diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b9e1f49..c0ab130 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,14 +31,14 @@ jobs: - name: selftest run: | make selftest - ./zerotier-selftest + ./backone-selftest - name: 'Tar files' # keeps permissions (execute) - run: tar -cvf zerotier-one.tar zerotier-one + run: tar -cvf backone.tar backone - name: Archive production artifacts uses: actions/upload-artifact@v4 with: - name: zerotier-one-ubuntu-x64 - path: zerotier-one.tar + name: backone-ubuntu-x64 + path: backone.tar retention-days: 7 build_macos: @@ -75,14 +75,14 @@ jobs: - name: selftest run: | make selftest - ./zerotier-selftest + ./backone-selftest - name: 'Tar files' # keeps permissions (execute) - run: tar -cvf zerotier-one.tar zerotier-one + run: tar -cvf backone.tar backone - name: Archive production artifacts uses: actions/upload-artifact@v4 with: - name: zerotier-one-mac - path: zerotier-one.tar + name: backone-mac + path: backone.tar retention-days: 7 @@ -118,6 +118,6 @@ jobs: - name: Archive production artifacts uses: actions/upload-artifact@v4 with: - name: zerotier-one-windows + name: backone-windows path: windows/Build retention-days: 7 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..5cd2e7d --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,25 @@ +name: Lint + +on: + push: + pull_request: + +jobs: + clang-format: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + # Pin: format results differ across clang-format versions. + - run: pip install --user clang-format==23.1.1 && echo "$HOME/.local/bin" >> "$GITHUB_PATH" + - name: Check changed lines + run: | + if [ "${{ github.event_name }}" = "pull_request" ]; then + BASE="${{ github.event.pull_request.base.sha }}" + elif [ "${{ github.event.before }}" != "" ] && [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then + BASE="${{ github.event.before }}" + else + BASE="$(git merge-base HEAD "origin/${{ github.event.repository.default_branch }}" || echo HEAD~1)" + fi + ./tools/lint.sh "$BASE" diff --git a/.github/workflows/validate-linux.sh b/.github/workflows/validate-linux.sh index a661f6f..08a679f 100755 --- a/.github/workflows/validate-linux.sh +++ b/.github/workflows/validate-linux.sh @@ -38,9 +38,9 @@ test() { export NS1="ip netns exec ns1" export NS2="ip netns exec ns2" - export ZT1="$NS1 ./zerotier-cli -p9996 -D$(pwd)/node1" + export ZT1="$NS1 ./backone-cli -p9996 -D$(pwd)/node1" # Specify custom port on one node to ensure that feature works - export ZT2="$NS2 ./zerotier-cli -p9997 -D$(pwd)/node2" + export ZT2="$NS2 ./backone-cli -p9997 -D$(pwd)/node2" echo -e "\nSetting up network namespaces..." echo "Setting up ns1" @@ -102,13 +102,13 @@ test() { --xml=yes \ --xml-file=$FILENAME_MEMORY_LOG \ --leak-check=full \ - ./zerotier-one node1 -p$ZT_PORT_NODE_1 -U >>node_1.log 2>&1 & + ./backone node1 -p$ZT_PORT_NODE_1 -U >>node_1.log 2>&1 & # Second instance, not run in memory profiler # Don't set up internet access until _after_ zerotier is running # This has been a source of stuckness in the past. $NS2 ip addr del 192.168.1.2/24 dev veth3 - $NS2 sudo ./zerotier-one node2 -U -p$ZT_PORT_NODE_2 >>node_2.log 2>&1 & + $NS2 sudo ./backone node2 -U -p$ZT_PORT_NODE_2 >>node_2.log 2>&1 & sleep 10; # New HTTP control plane is a bit sluggish, so we delay here @@ -170,9 +170,9 @@ test() { echo -e "\n\nRunning ZeroTier processes:" echo -e "\nNode 1:\n" - $NS1 ps aux | grep zerotier-one + $NS1 ps aux | grep backone echo -e "\nNode 2:\n" - $NS2 ps aux | grep zerotier-one + $NS2 ps aux | grep backone echo -e "\n\nStatus of each instance:" @@ -319,10 +319,10 @@ exit_test_and_generate_report() { node2_id=$($ZT2 -j status | jq -r .address) $ZT1 dump - mv zerotier_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node1_id.txt" + mv backone_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node1_id.txt" $ZT2 dump - mv zerotier_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node2_id.txt" + mv backone_dump.txt "$TEST_FILEPATH_PREFIX-node-dump-$node2_id.txt" # Copy ZeroTier stdout/stderr logs @@ -386,7 +386,7 @@ exit_test_and_generate_report() { "commit":"$ZTO_COMMIT", "arch_m":"$(uname -m)", "arch_a":"$(uname -a)", - "binary_size":"$(stat -c %s zerotier-one)", + "binary_size":"$(stat -c %s backone)", "time_length_test":$time_length_test, "time_to_both_nodes_online":$time_to_both_nodes_online, "num_possible_bytes_lost": $POSSIBLY_LOST, @@ -448,7 +448,7 @@ spam_cli() { check_exit_on_invalid_identity() { echo "Checking ZeroTier exits on invalid identity..." mkdir -p $(pwd)/exit_test - ZT1="sudo ./zerotier-one -p9999 $(pwd)/exit_test" + ZT1="sudo ./backone -p9999 $(pwd)/exit_test" echo "asdfasdfasdfasdf" > $(pwd)/exit_test/identity.secret echo "asdfasdfasdfasdf" > $(pwd)/exit_test/authtoken.secret @@ -473,20 +473,20 @@ check_exit_on_invalid_identity() { check_bind_to_correct_ports() { PORT_NUMBER=$1 echo "Checking bound ports:" - sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" - if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "tcp") ]]; + sudo netstat -anp | grep "$PORT_NUMBER" | grep "backone" + if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "backone" | grep "tcp") ]]; then : else exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to tcp/$1" fi - if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "tcp6") ]]; + if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "backone" | grep "tcp6") ]]; then : else exit_test_and_generate_report $TEST_FAIL "ZeroTier did not bind to tcp6/$1" fi - if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "zerotier" | grep "udp") ]]; + if [[ $(sudo netstat -anp | grep "$PORT_NUMBER" | grep "backone" | grep "udp") ]]; then : else diff --git a/.gitignore b/.gitignore index 1288cb9..4eb6de3 100755 --- a/.gitignore +++ b/.gitignore @@ -154,3 +154,7 @@ rustybits/ backone backone-cli backone-idtool + +/backone-selftest +*.gcno +*.gcda diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..0ea2785 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,117 @@ +# Repository Guidelines + +## Project Overview + +BackOne — fork of ZeroTier 1.14.1: peer-to-peer SDN daemon. Builds virtual Ethernet (TUN/TAP), tunnels L2 frames over encrypted UDP mesh, issues membership certs from an embedded controller. One fat binary `backone` doubles as CLI (`backone-cli`) and identity tool (`backone-idtool`) via `argv[0]` dispatch (`one.cpp:2140-2142`). Local JSON API on `127.0.0.1:9993`. + +## Architecture & Data Flow + +Four layers, top → bottom: + +1. **Entry** — `one.cpp`: `main()` → `cli()` / `idtool()` / daemon → `OneService::newInstance()` + `run()`. +2. **Service** — `service/OneService.cpp` (`OneServiceImpl`, line 776): owns sockets (`Phy<>`), httplib control plane, TAP devices, `Node`, `EmbeddedNetworkController`, main loop. +3. **Core** — `node/`: OS-independent switch. Reached only through the C API (`ZT_Node_*` in `include/ZeroTierOne.h`, implemented at bottom of `node/Node.cpp`). +4. **OS glue** — `osdep/`: `Phy` (select()-based reactor, the only event loop), `EthernetTap` (per-OS TUN/TAP), `OSUtils`, `ManagedRoute`, `Thread`, `BlockingQueue`. + +**Core pattern = inversion of control.** `OneServiceImpl` fills `struct ZT_Node_Callbacks` (`service/OneService.cpp:1045-1054`) with `Snode*` static functions; `node/` never touches OS code, it calls back. Shared context is `RuntimeEnvironment` passed as `const RuntimeEnvironment *RR` to every `node/` function (`node/RuntimeEnvironment.hpp`). + +Flows: + +- **Wire → app:** `Phy::poll` → `phyOnDatagram` (`service/OneService.cpp:2940`) → `Node::processWirePacket` (`node/Node.cpp:206`) → `Switch::onRemotePacket` → verb dispatch `switch` (`node/IncomingPacket.cpp:94-151`) → peer/network/crypto. Heavy work offloaded to `PacketMultiplexer` worker threads. +- **App → wire:** TAP handler → `tapFrameHandler` (`service/OneService.cpp:3776`) → `Node::processVirtualNetworkFrame` → `Switch::onLocalEthernet` → `Peer`/`Path` → `_phy.udpSend`. +- **Controller:** `IncomingPacket::_doNETWORK_CONFIG_REQUEST` → `EmbeddedNetworkController::request` posts `_RQEntry*` to `BlockingQueue` → `hardware_concurrency()` workers → `DBMirrorSet`/`DB` → signed cert back via `NetworkController::Sender`. +- **Main loop** (`OneServiceImpl::run`, `service/OneService.cpp:~1150-1310`): single-threaded, time-sliced; refresh binds → `processBackgroundTasks` when due → `_phy.poll(delay)`. `Phy::whack()` (self-pipe) is the only cross-thread-safe Phy call. + +## Key Directories + +| Path | Purpose | +|---|---| +| `one.cpp` | Daemon/CLI/idtool entry; privilege drop, daemonize, signals | +| `node/` | Overlay engine: `Switch`, `Topology`, `Peer`, `IncomingPacket`, `Identity`, `Bond`, `Metrics` — OS-independent by rule | +| `service/` | `OneService` (whole runtime), `SoftwareUpdater` | +| `controller/` | `EmbeddedNetworkController` + `DB` backends (FileDB default, LFDB, PostgreSQL, Redis) | +| `osdep/` | All OS-dependent code: `Phy`, `EthernetTap*`, `Binder`, `ManagedRoute`, netlink/DNS helpers | +| `include/` | Public C API (`ZeroTierOne.h`, 57KB) — changes ripple to Java/libzt/SDK | +| `ext/` | Vendored: nlohmann/json, cpp-httplib, prometheus-cpp-lite, libpqxx, redis++, miniupnpc, ASM crypto | +| `rustybits/` | Cargo workspace: `zeroidc` (SSO FFI), `smeeclient` (PostgreSQL workflow client) | +| `java/` | JNI wrapper (`java/jni/…Node.cpp`, ant build) | +| `tcp-proxy/` | Standalone TCP fallback relay; own Makefile (C++11) | +| `rule-compiler/` | JS network-rules compiler (`node cli.js `), npm | +| `pkg/`, `debian/`, `windows/` | Packaging (snap/QNAP/Synology/ASUSTOR/WD, RPM `backone.spec`, MSVC sln) | + +## Development Commands + +```sh +make # = make one → ./backone + backone-cli/backone-idtool symlinks +make -j$(nproc) one +make core # libbackonecore.a +make selftest && ./backone-selftest +make debug # ZT_DEBUG=1 (adds -g, forces ZT_TRACE=1) +make ZT_SANITIZE=1 one # ASan +make central-controller # ZT_CONTROLLER=1 (needs ext/ libpqxx + hiredis + redis++) +make install DESTDIR=/tmp/root +make debian | make redhat # debuild / rpmbuild +make manpages # cd doc && ./build.sh (needs ronn or node marked-man) +cd rustybits && cargo build # zeroidc/smeeclient (also auto via `make zeroidc`) +cd java && ant build_java | build_android | build_jar +cd tcp-proxy && make +``` + +`Makefile` is a uname dispatcher → `make-linux.mk` / `make-mac.mk` / `make-bsd.mk` / `make-netbsd.mk`. Windows: `MSBuild windows/ZeroTierOne.sln /property:Configuration=Release`. Top-level `CMakeLists.txt` is a 323B stub — never `cmake .` as product build. + +Env knobs (make vars): `ZT_DEBUG`, `ZT_TRACE`, `ZT_SANITIZE`, `ZT_STATIC`, `ZT_OFFICIAL`, `ZT_CONTROLLER`, `ZT_SSO_SUPPORTED` (0 on Linux default → no cargo needed), `ZT_VAULT_SUPPORT`, `ZT_IA32`. + +## Code Conventions & Common Patterns + +- **Standard: C++17** (`-std=c++17` in all makefiles; `tcp-proxy` is C++11). Ignore stale comments claiming otherwise (`node/README.md` "No C++11", `osdep/BlockingQueue.hpp:30`). +- **Formatting**: `.clang-format` — LLVM base, **tabs always**, indent 4, Stroustrup braces, `BinPackArguments: false`, `PointerAlignment: Left`. Gate: `make lint` → `tools/lint.sh` (clang-format on lines changed vs base commit; `--all` checks whole files — whole repo has format debt, don't reformat untouched lines). No clang-tidy, no `-Werror`. +- **Namespace**: everything in `namespace ZeroTier { … }`, close with `} // namespace ZeroTier`. File-local helpers in anonymous namespace or `static`. +- **Naming**: classes `PascalCase`; methods `camelCase`; private members `_camelCase`; static C callbacks `S` + class (`SnodeWirePacketSendFunction`); macros/enums `ZT_UPPER_SNAKE`; include guards `ZT__HPP` (no `#pragma once`). +- **Includes**: quoted relative (`"../node/Constants.hpp"` from subdirs, `"node/Constants.hpp"` from root). Third-party via angle brackets resolved by `-isystem ext`. `node/Constants.hpp` FIRST in `node/` files — canonicalizes `__LINUX__`/`__APPLE__`/`__UNIX_LIKE__`/`__WINDOWS__`; never test raw `__linux__`/`_WIN32`. +- **Error handling**: three regimes — (1) C API boundary returns `ZT_ResultCode`, fatal = 100–999, checked via `ZT_ResultCode_isFatal`; (2) `node/` throws bare ints (`ZT_EXCEPTION_OUT_OF_BOUNDS`, `node/Constants.hpp:757+`), caught as `catch (int e)` in `OneServiceImpl::run`; (3) service/controller use `std::exception`/`catch (...)` at thread boundaries. **No exceptions across the C API.** +- **Threading**: no global lock; per-object `ZeroTier::Mutex` scoped guard (`Mutex::Lock _l(_m);`) or `std::mutex` + `lock_guard`/`shared_lock` in controller. Cross-thread wake only via `Phy::whack()`; producer/consumer via `BlockingQueue`. Threads: `std::thread`. +- **Async**: single-threaded reactor (`Phy::poll` callbacks), not futures; no `std::async`/`future` in C++ paths (tokio only inside `rustybits/smeeclient`). +- **Memory**: raw `new`/`delete` in service/controller; intrusive `SharedPtr` (`node/SharedPtr.hpp` — class needs `friend class SharedPtr` + `AtomicCounter __refCount`) for `Peer`/`Network`/`Path`; `std::shared_ptr` for `DB` backends. Zero secrets with `Utils::burn`. +- **DI/state**: no framework. Two seams only: `ZT_Node_Callbacks` function-pointer struct (core ↔ OS) and `const RuntimeEnvironment *RR` as first param. Controller injected via `Node::setNetconfMaster`. +- **JSON**: `nlohmann::json` + typed accessors `OSUtils::jsonString/jsonInt/jsonBool` (defaults); API is type-sensitive. +- **Metrics**: `node/Metrics.hpp` namespace, increment inline (`Metrics::udp_recv += len;`). +- **License header**: every new `.cpp/.hpp/.h` gets the 11-line BSL block verbatim (copy `node/Mutex.hpp:1-12`). +- **Placement rule**: sockets/files/interfaces → `osdep/`; orchestration → `service/`; persistence → `controller/`; `node/` stays OS-independent. New compiled file must be added to `objects.mk` (`CORE_OBJS` or `ONE_OBJS`) or it won't link. + +## Important Files + +Read before editing: + +1. `include/ZeroTierOne.h` — public contract (`ZT_Node_Callbacks:1733`, `ZT_ResultCode:375`); ripples to Java/SDK. +2. `node/Constants.hpp` — platform macros, exception ints, constants; include first. +3. `node/RuntimeEnvironment.hpp` — object graph every `node/` fn navigates. +4. `service/OneService.cpp` lines 690–1100 (callback table) and 1150–1400 (`run()` loop) — the integration seam. +5. `osdep/Phy.hpp` lines 55–160 — handler contract for any socket behavior. +6. `objects.mk` + `make-linux.mk:12,62-73,370-457` — what compiles with which flags. +7. Per-dir READMEs: `service/README.md` (local.conf schema + JSON API — primary ops doc), `controller/README.md`, `node/README.md`. + +Module-specific: wire protocol → `node/IncomingPacket.cpp:94-151` + `node/Packet.hpp`; routing → `node/Switch.cpp`; DB backend → `controller/DB.hpp` + `EmbeddedNetworkController.cpp:465-580`; TAP → `osdep/EthernetTap.cpp`. + +## Runtime/Tooling Preferences + +- **Build**: GNU make (g++ or clang auto-detected, `make-linux.mk:3-10`); MSVC on Windows; ant + NDK for Java; cargo for `rustybits/`; npm for `rule-compiler/`. +- **No package manager for C++** — deps vendored in `ext/` (do not add new ones casually). +- **Daemon paths (Linux)**: home `/var/lib/backone` (macOS: `/Library/Application Support/BackOne`); port 9993; key files `identity.secret`, `authtoken.secret`, `networks.d/`, `local.conf`, `controller.db`. Unprivileged CLI: `cp authtoken.secret ~/.backOneOneAuthToken` (source: `one.cpp:283`). +- **CLI**: `backone-cli info|listpeers|listnetworks|join |leave ` (`-j` JSON, `-p`, `-D`); `backone-idtool generate|validate|getpublic|sign|verify|mkcom`. +- **Dangerous scripts**: `update_controllers.sh`, `cycle_controllers.sh` are live ZeroTier-Central kubectl ops — never run locally. +- **Rebrand is partial**: build outputs, CI (`build.yml`, `validate-linux.sh`), `Dockerfile.ci`, `make-bsd.mk`/`make-netbsd.mk`, and debian units now use `backone*`. Still upstream-named: `pkg/snap/snapcraft.yaml` (builds `github.com/zerotier/zerotierone.git` → broken) and cosmetic strings (`/etc/zerotier-version` in `Dockerfile.ci`, `windows/zerotier-cli.bat`, `pkg/` vendor paths). Expect occasional `zerotier-*` names in docs/scripts. + +## Testing & QA + +No C++ unit framework. Practical loop: + +```sh +make selftest && ./backone-selftest # crypto KATs, identity, certs, packet codec, Phy loopback; non-zero exit on failure +make debug # ZT_DEBUG=1 build of one + selftest +``` + +- **Sections** in `selftest.cpp`: `testCrypto`, `testIdentity`, `testCertificate`, `testPacket`, `testOther`, `testPhy` (binds 127.0.0.1 UDP/TCP loopback; no root needed). +- **CI** (`.github/workflows/`): `build.yml` = build smoke (`make`, `make selftest`); `validate.yml` = `make one ZT_COVERAGE=1 ZT_TRACE=1` then `.github/workflows/validate-linux.sh` (two-node netns + ping + iperf3 + valgrind) and `validate-report.sh` (fails on any definite leak or non-zero test exit — the only hard gate). `ZT_COVERAGE=1` adds `--coverage` flags (`make-linux.mk:322-326`); coverage recorded via gcovr, never thresholded. +- **Lint/format**: `make lint` → `tools/lint.sh` (clang-format on changed lines vs base; CI: `.github/workflows/lint.yml`, clang-format pinned 23.1.1). No clang-tidy, no `-Werror`. Do not reformat untouched lines. +- **Gaps**: no Rust tests, no Java tests (orphaned `java/test/` deleted), no `make test`/`check` target. Prefer extending `selftest.cpp` for regression coverage; `rule-compiler` has `npm test` (real, `rule-compiler/test.js`). +- **Windows smoke** (`windows/README.md`): run exe `-p9994 -C ` then `zerotier-cli.bat -p9994 -D info|join`. diff --git a/Dockerfile.ci b/Dockerfile.ci index 9ff3b01..9817296 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -6,16 +6,17 @@ RUN apt-get update -qq && apt-get -qq install make clang COPY . . RUN /usr/bin/make RUN echo $PWD -RUN cp zerotier-one /usr/sbin +RUN cp backone /usr/sbin FROM ubuntu:21.04 -COPY --from=stage /zerotier-one /usr/sbin -RUN ln -sf /usr/sbin/zerotier-one /usr/sbin/zerotier-idtool -RUN ln -sf /usr/sbin/zerotier-one /usr/sbin/zerotier-cli +COPY --from=stage /backone /usr/sbin +RUN ln -sf /usr/sbin/backone /usr/sbin/backone-idtool +RUN ln -sf /usr/sbin/backone /usr/sbin/backone-cli RUN echo "${VERSION}" > /etc/zerotier-version -RUN rm -rf /var/lib/zerotier-one +RUN rm -rf /var/lib/backone +ENV ZEROTIER_HOME=/var/lib/backone ZT_PID_FILE=backone.pid ZT_PORT_FILE=backone.port ZT_DAEMON=/usr/sbin/backone ZT_CLI=backone-cli RUN apt-get -qq update diff --git a/Makefile b/Makefile index 1bedf30..536cffd 100644 --- a/Makefile +++ b/Makefile @@ -27,6 +27,9 @@ ifeq ($(OSTYPE),NetBSD) include make-netbsd.mk endif +lint: + @./tools/lint.sh + drone: @echo "rendering .drone.yaml from .drone.jsonnet" drone jsonnet --format --stream diff --git a/attic/world/mkworld.cpp b/attic/world/mkworld.cpp index 6b9bbe8..88ed8dc 100644 --- a/attic/world/mkworld.cpp +++ b/attic/world/mkworld.cpp @@ -81,36 +81,42 @@ int main(int argc,char **argv) std::vector roots; const uint64_t id = ZT_WORLD_ID_EARTH; - const uint64_t ts = 1567191349589ULL; // August 30th, 2019 + const uint64_t ts = 1567191349589ULL; // August 30th, 2019 + //const uint64_t ts = 1778645159589ULL; // May 13th, 2026 - // Los Angeles + // MVNET server1.saltis.id roots.push_back(World::Root()); - roots.back().identity = Identity("3a46f1bf30:0:76e66fab33e28549a62ee2064d1843273c2c300ba45c3f20bef02dbad225723bb59a9bb4b13535730961aeecf5a163ace477cceb0727025b99ac14a5166a09a3"); - roots.back().stableEndpoints.push_back(InetAddress("185.180.13.82/9993")); - roots.back().stableEndpoints.push_back(InetAddress("2a02:6ea0:c815::/9993")); + roots.back().identity = Identity("41cff2b17b:0:1f62d405a755ed8522e903edee7e2166fa357658a6cac8e6739b9e463898107538f09419e5cf5c2d139468c04ad1e0a08b59680ee2f07b2e50e670f81fd1dc3d"); + roots.back().stableEndpoints.push_back(InetAddress("103.80.237.27/9993")); - // Miami + // MVNET server2.saltis.id roots.push_back(World::Root()); - roots.back().identity = Identity("de8950a8b2:0:1b3ada8251b91b6b6fa6535b8c7e2460918f4f729abdec97d3c7f3796868fb02f0de0b0ee554b2d59fc3524743eebfcf5315e790ed6d92db5bd10c28c09b40ef"); - roots.back().stableEndpoints.push_back(InetAddress("207.246.73.245/443")); - roots.back().stableEndpoints.push_back(InetAddress("2001:19f0:9002:5cb:ec4:7aff:fe8f:69d9/443")); + roots.back().identity = Identity("e4bfc89a12:0:93f764c53030b11c4b9f824cdade6fb731d26b5150f326ca484dbb3acb33a065d5431524fe7ce517512b13c21c4ab5edb04a2e145cefa33ffdf39a855b966c21"); + roots.back().stableEndpoints.push_back(InetAddress("103.80.237.163/9993")); - // Tokyo - roots.push_back(World::Root()); - roots.back().identity = Identity("34e0a5e174:0:93efb50934788f856d5cfb9ca5be88e85b40965586b75befac900df77352c145a1ba7007569d37c77bfe52c0999f3bdc67a47a4a6000b720a883ce47aa2fb7f8"); - roots.back().stableEndpoints.push_back(InetAddress("147.75.92.2/443")); - roots.back().stableEndpoints.push_back(InetAddress("2604:1380:3000:7100::1/443")); - - // Amsterdam - roots.push_back(World::Root()); - roots.back().identity = Identity("992fcf1db7:0:206ed59350b31916f749a1f85dffb3a8787dcbf83b8c6e9448d4e3ea0e3369301be716c3609344a9d1533850fb4460c50af43322bcfc8e13d3301a1f1003ceb6"); - roots.back().stableEndpoints.push_back(InetAddress("195.181.173.159/443")); - roots.back().stableEndpoints.push_back(InetAddress("2a02:6ea0:c024::/443")); - - // Alice + // IDC server1a.saltis.id //roots.push_back(World::Root()); - //roots.back().identity = Identity("9d219039f3:0:01f0922a98e3b34ebcbff333269dc265d7a020aab69d72be4d4acc9c8c9294785771256cd1d942a90d1bd1d2dca3ea84ef7d85afe6611fb43ff0b74126d90a6e"); - //roots.back().stableEndpoints.push_back(InetAddress("188.166.94.177/9993")); // Amsterdam + //roots.back().identity = Identity("e620faa6a2:0:f450e2de69d0a70fa3183af50e881a96daac6a736fbb6004492cf97da774de0e003b060ec19e4c9b4288a60a99b4a60464b475ec2d1efb1b0c4a9b924b8f4bf1"); + //roots.back().stableEndpoints.push_back(InetAddress("103.185.47.53/9993")); + + // IDC server2a.saltis.id + roots.push_back(World::Root()); + roots.back().identity = Identity("35b7a18f36:0:e7d0dc4f655c0a2adb72aa9529e97d0fdf1e72bf12a6e753c6b366d88b388b645702edbd8dfeda21c3654f2d73c28fecc7c4713b335ffa61b09e322a7b93c18a"); + roots.back().stableEndpoints.push_back(InetAddress("103.185.47.52/9993")); + + // GW-Bridge Metro Link + //roots.push_back(World::Root()); + //roots.back().identity = Identity("117cd947d5:0:8b15bfe3798aa1529abf6def4d4d8eb3ff5cbd50c04ddaf7747adc00a55aef5b6666953ee30a2b6c3c852db7426c42760b7d26c63acdc6489fd11bb36690d966"); + //roots.back().stableEndpoints.push_back(InetAddress("103.87.149.147/9993")); // Amsterdam + //roots.back().stableEndpoints.push_back(InetAddress("203.30.255.130/9993")); // Amsterdam + //roots.back().stableEndpoints.push_back(InetAddress("192.168.80.5/9993")); // Amsterdam + + // GW-Bridge Metro Link + roots.push_back(World::Root()); + roots.back().identity = Identity("82ff7e0148:0:01a99aac0d7084a59c03831517cdcd9ced2af58bc61de92ab45e0ea2ea86e2692935c84e9923dafce9675f3cc5dd46846d52b5f31e0e6726cb94884b9b6c5518"); + roots.back().stableEndpoints.push_back(InetAddress("103.87.149.150/9993")); // Amsterdam + roots.back().stableEndpoints.push_back(InetAddress("192.168.80.5/9993")); // Amsterdam + //roots.back().stableEndpoints.push_back(InetAddress("2a03:b0c0:2:d0::7d:1/9993")); // Amsterdam //roots.back().stableEndpoints.push_back(InetAddress("154.66.197.33/9993")); // Johannesburg //roots.back().stableEndpoints.push_back(InetAddress("2c0f:f850:154:197::33/9993")); // Johannesburg diff --git a/attic/world/planet.GW7-METRO b/attic/world/planet.GW7-METRO new file mode 100644 index 0000000..2bc34df Binary files /dev/null and b/attic/world/planet.GW7-METRO differ diff --git a/attic/world/planet.METRO b/attic/world/planet.METRO new file mode 100644 index 0000000..a714117 Binary files /dev/null and b/attic/world/planet.METRO differ diff --git a/attic/world/planet.SIMULASI b/attic/world/planet.SIMULASI new file mode 100644 index 0000000..2ef42a1 Binary files /dev/null and b/attic/world/planet.SIMULASI differ diff --git a/attic/world/world.bin b/attic/world/world.bin deleted file mode 100644 index 88049cc..0000000 Binary files a/attic/world/world.bin and /dev/null differ diff --git a/controller/LFDB.cpp b/controller/LFDB.cpp index efccff6..96a6fd7 100644 --- a/controller/LFDB.cpp +++ b/controller/LFDB.cpp @@ -380,12 +380,23 @@ bool LFDB::save(nlohmann::json &record,bool notifyListeners) void LFDB::eraseNetwork(const uint64_t networkId) { - // TODO + nlohmann::json network, nullJson; + get(networkId, network); + _networkChanged(network, nullJson, true); + std::lock_guard l(_state_l); + _state.erase(networkId); } void LFDB::eraseMember(const uint64_t networkId,const uint64_t memberId) { - // TODO + nlohmann::json network, member, nullJson; + get(networkId, network, memberId, member); + _memberChanged(member, nullJson, true); + std::lock_guard l(_state_l); + auto nw = _state.find(networkId); + if (nw != _state.end()) { + nw->second.members.erase(memberId); + } } void LFDB::nodeIsOnline(const uint64_t networkId,const uint64_t memberId,const InetAddress &physicalAddress) diff --git a/controller/PostgreSQL.cpp b/controller/PostgreSQL.cpp index e4a31ba..c9f63cd 100644 --- a/controller/PostgreSQL.cpp +++ b/controller/PostgreSQL.cpp @@ -199,8 +199,13 @@ PostgreSQL::PostgreSQL(const Identity &myId, const char *path, int listenPort, R } const char *redisMemberStatus = getenv("ZT_REDIS_MEMBER_STATUS"); if (redisMemberStatus && (strcmp(redisMemberStatus, "true") == 0)) { - _redisMemberStatus = true; - fprintf(stderr, "Using redis for member status\n"); + if (_rc != NULL) { + _redisMemberStatus = true; + fprintf(stderr, "Using redis for member status\n"); + } + else { + fprintf(stderr, "ZT_REDIS_MEMBER_STATUS=true ignored: no settings.redis config\n"); + } } auto c = _pool->borrow(); @@ -222,7 +227,7 @@ PostgreSQL::PostgreSQL(const Identity &myId, const char *path, int listenPort, R opts.host = _rc->hostname; opts.port = _rc->port; opts.password = _rc->password; - opts.db = 0; + opts.db = _rc->clusterMode ? 0 : _rc->db; opts.keep_alive = true; opts.connect_timeout = std::chrono::seconds(3); poolOpts.size = 25; diff --git a/controller/Redis.hpp b/controller/Redis.hpp index 095419b..c48197e 100644 --- a/controller/Redis.hpp +++ b/controller/Redis.hpp @@ -5,10 +5,11 @@ namespace ZeroTier { struct RedisConfig { - std::string hostname; - int port; - std::string password; - bool clusterMode; + std::string hostname; + int port; + std::string password; + bool clusterMode; + int db; }; } diff --git a/debian/backone.service b/debian/backone.service new file mode 100644 index 0000000..cc4ac3b --- /dev/null +++ b/debian/backone.service @@ -0,0 +1,12 @@ +[Unit] +Description=BackOne +After=network-online.target network.target +Wants=network-online.target + +[Service] +ExecStart=/usr/sbin/backone +Restart=always +KillMode=process + +[Install] +WantedBy=multi-user.target diff --git a/doc/zerotier-cli.1 b/doc/backone-cli.1 similarity index 57% rename from doc/zerotier-cli.1 rename to doc/backone-cli.1 index 167109e..ab785e8 100644 --- a/doc/zerotier-cli.1 +++ b/doc/backone-cli.1 @@ -1,58 +1,63 @@ -.TH "ZEROTIER\-CLI" "1" "December 2016" "" "" +.TH "BACKONE\-CLI" "1" "September 2026" .SH "NAME" -\fBzerotier-cli\fR \- control local ZeroTier virtual network service +\fBbackone-cli\fR \- control local BackOne virtual network service .SH SYNOPSIS .P -\fBzerotier\-cli\fP [\-switches] [arguments] +\fBbackone\-cli\fP [\-switches] [arguments] .SH DESCRIPTION .P -\fBzerotier\-cli\fR provides a simple command line interface to the local JSON API of the ZeroTier virtual network endpoint service zerotier\-one(8)\. -.P -By default \fBzerotier\-cli\fR must be run as root or with \fBsudo\fP\|\. If you want to allow an unprivileged user to use \fBzerotier\-cli\fR to control the system ZeroTier service, you can create a local copy of the ZeroTier service authorization token in the user's home directory: +\fBbackone\-cli\fR provides a simple command line interface to the local JSON API of the BackOne virtual network endpoint service backone(8)\. .P +By default \fBbackone\-cli\fR must be run as root or with \fBsudo\fP\|\. If you want to allow an unprivileged user to use \fBbackone\-cli\fR to control the system BackOne service, you can create a local copy of the BackOne service authorization token in the user's home directory: .RS 2 .nf -sudo cp /var/lib/zerotier\-one/authtoken\.secret /home/user/\.zeroTierOneAuthToken -chown user /home/user/\.zeroTierOneAuthToken -chmod 0600 /home/user/\.zeroTierOneAuthToken +sudo cp /var/lib/backone/authtoken\.secret /home/user/\.backOneOneAuthToken +chown user /home/user/\.backOneOneAuthToken +chmod 0600 /home/user/\.backOneOneAuthToken .fi .RE .P -(The location of ZeroTier's service home may differ by platform\. See zerotier\-one(8)\.) +(The location of BackOne's service home may differ by platform\. See backone(8)\.) .P Note that this gives the user the power to connect or disconnect the system to or from any virtual network, which is a significant permission\. .P -\fBzerotier\-cli\fR has several command line arguments that are visible in \fBhelp\fP output\. The two most commonly used are \fB\-j\fP for raw JSON output and \fB\-D\fP to specify an alternative ZeroTier service working directory\. Raw JSON output is easier to parse in scripts and also contains verbose details not present in the tabular output\. The \fB\-D\fP option specifies where the service's zerotier\-one\.port and authtoken\.secret files are located if the service is not running at the default location for your system\. +\fBbackone\-cli\fR has several command line arguments that are visible in \fBhelp\fP output\. The two most commonly used are \fB\-j\fP for raw JSON output and \fB\-D\fP to specify an alternative BackOne service working directory\. Raw JSON output is easier to parse in scripts and also contains verbose details not present in the tabular output\. The \fB\-D\fP option specifies where the service's backone\.port and authtoken\.secret files are located if the service is not running at the default location for your system\. .SH COMMANDS -.RS 0 + +.RS 1 .IP \(bu 2 \fBhelp\fP: -Displays \fBzerotier\-cli\fR help\. +.br +Displays \fBbackone\-cli\fR help\. .IP \(bu 2 \fBinfo\fP: +.br Shows information about this device including its 10\-digit ZeroTier address and apparent connection status\. Use \fB\-j\fP for more verbose output\. .IP \(bu 2 \fBlistpeers\fP: +.br This command lists the ZeroTier VL1 (virtual layer 1, the peer to peer network) peers this service knows about and has recently (within the past 30 minutes or so) communicated with\. These are not necessarily all the devices on your virtual network(s), and may also include a few devices not on any virtual network you've joined\. These are typically either root servers or network controllers\. .IP \(bu 2 \fBlistnetworks\fP: +.br This lists the networks your system belongs to and some information about them, such as any ZeroTier\-managed IP addresses you have been assigned\. (IP addresses assigned manually to ZeroTier interfaces will not be listed here\. Use the standard network interface commands to see these\.) .IP \(bu 2 \fBjoin\fP: +.br To join a network just use \fBjoin\fP and its 16\-digit hex network ID\. That's it\. Then use \fBlistnetworks\fP to see the status\. You'll either get a reply from the network controller with a certificate and other info such as IP assignments, or you'll get "access denied\." In this case you'll need the administrator of this network to authorize your device by its 10\-digit device ID (visible with \fBinfo\fP) on the network's controller\. .IP \(bu 2 \fBleave\fP: +.br Leaving a network is as easy as joining it\. This disconnects from the network and deletes its interface from the system\. Note that peers on the network may hang around in \fBlistpeers\fP for up to 30 minutes until they time out due to lack of traffic\. But if they no longer share a network with you, they can't actually communicate with you in any meaningful way\. .RE .SH EXAMPLES .P Join "Earth," ZeroTier's big public party line network: -.P .RS 2 .nf -$ sudo zerotier\-cli join 8056c2e21c000001 -$ sudo zerotier\-cli listnetworks +$ sudo backone\-cli join 8056c2e21c000001 +$ sudo backone\-cli listnetworks ( wait until you get an Earth IP ) $ ping earth\.zerotier\.net ( you should now be able to ping our Earth test IP ) @@ -60,24 +65,22 @@ $ ping earth\.zerotier\.net .RE .P Leave "Earth": -.P .RS 2 .nf -$ sudo zerotier\-cli leave 8056c2e21c000001 +$ sudo backone\-cli leave 8056c2e21c000001 .fi .RE .P List VL1 peers: -.P .RS 2 .nf -$ sudo zerotier\-cli listpeers +$ sudo backone\-cli listpeers .fi .RE .SH COPYRIGHT .P -(c)2011\-2016 ZeroTier, Inc\. \-\- https://www\.zerotier\.com/ \-\- https://github\.com/zerotier +(c)2011\-2016 ZeroTier, Inc\. \-\- https://www.zerotier.com/ \-\- https://github.com/zerotier .SH SEE ALSO .P -zerotier\-one(8), zerotier\-idtool(1) +backone(8), backone\-idtool(1) diff --git a/doc/zerotier-cli.1.md b/doc/backone-cli.1.md similarity index 58% rename from doc/zerotier-cli.1.md rename to doc/backone-cli.1.md index 6252d45..1bf438d 100644 --- a/doc/zerotier-cli.1.md +++ b/doc/backone-cli.1.md @@ -1,30 +1,30 @@ -zerotier-cli(1) -- control local ZeroTier virtual network service -================================================================= +backone-cli(1) -- control local BackOne virtual network service +=============================================================== ## SYNOPSIS -`zerotier-cli` [-switches] [arguments] +`backone-cli` [-switches] [arguments] ## DESCRIPTION -**zerotier-cli** provides a simple command line interface to the local JSON API of the ZeroTier virtual network endpoint service zerotier-one(8). +**backone-cli** provides a simple command line interface to the local JSON API of the BackOne virtual network endpoint service backone(8). -By default **zerotier-cli** must be run as root or with `sudo`. If you want to allow an unprivileged user to use **zerotier-cli** to control the system ZeroTier service, you can create a local copy of the ZeroTier service authorization token in the user's home directory: +By default **backone-cli** must be run as root or with `sudo`. If you want to allow an unprivileged user to use **backone-cli** to control the system BackOne service, you can create a local copy of the BackOne service authorization token in the user's home directory: - sudo cp /var/lib/zerotier-one/authtoken.secret /home/user/.zeroTierOneAuthToken - chown user /home/user/.zeroTierOneAuthToken - chmod 0600 /home/user/.zeroTierOneAuthToken + sudo cp /var/lib/backone/authtoken.secret /home/user/.backOneOneAuthToken + chown user /home/user/.backOneOneAuthToken + chmod 0600 /home/user/.backOneOneAuthToken -(The location of ZeroTier's service home may differ by platform. See zerotier-one(8).) +(The location of BackOne's service home may differ by platform. See backone(8).) Note that this gives the user the power to connect or disconnect the system to or from any virtual network, which is a significant permission. -**zerotier-cli** has several command line arguments that are visible in `help` output. The two most commonly used are `-j` for raw JSON output and `-D` to specify an alternative ZeroTier service working directory. Raw JSON output is easier to parse in scripts and also contains verbose details not present in the tabular output. The `-D` option specifies where the service's zerotier-one.port and authtoken.secret files are located if the service is not running at the default location for your system. +**backone-cli** has several command line arguments that are visible in `help` output. The two most commonly used are `-j` for raw JSON output and `-D` to specify an alternative BackOne service working directory. Raw JSON output is easier to parse in scripts and also contains verbose details not present in the tabular output. The `-D` option specifies where the service's backone.port and authtoken.secret files are located if the service is not running at the default location for your system. ## COMMANDS * `help`: - Displays **zerotier-cli** help. + Displays **backone-cli** help. * `info`: Shows information about this device including its 10-digit ZeroTier address and apparent connection status. Use `-j` for more verbose output. @@ -45,19 +45,19 @@ Note that this gives the user the power to connect or disconnect the system to o Join "Earth," ZeroTier's big public party line network: - $ sudo zerotier-cli join 8056c2e21c000001 - $ sudo zerotier-cli listnetworks + $ sudo backone-cli join 8056c2e21c000001 + $ sudo backone-cli listnetworks ( wait until you get an Earth IP ) $ ping earth.zerotier.net ( you should now be able to ping our Earth test IP ) Leave "Earth": - $ sudo zerotier-cli leave 8056c2e21c000001 + $ sudo backone-cli leave 8056c2e21c000001 List VL1 peers: - $ sudo zerotier-cli listpeers + $ sudo backone-cli listpeers ## COPYRIGHT @@ -65,4 +65,4 @@ List VL1 peers: ## SEE ALSO -zerotier-one(8), zerotier-idtool(1) +backone(8), backone-idtool(1) diff --git a/doc/zerotier-idtool.1 b/doc/backone-idtool.1 similarity index 69% rename from doc/zerotier-idtool.1 rename to doc/backone-idtool.1 index fbc367a..4efb963 100644 --- a/doc/zerotier-idtool.1 +++ b/doc/backone-idtool.1 @@ -1,84 +1,87 @@ -.TH "ZEROTIER\-IDTOOL" "1" "December 2016" "" "" +.TH "BACKONE\-IDTOOL" "1" "September 2026" .SH "NAME" -\fBzerotier-idtool\fR \- tool for creating and manipulating ZeroTier identities +\fBbackone-idtool\fR \- tool for creating and manipulating ZeroTier identities .SH SYNOPSIS .P -\fBzerotier\-idtool\fP [args] +\fBbackone\-idtool\fP [args] .SH DESCRIPTION .P -\fBzerotier\-idtool\fR is a command line utility for doing things with ZeroTier identities\. A ZeroTier identity consists of a public/private key pair (or just the public if it's only an identity\.public) and a 10\-digit hexadecimal ZeroTier address derived from the public key by way of a proof of work based hash function\. +\fBbackone\-idtool\fR is a command line utility for doing things with ZeroTier identities\. A ZeroTier identity consists of a public/private key pair (or just the public if it's only an identity\.public) and a 10\-digit hexadecimal ZeroTier address derived from the public key by way of a proof of work based hash function\. .SH COMMANDS .P When command arguments call for a public or secret (full) identity, the identity can be specified as a path to a file or directly on the command line\. -.RS 0 + +.RS 1 .IP \(bu 2 \fBhelp\fP: +.br Display help\. (Also running with no command does this\.) .IP \(bu 2 \fBgenerate\fP [secret file] [public file] [vanity]: +.br Generate a new ZeroTier identity\. If a secret file is specified, the full identity including the private key will be written to this file\. If the public file is specified, the public portion will be written there\. If no file paths are specified the full secret identity is output to STDOUT\. The vanity prefix is a series of hexadecimal digits that the generated identity's address should start with\. Typically this isn't used, and if it's specified generation can take a very long time due to the intrinsic cost of generating identities with their proof of work function\. Generating an identity with a known 16\-bit (4 digit) prefix on a 2\.8ghz Core i5 (using one core) takes an average of two hours\. .IP \(bu 2 \fBvalidate\fP : +.br Locally validate an identity's key and proof of work function correspondence\. .IP \(bu 2 \fBgetpublic\fP : +.br Extract the public portion of an identity\.secret and print to STDOUT\. .IP \(bu 2 \fBsign\fP : +.br Sign a file's contents with SHA512+ECC\-256 (ed25519)\. The signature is output in hex to STDOUT\. .IP \(bu 2 \fBverify\fP : +.br Verify a signature created with \fBsign\fP\|\. .IP \(bu 2 -\fBmkcom\fP [id,value,maxdelta] [\|\.\.\.]: +\fBmkcom\fP [id,value,maxdelta] [\.\.\.]: +.br Create and sign a network membership certificate\. This is not generally useful since network controllers do this automatically and is included mostly for testing purposes\. .RE .SH EXAMPLES .P Generate and dump a new identity: -.P .RS 2 .nf -$ zerotier\-idtool generate +$ backone\-idtool generate .fi .RE .P Generate and write a new identity, both secret and public parts: -.P .RS 2 .nf -$ zerotier\-idtool generate identity\.secret identity\.public +$ backone\-idtool generate identity\.secret identity\.public .fi .RE .P Generate a vanity address that begins with the hex digits "beef" (this will take a while!): -.P .RS 2 .nf -$ zerotier\-idtool generate beef\.secret beef\.public beef +$ backone\-idtool generate beef\.secret beef\.public beef .fi .RE .P Sign a file with an identity's secret key: -.P .RS 2 .nf -$ zerotier\-idtool sign identity\.secret last_will_and_testament\.txt +$ backone\-idtool sign identity\.secret last_will_and_testament\.txt .fi .RE .P Verify a file's signature with a public key: -.P .RS 2 .nf -$ zerotier\-idtool verify identity\.public last_will_and_testament\.txt +$ backone\-idtool verify identity\.public last_will_and_testament\.txt .fi .RE .SH COPYRIGHT .P -(c)2011\-2016 ZeroTier, Inc\. \-\- https://www\.zerotier\.com/ \-\- https://github\.com/zerotier +(c)2011\-2016 ZeroTier, Inc\. \-\- https://www.zerotier.com/ \-\- https://github.com/zerotier .SH SEE ALSO .P -zerotier\-one(8), zerotier\-cli(1) +backone(8), backone\-cli(1) diff --git a/doc/zerotier-idtool.1.md b/doc/backone-idtool.1.md similarity index 74% rename from doc/zerotier-idtool.1.md rename to doc/backone-idtool.1.md index 52a586c..8d4d1d9 100644 --- a/doc/zerotier-idtool.1.md +++ b/doc/backone-idtool.1.md @@ -1,13 +1,13 @@ -zerotier-idtool(1) -- tool for creating and manipulating ZeroTier identities -============================================================================ +backone-idtool(1) -- tool for creating and manipulating ZeroTier identities +=========================================================================== ## SYNOPSIS -`zerotier-idtool` [args] +`backone-idtool` [args] ## DESCRIPTION -**zerotier-idtool** is a command line utility for doing things with ZeroTier identities. A ZeroTier identity consists of a public/private key pair (or just the public if it's only an identity.public) and a 10-digit hexadecimal ZeroTier address derived from the public key by way of a proof of work based hash function. +**backone-idtool** is a command line utility for doing things with ZeroTier identities. A ZeroTier identity consists of a public/private key pair (or just the public if it's only an identity.public) and a 10-digit hexadecimal ZeroTier address derived from the public key by way of a proof of work based hash function. ## COMMANDS @@ -38,23 +38,23 @@ When command arguments call for a public or secret (full) identity, the identity Generate and dump a new identity: - $ zerotier-idtool generate + $ backone-idtool generate Generate and write a new identity, both secret and public parts: - $ zerotier-idtool generate identity.secret identity.public + $ backone-idtool generate identity.secret identity.public Generate a vanity address that begins with the hex digits "beef" (this will take a while!): - $ zerotier-idtool generate beef.secret beef.public beef + $ backone-idtool generate beef.secret beef.public beef Sign a file with an identity's secret key: - $ zerotier-idtool sign identity.secret last_will_and_testament.txt + $ backone-idtool sign identity.secret last_will_and_testament.txt Verify a file's signature with a public key: - $ zerotier-idtool verify identity.public last_will_and_testament.txt + $ backone-idtool verify identity.public last_will_and_testament.txt ## COPYRIGHT @@ -62,4 +62,4 @@ Verify a file's signature with a public key: ## SEE ALSO -zerotier-one(8), zerotier-cli(1) +backone(8), backone-cli(1) diff --git a/doc/backone.8 b/doc/backone.8 new file mode 100644 index 0000000..e8f1e43 --- /dev/null +++ b/doc/backone.8 @@ -0,0 +1,121 @@ +.TH "BACKONE" "8" "September 2026" +.SH "NAME" +\fBbackone\fR \- BackOne virtual network endpoint service +.SH SYNOPSIS +.P +\fBbackone\fP [\-switches] [working directory] +.SH DESCRIPTION +.P +\fBbackone\fR is the service/daemon responsible for connecting a Unix (Linux/BSD/OSX) system to one or more ZeroTier virtual networks and presenting those networks to the system as virtual network ports\. You can think of it as a peer to peer VPN client\. +.P +It's typically run by init systems like systemd (Linux) or launchd (Mac) rather than directly by the user, and it must be run as root unless you give it the \fB\-U\fP switch and don't plan on actually joining networks (e\.g\. to run a network controller microservice only)\. +.P +The \fBbackone\fR service keeps its state and other files in a working directory\. If this directory is not specified at launch it defaults to "/var/lib/backone" on Linux, "/Library/Application Support/BackOne" on Mac, and "/var/db/backone" on FreeBSD and other similar BSDs\. The working directory should persist\. It shouldn't be automatically cleaned by system cleanup daemons or stored in a volatile location\. Loss of its identity\.secret file results in loss of this system's unique 10\-digit ZeroTier address and key\. +.P +Multiple instances of \fBbackone\fR can be run on the same system as long as they are run with different primary ports (see switches) and a different working directory\. But since a single service can join any number of networks, typically there's no point in doing this\. +.P +The \fBbackone\fR service is controlled via a JSON API available at 127\.0\.0\.1: with the default primary port being 9993\. Access to this API requires an authorization token normally found in the authtoken\.secret file in the service's working directory\. On some platforms access may be guarded by other measures such as socket peer UID/GID lookup if additional security options are enabled (this is not the default)\. +.P +The first time the service is started in a fresh working directory, it generates a ZeroTier identity\. On slow systems this process can take ten seconds or more due to an anti\-DDOS/anti\-counterfeit proof of work function used by ZeroTier in address generation\. This only happens once, and once generated the result is saved in identity\.secret in the working directory\. This file represents and defines/claims your ZeroTier address and associated ECC\-256 key pair\. +.SH SWITCHES + +.RS 1 +.IP \(bu 2 +\fB\-h\fP: +.br +Display help\. +.IP \(bu 2 +\fB\-v\fP: +.br +Display BackOne version\. +.IP \(bu 2 +\fB\-U\fP: +.br +Skip privilege check and allow to be run by non\-privileged user\. This is typically used when \fBbackone\fR is built with the network controller option included\. In this case the BackOne service might only be acting as a network controller and might never actually join networks, in which case it does not require elevated system permissions\. +.IP \(bu 2 +\fB\-p\fP: +.br +Specify a different primary port\. If this is not given the default is 9993\. If zero is given a random port is chosen each time\. +.IP \(bu 2 +\fB\-d\fP: +.br +Fork and run as a daemon\. +.IP \(bu 2 +\fB\-i\fP: +.br +Invoke the \fBbackone\-idtool\fR personality, in which case the binary behaves like backone\-idtool(1)\. This happens automatically if the name of the binary (or a symlink to it) is backone\-idtool\. +.IP \(bu 2 +\fB\-q\fP: +.br +Invoke the \fBbackone\-cli\fR personality, in which case the binary behaves like backone\-cli(1)\. This happens automatically if the name of the binary (or a symlink to it) is backone\-cli\. + +.RE +.SH EXAMPLES +.P +Run as daemon with OS default working directory and default port: +.RS 2 +.nf +$ sudo backone \-d +.fi +.RE +.P +Run as daemon with a different working directory and port: +.RS 2 +.nf +$ sudo backone \-d \-p12345 /tmp/backone\-working\-directory\-test +.fi +.RE +.SH FILES +.P +These are found in the service's working directory\. + +.RS 1 +.IP \(bu 2 +\fBidentity\.public\fP: +.br +The public portion of your ZeroTier identity, which is your 10\-digit hex address and the associated public key\. +.IP \(bu 2 +\fBidentity\.secret\fP: +.br +Your full ZeroTier identity including its private key\. This file identifies the system on the network, which means you can move a ZeroTier address around by copying this file and you should back up this file if you want to save your system's static ZeroTier address\. This file must be protected, since theft of its secret key will allow anyone to impersonate your device on any network and decrypt traffic\. For network controllers this file is particularly sensitive since it constitutes the private key for a certificate authority for the controller's networks\. +.IP \(bu 2 +\fBauthtoken\.secret\fP: +.br +The secret token used to authenticate requests to the service's local JSON API\. If it does not exist it is generated from a secure random source on service start\. To use, send it in the "X\-ZT1\-Auth" header with HTTP requests to 127\.0\.0\.1:\|\. +.IP \(bu 2 +\fBdevicemap\fP: +.br +Remembers mappings of zt# interface numbers to ZeroTier networks so they'll persist across restarts\. On some systems that support longer interface names that can encode the network ID (such as FreeBSD) this file may not be present\. +.IP \(bu 2 +\fBbackone\.pid\fP: +.br +BackOne's PID\. This file is deleted on normal shutdown\. +.IP \(bu 2 +\fBbackone\.port\fP: +.br +BackOne's primary port, which is also where its JSON API is found at 127\.0\.0\.1:\|\. This file is created on startup and is read by backone\-cli(1) to determine where it should find the control API\. +.IP \(bu 2 +\fBcontroller\.db\fP: +.br +If the BackOne service is built with the network controller enabled, this file contains the controller's SQLite3 database\. +.IP \(bu 2 +\fBcontroller\.db\.backup\fP: +.br +If the BackOne service is built with the network controller enabled, it periodically backs up its controller\.db database in this file (currently every 5 minutes if there have been changes)\. Since this file is not a currently in use SQLite3 database it's safer to back up without corruption\. On new backups the file is rotated out rather than being rewritten in place\. +.IP \(bu 2 +\fBiddb\.d/\fP (directory): +.br +Caches the public identity of every peer BackOne has spoken with in the last 60 days\. This directory and its contents can be deleted, but this may result in slower connection initiations since it will require that we go out and re\-fetch full identities for peers we're speaking to\. +.IP \(bu 2 +\fBnetworks\.d\fP (directory): +.br +This caches network configurations and certificate information for networks you belong to\. BackOne scans this directory for \|\.conf files on startup to recall its networks, so "touch"ing an empty \|\.conf file in this directory is a way of pre\-configuring BackOne to join a specific network on startup without using the API\. If the config file is empty BackOne will just fetch it from the network's controller\. + +.RE +.SH COPYRIGHT +.P +(c)2011\-2016 ZeroTier, Inc\. \-\- https://www.zerotier.com/ \-\- https://github.com/zerotier +.SH SEE ALSO +.P +backone\-cli(1), backone\-idtool(1) + diff --git a/doc/backone.8.md b/doc/backone.8.md new file mode 100644 index 0000000..d3217d7 --- /dev/null +++ b/doc/backone.8.md @@ -0,0 +1,95 @@ +backone(8) -- BackOne virtual network endpoint service +====================================================== + +## SYNOPSIS + +`backone` [-switches] [working directory] + +## DESCRIPTION + +**backone** is the service/daemon responsible for connecting a Unix (Linux/BSD/OSX) system to one or more ZeroTier virtual networks and presenting those networks to the system as virtual network ports. You can think of it as a peer to peer VPN client. + +It's typically run by init systems like systemd (Linux) or launchd (Mac) rather than directly by the user, and it must be run as root unless you give it the `-U` switch and don't plan on actually joining networks (e.g. to run a network controller microservice only). + +The **backone** service keeps its state and other files in a working directory. If this directory is not specified at launch it defaults to "/var/lib/backone" on Linux, "/Library/Application Support/BackOne" on Mac, and "/var/db/backone" on FreeBSD and other similar BSDs. The working directory should persist. It shouldn't be automatically cleaned by system cleanup daemons or stored in a volatile location. Loss of its identity.secret file results in loss of this system's unique 10-digit ZeroTier address and key. + +Multiple instances of **backone** can be run on the same system as long as they are run with different primary ports (see switches) and a different working directory. But since a single service can join any number of networks, typically there's no point in doing this. + +The **backone** service is controlled via a JSON API available at 127.0.0.1: with the default primary port being 9993. Access to this API requires an authorization token normally found in the authtoken.secret file in the service's working directory. On some platforms access may be guarded by other measures such as socket peer UID/GID lookup if additional security options are enabled (this is not the default). + +The first time the service is started in a fresh working directory, it generates a ZeroTier identity. On slow systems this process can take ten seconds or more due to an anti-DDOS/anti-counterfeit proof of work function used by ZeroTier in address generation. This only happens once, and once generated the result is saved in identity.secret in the working directory. This file represents and defines/claims your ZeroTier address and associated ECC-256 key pair. + +## SWITCHES + + * `-h`: + Display help. + + * `-v`: + Display BackOne version. + + * `-U`: + Skip privilege check and allow to be run by non-privileged user. This is typically used when **backone** is built with the network controller option included. In this case the BackOne service might only be acting as a network controller and might never actually join networks, in which case it does not require elevated system permissions. + + * `-p`: + Specify a different primary port. If this is not given the default is 9993. If zero is given a random port is chosen each time. + + * `-d`: + Fork and run as a daemon. + + * `-i`: + Invoke the **backone-idtool** personality, in which case the binary behaves like backone-idtool(1). This happens automatically if the name of the binary (or a symlink to it) is backone-idtool. + + * `-q`: + Invoke the **backone-cli** personality, in which case the binary behaves like backone-cli(1). This happens automatically if the name of the binary (or a symlink to it) is backone-cli. + +## EXAMPLES + +Run as daemon with OS default working directory and default port: + + $ sudo backone -d + +Run as daemon with a different working directory and port: + + $ sudo backone -d -p12345 /tmp/backone-working-directory-test + +## FILES + +These are found in the service's working directory. + + * `identity.public`: + The public portion of your ZeroTier identity, which is your 10-digit hex address and the associated public key. + + * `identity.secret`: + Your full ZeroTier identity including its private key. This file identifies the system on the network, which means you can move a ZeroTier address around by copying this file and you should back up this file if you want to save your system's static ZeroTier address. This file must be protected, since theft of its secret key will allow anyone to impersonate your device on any network and decrypt traffic. For network controllers this file is particularly sensitive since it constitutes the private key for a certificate authority for the controller's networks. + + * `authtoken.secret`: + The secret token used to authenticate requests to the service's local JSON API. If it does not exist it is generated from a secure random source on service start. To use, send it in the "X-ZT1-Auth" header with HTTP requests to 127.0.0.1:. + + * `devicemap`: + Remembers mappings of zt# interface numbers to ZeroTier networks so they'll persist across restarts. On some systems that support longer interface names that can encode the network ID (such as FreeBSD) this file may not be present. + + * `backone.pid`: + BackOne's PID. This file is deleted on normal shutdown. + + * `backone.port`: + BackOne's primary port, which is also where its JSON API is found at 127.0.0.1:. This file is created on startup and is read by backone-cli(1) to determine where it should find the control API. + + * `controller.db`: + If the BackOne service is built with the network controller enabled, this file contains the controller's SQLite3 database. + + * `controller.db.backup`: + If the BackOne service is built with the network controller enabled, it periodically backs up its controller.db database in this file (currently every 5 minutes if there have been changes). Since this file is not a currently in use SQLite3 database it's safer to back up without corruption. On new backups the file is rotated out rather than being rewritten in place. + + * `iddb.d/` (directory): + Caches the public identity of every peer BackOne has spoken with in the last 60 days. This directory and its contents can be deleted, but this may result in slower connection initiations since it will require that we go out and re-fetch full identities for peers we're speaking to. + + * `networks.d` (directory): + This caches network configurations and certificate information for networks you belong to. BackOne scans this directory for .conf files on startup to recall its networks, so "touch"ing an empty .conf file in this directory is a way of pre-configuring BackOne to join a specific network on startup without using the API. If the config file is empty BackOne will just fetch it from the network's controller. + +## COPYRIGHT + +(c)2011-2016 ZeroTier, Inc. -- https://www.zerotier.com/ -- https://github.com/zerotier + +## SEE ALSO + +backone-cli(1), backone-idtool(1) diff --git a/doc/build.sh b/doc/build.sh index 9df72a3..6463feb 100755 --- a/doc/build.sh +++ b/doc/build.sh @@ -1,42 +1,33 @@ #!/bin/bash -export PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -if [ ! -f zerotier-cli.1.md ]; then - echo 'This script must be run from the doc/ subfolder of the ZeroTier tree.' +if [ ! -f backone.8.md ]; then + echo 'This script must be run from the doc/ subfolder of the BackOne tree.' + exit 1 fi rm -f *.1 *.2 *.8 if [ -e /usr/bin/ronn -o -e /usr/local/bin/ronn ]; then - # Use 'ronn' which is available as a package on many distros including Debian - ronn -r zerotier-cli.1.md - ronn -r zerotier-idtool.1.md - ronn -r zerotier-one.8.md + # Use 'ronn' which is available as a package on many distros including Debian + ronn -r backone-cli.1.md + ronn -r backone-idtool.1.md + ronn -r backone.8.md else - # Use 'marked-man' from npm - NODE=/usr/bin/node - if [ ! -e $NODE ]; then - if [ -e /usr/bin/nodejs ]; then - NODE=/usr/bin/nodejs - elif [ -e /usr/local/bin/node ]; then - NODE=/usr/local/bin/node - elif [ -e /usr/local/bin/nodejs ]; then - NODE=/usr/local/bin/nodejs - else - echo 'Unable to find ronn or node/npm -- cannot build man pages!' - exit 1 - fi - fi + # Use 'marked-man' from npm + NODE=$(command -v node || command -v nodejs) + if [ -z "$NODE" ]; then + echo 'Unable to find ronn or node/npm -- cannot build man pages!' + exit 1 + fi - if [ ! -f node_modules/marked-man/bin/marked-man ]; then - echo 'Installing npm package "marked-man" -- MarkDown to ROFF converter...' - npm install marked-man - fi + if ! npx --no-install marked-man --version >/dev/null 2>&1; then + echo 'Installing npm package "marked-man" -- MarkDown to ROFF converter...' + npm install marked-man + fi - $NODE node_modules/marked-man/bin/marked-man zerotier-cli.1.md >zerotier-cli.1 - $NODE node_modules/marked-man/bin/marked-man zerotier-idtool.1.md >zerotier-idtool.1 - $NODE node_modules/marked-man/bin/marked-man zerotier-one.8.md >zerotier-one.8 + npx --no-install marked-man backone-cli.1.md >backone-cli.1 + npx --no-install marked-man backone-idtool.1.md >backone-idtool.1 + npx --no-install marked-man backone.8.md >backone.8 fi exit 0 diff --git a/doc/zerotier-one.8 b/doc/zerotier-one.8 deleted file mode 100644 index 4ad7a15..0000000 --- a/doc/zerotier-one.8 +++ /dev/null @@ -1,104 +0,0 @@ -.TH "ZEROTIER\-ONE" "8" "December 2016" "" "" -.SH "NAME" -\fBzerotier-one\fR \- ZeroTier virtual network endpoint service -.SH SYNOPSIS -.P -\fBzerotier\-one\fP [\-switches] [working directory] -.SH DESCRIPTION -.P -\fBzerotier\-one\fR is the service/daemon responsible for connecting a Unix (Linux/BSD/OSX) system to one or more ZeroTier virtual networks and presenting those networks to the system as virtual network ports\. You can think of it as a peer to peer VPN client\. -.P -It's typically run by init systems like systemd (Linux) or launchd (Mac) rather than directly by the user, and it must be run as root unless you give it the \fB\-U\fP switch and don't plan on actually joining networks (e\.g\. to run a network controller microservice only)\. -.P -The \fBzerotier\-one\fR service keeps its state and other files in a working directory\. If this directory is not specified at launch it defaults to "/var/lib/zerotier\-one" on Linux, "/Library/Application Support/ZeroTier/One" on Mac, and "/var/db/zerotier\-one" on FreeBSD and other similar BSDs\. The working directory should persist\. It shouldn't be automatically cleaned by system cleanup daemons or stored in a volatile location\. Loss of its identity\.secret file results in loss of this system's unique 10\-digit ZeroTier address and key\. -.P -Multiple instances of \fBzerotier\-one\fR can be run on the same system as long as they are run with different primary ports (see switches) and a different working directory\. But since a single service can join any number of networks, typically there's no point in doing this\. -.P -The \fBzerotier\-one\fR service is controlled via a JSON API available at 127\.0\.0\.1: with the default primary port being 9993\. Access to this API requires an authorization token normally found in the authtoken\.secret file in the service's working directory\. On some platforms access may be guarded by other measures such as socket peer UID/GID lookup if additional security options are enabled (this is not the default)\. -.P -The first time the service is started in a fresh working directory, it generates a ZeroTier identity\. On slow systems this process can take ten seconds or more due to an anti\-DDOS/anti\-counterfeit proof of work function used by ZeroTier in address generation\. This only happens once, and once generated the result is saved in identity\.secret in the working directory\. This file represents and defines/claims your ZeroTier address and associated ECC\-256 key pair\. -.SH SWITCHES -.RS 0 -.IP \(bu 2 -\fB\-h\fP: -Display help\. -.IP \(bu 2 -\fB\-v\fP: -Display ZeroTier One version\. -.IP \(bu 2 -\fB\-U\fP: -Skip privilege check and allow to be run by non\-privileged user\. This is typically used when \fBzerotier\-one\fR is built with the network controller option included\. In this case the ZeroTier service might only be acting as a network controller and might never actually join networks, in which case it does not require elevated system permissions\. -.IP \(bu 2 -\fB\-p\fP: -Specify a different primary port\. If this is not given the default is 9993\. If zero is given a random port is chosen each time\. -.IP \(bu 2 -\fB\-d\fP: -Fork and run as a daemon\. -.IP \(bu 2 -\fB\-i\fP: -Invoke the \fBzerotier\-idtool\fR personality, in which case the binary behaves like zerotier\-idtool(1)\. This happens automatically if the name of the binary (or a symlink to it) is zerotier\-idtool\. -.IP \(bu 2 -\fB\-q\fP: -Invoke the \fBzerotier\-cli\fR personality, in which case the binary behaves like zerotier\-cli(1)\. This happens automatically if the name of the binary (or a symlink to it) is zerotier\-cli\. - -.RE -.SH EXAMPLES -.P -Run as daemon with OS default working directory and default port: -.P -.RS 2 -.nf -$ sudo zerotier\-one \-d -.fi -.RE -.P -Run as daemon with a different working directory and port: -.P -.RS 2 -.nf -$ sudo zerotier\-one \-d \-p12345 /tmp/zerotier\-working\-directory\-test -.fi -.RE -.SH FILES -.P -These are found in the service's working directory\. -.RS 0 -.IP \(bu 2 -\fBidentity\.public\fP: -The public portion of your ZeroTier identity, which is your 10\-digit hex address and the associated public key\. -.IP \(bu 2 -\fBidentity\.secret\fP: -Your full ZeroTier identity including its private key\. This file identifies the system on the network, which means you can move a ZeroTier address around by copying this file and you should back up this file if you want to save your system's static ZeroTier address\. This file must be protected, since theft of its secret key will allow anyone to impersonate your device on any network and decrypt traffic\. For network controllers this file is particularly sensitive since it constitutes the private key for a certificate authority for the controller's networks\. -.IP \(bu 2 -\fBauthtoken\.secret\fP: -The secret token used to authenticate requests to the service's local JSON API\. If it does not exist it is generated from a secure random source on service start\. To use, send it in the "X\-ZT1\-Auth" header with HTTP requests to 127\.0\.0\.1:\|\. -.IP \(bu 2 -\fBdevicemap\fP: -Remembers mappings of zt# interface numbers to ZeroTier networks so they'll persist across restarts\. On some systems that support longer interface names that can encode the network ID (such as FreeBSD) this file may not be present\. -.IP \(bu 2 -\fBzerotier\-one\.pid\fP: -ZeroTier's PID\. This file is deleted on normal shutdown\. -.IP \(bu 2 -\fBzerotier\-one\.port\fP: -ZeroTier's primary port, which is also where its JSON API is found at 127\.0\.0\.1:\|\. This file is created on startup and is read by zerotier\-cli(1) to determine where it should find the control API\. -.IP \(bu 2 -\fBcontroller\.db\fP: -If the ZeroTier One service is built with the network controller enabled, this file contains the controller's SQLite3 database\. -.IP \(bu 2 -\fBcontroller\.db\.backup\fP: -If the ZeroTier One service is built with the network controller enabled, it periodically backs up its controller\.db database in this file (currently every 5 minutes if there have been changes)\. Since this file is not a currently in use SQLite3 database it's safer to back up without corruption\. On new backups the file is rotated out rather than being rewritten in place\. -.IP \(bu 2 -\fBiddb\.d/\fP (directory): -Caches the public identity of every peer ZeroTier has spoken with in the last 60 days\. This directory and its contents can be deleted, but this may result in slower connection initations since it will require that we go out and re\-fetch full identities for peers we're speaking to\. -.IP \(bu 2 -\fBnetworks\.d\fP (directory): -This caches network configurations and certificate information for networks you belong to\. ZeroTier scans this directory for \|\.conf files on startup to recall its networks, so "touch"ing an empty \|\.conf file in this directory is a way of pre\-configuring ZeroTier to join a specific network on startup without using the API\. If the config file is empty ZeroTIer will just fetch it from the network's controller\. - -.RE -.SH COPYRIGHT -.P -(c)2011\-2016 ZeroTier, Inc\. \-\- https://www\.zerotier\.com/ \-\- https://github\.com/zerotier -.SH SEE ALSO -.P -zerotier\-cli(1), zerotier\-idtool(1) - diff --git a/doc/zerotier-one.8.md b/doc/zerotier-one.8.md deleted file mode 100644 index 4f46550..0000000 --- a/doc/zerotier-one.8.md +++ /dev/null @@ -1,95 +0,0 @@ -zerotier-one(8) -- ZeroTier virtual network endpoint service -============================================================ - -## SYNOPSIS - -`zerotier-one` [-switches] [working directory] - -## DESCRIPTION - -**zerotier-one** is the service/daemon responsible for connecting a Unix (Linux/BSD/OSX) system to one or more ZeroTier virtual networks and presenting those networks to the system as virtual network ports. You can think of it as a peer to peer VPN client. - -It's typically run by init systems like systemd (Linux) or launchd (Mac) rather than directly by the user, and it must be run as root unless you give it the `-U` switch and don't plan on actually joining networks (e.g. to run a network controller microservice only). - -The **zerotier-one** service keeps its state and other files in a working directory. If this directory is not specified at launch it defaults to "/var/lib/zerotier-one" on Linux, "/Library/Application Support/ZeroTier/One" on Mac, and "/var/db/zerotier-one" on FreeBSD and other similar BSDs. The working directory should persist. It shouldn't be automatically cleaned by system cleanup daemons or stored in a volatile location. Loss of its identity.secret file results in loss of this system's unique 10-digit ZeroTier address and key. - -Multiple instances of **zerotier-one** can be run on the same system as long as they are run with different primary ports (see switches) and a different working directory. But since a single service can join any number of networks, typically there's no point in doing this. - -The **zerotier-one** service is controlled via a JSON API available at 127.0.0.1: with the default primary port being 9993. Access to this API requires an authorization token normally found in the authtoken.secret file in the service's working directory. On some platforms access may be guarded by other measures such as socket peer UID/GID lookup if additional security options are enabled (this is not the default). - -The first time the service is started in a fresh working directory, it generates a ZeroTier identity. On slow systems this process can take ten seconds or more due to an anti-DDOS/anti-counterfeit proof of work function used by ZeroTier in address generation. This only happens once, and once generated the result is saved in identity.secret in the working directory. This file represents and defines/claims your ZeroTier address and associated ECC-256 key pair. - -## SWITCHES - - * `-h`: - Display help. - - * `-v`: - Display ZeroTier One version. - - * `-U`: - Skip privilege check and allow to be run by non-privileged user. This is typically used when **zerotier-one** is built with the network controller option included. In this case the ZeroTier service might only be acting as a network controller and might never actually join networks, in which case it does not require elevated system permissions. - - * `-p`: - Specify a different primary port. If this is not given the default is 9993. If zero is given a random port is chosen each time. - - * `-d`: - Fork and run as a daemon. - - * `-i`: - Invoke the **zerotier-idtool** personality, in which case the binary behaves like zerotier-idtool(1). This happens automatically if the name of the binary (or a symlink to it) is zerotier-idtool. - - * `-q`: - Invoke the **zerotier-cli** personality, in which case the binary behaves like zerotier-cli(1). This happens automatically if the name of the binary (or a symlink to it) is zerotier-cli. - -## EXAMPLES - -Run as daemon with OS default working directory and default port: - - $ sudo zerotier-one -d - -Run as daemon with a different working directory and port: - - $ sudo zerotier-one -d -p12345 /tmp/zerotier-working-directory-test - -## FILES - -These are found in the service's working directory. - - * `identity.public`: - The public portion of your ZeroTier identity, which is your 10-digit hex address and the associated public key. - - * `identity.secret`: - Your full ZeroTier identity including its private key. This file identifies the system on the network, which means you can move a ZeroTier address around by copying this file and you should back up this file if you want to save your system's static ZeroTier address. This file must be protected, since theft of its secret key will allow anyone to impersonate your device on any network and decrypt traffic. For network controllers this file is particularly sensitive since it constitutes the private key for a certificate authority for the controller's networks. - - * `authtoken.secret`: - The secret token used to authenticate requests to the service's local JSON API. If it does not exist it is generated from a secure random source on service start. To use, send it in the "X-ZT1-Auth" header with HTTP requests to 127.0.0.1:. - - * `devicemap`: - Remembers mappings of zt# interface numbers to ZeroTier networks so they'll persist across restarts. On some systems that support longer interface names that can encode the network ID (such as FreeBSD) this file may not be present. - - * `zerotier-one.pid`: - ZeroTier's PID. This file is deleted on normal shutdown. - - * `zerotier-one.port`: - ZeroTier's primary port, which is also where its JSON API is found at 127.0.0.1:. This file is created on startup and is read by zerotier-cli(1) to determine where it should find the control API. - - * `controller.db`: - If the ZeroTier One service is built with the network controller enabled, this file contains the controller's SQLite3 database. - - * `controller.db.backup`: - If the ZeroTier One service is built with the network controller enabled, it periodically backs up its controller.db database in this file (currently every 5 minutes if there have been changes). Since this file is not a currently in use SQLite3 database it's safer to back up without corruption. On new backups the file is rotated out rather than being rewritten in place. - - * `iddb.d/` (directory): - Caches the public identity of every peer ZeroTier has spoken with in the last 60 days. This directory and its contents can be deleted, but this may result in slower connection initiations since it will require that we go out and re-fetch full identities for peers we're speaking to. - - * `networks.d` (directory): - This caches network configurations and certificate information for networks you belong to. ZeroTier scans this directory for .conf files on startup to recall its networks, so "touch"ing an empty .conf file in this directory is a way of pre-configuring ZeroTier to join a specific network on startup without using the API. If the config file is empty ZeroTIer will just fetch it from the network's controller. - -## COPYRIGHT - -(c)2011-2016 ZeroTier, Inc. -- https://www.zerotier.com/ -- https://github.com/zerotier - -## SEE ALSO - -zerotier-cli(1), zerotier-idtool(1) diff --git a/entrypoint.sh.release b/entrypoint.sh.release index 284a3d4..8dd3fc0 100644 --- a/entrypoint.sh.release +++ b/entrypoint.sh.release @@ -1,7 +1,7 @@ #!/bin/sh grepzt() { - [ -f /var/lib/zerotier-one/zerotier-one.pid -a -n "$(cat /var/lib/zerotier-one/zerotier-one.pid 2>/dev/null)" -a -d "/proc/$(cat /var/lib/zerotier-one/zerotier-one.pid 2>/dev/null)" ] + [ -f "$ZEROTIER_HOME/$ZT_PID_FILE" -a -n "$(cat "$ZEROTIER_HOME/$ZT_PID_FILE" 2>/dev/null)" -a -d "/proc/$(cat "$ZEROTIER_HOME/$ZT_PID_FILE" 2>/dev/null)" ] return $? } @@ -10,9 +10,9 @@ mkztfile() { mode=$2 content=$3 - mkdir -p /var/lib/zerotier-one - echo "$content" > "/var/lib/zerotier-one/$file" - chmod "$mode" "/var/lib/zerotier-one/$file" + mkdir -p "$ZEROTIER_HOME" + echo "$content" > "$ZEROTIER_HOME/$file" + chmod "$mode" "$ZEROTIER_HOME/$file" } if [ "x$ZEROTIER_API_SECRET" != "x" ] @@ -30,11 +30,11 @@ then mkztfile identity.secret 0600 "$ZEROTIER_IDENTITY_SECRET" fi -mkztfile zerotier-one.port 0600 "9993" +mkztfile "$ZT_PORT_FILE" 0600 "9993" killzerotier() { log "Killing zerotier" - kill $(cat /var/lib/zerotier-one/zerotier-one.pid 2>/dev/null) + kill $(cat "$ZEROTIER_HOME/$ZT_PID_FILE" 2>/dev/null) exit 0 } @@ -69,13 +69,13 @@ log_detail_params() { trap killzerotier INT TERM log "Configuring networks to join" -mkdir -p /var/lib/zerotier-one/networks.d +mkdir -p "$ZEROTIER_HOME/networks.d" log_params "Joining networks from command line:" $@ for i in "$@" do log_detail_params "Configuring join:" "$i" - touch "/var/lib/zerotier-one/networks.d/${i}.conf" + touch "$ZEROTIER_HOME/networks.d/${i}.conf" done if [ "x$ZEROTIER_JOIN_NETWORKS" != "x" ] @@ -84,12 +84,12 @@ then for i in $ZEROTIER_JOIN_NETWORKS do log_detail_params "Configuring join:" "$i" - touch "/var/lib/zerotier-one/networks.d/${i}.conf" + touch "$ZEROTIER_HOME/networks.d/${i}.conf" done fi log "Starting ZeroTier" -nohup /usr/sbin/zerotier-one & +nohup "$ZT_DAEMON" & while ! grepzt do @@ -109,13 +109,13 @@ cat >/healthcheck.sh </dev/null + trap TERM + fi + [ $RETVAL -eq 0 ] && rm -f $lockfile + echo +} + +reload() +{ + stop + start +} + +restart() { + stop + start +} + +force_reload() { + restart +} + +rh_status() { + status -p $PID_FILE backone +} + +rh_status_q() { + rh_status >/dev/null 2>&1 +} + +case "$1" in + start) + rh_status_q && exit 0 + start + ;; + stop) + if ! rh_status_q; then + rm -f $lockfile + exit 0 + fi + stop + ;; + restart) + restart + ;; + reload) + rh_status_q || exit 7 + reload + ;; + force-reload) + force_reload + ;; + condrestart|try-restart) + rh_status_q || exit 0 + if [ -f $lockfile ] ; then + do_restart_sanity_check + if [ $RETVAL -eq 0 ] ; then + stop + # avoid race + sleep 3 + start + else + RETVAL=6 + fi + fi + ;; + status) + rh_status + RETVAL=$? + if [ $RETVAL -eq 3 -a -f $lockfile ] ; then + RETVAL=2 + fi + ;; + *) + echo $"Usage: $0 {start|stop|restart|reload|force-reload|condrestart|try-restart|status}" + RETVAL=2 +esac +exit $RETVAL diff --git a/ext/installfiles/linux/zerotier-one.te b/ext/installfiles/linux/backone.te similarity index 90% rename from ext/installfiles/linux/zerotier-one.te rename to ext/installfiles/linux/backone.te index 978df0b..80f43a1 100644 --- a/ext/installfiles/linux/zerotier-one.te +++ b/ext/installfiles/linux/backone.te @@ -1,5 +1,5 @@ -module zerotier-one 1.0; +module backone 1.0; require { type unconfined_t; diff --git a/ext/installfiles/linux/zerotier-one.init.rhel6 b/ext/installfiles/linux/zerotier-one.init.rhel6 deleted file mode 100755 index 3ff2f18..0000000 --- a/ext/installfiles/linux/zerotier-one.init.rhel6 +++ /dev/null @@ -1,138 +0,0 @@ -#!/bin/bash -# -# zerotier-one Start the ZeroTier One network virtualization service -# -# chkconfig: 2345 55 25 -# description: ZeroTier One allows systems to join and participate in \ -# ZeroTier virtual networks. See https://www.zerotier.com/ -# -# processname: zerotier-one -# config: /var/lib/zerotier-one/identity.public -# config: /var/lib/zerotier-one/identity.secret -# config: /var/lib/zerotier-one/local.conf -# config: /var/lib/zerotier-one/authtoken.secret -# pidfile: /var/lib/zerotier-one/zerotier-one.pid - -### BEGIN INIT INFO -# Provides: zerotier-one -# Required-Start: $local_fs $network $syslog -# Required-Stop: $local_fs $syslog -# Should-Start: $syslog -# Should-Stop: $network $syslog -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Short-Description: Start the ZeroTier One network virtualization service -# Description: ZeroTier One allows systems to join and participate in -# ZeroTier virtual networks. See https://www.zerotier.com/ -### END INIT INFO - -# source function library -. /etc/rc.d/init.d/functions - -# pull in sysconfig settings -[ -f /etc/sysconfig/zerotier-one ] && . /etc/sysconfig/zerotier-one - -RETVAL=0 -prog="zerotier-one" -lockfile=/var/lock/subsys/$prog -ZT="/usr/sbin/zerotier-one" -PID_FILE=/var/lib/zerotier-one/zerotier-one.pid - -runlevel=$(set -- $(runlevel); eval "echo \$$#" ) - -start() -{ - [ -x $ZT ] || exit 5 - echo -n $"Starting $prog: " - $ZT $ZT_OPTIONS -d && success || failure - RETVAL=$? - [ $RETVAL -eq 0 ] && touch $lockfile - echo - return $RETVAL -} - -stop() -{ - echo -n $"Stopping $prog: " - killproc -p $PID_FILE $ZT - RETVAL=$? - if [ "x$runlevel" = x0 -o "x$runlevel" = x6 ] ; then - trap '' TERM - killall $prog 2>/dev/null - trap TERM - fi - [ $RETVAL -eq 0 ] && rm -f $lockfile - echo -} - -reload() -{ - stop - start -} - -restart() { - stop - start -} - -force_reload() { - restart -} - -rh_status() { - status -p $PID_FILE zerotier-one -} - -rh_status_q() { - rh_status >/dev/null 2>&1 -} - -case "$1" in - start) - rh_status_q && exit 0 - start - ;; - stop) - if ! rh_status_q; then - rm -f $lockfile - exit 0 - fi - stop - ;; - restart) - restart - ;; - reload) - rh_status_q || exit 7 - reload - ;; - force-reload) - force_reload - ;; - condrestart|try-restart) - rh_status_q || exit 0 - if [ -f $lockfile ] ; then - do_restart_sanity_check - if [ $RETVAL -eq 0 ] ; then - stop - # avoid race - sleep 3 - start - else - RETVAL=6 - fi - fi - ;; - status) - rh_status - RETVAL=$? - if [ $RETVAL -eq 3 -a -f $lockfile ] ; then - RETVAL=2 - fi - ;; - *) - echo $"Usage: $0 {start|stop|restart|reload|force-reload|condrestart|try-restart|status}" - RETVAL=2 -esac -exit $RETVAL diff --git a/make-bsd.mk b/make-bsd.mk index ce0b4dd..b70fb79 100644 --- a/make-bsd.mk +++ b/make-bsd.mk @@ -157,42 +157,42 @@ CXXFLAGS+=$(CFLAGS) -std=c++17 #-D_GLIBCXX_USE_C99 -D_GLIBCXX_USE_C99_MATH -D_GL all: one one: $(CORE_OBJS) $(ONE_OBJS) one.o - $(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one $(CORE_OBJS) $(ONE_OBJS) one.o $(LIBS) - $(STRIP) zerotier-one - ln -sf zerotier-one zerotier-idtool - ln -sf zerotier-one zerotier-cli + $(CXX) $(CXXFLAGS) $(LDFLAGS) -o backone $(CORE_OBJS) $(ONE_OBJS) one.o $(LIBS) + $(STRIP) backone + ln -sf backone backone-idtool + ln -sf backone backone-cli -zerotier-one: one +backone: one -zerotier-idtool: one +backone-idtool: one -zerotier-cli: one +backone-cli: one -libzerotiercore.a: $(CORE_OBJS) - ar rcs libzerotiercore.a $(CORE_OBJS) - ranlib libzerotiercore.a +libbackonecore.a: $(CORE_OBJS) + ar rcs libbackonecore.a $(CORE_OBJS) + ranlib libbackonecore.a -core: libzerotiercore.a +core: libbackonecore.a selftest: $(CORE_OBJS) $(ONE_OBJS) selftest.o - $(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-selftest selftest.o $(CORE_OBJS) $(ONE_OBJS) $(LIBS) - $(STRIP) zerotier-selftest + $(CXX) $(CXXFLAGS) $(LDFLAGS) -o backone-selftest selftest.o $(CORE_OBJS) $(ONE_OBJS) $(LIBS) + $(STRIP) backone-selftest -zerotier-selftest: selftest +backone-selftest: selftest clean: - rm -rf *.a *.o node/*.o controller/*.o osdep/*.o service/*.o ext/http-parser/*.o build-* zerotier-one zerotier-idtool zerotier-selftest zerotier-cli $(ONE_OBJS) $(CORE_OBJS) + rm -rf *.a *.o node/*.o controller/*.o osdep/*.o service/*.o ext/http-parser/*.o build-* backone backone-idtool backone-selftest backone-cli $(ONE_OBJS) $(CORE_OBJS) debug: FORCE $(MAKE) -j ZT_DEBUG=1 install: one - rm -f /usr/local/sbin/zerotier-one - cp zerotier-one /usr/local/sbin - ln -sf /usr/local/sbin/zerotier-one /usr/local/sbin/zerotier-cli - ln -sf /usr/local/sbin/zerotier-one /usr/local/bin/zerotier-idtool + rm -f /usr/local/sbin/backone + cp backone /usr/local/sbin + ln -sf /usr/local/sbin/backone /usr/local/sbin/backone-cli + ln -sf /usr/local/sbin/backone /usr/local/bin/backone-idtool uninstall: FORCE - rm -rf /usr/local/sbin/zerotier-one /usr/local/sbin/zerotier-cli /usr/local/bin/zerotier-idtool /var/db/zerotier-one/zerotier-one.port /var/db/zerotier-one/zerotier-one.pid /var/db/zerotier-one/iddb.d + rm -rf /usr/local/sbin/backone /usr/local/sbin/backone-cli /usr/local/bin/backone-idtool /var/db/backone/backone.port /var/db/backone/backone.pid /var/db/backone/iddb.d FORCE: diff --git a/make-linux.mk b/make-linux.mk index f113fea..efd2402 100644 --- a/make-linux.mk +++ b/make-linux.mk @@ -9,7 +9,7 @@ ifeq ($(origin CXX),default) CXX:=$(shell if [ -e /opt/rh/devtoolset-8/root/usr/bin/g++ ]; then echo /opt/rh/devtoolset-8/root/usr/bin/g++; else echo $(CXX); fi) endif -INCLUDES?=-Irustybits/target -isystem ext -Iext/prometheus-cpp-lite-1.0/core/include -Iext-prometheus-cpp-lite-1.0/3rdparty/http-client-lite/include -Iext/prometheus-cpp-lite-1.0/simpleapi/include +INCLUDES?=-Irustybits/target -isystem ext -isystem ext/liboqs/include -Iext/prometheus-cpp-lite-1.0/core/include -Iext-prometheus-cpp-lite-1.0/3rdparty/http-client-lite/include -Iext/prometheus-cpp-lite-1.0/simpleapi/include DEFS?= LDLIBS?= DESTDIR?= @@ -46,6 +46,15 @@ endif # Trying to use dynamically linked libhttp-parser causes tons of compatibility problems. ONE_OBJS+=ext/http-parser/http_parser.o +# ext/liboqs 0.16.0 vendored: PQ objects (list in objects.mk), isolated flags +override CORE_OBJS+=$(OQS_OBJS) +OQS_CFLAGS=-isystem ext/liboqs/include -isystem ext/liboqs/src -isystem ext/liboqs/src/common/pqclean_shims \ + -Iext/liboqs/src/kem/ml_kem/mlkem-native_ml-kem-768_ref \ + -Iext/liboqs/src/sig/ml_dsa/mldsa-native_ml-dsa-65_ref \ + -Iext/liboqs/src/common/sha3/xkcp_low/KeccakP-1600/plain-64bits \ + -DMLK_CONFIG_PARAMETER_SET=768 -DMLK_CONFIG_FILE=\"../../integration/liboqs/config_c.h\" \ + -DMLD_CONFIG_PARAMETER_SET=65 -DMLD_CONFIG_FILE=\"../../integration/liboqs/config_c.h\" + ifeq ($(ZT_RULES_ENGINE_DEBUGGING),1) override DEFS+=-DZT_RULES_ENGINE_DEBUGGING endif @@ -319,6 +328,11 @@ ifeq ($(ZT_OFFICIAL),1) CORE_OBJS+=ext/misc/linux-old-glibc-compat.o override LDFLAGS+=-Wl,--wrap=memcpy -static-libstdc++ endif +ifeq ($(ZT_COVERAGE),1) + override CFLAGS+=--coverage + override CXXFLAGS+=--coverage + override LDFLAGS+=--coverage +endif ifeq ($(ZT_CONTROLLER),1) override CXXFLAGS+=-Wall -Wno-deprecated -std=c++17 -pthread $(INCLUDES) -DNDEBUG $(DEFS) @@ -365,6 +379,8 @@ override CXXFLAGS+=-fPIC -fPIE # Non-executable stack override LDFLAGS+=-Wl,-z,noexecstack +ext/liboqs/src/%.o: ext/liboqs/src/%.c + $(CC) $(CFLAGS) $(OQS_CFLAGS) -c -o $@ $< .PHONY: all all: one diff --git a/make-netbsd.mk b/make-netbsd.mk index f249003..7a477cb 100644 --- a/make-netbsd.mk +++ b/make-netbsd.mk @@ -39,21 +39,21 @@ CXXFLAGS+=$(CFLAGS) -fno-rtti -fpermissive all: one one: $(OBJS) service/OneService.o one.o - $(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one $(OBJS) service/OneService.o one.o $(LIBS) - $(STRIP) zerotier-one - ln -sf zerotier-one zerotier-idtool - ln -sf zerotier-one zerotier-cli + $(CXX) $(CXXFLAGS) $(LDFLAGS) -o backone $(OBJS) service/OneService.o one.o $(LIBS) + $(STRIP) backone + ln -sf backone backone-idtool + ln -sf backone backone-cli selftest: $(OBJS) selftest.o - $(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-selftest selftest.o $(OBJS) $(LIBS) - $(STRIP) zerotier-selftest + $(CXX) $(CXXFLAGS) $(LDFLAGS) -o backone-selftest selftest.o $(OBJS) $(LIBS) + $(STRIP) backone-selftest # No installer on FreeBSD yet #installer: one FORCE # ./buildinstaller.sh clean: - rm -rf *.o node/*.o controller/*.o osdep/*.o service/*.o ext/http-parser/*.o ext/lz4/*.o ext/json-parser/*.o build-* zerotier-one zerotier-idtool zerotier-selftest zerotier-cli ZeroTierOneInstaller-* + rm -rf *.o node/*.o controller/*.o osdep/*.o service/*.o ext/http-parser/*.o ext/lz4/*.o ext/json-parser/*.o build-* backone backone-idtool backone-selftest backone-cli ZeroTierOneInstaller-* debug: FORCE make -j 4 ZT_DEBUG=1 diff --git a/pkg/snap/snapcraft.yaml b/pkg/snap/snapcraft.yaml index 57a2ed8..6dc6f55 100644 --- a/pkg/snap/snapcraft.yaml +++ b/pkg/snap/snapcraft.yaml @@ -1,13 +1,13 @@ -name: zerotier +name: backone summary: Securely connect any device, anywhere. description: | - ZeroTier is a software-based managed Ethernet switch for planet Earth. Use it to connect your - desktop clients, servers, phones, NAS, or even individual applications (using our SDK). + BackOne is a fork of ZeroTier, a software-based managed Ethernet switch for planet Earth. Use it + to connect your desktop clients, servers, phones, NAS, or even individual applications (using + our SDK). - This snap contains ZeroTier One, a service that provides ZeroTier network connectivity and - makes joining virtual networks as easy as joining IRC or Slack channels. Apps for Android - and iOS are available for free in the Google Play and Apple app stores. + This snap contains the BackOne daemon, a service that provides ZeroTier network connectivity + and makes joining virtual networks as easy as joining IRC or Slack channels. ZeroTier eliminates the LAN/WAN distinction and makes VPNs, tunnels, proxies, and other kludges arising from the inflexible nature of physical networks obsolete. Everything is encrypted @@ -15,14 +15,12 @@ description: | Install (be sure to use sudo) - sudo snap install zerotier + sudo snap install backone Join your network - sudo zerotier join - sudo zerotier status - - Approve your new node in ZeroTier Central (https://my.zerotier.com)! Welcome online! + sudo backone join + sudo backone status adopt-info: one confinement: strict @@ -32,41 +30,39 @@ base: core18 apps: one: # Add -U to prevent attempting to drop privileges since snaps have their - # own containment mechanism. Otherwise, if a user named "zerotier-one" + # own containment mechanism. Otherwise, if a user named "backone" # exists on the system, the setgid or related calls will fail. - command: usr/sbin/zerotier-one -U + command: usr/sbin/backone -U daemon: simple plugs: - network - network-bind - network-control - # For backwards compatibility with old package (e.g. zerotier.cli) - # Should be removed someday cli: - command: usr/sbin/zerotier-cli + command: usr/sbin/backone-cli plugs: - network - zerotier: - command: usr/sbin/zerotier-cli + backone: + command: usr/sbin/backone-cli plugs: - network idtool: - command: usr/sbin/zerotier-idtool + command: usr/sbin/backone-idtool plugs: - network layout: - /var/lib/zerotier-one: + /var/lib/backone: bind: $SNAP_COMMON parts: one: plugin: make - source: https://github.com/zerotier/zerotierone.git - source-branch: "master" + source: https://git.proit.id/dsutanto/BackOne.git + source-branch: "main" build-packages: - build-essential - libc++-dev @@ -74,17 +70,17 @@ parts: - ZT_SSO_SUPPORTED=0 filesets: binaries: - - usr/sbin/zerotier-one - - usr/sbin/zerotier-cli - - usr/sbin/zerotier-idtool + - usr/sbin/backone + - usr/sbin/backone-cli + - usr/sbin/backone-idtool prime: - $binaries override-build: | snapcraftctl build # Grab the version string from the newly-compiled binary. - snapcraftctl set-version "$(./zerotier-one -v)" + snapcraftctl set-version "$(./backone -v)" slots: - zerotier-control: + backone-control: interface: content read: - $SNAP_COMMON diff --git a/rule-compiler/package.json b/rule-compiler/package.json index 1db006b..f5dad9a 100644 --- a/rule-compiler/package.json +++ b/rule-compiler/package.json @@ -3,9 +3,9 @@ "version": "1.2.2-2", "description": "ZeroTier Rule Script Compiler", "main": "cli.js", - "scripts": { - "test": "echo \"Error: no test specified\" && exit 1" - }, + "scripts": { + "test": "node test.js" + }, "repository": { "type": "git", "url": "https://github.com/zerotier/ZeroTierOne/rule-compiler" diff --git a/rule-compiler/test.js b/rule-compiler/test.js new file mode 100644 index 0000000..0611a69 --- /dev/null +++ b/rule-compiler/test.js @@ -0,0 +1,39 @@ +'use strict'; + +const assert = require('assert'); +const fs = require('fs'); +const path = require('path'); +const RuleCompiler = require('./rule-compiler.js'); + +// 1. Bundled example ruleset compiles and produces expected cap/tag metadata. +const rules = []; +const caps = {}; +const tags = {}; +let err = RuleCompiler.compile( + fs.readFileSync(path.join(__dirname, 'examples', 'capabilities-and-tags.ztrules')).toString(), + rules, caps, tags); +assert.strictEqual(err, null, 'example ruleset must compile, got: ' + JSON.stringify(err)); +assert.ok(Array.isArray(rules) && rules.length > 0, 'document-level rules emitted'); +assert.strictEqual(caps.ssh.id, 1000, 'cap ssh id'); +assert.strictEqual(caps.ssh.default, false, 'cap ssh not default'); +assert.ok(caps.ssh.rules.length > 0, 'cap ssh body rendered'); +assert.strictEqual(tags.department.id, 1000, 'tag department id'); +assert.strictEqual(tags.department.enums.engineering, 400, 'tag department enum'); +assert.ok(rules.some(r => r.type === 'ACTION_ACCEPT'), 'example contains an accept rule'); + +// 2. Syntax/semantic errors return [line, col, message], not a throw. +err = RuleCompiler.compile('tag broken\n;\n', [], {}, {}); +assert.ok(Array.isArray(err) && err.length === 3, 'error tuple returned'); +assert.ok(err[0] >= 1, 'error carries line number'); +assert.strictEqual(typeof err[2], 'string'); +assert.ok(err[2].length > 0, 'error carries message'); + +// 3. Undefined tag reference rejected with error tuple. +err = RuleCompiler.compile('accept tdiff nosuchtag 1;\n', [], {}, {}); +assert.ok(Array.isArray(err) && err.length === 3, 'undefined tag rejected'); + +// 4. Non-string src rejected without throwing. +err = RuleCompiler.compile(42, [], {}, {}); +assert.ok(Array.isArray(err), 'non-string src rejected'); + +console.log('rule-compiler: all tests passed'); diff --git a/service/README.md b/service/README.md index 94e920a..b816dc2 100644 --- a/service/README.md +++ b/service/README.md @@ -41,7 +41,14 @@ Settings available in `local.conf` (this is not valid JSON, and JSON does not al "allowManagementFrom": [ "NETWORK/bits", ...] |null, /* If non-NULL, allow JSON/HTTP management from this IP network. Default is 127.0.0.1 only. */ "bind": [ "ip",... ], /* If present and non-null, bind to these IPs instead of to each interface (wildcard IP allowed) */ "allowTcpFallbackRelay": true|false, /* Allow or disallow establishment of TCP relay connections (true by default) */ - "multipathMode": 0|1|2 /* multipath mode: none (0), random (1), proportional (2) */ + "multipathMode": 0|1|2, /* multipath mode: none (0), random (1), proportional (2) */ + "redis": { /* Optional, requires controllerDbPath starting with "postgres:" */ + "hostname": "str", /* Redis server host */ + "port": 1-65535, /* Redis server port */ + "password": "str", /* Auth password, "" for none */ + "clusterMode": true|false, /* Connect via RedisCluster instead of standalone */ + "db": 0-15 /* Database index, standalone mode only (cluster mode forces 0) */ + }, } } ``` diff --git a/tools/lint.sh b/tools/lint.sh new file mode 100755 index 0000000..428a694 --- /dev/null +++ b/tools/lint.sh @@ -0,0 +1,59 @@ +#!/usr/bin/env bash +# clang-format gate. Whole repo has format debt (139/141 first-party files fail), +# so default mode checks only lines CHANGED vs base. --all checks whole files. +# Usage: tools/lint.sh [base-commit] | tools/lint.sh --all +set -euo pipefail +cd "$(dirname "$0")/.." + +CF="${CLANG_FORMAT:-$(command -v clang-format || true)}" +if [ -z "$CF" ]; then + echo "lint: clang-format not found (pip install clang-format)" >&2 + exit 2 +fi + +PATHSPEC=( + '*.cpp' '*.hpp' '*.h' + ':(exclude)ext/*' ':(exclude)java/*' ':(exclude)rustybits/*' + ':(exclude)windows/*' ':(exclude)attic/*' +) + +fail=0 + +check() { # $1=file, rest=--lines args; empty args = whole file + local f=$1 + shift + if ! "$CF" --dry-run --Werror "$@" "$f"; then + fail=1 + fi +} + +if [ "${1:-}" = "--all" ]; then + while IFS= read -r f; do check "$f"; done < <(git ls-files "${PATHSPEC[@]}") +else + base=${1:-} + if [ -z "$base" ]; then + base=$(git merge-base HEAD '@{upstream}' 2>/dev/null || echo HEAD~1) + fi + # tracked changed files: only changed line ranges (MR = modified/renamed content) + while IFS= read -r f; do + args=() + while IFS= read -r hunk; do + # new-side header is "+start,count" (git diff format), not "+start,end" + [[ $hunk =~ \+([0-9]+)(,([0-9]+))? ]] || continue + start=${BASH_REMATCH[1]} + count=${BASH_REMATCH[3]:-1} + end=$((start + count - 1)) + if [ "$count" -eq 0 ]; then # deletion-only: nearest surviving line + start=$((start > 1 ? start - 1 : 1)) + end=$start + fi + args+=(--lines="$start:$end") + done < <(git diff -U0 --no-color "$base" --diff-filter=ACMR -- "$f" | grep '^@@' || true) + [ ${#args[@]} -eq 0 ] && continue + check "$f" "${args[@]}" + done < <(git diff --name-only --diff-filter=ACMR "$base" -- "${PATHSPEC[@]}") + # untracked new files: whole file (no debt possible yet) + while IFS= read -r f; do check "$f"; done < <(git ls-files --others --exclude-standard "${PATHSPEC[@]}") +fi + +exit $fail