VERSION 1.1.0: Win/Mac UI improvements, improved NAT-t, CIRCUIT_TEST, and more!

ZeroTier 1.1.0 introduces a number of fixes and improvements in several areas. We incremented the secondary version to indicate the significance of this release. Version numbering has been a bit ad-hoc in the past. In future versions we will adopt the following scheme: odd-numbered revision numbers like 1.1.1 will indicate development versions, while even numbered ones like 1.1.2 will indicate tagged releases. The public git repo branching has also been revised: master will always be the latest tagged release, dev will be usually-working development, and edge will host maybe-broken "bleeding edge" development. Pull requests on GitHub should generally be made against dev, not master or edge. Other branches that may appear from time to time may be feature or experimental branches. Only master is confirmed good, with dev usually being okay but not guaranteed to be such. (To the extent that any software is ever guaranteed to be anything.) Change summary: User-facing changes and improvements: - Windows now has a new .NET-based native UI, which replaces the old WebControl wrapper around the React UI. This just didn't work well on older Windows systems, and we did not want to bundle 40+ megabytes of web browser with our app just for its very simple UI. - The web UI (still used for Mac and usable in Linux as well) is updated with improved look and simplifications. - Both UIs no longer have the "Peers" tab, since several users reported that non- technical users found this confusing and even alarming (does this mean people can access my system?). This information is visibile with "listpeers" from the command line (zerotier-cli). New features: - Virtual networks that use our RFC4193-based IPv6 numbering scheme now emulate IPv6 NDP for queries that target these addresses within the same network. This allows for faster multicast-free connection init and improved security since the address is now hard-wired to the device ID (which is a crypto token). This does not affect IPv6 NDP for other IPv6 addresses or link-local, which will continue to work normally. This also opens the potential for a reduced footprint multicast-free build for embedded applications. - This version includes beta support for a feature called CIRCUIT_TEST. Network controllers for networks you have joined can now send a special message called CIRCUIT_TEST which allows for ZeroTier-layer link testing and remote diagnosis of link issues. Any operator of a network controller can do this; more documentation will be forthcoming. The only information that may be gathered in this way is IP addressing info and very basic system info (OS, 32/64 bit, ZeroTier version). No personal information, hard drive data, location, or other private info is available. This can only be ordered by a controller of a network you have joined and is secured using cryptographic signatures. - This version includes an alpha version of clustering a.k.a. multi-homing! This powerful feature allows for a single ZeroTier device to be run from multiple endpoints, with connecting peers being handed off to endpoints that are closer via GeoIP lookup and/or are more lightly loaded. Currently this is only suitable for use in our soon-to-be-upgraded root server infrastructure (details will be blogged soon), but in the future it will be capable of hosting multi-homed devices on user networks. This will allow things like (for example) a geo- clustered Cassandra server that appears behind a single IP on a virtual LAN. This feature must be enabled with the ZT_ENABLE_CLUSTER=1 build option. Bug fixes and other improvements (including performance!): - A faster version of the Poly1305 cryptographic MAC function was substituted for sometimes greatly improved performance. - C++ STL std::map was replaced throughout the entire core with a hand-rolled Hashtable implementation for improved performance and in some cases a reduced memory footprint. Some maps are still used in peripheral code that is not performance critical or where ordered keys are needed. - The zerotier-cli and zerotier-idtool symbolic links are now created in /usr/local/bin on OSX to comply with El Capitan file security restrictions. - The OSX tap device driver has been updated. This update may fix issues that some users have reported with bridging on OSX. This new tap device driver drops 32-bit support, but if you have a 32-bit system you can manually install the old driver from ext/bin/tap-mac. - Mac users could experience a problem with the UI if they installed ZeroTier, then uninstalled it, then installed again. This is now fixed. - UPnP port mappings should work better on some routers, and a different local port is now used for UPnP mapped traffic vs. NAT-t'd traffic to get around a bug in several popular mid-tier routers where using UPnP mapping alongside traditional NAT traversal made a port unreachable. - Debian package now builds with the right arch label on armv7l systems (Pi 2) - The old "root topology" has been replaced with a similar but better thought out concept called a World. The World defines the root servers and possibly in the future other things, and can be updated in-band from trusted peers allowing for software-upgrade-free network upgrades to keep up with growing demand. See node/World.hpp for details. - A fix was made to "self-awareness," which keeps track of your external IP info and adapts to changes, to eliminate a problem that could cause "link thrashing" behind some symmetric NATs. - Escalating UDP TTLs was re-introduced to better transit some port-restricted cone NATs such as Linux IP MASQ (used for Docker). - An otherwise harmless crash-on-exit bug in the network controller was fixed. - All new direct links are now confirmed in both directions. This adds a very small amount of initial HELLO/OK traffic but fixes some edge cases where an incomplete or unidirectional path might be used. - [SECURITY] Better rate limiting was put in place for VERB_PUSH_DIRECT_PATHS to prevent potential abuse for amplification attacks. - [SECURITY] Build flags were tweaked on OSX to ensure that all code including dependency libraries are built with full stack canary protection and ASLR support. Visit https://www.zerotier.com/blog or follow @ZeroTier on Twitter for updates and announcements!
Just add a launch prerequisite for .NET 4.5 -- it's usually there, and if not it can be easily installed. This is mostly an issue on old Windows Server systems, and in that case the admin will likely want to decide how to proceed.
2026-09-22 15:29:03 -07:00 · 2015-11-17 12:18:45 -08:00 · 2015-11-17 11:13:44 -08:00 · 2015-11-17 09:56:19 -08:00 · 2015-11-16 19:54:58 -08:00 · 2015-11-16 19:27:36 -08:00
338 changed files with 27809 additions and 16778 deletions
@@ -29,8 +29,12 @@ Thumbs.db
 # *nix/Mac build droppings
 /build-*
 /ZeroTierOneInstaller-*
+/examples/docker/zerotier-one
+/examples/docker/test-*.env
+/world/mkworld
+/world/*.c25519

-# Miscellaneous file types that we don't want to check in
+# Miscellaneous temporaries, build files, etc.
 *.log
 *.opensdf
 *.user
@@ -40,28 +44,26 @@ Thumbs.db
 *.pid
 *.pkg
 *.o
+*.a
+*.dylib
+*.so
+*.o-*
 *.core
 *.deb
 *.rpm
 *.autosave
 *.tmp
-
-# Root topology build files, temporaries, and never check in secrets
-/root-topology/bin2c
-/root-topology/mktopology
-/root-topology/*.secret
-/root-topology/test/supernodes
-/root-topology/test/test-root-topology
+node_modules
+cluster-geo/cluster-geo/config.js
+cluster-geo/cluster-geo/cache.*
+tests/http/zerotier-one
+tests/http/big-test-hosts

 # MacGap wrapper build files
 /ext/mac-ui-macgap1-wrapper/src/MacGap.xcodeproj/project.xcworkspace/xcuserdata/*
 /ext/mac-ui-macgap1-wrapper/src/MacGap.xcodeproj/xcuserdata/*
 /ext/mac-ui-macgap1-wrapper/src/build

-# Web UI dev temporaries
-/ui/.module-cache
-node_modules
-
 # Java/Android/JNI build droppings
 java/obj/
 java/libs/
@@ -71,3 +73,6 @@ java/doc/
 java/build_win64/
 java/build_win32/
 /java/mac32_64/
+windows/WinUI/obj/
+windows/WinUI/bin/
+windows/ZeroTierOne/Debug/
@@ -116,7 +116,7 @@ On Mac the best way is to install [Packages](http://s.sudre.free.fr/Software/Pac

 This builds a .pkg file that can be installed.

-BSD has no installer yet. We're working on it.
+In FreeBSD there is now an official .pkg in the FreeBSD repository. Type "pkg install zerotier". It can also be built and installed from source.

 Linux/BSD and Mac installations have an *uninstall.sh* file in their ZeroTier home folder that cleanly removes ZeroTier One from the system. Run this with:

@@ -166,6 +166,10 @@ If you're interested, there's a [technical deep dive about NAT traversal on our

 If a firewall between you and the Internet blocks ZeroTier's UDP traffic, you will fall back to last-resort TCP tunneling to rootservers over port 443 (https impersonation). This will work almost anywhere but is *very slow* compared to UDP or direct peer to peer connectivity.

+### Contributing
+
+There are three main branches: **edge**, **test**, and **master**. Other branches may be for specific features, tests, or use cases. In general **edge** is "bleeding" and may or may not work, while **test** should be relatively stable and **master** is the latest tagged release. Pull requests should generally be done against **test** or **edge**, since pull requests against **master** may be working against a branch that is somewhat out of date.
+
 ### License

 The ZeroTier source code is open source and is licensed under the GNU GPL v3 (not LGPL). If you'd like to embed it in a closed-source commercial product or appliance, please e-mail [contact@zerotier.com](mailto:contact@zerotier.com) to discuss commercial licensing. Otherwise it can be used for free.
@@ -0,0 +1,96 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2015  ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#ifndef ZT_OSXETHERNETTAP_HPP
+#define ZT_OSXETHERNETTAP_HPP
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#include "../node/Constants.hpp"
+#include "../node/MAC.hpp"
+#include "../node/InetAddress.hpp"
+#include "../node/MulticastGroup.hpp"
+
+#include "Thread.hpp"
+
+namespace ZeroTier {
+
+/**
+ * OSX Ethernet tap using ZeroTier kernel extension zt# devices
+ */
+class OSXEthernetTap
+{
+public:
+	OSXEthernetTap(
+		const char *homePath,
+		const MAC &mac,
+		unsigned int mtu,
+		unsigned int metric,
+		uint64_t nwid,
+		const char *friendlyName,
+		void (*handler)(void *,uint64_t,const MAC &,const MAC &,unsigned int,unsigned int,const void *,unsigned int),
+		void *arg);
+
+	~OSXEthernetTap();
+
+	inline void setEnabled(bool en) { _enabled = en; }
+	inline bool enabled() const { return _enabled; }
+	bool addIp(const InetAddress &ip);
+	bool removeIp(const InetAddress &ip);
+	std::vector<InetAddress> ips() const;
+	void put(const MAC &from,const MAC &to,unsigned int etherType,const void *data,unsigned int len);
+	std::string deviceName() const;
+	void setFriendlyName(const char *friendlyName);
+	void scanMulticastGroups(std::vector<MulticastGroup> &added,std::vector<MulticastGroup> &removed);
+
+	void threadMain()
+		throw();
+
+	// Private members of OSXEthernetTap have public visibility to be accessable
+	// from an internal bounce function; don't modify directly.
+	void (*_handler)(void *,uint64_t,const MAC &,const MAC &,unsigned int,unsigned int,const void *,unsigned int);
+	void *_arg;
+	void *_pcap; // pcap_t *
+	uint64_t _nwid;
+	MAC _mac;
+	Thread _thread;
+	std::string _homePath;
+	std::string _dev;
+	std::vector<MulticastGroup> _multicastGroups;
+	unsigned int _mtu;
+	unsigned int _metric;
+	volatile bool _enabled;
+};
+
+} // namespace ZeroTier
+
+#endif
@@ -0,0 +1,101 @@
+/*
+ * ZeroTier One - Network Virtualization Everywhere
+ * Copyright (C) 2011-2015  ZeroTier, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#ifndef ZT_OSXETHERNETTAP_HPP
+#define ZT_OSXETHERNETTAP_HPP
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#include "../node/Constants.hpp"
+#include "../node/MAC.hpp"
+#include "../node/InetAddress.hpp"
+#include "../node/MulticastGroup.hpp"
+
+#include "Thread.hpp"
+
+namespace ZeroTier {
+
+class Arp;
+
+/**
+ * OSX Ethernet tap supporting either ZeroTier tun/tap kext or OSX-native utun
+ */
+class OSXEthernetTap
+{
+public:
+	OSXEthernetTap(
+		const char *homePath,
+		const MAC &mac,
+		unsigned int mtu,
+		unsigned int metric,
+		uint64_t nwid,
+		const char *friendlyName,
+		void (*handler)(void *,uint64_t,const MAC &,const MAC &,unsigned int,unsigned int,const void *,unsigned int),
+		void *arg);
+
+	~OSXEthernetTap();
+
+	void setEnabled(bool en);
+	bool enabled() const;
+	bool addIp(const InetAddress &ip);
+	bool removeIp(const InetAddress &ip);
+	std::vector<InetAddress> ips() const;
+	void put(const MAC &from,const MAC &to,unsigned int etherType,const void *data,unsigned int len);
+	std::string deviceName() const;
+	void setFriendlyName(const char *friendlyName);
+	void scanMulticastGroups(std::vector<MulticastGroup> &added,std::vector<MulticastGroup> &removed);
+
+	inline bool isNativeUtun() const { return _utun; }
+
+	void threadMain()
+		throw();
+
+private:
+	void (*_handler)(void *,uint64_t,const MAC &,const MAC &,unsigned int,unsigned int,const void *,unsigned int);
+	void *_arg;
+	Arp *_arp; // created and used if utun is enabled
+	uint64_t _nwid;
+	Thread _thread;
+	std::string _homePath;
+	std::string _dev;
+	std::vector<MulticastGroup> _multicastGroups;
+	unsigned int _mtu;
+	unsigned int _metric;
+	int _fd;
+	int _shutdownSignalPipe[2];
+	bool _utun;
+	volatile bool _enabled;
+};
+
+} // namespace ZeroTier
+
+#endif
@@ -0,0 +1,14 @@
+Cluster GeoIP Service
+======
+
+In cluster mode (build with ZT\_ENABLE\_CLUSTER and install a cluster definition file), ZeroTier One can use geographic IP lookup to steer clients toward members of a cluster that are physically closer and are therefore very likely to offer lower latency and better performance. Ordinary non-clustered ZeroTier endpoints will have no use for this code.
+
+If a cluster-mode instance detects a file in the ZeroTier home folder called *cluster-geo.exe*, it attempts to execute it. If this program runs, it receives IP addresses on STDIN and produces lines of CSV on STDOUT with the following format:
+
+    IP,result code,latitude,longitude,x,y,z
+
+The first field is the IP echoed back. The second field is 0 if the result is pending and may be ready in the future or 1 if the result is ready now. If the second field is 0 the remaining fields should be 0. Otherwise the remaining fields contain the IP's latitude, longitude, and X/Y/Z coordinates.
+
+ZeroTier's cluster route optimization code only uses the X/Y/Z values. These are computed by this cluster-geo code as the spherical coordinates of the IP address using the Earth's center as the point of origin and using an approximation of the Earth as a sphere. This doesn't yield *exact* coordinates, but it's good enough for our purposes since the goal is to route clients to the geographically closest endpoint.
+
+To install, copy *cluster-geo.exe* and the *cluster-geo/* subfolder into the ZeroTier home. Then go into *cluster-geo/* and run *npm install* to install the project's dependencies. A recent (4.x or newer) version of NodeJS is recommended. You will also need a [MaxMind GeoIP2 Precision Services](https://www.maxmind.com/) license key. The *MaxMind GeoIP2 City* tier is required since this supplies actual coordinates. It's a commercial service but is very inexpensive and offers very good accuracy for both IPv4 and IPv6 addresses. The *cluster-geo.js* program caches results in a LevelDB database for up to 120 days to reduce GeoIP API queries.
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+export PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin
+
+cd `dirname $0`
+if [ ! -d cluster-geo -o ! -f cluster-geo/cluster-geo.js ]; then
+	echo 'Cannot find ./cluster-geo containing NodeJS script files.'
+	exit 1
+fi
+
+cd cluster-geo
+
+exec node --harmony cluster-geo.js
@@ -0,0 +1,102 @@
+"use strict";
+
+//
+// GeoIP lookup service
+//
+
+// GeoIP cache TTL in ms
+var CACHE_TTL = (60 * 60 * 24 * 120 * 1000); // 120 days
+
+// Globally increase event emitter maximum listeners
+var EventEmitter = require('events');
+EventEmitter.prototype._maxListeners = 1000;
+process.setMaxListeners(1000);
+
+// Load config
+var config = require(__dirname + '/config.js');
+
+if (!config.maxmind) {
+	console.error('FATAL: only MaxMind GeoIP2 is currently supported and is not configured in config.js');
+	process.exit(1);
+}
+var geo = require('geoip2ws')(config.maxmind);
+
+var cache = require('levelup')(__dirname + '/cache.leveldb');
+
+function lookup(ip,callback)
+{
+	cache.get(ip,function(err,cachedEntryJson) {
+		if ((!err)&&(cachedEntryJson)) {
+			try {
+				let cachedEntry = JSON.parse(cachedEntryJson.toString());
+				if (cachedEntry) {
+					let ts = cachedEntry.ts;
+					let r = cachedEntry.r;
+					if ((ts)&&(r)) {
+						if ((Date.now() - ts) < CACHE_TTL) {
+							r._cached = true;
+							return callback(null,r);
+						}
+					}
+				}
+			} catch (e) {}
+		}
+
+		geo(ip,function(err,result) {
+			if (err)
+				return callback(err,null);
+			if ((!result)||(!result.location))
+				return callback(new Error('null result'),null);
+
+			cache.put(ip,JSON.stringify({
+				ts: Date.now(),
+				r: result
+			}),function(err) {
+				if (err)
+					console.error('Error saving to cache: '+err);
+				return callback(null,result);
+			});
+		});
+	});
+};
+
+var linebuf = '';
+process.stdin.on('readable',function() {
+	var chunk;
+	while (null !== (chunk = process.stdin.read())) {
+		for(var i=0;i<chunk.length;++i) {
+			let c = chunk[i];
+			if ((c == 0x0d)||(c == 0x0a)) {
+				if (linebuf.length > 0) {
+					let ip = linebuf;
+					lookup(ip,function(err,result) {
+						if ((err)||(!result)||(!result.location)) {
+							return process.stdout.write(ip+',0,0,0,0,0,0\n');
+						} else {
+							let lat = parseFloat(result.location.latitude);
+							let lon = parseFloat(result.location.longitude);
+
+							// Convert to X,Y,Z coordinates from Earth's origin, Earth-as-sphere approximation.
+							let latRadians = lat * 0.01745329251994; // PI / 180
+							let lonRadians = lon * 0.01745329251994; // PI / 180
+							let cosLat = Math.cos(latRadians);
+							let x = Math.round((-6371.0) * cosLat * Math.cos(lonRadians)); // 6371 == Earth's approximate radius in kilometers
+							let y = Math.round(6371.0 * Math.sin(latRadians));
+							let z = Math.round(6371.0 * cosLat * Math.sin(lonRadians));
+
+							return process.stdout.write(ip+',1,'+lat+','+lon+','+x+','+y+','+z+'\n');
+						}
+					});
+				}
+				linebuf = '';
+			} else {
+				linebuf += String.fromCharCode(c);
+			}
+		}
+	}
+});
+
+process.stdin.on('end',function() {
+	cache.close();
+	process.exit(0);
+});
@@ -0,0 +1,7 @@
+// MaxMind GeoIP2 config
+module.exports.maxmind = {
+	userId: 1234,
+	licenseKey: 'asdf',
+	service: 'city',
+	requestTimeout: 1000
+};
@@ -0,0 +1,16 @@
+{
+  "name": "cluster-geo",
+  "version": "1.0.0",
+  "description": "Cluster GEO-IP Query Service",
+  "main": "cluster-geo.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "ZeroTier, Inc.",
+  "license": "GPL-3.0",
+  "dependencies": {
+    "geoip2ws": "^1.7.1",
+    "leveldown": "^1.4.2",
+    "levelup": "^1.3.0"
+  }
+}
@@ -39,13 +39,22 @@
 #include "../node/Constants.hpp"
 #include "../node/NetworkController.hpp"
 #include "../node/Mutex.hpp"
+#include "../osdep/Thread.hpp"
+
+// Number of in-memory last log entries to maintain per user
+#define ZT_SQLITENETWORKCONTROLLER_IN_MEMORY_LOG_SIZE 32
+
+// How long do circuit tests "live"? This is just to prevent buildup in memory.
+#define ZT_SQLITENETWORKCONTROLLER_CIRCUIT_TEST_TIMEOUT 300000

 namespace ZeroTier {

+class Node;
+
 class SqliteNetworkController : public NetworkController
 {
 public:
-	SqliteNetworkController(const char *dbPath);
+	SqliteNetworkController(Node *node,const char *dbPath,const char *circuitTestPath);
 	virtual ~SqliteNetworkController();

 	virtual NetworkController::ResultCode doNetworkConfigRequest(
@@ -54,7 +63,6 @@ public:
 		const Identity &identity,
 		uint64_t nwid,
 		const Dictionary &metaData,
-		uint64_t haveRevision,
 		Dictionary &netconf);

 	unsigned int handleControlPlaneHttpGET(
@@ -79,6 +87,10 @@ public:
 		std::string &responseBody,
 		std::string &responseContentType);

+	// threadMain() for backup thread -- do not call directly
+	void threadMain()
+		throw();
+
 private:
 	enum IpAssignmentType {
 		// IP assignment is a static IP address
@@ -94,11 +106,54 @@ private:
 		const std::string &body,
 		std::string &responseBody,
 		std::string &responseContentType);
+	NetworkController::ResultCode _doNetworkConfigRequest(
+		const InetAddress &fromAddr,
+		const Identity &signingId,
+		const Identity &identity,
+		uint64_t nwid,
+		const Dictionary &metaData,
+		Dictionary &netconf);

+	static void _circuitTestCallback(ZT_Node *node,ZT_CircuitTest *test,const ZT_CircuitTestReport *report);
+
+	Node *_node;
+	Thread _backupThread;
+	volatile bool _backupThreadRun;
 	std::string _dbPath;
+	std::string _circuitTestPath;
 	std::string _instanceId;

-	std::map< std::pair<Address,uint64_t>,uint64_t > _lastRequestTime;
+	// A circular buffer last log
+	struct _LLEntry
+	{
+		_LLEntry()
+		{
+			for(long i=0;i<ZT_SQLITENETWORKCONTROLLER_IN_MEMORY_LOG_SIZE;++i)
+				this->l[i].ts = 0;
+			this->lastRequestTime = 0;
+			this->totalRequests = 0;
+		}
+
+		// Circular buffer of last log entries
+		struct {
+			uint64_t ts; // timestamp or 0 if circular buffer entry unused
+			char version[64];
+			InetAddress fromAddr;
+			bool authorized;
+		} l[ZT_SQLITENETWORKCONTROLLER_IN_MEMORY_LOG_SIZE];
+
+		// Time of last request whether successful or not
+		uint64_t lastRequestTime;
+
+		// Total requests by this address / network ID pair (also serves mod IN_MEMORY_LOG_SIZE as circular buffer ptr)
+		uint64_t totalRequests;
+	};
+
+	// Last log entries by address and network ID pair
+	std::map< std::pair<Address,uint64_t>,_LLEntry > _lastLog;
+
+	// Circuit tests outstanding
+	std::map< uint64_t,ZT_CircuitTest * > _circuitTests;

 	sqlite3 *_db;

@@ -106,9 +161,7 @@ private:
 	sqlite3_stmt *_sGetMember;
 	sqlite3_stmt *_sCreateMember;
 	sqlite3_stmt *_sGetNodeIdentity;
-	sqlite3_stmt *_sCreateNode;
-	sqlite3_stmt *_sUpdateNode;
-	sqlite3_stmt *_sUpdateNode2;
+	sqlite3_stmt *_sCreateOrReplaceNode;
 	sqlite3_stmt *_sGetEtherTypesFromRuleTable;
 	sqlite3_stmt *_sGetActiveBridges;
 	sqlite3_stmt *_sGetIpAssignmentsForNode;
@@ -137,6 +190,7 @@ private:
 	sqlite3_stmt *_sUpdateMemberAuthorized;
 	sqlite3_stmt *_sUpdateMemberActiveBridge;
 	sqlite3_stmt *_sDeleteMember;
+	sqlite3_stmt *_sDeleteAllNetworkMembers;
 	sqlite3_stmt *_sDeleteNetwork;
 	sqlite3_stmt *_sGetGateways;
 	sqlite3_stmt *_sDeleteGateways;
@@ -144,9 +198,6 @@ private:
 	sqlite3_stmt *_sIncrementMemberRevisionCounter;
 	sqlite3_stmt *_sGetConfig;
 	sqlite3_stmt *_sSetConfig;
-	sqlite3_stmt *_sPutLog;
-	sqlite3_stmt *_sGetMemberLog;
-	sqlite3_stmt *_sGetRecentMemberLog;

 	Mutex _lock;
 };
@@ -77,19 +77,6 @@ CREATE TABLE Member (
 CREATE INDEX Member_networkId_activeBridge ON Member(networkId, activeBridge);
 CREATE INDEX Member_networkId_memberRevision ON Member(networkId, memberRevision);

-CREATE TABLE Log (
-  networkId char(16) NOT NULL,
-  nodeId char(10) NOT NULL,
-  ts integer NOT NULL,
-  authorized integer NOT NULL,
-  authTokenId integer,
-  version varchar(16),
-  fromAddr varchar(64)
-);
-
-CREATE INDEX Log_networkId_nodeId ON Log(networkId, nodeId);
-CREATE INDEX Log_ts ON Log(ts);
-
 CREATE TABLE Relay (
  networkId char(16) NOT NULL REFERENCES Network(id) ON DELETE CASCADE,
  address char(10) NOT NULL,
@@ -78,19 +78,6 @@
 "CREATE INDEX Member_networkId_activeBridge ON Member(networkId, activeBridge);\n"\
 "CREATE INDEX Member_networkId_memberRevision ON Member(networkId, memberRevision);\n"\
 "\n"\
-"CREATE TABLE Log (\n"\
-"  networkId char(16) NOT NULL,\n"\
-"  nodeId char(10) NOT NULL,\n"\
-"  ts integer NOT NULL,\n"\
-"  authorized integer NOT NULL,\n"\
-"  authTokenId integer,\n"\
-"  version varchar(16),\n"\
-"  fromAddr varchar(64)\n"\
-");\n"\
-"\n"\
-"CREATE INDEX Log_networkId_nodeId ON Log(networkId, nodeId);\n"\
-"CREATE INDEX Log_ts ON Log(ts);\n"\
-"\n"\
 "CREATE TABLE Relay (\n"\
 "  networkId char(16) NOT NULL REFERENCES Network(id) ON DELETE CASCADE,\n"\
 "  address char(10) NOT NULL,\n"\
@@ -0,0 +1,26 @@
+API Examples
+======
+
+This folder contains examples that can be posted with curl or another http query utility to a local instance.
+
+To test querying with curl:
+
+    curl -H 'X-ZT1-Auth:AUTHTOKEN' http://127.0.0.1:9993/status
+
+To create a public network on a local controller (service must be built with "make ZT\_ENABLE\_NETWORK\_CONTROLLER=1"):
+
+    curl -H 'X-ZT1-Auth:AUTHTOKEN' -X POST -d @public.json http://127.0.0.1:9993/controller/network/################
+
+Replace AUTHTOKEN with the contents of this instance's authtoken.secret file and ################ with a valid network ID. Its first 10 hex digits must be the ZeroTier address of the controller itself, while the last 6 hex digits can be anything. Also be sure to change the port if you have this instance listening somewhere other than 9993.
+
+After POSTing you can double check the network config with:
+
+    curl -H 'X-ZT1-Auth:AUTHTOKEN' http://127.0.0.1:9993/controller/network/################
+
+Once this network is created (and if your controller is online, etc.) you can then join this network from any device anywhere in the world and it will receive a valid network configuration.
+
+---
+
+**public.json**: A valid configuration for a public network that allows IPv4 and IPv6 traffic.
+
+**circuit-test-pingpong.json**: An example circuit test that can be posted to /controller/network/################/test to order a test -- you will have to edit this to insert the hops you want since the two hard coded device IDs are from our own test instances.
@@ -0,0 +1,13 @@
+{
+	"hops": [
+		[ "4cbc810d4c" ],
+		[ "868cd1664f" ],
+		[ "4cbc810d4c" ],
+		[ "868cd1664f" ],
+		[ "4cbc810d4c" ],
+		[ "868cd1664f" ],
+		[ "4cbc810d4c" ],
+		[ "868cd1664f" ]
+	],
+	"reportAtEveryHop": true
+}
@@ -0,0 +1,27 @@
+{
+	"name": "public_test_network",
+	"private": false,
+	"enableBroadcast": true,
+	"allowPassiveBridging": false,
+	"v4AssignMode": "zt",
+	"v6AssignMode": "rfc4193",
+	"multicastLimit": 32,
+	"relays": [],
+	"gateways": [],
+	"ipLocalRoutes": ["10.66.0.0/16"],
+	"ipAssignmentPools": [{"ipRangeStart":"10.66.0.1","ipRangeEnd":"10.66.255.254"}],
+	"rules": [
+	{
+		"ruleNo": 10,
+		"etherType": 2048,
+		"action": "accept"
+	},{
+		"ruleNo": 20,
+		"etherType": 2054,
+		"action": "accept"
+	},{
+		"ruleNo": 30,
+		"etherType": 34525,
+		"action": "accept"
+	}]
+}
@@ -0,0 +1,19 @@
+FROM centos:7
+
+MAINTAINER https://www.zerotier.com/
+
+RUN yum -y update && yum install -y sqlite net-tools && yum clean all
+
+EXPOSE 9993/udp
+
+RUN mkdir -p /var/lib/zerotier-one
+RUN mkdir -p /var/lib/zerotier-one/networks.d
+RUN ln -sf /var/lib/zerotier-one/zerotier-one /usr/local/bin/zerotier-cli
+RUN ln -sf /var/lib/zerotier-one/zerotier-one /usr/local/bin/zerotier-idtool
+
+ADD zerotier-one /var/lib/zerotier-one/
+
+ADD main.sh /
+RUN chmod a+x /main.sh
+
+CMD ["./main.sh"]