// (c) 2020-2023 ZeroTier, Inc. -- currently proprietary pending actual release and licensing. See LICENSE.md.

// HACK! Will eventually use epoll() or something in Phy<> instead of select().
// Also be sure to change ulimit -n and fs.file-max in /etc/sysctl.conf on relays.
#if defined(__linux__) || defined(__LINUX__) || defined(__LINUX) || defined(LINUX)
#include <bits/types.h>
#include <linux/posix_types.h>
#undef __FD_SETSIZE
#define __FD_SETSIZE 1048576
#undef FD_SETSIZE
#define FD_SETSIZE 1048576
#endif

#include "Phy.hpp"

#define ZT_TCP_PROXY_CONNECTION_TIMEOUT_SECONDS 300
#define ZT_TCP_PROXY_TCP_PORT					443
#define INVALID_SOCKET_FD						-1

#include "ZeroTierSockets.h"
#include "ext/libzt/ext/ZeroTierOne/node/Mutex.hpp"

#include <algorithm>
#include <arpa/inet.h>
#include <cstdio>
#include <errno.h>
#include <fcntl.h>
#include <map>
#include <netdb.h>
#include <netinet/in.h>
#include <pthread.h>
#include <set>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/poll.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <vector>

#define SOCKS_OPEN		   0x00
#define SOCKS_CONNECT_INIT 0x01
#define SOCKS_CONNECT_IPV4 0x02
#define SOCKS_UDP		   0x03
#define SOCKS_COMPLETE	   0x04
#define CONNECTION_TIMEOUT 0x05

#define SOCKS_IDX_VERSION 0x00
#define IDX_COMMAND		  0x01
#define IDX_METHOD		  0x01
#define IDX_FRAG		  0x01
#define IDX_ERROR_CODE	  0x01
#define IDX_NMETHODS	  0x01
#define IDX_METHODS		  0x02	 // Supported methods
#define IDX_ATYP		  0x03
#define IDX_DST_ADDR	  0x04

#define THIS_PROXY_VERSION 0x5

#define REPLY_LEN			  10
#define CONNECT_TIMEOUT_S	  10
#define MAX_ADDR_LEN		  32
#define PORT_LEN			  2
#define LISTEN_BACKLOG		  32
#define MAX_PROXY_CONNECTIONS 256
#define BUF_SIZE			  (16 * 1024)
#define SLEEP_INTERVAL		  5000
#define POLL_TIMEOUT_MS		  (500)

#define ZT_FILENAME (strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILE__)

#define ZT_RED	 "\x1B[31m"
#define ZT_GRN	 "\x1B[32m"
#define ZT_YEL	 "\x1B[33m"
#define ZT_BLU	 "\x1B[34m"
#define ZT_MAG	 "\x1B[35m"
#define ZT_CYN	 "\x1B[36m"
#define ZT_WHT	 "\x1B[37m"
#define ZT_RESET "\x1B[0m"

#define LOG_INFO(fmt, args...)	fprintf(stderr, ZT_WHT "%17s:%06d:%25s: " fmt "\n" ZT_RESET, ZT_FILENAME, __LINE__, __FUNCTION__, ##args)
#define LOG_WARN(fmt, args...)	fprintf(stderr, ZT_YEL "%17s:%06d:%25s: " fmt "\n" ZT_RESET, ZT_FILENAME, __LINE__, __FUNCTION__, ##args)
#define LOG_ERROR(fmt, args...) fprintf(stderr, ZT_RED "%17s:%06d:%25s: " fmt "\n" ZT_RESET, ZT_FILENAME, __LINE__, __FUNCTION__, ##args)

#ifdef PYLON_DEBUG
#define LOG_DEBUG(fmt, args...) fprintf(stderr, ZT_WHT "%17s:%06d:%25s: " fmt "\n" ZT_RESET, ZT_FILENAME, __LINE__, __FUNCTION__, ##args)
#else
#if defined(_WIN32)
#define LOG_DEBUG(...)
#else
#define LOG_DEBUG(fmt, args...)
#endif
#endif

ZeroTier::Mutex conn_m;

void* handle_proxy_conn(void* conn_ptr);

enum ConnectDirection { ToZeroTierNetwork, ToLocalAreaNetwork };

struct proxy_connection {
  int state;

  pthread_t handler;
  ConnectDirection direction;

  int fused_closed;	// Whether this fused socket has been closed
  bool shouldStop;

  bool rxStopped;
  bool txStopped;

  int fd_lan;
  int fd_zan;	  // end of socketpair that OS can read and write to (data on this socket is forwarded to and from the ZAN)
  int fd_zts;	  // libzt non-OS socket
  int fd_int;	  // end of socketpair that helper will read and write to
};

struct proxy_connection connections[MAX_PROXY_CONNECTIONS];
pthread_t threads[MAX_PROXY_CONNECTIONS];

// Retrieve data from libzt

void* fused_socket_tx_helper(void* ptr)
{
  struct proxy_connection* conn = (struct proxy_connection*)ptr;
  while (! conn->shouldStop && ! conn->fused_closed) {
    LOG_DEBUG("0x%p A <--- Z: (%2d, %2d, %2d): polling", conn, conn->fd_zan, conn->fd_int, conn->fd_zts);
    struct zts_pollfd fds[1];
    int nfds = 1;
    memset(fds, 0, sizeof(fds));
    fds[0].fd = conn->fd_zts;
    fds[0].events = ZTS_POLLIN;

    int rc = zts_bsd_poll(fds, nfds, POLL_TIMEOUT_MS);

    if (rc < 0) {
      LOG_ERROR("0x%p A <--- Z: poll() failed", conn);
      // perror("");
      usleep(SLEEP_INTERVAL);
      continue;
    }
    if (rc == 0) {
      LOG_DEBUG("0x%p A <--- Z: rc==0", conn);
      usleep(SLEEP_INTERVAL);
      continue;
    }

    for (int i = 0; i < nfds; i++) {
      if (fds[i].revents == 0) {
        LOG_DEBUG("0x%p A <--- Z: revents==0", conn);
        usleep(SLEEP_INTERVAL);
        continue;
      }
      if (fds[i].revents != ZTS_POLLIN) {
        LOG_DEBUG("0x%p A <--- Z: != ZTS_POLLIN", conn);
        usleep(SLEEP_INTERVAL);
        break;
      }
      if (fds[i].fd == conn->fd_zts) {
        usleep(SLEEP_INTERVAL);
        LOG_DEBUG("0x%p A <--- Z: reading from fused zt socket", conn);
        char rx_from_zt_buf[BUF_SIZE];
        int r = zts_read(conn->fd_zts, rx_from_zt_buf, sizeof(rx_from_zt_buf));
        if (r < 0) {
          LOG_DEBUG("0x%p A <--- Z: from fused zt socket (%d)", conn, r);
          // perror("");
          close(conn->fd_int);
          conn->fused_closed = 1;
        }
        if (r > 0) {
          int w = write(conn->fd_int, rx_from_zt_buf, r);
          if (w < 0) {
            LOG_ERROR("0x%p A <--- Z: to zt socket", conn);
            // perror("");
          }
          if (w > 0) {
            LOG_DEBUG("0x%p A <--- Z: wrote %d", conn, w);
          }
        }
      }
    }
  }
  conn->txStopped = true;
  LOG_DEBUG("0x%p A <--- Z: (%2d, %2d, %2d): stopping thread", conn, conn->fd_zan, conn->fd_int, conn->fd_zts);
  return NULL;
}

// Feed data into libzt

void* fused_socket_rx_helper(void* ptr)
{
  struct proxy_connection* conn = (struct proxy_connection*)ptr;
  while (! conn->shouldStop && ! conn->fused_closed) {
    LOG_DEBUG("0x%p A ---> Z: (%2d, %2d, %2d): polling", conn, conn->fd_zan, conn->fd_int, conn->fd_zts);
    struct pollfd fds[1];
    int nfds = 1;
    memset(fds, 0, sizeof(fds));
    fds[0].fd = conn->fd_int;
    fds[0].events = POLLIN;
    int rc = poll(fds, nfds, POLL_TIMEOUT_MS);

    if (rc < 0) {
      LOG_ERROR("0x%p A ---> Z:  poll failed", conn);
      // perror("");
      usleep(SLEEP_INTERVAL);
      continue;
    }
    if (rc == 0) {
      continue;
    }

    for (int i = 0; i < nfds; i++) {
      if (fds[i].revents == 0) {
        continue;
      }
      if (fds[i].revents != POLLIN) {
        usleep(SLEEP_INTERVAL);
      }
      if (fds[i].fd == conn->fd_int) {
        usleep(SLEEP_INTERVAL);
        LOG_DEBUG("0x%p A ---> Z:  reading from fused client socket", conn);
        char rx_from_client_buf[BUF_SIZE];
        int r = read(conn->fd_int, rx_from_client_buf, sizeof(rx_from_client_buf));
        if (r < 0) {
          LOG_DEBUG("0x%p A ---> Z: from fused client socket (%d)", conn, r);
          // perror("");
        }
        if (r > 0) {
          int w = zts_write(conn->fd_zts, rx_from_client_buf, r);
          if (w < 0) {
            LOG_ERROR("0x%p A ---> Z: to zt socket", conn);
            // perror("");
            close(conn->fd_int);
            conn->fused_closed = 1;
          }
          if (w > 0) {
            LOG_DEBUG("0x%p A ---> Z: wrote %d", conn, w);
          }
        }
      }
    }
  }
  conn->rxStopped = true;
  LOG_DEBUG("0x%p A ---> Z: (%2d, %2d, %2d): stopping thread", conn, conn->fd_zan, conn->fd_int, conn->fd_zts);
  return NULL;
}

int zts_fused_socket(int fd_pre_existing, struct proxy_connection* conn)
{
  if (! conn) {
    LOG_ERROR("invalid connection object provided");
    return -1;
  }

  int fd_zts = INVALID_SOCKET_FD;

  if (fd_pre_existing > 0) {
    fd_zts = fd_pre_existing;
  }
  else {
    fd_zts = zts_socket(AF_INET, SOCK_STREAM, 0);
  }
  // Create zt socket
  if (fd_zts < 0) {
    LOG_ERROR("Failed to create zt socket");
    return fd_zts;
  }
  conn->fd_zts = fd_zts;
  // Create socket pair
  int sockets[2];
  int err = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
  if (err < 0) {
    LOG_ERROR("Failed to create socket pair");
    return err;
  }
  conn->fd_zan = sockets[0];
  conn->fd_int = sockets[1];
  conn->fused_closed = 0;

  LOG_DEBUG("fused socket (%d) : [%d:%d <---> %d]", conn->fd_zan, conn->fd_zan, conn->fd_int, conn->fd_zts);

  pthread_t tx_thread;
  pthread_create(&tx_thread, NULL, fused_socket_tx_helper, (void*)conn);
  pthread_t rx_thread;
  pthread_create(&rx_thread, NULL, fused_socket_rx_helper, (void*)conn);

  return 0;
}

void* get_in_addr(struct sockaddr* sa)
{
  if (sa->sa_family == AF_INET) {
    return &(((struct sockaddr_in*)sa)->sin_addr);
  }
  return &(((struct sockaddr_in6*)sa)->sin6_addr);
}

int add_proxy_client_conn(int fd_socks_client, ConnectDirection dir)
{
  conn_m.lock();
  // Find empty connection slot for new proxied connection
  int empty_slot = MAX_PROXY_CONNECTIONS;
  for (int i = 0; i < MAX_PROXY_CONNECTIONS; i++) {
    if (connections[i].state == SOCKS_OPEN) {
      empty_slot = i;
      break;
    }
  }
  if (empty_slot == MAX_PROXY_CONNECTIONS) {
    LOG_ERROR("Max number of proxied connections reached.");
    conn_m.unlock();
    return -1;	 //
  }
  LOG_INFO("0x%p New connection added to slot %d", (void*)&connections[empty_slot], empty_slot);
  if (dir == ConnectDirection::ToZeroTierNetwork) {
    connections[empty_slot].fd_lan = fd_socks_client;
  }
  if (dir == ConnectDirection::ToLocalAreaNetwork) {
    connections[empty_slot].fd_zan = fd_socks_client;
  }
  connections[empty_slot].state = SOCKS_OPEN;
  connections[empty_slot].direction = dir;
  connections[empty_slot].shouldStop = false;
  connections[empty_slot].rxStopped = false;
  connections[empty_slot].txStopped = false;
  pthread_create(&connections[empty_slot].handler, NULL, handle_proxy_conn, (void*)&connections[empty_slot]);
  conn_m.unlock();
  return 0;
}

int proxy_server(char* listen_addr, unsigned short listen_port)
{
  int fd_lan_listen, fd_lan_accept;
  struct addrinfo hints, *servinfo, *p;
  struct sockaddr_storage client_addr;
  socklen_t sin_size;
  struct sigaction sa;
  char s[INET6_ADDRSTRLEN];
  int yes = 1;
  int err;

  memset(&hints, 0, sizeof(hints));
  hints.ai_family = AF_UNSPEC;
  hints.ai_socktype = SOCK_STREAM;
  hints.ai_flags = AI_PASSIVE;

  char port_str[5] = { 0 };
  snprintf(port_str, sizeof(port_str), "%d", listen_port);
  if ((err = getaddrinfo(listen_addr, port_str, &hints, &servinfo)) != 0) {
    LOG_DEBUG("getaddrinfo: %s", gai_strerror(err));
    return 1;
  }
  for (p = servinfo; p != NULL; p = p->ai_next) {
    if ((fd_lan_listen = socket(p->ai_family, p->ai_socktype, p->ai_protocol)) == -1) {
      perror("socket");
      continue;
    }
    if (setsockopt(fd_lan_listen, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)) == -1) {
      perror("setsockopt");
      exit(1);
    }
    if (bind(fd_lan_listen, p->ai_addr, p->ai_addrlen) == -1) {
      close(fd_lan_listen);
      perror("bind");
      continue;
    }
    break;
  }

  freeaddrinfo(servinfo);

  if (p == NULL) {
    LOG_DEBUG("failed to bind");
    exit(1);
  }

  if (listen(fd_lan_listen, LISTEN_BACKLOG) < 0) {
    perror("listen");
    exit(1);
  }

  char* zt_listen_addr = (char*)"0.0.0.0";

  LOG_INFO("Listening for connections via LAN on %s:%d", listen_addr, listen_port);
  LOG_INFO("Listening for connections via ZeroTier network on %s:%d", zt_listen_addr, listen_port);

  // Start listening on ZeroTier network using libzt

  int fd_zt_listen, fd_zt_accept;

  LOG_DEBUG("Creating socket...\n");
  if ((fd_zt_listen = zts_socket(ZTS_AF_INET, ZTS_SOCK_STREAM, 0)) < 0) {
    LOG_ERROR("Error (fd=%d, ret=%d, zts_errno=%d). Exiting.\n", fd_zt_listen, err, zts_errno);
    exit(1);
  }
  LOG_DEBUG("Binding...\n");
  if ((err = zts_bind(fd_zt_listen, zt_listen_addr, listen_port) < 0)) {
    LOG_ERROR("Error (fd=%d, ret=%d, zts_errno=%d). Exiting.\n", fd_zt_listen, err, zts_errno);
    exit(1);
  }
  LOG_DEBUG("Listening...\n");
  if ((err = zts_listen(fd_zt_listen, LISTEN_BACKLOG)) < 0) {
    LOG_ERROR("Error (fd=%d, ret=%d, zts_errno=%d). Exiting.\n", fd_zt_listen, err, zts_errno);
    exit(1);
  }

  // Set listen sockets to non blocking

  zts_set_blocking(fd_zt_listen, false);

  err = fcntl(fd_lan_listen, F_SETFL, fcntl(fd_lan_listen, F_GETFL, 0) | O_NONBLOCK);
  if (err == -1) {
    perror("calling fcntl");
    exit(0);
  }

  // Accept connections

  while (1) {
    sleep(1);
    LOG_DEBUG("Listening poll...");

    // Try to accept ZeroTier virtual network connections

    char remote_ipstr[ZTS_INET6_ADDRSTRLEN] = { 0 };
    unsigned short port = 0;
    if ((fd_zt_accept = zts_accept(fd_zt_listen, remote_ipstr, ZTS_INET6_ADDRSTRLEN, &port)) < 0) {
      // Nothing
    }
    else {
      LOG_INFO("Accepted connection from %s:%d\n", remote_ipstr, port);
      if (add_proxy_client_conn(fd_zt_accept, ConnectDirection::ToLocalAreaNetwork) < 0) {
        zts_close(fd_zt_accept);
      }
    }

    // Try to accept LAN connections

    sin_size = sizeof(client_addr);
    fd_lan_accept = accept(fd_lan_listen, (struct sockaddr*)&client_addr, &sin_size);
    if (fd_lan_accept == -1) {
      // Nothing
    }
    else {
      inet_ntop(client_addr.ss_family, get_in_addr((struct sockaddr*)&client_addr), s, sizeof(s));
      LOG_INFO("Accepted connection from %s", s);
      // TODO: Add port
      if (add_proxy_client_conn(fd_lan_accept, ConnectDirection::ToZeroTierNetwork) < 0) {
        close(fd_lan_accept);
      }
    }
  }
  return 0;
}

void* handle_proxy_conn(void* conn_ptr)
{
  struct proxy_connection* conn = (struct proxy_connection*)conn_ptr;
  if (! conn_ptr) {
    LOG_DEBUG("invalid connection object");
    return NULL;
  }

  if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
    LOG_INFO("0x%p Connection request from LAN to ZeroTier network", (void*)conn);
  }
  if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
    LOG_INFO("0x%p Connection request from ZeroTier network to LAN", (void*)conn);
    zts_fused_socket(conn->fd_zan, conn);
  }

  bool _run = true;

  while (_run) {
    if (conn->fused_closed && conn->state == SOCKS_COMPLETE) {
      LOG_WARN("0x%p shutting down", conn);
      break;
    }

    usleep(SLEEP_INTERVAL);
    int rx_len_client = 0;
    int rx_len_resource = 0;
    char rx_from_client_buf[BUF_SIZE];
    char rx_from_zt_to_client_buf[BUF_SIZE];
    int nfds = 1;
    struct pollfd fds[2];
    memset(fds, 0, sizeof(fds));

    // Poll OS client socket, and OS socketpair end

    if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
      fds[0].fd = conn->fd_lan;
      fds[0].events = POLLIN;
      LOG_DEBUG("0x%p poll (fd_lan:%2d)", conn, fds[0].fd);
      if (conn->state == SOCKS_COMPLETE) {
        fds[1].fd = conn->fd_zan;
        fds[1].events = POLLIN;
        nfds = 2;
        LOG_DEBUG("0x%p poll (fd_zan:%2d)", conn, fds[1].fd);
      }
      LOG_DEBUG("0x%p polling (%d) sockets", conn, nfds);
      int rc = poll(fds, nfds, POLL_TIMEOUT_MS);
      if (rc < 0) {
        LOG_ERROR("0x%p poll failed", conn);
        break;
      }
      if (rc == 0) {
        break;
      }
    }

    // Poll on OS socketpair end and LAN socket

    if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
      fds[0].fd = conn->fd_zan;
      fds[0].events = POLLIN;
      LOG_DEBUG("0x%p poll (fd_zan:%2d)", conn, fds[0].fd);
      if (conn->state == SOCKS_COMPLETE) {
        fds[1].fd = conn->fd_lan;
        fds[1].events = POLLIN;
        nfds = 2;
        LOG_DEBUG("0x%p poll (fd_lan:%2d)", conn, fds[1].fd);
      }
      int rc = poll(fds, nfds, POLL_TIMEOUT_MS);
      if (rc < 0) {
        LOG_ERROR("0x%p poll failed", conn);
        break;
      }
      if (rc == 0) {
        break;
      }
    }

    // Read data in preparation for forwarding

    for (int i = 0; i < nfds; i++) {
      if (fds[i].revents == 0) {
        continue;
      }
      if (fds[i].revents != POLLIN) {
        LOG_ERROR("0x%p != POLLIN (fd=%d)", conn, fds[i].fd);
        _run = false;
        break;
      }

      // Read data from client

      if ((fds[i].fd == conn->fd_lan && conn->direction == ConnectDirection::ToZeroTierNetwork) || (fds[i].fd == conn->fd_zan && conn->direction == ConnectDirection::ToLocalAreaNetwork)) {
        if (fds[i].fd == conn->fd_lan && conn->direction == ConnectDirection::ToZeroTierNetwork) {
          LOG_DEBUG("0x%p RX reading from client socket (OS:%d)", conn, conn->fd_lan);
          rx_len_client = read(conn->fd_lan, rx_from_client_buf, sizeof(rx_from_client_buf));
        }
        if (fds[i].fd == conn->fd_zan && conn->direction == ConnectDirection::ToLocalAreaNetwork) {
          LOG_DEBUG("0x%p RX reading from client socket (OS:%d)", conn, conn->fd_zan);
          rx_len_client = read(conn->fd_zan, rx_from_client_buf, sizeof(rx_from_client_buf));
        }
        if (rx_len_client < 0) {
          LOG_ERROR("0x%p RX read (%d) from client", conn, rx_len_client);
        }
        if (rx_len_client == 0) {
          // Closed connection
          LOG_DEBUG("0x%p RX read (%d) from client", conn, rx_len_client);
          _run = false;
          break;
        }
        if (rx_len_client > 0) {
          LOG_INFO("0x%p RX read (%d) from client", conn, rx_len_client);
        }
      }

      // Read data from resource

      if (conn->state == SOCKS_COMPLETE) {
        if ((fds[i].fd == conn->fd_zan && conn->direction == ConnectDirection::ToZeroTierNetwork) || (fds[i].fd == conn->fd_lan && conn->direction == ConnectDirection::ToLocalAreaNetwork)) {
          if (fds[i].fd == conn->fd_zan && conn->direction == ConnectDirection::ToZeroTierNetwork) {
            LOG_DEBUG("0x%p RX reading from resource socket (OS:%d)", conn, conn->fd_zan);
            rx_len_resource = read(conn->fd_zan, rx_from_zt_to_client_buf, sizeof(rx_from_zt_to_client_buf));
          }
          if (fds[i].fd == conn->fd_lan && conn->direction == ConnectDirection::ToLocalAreaNetwork) {
            LOG_DEBUG("0x%p RX reading from resource socket (OS:%d)", conn, conn->fd_lan);
            rx_len_resource = read(conn->fd_lan, rx_from_zt_to_client_buf, sizeof(rx_from_zt_to_client_buf));
          }
          if (rx_len_resource < 0) {
            LOG_ERROR("0x%p RX read (%d) from resource", conn, rx_len_resource);
            _run = false;
            break;
          }
          if (rx_len_resource > 0) {
            LOG_DEBUG("0x%p RX read (%d) from resource", conn, rx_len_resource);
          }
        }
      }
    }

    // General data forwarding

    if (conn->state == SOCKS_COMPLETE) {
      // Forward traffic from client to resource

      if (rx_len_client > 0) {
        int tx_len_to_resource = -1;
        if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
          LOG_DEBUG("0x%p TX writing (%d) from client to resource (OS:%d)", conn, rx_len_client, conn->fd_zan);
          tx_len_to_resource = write(conn->fd_zan, rx_from_client_buf, rx_len_client);
        }
        if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
          LOG_DEBUG("0x%p TX writing (%d) from client to resource (OS:%d)", conn, rx_len_client, conn->fd_lan);
          tx_len_to_resource = write(conn->fd_lan, rx_from_client_buf, rx_len_client);
        }
        if (tx_len_to_resource < 0) {
          LOG_ERROR("0x%p TX wrote (%d) to resource", conn, tx_len_to_resource);
        }
        if (tx_len_to_resource > 0) {
          LOG_DEBUG("0x%p TX wrote (%d) to resource", conn, tx_len_to_resource);
        }
      }

      // Forward traffic from resource to client

      if (rx_len_resource > 0) {
        int tx_len_to_client = -1;
        if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
          LOG_DEBUG("0x%p TX writing (%d) from resource to client (OS:%d)", conn, rx_len_resource, conn->fd_lan);
          tx_len_to_client = write(conn->fd_lan, rx_from_zt_to_client_buf, rx_len_resource);
        }
        if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
          LOG_DEBUG("0x%p TX writing (%d) from resource to client (ZT:%d)", conn, rx_len_resource, conn->fd_zan);
          tx_len_to_client = write(conn->fd_zan, rx_from_zt_to_client_buf, rx_len_resource);
        }
        if (tx_len_to_client < 0) {
          LOG_ERROR("0x%p TX wrote (%d) to client", conn, tx_len_to_client);
        }
        if (tx_len_to_client > 0) {
          LOG_DEBUG("0x%p TX wrote (%d) to client", conn, tx_len_to_client);
        }
      }
    }

    if (conn->state == SOCKS_OPEN) {
      // SOCKS_OPEN
      // +----+----------+----------+
      // |VER | NMETHODS | METHODS  |
      // +----+----------+----------+
      // | 1  |    1     | 1 to 255 |
      // +----+----------+----------+
      LOG_DEBUG("0x%p SOCKS_OPEN", conn);
      if (rx_len_client >= 3) {
        int version = rx_from_client_buf[SOCKS_IDX_VERSION];
        int methodsLength = rx_from_client_buf[IDX_NMETHODS];
        int firstSupportedMethod = rx_from_client_buf[IDX_METHODS];
        int supportedMethod = 0;
        if (firstSupportedMethod == 2) {
          supportedMethod = firstSupportedMethod;
        }
        LOG_DEBUG("0x%p  <ver=%d, meth_len=%d, supp_meth=%d>", conn, version, methodsLength, supportedMethod);

        // Send METHOD selection msg
        // +----+--------+
        // |VER | METHOD |
        // +----+--------+
        // | 1  |   1    |
        // +----+--------+
        char reply[2];
        reply[SOCKS_IDX_VERSION] = THIS_PROXY_VERSION;
        reply[IDX_METHOD] = supportedMethod;

        if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
          send(conn->fd_lan, reply, sizeof(reply), 0);
        }
        if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
          send(conn->fd_zan, reply, sizeof(reply), 0);
        }
        conn->state = SOCKS_CONNECT_INIT;
        continue;
      }
    }

    if (conn->state == SOCKS_CONNECT_INIT) {
      // SOCKS_CONNECT_INIT
      // +----+-----+-------+------+----------+----------+
      // |VER | CMD |  RSV  | ATYP | DST.ADDR | DST.PORT |
      // +----+-----+-------+------+----------+----------+
      // | 1  |  1  | X'00' |  1   | Variable |    2     |
      // +----+-----+-------+------+----------+----------+
      LOG_DEBUG("0x%p SOCKS_CONNECT_INIT", conn);
      // Ex. 4(meta) + 4(ipv4) + 2(port) = 10
      if (rx_len_client >= 10) {
        int version = rx_from_client_buf[SOCKS_IDX_VERSION];
        int cmd = rx_from_client_buf[IDX_COMMAND];
        int addr_type = rx_from_client_buf[IDX_ATYP];

        LOG_DEBUG("0x%p  <ver=%d, cmd=%d, typ=%d>", conn, version, cmd, addr_type);

        // CONNECT request
        if (cmd == 1) {
          LOG_DEBUG("0x%p cmd=%d", conn, cmd);
          // Ipv4
          if (addr_type == 1) {
            int raw_addr;
            memcpy(&raw_addr, &rx_from_client_buf[4], 4);
            char ipstr[16];
            inet_ntop(AF_INET, &raw_addr, (char*)ipstr, INET_ADDRSTRLEN);
            unsigned short port = 0;
            memcpy(&port, &rx_from_client_buf[8], 2);

            int err = -1;

            // Connect to resource on ZeroTier network

            if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
              zts_fused_socket(INVALID_SOCKET_FD, conn);
              port = ntohs(port);
              LOG_DEBUG("0x%p connecting via zt to: %s:%d", conn, ipstr, port);
              err = zts_connect(conn->fd_zts, ipstr, port, CONNECT_TIMEOUT_S);
              LOG_DEBUG("0x%p conn->fd_zts=(ZT:%d)", conn, conn->fd_zts);
            }

            // Connect to resource on LAN

            if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
              LOG_DEBUG("0x%p connecting via lan to: %s:%d", conn, ipstr, ntohs(port));
              struct sockaddr_in in4;
              in4.sin_family = AF_INET;
              in4.sin_addr.s_addr = raw_addr;
              in4.sin_port = port;
              conn->fd_lan = socket(AF_INET, SOCK_STREAM, 0);
              err = connect(conn->fd_lan, (struct sockaddr*)&in4, sizeof(struct sockaddr));
              LOG_DEBUG("0x%p conn->fd_lan=(OS:%d)", conn, conn->fd_lan);
            }

            if (err < 0) {
              LOG_ERROR("0x%p error establishing connection to resource", conn);
              perror("");
              continue;
            }
            else {
              /*
                +----+-----+-------+------+----------+----------+
                |VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
                +----+-----+-------+------+----------+----------+
                | 1  |  1  | X'00' |  1   | Variable |    2     |
                +----+-----+-------+------+----------+----------+

              Where:

                o  VER    protocol version: X'05'
                o  REP    Reply field:
                o  X'00' succeeded
                o  X'01' general SOCKS server failure
                o  X'02' connection not allowed by ruleset
                o  X'03' Network unreachable
                o  X'04' Host unreachable
                o  X'05' Connection refused
                o  X'06' TTL expired
                o  X'07' Command not supported
                o  X'08' Address type not supported
                o  X'09' to X'FF' unassigned
                o  RSV    RESERVED
                o  ATYP   address type of following address
              */

              // REPLY
              conn->state = SOCKS_COMPLETE;
              char replybuf[REPLY_LEN] = { 0 };
              replybuf[0] = 5;   // ver
              replybuf[1] = 0;   // rep
              replybuf[2] = 0;   // rsv
              replybuf[3] = 1;   // address type

              memcpy(&replybuf[4], &raw_addr, 4);
              short bind_port = htonl(port);
              memcpy(&replybuf[8], &bind_port, 2);

              int reply_len = -1;
              if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
                reply_len = send(conn->fd_lan, replybuf, REPLY_LEN, 0);
              }
              if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
                reply_len = send(conn->fd_zan, replybuf, REPLY_LEN, 0);
              }
              LOG_DEBUG("0x%p SOCKS Replying to client with (%d) bytes", conn, reply_len);
            }
          }
        }
      }
    }
  }
  LOG_INFO("0x%p Closing connection", conn);
  conn_m.lock();
  conn->shouldStop = true;
  conn->state = SOCKS_OPEN;
  LOG_WARN("0x%p waiting for IO threads to stop", conn);
  while (1) {
    usleep(SLEEP_INTERVAL);
    if (conn->txStopped && conn->rxStopped) {
      break;
    }
  }
  if (conn->direction == ConnectDirection::ToZeroTierNetwork) {
    close(conn->fd_lan);
  }
  if (conn->direction == ConnectDirection::ToLocalAreaNetwork) {
    close(conn->fd_zan);
  }
  conn_m.unlock();
  return NULL;
}

void on_zts_event(void* msgPtr)
{
  zts_event_msg_t* msg = (zts_event_msg_t*)msgPtr;
  if (msg->event_code == ZTS_EVENT_NODE_ONLINE) {
    LOG_DEBUG("ZTS_EVENT_NODE_ONLINE: %lx", msg->node->node_id);
  }
  if (msg->event_code == ZTS_EVENT_NODE_OFFLINE) {
    LOG_DEBUG("ZTS_EVENT_NODE_OFFLINE");
  }
  if (msg->event_code == ZTS_EVENT_NETWORK_NOT_FOUND) {
    LOG_DEBUG("ZTS_EVENT_NETWORK_NOT_FOUND: %lx", msg->network->net_id);
  }
  if (msg->event_code == ZTS_EVENT_NETWORK_ACCESS_DENIED) {
    LOG_DEBUG("ZTS_EVENT_NETWORK_ACCESS_DENIED: %lx", msg->network->net_id);
  }
  if (msg->event_code == ZTS_EVENT_ADDR_ADDED_IP4) {
    char ipstr[ZTS_INET6_ADDRSTRLEN] = { 0 };
    struct zts_sockaddr_in* in = (struct zts_sockaddr_in*)&(msg->addr->addr);
    zts_inet_ntop(ZTS_AF_INET, &(in->sin_addr), ipstr, ZTS_INET6_ADDRSTRLEN);
    LOG_DEBUG("ZTS_EVENT_ADDR_NEW_IP: %s", ipstr);
  }
}

using namespace ZeroTier;

/*
 * ZeroTier TCP Proxy Server
 *
 * This implements a simple packet encapsulation that is designed to look like
 * a TLS connection. It's not a TLS connection, but it sends TLS format record
 * headers. It could be extended in the future to implement a fake TLS
 * handshake.
 *
 * At the moment, each packet is just made to look like TLS application data:
 *   <[1] TLS content type> - currently 0x17 for "application data"
 *   <[1] TLS major version> - currently 0x03 for TLS 1.2
 *   <[1] TLS minor version> - currently 0x03 for TLS 1.2
 *   <[2] payload length> - 16-bit length of payload in bytes
 *   <[...] payload> - Message payload
 *
 * TCP is inherently inefficient for encapsulating Ethernet, since TCP and TCP
 * like protocols over TCP lead to double-ACKs. So this transport is only used
 * to enable access when UDP or other datagram protocols are not available.
 *
 * Clients send a greeting, which is a four-byte message that contains:
 *   <[1] ZeroTier major version>
 *   <[1] minor version>
 *   <[2] revision>
 *
 * If a client has sent a greeting, it uses the new version of this protocol
 * in which every encapsulated ZT packet is prepended by an IP address where
 * it should be forwarded (or where it came from for replies). This causes
 * this proxy to act as a remote UDP socket similar to a socks proxy, which
 * will allow us to move this function off the rootservers and onto dedicated
 * proxy nodes.
 *
 * Older ZT clients that do not send this message get their packets relayed
 * to/from 127.0.0.1:9993, which will allow them to talk to and relay via
 * the ZT node on the same machine as the proxy. We'll only support this for
 * as long as such nodes appear to be in the wild.
 */

struct TcpProxyService;

struct TcpProxyService {
  Phy<TcpProxyService*>* phy;
  int udpPortCounter;
  struct Client {
    char tcpReadBuf[131072];
    char tcpWriteBuf[131072];
    unsigned long tcpWritePtr;
    unsigned long tcpReadPtr;
    PhySocket* tcp;
    PhySocket* udp;
    time_t lastActivity;
    bool newVersion;
  };
  std::map<PhySocket*, Client> clients;

  PhySocket* getUnusedUdp(void* uptr)
  {
    for (int i = 0; i < 65535; ++i) {
      ++udpPortCounter;
      if (udpPortCounter > 0xfffe) {
        udpPortCounter = 1024;
      }
      struct sockaddr_in laddr;
      memset(&laddr, 0, sizeof(struct sockaddr_in));
      laddr.sin_family = AF_INET;
      laddr.sin_port = htons((uint16_t)udpPortCounter);
      PhySocket* udp = phy->udpBind(reinterpret_cast<struct sockaddr*>(&laddr), uptr);
      if (udp) {
        return udp;
      }
    }
    return (PhySocket*)0;
  }

  void phyOnDatagram(PhySocket* sock, void** uptr, const struct sockaddr* localAddr, const struct sockaddr* from, void* data, unsigned long len)
  {
    if (! *uptr) {
      return;
    }
    if ((from->sa_family == AF_INET) && (len >= 16) && (len < 2048)) {
      Client& c = *((Client*)*uptr);
      c.lastActivity = time((time_t*)0);

      unsigned long mlen = len;
      if (c.newVersion) {
        mlen += 7;	 // new clients get IP info
      }

      if ((c.tcpWritePtr + 5 + mlen) <= sizeof(c.tcpWriteBuf)) {
        if (! c.tcpWritePtr) {
          phy->setNotifyWritable(c.tcp, true);
        }

        c.tcpWriteBuf[c.tcpWritePtr++] = 0x17;	 // look like TLS data
        c.tcpWriteBuf[c.tcpWritePtr++] = 0x03;	 // look like TLS 1.2
        c.tcpWriteBuf[c.tcpWritePtr++] = 0x03;	 // look like TLS 1.2

        c.tcpWriteBuf[c.tcpWritePtr++] = (char)((mlen >> 8) & 0xff);
        c.tcpWriteBuf[c.tcpWritePtr++] = (char)(mlen & 0xff);

        if (c.newVersion) {
          c.tcpWriteBuf[c.tcpWritePtr++] = (char)4;	// IPv4
          *((uint32_t*)(c.tcpWriteBuf + c.tcpWritePtr)) = ((const struct sockaddr_in*)from)->sin_addr.s_addr;
          c.tcpWritePtr += 4;
          *((uint16_t*)(c.tcpWriteBuf + c.tcpWritePtr)) = ((const struct sockaddr_in*)from)->sin_port;
          c.tcpWritePtr += 2;
        }

        for (unsigned long i = 0; i < len; ++i) {
          c.tcpWriteBuf[c.tcpWritePtr++] = ((const char*)data)[i];
        }
      }

      printf("<< UDP %s:%d -> %.16llx\n", inet_ntoa(reinterpret_cast<const struct sockaddr_in*>(from)->sin_addr), (int)ntohs(reinterpret_cast<const struct sockaddr_in*>(from)->sin_port), (unsigned long long)&c);
    }
  }

  void phyOnTcpConnect(PhySocket* sock, void** uptr, bool success)
  {
    // unused, we don't initiate outbound connections
  }

  void phyOnTcpAccept(PhySocket* sockL, PhySocket* sockN, void** uptrL, void** uptrN, const struct sockaddr* from)
  {
    Client& c = clients[sockN];
    PhySocket* udp = getUnusedUdp((void*)&c);
    if (! udp) {
      phy->close(sockN);
      clients.erase(sockN);
      printf("** TCP rejected, no more UDP ports to assign\n");
      return;
    }
    c.tcpWritePtr = 0;
    c.tcpReadPtr = 0;
    c.tcp = sockN;
    c.udp = udp;
    c.lastActivity = time((time_t*)0);
    c.newVersion = false;
    *uptrN = (void*)&c;
    printf("<< TCP from %s -> %.16llx\n", inet_ntoa(reinterpret_cast<const struct sockaddr_in*>(from)->sin_addr), (unsigned long long)&c);
  }

  void phyOnTcpClose(PhySocket* sock, void** uptr)
  {
    if (! *uptr) {
      return;
    }
    Client& c = *((Client*)*uptr);
    phy->close(c.udp);
    clients.erase(sock);
    printf("** TCP %.16llx closed\n", (unsigned long long)*uptr);
  }

  void phyOnTcpData(PhySocket* sock, void** uptr, void* data, unsigned long len)
  {
    Client& c = *((Client*)*uptr);
    c.lastActivity = time((time_t*)0);

    for (unsigned long i = 0; i < len; ++i) {
      if (c.tcpReadPtr >= sizeof(c.tcpReadBuf)) {
        phy->close(sock);
        return;
      }
      c.tcpReadBuf[c.tcpReadPtr++] = ((const char*)data)[i];

      if (c.tcpReadPtr >= 5) {
        unsigned long mlen = (((((unsigned long)c.tcpReadBuf[3]) & 0xff) << 8) | (((unsigned long)c.tcpReadBuf[4]) & 0xff));
        if (c.tcpReadPtr >= (mlen + 5)) {
          if (mlen == 4) {
            // Right now just sending this means the client is 'new enough' for the IP header
            c.newVersion = true;
            printf("<< TCP %.16llx HELLO\n", (unsigned long long)*uptr);
          }
          else if (mlen >= 7) {
            char* payload = c.tcpReadBuf + 5;
            unsigned long payloadLen = mlen;

            struct sockaddr_in dest;
            memset(&dest, 0, sizeof(dest));
            if (c.newVersion) {
              if (*payload == (char)4) {
                // New clients tell us where their packets go.
                ++payload;
                dest.sin_family = AF_INET;
                dest.sin_addr.s_addr = *((uint32_t*)payload);
                payload += 4;
                dest.sin_port = *((uint16_t*)payload);	 // will be in network byte order already
                payload += 2;
                payloadLen -= 7;
              }
            }
            else {
              // For old clients we will just proxy everything to a local ZT instance. The
              // fact that this will come from 127.0.0.1 will in turn prevent that instance
              // from doing unite() with us. It'll just forward. There will not be many of
              // these.
              dest.sin_family = AF_INET;
              dest.sin_addr.s_addr = htonl(0x7f000001);	// 127.0.0.1
              dest.sin_port = htons(9993);
            }

            // Note: we do not relay to privileged ports... just an abuse prevention rule.
            if ((ntohs(dest.sin_port) > 1024) && (payloadLen >= 16)) {
              phy->udpSend(c.udp, (const struct sockaddr*)&dest, payload, payloadLen);
              printf(">> TCP %.16llx to %s:%d\n", (unsigned long long)*uptr, inet_ntoa(dest.sin_addr), (int)ntohs(dest.sin_port));
            }
          }

          memmove(c.tcpReadBuf, c.tcpReadBuf + (mlen + 5), c.tcpReadPtr -= (mlen + 5));
        }
      }
    }
  }

  void phyOnTcpWritable(PhySocket* sock, void** uptr)
  {
    Client& c = *((Client*)*uptr);
    if (c.tcpWritePtr) {
      long n = phy->streamSend(sock, c.tcpWriteBuf, c.tcpWritePtr);
      if (n > 0) {
        memmove(c.tcpWriteBuf, c.tcpWriteBuf + n, c.tcpWritePtr -= (unsigned long)n);
        if (! c.tcpWritePtr) {
          phy->setNotifyWritable(sock, false);
        }
      }
    }
    else {
      phy->setNotifyWritable(sock, false);
    }
  }

  void doHousekeeping()
  {
    std::vector<PhySocket*> toClose;
    time_t now = time((time_t*)0);
    for (std::map<PhySocket*, Client>::iterator c(clients.begin()); c != clients.end(); ++c) {
      if ((now - c->second.lastActivity) >= ZT_TCP_PROXY_CONNECTION_TIMEOUT_SECONDS) {
        toClose.push_back(c->first);
        toClose.push_back(c->second.udp);
      }
    }
    for (std::vector<PhySocket*>::iterator s(toClose.begin()); s != toClose.end(); ++s) {
      phy->close(*s);
    }
  }
};

int reflect(int argc, char** argv)
{
  signal(SIGPIPE, SIG_IGN);
  signal(SIGHUP, SIG_IGN);
  srand(time((time_t*)0));

  TcpProxyService svc;
  Phy<TcpProxyService*> phy(&svc, false, true);
  svc.phy = &phy;
  svc.udpPortCounter = 1023;

  {
    struct sockaddr_in laddr;
    memset(&laddr, 0, sizeof(laddr));
    laddr.sin_family = AF_INET;
    laddr.sin_port = htons(ZT_TCP_PROXY_TCP_PORT);
    if (! phy.tcpListen((const struct sockaddr*)&laddr)) {
      fprintf(stderr, "%s: fatal error: unable to bind TCP port %d\n", argv[0], ZT_TCP_PROXY_TCP_PORT);
      return 1;
    }
  }

  time_t lastDidHousekeeping = time((time_t*)0);
  for (;;) {
    phy.poll(120000);
    time_t now = time((time_t*)0);
    if ((now - lastDidHousekeeping) > 120) {
      lastDidHousekeeping = now;
      svc.doHousekeeping();
    }
  }

  return 0;
}

void emit_status_blob(const char* listen_addr, const int listen_port, uint64_t net_id)
{
  char config_str[1024] = { 0 };
  snprintf(
    config_str,
    sizeof(config_str),
    "{ \
 \n\t\"listen_addr\":%s, \
 \n\t\"listen_port\":%d, \
 \n\t\"node_id\":%lx, \
  \n\t\"net_id\":%lx \
\n}",
    listen_addr,
    listen_port,
    zts_node_get_id(),
    net_id);

  fprintf(stdout, "%s\n", config_str);
}

enum PylonMode { Invalid, PeerToPeer, Relayed };

int main(int argc, char** argv)
{
  if (argc == 2) {
    // In this mode, pylon will function as a network-agnostic TCP proxy for ZeroTier traffic
    if (strcmp(argv[1], "reflect")) {
      fprintf(stderr, "Invalid mode. Specify either [pylon reflect] or [pylon refract]\n");
      exit(0);
    }
    fprintf(stderr, "Relaying ZeroTier traffic on port %d\n", ZT_TCP_PROXY_TCP_PORT);
    reflect(argc, argv);
    exit(0);
  }

  PylonMode mode = PylonMode::Invalid;

  if (argc == 7) {
    // In this mode, pylon will proxy connections between the physical LAN and the ZeroTier virtual network
    if (strcmp(argv[1], "refract")) {
      fprintf(stderr, "Invalid mode. Specify either [pylon reflect] or [pylon refract]\n");
      exit(0);
    }
    if (strcmp(argv[3], "--listen-addr")) {
      fprintf(stderr, "Invalid configuration. Specify a local listening address with --listen-addr\n");
      exit(0);
    }
    if (strcmp(argv[5], "--listen-port")) {
      fprintf(stderr, "Invalid configuration. Specify a local listening port with --listen-port\n");
      exit(0);
    }
    mode = PylonMode::PeerToPeer;
    LOG_INFO("Running pylon instance in P2P mode");
  }
  if (argc == 11) {
    // In this mode, pylon will proxy connections between the physical LAN and the ZeroTier virtual network (via a relay)
    if (strcmp(argv[1], "refract")) {
      fprintf(stderr, "Invalid mode. Specify either [pylon reflect] or [pylon refract]\n");
      exit(0);
    }
    if (strcmp(argv[3], "--listen-addr")) {
      fprintf(stderr, "Invalid configuration. Specify a local listening address with --listen-addr\n");
      exit(0);
    }
    if (strcmp(argv[5], "--listen-port")) {
      fprintf(stderr, "Invalid configuration. Specify a local listening port with --listen-port\n");
      exit(0);
    }
    if (strcmp(argv[7], "--relay-addr")) {
      fprintf(stderr, "Invalid configuration. Specify a relay address with --relay-addr\n");
      exit(0);
    }
    if (strcmp(argv[9], "--relay-port")) {
      fprintf(stderr, "Invalid configuration. Specify a relay port with --relay-port\n");
      exit(0);
    }
    mode = PylonMode::Relayed;
    LOG_INFO("Running pylon instance in RELAYED mode (a [pylon reflect] instance is also required)");
  }

  if (mode == PylonMode::Invalid) {
    fprintf(stderr, "\nUsage:\n\n");
    fprintf(stderr, "pylon refract <net_id> --listen-addr 0.0.0.0 --listen-port 1080 --relay-addr 1.2.3.4 --relay-port 443\n");
    exit(0);
  }

  long long int net_id = strtoull(argv[2], NULL, 16);
  char* listen_addr = argv[4];
  unsigned int listen_port = atoi(argv[6]);

  const char* env_secret_key = getenv("ZT_PYLON_SECRET_KEY");
  const char* env_whitelisted_port = getenv("ZT_PYLON_WHITELISTED_PORT");

  if (! env_secret_key) {
    LOG_ERROR("No secret key provided. Set ZT_PYLON_SECRET_KEY");
    exit(0);
  }

  // Determine which port ZeroTier should use for UDP transport (if any at all)

  if (env_whitelisted_port) {
    if (mode == PylonMode::Relayed) {
      LOG_WARN("Whitelisted UDP port was specified but relay mode will ignore it and only use TCP/443");
    }
    else {
      LOG_INFO("ZT_PYLON_WHITELISTED_PORT set, using UDP/%s for ZeroTier transport", env_whitelisted_port);
      if (zts_init_set_port(atoi(env_whitelisted_port)) < ZTS_ERR_OK) {
        LOG_ERROR("Failed to set ZeroTier transport port. Exiting.");
        exit(0);
      }
    }
  }
  else {
    if (mode == PylonMode::PeerToPeer) {
      LOG_WARN("No udp port set, picking random");
      zts_init_set_port(0);
    }
  }

  // Initialize node

  int err = ZTS_ERR_OK;

  zts_init_set_event_handler(&on_zts_event);

  char* tcp_relay_addr = (char*)"0.0.0.0";
  unsigned short tcp_relay_port = 443;

  if (mode == PylonMode::Relayed) {
    LOG_WARN("Configuring Pylon to use relay: %s:%d", tcp_relay_addr, tcp_relay_port);
    zts_init_allow_tcp_relay(1);
    zts_init_force_tcp_relay(1);
    zts_init_set_tcp_relay(tcp_relay_addr, tcp_relay_port);
  }

  if ((err = zts_init_from_memory(env_secret_key, strlen(env_secret_key))) != ZTS_ERR_OK) {
    LOG_ERROR("Failed to start zt node. Contents of ZT_PYLON_SECRET_KEY may be invalid, error = %d. Exiting.", err);
    exit(1);
  }

  // Start node

  if ((err = zts_node_start()) != ZTS_ERR_OK) {
    LOG_ERROR("Failed to start zt node, error = %d. Exiting.", err);
    exit(1);
  }

  LOG_INFO("Waiting for zt node to come online...");
  while (! zts_node_is_online()) {
    zts_util_delay(25);
  }

  // LOG_DEBUG("zt port = %d", zts_node_get_port());
  LOG_INFO("zt node: %lx", zts_node_get_id());

  // Join network

  LOG_INFO("Joining network %llx ... (please authorize)", net_id);
  if (zts_net_join(net_id) != ZTS_ERR_OK) {
    LOG_DEBUG("Failed to join network. Exiting.");
    exit(1);
  }
  LOG_INFO("Waiting for network join to complete");
  while (! zts_net_transport_is_ready(net_id)) {
    zts_util_delay(25);
  }
  int family = zts_util_get_ip_family(listen_addr);
  LOG_INFO("Waiting for address assignment from network...");
  while (! (zts_addr_is_assigned(net_id, family))) {
    zts_util_delay(25);
  }
  char ipstr[ZTS_IP_MAX_STR_LEN] = { 0 };
  zts_addr_get_str(net_id, family, ipstr, ZTS_IP_MAX_STR_LEN);
  LOG_INFO("Address on network %llx is %s", net_id, ipstr);

  emit_status_blob(listen_addr, listen_port, net_id);

  proxy_server(listen_addr, listen_port);

  return zts_node_stop();
}