Merge branch 'max-netconf-queue' into no-migrate

Helps prevent lost messages.  Commbied with a smaller limit of messages
cached in memory before processing

.clang-format

@@ -0,0 +1,74 @@
+---
+BasedOnStyle: LLVM
+BreakBeforeBraces: Stroustrup
+IndentWidth: 4
+TabWidth: 4
+AlignAfterOpenBracket: AlwaysBreak
+AlignConsecutiveMacros: "true"
+AlignConsecutiveAssignments: "false"
+AlignConsecutiveDeclarations: "false"
+AlignEscapedNewlines: Right
+AlignOperands: "true"
+AlignTrailingComments: "true"
+AllowAllArgumentsOnNextLine: "false"
+AllowAllConstructorInitializersOnNextLine: "false"
+AllowAllParametersOfDeclarationOnNextLine: "false"
+AllowShortBlocksOnASingleLine: "true"
+AllowShortCaseLabelsOnASingleLine: "false"
+AllowShortFunctionsOnASingleLine: None
+AllowShortIfStatementsOnASingleLine: Never
+AlwaysBreakAfterReturnType: None
+BinPackArguments: "true"
+BinPackParameters: OnePerLine
+BreakBeforeBinaryOperators: NonAssignment
+BreakBeforeTernaryOperators: "true"
+BreakConstructorInitializers: BeforeComma
+BreakInheritanceList: BeforeComma
+CompactNamespaces: "false"
+ConstructorInitializerAllOnOneLineOrOnePerLine: "true"
+ConstructorInitializerIndentWidth: "4"
+ContinuationIndentWidth: "4"
+Cpp11BracedListStyle: "false"
+FixNamespaceComments: "true"
+IncludeBlocks: Regroup
+IndentCaseLabels: "true"
+IndentPPDirectives: None
+IndentWrappedFunctionNames: "false"
+KeepEmptyLinesAtTheStartOfBlocks: "false"
+MaxEmptyLinesToKeep: "1"
+NamespaceIndentation: None
+PointerAlignment: Left
+ReflowComments: "true"
+SortIncludes: "true"
+SortUsingDeclarations: "true"
+SpaceAfterCStyleCast: "false"
+SpaceAfterLogicalNot: "true"
+SpaceAfterTemplateKeyword: "true"
+SpaceBeforeAssignmentOperators: "true"
+SpaceBeforeCpp11BracedList: "true"
+SpaceBeforeCtorInitializerColon: "true"
+SpaceBeforeInheritanceColon: "true"
+SpaceBeforeParens: ControlStatements
+SpaceBeforeRangeBasedForLoopColon: "true"
+SpaceInEmptyParentheses: "false"
+SpacesBeforeTrailingComments: "3"
+SpacesInAngles: "false"
+SpacesInCStyleCastParentheses: "false"
+SpacesInContainerLiterals: "true"
+SpacesInParentheses: "false"
+SpacesInSquareBrackets: "false"
+UseTab: "Always"
+
+---
+Language: Cpp
+Standard: Cpp03
+ColumnLimit: "120"
+---
+Language: ObjC
+ColumnLimit: "120"
+---
+Language: Java
+ColumnLimit: "120"
+---
+Language: CSharp
+ColumnLimit: "120"

.clangd

@@ -0,0 +1,11 @@
+CompileFlags:
+  Add:
+    - "-std=c++17"
+    - "-I../ext"
+    - "-I../ext/prometheus-cpp-lite-1.0/core/include"
+    - "-I../ext/prometheus-cpp-lite-1.0/simpleapi/include"
+    - "-I../ext/opentelemetry-cpp-1.21.0/api/include"
+    - "-I./ext"
+    - "-I./ext/prometheus-cpp-lite-1.0/core/include"
+    - "-I./ext/prometheus-cpp-lite-1.0/simpleapi/include"
+    - "-I./ext/opentelemetry-cpp-1.21.0/api/include"

.dockerignore

@@ -0,0 +1,12 @@
+.git/
+workspace/
+# Local from-source dependency builds (scripts/bootstrap-deps.sh) and CMake output;
+# never ship these into an image -- they are host-specific and large.
+.deps/
+.deps-build/
+build/
+build-*/
+out/
+# Dockerfiles are supplied via -f; keeping them out of the context means editing
+# them does not invalidate the COPY layers (and the heavy build cache).
+ext/central-controller-docker/Dockerfile*

.gitattributes

@@ -0,0 +1,4 @@
+ext/bin/tap-windows-ndis6/x64/zttap300.inf eol=crlf
+ext/bin/tap-windows-ndis6/x64.old/zttap300.inf eol=crlf
+ext/bin/tap-windows-ndis6/x86/zttap300.inf eol=crlf
+windows/TapDriver6/zttap300.inf eol=crlf

.github/ISSUE_TEMPLATE/bugs-and-issues.md

@@ -0,0 +1,31 @@
+---
+name: Bugs and Issues
+about: Create a report to help us improve
+title: ''
+labels: NEEDS TRIAGE
+assignees: ''
+
+---
+
+# Before filing a Bug Report
+
+_Using these will ensure you get quicker support, and make this space available for code-related issues. Thank you!_
+
+- [Docs Site](https://docs.zerotier.com/zerotier/troubleshooting) => Troubleshooting, quickstarts, and more advanced topics.
+- [Discuss Forum](https://discuss.zerotier.com/) => Our discussion forum for users and support to mutually resolve issues & suggest ideas.
+- [Reddit](https://www.reddit.com/r/zerotier/) => Our subreddit, which we monitor regularly and is fairly active.
+- [Knowledge Base](https://zerotier.atlassian.net/wiki/spaces/SD/overview) => Older wiki.
+
+If you are having a connection issue, it's much easier to diagnose through the discussion forum or the ticket system. 
+
+
+# If you still want to file a Bug Report
+
+## Please let us know
+
+- What you expect to be happening.
+- What is actually happening?
+- Any steps to reproduce the error.
+- Any relevant console output or screenshots.
+- What operating system and ZeroTier version. Please try the latest ZeroTier release. 
+

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,13 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[Feature Request] "
+labels: suggestion
+assignees: ''
+
+---
+
+If there is something you'd like to have added to ZeroTier, to go to https://discuss.zerotier.com/c/feature-requests/ instead. Issues there can be voted on and discussed in-depth.
+
+
+Thank you!

.github/ISSUE_TEMPLATE/game-connection-issue.md

@@ -0,0 +1,15 @@
+---
+name: Game Connection Issue
+about: Game issues are better served by forum posts
+title: Please go to our Discuss or Reddit for game-related issues. Thanks!
+labels: wontfix
+assignees: ''
+
+---
+
+Are you having trouble connecting to a game on your virtual network after installing ZeroTier?
+
+- [ ] Yes
+- [ ] No
+
+If you answered yes, then it is very likely that your question would be better answered on our [Community Forums](https://discuss.zerotier.com) or [Reddit](https://www.reddit.com/r/zerotier/) community; we monitor both regularly. We also have extensive documentation on our [Knowledge Base](https://zerotier.atlassian.net/wiki/spaces/SD/overview). Thank you!

.github/workflows/build.yml

@@ -0,0 +1,126 @@
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+jobs:
+  build_ubuntu:
+    runs-on: ubuntu-latest
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf input
+      #        git config --global core.eol lf
+    - name: checkout
+      uses: actions/checkout@v4
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        targets: x86_64-unknown-linux-gnu
+        components: rustfmt, clippy
+
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+
+    - name: make
+      run: make
+    - name: selftest
+      run: |
+        make selftest
+        ./zerotier-selftest
+    - name: 'Tar files' # keeps permissions (execute)
+      run: tar -cvf zerotier-one.tar zerotier-one
+    - name: Archive production artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: zerotier-one-ubuntu-x64
+        path: zerotier-one.tar
+        retention-days: 7
+
+  build_macos:
+    runs-on: macos-latest
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf input
+      #        git config --global core.eol lf
+    - name: checkout
+      uses: actions/checkout@v4
+    - name: Install Rust aarch64
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        target: aarch64-apple-darwin
+        components: rustfmt, clippy
+    - name: Install Rust x86_64
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        target: x86_64-apple-darwin
+        components: rustfmt, clippy
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+    - name: make
+      run: make
+    - name: selftest
+      run: |
+        make selftest
+        ./zerotier-selftest
+    - name: 'Tar files' # keeps permissions (execute)
+      run: tar -cvf zerotier-one.tar zerotier-one
+    - name: Archive production artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: zerotier-one-mac
+        path: zerotier-one.tar
+        retention-days: 7
+
+
+  build_windows:
+    runs-on: windows-2022
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf true
+      #        git config --global core.eol lf
+    - name: checkout
+      uses: actions/checkout@v4
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        targets: x86_64-pc-windows-msvc
+        components: rustfmt, clippy
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+
+    - name: setup msbuild
+      uses: microsoft/setup-msbuild@v2
+    - name: msbuild
+      run: |
+        msbuild windows\ZeroTierOne.sln /m /p:Configuration=Release  /property:Platform=x64 /t:ZeroTierOne
+    - name: Archive production artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: zerotier-one-windows
+        path: windows/Build
+        retention-days: 7

.github/workflows/central-controller.yaml

@@ -0,0 +1,104 @@
+# on:
+#     workflow_dispatch:
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  central_controller:
+    name: Central Controller Build
+    strategy:
+      matrix:
+        runner: [gha-runner-x64, gha-runner-arm64]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build & Push Docker Image
+        # Registry layer cache (mode=max) so the expensive builder stage -- which
+        # builds opentelemetry-cpp + google-cloud-cpp from source -- is reused across
+        # runs and fresh runners. The cache invalidates automatically when the
+        # bootstrap inputs change. Cache is per-arch (the deps layer is arch-specific).
+        run: |
+          CACHE=us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller-buildcache:${{ runner.arch }}
+          docker buildx build \
+            -t us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} \
+            -f ext/central-controller-docker/Dockerfile \
+            --cache-from type=registry,ref=$CACHE \
+            --cache-to type=registry,ref=$CACHE,mode=max \
+            --provenance false \
+            --push .
+
+  multi-arch-docker:
+    runs-on: gha-runner-x64
+    needs: central_controller
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Create and push multi-arch manifest
+        run: |
+          docker manifest create us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
+          docker manifest push us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}

.github/workflows/validate-linux.sh

@@ -0,0 +1,497 @@
+#!/bin/bash
+
+# This test script joins Earth and pokes some stuff
+
+TEST_NETWORK=8056c2e21c000001
+RUN_LENGTH=30
+TEST_FINISHED=false
+ZTO_VER=$(git describe --tags $(git rev-list --tags --max-count=1))
+ZTO_COMMIT=$(git rev-parse HEAD)
+ZTO_COMMIT_SHORT=$(git rev-parse --short HEAD)
+TEST_DIR_PREFIX="$ZTO_VER-$ZTO_COMMIT_SHORT-test-results"
+
+TEST_OK=0
+TEST_FAIL=1
+
+echo "Performing test on: $ZTO_VER-$ZTO_COMMIT_SHORT"
+TEST_FILEPATH_PREFIX="$TEST_DIR_PREFIX/$ZTO_COMMIT_SHORT"
+mkdir $TEST_DIR_PREFIX
+
+# How long we will wait for ZT to come online before considering it a failure
+MAX_WAIT_SECS=30
+
+ZT_PORT_NODE_1=9996
+ZT_PORT_NODE_2=9997
+
+################################################################################
+# Multi-node connectivity and performance test                                 #
+################################################################################
+
+test() {
+
+	echo -e "\nPerforming pre-flight checks"
+
+	check_exit_on_invalid_identity
+
+	echo -e "\nRunning test for $RUN_LENGTH seconds"
+
+	export NS1="ip netns exec ns1"
+	export NS2="ip netns exec ns2"
+
+	export ZT1="$NS1 ./zerotier-cli -p9996 -D$(pwd)/node1"
+	# Specify custom port on one node to ensure that feature works
+	export ZT2="$NS2 ./zerotier-cli -p9997 -D$(pwd)/node2"
+
+	echo -e "\nSetting up network namespaces..."
+	echo "Setting up ns1"
+
+	ip netns add ns1
+	$NS1 ip link set dev lo up
+	ip link add veth0 type veth peer name veth1
+	ip link set veth1 netns ns1
+	ip addr add 192.168.0.1/24 dev veth0
+	ip link set dev veth0 up
+
+	$NS1 ip addr add 192.168.0.2/24 dev veth1
+	$NS1 ip link set dev veth1 up
+
+	# Add default route
+	$NS1 ip route add default via 192.168.0.1
+
+	iptables -t nat -A POSTROUTING -s 192.168.0.0/255.255.255.0 \
+		-o eth0 -j MASQUERADE
+	iptables -A FORWARD -i eth0 -o veth0 -j ACCEPT
+	iptables -A FORWARD -o eth0 -i veth0 -j ACCEPT
+
+	echo "Setting up ns2"
+	ip netns add ns2
+	$NS2 ip link set dev lo up
+	ip link add veth2 type veth peer name veth3
+	ip link set veth3 netns ns2
+	ip addr add 192.168.1.1/24 dev veth2
+	ip link set dev veth2 up
+
+	$NS2 ip addr add 192.168.1.2/24 dev veth3
+	$NS2 ip link set dev veth3 up
+	$NS2 ip route add default via 192.168.1.1
+
+	iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 \
+		-o eth0 -j MASQUERADE
+	iptables -A FORWARD -i eth0 -o veth2 -j ACCEPT
+	iptables -A FORWARD -o eth0 -i veth2 -j ACCEPT
+
+	# Allow forwarding
+	sysctl -w net.ipv4.ip_forward=1
+
+	################################################################################
+	# Memory Leak Check                                                            #
+	################################################################################
+
+	export FILENAME_MEMORY_LOG="$TEST_FILEPATH_PREFIX-memory.log"
+
+	echo -e "\nStarting a ZeroTier instance in each namespace..."
+
+	export time_test_start=$(date +%s)
+
+	# Spam the CLI as ZeroTier is starting
+	spam_cli 100
+
+	echo "Starting memory leak check"
+	$NS1 sudo valgrind --demangle=yes --exit-on-first-error=yes \
+		--error-exitcode=1 \
+		--xml=yes \
+		--xml-file=$FILENAME_MEMORY_LOG \
+		--leak-check=full \
+		./zerotier-one node1 -p$ZT_PORT_NODE_1 -U >>node_1.log 2>&1 &
+
+	# Second instance, not run in memory profiler
+	# Don't set up internet access until _after_ zerotier is running
+	# This has been a source of stuckness in the past.
+	$NS2 ip addr del 192.168.1.2/24 dev veth3
+	$NS2 sudo ./zerotier-one node2 -U -p$ZT_PORT_NODE_2 >>node_2.log 2>&1 &
+
+	sleep 10; # New HTTP control plane is a bit sluggish, so we delay here
+
+	check_bind_to_correct_ports $ZT_PORT_NODE_1
+	check_bind_to_correct_ports $ZT_PORT_NODE_2
+
+	$NS2 ip addr add 192.168.1.2/24 dev veth3
+	$NS2 ip route add default via 192.168.1.1
+
+	echo -e "\nPing from host to namespaces"
+
+	ping -c 3 192.168.0.1
+	ping -c 3 192.168.1.1
+
+	echo -e "\nPing from namespace to host"
+
+	$NS1 ping -c 3 192.168.0.1
+	$NS1 ping -c 3 192.168.0.1
+	$NS2 ping -c 3 192.168.0.2
+	$NS2 ping -c 3 192.168.0.2
+
+	echo -e "\nPing from ns1 to ns2"
+
+	$NS1 ping -c 3 192.168.0.1
+
+	echo -e "\nPing from ns2 to ns1"
+
+	$NS2 ping -c 3 192.168.0.1
+
+	################################################################################
+	# Online Check                                                                 #
+	################################################################################
+
+	echo "Waiting for ZeroTier to come online before attempting test..."
+	node1_online=false
+	node2_online=false
+	both_instances_online=false
+	time_zt_node1_start=$(date +%s)
+	time_zt_node2_start=$(date +%s)
+
+	for ((s = 0; s <= $MAX_WAIT_SECS; s++)); do
+		node1_online="$($ZT1 -j info | jq '.online' 2>/dev/null)"
+		node2_online="$($ZT2 -j info | jq '.online' 2>/dev/null)"
+		echo "Checking for online status: try #$s, node1:$node1_online, node2:$node2_online"
+		if [[ "$node2_online" == "true" && "$node1_online" == "true" ]]; then
+			export both_instances_online=true
+			export time_to_both_nodes_online=$(date +%s)
+			break
+		fi
+		sleep 1
+	done
+
+	echo -e "\n\nContents of ZeroTier home paths:"
+
+	ls -lga node1
+	tree node1
+	ls -lga node2
+	tree node2
+
+	echo -e "\n\nRunning ZeroTier processes:"
+	echo -e "\nNode 1:\n"
+	$NS1 ps aux | grep zerotier-one
+	echo -e "\nNode 2:\n"
+	$NS2 ps aux | grep zerotier-one
+
+	echo -e "\n\nStatus of each instance:"
+
+	echo -e "\n\nNode 1:\n"
+	$ZT1 status
+	echo -e "\n\nNode 2:\n"
+	$ZT2 status
+
+	if [[ "$both_instances_online" != "true" ]]; then
+		exit_test_and_generate_report $TEST_FAIL "one or more nodes failed to come online"
+	fi
+
+	echo -e "\nJoining networks"
+
+	$ZT1 join $TEST_NETWORK
+	$ZT2 join $TEST_NETWORK
+
+	sleep 10
+
+	node1_ip4=$($ZT1 get $TEST_NETWORK ip4)
+	node2_ip4=$($ZT2 get $TEST_NETWORK ip4)
+
+	echo "node1_ip4=$node1_ip4"
+	echo "node2_ip4=$node2_ip4"
+
+	echo -e "\nPinging each node"
+
+	PING12_FILENAME="$TEST_FILEPATH_PREFIX-ping-1-to-2.txt"
+	PING21_FILENAME="$TEST_FILEPATH_PREFIX-ping-2-to-1.txt"
+
+	$NS1 ping -c 16 $node2_ip4 >$PING12_FILENAME
+	$NS2 ping -c 16 $node1_ip4 >$PING21_FILENAME
+
+	ping_loss_percent_1_to_2=$(cat $PING12_FILENAME |
+		grep "packet loss" | awk '{print $6}' | sed 's/%//')
+	ping_loss_percent_2_to_1=$(cat $PING21_FILENAME |
+		grep "packet loss" | awk '{print $6}' | sed 's/%//')
+
+	# Normalize loss value
+	export ping_loss_percent_1_to_2=$(echo "scale=2; $ping_loss_percent_1_to_2/100.0" | bc)
+	export ping_loss_percent_2_to_1=$(echo "scale=2; $ping_loss_percent_2_to_1/100.0" | bc)
+
+	################################################################################
+	# CLI Check                                                                    #
+	################################################################################
+
+	echo "Testing basic CLI functionality..."
+
+	spam_cli 10
+
+	$ZT1 join $TEST_NETWORK
+
+	$ZT1 -h
+	$ZT1 -v
+	$ZT1 status
+	$ZT1 info
+	$ZT1 listnetworks
+	$ZT1 peers
+	$ZT1 listpeers
+
+	$ZT1 -j status
+	$ZT1 -j info
+	$ZT1 -j listnetworks
+	$ZT1 -j peers
+	$ZT1 -j listpeers
+
+	$ZT1 dump
+
+	$ZT1 get $TEST_NETWORK allowDNS
+	$ZT1 get $TEST_NETWORK allowDefault
+	$ZT1 get $TEST_NETWORK allowGlobal
+	$ZT1 get $TEST_NETWORK allowManaged
+	$ZT1 get $TEST_NETWORK bridge
+	$ZT1 get $TEST_NETWORK broadcastEnabled
+	$ZT1 get $TEST_NETWORK dhcp
+	$ZT1 get $TEST_NETWORK id
+	$ZT1 get $TEST_NETWORK mac
+	$ZT1 get $TEST_NETWORK mtu
+	$ZT1 get $TEST_NETWORK name
+	$ZT1 get $TEST_NETWORK netconfRevision
+	$ZT1 get $TEST_NETWORK nwid
+	$ZT1 get $TEST_NETWORK portDeviceName
+	$ZT1 get $TEST_NETWORK portError
+	$ZT1 get $TEST_NETWORK status
+	$ZT1 get $TEST_NETWORK type
+
+	# Test an invalid command
+	$ZT1 get $TEST_NETWORK derpderp
+
+	# TODO: Validate JSON
+
+	# Performance Test
+
+	export FILENAME_PERF_JSON="$TEST_FILEPATH_PREFIX-iperf.json"
+
+	echo -e "\nBeginning performance test:"
+
+	echo -e "\nStarting server:"
+
+	echo "$NS1 iperf3 -s &"
+	sleep 1
+
+	echo -e "\nStarting client:"
+	sleep 1
+
+	echo "$NS2 iperf3 --json -c $node1_ip4 > $FILENAME_PERF_JSON"
+
+	cat $FILENAME_PERF_JSON
+
+	# Let ZeroTier idle long enough for various timers
+
+	echo -e "\nIdling ZeroTier for $RUN_LENGTH seconds..."
+	sleep $RUN_LENGTH
+
+	echo -e "\nLeaving networks"
+
+	$ZT1 leave $TEST_NETWORK
+	$ZT2 leave $TEST_NETWORK
+
+	sleep 5
+
+	exit_test_and_generate_report $TEST_OK "completed test"
+}
+
+################################################################################
+# Generate report                                                              #
+################################################################################
+
+exit_test_and_generate_report() {
+
+	echo -e "\nStopping memory check..."
+	sudo pkill -15 -f valgrind
+	sleep 10
+
+	time_test_end=$(date +%s)
+
+	echo "Exiting test with reason: $2 ($1)"
+
+	# Collect ZeroTier dump files
+
+	echo -e "\nCollecting ZeroTier dump files"
+
+	node1_id=$($ZT1 -j status | jq -r .address)
+	node2_id=$($ZT2 -j status | jq -r .address)
+
+	$ZT1 dump
+	mv zerotier_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node1_id.txt"
+
+	$ZT2 dump
+	mv zerotier_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node2_id.txt"
+
+	# Copy ZeroTier stdout/stderr logs
+
+	cp node_1.log "$TEST_FILEPATH_PREFIX-node-log-$node1_id.txt"
+	cp node_2.log "$TEST_FILEPATH_PREFIX-node-log-$node2_id.txt"
+
+	# Generate report
+
+	cat $FILENAME_MEMORY_LOG
+
+	DEFINITELY_LOST=$(xmlstarlet sel -t -v '/valgrindoutput/error/xwhat' \
+		$FILENAME_MEMORY_LOG | grep "definitely" | awk '{print $1;}')
+	POSSIBLY_LOST=$(xmlstarlet sel -t -v '/valgrindoutput/error/xwhat' \
+		$FILENAME_MEMORY_LOG | grep "possibly" | awk '{print $1;}')
+
+	# Generate coverage report artifact and summary
+
+	FILENAME_COVERAGE_JSON="$TEST_FILEPATH_PREFIX-coverage.json"
+	FILENAME_COVERAGE_HTML="$TEST_FILEPATH_PREFIX-coverage.html"
+
+	echo -e "\nGenerating coverage test report..."
+
+	gcovr -r . --exclude ext --json-summary $FILENAME_COVERAGE_JSON \
+		--html >$FILENAME_COVERAGE_HTML
+
+	cat $FILENAME_COVERAGE_JSON
+
+	COVERAGE_LINE_COVERED=$(cat $FILENAME_COVERAGE_JSON | jq .line_covered)
+	COVERAGE_LINE_TOTAL=$(cat $FILENAME_COVERAGE_JSON | jq .line_total)
+	COVERAGE_LINE_PERCENT=$(cat $FILENAME_COVERAGE_JSON | jq .line_percent)
+
+	COVERAGE_LINE_COVERED="${COVERAGE_LINE_COVERED:-0}"
+	COVERAGE_LINE_TOTAL="${COVERAGE_LINE_TOTAL:-0}"
+	COVERAGE_LINE_PERCENT="${COVERAGE_LINE_PERCENT:-0}"
+
+	# Default values
+
+	DEFINITELY_LOST="${DEFINITELY_LOST:-0}"
+	POSSIBLY_LOST="${POSSIBLY_LOST:-0}"
+	ping_loss_percent_1_to_2="${ping_loss_percent_1_to_2:-100.0}"
+	ping_loss_percent_2_to_1="${ping_loss_percent_2_to_1:-100.0}"
+	time_to_both_nodes_online="${time_to_both_nodes_online:--1}"
+
+	# Summarize and emit json for trend reporting
+
+	FILENAME_SUMMARY="$TEST_FILEPATH_PREFIX-summary.json"
+
+	time_length_test=$((time_test_end - time_test_start))
+	if [[ $time_to_both_nodes_online != -1 ]];
+	then
+		time_to_both_nodes_online=$((time_to_both_nodes_online - time_test_start))
+	fi
+	#time_length_zt_join=$((time_zt_join_end-time_zt_join_start))
+	#time_length_zt_leave=$((time_zt_leave_end-time_zt_leave_start))
+	#time_length_zt_can_still_ping=$((time_zt_can_still_ping-time_zt_leave_start))
+
+	summary=$(
+		cat <<EOF
+{
+  "version":"$ZTO_VER",
+  "commit":"$ZTO_COMMIT",
+  "arch_m":"$(uname -m)",
+  "arch_a":"$(uname -a)",
+  "binary_size":"$(stat -c %s zerotier-one)",
+  "time_length_test":$time_length_test,
+  "time_to_both_nodes_online":$time_to_both_nodes_online,
+  "num_possible_bytes_lost": $POSSIBLY_LOST,
+  "num_definite_bytes_lost": $DEFINITELY_LOST,
+  "num_bad_formattings": $POSSIBLY_LOST,
+  "coverage_lines_covered": $COVERAGE_LINE_COVERED,
+  "coverage_lines_total": $COVERAGE_LINE_TOTAL,
+  "coverage_lines_percent": $COVERAGE_LINE_PERCENT,
+  "ping_loss_percent_1_to_2": $ping_loss_percent_1_to_2,
+  "ping_loss_percent_2_to_1": $ping_loss_percent_2_to_1,
+  "test_exit_code": $1,
+  "test_exit_reason":"$2"
+}
+EOF
+	)
+
+	echo $summary >$FILENAME_SUMMARY
+	cat $FILENAME_SUMMARY
+
+	exit 0
+}
+
+################################################################################
+# CLI Check                                                                    #
+################################################################################
+
+spam_cli() {
+	echo "Spamming CLI..."
+	# Rapidly spam the CLI with joins/leaves
+
+	MAX_TRIES="${1:-10}"
+
+	for ((s = 0; s <= MAX_TRIES; s++)); do
+		$ZT1 status
+		$ZT2 status
+		sleep 0.1
+	done
+
+	SPAM_TRIES=128
+
+	for ((s = 0; s <= SPAM_TRIES; s++)); do
+		$ZT1 join $TEST_NETWORK
+	done
+
+	for ((s = 0; s <= SPAM_TRIES; s++)); do
+		$ZT1 leave $TEST_NETWORK
+	done
+
+	for ((s = 0; s <= SPAM_TRIES; s++)); do
+		$ZT1 leave $TEST_NETWORK
+		$ZT1 join $TEST_NETWORK
+	done
+}
+
+################################################################################
+# Check for proper exit on load of invalid identity                            #
+################################################################################
+
+check_exit_on_invalid_identity() {
+	echo "Checking ZeroTier exits on invalid identity..."
+	mkdir -p $(pwd)/exit_test
+	ZT1="sudo ./zerotier-one -p9999 $(pwd)/exit_test"
+	echo "asdfasdfasdfasdf" > $(pwd)/exit_test/identity.secret
+	echo "asdfasdfasdfasdf" > $(pwd)/exit_test/authtoken.secret
+
+	echo "Launch ZeroTier with an invalid identity"
+	$ZT1 &
+	my_pid=$!
+
+	echo "Waiting 5 seconds"
+	sleep 5
+
+	# check if process is running
+	kill -0 $my_pid
+	if [ $? -eq 0 ]; then
+		exit_test_and_generate_report $TEST_FAIL "Exit test FAILED: Process still running after being fed an invalid identity"
+	fi
+}
+
+################################################################################
+# Check that we're binding to the primary port for TCP/TCP6/UDP                #
+################################################################################
+
+check_bind_to_correct_ports() {
+	PORT_NUMBER=$1
+	echo "Checking bound ports:"
+	sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier"
+	if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "tcp") ]];
+	then
+		:
+	else
+		exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to tcp/$1"
+	fi
+	if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "tcp6") ]];
+	then
+		:
+	else
+		exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to tcp6/$1"
+	fi
+	if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "udp") ]];
+	then
+		:
+	else
+		exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to udp/$1"
+	fi
+}
+
+test "$@"

.github/workflows/validate-report.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+################################################################################
+# Set exit code depending on tool reports                                      #
+################################################################################
+
+DEFINITELY_LOST=$(cat *test-results/*summary.json | jq .num_definite_bytes_lost)
+EXIT_CODE=$(cat *test-results/*summary.json | jq .exit_code)
+EXIT_REASON=$(cat *test-results/*summary.json | jq .exit_reason)
+
+cat *test-results/*summary.json
+
+echo -e "\nBytes of memory definitely lost: $DEFINITELY_LOST"
+
+if [[ "$DEFINITELY_LOST" -gt 0 ]]; then
+      exit 1
+fi
+
+# Catch-all for other non-zero exit codes
+
+if [[ "$EXIT_CODE" -gt 0 ]]; then
+      echo "Test failed: $EXIT_REASON"
+      exit 1
+fi

.github/workflows/validate.yml

@@ -0,0 +1,56 @@
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+jobs:
+  build_ubuntu:
+    runs-on: ubuntu-latest
+    steps:
+    - name: gitconfig
+      run: |
+        git config --global core.autocrlf input
+
+    - name: checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+        targets: x86_64-unknown-linux-gnu
+        components: rustfmt, clippy
+
+    - name: Set up cargo cache
+      uses: Swatinem/rust-cache@v2
+      continue-on-error: false
+      with:
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
+        shared-key: ${{ runner.os }}-cargo-
+        workspaces: |
+          rustybits/
+
+    - name: validate-1m-linux
+      env:
+        CC: 'gcc'
+        CXX: 'g++'
+        BRANCH: ${{  github.ref_name }}
+      run: |
+        sudo apt update && sudo apt install -y valgrind xmlstarlet gcovr iperf3 tree
+        make one ZT_COVERAGE=1 ZT_TRACE=1
+        sudo chmod +x ./.github/workflows/validate-linux.sh
+        sudo ./.github/workflows/validate-linux.sh
+
+    - name: Archive test results
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{github.sha}}-test-results
+        path: "*test-results*"
+
+    - name: final-report
+      run: |
+        sudo chmod +x ./.github/workflows/validate-report.sh
+        sudo ./.github/workflows/validate-report.sh
+

.gitignore

@@ -4,11 +4,22 @@
 /zerotier-cli
 /zerotier-selftest
 /zerotier
+/nltest
+
+# IDE and dev tool stuff
+/.idea
+/.nova
+/compile_commands.json
+/.claude
+/.aider
 
 # OS-created garbage files from various platforms
 .DS_Store
 .Apple*
 Thumbs.db
+@eaDir
+lost+found
+._*
 
 # Windows build droppings
 /windows/ZeroTierOne.sdf
@@ -25,10 +36,19 @@ Thumbs.db
 /windows/Release
 /windows/WebUIWrapper/bin
 /windows/WebUIWrapper/obj
+/windows/lib
 /ext/installfiles/windows/ZeroTier One-SetupFiles
-/ext/installfiles/windows/Prerequisites
 /ext/installfiles/windows/*-cache
 /ZeroTier One.msi
+*.vcxproj.backup
+/windows/TapDriver6/Win7Debug
+/windows/TapDriver6/win7Release
+/windows/*.db
+/windows/*.opendb
+enc_temp_folder
+/windows/copyutil/bin
+/windows/copyutil/obj
+.vs/
 
 # *nix/Mac build droppings
 /build-*
@@ -38,18 +58,21 @@ Thumbs.db
 /world/mkworld
 /world/*.c25519
 zt1-src.tar.gz
+/MacEthernetTapAgent
 
 # Miscellaneous temporaries, build files, etc.
+ext/installfiles/windows/*.back*.aip
+tcp-proxy/tcp-proxy
+rustybits/target
 *.log
 *.opensdf
 *.user
 *.cache
-*.obj
 *.tlog
 *.pid
 *.pkg
 *.o
-*.a
+/*.a
 *.dylib
 *.so
 *.so.*
@@ -59,16 +82,16 @@ zt1-src.tar.gz
 *.rpm
 *.autosave
 *.tmp
-doc/*.1
-doc/*.2
-doc/*.8
 .depend
 node_modules
+zt1_update_*
 debian/files
 debian/zerotier-one
 debian/zerotier-one*.debhelper
 debian/*.log
 debian/zerotier-one.substvars
+root-watcher/config.json
+build/
 
 # Java/Android/JNI build droppings
 java/obj/
@@ -82,3 +105,49 @@ java/build_win32/
 windows/WinUI/obj/
 windows/WinUI/bin/
 windows/ZeroTierOne/Debug/
+/ext/installfiles/windows/chocolatey/zerotier-one/*.nupkg
+
+
+# Miscellaneous mac/Xcode droppings
+.Trashes
+*.swp
+*~.nib
+DerivedData/
+*.pbxuser
+*.mode1v3
+*.mode2v3
+*.perspectivev3
+!default.pbxuser
+!default.mode1v3
+!default.mode2v3
+!default.perspectivev3
+*.xccheckout
+xcuserdata/
+.vscode
+__pycache__
+*~
+attic/world/*.c25519
+attic/world/mkworld
+workspace/
+workspace2/
+zeroidc/target/
+tcp-proxy/target
+
+# Snapcraft Linux build stuff
+/parts/
+/stage/
+/prime/
+*.snap
+.snapcraft
+__pycache__
+*.pyc
+*_source.tar.bz2
+snap/.snapcraft
+build/
+
+# Local dependency bootstrap output (scripts/bootstrap-deps.sh): the install
+# prefix and the build/clone scratch dir. Large + host-specific; never commit.
+.deps/
+.deps-build/
+
+.claude/*.local.*

AUTHORS.md

@@ -1,80 +0,0 @@
-## Primary Authors
-
- * ZeroTier Core and ZeroTier One virtual networking service<br>
-   Adam Ierymenko / adam.ierymenko@zerotier.com
-
- * Java JNI Interface to enable Android application development, and Android app itself (code for that is elsewhere)<br>
-   Grant Limberg / glimberg@gmail.com
-
- * ZeroTier SDK (formerly known as Network Containers)<br>
-   Joseph Henry / joseph.henry@zerotier.com
-
-## Third Party Contributors
-
- * A number of fixes and improvements to the new controller, other stuff.<br>
-   Kees Bos / https://github.com/keesbos/
-
- * Debugging and testing, OpenWRT support fixes.<br>
-   Moritz Warning / moritzwarning@web.de
-
- * Debian GNU/Linux packaging, manual pages, and license compliance edits.<br>
-   Ben Finney <ben+zerotier@benfinney.id.au>
-
- * Several others made smaller contributions, which GitHub tracks here:<br>
-   https://github.com/zerotier/ZeroTierOne/graphs/contributors/
-
-## Third-Party Code
-
-These are included in ext/ for platforms that do not have them available in common repositories. Otherwise they may be linked and the package may ship with them as dependencies.
-
- * LZ4 compression algorithm by Yann Collet
-
-   * Files: ext/lz4/*
-   * Home page: http://code.google.com/p/lz4/
-   * License grant: BSD attribution
-
- * http-parser by Joyent, Inc. (many authors)
-
-   * Files: ext/http-parser/*
-   * Home page: https://github.com/joyent/http-parser/
-   * License grant: MIT/Expat
-
- * json-parser by James McLaughlin
-
-   * Files: ext/json-parser/*
-   * Home page: https://github.com/udp/json-parser/
-   * License grant: BSD attribution
-
- * TunTapOSX by Mattias Nissler
-
-   * Files: ext/tap-mac/tuntap/*
-   * Home page: http://tuntaposx.sourceforge.net/
-   * License grant: BSD attribution no-endorsement
-   * ZeroTier Modifications: change interface name to zt#, increase max MTU, increase max devices
-
- * tap-windows6 by the OpenVPN project
-
-   * Files: windows/TapDriver6/*
-   * Home page:
-       https://github.com/OpenVPN/tap-windows6/
-   * License grant: GNU GPL v2
-   * ZeroTier Modifications: change name of driver to ZeroTier, add ioctl() to get L2 multicast memberships (source is in ext/ and modifications inherit GPL)
-
- * Salsa20 stream cipher, Curve25519 elliptic curve cipher, Ed25519
-   digital signature algorithm, and Poly1305 MAC algorithm, all by
-   Daniel J. Bernstein
-
-   * Files:
-       node/Salsa20.hpp
-       node/C25519.hpp
-       node/Poly1305.hpp
-   * Home page: http://cr.yp.to/
-   * License grant: public domain
-
- * MiniUPNPC and libnatpmp by Thomas Bernard
-
-   * Files:
-       ext/libnatpmp/*
-       ext/miniupnpc/*
-   * Home page: http://miniupnp.free.fr/
-   * License grant: BSD attribution no-endorsement

Brewfile

@@ -0,0 +1,28 @@
+# Central Controller build dependencies for macOS development.
+#
+#   brew bundle            # install the deps below
+#   ZT_CONTROLLER_DEPS=1 scripts/bootstrap-deps.sh   # build the two pinned controller deps (full OTel + google-cloud-cpp)
+#
+# The two version-sensitive C++ libraries (opentelemetry-cpp, google-cloud-cpp)
+# are NOT taken from Homebrew -- they are pinned and built from source by
+# scripts/bootstrap-deps.sh so every dev/CI machine uses the same versions
+# (the role conda previously filled). Everything below is stable enough to take
+# from Homebrew.
+
+brew "cmake"
+brew "ninja"
+brew "pkg-config"
+brew "rustup-init"      # then: rustup-init -y && rustup default stable
+
+brew "libpqxx"
+brew "libpq"           # keg-only; add $(brew --prefix libpq) to CMAKE_PREFIX_PATH so find_package(PostgreSQL) resolves
+brew "hiredis"
+brew "jemalloc"
+brew "nlohmann-json"
+brew "openssl@3"
+brew "abseil"
+brew "protobuf"
+brew "grpc"
+brew "googletest"      # google-cloud-cpp requires GTest/GMock at configure (builds its *_mocks libs)
+brew "curl"
+brew "inja"

CMakePresets.json

@@ -0,0 +1,167 @@
+{
+  "version": 3,
+  "cmakeMinimumRequired": { "major": 3, "minor": 21, "patch": 0 },
+  "configurePresets": [
+    {
+      "name": "unix-base",
+      "hidden": true,
+      "generator": "Unix Makefiles",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps",
+        "CMAKE_BUILD_TYPE": "Release"
+      }
+    },
+    {
+      "name": "linux-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Linux" }
+    },
+    {
+      "name": "macos-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Darwin" },
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps;$env{HOMEBREW_PREFIX};$env{HOMEBREW_PREFIX}/opt/openssl@3;$env{HOMEBREW_PREFIX}/opt/libpq"
+      }
+    },
+
+    { "name": "linux-release",            "inherits": "linux-base", "displayName": "Linux daemon (Release)" },
+    { "name": "linux-debug",              "inherits": "linux-base", "displayName": "Linux daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-controller-release", "inherits": "linux-base", "displayName": "Linux Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "linux-controller-debug",   "inherits": "linux-base", "displayName": "Linux Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-free-release",       "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "linux-free-debug",         "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "macos-release",            "inherits": "macos-base", "displayName": "macOS daemon (Release)" },
+    { "name": "macos-debug",              "inherits": "macos-base", "displayName": "macOS daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-controller-release", "inherits": "macos-base", "displayName": "macOS Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "macos-controller-debug",   "inherits": "macos-base", "displayName": "macOS Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-free-release",       "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "macos-free-debug",         "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-universal-release",  "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Release)", "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64" } },
+    { "name": "macos-universal-debug",    "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Debug)",   "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "freebsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "FreeBSD" }
+    },
+    {
+      "name": "openbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "OpenBSD" }
+    },
+    {
+      "name": "netbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "NetBSD" }
+    },
+
+    { "name": "freebsd-release",          "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Release)" },
+    { "name": "freebsd-debug",            "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "freebsd-free-release",     "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "freebsd-free-debug",       "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "openbsd-release",          "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Release)" },
+    { "name": "openbsd-debug",            "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "openbsd-free-release",     "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "openbsd-free-debug",       "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "netbsd-release",           "inherits": "netbsd-base", "displayName": "NetBSD daemon (Release)" },
+    { "name": "netbsd-debug",             "inherits": "netbsd-base", "displayName": "NetBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "netbsd-free-release",      "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "netbsd-free-debug",        "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "windows-x64",
+      "displayName": "Windows x64 daemon (MSVC + vcpkg)",
+      "generator": "Visual Studio 17 2022",
+      "architecture": "x64",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Windows" },
+      "cacheVariables": {
+        "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static",
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/x64"
+      }
+    },
+    {
+      "name": "windows-arm64",
+      "inherits": "windows-x64",
+      "displayName": "Windows ARM64 daemon (MSVC + vcpkg)",
+      "architecture": "ARM64",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "arm64-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/ARM64" }
+    },
+    {
+      "name": "windows-x86",
+      "inherits": "windows-x64",
+      "displayName": "Windows x86 daemon (MSVC + vcpkg)",
+      "architecture": "Win32",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "x86-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/Win32" }
+    },
+    {
+      "name": "windows-x64-free",
+      "inherits": "windows-x64",
+      "displayName": "Windows x64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-arm64-free",
+      "inherits": "windows-arm64",
+      "displayName": "Windows ARM64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-x86-free",
+      "inherits": "windows-x86",
+      "displayName": "Windows x86 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    }
+  ],
+  "buildPresets": [
+    { "name": "linux-release",            "configurePreset": "linux-release" },
+    { "name": "linux-debug",              "configurePreset": "linux-debug" },
+    { "name": "linux-controller-release", "configurePreset": "linux-controller-release" },
+    { "name": "linux-controller-debug",   "configurePreset": "linux-controller-debug" },
+    { "name": "linux-free-release",       "configurePreset": "linux-free-release" },
+    { "name": "linux-free-debug",         "configurePreset": "linux-free-debug" },
+    { "name": "macos-release",            "configurePreset": "macos-release" },
+    { "name": "macos-debug",              "configurePreset": "macos-debug" },
+    { "name": "macos-controller-release", "configurePreset": "macos-controller-release" },
+    { "name": "macos-controller-debug",   "configurePreset": "macos-controller-debug" },
+    { "name": "macos-free-release",       "configurePreset": "macos-free-release" },
+    { "name": "macos-free-debug",         "configurePreset": "macos-free-debug" },
+    { "name": "macos-universal-release",  "configurePreset": "macos-universal-release" },
+    { "name": "macos-universal-debug",    "configurePreset": "macos-universal-debug" },
+    { "name": "freebsd-release",          "configurePreset": "freebsd-release" },
+    { "name": "freebsd-debug",            "configurePreset": "freebsd-debug" },
+    { "name": "freebsd-free-release",     "configurePreset": "freebsd-free-release" },
+    { "name": "freebsd-free-debug",       "configurePreset": "freebsd-free-debug" },
+    { "name": "openbsd-release",          "configurePreset": "openbsd-release" },
+    { "name": "openbsd-debug",            "configurePreset": "openbsd-debug" },
+    { "name": "openbsd-free-release",     "configurePreset": "openbsd-free-release" },
+    { "name": "openbsd-free-debug",       "configurePreset": "openbsd-free-debug" },
+    { "name": "netbsd-release",           "configurePreset": "netbsd-release" },
+    { "name": "netbsd-debug",             "configurePreset": "netbsd-debug" },
+    { "name": "netbsd-free-release",      "configurePreset": "netbsd-free-release" },
+    { "name": "netbsd-free-debug",        "configurePreset": "netbsd-free-debug" },
+    { "name": "windows-x64-release",        "configurePreset": "windows-x64",        "configuration": "Release" },
+    { "name": "windows-x64-debug",          "configurePreset": "windows-x64",        "configuration": "Debug" },
+    { "name": "windows-arm64-release",      "configurePreset": "windows-arm64",      "configuration": "Release" },
+    { "name": "windows-arm64-debug",        "configurePreset": "windows-arm64",      "configuration": "Debug" },
+    { "name": "windows-x86-release",        "configurePreset": "windows-x86",        "configuration": "Release" },
+    { "name": "windows-x86-debug",          "configurePreset": "windows-x86",        "configuration": "Debug" },
+    { "name": "windows-x64-free-release",   "configurePreset": "windows-x64-free",   "configuration": "Release" },
+    { "name": "windows-x64-free-debug",     "configurePreset": "windows-x64-free",   "configuration": "Debug" },
+    { "name": "windows-arm64-free-release", "configurePreset": "windows-arm64-free", "configuration": "Release" },
+    { "name": "windows-arm64-free-debug",   "configurePreset": "windows-arm64-free", "configuration": "Debug" },
+    { "name": "windows-x86-free-release",   "configurePreset": "windows-x86-free",   "configuration": "Release" },
+    { "name": "windows-x86-free-debug",     "configurePreset": "windows-x86-free",   "configuration": "Debug" }
+  ]
+}

COPYING

@@ -1,17 +0,0 @@
-ZeroTier One, an endpoint server for the ZeroTier virtual network layer.
-Copyright © 2011–2016 ZeroTier, Inc.
-
-ZeroTier One is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 3 of the License, or (at
-your option) any later version.
-
-See the file ‘LICENSE.GPL-3’ for the text of the GNU GPL version 3.
-If that file is not present, see <http://www.gnu.org/licenses/>.
-
-..
-    Local variables:
-    coding: utf-8
-    mode: text
-    End:
-    vim: fileencoding=utf-8 filetype=text :

Dockerfile.ci

@@ -0,0 +1,28 @@
+# vim: ft=dockerfile
+
+FROM ubuntu:21.04 as stage
+
+RUN apt-get update -qq && apt-get -qq install make clang
+COPY . .
+RUN /usr/bin/make
+RUN echo $PWD
+RUN cp zerotier-one /usr/sbin
+
+FROM ubuntu:21.04
+
+COPY --from=stage /zerotier-one /usr/sbin
+RUN ln -sf /usr/sbin/zerotier-one /usr/sbin/zerotier-idtool
+RUN ln -sf /usr/sbin/zerotier-one /usr/sbin/zerotier-cli
+
+RUN echo "${VERSION}" > /etc/zerotier-version
+RUN rm -rf /var/lib/zerotier-one
+
+
+RUN apt-get -qq update
+RUN apt-get -qq install iproute2 net-tools fping 2ping iputils-ping iputils-arping
+
+COPY entrypoint.sh.release /entrypoint.sh
+RUN chmod 755 /entrypoint.sh
+
+CMD []
+ENTRYPOINT ["/entrypoint.sh"]

Dockerfile.release

@@ -0,0 +1,23 @@
+# vim: ft=dockerfile
+
+FROM debian:bookworm
+
+ARG VERSION
+
+RUN apt-get update -qq && apt-get install curl gpg -y
+RUN mkdir -p /usr/share/zerotier && \
+    curl -o /usr/share/zerotier/tmp.asc "https://download.zerotier.com/contact%40zerotier.com.gpg" && \
+    gpg --no-default-keyring --keyring /usr/share/zerotier/zerotier.gpg --import /usr/share/zerotier/tmp.asc && \
+    rm -f /usr/share/zerotier/tmp.asc && \
+    echo "deb [signed-by=/usr/share/zerotier/zerotier.gpg] http://download.zerotier.com/debian/bookworm bookworm main" > /etc/apt/sources.list.d/zerotier.list
+
+RUN apt-get update -qq && apt-get install zerotier-one=${VERSION} curl iproute2 net-tools iputils-ping openssl libssl3 -y
+RUN rm -rf /var/lib/zerotier-one
+
+COPY entrypoint.sh.release /entrypoint.sh
+RUN chmod 755 /entrypoint.sh
+
+HEALTHCHECK --interval=1s CMD bash /healthcheck.sh
+
+CMD []
+ENTRYPOINT ["/entrypoint.sh"]