VERSION 1.6.0

See RELEASE-NOTES.md for details.

.dockerignore

@@ -0,0 +1,2 @@
+.git/
+workspace/

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,46 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-
----
-**Alternative, faster ways to get help**
-If you have just started using ZeroTier, here are some places to get help:
-- my.zerotier.com has a _Community_ tab. It's a live chat with other users and the developers. 
-- [ZeroTier Knowledge Base](https://zerotier.atlassian.net/wiki/spaces/SD/overview)
-- www.zerotier.com has a Contact Us button
-- email contact@zerotier.com
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Create a Network '...'
-2. Install zerotier-one '....'
-3. '....'
-4. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots or console output to help explain your problem.
-
-**Desktop (please complete the following information):**
- - OS: [e.g. Mac, Linux, Windows, BSD]
- - OS/Distribution Version
- - ZeroTier Version [e.g. 1.2.4]
- - Hardware [e.g. raspberry pi 3]
- 
-**Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Version [e.g. 1.2.4]
-
-**Additional context**
-Add any other context about the problem here.
-- ZeroTier Network Configuration
-- Router Config
-- Firewall Config (try turning the firewall off)
-- General Network Environment: [ e.g Home, University Campus, Corporate LAN ]
-

.github/ISSUE_TEMPLATE/bugs-and-issues.md

@@ -0,0 +1,50 @@
+---
+name: Bugs and Issues
+about: Create a report to help us improve
+title: ''
+labels: NEEDS TRIAGE
+assignees: ''
+
+---
+
+# Before filing a Bug Report
+
+_Using these will ensure you get quicker support, and make this space available for code-related issues. Thank you!_
+
+- [Knowledge Base](https://zerotier.atlassian.net/wiki/spaces/SD/overview) => Guides and documentation on how to use ZeroTier.
+- [Discuss Forum](https://discuss.zerotier.com/) => Our discussion forum for users and support to mutally resolve issues & suggest ideas.
+- [Reddit](https://www.reddit.com/r/zerotier/) => Our subreddit, which we monitor regularly and is fairly active.
+- https://www.zerotier.com/contact/ => Sales and licensing queries
+- https://zerotier.atlassian.net/servicedesk/customer/portals => Customer Support Portal
+
+# If you still want to file a Bug Report
+
+## Required
+
+- What you expect to be happening.
+- What is actually happening?
+- Any steps to reproduce the error.
+- Any screenshots that would help us out.
+
+## Additional information 
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. Mac, Linux, Windows, BSD]
+ - OS/Distribution Version
+ - ZeroTier Version [e.g. 1.4.6]
+  
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - ZeroTier Version [e.g. 1.4.6]
+
+ **Embedded & NAS (please complete the following information):**
+ - Device: [e.g. Synology, Pi4]
+ - OS/Distribution (if applicable)
+ - ZeroTier Version [e.g. 1.4.6]
+
+**Additional context**
+- ZeroTier Network Configuration: IPv4 & IPv6 networks defined on your ZeroTier Central
+- Router Config: are you permitting port 9993, uPnP, and NAT-PMP?
+- Firewall Config: are you permitting port 9993 on your OS; setting it to "Private" on Windows?
+- Are you using this at home, in an office, college, etc?

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,17 +1,13 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
+title: "[Feature Request] "
+labels: suggestion
+assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+If there is something you'd like to have added to ZeroTier, to go to https://discuss.zerotier.com/c/feature-requests/ instead. Issues there can be voted on and discussed in-depth.
 
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
 
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.
+Thank you!

.github/ISSUE_TEMPLATE/game-connection-issue.md

@@ -0,0 +1,15 @@
+---
+name: Game Connection Issue
+about: Game issues are better served by forum posts
+title: Please go to our Discuss or Reddit for game-related issues. Thanks!
+labels: wontfix
+assignees: ''
+
+---
+
+Are you having trouble connecting to a game on your virtual network after installing ZeroTier?
+
+- [ ] Yes
+- [ ] No
+
+If you answered yes, then it is very likely that your question would be better answered on our [Discuss ](https://discuss.zerotier.com) forum or [Reddit](https://www.reddit.com/r/zerotier/) community; we monitor both regularly. We also have extensive documentation on our [Knowledge Base](https://zerotier.atlassian.net/wiki/spaces/SD/overview). Thank you!

.gitignore

@@ -33,7 +33,6 @@ Thumbs.db
 /ext/installfiles/windows/Prerequisites
 /ext/installfiles/windows/*-cache
 /ZeroTier One.msi
-/windows/.vs
 *.vcxproj.backup
 /windows/TapDriver6/Win7Debug
 /windows/TapDriver6/win7Release
@@ -42,6 +41,7 @@ Thumbs.db
 enc_temp_folder
 /windows/copyutil/bin
 /windows/copyutil/obj
+.vs/
 
 # *nix/Mac build droppings
 /build-*
@@ -120,3 +120,5 @@ __pycache__
 *~
 attic/world/*.c25519
 attic/world/mkworld
+workspace/
+workspace2/

Jenkinsfile

@@ -1,84 +1,365 @@
-#!/usr/bin/env groovy
-
-node('master') {
-    checkout scm
+pipeline {
+    options {
+        disableConcurrentBuilds()
+        preserveStashes(buildCount: 10)
+        timestamps()
+    }
+    parameters {
+        booleanParam(name: "BUILD_ALL", defaultValue: false, description: "Build all supported platform/architecture combos.  Defaults to x86/x64 only")
+    }
     
-    def changelog = getChangeLog currentBuild
-
-    mattermostSend "Building ${env.JOB_NAME} #${env.BUILD_NUMBER} \n Change Log: \n ${changelog}"
-}
-
-parallel 'centos7': {
-    node('centos7') {
-        try {
-            checkout scm
-
-	        stage('Build Centos 7') {
-                sh 'make -f make-linux.mk'
+    agent none
+    
+    stages {
+        stage ("Build") {
+            steps {
+                script {
+                    def tasks = [:]
+                    tasks << buildStaticBinaries()
+                    tasks << buildDebianNative()
+                    tasks << buildCentosNative()
+                    
+                    parallel tasks
+                }
             }
         }
-        catch (err) {
-            currentBuild.result = "FAILURE"
-            mattermostSend color: '#ff0000', message: "${env.JOB_NAME} broken on Centos 7 (<${env.BUILD_URL}|Open>)"
-
-            throw err
+        stage ("Package Static") {
+            steps {
+                script {
+                    parallel packageStatic()
+                }
+            }
         }
     }
-// }, 'android-ndk': {
-//     node('android-ndk') {
-//         try {
-//             checkout scm
-	
-//             stage('Build Android NDK') { 
-//                 sh "/android/android-ndk-r15b/ndk-build -C $WORKSPACE/java ZT1=${WORKSPACE}"
-//             }
-//         }
-//         catch (err) {
-//             currentBuild.result = "FAILURE"
-//             mattermostSend color: '#ff0000', message: "${env.JOB_NAME} broken on Android NDK (<${env.BUILD_URL}|Open>)"
-
-//             throw err
-//         }
-//     }
-// }, 'macOS': {
-//     node('macOS') {
-//         try {
-//             checkout scm
-
-//             stage('Build macOS') {
-//                 sh 'make -f make-mac.mk'
-//             }
-
-//             stage('Build macOS UI') {
-//                 sh 'cd macui && xcodebuild -target "ZeroTier One" -configuration Debug'
-//             }
-//         }
-//         catch (err) {
-//             currentBuild.result = "FAILURE"
-//             mattermostSend color: '#ff0000', message: "${env.JOB_NAME} broken on macOS (<${env.BUILD_URL}|Open>)"
-
-//             throw err
-//         }
-//     }
-// }, 'windows': {
-//     node('windows') {
-//         try {
-//             checkout scm
-            
-//             stage('Build Windows') {
-//                 bat '''CALL "C:\\Program Files (x86)\\Microsoft Visual Studio 14.0\\VC\\vcvarsall.bat" amd64
-// git clean -dfx
-// msbuild windows\\ZeroTierOne.sln
-// '''
-//             }
-//         }
-//         catch (err) {
-//             currentBuild.result = "FAILURE"
-//             mattermostSend color: '#ff0000', message: "${env.JOB_NAME} broken on Windows (<${env.BUILD_URL}|Open>)"
-
-//             throw err
-//         }
-//     }
 }
 
-mattermostSend color: "#00ff00", message: "${env.JOB_NAME} #${env.BUILD_NUMBER} Complete (<${env.BUILD_URL}|Show More...>)"
+def buildStaticBinaries() {
+    def tasks = [:]
+    def dist = ["alpine"]
+    def archs = []
+    if (params.BUILD_ALL == true) {
+        archs = ["arm64", "amd64", "i386", "armhf", "armel", "ppc64le", "s390x"]
+    } else {
+        archs = ["amd64", "i386"]
+    }
+
+    tasks << getTasks(dist, archs, { distro, platform -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                sh "echo ${distro}-${platform}"
+                def runtime = docker.image("ztbuild/${distro}-${platform}:latest")
+                runtime.inside {
+                    dir("build") {
+                        sh 'make -j8 ZT_STATIC=1 all'
+                        sh "file ./zerotier-one"
+                        sh "mv zerotier-one zerotier-one-static-${platform}"
+                        stash includes: 'zerotier-one-static-*', name: "static-${platform}"
+                    }
+                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+                }
+            }
+        }
+        return myNode
+    })
+    
+    return tasks
+}
+
+def getTasks(axisDistro, axisPlatform, task) {
+    def tasks = [:]
+    for(int i=0; i< axisDistro.size(); i++) {
+        def axisDistroValue = axisDistro[i]
+        for(int j=0; j< axisPlatform.size(); j++) {
+            def axisPlatformValue = axisPlatform[j]
+            tasks["${axisDistroValue}/${axisPlatformValue}"] = task(axisDistroValue, axisPlatformValue)
+        }
+    }
+    return tasks
+}
+
+def packageStatic() {
+    def tasks = [:]
+    
+    def centos6 = ["centos6"]
+    def centos6Arch = ["i386", "amd64"]
+    tasks << getTasks(centos6, centos6Arch, { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    dir("build") {
+                        unstash "static-${arch}"
+                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one" 
+                        sh "make redhat"
+                        sh "mkdir -p ${distro}"
+                        sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
+                        archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
+                    }
+                }
+                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+            }
+        }
+        return myNode
+    })
+    
+    def centos7 = ["centos7"]
+    def centos7Arch = ["i386"]
+    tasks << getTasks(centos7, centos7Arch, { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    dir("build") {
+                        unstash "static-${arch}"
+                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one" 
+                        sh "make redhat"
+                        sh "mkdir -p ${distro}"
+                        sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
+                        archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
+                    }
+                }
+                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+            }
+        }
+        return myNode
+    })
+    
+    if (params.BUILD_ALL == true) {
+        def clefos7 = ["clefos"]
+        def clefos7Arch = ["s390x"]
+        tasks << getTasks(clefos7, clefos7Arch, { distro, arch -> 
+            def myNode = {
+                node ('linux-build') {
+                    dir ("build") {
+                        checkout scm
+                    }
+                    def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                    runtime.inside {
+                        dir("build/") {
+                            unstash "static-${arch}"
+                            sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one" 
+                            sh "make redhat"
+                            sh "mkdir -p ${distro}"
+                            sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
+                            archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
+                        }
+                    }
+                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+                }
+            }
+            return myNode
+        })
+    }
+
+    def debianJessie = ["debian-jessie"]
+    def debianJessieArchs = []
+    if (params.BUILD_ALL == true) {
+        debianJessieArch = ["armhf", "armel", "amd64", "i386"]
+    } else {
+        debianJessieArch = ["amd64", "i386"]
+    }
+    tasks << getTasks(debianJessie, debianJessieArch, { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    sh "ls -la ."
+                    dir('build/') {
+                        sh "ls -la ."
+                        unstash "static-${arch}"
+                        sh "pwd"
+                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one && file ./zerotier-one" 
+                        sh "mv -f debian/rules.static debian/rules"
+                        sh "make debian"
+                    }
+                    sh "mkdir -p ${distro}"
+                    sh "mv *.deb ${distro}"
+                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
+                }
+                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+            }
+        }
+        return myNode
+    })
+    
+    def ubuntuTrusty = ["ubuntu-trusty"]
+    def ubuntuTrustyArch = []
+    if (params.BUILD_ALL == true) {
+        ubuntuTrustyArch = ["i386", "amd64", "armhf", "arm64", "ppc64le"]
+    } else {
+        ubuntuTrustyArch = ["i386", "amd64"]
+    }
+    tasks << getTasks(ubuntuTrusty, ubuntuTrustyArch, { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    sh "ls -la ."
+                    dir('build/') {
+                        sh "ls -la ."
+                        unstash "static-${arch}"
+                        sh "pwd"
+                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one && file ./zerotier-one" 
+                        sh "mv -f debian/rules.static debian/rules"
+                        sh "make debian"
+                    }
+                    sh "mkdir -p ${distro}"
+                    sh "mv *.deb ${distro}"
+                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
+                }
+                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+            }
+        }
+        return myNode
+    })
+    
+    def debianWheezy = ["debian-wheezy"]
+    def debianWheezyArchs = []
+    if (params.BUILD_ALL == true) {
+        debianWheezyArchs = ["armhf", "armel", "amd64", "i386"]
+    } else {
+        debianWheezyArchs = ["amd64", "i386"]
+    }
+    tasks << getTasks(debianJessie, debianJessieArch, { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    dir('build/') {
+                        unstash "static-${arch}"
+                        sh "mv zerotier-one-static-${arch} zerotier-one && chmod +x zerotier-one && file ./zerotier-one" 
+                        sh "mv -f debian/rules.wheezy.static debian/rules"
+                        sh "mv -f debian/control.wheezy debian/control"
+                        sh "make debian"
+                    }
+                    sh "mkdir -p ${distro}"
+                    sh "mv *.deb ${distro}"
+                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
+                }
+                cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+            }
+        }
+        return myNode
+    })
+    
+    return tasks
+}
+
+def buildDebianNative() {
+    def tasks = [:]
+    def buster = ["debian-buster", "debian-stretch", "debian-bullseye", "debian-sid"]
+    def busterArchs = []
+    if (params.BUILD_ALL) {
+        busterArchs = ["s390x", "ppc64le", "i386", "armhf", "armel", "arm64", "amd64"]
+    } else {
+        busterArchs = ["amd64", "i386"]
+    }
+    
+    def build = { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    dir("build") {
+                        sh 'make debian'
+                    }
+                    sh "mkdir -p ${distro}"
+                    sh "mv *.deb ${distro}"
+                    archiveArtifacts artifacts: "${distro}/*.deb", onlyIfSuccessful: true
+                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+                }
+            }
+        }
+        return myNode
+    }
+    
+    tasks << getTasks(buster, busterArchs, build)
+    
+    // bash is broken when running under QEMU-s390x on Xenial
+    def xenial = ["ubuntu-xenial"]
+    def xenialArchs = []
+    if (params.BUILD_ALL == true) {
+        xenialArchs = ["i386", "amd64", "armhf", "arm64", "ppc64le"]
+    } else {
+        xenialArchs = ["i386", "amd64"]
+    }
+    tasks << getTasks(xenial, xenialArchs, build)
+    
+    def ubuntu = ["ubuntu-bionic", "ubuntu-eoan"]
+    def ubuntuArchs = []
+    if (params.BUILD_ALL == true) {
+        ubuntuArchs = ["i386", "amd64", "armhf", "arm64", "ppc64le", "s390x"]
+    } else {
+        ubuntuArchs = ["i386", "amd64"]
+    }
+    tasks << getTasks(ubuntu, ubuntuArchs, build)
+    
+    def kali = ["kali-rolling"]
+    def kaliArchs = ["amd64"]
+    tasks << getTasks(kali, kaliArchs, build)
+    
+    return tasks
+}
+
+def buildCentosNative() {
+    def tasks = [:]
+    
+    def build = { distro, arch -> 
+        def myNode = {
+            node ('linux-build') {
+                dir ("build") {
+                    checkout scm
+                }
+                def runtime = docker.image("ztbuild/${distro}-${arch}:latest")
+                runtime.inside {
+                    dir("build") {
+                        sh 'make -j4'
+                        sh 'make redhat'
+                        sh "mkdir -p ${distro}"
+                        sh "cp -av `find ~/rpmbuild/ -type f -name \"*.rpm\"` ${distro}/"
+                        archiveArtifacts artifacts: "${distro}/*.rpm", onlyIfSuccessful: true
+                    }
+                    
+                    cleanWs deleteDirs: true, disableDeferredWipeout: true, notFailBuild: true
+                }
+            }
+        }
+        return myNode
+    }
+    
+    def centos8 = ["centos8"]
+    def centos8Archs = []
+    if (params.BUILD_ALL == true) {
+        centos8Archs = ["amd64", "arm64", "ppc64le"]
+    } else {
+        centos8Archs = ["amd64"]
+    }
+    tasks << getTasks(centos8, centos8Archs, build)
+    
+    def centos7 = ["centos7"]
+    def centos7Archs = ["amd64"]
+    tasks << getTasks(centos7, centos7Archs, build)
+    
+    return tasks
+}

LICENSE.txt

@@ -47,7 +47,7 @@ Additional Use Grant: You may make use of the Licensed Work, provided you
                       services, social welfare, senior care, child care, and
                       the care of persons with disabilities.
 
-Change Date:          2023-01-01
+Change Date:          2025-01-01
 
 Change License:       Apache License version 2.0 as published by the Apache
                       Software Foundation

README.md

@@ -5,7 +5,7 @@ ZeroTier is a smart programmable Ethernet switch for planet Earth. It allows all
 
 This is accomplished by combining a cryptographically addressed and secure peer to peer network (termed VL1) with an Ethernet emulation layer somewhat similar to VXLAN (termed VL2). Our VL2 Ethernet virtualization layer includes advanced enterprise SDN features like fine grained access control rules for network micro-segmentation and security monitoring.
 
-All ZeroTier traffic is encrypted end-to-end using secret keys that only you control. Most traffic flows peer to peer, though we offer free (but slow) relaying for users who cannot establish peer to peer connetions.
+All ZeroTier traffic is encrypted end-to-end using secret keys that only you control. Most traffic flows peer to peer, though we offer free (but slow) relaying for users who cannot establish peer to peer connections.
 
 The goals and design principles of ZeroTier are inspired by among other things the original [Google BeyondCorp](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43231.pdf) paper and the [Jericho Forum](https://en.wikipedia.org/wiki/Jericho_Forum) with its notion of "deperimeterization."
 

RELEASE-NOTES.md

@@ -1,6 +1,47 @@
 ZeroTier Release Notes
 ======
 
+# 2020-11-19 -- Version 1.6.0
+
+Version 1.6.0 is a major release that incorporates back-ported features from the 2.0 branch, which is still under development. It also fixes a number of issues.
+
+New features and improvements (including those listed under 1.5.0):
+
+ * **Apple Silicon** (MacOS ARM64) native support via universal binary. ZeroTier now requires the very latest Xcode to build.
+ * **Linux performance improvements** for up to 25% faster tun/tap I/O performance on multi-core systems.
+ * **Multipath support** with modes modeled after the Linux kernel's bonding driver. This includes active-passive and active-active modes with fast failover and load balancing. See section 2.1.5 of the manual.
+ * **DNS configuration** push from network controllers to end nodes, with locally configurable permissions for whether or not push is allowed.
+ * **AES-GMAC-SIV** encryption mode, which is both somewhat more secure and significantly faster than the old Salsa20/12-Poly1305 mode on hardware that supports AES acceleration. This includes virtually all X86-64 chips and most ARM64. This mode is based on AES-SIV and has been audited by Trail of Bits to ensure that it is equivalent security-wise.
+
+Bug fixes:
+
+ * **Managed route assignment fixes** to eliminate missing routes on Linux and what we believe to be the source of sporadic high CPU usage on MacOS.
+ * **Hang on shutdown** issues should be fixed.
+ * **Sporadic multicast outages** should be fixed.
+
+Known remaining issues:
+
+ * AES hardware acceleration is not yet supported on 32-bit ARM, PowerPC (32 or 64), or MIPS (32 or 64) systems. Currently supported are X86-64 and ARM64/AARCH64 with crypto extensions.
+
+# 2020-10-05 -- Version 1.5.0 (actually 1.6.0-beta1)
+
+Version 1.6.0 (1.5.0 is a beta!) is a significant release that incorporates a number of back-ported fixes and features from the ZeroTier 2.0 tree.
+
+Major new features are:
+
+ * **Multipath support** with modes modeled after the Linux kernel's bonding driver. This includes active-passive and active-active modes with fast failover and load balancing. See section 2.1.5 of the manual.
+ * **DNS configuration** push from network controllers to end nodes, with locally configurable permissions for whether or not push is allowed.
+ * **AES-GMAC-SIV** encryption mode, which is both somewhat more secure and significantly faster than the old Salsa20/12-Poly1305 mode on hardware that supports AES acceleration. This includes virtually all X86-64 chips and most ARM64. This mode is based on AES-SIV and has been audited by Trail of Bits to ensure that it is equivalent security-wise.
+
+Known issues that are not yet fixed in this beta:
+
+ * Some Mac users have reported periods of 100% CPU in kernel_task and connection instability after leaving networks that have been joined for a period of time, or needing to kill ZeroTier and restart it to finish leaving a network. This doesn't appear to affect all users and we haven't diagnosed the root cause yet.
+ * The service sometimes hangs on shutdown requiring a kill -9. This also does not affect all systems or users.
+ * AES hardware acceleration is not yet supported on 32-bit ARM, PowerPC (32 or 64), or MIPS (32 or 64) systems. Currently supported are X86-64 and ARM64/AARCH64 with crypto extensions.
+ * Some users have reported multicast/broadcast outages on networks lasting up to 30 seconds. Still investigating.
+
+We're trying to fix all these issues before the 1.6.0 release. Stay tuned.
+
 # 2019-08-30 -- Version 1.4.6
 
  * Update default root list to latest

controller/DB.cpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.
@@ -48,6 +48,8 @@ void DB::initNetwork(nlohmann::json &network)
 			{ "type","ACTION_ACCEPT" }
 		}};
 	}
+	if (!network.count("dns")) network["dns"] = nlohmann::json::array();
+
 	network["objtype"] = "network";
 }
 

controller/DB.hpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.

controller/DBMirrorSet.cpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.

controller/DBMirrorSet.hpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.

controller/EmbeddedNetworkController.cpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.
@@ -456,7 +456,7 @@ static bool _parseRule(json &r,ZT_VirtualNetworkRule &rule)
 
 } // anonymous namespace
 
-EmbeddedNetworkController::EmbeddedNetworkController(Node *node,const char *ztPath,const char *dbPath, int listenPort, MQConfig *mqc) :
+EmbeddedNetworkController::EmbeddedNetworkController(Node *node,const char *ztPath,const char *dbPath, int listenPort, RedisConfig *rc) :
 	_startTime(OSUtils::now()),
 	_listenPort(listenPort),
 	_node(node),
@@ -464,7 +464,7 @@ EmbeddedNetworkController::EmbeddedNetworkController(Node *node,const char *ztPa
 	_path(dbPath),
 	_sender((NetworkController::Sender *)0),
 	_db(this),
-	_mqc(mqc)
+	_rc(rc)
 {
 }
 
@@ -485,7 +485,7 @@ void EmbeddedNetworkController::init(const Identity &signingId,Sender *sender)
 
 #ifdef ZT_CONTROLLER_USE_LIBPQ
 	if ((_path.length() > 9)&&(_path.substr(0,9) == "postgres:")) {
-		_db.addDB(std::shared_ptr<DB>(new PostgreSQL(_signingId,_path.substr(9).c_str(), _listenPort, _mqc)));
+		_db.addDB(std::shared_ptr<DB>(new PostgreSQL(_signingId,_path.substr(9).c_str(), _listenPort, _rc)));
 	} else {
 #endif
 		_db.addDB(std::shared_ptr<DB>(new FileDB(_path.c_str())));
@@ -585,7 +585,7 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpGET(
 							responseBody.reserve((members.size() + 2) * 32);
 							std::string mid;
 							for(auto member=members.begin();member!=members.end();++member) {
-								mid = (*member)["id"];
+								mid = OSUtils::jsonString((*member)["id"], "");
 								char tmp[128];
 								OSUtils::ztsnprintf(tmp,sizeof(tmp),"%s\"%s\":%llu",(responseBody.length() > 1) ? "," : "",mid.c_str(),(unsigned long long)OSUtils::jsonInt((*member)["revision"],0));
 								responseBody.append(tmp);
@@ -1029,6 +1029,26 @@ unsigned int EmbeddedNetworkController::handleControlPlaneHttpPOST(
 						}
 					}
 
+					if (b.count("dns")) {
+						json &dns = b["dns"];
+						if (dns.is_object()) {
+							json nd;
+
+							nd["domain"] = dns["domain"];
+
+							json &srv = dns["servers"];
+							if (srv.is_array()) {
+								json ns = json::array();
+								for(unsigned int i=0;i<srv.size();++i) {
+									ns.push_back(srv[i]);
+								}
+								nd["servers"] = ns;
+							}
+
+							network["dns"] = nd;
+						}
+					}
+
 				} catch ( ... ) {
 					responseBody = "{ \"message\": \"exception occurred while parsing body variables\" }";
 					responseContentType = "application/json";
@@ -1366,6 +1386,7 @@ void EmbeddedNetworkController::_request(
 	nc->mtu = std::max(std::min((unsigned int)OSUtils::jsonInt(network["mtu"],ZT_DEFAULT_MTU),(unsigned int)ZT_MAX_MTU),(unsigned int)ZT_MIN_MTU);
 	nc->multicastLimit = (unsigned int)OSUtils::jsonInt(network["multicastLimit"],32ULL);
 
+	
 	std::string rtt(OSUtils::jsonString(member["remoteTraceTarget"],""));
 	if (rtt.length() == 10) {
 		nc->remoteTraceTarget = Address(Utils::hexStrToU64(rtt.c_str()));
@@ -1392,6 +1413,7 @@ void EmbeddedNetworkController::_request(
 	json &tags = network["tags"];
 	json &memberCapabilities = member["capabilities"];
 	json &memberTags = member["tags"];
+	json &dns = network["dns"];
 
 	if (metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_RULES_ENGINE_REV,0) <= 0) {
 		// Old versions with no rules engine support get an allow everything rule.
@@ -1684,6 +1706,20 @@ void EmbeddedNetworkController::_request(
 			}
 		}
 	}
+	
+	if(dns.is_object()) {
+		std::string domain = OSUtils::jsonString(dns["domain"],"");
+		memcpy(nc->dns.domain, domain.c_str(), domain.size());
+		json &addrArray = dns["servers"];
+		if (addrArray.is_array()) {
+			for(unsigned int j = 0; j < addrArray.size() && j < ZT_MAX_DNS_SERVERS; ++j) {
+				json &addr = addrArray[j];
+				nc->dns.server_addr[j] = InetAddress(OSUtils::jsonString(addr,"").c_str());
+			}
+		}
+	} else {
+		dns = json::object();
+	}
 
 	// Issue a certificate of ownership for all static IPs
 	if (nc->staticIpCount) {

controller/EmbeddedNetworkController.hpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.
@@ -43,8 +43,7 @@
 namespace ZeroTier {
 
 class Node;
-
-struct MQConfig;
+struct RedisConfig;
 
 class EmbeddedNetworkController : public NetworkController,public DB::ChangeListener
 {
@@ -53,7 +52,7 @@ public:
 	 * @param node Parent node
 	 * @param dbPath Database path (file path or database credentials)
 	 */
-	EmbeddedNetworkController(Node *node,const char *ztPath,const char *dbPath, int listenPort, MQConfig *mqc = NULL);
+	EmbeddedNetworkController(Node *node,const char *ztPath,const char *dbPath, int listenPort, RedisConfig *rc);
 	virtual ~EmbeddedNetworkController();
 
 	virtual void init(const Identity &signingId,Sender *sender);
@@ -151,7 +150,7 @@ private:
 	std::unordered_map< _MemberStatusKey,_MemberStatus,_MemberStatusHash > _memberStatus;
 	std::mutex _memberStatus_l;
 
-	MQConfig *_mqc;
+	RedisConfig *_rc;
 };
 
 } // namespace ZeroTier

controller/FileDB.cpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.

controller/FileDB.hpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.

controller/LFDB.cpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.
@@ -48,7 +48,7 @@ LFDB::LFDB(const Identity &myId,const char *path,const char *lfOwnerPrivate,cons
 		char maskingKey [128];
 		Utils::hex(sha512pk,32,maskingKey);
 
-		httplib::Client htcli(_lfNodeHost.c_str(),_lfNodePort,600);
+		httplib::Client htcli(_lfNodeHost.c_str(),_lfNodePort);
 		int64_t timeRangeStart = 0;
 		while (_running.load()) {
 			{

controller/LFDB.hpp

@@ -4,7 +4,7 @@
  * Use of this software is governed by the Business Source License included
  * in the LICENSE.TXT file in the project's root directory.
  *
- * Change Date: 2023-01-01
+ * Change Date: 2025-01-01
  *
  * On the date above, in accordance with the Business Source License, use
  * of this software will be governed by version 2.0 of the Apache License.