.h \
-    ../node/EthernetTap.hpp \
-    ../node/EthernetTapFactory.hpp
+    ../ext/lz4/lz4.h

 FORMS    += mainwindow.ui \
 		aboutwindow.ui \
@@ -62,8 +62,12 @@
 #include "mac_doprivileged.h"
 #endif

+#include "../node/Utils.hpp"
+#include "../node/Identity.hpp"
+#include "../node/Defaults.hpp"
+
 // Globally visible
-ZeroTier::Node::NodeControlClient *zeroTierClient = (ZeroTier::Node::NodeControlClient *)0;
+ZeroTier::NodeControlClient *zeroTierClient = (ZeroTier::NodeControlClient *)0;

 // Main window instance for app
 QMainWindow *mainWindow = (MainWindow *)0;
@@ -77,6 +81,7 @@ static void handleZTMessage(void *arg,const char *line)
 	ztReplies_m.lock();

 	if (line) {
+		//printf("%s\n",line);
 		if ((line[0] == '.')&&(line[1] == (char)0)) {
 			// The message is packed into an event and sent to the main window where
 			// the actual parsing code lives.
@@ -136,7 +141,7 @@ MainWindow::~MainWindow()
 {
 	delete ui;
 	delete zeroTierClient;
-	zeroTierClient = (ZeroTier::Node::NodeControlClient *)0;
+	zeroTierClient = (ZeroTier::NodeControlClient *)0;
 	mainWindow = (MainWindow *)0;
 }

@@ -161,7 +166,7 @@ void MainWindow::timerEvent(QTimerEvent *event) // event can be null since code

 	if (!zeroTierClient) {
 #ifdef __APPLE__
-		if ((!QFile::exists(ZeroTier::Node::NodeControlClient::authTokenDefaultUserPath()))&&(QFile::exists("/Library/Application Support/ZeroTier/One/zerotier-one"))) {
+		if ((!QFile::exists(ZeroTier::NodeControlClient::authTokenDefaultUserPath()))&&(QFile::exists("/Library/Application Support/ZeroTier/One/zerotier-one"))) {
 			// Authorize user by copying auth token into local home directory
 			QMessageBox::information(this,"Authorization Needed","Administrator privileges are required to allow the current user to control ZeroTier One on this computer. (You only have to do this once.)",QMessageBox::Ok,QMessageBox::NoButton);

@@ -204,14 +209,23 @@ void MainWindow::timerEvent(QTimerEvent *event) // event can be null since code
 #endif // __APPLE__

 		try {
-			zeroTierClient = new ZeroTier::Node::NodeControlClient((const char *)0,&handleZTMessage,this);
-			const char *err = zeroTierClient->error();
-			if (err) {
-				delete zeroTierClient;
-				zeroTierClient = (ZeroTier::Node::NodeControlClient *)0;
+			std::string buf;
+			if (ZeroTier::Utils::readFile((ZeroTier::ZT_DEFAULTS.defaultHomePath + ZT_PATH_SEPARATOR_S + "identity.public").c_str(),buf)) {
+				ZeroTier::Identity id;
+				if (id.fromString(buf)) {
+					std::string authToken(ZeroTier::NodeControlClient::getAuthToken(ZeroTier::NodeControlClient::authTokenDefaultUserPath(),false));
+					if (!authToken.length())
+						authToken = ZeroTier::NodeControlClient::getAuthToken((ZeroTier::ZT_DEFAULTS.defaultHomePath + ZT_PATH_SEPARATOR_S + "authtoken.secret").c_str(),false);
+					zeroTierClient = new ZeroTier::NodeControlClient((std::string(ZT_IPC_ENDPOINT_BASE) + id.address().toString()).c_str(),authToken.c_str(),&handleZTMessage,this);
+					const char *err = zeroTierClient->error();
+					if (err) {
+						delete zeroTierClient;
+						zeroTierClient = (ZeroTier::NodeControlClient *)0;
+					}
+				}
 			}
 		} catch ( ... ) {
-			zeroTierClient = (ZeroTier::Node::NodeControlClient *)0;
+			zeroTierClient = (ZeroTier::NodeControlClient *)0;
 		}
 	}

@@ -237,7 +251,7 @@ void MainWindow::customEvent(QEvent *event)
 	ZTMessageEvent *m = (ZTMessageEvent *)event; // only one custom event type so far
 	if (m->ztMessage.size() == 0)
 		return;
-	std::vector<std::string> hdr(ZeroTier::Node::NodeControlClient::splitLine(m->ztMessage[0]));
+	std::vector<std::string> hdr(ZeroTier::NodeControlClient::splitLine(m->ztMessage[0]));
 	if (hdr.size() < 2)
 		return;
 	if (hdr[0] != "200")
@@ -255,7 +269,7 @@ void MainWindow::customEvent(QEvent *event)
 	} else if (hdr[1] == "listnetworks") {
 		std::map< std::string,std::vector<std::string> > newNetworks;
 		for(unsigned long i=1;i<m->ztMessage.size();++i) {
-			std::vector<std::string> l(ZeroTier::Node::NodeControlClient::splitLine(m->ztMessage[i]));
+			std::vector<std::string> l(ZeroTier::NodeControlClient::splitLine(m->ztMessage[i]));
 			// 200 listnetworks <nwid> <name> <mac> <status> <config age> <type> <dev> <ips>
 			if ((l.size() == 10)&&(l[2].length() == 16))
 				newNetworks[l[2]] = l;
@@ -42,6 +42,7 @@
 #include "../node/Constants.hpp"
 #include "../node/Node.hpp"
 #include "../node/Utils.hpp"
+#include "../control/NodeControlClient.hpp"

 namespace Ui {
 class MainWindow;
@@ -49,7 +50,7 @@ class MainWindow;

 // Globally visible instance of local client for communicating with ZT1
 // Can be null if not connected, or will point to current
-extern ZeroTier::Node::NodeControlClient *zeroTierClient;
+extern ZeroTier::NodeControlClient *zeroTierClient;

 // Globally visible pointer to main app window
 extern QMainWindow *mainWindow;
@@ -1,7 +1,4 @@
+Retired Code and Miscellaneous Junk
+======
+
 This directory is for old code that isn't used but we don't want to lose track of, and for anything else random like debug scripts.
-
-#### Some stuff other than shelved code:
-
-multicast-trace-receiver.rb: receives multicast trace UDP packets from ZT_TRACE_MULTICAST
-
-encrypt, decrypt: useful shell scripts for AES-encrypting and decrypting files
@@ -0,0 +1,88 @@
+CC=cc
+CXX=c++
+
+INCLUDES=
+DEFS=
+LIBS=
+
+include objects.mk
+OBJS+=
+TESTNET_OBJS=testnet/SimNet.o testnet/SimNetSocketManager.o testnet/TestEthernetTap.o testnet/TestEthernetTapFactory.o testnet/TestRoutingTable.o
+
+# Enable SSE-optimized Salsa20 on x86 and x86_64 machines
+MACHINE=$(shell uname -m)
+ifeq ($(MACHINE),x86_64)
+	DEFS+=-DZT_SALSA20_SSE 
+endif
+ifeq ($(MACHINE),amd64)
+	DEFS+=-DZT_SALSA20_SSE 
+endif
+ifeq ($(MACHINE),i686)
+	DEFS+=-DZT_SALSA20_SSE 
+endif
+ifeq ($(MACHINE),i586)
+	DEFS+=-DZT_SALSA20_SSE 
+endif
+ifeq ($(MACHINE),i386)
+	DEFS+=-DZT_SALSA20_SSE 
+endif
+ifeq ($(MACHINE),x86)
+	DEFS+=-DZT_SALSA20_SSE 
+endif
+
+# "make official" is a shortcut for this
+ifeq ($(ZT_OFFICIAL_RELEASE),1)
+	ZT_AUTO_UPDATE=1
+	DEFS+=-DZT_OFFICIAL_RELEASE 
+endif
+ifeq ($(ZT_AUTO_UPDATE),1)
+	DEFS+=-DZT_AUTO_UPDATE 
+endif
+
+# "make debug" is a shortcut for this
+ifeq ($(ZT_DEBUG),1)
+#	DEFS+=-DZT_TRACE -DZT_LOG_STDOUT 
+	CFLAGS=-Wall -g -pthread $(INCLUDES) $(DEFS)
+	LDFLAGS=
+	STRIP=echo
+	# The following line enables optimization for the crypto code, since
+	# C25519 in particular is almost UNUSABLE in heavy testing without it.
+ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS = -Wall -O2 -g -pthread $(INCLUDES) $(DEFS)
+else
+	CFLAGS=-Wall -O3 -fPIE -fvisibility=hidden -fstack-protector -pthread $(INCLUDES) -DNDEBUG $(DEFS)
+	LDFLAGS=-pie -Wl,-z,relro,-z,now
+	STRIP=strip --strip-all
+endif
+
+CXXFLAGS=$(CFLAGS) -fno-rtti
+
+all:	one
+
+one:	$(OBJS) main.o
+	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one main.o $(OBJS) $(LIBS)
+	$(STRIP) zerotier-one
+	ln -sf zerotier-one zerotier-cli
+	ln -sf zerotier-one zerotier-idtool
+
+selftest:	$(OBJS) selftest.o
+	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-selftest selftest.o $(OBJS) $(LIBS)
+	$(STRIP) zerotier-selftest
+
+testnet: $(TESTNET_OBJS) $(OBJS) testnet.o
+	$(CXX) $(CXXFLAGS) -o zerotier-testnet testnet.o $(OBJS) $(TESTNET_OBJS) $(LIBS)
+	$(STRIP) zerotier-testnet
+
+installer: one FORCE
+	./buildinstaller.sh
+
+clean:
+	rm -rf $(OBJS) $(TESTNET_OBJS) node/*.o osnet/*.o control/*.o testnet/*.o *.o zerotier-* build-* ZeroTierOneInstaller-*
+
+debug:	FORCE
+	make -j 4 ZT_DEBUG=1
+
+official: FORCE
+	make -j 4 ZT_OFFICIAL_RELEASE=1
+	./buildinstaller.sh
+
+FORCE:
@@ -1,27 +0,0 @@
-#!/usr/bin/ruby
-
-#
-# This can be used with the debug build option ZT_TRACE_MULTICAST to trace
-# a multicast cascade.
-#
-# Define ZT_TRACE_MULTICAST to the IP/port where this script will be listening.
-# The default port here is 6060, so an example would be to add:
-#
-# -DZT_TRACE_MULTICAST=\"10.0.0.1/6060\"
-#
-# ... to DEFS in the Makefile. Then build and run ZeroTier One on a testnet and
-# the box defined as the trace endpoint will get spammed with UDP packets
-# containing trace information for multicast propagation. This script then dumps
-# these trace packets to stdout. Look at the code in PacketDecoder.cpp to see
-# what this information entails.
-#
-
-require 'socket'
-
-s = UDPSocket.new
-s.bind('0.0.0.0',6060)
-
-loop {
-	m = s.recvfrom(4096)[0].chomp
-	puts m if m.length > 0
-}
@@ -31,16 +31,20 @@ case "$system" in
 		# Canonicalize $machine for some architectures... we use x86
 		# and x64 for Intel stuff. ARM and others should be fine if
 		# we ever ship officially for those.
+		debian_arch=$machine
 		case "$machine" in
 			i386|i486|i586|i686)
 				machine="x86"
+				debian_arch="i386"
 				;;
 			x86_64|amd64|x64)
 				machine="x64"
+				debian_arch="amd64"
+				;;
+			armv6l|arm|armhf)
+				machine="armv6l"
+				debian_arch="armhf"
 				;;
-			*)
-				echo "Unsupported machine type: $machine"
-				exit 2
 		esac

 		echo "Assembling Linux installer for $machine and version $vmajor.$vminor.$revision"
@@ -64,6 +68,56 @@ case "$system" in
 		rm -f build-installer-tmp.tar.gz
 		ls -l $targ

+		if [ -f /usr/bin/dpkg-deb -a "$UID" -eq 0 ]; then
+			echo
+			echo Found dpkg-deb and you are root, trying to build Debian package.
+
+			rm -rf build-installer-deb
+
+			debbase="build-installer-deb/zerotier-one_${vmajor}.${vminor}.${revision}.autoupdating_$debian_arch"
+			debfolder="${debbase}/DEBIAN"
+			mkdir -p $debfolder
+
+			cat 'ext/installfiles/linux/DEBIAN/control.in' | sed "s/__VERSION__/${vmajor}.${vminor}.${revision}.autoupdating/" | sed "s/__ARCH__/${debian_arch}/" >$debfolder/control
+			cat $debfolder/control
+			cp -f 'ext/installfiles/linux/DEBIAN/conffiles' "${debfolder}/conffiles"
+
+			mkdir -p "${debbase}/var/lib/zerotier-one/updates.d"
+			cp -f $targ "${debbase}/var/lib/zerotier-one/updates.d"
+
+			rm -f "${debfolder}/postinst" "${debfolder}/prerm"
+
+			echo '#!/bin/bash' >${debfolder}/postinst
+			echo "/var/lib/zerotier-one/updates.d/${targ}" >>${debfolder}/postinst
+			echo "/bin/rm -f /var/lib/zerotier-one/updates.d/*" >>${debfolder}/postinst
+			chmod a+x ${debfolder}/postinst
+
+			echo '#!/bin/bash' >${debfolder}/prerm
+			echo 'export PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin' >>${debfolder}/prerm
+			echo 'if [ "$1" != "upgrade" ]; then' >>${debfolder}/prerm
+			echo '	/var/lib/zerotier-one/uninstall.sh' >>${debfolder}/prerm
+			echo 'fi' >>${debfolder}/prerm
+			chmod a+x ${debfolder}/prerm
+
+			dpkg-deb --build $debbase
+
+			mv -f build-installer-deb/*.deb .
+			rm -rf build-installer-deb
+		fi
+
+		if [ -f /usr/bin/rpmbuild ]; then
+			echo
+			echo Found rpmbuild, trying to build RedHat/CentOS package.
+
+			rm -f /tmp/zerotier-one.spec
+			curr_dir=`pwd`
+			cat ext/installfiles/linux/RPM/zerotier-one.spec.in | sed "s/__VERSION__/${vmajor}.${vminor}.${revision}/g" | sed "s/__INSTALLER__/${targ}/g" >/tmp/zerotier-one.spec
+
+			rpmbuild -ba /tmp/zerotier-one.spec
+
+			rm -f /tmp/zerotier-one.spec
+		fi
+
 		;;

 	Darwin)
@@ -99,4 +153,6 @@ case "$system" in

 esac

+rm -rf build-installer
+
 exit 0
@@ -36,16 +36,20 @@
 #include "IpcConnection.hpp"

 #ifndef __WINDOWS__
+#include <unistd.h>
+#include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/un.h>
-#include <unistd.h>
+#include <sys/socket.h>
+#include <sys/select.h>
 #endif

 namespace ZeroTier {

-IpcConnection::IpcConnection(const char *endpoint,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
+IpcConnection::IpcConnection(const char *endpoint,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
 	_handler(commandHandler),
 	_arg(arg),
+	_timeout(timeout),
 #ifdef __WINDOWS__
 	_sock(INVALID_HANDLE_VALUE),
 	_incoming(false),
@@ -81,12 +85,13 @@ IpcConnection::IpcConnection(const char *endpoint,void (*commandHandler)(void *,
 }

 #ifdef __WINDOWS__
-IpcConnection::IpcConnection(HANDLE s,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
+IpcConnection::IpcConnection(HANDLE s,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
 #else
-IpcConnection::IpcConnection(int s,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
+IpcConnection::IpcConnection(int s,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
 #endif
 	_handler(commandHandler),
 	_arg(arg),
+	_timeout(timeout),
 	_sock(s),
 #ifdef __WINDOWS__
 	_incoming(true),
@@ -104,18 +109,23 @@ IpcConnection::~IpcConnection()
 	_writeLock.unlock();

 #ifdef __WINDOWS__
+
 	while (_running) {
-		Thread::cancelIO(_thread);
+		Thread::cancelIO(_thread); // cause Windows to break from blocking read and detect shutdown
 		Sleep(100);
 	}
-#else
+
+#else // !__WINDOWS__
+
 	int s = _sock;
 	_sock = 0;
 	if (s > 0) {
 		::shutdown(s,SHUT_RDWR);
 		::close(s);
 	}
-#endif
+	Thread::join(_thread);
+
+#endif // __WINDOWS__ / !__WINDOWS__
 }

 void IpcConnection::printf(const char *format,...)
@@ -134,7 +144,7 @@ void IpcConnection::printf(const char *format,...)

 #ifdef __WINDOWS__
 	_writeBuf.append(tmp,n);
-	Thread::cancelIO(_thread);
+	Thread::cancelIO(_thread); // cause Windows to break from blocking read and service write buffer
 #else
 	if (_sock > 0)
 		::write(_sock,tmp,n);
@@ -144,20 +154,39 @@ void IpcConnection::printf(const char *format,...)
 void IpcConnection::threadMain()
 	throw()
 {
-	char tmp[65536];
-	char linebuf[65536];
+	char tmp[16384];
+	char linebuf[16384];
 	unsigned int lineptr = 0;
 	char c;

 #ifdef __WINDOWS__
+
 	DWORD n,i;
 	std::string wbuf;
-#else
+
+#else // !__WINDOWS__
+
 	int s,n,i;
-#endif
+	fd_set readfds,writefds,errorfds;
+	struct timeval tout;
+
+#ifdef SO_NOSIGPIPE
+	if (_sock > 0) {
+		i = 1;
+		::setsockopt(_sock,SOL_SOCKET,SO_NOSIGPIPE,(char *)&i,sizeof(i));
+	}
+#endif // SO_NOSIGPIPE
+
+#endif // __WINDOWS__ / !__WINDOWS__

 	while (_run) {
+
 #ifdef __WINDOWS__
+
+		/* Note that we do not use fucking timeouts in Windows, since it does seem
+		 * to properly detect named pipe endpoint close. But we do use a write buffer
+		 * because Windows won't let you divorce reading and writing threads without
+		 * all that OVERLAPPED cruft. */
 		{
 			Mutex::Lock _l(_writeLock);
 			if (!_run)
@@ -187,16 +216,42 @@ void IpcConnection::threadMain()
 		}
 		if (!_run)
 			break;
-#else
+
+#else // !__WINDOWS__
+
+		/* So today I learned that there is no reliable way to detect a half-closed
+		 * Unix domain socket. So to make sure we don't leave orphaned sockets around
+		 * we just use fucking timeouts. If a socket fucking times out, we break from
+		 * the I/O loop and terminate the thread. But this IpcConnection code is ugly
+		 * so maybe the OS is simply offended by it and refuses to reveal its mysteries
+		 * to me. Oh well... this IPC code will probably get canned when we go to
+		 * local HTTP RESTful interfaces or soemthing like that. */
 		if ((s = _sock) <= 0)
 			break;
-		n = (int)::read(s,tmp,sizeof(tmp));
-		if ((n <= 0)||(_sock <= 0))
-			break;
-#endif
+		FD_ZERO(&readfds);
+		FD_ZERO(&writefds);
+		FD_ZERO(&errorfds);
+		FD_SET(s,&readfds);
+		FD_SET(s,&errorfds);
+		tout.tv_sec = _timeout; // use a fucking timeout
+		tout.tv_usec = 0;
+		if (select(s+1,&readfds,&writefds,&errorfds,&tout) <= 0) {
+			break; // socket has fucking timed out
+		} else {
+			if (FD_ISSET(s,&errorfds))
+				break; // socket has an exception... sometimes works
+			else {
+				n = (int)::read(s,tmp,sizeof(tmp));
+				if ((n <= 0)||(_sock <= 0))
+					break; // read returned error... sometimes works
+			}
+		}
+
+#endif // __WINDOWS__ / !__WINDOWS__
+
 		for(i=0;i<n;++i) {
 			c = (linebuf[lineptr] = tmp[i]);
-			if ((c == '\r')||(c == '\n')||(lineptr == (sizeof(linebuf) - 1))) {
+			if ((c == '\r')||(c == '\n')||(c == (char)0)||(lineptr == (sizeof(linebuf) - 1))) {
 				if (lineptr) {
 					linebuf[lineptr] = (char)0;
 					_handler(_arg,this,IPC_EVENT_COMMAND,linebuf);
@@ -211,11 +266,13 @@ void IpcConnection::threadMain()
 	_writeLock.unlock();

 #ifdef __WINDOWS__
+
 	if (_incoming)
 		DisconnectNamedPipe(_sock);
 	CloseHandle(_sock);
 	_running = false;
-#endif
+
+#endif // __WINDOWS__

 	if (r)
 		_handler(_arg,this,IPC_EVENT_CONNECTION_CLOSED,(const char *)0);
@@ -28,10 +28,10 @@
 #ifndef ZT_IPCCONNECTION_HPP
 #define ZT_IPCCONNECTION_HPP

-#include "Constants.hpp"
-#include "Thread.hpp"
-#include "NonCopyable.hpp"
-#include "Mutex.hpp"
+#include "../node/Constants.hpp"
+#include "../node/Thread.hpp"
+#include "../node/NonCopyable.hpp"
+#include "../node/Mutex.hpp"

 #ifdef __WINDOWS__
 #include <WinSock2.h>
@@ -61,11 +61,12 @@ public:
 	 * Connect to an IPC endpoint
 	 *
 	 * @param endpoint Endpoint path
+	 * @param timeout Inactivity timeout in seconds
 	 * @param commandHandler Command handler function
 	 * @param arg First argument to command handler
 	 * @throws std::runtime_error Unable to connect
 	 */
-	IpcConnection(const char *endpoint,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
+	IpcConnection(const char *endpoint,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
 	~IpcConnection();

 	/**
@@ -80,13 +81,14 @@ public:
 private:
 	// Used by IpcListener to construct incoming connections
 #ifdef __WINDOWS__
-	IpcConnection(HANDLE s,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
+	IpcConnection(HANDLE s,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
 #else
-	IpcConnection(int s,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
+	IpcConnection(int s,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
 #endif

 	void (*_handler)(void *,IpcConnection *,IpcConnection::EventType,const char *);
 	void *_arg;
+	unsigned int _timeout;
 #ifdef __WINDOWS__
 	HANDLE _sock;
 	std::string _writeBuf;
@@ -42,10 +42,11 @@

 namespace ZeroTier {

-IpcListener::IpcListener(const char *ep,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
+IpcListener::IpcListener(const char *ep,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg) :
 	_endpoint(ep),
 	_handler(commandHandler),
 	_arg(arg),
+	_timeout(timeout),
 #ifdef __WINDOWS__
 	_run(true),
 	_running(true)
@@ -130,7 +131,7 @@ void IpcListener::threadMain()
 					break;
 				}
 				try {
-					_handler(_arg,new IpcConnection(s,_handler,_arg),IpcConnection::IPC_EVENT_NEW_CONNECTION,(const char *)0);
+					_handler(_arg,new IpcConnection(s,_timeout,_handler,_arg),IpcConnection::IPC_EVENT_NEW_CONNECTION,(const char *)0);
 				} catch ( ... ) {} // handlers should not throw
 			} else {
 				CloseHandle(s);
@@ -155,7 +156,7 @@ void IpcListener::threadMain()
 			break;
 		}
 		try {
-			_handler(_arg,new IpcConnection(s,_handler,_arg),IpcConnection::IPC_EVENT_NEW_CONNECTION,(const char *)0);
+			_handler(_arg,new IpcConnection(s,_timeout,_handler,_arg),IpcConnection::IPC_EVENT_NEW_CONNECTION,(const char *)0);
 		} catch ( ... ) {} // handlers should not throw
 	}
 #endif
@@ -28,22 +28,14 @@
 #ifndef ZT_IPCLISTENER_HPP
 #define ZT_IPCLISTENER_HPP

-#include "Constants.hpp"
-#include "Thread.hpp"
-#include "NonCopyable.hpp"
+#include "../node/Constants.hpp"
+#include "../node/Thread.hpp"
+#include "../node/NonCopyable.hpp"
 #include "IpcConnection.hpp"

 #include <string>
 #include <stdexcept>

-#ifdef __WINDOWS__
-#include <WinSock2.h>
-#include <Windows.h>
-#define ZT_IPC_ENDPOINT_BASE "\\\\.\\pipe\\ZeroTierOne-"
-#else
-#define ZT_IPC_ENDPOINT_BASE "/tmp/.ZeroTierOne-"
-#endif
-
 namespace ZeroTier {

 /**
@@ -58,7 +50,7 @@ public:
 	 * The supplied handler is passed on to incoming instances of IpcConnection. When
 	 * a connection is first opened, it is called with IPC_EVENT_NEW_CONNECTION. The
 	 * receiver must take ownership of the connection object. When a connection is
-	 * closed, IPC_EVENT_CONNECTION_CLOSING is generated. At this point (or after) the
+	 * closed, IPC_EVENT_CONNECTION_CLOSED is generated. At this point (or after) the
 	 * receiver must delete the object. IPC_EVENT_COMMAND is generated when lines of
 	 * text are read, and in this cases the last argument is not NULL. No closed event
 	 * is generated in the event of manual delete if the connection is still open.
@@ -67,11 +59,13 @@ public:
 	 * some kind of actor model or something if it gets too unweildy. But for now the
 	 * use cases are simple enough that it's not too bad.
 	 *
+	 * @param IPC endpoint name (OS-specific)
+	 * @param timeout Endpoint inactivity timeout in seconds
 	 * @param commandHandler Function to call for each command
 	 * @param arg First argument to pass to handler
 	 * @throws std::runtime_error Unable to bind to endpoint
 	 */
-	IpcListener(const char *ep,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);
+	IpcListener(const char *ep,unsigned int timeout,void (*commandHandler)(void *,IpcConnection *,IpcConnection::EventType,const char *),void *arg);

 	~IpcListener();

@@ -82,6 +76,7 @@ private:
 	std::string _endpoint;
 	void (*_handler)(void *,IpcConnection *,IpcConnection::EventType,const char *);
 	void *_arg;
+	unsigned int _timeout;
 #ifdef __WINDOWS__
 	volatile bool _run;
 	volatile bool _running;
@@ -0,0 +1,167 @@
+/*
+ * ZeroTier One - Global Peer to Peer Ethernet
+ * Copyright (C) 2011-2014  ZeroTier Networks LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#include "NodeControlClient.hpp"
+#include "../node/Constants.hpp"
+#include "../node/Utils.hpp"
+#include "../node/Defaults.hpp"
+#include "IpcConnection.hpp"
+#include "IpcListener.hpp"
+#include "NodeControlService.hpp"
+
+#ifdef __WINDOWS__
+#include <WinSock2.h>
+#include <Windows.h>
+#include <tchar.h>
+#include <wchar.h>
+#include <ShlObj.h>
+#endif // __WINDOWS__
+
+namespace ZeroTier {
+
+struct _NodeControlClientImpl
+{
+	void (*resultHandler)(void *,const char *);
+	void *arg;
+	bool ignoreNextBreak;
+	IpcConnection *ipcc;
+	std::string err;
+};
+
+static void _CBipcResultHandler(void *arg,IpcConnection *ipcc,IpcConnection::EventType event,const char *result)
+{
+	if ((event == IpcConnection::IPC_EVENT_COMMAND)&&(result)) {
+		if (!strcmp(result,"200 auth OK")) {
+			((_NodeControlClientImpl *)arg)->ignoreNextBreak = true;
+		} else if ((((_NodeControlClientImpl *)arg)->ignoreNextBreak)&&(!strcmp(result,"."))) {
+			((_NodeControlClientImpl *)arg)->ignoreNextBreak = false;
+		} else ((_NodeControlClientImpl *)arg)->resultHandler(((_NodeControlClientImpl *)arg)->arg,result);
+	}
+}
+
+NodeControlClient::NodeControlClient(const char *ep,const char *authToken,void (*resultHandler)(void *,const char *),void *arg)
+	throw() :
+	_impl((void *)new _NodeControlClientImpl)
+{
+	_NodeControlClientImpl *impl = (_NodeControlClientImpl *)_impl;
+	impl->resultHandler = resultHandler;
+	impl->arg = arg;
+	impl->ignoreNextBreak = false;
+	try {
+		impl->ipcc = new IpcConnection(ep,ZT_IPC_TIMEOUT,&_CBipcResultHandler,_impl);
+		impl->ipcc->printf("auth %s"ZT_EOL_S,authToken);
+	} catch ( ... ) {
+		impl->ipcc = (IpcConnection *)0;
+		impl->err = "failure connecting to running ZeroTier One service";
+	}
+}
+
+NodeControlClient::~NodeControlClient()
+{
+	if (_impl) {
+		delete ((_NodeControlClientImpl *)_impl)->ipcc;
+		delete (_NodeControlClientImpl *)_impl;
+	}
+}
+
+const char *NodeControlClient::error() const
+	throw()
+{
+	if (((_NodeControlClientImpl *)_impl)->err.length())
+		return ((_NodeControlClientImpl *)_impl)->err.c_str();
+	return (const char *)0;
+}
+
+void NodeControlClient::send(const char *command)
+	throw()
+{
+	try {
+		if (((_NodeControlClientImpl *)_impl)->ipcc)
+			((_NodeControlClientImpl *)_impl)->ipcc->printf("%s"ZT_EOL_S,command);
+	} catch ( ... ) {}
+}
+
+std::vector<std::string> NodeControlClient::splitLine(const char *line)
+{
+	return Utils::split(line," ","\\","\"");
+}
+
+const char *NodeControlClient::authTokenDefaultUserPath()
+{
+	static std::string dlp;
+	static Mutex dlp_m;
+
+	Mutex::Lock _l(dlp_m);
+
+#ifdef __WINDOWS__
+
+	if (!dlp.length()) {
+		char buf[16384];
+		if (SUCCEEDED(SHGetFolderPathA(NULL,CSIDL_APPDATA,NULL,0,buf)))
+			dlp = (std::string(buf) + "\\ZeroTier\\One\\authtoken.secret");
+	}
+
+#else // not __WINDOWS__
+
+	if (!dlp.length()) {
+		const char *home = getenv("HOME");
+		if (home) {
+#ifdef __APPLE__
+			dlp = (std::string(home) + "/Library/Application Support/ZeroTier/One/authtoken.secret");
+#else
+			dlp = (std::string(home) + "/.zeroTierOneAuthToken");
+#endif
+		}
+	}
+
+#endif // __WINDOWS__ or not __WINDOWS__
+
+	return dlp.c_str();
+}
+
+std::string NodeControlClient::getAuthToken(const char *path,bool generateIfNotFound)
+{
+	unsigned char randbuf[24];
+	std::string token;
+
+	if (Utils::readFile(path,token))
+		return Utils::trim(token);
+	else token = "";
+
+	if (generateIfNotFound) {
+		Utils::getSecureRandom(randbuf,sizeof(randbuf));
+		for(unsigned int i=0;i<sizeof(randbuf);++i)
+			token.push_back(("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")[(unsigned int)randbuf[i] % 62]);
+		if (!Utils::writeFile(path,token))
+			return std::string();
+		Utils::lockDownFile(path,false);
+	}
+
+	return token;
+}
+
+} // namespace ZeroTier
@@ -0,0 +1,118 @@
+/*
+ * ZeroTier One - Global Peer to Peer Ethernet
+ * Copyright (C) 2011-2014  ZeroTier Networks LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#ifndef ZT_NODECONTROLCLIENT_HPP
+#define ZT_NODECONTROLCLIENT_HPP
+
+#include <string>
+#include <vector>
+
+#include "../node/Constants.hpp"
+
+#ifdef __WINDOWS__
+#define ZT_IPC_ENDPOINT_BASE "\\\\.\\pipe\\ZeroTierOne-"
+#else
+#define ZT_IPC_ENDPOINT_BASE "/tmp/.ZeroTierOne-"
+#endif
+
+namespace ZeroTier {
+
+/**
+ * Client for controlling a local ZeroTier One node
+ */
+class NodeControlClient
+{
+public:
+	/**
+	 * Create a new node config client
+	 *
+	 * Initialization may fail. Call error() to check.
+	 *
+	 * @param ep Endpoint to connect to (OS-dependent)
+	 * @param resultHandler Function to call when commands provide results
+	 * @param arg First argument to result handler
+	 */
+	NodeControlClient(const char *ep,const char *authToken,void (*resultHandler)(void *,const char *),void *arg)
+		throw();
+
+	~NodeControlClient();
+
+	/**
+	 * @return Initialization error or NULL if none
+	 */
+	const char *error() const
+		throw();
+
+	/**
+	 * Send a command to the local node
+	 *
+	 * Note that the returned conversation ID will never be 0. A return value
+	 * of 0 indicates a fatal error such as failure to bind to any local UDP
+	 * port.
+	 *
+	 * @param command
+	 * @return Conversation ID that will be provided to result handler when/if results are sent back
+	 */
+	void send(const char *command)
+		throw();
+	inline void send(const std::string &command)
+		throw() { return send(command.c_str()); }
+
+	/**
+	 * Split a line of results
+	 *
+	 * @param line Line to split
+	 * @return Vector of fields
+	 */
+	static std::vector<std::string> splitLine(const char *line);
+	static inline std::vector<std::string> splitLine(const std::string &line) { return splitLine(line.c_str()); }
+
+	/**
+	 * @return Default path for current user's authtoken.secret or ~/.zeroTierOneAuthToken (location is platform-dependent)
+	 */
+	static const char *authTokenDefaultUserPath();
+
+	/**
+	 * Load (or generate) the authentication token
+	 *
+	 * @param path Full path to authtoken.secret
+	 * @param generateIfNotFound If true, generate and save if not found or readable (requires appropriate privileges, returns empty on failure)
+	 * @return Authentication token or empty string on failure
+	 */
+	static std::string getAuthToken(const char *path,bool generateIfNotFound);
+
+private:
+	// NodeControlClient is not copyable
+	NodeControlClient(const NodeControlClient&);
+	const NodeControlClient& operator=(const NodeControlClient&);
+
+	void *_impl;
+};
+
+} // namespace ZeroTier
+
+#endif
@@ -0,0 +1,250 @@
+/*
+ * ZeroTier One - Global Peer to Peer Ethernet
+ * Copyright (C) 2011-2014  ZeroTier Networks LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "NodeControlService.hpp"
+#include "NodeControlClient.hpp"
+
+#include "../node/Constants.hpp"
+#include "../node/MAC.hpp"
+#include "../node/Node.hpp"
+#include "../node/Utils.hpp"
+
+namespace ZeroTier {
+
+NodeControlService::NodeControlService(Node *node,const char *authToken) :
+	_node(node),
+	_listener((IpcListener *)0),
+	_authToken(authToken),
+	_running(true),
+	_thread(Thread::start(this))
+{
+}
+
+NodeControlService::~NodeControlService()
+{
+	_running = false;
+	Thread::join(_thread);
+	{
+		Mutex::Lock _l(_connections_m);
+		for(std::map< IpcConnection *,bool >::iterator c(_connections.begin());c!=_connections.end();++c)
+			delete c->first;
+		_connections.clear();
+	}
+	delete _listener;
+}
+
+void NodeControlService::threadMain()
+	throw()
+{
+	char tmp[1024];
+	try {
+		while (_running) {
+			if (!_node->running()) {
+				if (_node->started())
+					break;
+			} else if ((_node->initialized())&&(_node->address())) {
+				Utils::snprintf(tmp,sizeof(tmp),"%s%.10llx",ZT_IPC_ENDPOINT_BASE,(unsigned long long)_node->address());
+				_listener = new IpcListener(tmp,ZT_IPC_TIMEOUT,&_CBcommandHandler,this);
+				break;
+			}
+			Thread::sleep(100); // wait for Node to start
+		}
+	} catch ( ... ) {
+		delete _listener;
+		_listener = (IpcListener *)0;
+	}
+}
+
+void NodeControlService::_CBcommandHandler(void *arg,IpcConnection *ipcc,IpcConnection::EventType event,const char *commandLine)
+{
+	switch(event) {
+		case IpcConnection::IPC_EVENT_COMMAND: {
+			if ((!((NodeControlService *)arg)->_running)||(!commandLine)||(!commandLine[0]))
+				return;
+			((NodeControlService *)arg)->_doCommand(ipcc,commandLine);
+		}	break;
+
+		case IpcConnection::IPC_EVENT_NEW_CONNECTION: {
+			Mutex::Lock _l(((NodeControlService *)arg)->_connections_m);
+			((NodeControlService *)arg)->_connections[ipcc] = false; // not yet authenticated
+		}	break;
+
+		case IpcConnection::IPC_EVENT_CONNECTION_CLOSED: {
+			Mutex::Lock _l(((NodeControlService *)arg)->_connections_m);
+			((NodeControlService *)arg)->_connections.erase(ipcc);
+			delete ipcc;
+		}	break;
+	}
+}
+
+void NodeControlService::_doCommand(IpcConnection *ipcc,const char *commandLine)
+{
+	std::vector<std::string> r;
+	std::vector<std::string> cmd(Utils::split(commandLine,"\r\n \t","\\","'"));
+
+	if ((cmd.empty())||(cmd[0] == "help")) {
+		ipcc->printf("200 help help"ZT_EOL_S);
+		ipcc->printf("200 help auth <token>"ZT_EOL_S);
+		ipcc->printf("200 help info"ZT_EOL_S);
+		ipcc->printf("200 help listpeers"ZT_EOL_S);
+		ipcc->printf("200 help listnetworks"ZT_EOL_S);
+		ipcc->printf("200 help join <network ID>"ZT_EOL_S);
+		ipcc->printf("200 help leave <network ID>"ZT_EOL_S);
+		ipcc->printf("200 help terminate [<reason>]"ZT_EOL_S);
+		ipcc->printf("200 help updatecheck"ZT_EOL_S);
+	} else if (cmd[0] == "auth") {
+		if ((cmd.size() > 1)&&(_authToken.length() > 0)&&(_authToken == cmd[1])) {
+			Mutex::Lock _l(_connections_m);
+			_connections[ipcc] = true;
+			ipcc->printf("200 auth OK"ZT_EOL_S);
+		} else ipcc->printf("403 auth failed"ZT_EOL_S);
+	} else {
+		{
+			Mutex::Lock _l(_connections_m);
+			if (!_connections[ipcc]) {
+				ipcc->printf("403 %s unauthorized"ZT_EOL_S"."ZT_EOL_S,cmd[0].c_str());
+				return;
+			}
+		}
+
+		if (cmd[0] == "info") {
+			ipcc->printf("200 info %.10llx %s %s"ZT_EOL_S,_node->address(),(_node->online() ? "ONLINE" : "OFFLINE"),Node::versionString());
+		} else if (cmd[0] == "listpeers") {
+			ipcc->printf("200 listpeers <ztaddr> <paths> <latency> <version> <role>"ZT_EOL_S);
+			ZT1_Node_PeerList *pl = _node->listPeers();
+			if (pl) {
+				for(unsigned int i=0;i<pl->numPeers;++i) {
+					ipcc->printf("200 listpeers %.10llx ",(unsigned long long)pl->peers[i].rawAddress);
+					if (pl->peers[i].numPaths == 0)
+						ipcc->printf("-");
+					else {
+						for(unsigned int j=0;j<pl->peers[i].numPaths;++j) {
+							if (j > 0)
+								ipcc->printf(",");
+							switch(pl->peers[i].paths[j].type) {
+								default:
+									ipcc->printf("unknown;");
+									break;
+								case ZT1_Node_PhysicalPath_TYPE_UDP:
+									ipcc->printf("udp;");
+									break;
+								case ZT1_Node_PhysicalPath_TYPE_TCP_OUT:
+									ipcc->printf("tcp_out;");
+									break;
+								case ZT1_Node_PhysicalPath_TYPE_TCP_IN:
+									ipcc->printf("tcp_in;");
+									break;
+								case ZT1_Node_PhysicalPath_TYPE_ETHERNET:
+									ipcc->printf("eth;");
+									break;
+							}
+							ipcc->printf("%s/%d;%ld;%ld;%ld;%s",
+								pl->peers[i].paths[j].address.ascii,
+								(int)pl->peers[i].paths[j].address.port,
+								pl->peers[i].paths[j].lastSend,
+								pl->peers[i].paths[j].lastReceive,
+								pl->peers[i].paths[j].lastPing,
+								(pl->peers[i].paths[j].fixed ? "fixed" : (pl->peers[i].paths[j].active ? "active" : "inactive")));
+						}
+					}
+					const char *rolestr;
+					switch(pl->peers[i].role) {
+						case ZT1_Node_Peer_SUPERNODE: rolestr = "SUPERNODE"; break;
+						case ZT1_Node_Peer_HUB: rolestr = "HUB"; break;
+						case ZT1_Node_Peer_NODE: rolestr = "NODE"; break;
+						default: rolestr = "?"; break;
+					}
+					ipcc->printf(" %u %s %s"ZT_EOL_S,
+						pl->peers[i].latency,
+						((pl->peers[i].remoteVersion[0]) ? pl->peers[i].remoteVersion : "-"),
+						rolestr);
+				}
+				_node->freeQueryResult(pl);
+			}
+		} else if (cmd[0] == "listnetworks") {
+			ipcc->printf("200 listnetworks <nwid> <name> <mac> <status> <config age> <type> <dev> <ips>"ZT_EOL_S);
+			ZT1_Node_NetworkList *nl = _node->listNetworks();
+			if (nl) {
+				for(unsigned int i=0;i<nl->numNetworks;++i) {
+					ipcc->printf("200 listnetworks %s %s %s %s %ld %s %s ",
+						nl->networks[i].nwidHex,
+						nl->networks[i].name,
+						nl->networks[i].macStr,
+						nl->networks[i].statusStr,
+						nl->networks[i].configAge,
+						(nl->networks[i].isPrivate ? "private" : "public"),
+						nl->networks[i].device);
+					if (nl->networks[i].numIps > 0) {
+						for(unsigned int j=0;j<nl->networks[i].numIps;++j) {
+							if (j > 0)
+								ipcc->printf(",");
+							ipcc->printf("%s/%d",nl->networks[i].ips[j].ascii,(int)nl->networks[i].ips[j].port);
+						}
+					} else ipcc->printf("-");
+					ipcc->printf(ZT_EOL_S);
+				}
+				_node->freeQueryResult(nl);
+			}
+		} else if (cmd[0] == "join") {
+			if (cmd.size() > 1) {
+				uint64_t nwid = Utils::hexStrToU64(cmd[1].c_str());
+				_node->join(nwid);
+				ipcc->printf("200 join %.16llx OK"ZT_EOL_S,(unsigned long long)nwid);
+			} else {
+				ipcc->printf("400 join requires a network ID (>0) in hexadecimal format"ZT_EOL_S);
+			}
+		} else if (cmd[0] == "leave") {
+			if (cmd.size() > 1) {
+				uint64_t nwid = Utils::hexStrToU64(cmd[1].c_str());
+				_node->leave(nwid);
+				ipcc->printf("200 leave %.16llx OK"ZT_EOL_S,(unsigned long long)nwid);
+			} else {
+				ipcc->printf("400 leave requires a network ID (>0) in hexadecimal format"ZT_EOL_S);
+			}
+		} else if (cmd[0] == "terminate") {
+			if (cmd.size() > 1)
+				_node->terminate(Node::NODE_NORMAL_TERMINATION,cmd[1].c_str());
+			else _node->terminate(Node::NODE_NORMAL_TERMINATION,"terminate via IPC command");
+		} else if (cmd[0] == "updatecheck") {
+			if (_node->updateCheck()) {
+				ipcc->printf("500 software updates are not enabled"ZT_EOL_S);
+			} else {
+				ipcc->printf("200 OK"ZT_EOL_S);
+			}
+		} else {
+			ipcc->printf("404 %s No such command. Use 'help' for help."ZT_EOL_S,cmd[0].c_str());
+		}
+	}
+
+	ipcc->printf("."ZT_EOL_S);
+}
+
+} // namespace ZeroTier
@@ -0,0 +1,84 @@
+/*
+ * ZeroTier One - Global Peer to Peer Ethernet
+ * Copyright (C) 2011-2014  ZeroTier Networks LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#ifndef ZT_NODECONTROLSERVICE_HPP
+#define ZT_NODECONTROLSERVICE_HPP
+
+#include <string>
+#include <map>
+
+#include "IpcConnection.hpp"
+#include "IpcListener.hpp"
+
+#include "../node/Constants.hpp"
+#include "../node/NonCopyable.hpp"
+#include "../node/Thread.hpp"
+
+namespace ZeroTier {
+
+class Node;
+
+/**
+ * Background controller service that controls and configures a node
+ *
+ * This is used with system-installed instances of ZeroTier One to
+ * provide the IPC-based control bus service for node configuration.
+ */
+class NodeControlService : NonCopyable
+{
+public:
+	/**
+	 * @param node Node to control and configure
+	 * @param authToken Authorization token for clients
+	 */
+	NodeControlService(Node *node,const char *authToken);
+
+	~NodeControlService();
+
+	// Background thread waits for node to initialize, then creates IpcListener and
+	// terminates. It also terminates on delete if it hasn't bootstrapped yet.
+	void threadMain()
+		throw();
+
+private:
+	static void _CBcommandHandler(void *arg,IpcConnection *ipcc,IpcConnection::EventType event,const char *commandLine);
+	void _doCommand(IpcConnection *ipcc,const char *commandLine);
+
+	Node *_node;
+	IpcListener *_listener;
+	std::string _authToken;
+
+	std::map< IpcConnection *,bool > _connections;
+	Mutex _connections_m;
+
+	volatile bool _running;
+	Thread _thread;
+};
+
+} // namespace ZeroTier
+
+#endif
@@ -0,0 +1,4 @@
+ZeroTier Control Plane
+======
+
+This code is responsible for the local command bus used to control the ZeroTier One service on a local machine via zerotier-cli or the Qt GUI. It's not part of the core node implementation. It uses Unix domain sockets on unix-like OSes and named pipes on Windows. Authentication is via a simple token mechanism. (Eventually this part of the software is getting a rework.)