├── .dockerignore ├── .github ├── ISSUE_TEMPLATE │ ├── bug_report.md │ ├── feature_request.md │ └── other-inquires.md └── workflows │ └── docker4commit.yml ├── .gitignore ├── Dockerfile ├── LICENSE ├── README.md ├── VERSION ├── argon2g ├── go.mod ├── go.sum └── main.go ├── build-gobinaries.sh ├── build-ztncui.sh ├── denv ├── fileserv ├── go.mod └── main.go ├── release.sh ├── s6-rc.d ├── entryinit │ ├── type │ └── up ├── fileserv │ ├── dependencies.d │ │ └── ztncui │ ├── run │ └── type ├── user │ ├── contents.d │ │ ├── entryinit │ │ ├── fileserv │ │ ├── ztncui │ │ └── ztone │ └── type ├── ztncui │ ├── dependencies.d │ │ └── ztone │ ├── run │ └── type └── ztone │ ├── dependencies.d │ └── entryinit │ ├── run │ └── type ├── start_firsttime_init.sh ├── start_zt1.sh ├── start_ztncui.sh └── ztnodeid ├── assets └── mkworld.config.json ├── cmd └── mkworld │ └── main.go ├── go.mod ├── go.sum └── pkg ├── node ├── errs.go ├── identity.go ├── node.go └── world.go └── ztcrypto └── identity.go /.dockerignore: -------------------------------------------------------------------------------- 1 | .env 2 | .vscode/ 3 | .idea/ 4 | .DS_Store -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: "[BUG?]" 5 | labels: bug 6 | assignees: '' 7 | 8 | --- 9 | 10 | - [ ] | I confirm I've searched the internet using Google and read the [official document of Zerotier](https://docs.zerotier.com/) thoroughly. 11 | - [ ] | I've acknowledged that this issue tracker will ONLY support issue coming from Docker packaging itself, rather than Zerotier client. 12 | 13 | **Describe the bug** 14 | A clear and concise description of what the bug is. 15 | 16 | **To Reproduce** 17 | Steps to reproduce the behavior: 18 | 1. Go to '...' 19 | 2. Click on '....' 20 | 3. Scroll down to '....' 21 | 4. See error 22 | 23 | **Expected behavior** 24 | A clear and concise description of what you expected to happen. 25 | 26 | **Screenshots** 27 | If applicable, add screenshots to help explain your problem. 28 | 29 | **Desktop (please complete the following information):** 30 | - OS: [e.g. iOS] 31 | - Browser [e.g. chrome, safari] 32 | - Version [e.g. 22] 33 | 34 | **Smartphone (please complete the following information):** 35 | - Device: [e.g. iPhone6] 36 | - OS: [e.g. iOS8.1] 37 | - Browser [e.g. stock browser, safari] 38 | - Version [e.g. 22] 39 | 40 | **Additional context** 41 | Add any other context about the problem here. 42 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature request 3 | about: Suggest an idea for this project 4 | title: "[FeatReq]" 5 | labels: enhancement 6 | assignees: '' 7 | 8 | --- 9 | 10 | **Is your feature request related to a problem? Please describe.** 11 | A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] 12 | 13 | **Describe the solution you'd like** 14 | A clear and concise description of what you want to happen. 15 | 16 | **Describe alternatives you've considered** 17 | A clear and concise description of any alternative solutions or features you've considered. 18 | 19 | **Additional context** 20 | Add any other context or screenshots about the feature request here. 21 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/other-inquires.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Other Inquires 3 | about: Inquires that have not been covered above. 4 | title: "[Question]" 5 | labels: question 6 | assignees: '' 7 | 8 | --- 9 | 10 | [ ] | I confirmed that I've searched in discussion and issues, and found nothing related. 11 | 12 | Please offer your hardware information and software information, such as: 13 | - Model: 14 | - CPU: 15 | - Architecture: 16 | - Distro & version: 17 | - Others you think that might be helpful to solve this problem 18 | -------------------------------------------------------------------------------- /.github/workflows/docker4commit.yml: -------------------------------------------------------------------------------- 1 | name: Docker Build 2 | 3 | on: 4 | push: 5 | pull_request: 6 | types: 7 | - review_requested 8 | - opened 9 | 10 | permissions: 11 | contents: write 12 | packages: write 13 | 14 | env: 15 | # Use docker.io for Docker Hub if empty 16 | REGISTRY: ghcr.io 17 | # github.repository as / 18 | IMAGE_NAME: ${{ github.repository }} 19 | 20 | jobs: 21 | build-amd64-docker: 22 | runs-on: ubuntu-22.04 23 | env: 24 | platform-name: "linux/amd64" 25 | platform-tag: "x86_64" 26 | steps: 27 | - name: Checkout 28 | uses: actions/checkout@v4 29 | with: 30 | submodules: true 31 | - name: Prepare destination folder 32 | run: mkdir -p /tmp/build/out 33 | - name: Set up Docker Buildx 34 | uses: docker/setup-buildx-action@v3 35 | - name: Cache Docker layers 36 | uses: actions/cache@v4 37 | with: 38 | path: /tmp/.buildx-cache 39 | key: ${{ runner.os }}-buildx-${{ github.sha }} 40 | restore-keys: | 41 | ${{ runner.os }}-buildx- 42 | - name: Login to GHCR 43 | uses: docker/login-action@v3 44 | with: 45 | registry: ${{ env.REGISTRY }} 46 | username: ${{ github.actor }} 47 | password: ${{ secrets.GITHUB_TOKEN }} 48 | - name: Build Docker image 49 | uses: docker/build-push-action@v5 50 | with: 51 | context: . 52 | platforms: ${{ env.platform-name }} 53 | cache-from: type=local,src=/tmp/.buildx-cache 54 | cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max,compression=zstd 55 | build-args: | 56 | OVERLAY_S6_ARCH=${{ env.platform-tag }} 57 | outputs: | 58 | type=docker,dest=/tmp/build/out/ztncui-aio-${{ env.platform-tag }}.tar 59 | push: false 60 | provenance: false # attestation need to be disabled to merge later. 61 | sbom: false # attestation need to be disabled to merge later. 62 | tags: | 63 | ghcr.io/${{ env.IMAGE_NAME }}:sha256-${{ github.sha }}-${{ env.platform-tag }} 64 | - name: Publish the Image 65 | if: ${{ startsWith(github.ref, 'refs/tags/v') }} 66 | uses: docker/build-push-action@v5 67 | with: 68 | context: . 69 | platforms: ${{ env.platform-name }} 70 | cache-from: type=local,src=/tmp/.buildx-cache 71 | cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max,compression=zstd 72 | push: true 73 | provenance: false # attestation need to be disabled to merge later. 74 | sbom: false # attestation need to be disabled to merge later. 75 | build-args: | 76 | OVERLAY_S6_ARCH=${{ env.platform-tag }} 77 | tags: | 78 | ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-${{ env.platform-tag }} 79 | - name: Archive generated artifacts 80 | uses: actions/upload-artifact@v4 81 | with: 82 | retention-days: 30 83 | name: dir-ztncui-aio-${{ env.platform-tag }} 84 | path: /tmp/build/out/ztncui-aio-${{ env.platform-tag }}.tar 85 | - name: Move cache 86 | run: | 87 | rm -rf /tmp/.buildx-cache 88 | mv /tmp/.buildx-cache-new /tmp/.buildx-cache 89 | build-arm64-docker: 90 | runs-on: buildjet-4vcpu-ubuntu-2204-arm 91 | env: 92 | platform-name: "linux/arm64/v8" 93 | platform-tag: "aarch64" 94 | steps: 95 | - name: Checkout 96 | uses: actions/checkout@v4 97 | with: 98 | submodules: true 99 | - name: Prepare destination folder 100 | run: mkdir -p /tmp/build/out 101 | - name: Set up Docker Buildx 102 | uses: docker/setup-buildx-action@v3 103 | - name: Cache Docker layers 104 | uses: buildjet/cache@v3 105 | with: 106 | path: /tmp/.buildx-cache 107 | key: ${{ runner.os }}-buildx-${{ github.sha }} 108 | restore-keys: | 109 | ${{ runner.os }}-buildx- 110 | - name: Login to GHCR 111 | uses: docker/login-action@v3 112 | with: 113 | registry: ${{ env.REGISTRY }} 114 | username: ${{ github.actor }} 115 | password: ${{ secrets.GITHUB_TOKEN }} 116 | - name: Build Docker image 117 | uses: docker/build-push-action@v5 118 | with: 119 | context: . 120 | platforms: ${{ env.platform-name }} 121 | cache-from: type=local,src=/tmp/.buildx-cache 122 | cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max,compression=zstd 123 | build-args: | 124 | OVERLAY_S6_ARCH=${{ env.platform-tag }} 125 | outputs: | 126 | type=docker,dest=/tmp/build/out/ztncui-aio-${{ env.platform-tag }}.tar 127 | push: false 128 | provenance: false # attestation need to be disabled to merge later. 129 | sbom: false # attestation need to be disabled to merge later. 130 | tags: | 131 | ghcr.io/${{ env.IMAGE_NAME }}:sha256-${{ github.sha }}-${{ env.platform-tag }} 132 | - name: Publish the Image 133 | if: ${{ startsWith(github.ref, 'refs/tags/v') }} 134 | uses: docker/build-push-action@v5 135 | with: 136 | context: . 137 | platforms: ${{ env.platform-name }} 138 | cache-from: type=local,src=/tmp/.buildx-cache 139 | cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max,compression=zstd 140 | push: true 141 | provenance: false # attestation need to be disabled to merge later. 142 | sbom: false # attestation need to be disabled to merge later. 143 | build-args: | 144 | OVERLAY_S6_ARCH=${{ env.platform-tag }} 145 | tags: | 146 | ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-${{ env.platform-tag }} 147 | - name: Archive generated artifacts 148 | uses: actions/upload-artifact@v4 149 | with: 150 | retention-days: 30 151 | name: dir-ztncui-aio-${{ env.platform-tag }} 152 | path: /tmp/build/out/ztncui-aio-${{ env.platform-tag }}.tar 153 | - name: Move cache 154 | run: | 155 | rm -rf /tmp/.buildx-cache 156 | mv /tmp/.buildx-cache-new /tmp/.buildx-cache 157 | merge-multiarch: 158 | needs: 159 | - build-amd64-docker 160 | - build-arm64-docker 161 | if: ${{ startsWith(github.ref, 'refs/tags/v') }} 162 | runs-on: ubuntu-22.04 163 | steps: 164 | # note: change the repository_owner to specific one if post to other repos 165 | - name: Prepare for release 166 | run: | 167 | mkdir -p /tmp/relbuild/${{ github.repository_owner }} 168 | - name: Login To GHCR 169 | uses: docker/login-action@v3 170 | with: 171 | registry: ${{ env.REGISTRY }} 172 | username: ${{ github.actor }} 173 | password: ${{ secrets.GITHUB_TOKEN }} 174 | - name: Merge images with different architecture and push 175 | run: | 176 | docker manifest create ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }} --amend ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-aarch64 --amend ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-x86_64 177 | docker manifest push ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }} 178 | docker manifest create ghcr.io/${{ env.IMAGE_NAME }}:latest --amend ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-aarch64 --amend ghcr.io/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-x86_64 179 | docker manifest push ghcr.io/${{ env.IMAGE_NAME }}:latest 180 | - name: Download artifacts previously 181 | uses: actions/download-artifact@v4 182 | with: 183 | path: /tmp/relbuild/${{ github.repository_owner }} 184 | - name: Compress all artifacts using ZSTD 185 | run: | 186 | cd /tmp/relbuild/${{ github.repository_owner }} 187 | mv ./dir-ztncui-*/*.tar . 188 | zstd -4 --rm *.tar 189 | rm -rf ./dir-ztncui-* 190 | - name: Create Release and Upload DockerImage Assets In TarGZ 191 | uses: Hs1r1us/Release-AIO@v2.0.0 192 | env: 193 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 194 | with: 195 | body: Regular update, check commit history for changelog. 196 | tag_name: ${{ github.ref }} 197 | release_name: ${{ github.ref_name }} 198 | asset_files: /tmp/relbuild/${{ github.repository_owner }} 199 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .vscode/ 2 | .DS_Store 3 | .idea -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM debian:bullseye-slim AS jsbuilder 2 | ENV NODEJS_MAJOR=18 3 | ENV DEBIAN_FRONTEND=noninteractive 4 | 5 | LABEL org.opencontainers.image.source="https://github.com/kmahyyg/ztncui-aio" 6 | LABEL MAINTAINER="Key Networks https://key-networks.com" 7 | LABEL Description="ztncui (a ZeroTier network controller user interface) + ZeroTier network controller" 8 | ADD VERSION . 9 | 10 | # BUILD ZTNCUI IN FIRST STAGE 11 | WORKDIR /build 12 | RUN apt update -y && \ 13 | apt install curl gnupg2 ca-certificates zip unzip build-essential git --no-install-recommends -y && \ 14 | curl -sL -o node_inst.sh https://deb.nodesource.com/setup_${NODEJS_MAJOR}.x && \ 15 | bash node_inst.sh && \ 16 | apt install -y nodejs --no-install-recommends && \ 17 | rm -f node_inst.sh 18 | COPY build-ztncui.sh /build/ 19 | RUN bash /build/build-ztncui.sh 20 | 21 | # BUILD GO UTILS 22 | FROM golang:bullseye AS gobuilder 23 | WORKDIR /buildsrc 24 | COPY argon2g /buildsrc/argon2g 25 | COPY fileserv /buildsrc/fileserv 26 | COPY ztnodeid /buildsrc/ztnodeid 27 | COPY build-gobinaries.sh /buildsrc/build-gobinaries.sh 28 | ENV CGO_ENABLED=0 29 | RUN apt update -y && \ 30 | apt install zip -y && \ 31 | bash /buildsrc/build-gobinaries.sh 32 | 33 | # START RUNNER 34 | FROM debian:bullseye-slim AS runner 35 | ENV DEBIAN_FRONTEND=noninteractive 36 | ENV AUTOGEN_PLANET=0 37 | ARG OVERLAY_S6_ARCH 38 | WORKDIR /tmp 39 | RUN apt update -y && \ 40 | apt install curl gnupg2 ca-certificates gzip xz-utils iproute2 unzip net-tools procps --no-install-recommends -y && \ 41 | curl -L -O https://github.com/just-containers/s6-overlay/releases/download/v3.1.3.0/s6-overlay-noarch.tar.xz && \ 42 | tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && rm /tmp/s6-overlay-noarch.tar.xz && \ 43 | curl -L -O https://github.com/just-containers/s6-overlay/releases/download/v3.1.3.0/s6-overlay-$OVERLAY_S6_ARCH.tar.xz && \ 44 | tar -C / -Jxpf /tmp/s6-overlay-$OVERLAY_S6_ARCH.tar.xz && rm /tmp/s6-overlay-$OVERLAY_S6_ARCH.tar.xz && \ 45 | groupadd -g 2222 zerotier-one && \ 46 | useradd -u 2222 -g 2222 zerotier-one && \ 47 | usermod -aG zerotier-one zerotier-one && \ 48 | usermod -aG zerotier-one root && \ 49 | curl -sL -o zt-one.sh https://install.zerotier.com && \ 50 | bash zt-one.sh && \ 51 | rm -f zt-one.sh && \ 52 | apt clean -y && \ 53 | rm -rf /var/lib/zerotier-one && \ 54 | rm -rf /var/lib/apt/lists/* 55 | 56 | WORKDIR /opt/key-networks/ztncui 57 | COPY --from=jsbuilder /build/artifact.zip . 58 | RUN unzip ./artifact.zip && \ 59 | rm -f ./artifact.zip 60 | 61 | WORKDIR / 62 | COPY start_firsttime_init.sh /start_firsttime_init.sh 63 | COPY start_zt1.sh /start_zt1.sh 64 | COPY start_ztncui.sh /start_ztncui.sh 65 | 66 | COPY --from=gobuilder /buildsrc/artifact-go.zip /tmp/ 67 | RUN unzip -d /usr/local/bin /tmp/artifact-go.zip && \ 68 | rm -rf /tmp/artifact-go.zip && \ 69 | chmod 0755 /usr/local/bin/* && \ 70 | chmod 0755 /start_*.sh 71 | 72 | COPY s6-rc.d/ /etc/s6-overlay/s6-rc.d/ 73 | 74 | EXPOSE 3000/tcp 75 | EXPOSE 3180/tcp 76 | EXPOSE 8000/tcp 77 | EXPOSE 3443/tcp 78 | 79 | VOLUME ["/opt/key-networks/ztncui/etc", "/etc/zt-mkworld", "/var/lib/zerotier-one"] 80 | ENTRYPOINT [ "/init" ] 81 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ztncui-aio 2 | 3 | ![](https://github.com/kmahyyg/ztncui-aio/actions/workflows/docker4commit.yml/badge.svg) 4 | 5 | Current Version: 20250119-1.14.1-0.8.14 6 | 7 | ## From ztncui author 8 | 9 | Say a huge thank you to their work! 10 | ### ZeroTier network controller user interface in a Docker container 11 | 12 | This is to build a Docker image that contains **[ZeroTier One](https://www.zerotier.com/download.shtml)** and **[ztncui](https://key-networks.com/ztncui)** to set up a **standalone ZeroTier network controller** with a web user interface in a container. 13 | 14 | Follow us on [![alt @key_networks on Twitter](https://i.imgur.com/wWzX9uB.png)](https://twitter.com/key_networks) 15 | 16 | Licensed Under GNU GPLv3 17 | 18 | ## Build yourself 19 | 20 | We support aarch64 (arm64/v8), amd64 by default. 21 | 22 | Armv7(means armhf) might work, but is not tested. 23 | 24 | Others are unsupported. 25 | 26 | ```bash 27 | $ git clone https://github.com/kmahyyg/ztncui-aio 28 | $ docker build . --build-arg OVERLAY_S6_ARCH= -t ghcr.io/kmahyyg/ztncui-aio:latest 29 | ``` 30 | 31 | > Why not directly detect CPU arch? Some kernel may use non-standard expression of architecture. 32 | 33 | Change `NODEJS_MAJOR` variable in Dockerfile to use different nodejs version. 34 | 35 | Never use `node_lts.x` as your installation script of nodejs whose version might changed without further notice due to time shift. 36 | 37 | ## Usage 38 | 39 | ### Golang auto-mkworld (already embedded in docker image) 40 | 41 | This feature allows you to generate a planet file without using C code and compiler. 42 | 43 | Also, due to limitation of IPC of Zerotier-One UI and multiple issues, we do NOT support customized port, you can ONLY use port 9993/udp here. 44 | 45 | Set the following environment variable when create the container, and according to your needs: 46 | 47 | | MANDATORY | Name | Explanation | Default Value | 48 | |:--------:|:--------:|:--------:|:--------:| 49 | | no | AUTOGEN_PLANET | If set to 1, will use this node identity to generate a `planet` file and put to `httpfs` folder to serve it outside. If set to 2, will use config in `/etc/zt-mkworld/mkworld.config.json`. If set to 0, will do nothing. | 0 | 50 | 51 | The reference config file can be found on `ztnodeid/assets/mkworld.conf.json`. 52 | 53 | You could also define yourself, and check the stdout output to get C header of customized planet. After that, you will find the custom planet file under http file server root and also ca certificate. 54 | 55 | The configuration JSON can be understand like this: 56 | 57 | ```json 58 | { 59 | "rootNodes": [ // array of node, can be multiple 60 | { 61 | "comments": "amsterdam official", // node object, comment, will auto generate if AUTOGEN_PLANET=1 62 | "identity": "992fcf1db7:0:206ed59350b31916f749a1f85dffb3a8787dcbf83b8c6e9448d4e3ea0e3369301be716c3609344a9d1533850fb4460c50af43322bcfc8e13d3301a1f1003ceb6", 63 | // node identity.public ^^ , if node is not initialized, will initialize at the container start 64 | "endpoints": [ 65 | "195.181.173.159/443", // node service location, in format: ip/port, will auto generate if AUTOGEN_PLANET=1 66 | "2a02:6ea0:c024::/443" // must be less than or equal to two endpoints, one for IPv4, one for IPv6. if you have multiple IP, set multiple node with different identity. 67 | ] 68 | } 69 | ], 70 | "signing": [ 71 | "previous.c25519", // planet signing key, if not exist, will generate 72 | "current.c25519" // same, used for iteration and update 73 | ], 74 | "output": "planet.custom", // output filename 75 | "plID": 0, // planet numeric ID, if you don't know, do not modify, and set plRecommend to true 76 | "plBirth": 0, // planet creation timestamp, if you don't know, do not modify, and set plRecommend to true 77 | "plRecommend": true // set plRecommend to true, auto-recommend plID, plBirth value. For more details, read mkworld source code in zerotier-one official repo 78 | } 79 | ``` 80 | 81 | ### Docker image 82 | 83 | ```bash 84 | $ git clone https://github.com/kmahyyg/ztncui-aio # to get a copy of denv file, otherwise make your own 85 | $ docker pull ghcr.io/kmahyyg/ztncui-aio 86 | $ docker run -d -p3443:3443 -p3180:3180 -p9993:9993/udp \ 87 | -v /mydata/ztncui:/opt/key-networks/ztncui/etc \ 88 | -v /mydata/zt1:/var/lib/zerotier-one \ 89 | -v /mydata/zt-mkworld-conf:/etc/zt-mkworld \ 90 | --env-file ./denv \ 91 | --restart always \ 92 | --cap-add=NET_ADMIN --device /dev/net/tun:/dev/net/tun \ 93 | --name ztncui \ 94 | ghcr.io/kmahyyg/ztncui-aio # /mydata above is the data folder that you use to save the supporting files 95 | ``` 96 | 97 | ## Supported Configuration using local persistent storage 98 | 99 | For ZTNCUI: https://github.com/key-networks/ztncui 100 | 101 | Set the following environment variable when create the container, and according to your needs: 102 | 103 | | MANDATORY | Name | Explanation | Default Value | 104 | |:--------:|:--------:|:--------:|:--------:| 105 | | YES | NODE_ENV | https://pugjs.org/api/express.html | production | 106 | | no | HTTPS_HOST | HTTPS_HOST | NO DEFAULT, MEANS DISABLED | 107 | | no | HTTPS_PORT | HTTPS_PORT | NO DEFAULT, MEANS DISABLED | 108 | | no | HTTP_PORT | HTTP_PORT | 3000 | 109 | | no | HTTP_ALL_INTERFACES | Listen on all interfaces, useful for reverse proxy, HTTP only | NO DEFAULT | 110 | 111 | Note: If you do NOT set `HTTP_ALL_INTERFACES`, the 3000 port will only get listened inside container, means `127.0.0.1:3000` by default. 112 | 113 | This application does NOT have a built-in protection mechanism against brute-force attack, you should NOT directly expose it on the internet. 114 | 115 | And you should ALWAYS NOT use a weak password. 116 | 117 | Set the following environment variable when create the container, and according to your needs: 118 | 119 | | MANDATORY | Name | Explanation | Default Value | 120 | |:--------:|:--------:|:--------:|:--------:| 121 | | no | MYDOMAIN | generate TLS certs on the fly (if not exists) | ztncui.docker.test | 122 | | no | ZTNCUI_PASSWD | generate admin password on the fly (if not exists) | password | 123 | | YES | MYADDR | your ip address, public ip address preferred, will auto-detect if not set | NO DEFAULT | 124 | 125 | 126 | **WARNING: IF YOU DO NOT SET PASSWORD, YOU HAVE TO USE `docker container logs ` to get your random password. This is a gatekeeper.** 127 | 128 | To reset password of ztncui: delete file under `/mydata/ztncui/passwd` and set the environment variable to the password you want, then re-create the container. After application has been initialized, the password should ONLY be changed from the web page. 129 | 130 | ## Public File Server 131 | 132 | | MANDATORY | Name | Explanation | Default Value | 133 | |:--------:|:--------:|:--------:|:--------:| 134 | | no | PLANET_RETR_PUBLIC | File server listened globally or only local | NO DEFAULT | 135 | 136 | If `PLANET_RETR_PUBLIC` is set, then file server will listen on `0.0.0.0`, otherwise, `127.0.0.1` . 137 | This image exposed an http server at port 3180, you could save file in `/mydata/ztncui/httpfs/` to serve it. 138 | (You could use this to build your own root server and distribute planet file, even though, that won't hurt you, I still suggest to set a protection for both http servers in front.) 139 | 140 | ## Chinese users only 141 | 142 | This script use https:///ip.sb for public IP detection purpose, which is blocked in some area of China Mainland. Under this circumstance, the program will try to detect public IP using `ifconfig` tool and might lead to unwanted result, to prevent this, make sure you set `MYADDR` environment variable when docker container is up. 143 | 144 | **This repo (https://github.com/kmahyyg/ztncui-aio) only accept Issues and PRs in English. Other languages will be closed directly without any further notice. If you come from some non-English countries, use Google Translate, and state that at the beginning of the text body.** 145 | 146 | -------------------------------------------------------------------------------- /VERSION: -------------------------------------------------------------------------------- 1 | 1.2.14 2 | -------------------------------------------------------------------------------- /argon2g/go.mod: -------------------------------------------------------------------------------- 1 | module argon2g 2 | 3 | go 1.15 4 | 5 | require golang.org/x/crypto v0.35.0 6 | -------------------------------------------------------------------------------- /argon2g/go.sum: -------------------------------------------------------------------------------- 1 | github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= 2 | github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= 3 | golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= 4 | golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= 5 | golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= 6 | golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= 7 | golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= 8 | golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs= 9 | golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ= 10 | golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= 11 | golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= 12 | golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= 13 | golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= 14 | golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= 15 | golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= 16 | golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= 17 | golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= 18 | golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= 19 | golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= 20 | golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= 21 | golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= 22 | golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= 23 | golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 24 | golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 25 | golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 26 | golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= 27 | golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= 28 | golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= 29 | golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= 30 | golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= 31 | golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 32 | golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 33 | golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 34 | golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 35 | golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 36 | golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 37 | golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 38 | golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= 39 | golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= 40 | golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= 41 | golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= 42 | golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= 43 | golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= 44 | golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= 45 | golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= 46 | golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= 47 | golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= 48 | golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= 49 | golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= 50 | golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= 51 | golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= 52 | golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= 53 | golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= 54 | golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= 55 | golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= 56 | golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= 57 | golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= 58 | golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= 59 | golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= 60 | golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= 61 | golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= 62 | golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= 63 | golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= 64 | golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= 65 | golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= 66 | golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 67 | -------------------------------------------------------------------------------- /argon2g/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "encoding/base64" 5 | "encoding/json" 6 | "fmt" 7 | "io/ioutil" 8 | "log" 9 | "math/rand" 10 | "time" 11 | "os" 12 | 13 | "golang.org/x/crypto/argon2" 14 | ) 15 | 16 | type UserDef struct { 17 | Name string `json:"name"` 18 | PassSet bool `json:"pass_set"` 19 | Hash string `json:"hash"` 20 | } 21 | 22 | type PasswdDef struct { 23 | Admin UserDef `json:"admin"` 24 | } 25 | 26 | const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890" 27 | 28 | func RandStringBytes(n int) string { 29 | rand.Seed(time.Now().UnixNano()) 30 | b := make([]byte, n) 31 | for i := range b { 32 | b[i] = letterBytes[rand.Intn(len(letterBytes))] // It's not safe for password purpose, but i'm lazy. 33 | } 34 | return string(b) 35 | } 36 | 37 | func main() { 38 | var password string = os.Getenv("ZTNCUI_PASSWD") 39 | if len(password) < 2 { 40 | log.Println("Current Password: " + password + " is too weak or not set...") 41 | password = RandStringBytes(10) 42 | } 43 | log.Println("Current Password: " + password) 44 | 45 | var ag2_memory uint32 = 4096 46 | var ag2_iter uint32 = 3 47 | var ag2_para uint8 = 1 48 | var ag2_saltlen uint8 = 16 49 | var ag2_hashlen uint32 = 32 50 | 51 | ag2_salt := make([]byte, ag2_saltlen) 52 | _, err := rand.Read(ag2_salt) 53 | if err != nil { 54 | log.Fatal(err) 55 | } 56 | 57 | ag2_hash := argon2.Key([]byte(password), ag2_salt, ag2_iter, ag2_memory, ag2_para, ag2_hashlen) 58 | ag2_saltb64 := base64.RawStdEncoding.EncodeToString(ag2_salt) 59 | ag2_hashb64 := base64.RawStdEncoding.EncodeToString(ag2_hash) 60 | 61 | finalhash := fmt.Sprintf("$argon2i$v=%d$m=%d,t=%d,p=%d$%s$%s", argon2.Version, ag2_memory, ag2_iter, ag2_para, ag2_saltb64, ag2_hashb64) 62 | 63 | u1 := UserDef{ 64 | Name: "admin", 65 | PassSet: false, 66 | Hash: finalhash, 67 | } 68 | p1 := PasswdDef{ 69 | Admin: u1, 70 | } 71 | v1, err := json.Marshal(p1) 72 | if err != nil { 73 | log.Fatal(err) 74 | } 75 | err = ioutil.WriteFile("passwd", v1, 0644) 76 | if err != nil { 77 | log.Fatal(err) 78 | } 79 | log.Println("Generate Done, check passwd file.") 80 | } 81 | -------------------------------------------------------------------------------- /build-gobinaries.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -xe 3 | cd /buildsrc 4 | mkdir -p binaries 5 | cd argon2g 6 | go mod download 7 | go build -ldflags='-s -w' -trimpath -o ../binaries/argon2g 8 | cd .. 9 | git clone https://github.com/jsha/minica 10 | cd minica 11 | go mod download 12 | go build -ldflags='-s -w' -trimpath -o ../binaries/minica 13 | cd .. 14 | git clone https://github.com/tianon/gosu 15 | cd gosu 16 | go mod download 17 | go build -o ../binaries/gosu -ldflags='-s -w' -trimpath 18 | cd .. 19 | cd fileserv 20 | go build -ldflags='-s -w' -trimpath -o ../binaries/fileserv main.go 21 | cd .. 22 | cd ztnodeid 23 | go build -ldflags='-s -w' -trimpath -o ../binaries/ztmkworld cmd/mkworld/main.go 24 | cd .. 25 | cd binaries 26 | zip -r /buildsrc/artifact-go.zip ./* 27 | -------------------------------------------------------------------------------- /build-ztncui.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -xe 3 | git clone https://github.com/key-networks/ztncui 4 | npm install -g node-gyp pkg 5 | cd ztncui/src 6 | npm install 7 | 8 | MACHINE_ARCHITECTURE=$(uname -m) 9 | export NODEJS_PACK_ARCH="" 10 | case ${MACHINE_ARCHITECTURE} in 11 | "arm"|"armv7l"|"armv7"|"armhf") 12 | # armv6 is too old, and unsupported by pkg, and should be deprecated, so we won't support 13 | # armv7 is unsupported by pkg, you could try build yourself, but no guarantee here 14 | echo "Upstream unsupported architecture: ${MACHINE_ARCHITECTURE}. Treat as armv7. But will still try to build." 15 | NODEJS_PACK_ARCH="armv7" 16 | ;; 17 | "aarch64"|"arm64") 18 | NODEJS_PACK_ARCH="arm64" 19 | ;; 20 | "x86_64"|"amd64") 21 | NODEJS_PACK_ARCH="x64" 22 | ;; 23 | *) 24 | echo "Unsupported Architecture: ${MACHINE_ARCHITECTURE}. Exit now." 25 | exit 127 26 | ;; 27 | esac 28 | 29 | pkg -c ./package.json -C Brotli --no-bytecode --public -t "node${NODEJS_MAJOR}-linux-${NODEJS_PACK_ARCH}" bin/www -o ztncui 30 | zip -r /build/artifact.zip ztncui node_modules/argon2/build/Release 31 | -------------------------------------------------------------------------------- /denv: -------------------------------------------------------------------------------- 1 | NODE_ENV=production 2 | HTTPS_PORT=3443 3 | ZTNCUI_PASSWD=password 4 | MYDOMAIN=ztncui.docker.test 5 | AUTOGEN_PLANET=0 -------------------------------------------------------------------------------- /fileserv/go.mod: -------------------------------------------------------------------------------- 1 | module fileserv 2 | 3 | go 1.15 4 | -------------------------------------------------------------------------------- /fileserv/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "log" 5 | "net/http" 6 | "os" 7 | ) 8 | 9 | func main() { 10 | var fs http.FileSystem = http.Dir("/opt/key-networks/ztncui/etc/httpfs") 11 | var fsHandler = http.FileServer(fs) 12 | var listenGlobal = os.Getenv("PLANET_RETR_PUBLIC") 13 | if listenGlobal != "" { 14 | log.Fatal(http.ListenAndServe(":3180", fsHandler)) 15 | } else { 16 | log.Fatal(http.ListenAndServe("127.0.0.1:3180", fsHandler)) 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /release.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 3 | # Derived from https://medium.com/travis-on-docker/how-to-version-your-docker-images-1d5c577ebf54 4 | # 5 | # This script has only been used by docker.io/key-networks/ztncui 6 | # 7 | # In kmahyyg/ztncui-aio, the publishing process is done by github-action 8 | # 9 | 10 | set -ex 11 | 12 | USERNAME=keynetworks 13 | IMAGE=ztncui 14 | 15 | # bump version 16 | docker run --rm -v "$PWD":/app treeder/bump patch 17 | version=`cat VERSION` 18 | echo "version: $version" 19 | 20 | # build 21 | docker build -t $USERNAME/$IMAGE:latest . 22 | 23 | # tag it 24 | git add -A 25 | git commit -m "version $version" 26 | git tag -a "$version" -m "version $version" 27 | docker tag $USERNAME/$IMAGE:latest $USERNAME/$IMAGE:$version 28 | 29 | # push it 30 | docker login --username=$USERNAME 31 | docker push $USERNAME/$IMAGE:latest 32 | docker push $USERNAME/$IMAGE:$version 33 | -------------------------------------------------------------------------------- /s6-rc.d/entryinit/type: -------------------------------------------------------------------------------- 1 | oneshot -------------------------------------------------------------------------------- /s6-rc.d/entryinit/up: -------------------------------------------------------------------------------- 1 | #!/command/execlineb -P 2 | exec /command/with-contenv bash /start_firsttime_init.sh -------------------------------------------------------------------------------- /s6-rc.d/fileserv/dependencies.d/ztncui: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/fileserv/dependencies.d/ztncui -------------------------------------------------------------------------------- /s6-rc.d/fileserv/run: -------------------------------------------------------------------------------- 1 | #!/command/with-contenv bash 2 | # make sure we've got it chowned 3 | /bin/chown -R zerotier-one:zerotier-one /opt/key-networks/ztncui 4 | /usr/local/bin/gosu zerotier-one:zerotier-one /usr/local/bin/fileserv -------------------------------------------------------------------------------- /s6-rc.d/fileserv/type: -------------------------------------------------------------------------------- 1 | longrun -------------------------------------------------------------------------------- /s6-rc.d/user/contents.d/entryinit: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/user/contents.d/entryinit -------------------------------------------------------------------------------- /s6-rc.d/user/contents.d/fileserv: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/user/contents.d/fileserv -------------------------------------------------------------------------------- /s6-rc.d/user/contents.d/ztncui: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/user/contents.d/ztncui -------------------------------------------------------------------------------- /s6-rc.d/user/contents.d/ztone: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/user/contents.d/ztone -------------------------------------------------------------------------------- /s6-rc.d/user/type: -------------------------------------------------------------------------------- 1 | bundle -------------------------------------------------------------------------------- /s6-rc.d/ztncui/dependencies.d/ztone: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/ztncui/dependencies.d/ztone -------------------------------------------------------------------------------- /s6-rc.d/ztncui/run: -------------------------------------------------------------------------------- 1 | #!/command/with-contenv bash 2 | /start_ztncui.sh -------------------------------------------------------------------------------- /s6-rc.d/ztncui/type: -------------------------------------------------------------------------------- 1 | longrun -------------------------------------------------------------------------------- /s6-rc.d/ztone/dependencies.d/entryinit: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kmahyyg/ztncui-aio/96ba1ed52738b4282db526ec61050cafa2925140/s6-rc.d/ztone/dependencies.d/entryinit -------------------------------------------------------------------------------- /s6-rc.d/ztone/run: -------------------------------------------------------------------------------- 1 | #!/command/with-contenv bash 2 | /start_zt1.sh -------------------------------------------------------------------------------- /s6-rc.d/ztone/type: -------------------------------------------------------------------------------- 1 | longrun -------------------------------------------------------------------------------- /start_firsttime_init.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # debugging purpose 4 | if [ ! -z $DEBUG_ENV ]; then 5 | echo "Debugging: Print EnvVar:" 6 | printenv 7 | fi 8 | 9 | # create dest folder 10 | mkdir -p /etc/zt-mkworld 11 | 12 | # make sure we've got it chowned 13 | chown -R zerotier-one:zerotier-one /opt/key-networks/ztncui 14 | chown -R zerotier-one:zerotier-one /var/lib/zerotier-one 15 | 16 | # detect if identity folder exists 17 | if [ ! -d /var/lib/zerotier-one ]; then 18 | mkdir -p /var/lib/zerotier-one 19 | fi 20 | 21 | # detect if identity private key exists 22 | if [ ! -f /var/lib/zerotier-one/identity.secret ]; then 23 | cd /var/lib/zerotier-one 24 | /usr/sbin/zerotier-idtool generate identity.secret identity.public 25 | fi 26 | 27 | # always make httpfs folder 28 | mkdir -p /opt/key-networks/ztncui/etc/httpfs 29 | 30 | # detect public ip 31 | if [ -z $MYADDR ]; then 32 | echo "Set Your IP Address to continue." 33 | echo "If you don't do that, I will automatically detect." 34 | MYEXTADDR=$(curl --connect-timeout 5 ip.sb) 35 | if [ -z $MYEXTADDR ]; then 36 | MYINTADDR=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1') 37 | MYADDR=${MYINTADDR} 38 | else 39 | MYADDR=${MYEXTADDR} 40 | fi 41 | fi 42 | 43 | MYDOMAIN=${MYDOMAIN:-ztncui.docker.test} # Used for planet comment 44 | 45 | echo "YOUR IP: ${MYADDR}" 46 | echo "YOUR DOMAIN: ${MYDOMAIN}" 47 | 48 | cd /etc/zt-mkworld 49 | # detect if ALREADY_INITED 50 | if [ -f /etc/zt-mkworld/ALREADY_INITED ]; then 51 | echo "ALREADY_INITED detected." 52 | exit 0 53 | # if not exist, goto planet file generate. 54 | else 55 | # if set to 0, won't do anything. 56 | if [[ $AUTOGEN_PLANET -eq 0 ]]; then 57 | # finally create ALREADY_INITED flag file 58 | echo "AUTOGEN_PLANET is 0. Set to inited and exit." 59 | touch /etc/zt-mkworld/ALREADY_INITED 60 | exit 0 61 | fi 62 | # AUTOGEN_PLANET is not 0, backup now. 63 | if [[ -f /var/lib/zerotier-one/planet ]]; then 64 | cp /var/lib/zerotier-one/planet /var/lib/zerotier-one/planet.bak.$(date +%s) 65 | fi 66 | 67 | # if AUTOGEN_PLANET is set to 1, check if identity.public exists, 68 | # then generate mkworld.config.json on the fly 69 | if [[ $AUTOGEN_PLANET -eq 1 ]]; then 70 | # check if identity.public exists 71 | if [ -f /var/lib/zerotier-one/identity.public ]; then 72 | # generate json config file 73 | rm -f /etc/zt-mkworld/mkworld.config.json 74 | # now heredoc 75 | cat << EOF > /etc/zt-mkworld/mkworld.config.json 76 | { 77 | "rootNodes": [ 78 | { 79 | "comments": "custom planet - ${MYDOMAIN} - ${MYADDR}", 80 | "identity": "$(cat /var/lib/zerotier-one/identity.public)", 81 | "endpoints": [ 82 | "${MYADDR}/9993" 83 | ] 84 | } 85 | ], 86 | "signing": ["previous.c25519", "current.c25519"], 87 | "output": "planet.custom", 88 | "plID": 0, 89 | "plBirth": 0, 90 | "plRecommend": true 91 | } 92 | EOF 93 | # run program under corresponding workdir, check exit code is 0. 94 | cd /etc/zt-mkworld 95 | /usr/local/bin/ztmkworld -c /etc/zt-mkworld/mkworld.config.json 96 | # copy custom planet to /var/lib/zerotier-one and httpfs 97 | if [[ $? -eq 0 ]]; then 98 | cp -f ./planet.custom /var/lib/zerotier-one/planet 99 | cp -f ./planet.custom /opt/key-networks/ztncui/etc/httpfs 100 | chown -R zerotier-one:zerotier-one /var/lib/zerotier-one 101 | echo "planet successfully generated." 102 | else 103 | echo "planet generator failed. exit now." 104 | /run/s6/basedir/bin/halt 105 | exit 1 106 | fi 107 | # finally create ALREADY_INITED flag file 108 | echo "mkworld successfully ran." 109 | touch /etc/zt-mkworld/ALREADY_INITED 110 | exit 0 111 | else 112 | echo "identity.public does NOT exit, cannot generate planet file." 113 | /run/s6/basedir/bin/halt 114 | exit 1 115 | fi 116 | fi 117 | 118 | # if set to 2, only use mkworld.config.json provided 119 | # check if mkworld.config.json exists 120 | if [[ $AUTOGEN_PLANET -eq 2 ]]; then 121 | cd /etc/zt-mkworld 122 | if [ ! -f /etc/zt-mkworld/mkworld.config.json ]; then 123 | echo "/etc/zt-mkworld/mkworld.config.json not exists. exit now." 124 | /run/s6/basedir/bin/halt 125 | exit 1 126 | fi 127 | /usr/local/bin/ztmkworld -c /etc/zt-mkworld/mkworld.config.json 128 | # check if successfully exit 129 | # copy custom planet to /var/lib/zerotier-one and httpfs 130 | if [[ $? -eq 0 ]]; then 131 | cp -f ./planet.custom /var/lib/zerotier-one/planet 132 | cp -f ./planet.custom /opt/key-networks/ztncui/etc/httpfs 133 | chown -R zerotier-one:zerotier-one /var/lib/zerotier-one 134 | echo "planet successfully generated." 135 | else 136 | echo "planet generator failed. exit now." 137 | /run/s6/basedir/bin/halt 138 | exit 1 139 | fi 140 | # finally create ALREADY_INITED flag file 141 | echo "mkworld successfully ran." 142 | touch /etc/zt-mkworld/ALREADY_INITED 143 | exit 0 144 | fi 145 | # after generate, copy to httpfs folder, do not directly expose the mkworld config folder. 146 | # the config folder contains secret keys! 147 | fi 148 | -------------------------------------------------------------------------------- /start_zt1.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Always do this to make sure the directory permissions are correct. 4 | chown -R zerotier-one:zerotier-one /var/lib/zerotier-one 5 | # remove secrets 6 | unset ZTNCUI_PASSWD 7 | # ZT1 must run as root. 8 | /usr/sbin/zerotier-one 9 | -------------------------------------------------------------------------------- /start_ztncui.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | cd /opt/key-networks/ztncui 4 | 5 | if [ -z $MYADDR ]; then 6 | echo "Set Your IP Address to continue." 7 | echo "If you don't do that, I will automatically detect." 8 | MYEXTADDR=$(curl --connect-timeout 5 ip.sb) 9 | if [ -z $MYEXTADDR ]; then 10 | MYINTADDR=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1') 11 | MYADDR=${MYINTADDR} 12 | else 13 | MYADDR=${MYEXTADDR} 14 | fi 15 | echo "YOUR IP: ${MYADDR}" 16 | fi 17 | 18 | MYDOMAIN=${MYDOMAIN:-ztncui.docker.test} # Used for minica 19 | ZTNCUI_PASSWD=${ZTNCUI_PASSWD:-password} # Used for argon2g 20 | MYADDR=${MYADDR} 21 | HTTP_ALL_INTERFACES=${HTTP_ALL_INTERFACES} 22 | HTTP_PORT=${HTTP_PORT:-3000} 23 | PLANET_RETR_PUBLIC=${PLANET_RETR_PUBLIC} 24 | 25 | # HTTPS Disabled 26 | # HTTPS_PORT=${HTTPS_PORT:-3443} 27 | 28 | echo "YOUR DOMAIN: ${MYDOMAIN}" 29 | 30 | while [ ! -f /var/lib/zerotier-one/authtoken.secret ]; do 31 | echo "ZT1 AuthToken is not found... Wait for ZT1 to start..." 32 | sleep 2 33 | done 34 | chown zerotier-one:zerotier-one /var/lib/zerotier-one/authtoken.secret 35 | chmod 640 /var/lib/zerotier-one/authtoken.secret 36 | 37 | cd /opt/key-networks/ztncui 38 | 39 | echo "NODE_ENV=production" > /opt/key-networks/ztncui/.env 40 | echo "MYADDR=$MYADDR" >> /opt/key-networks/ztncui/.env 41 | echo "HTTP_PORT=$HTTP_PORT" >> /opt/key-networks/ztncui/.env 42 | if [ ! -z $HTTP_ALL_INTERFACES ]; then 43 | echo "HTTP_ALL_INTERFACES=$HTTP_ALL_INTERFACES" >> /opt/key-networks/ztncui/.env 44 | else 45 | [ ! -z $HTTPS_PORT ] && echo "HTTPS_PORT=$HTTPS_PORT" >> /opt/key-networks/ztncui/.env 46 | fi 47 | 48 | echo "ZTNCUI ENV CONFIGURATION: " 49 | cat /opt/key-networks/ztncui/.env 50 | 51 | mkdir -p /opt/key-networks/ztncui/etc/storage 52 | mkdir -p /opt/key-networks/ztncui/etc/tls 53 | mkdir -p /opt/key-networks/ztncui/etc/httpfs # for planet files 54 | 55 | if [ ! -f /opt/key-networks/ztncui/etc/passwd ]; then 56 | echo "Default Password File Not Exists... Generating..." 57 | cd /opt/key-networks/ztncui/etc 58 | /usr/local/bin/argon2g 59 | cd ../ 60 | fi 61 | 62 | if [ ! -f /opt/key-networks/ztncui/etc/tls/fullchain.pem ] || [ ! -f /opt/key-networks/ztncui/etc/tls/privkey.pem ]; then 63 | echo "Cannot detect TLS Certs, Generating..." 64 | cd /opt/key-networks/ztncui/etc/tls 65 | /usr/local/bin/minica -domains "$MYDOMAIN" 66 | cat "$MYDOMAIN/cert.pem" minica.pem > fullchain.pem 67 | cp -f "$MYDOMAIN/key.pem" privkey.pem 68 | cp -f minica.pem /opt/key-networks/ztncui/etc/httpfs/ca.pem 69 | cd ../../ 70 | fi 71 | 72 | chown -R zerotier-one:zerotier-one /opt/key-networks/ztncui 73 | chmod 0755 /opt/key-networks/ztncui/ztncui 74 | 75 | unset ZTNCUI_PASSWD 76 | /usr/local/bin/gosu zerotier-one:zerotier-one /opt/key-networks/ztncui/ztncui 77 | -------------------------------------------------------------------------------- /ztnodeid/assets/mkworld.config.json: -------------------------------------------------------------------------------- 1 | { 2 | "rootNodes": [ 3 | { 4 | "comments": "amsterdam official", 5 | "identity": "992fcf1db7:0:206ed59350b31916f749a1f85dffb3a8787dcbf83b8c6e9448d4e3ea0e3369301be716c3609344a9d1533850fb4460c50af43322bcfc8e13d3301a1f1003ceb6", 6 | "endpoints": [ 7 | "195.181.173.159/443", 8 | "2a02:6ea0:c024::/443" 9 | ] 10 | } 11 | ], 12 | "signing": [ 13 | "previous.c25519", 14 | "current.c25519" 15 | ], 16 | "output": "planet.custom", 17 | "plID": 0, 18 | "plBirth": 0, 19 | "plRecommend": true 20 | } -------------------------------------------------------------------------------- /ztnodeid/cmd/mkworld/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "encoding/json" 5 | "errors" 6 | "flag" 7 | "fmt" 8 | "log" 9 | "math/rand" 10 | "os" 11 | "time" 12 | "ztnodeid/pkg/node" 13 | "ztnodeid/pkg/ztcrypto" 14 | ) 15 | 16 | var ( 17 | ErrWorldSigningKeyIllegal = errors.New("world signing key current.c25519 / previous.c25519 is illegal") 18 | ErrPreflightCheckFailed = errors.New("preflight check failed, internal requirement cannot be satisfied") 19 | errUseRecommendValue = errors.New("potential risk of failed execution, use recommendation if possible") 20 | ) 21 | 22 | var ( 23 | prevkp = make([]byte, node.ZT_C25519_PUBLIC_KEY_LEN+node.ZT_C25519_PRIVATE_KEY_LEN) 24 | curkp = make([]byte, node.ZT_C25519_PUBLIC_KEY_LEN+node.ZT_C25519_PRIVATE_KEY_LEN) 25 | mConf = &MkWorldConfig{} 26 | gConfFile = flag.String("c", "mkworld.config.json", "program config") 27 | alreadyMod = false 28 | ) 29 | 30 | func init() { 31 | flag.Parse() 32 | log.Println("startup flag parsed: ", flag.Parsed()) 33 | } 34 | 35 | func main() { 36 | /** 37 | // current.c25519: public key 64 bytes, private key 64 bytes 38 | // signature: must be signed by previous, 39 | // message is world after serialized, internal public key is current 40 | // if initial, previous=current 41 | // elliptic curve crypt operation are copied from NaCl 42 | **/ 43 | // Now Start Preflight Check 44 | // Check Config Number limit and legal or not 45 | if err := Preflight(); err != nil { 46 | switch err { 47 | case ErrPreflightCheckFailed: 48 | panic(err) 49 | case errUseRecommendValue: 50 | log.Println("!You've been warned! WARN! WARN! WARN!") 51 | if mConf.PlanetRecommend { 52 | log.Println("since you've set plRecommend to true, we will automatically choose a new value.") 53 | log.Println("which might be much suitable for you.") 54 | mConf.PlanetID = (uint64)(rand.Uint32()) 55 | mConf.PlanetBirth = (uint64)(time.Now().UnixMilli()) 56 | log.Printf("Generated Planet ID: %d, Birth TimeStamp: %d . \n", mConf.PlanetID, mConf.PlanetBirth) 57 | alreadyMod = true 58 | } else { 59 | log.Println("planet ID and planet birth might not be suitable for unofficial world. unexpected things might happen.") 60 | } 61 | default: 62 | log.Println("unknown error occured, preflight check failed.") 63 | panic(err) 64 | } 65 | log.Println("!You've been warned! WARN! WARN! WARN!") 66 | } 67 | // check signing key 68 | if err := PreFlightSigningKeyCheck(); err != nil { 69 | // if signing key is illegal, generate new 70 | switch err { 71 | case ErrWorldSigningKeyIllegal: 72 | log.Println("preflight check error occurred, but still can proceed.") 73 | pub1, priv1 := ztcrypto.GenerateDualPair() 74 | copy(prevkp[:node.ZT_C25519_PUBLIC_KEY_LEN], pub1[:]) 75 | copy(prevkp[node.ZT_C25519_PUBLIC_KEY_LEN:], priv1[:]) 76 | copy(curkp, prevkp) 77 | err = os.WriteFile("current.c25519", prevkp, 0640) 78 | if err != nil { 79 | log.Println("failed to write generate c25519 key pair to disk.") 80 | panic(err) 81 | } 82 | err = os.WriteFile("previous.c25519", curkp, 0640) 83 | if err != nil { 84 | log.Println("failed to write generate c25519 key pair to disk.") 85 | panic(err) 86 | } 87 | log.Println("new world signing key generated.") 88 | default: 89 | log.Println("preflight check failed.") 90 | // else panic 91 | panic(err) 92 | } 93 | } 94 | log.Println("preflight check successfully complete.") 95 | // Preflight check successfully completed 96 | // Start to build a world 97 | ztW := &node.ZtWorld{ 98 | Type: node.ZT_WORLD_TYPE_PLANET, 99 | ID: mConf.PlanetID, 100 | Timestamp: mConf.PlanetBirth, 101 | } 102 | // fill the node 103 | var err2 error 104 | ztW.Nodes, err2 = buildPlanetNodeFromConfig() 105 | if err2 != nil { 106 | panic(err2) 107 | } 108 | 109 | // prepare for signing 110 | var futurePubK = [node.ZT_C25519_PUBLIC_KEY_LEN]byte{} 111 | copy(futurePubK[:], curkp[:node.ZT_C25519_PUBLIC_KEY_LEN]) 112 | ztW.PublicKeyMustBeSignedByNextTime = futurePubK 113 | log.Println("generating pre-sign message.") 114 | toSignZtW, err := ztW.Serialize(true, [node.ZT_C25519_SIGNATURE_LEN]byte{}) 115 | if err != nil { 116 | panic(err) 117 | } 118 | log.Println("pre-sign world generated and serialized successfully.") 119 | 120 | var sigPubK [node.ZT_C25519_PUBLIC_KEY_LEN]byte 121 | var sigPrivK [node.ZT_C25519_PRIVATE_KEY_LEN]byte 122 | copy(sigPubK[:], prevkp[:node.ZT_C25519_PUBLIC_KEY_LEN]) 123 | copy(sigPrivK[:], prevkp[node.ZT_C25519_PUBLIC_KEY_LEN:]) 124 | 125 | sig4NewWorld, err := ztcrypto.SignMessage(sigPubK, sigPrivK, toSignZtW) 126 | if err != nil { 127 | panic(err) 128 | } 129 | log.Println("world has been signed.") 130 | 131 | // pack and serialize 132 | finalWorld, err := ztW.Serialize(false, sig4NewWorld) 133 | if err != nil { 134 | panic(err) 135 | } 136 | log.Println("new signed world are packed.") 137 | err = os.WriteFile(mConf.OutputFile, finalWorld, 0644) 138 | if err != nil { 139 | panic(err) 140 | } 141 | log.Println("packed new signed world has been written to file.") 142 | log.Println(" ") 143 | 144 | // if params are recommended, save 145 | if alreadyMod { 146 | mDt, err := json.Marshal(mConf) 147 | if err != nil { 148 | log.Println("err when trying to save modified mkworld json, err: ", err) 149 | } else { 150 | err2 := os.WriteFile("mkworld.new.json", mDt, 0644) 151 | if err2 != nil { 152 | log.Println("write file to disk failed, err:", err2) 153 | } 154 | log.Println("write modified json successfully.") 155 | } 156 | } 157 | log.Println(" ") 158 | 159 | // get c output 160 | log.Println("now c language output: ") 161 | fmt.Println(" ") 162 | fmt.Println("#define ZT_DEFAULT_WORLD_LENGTH ", len(finalWorld)) 163 | fmt.Printf("static const unsigned char ZT_DEFAULT_WORLD[ZT_DEFAULT_WORLD_LENGTH] = {") 164 | for i, v := range finalWorld { 165 | if i > 0 { 166 | fmt.Printf(",") 167 | } 168 | fmt.Printf("0x%02x", v) 169 | } 170 | fmt.Printf("};\n") 171 | fmt.Println(" ") 172 | } 173 | 174 | type MkWorldConfig struct { 175 | SigningKeyFiles []string `json:"signing"` 176 | OutputFile string `json:"output"` 177 | RootNodes []MkWorldNode `json:"rootNodes"` 178 | PlanetID uint64 `json:"plID"` 179 | PlanetBirth uint64 `json:"plBirth"` 180 | PlanetRecommend bool `json:"plRecommend"` 181 | } 182 | 183 | type MkWorldNode struct { 184 | Comments string `json:"comments,omitempty"` 185 | IdentityStr string `json:"identity"` 186 | Endpoints []string `json:"endpoints"` 187 | } 188 | 189 | func Preflight() error { 190 | gcfdata, err := os.ReadFile(*gConfFile) 191 | if err != nil { 192 | return err 193 | } 194 | log.Println("config file read.") 195 | err = json.Unmarshal(gcfdata, mConf) 196 | if err != nil { 197 | return err 198 | } 199 | log.Println("config file unmarshalled.") 200 | if len(mConf.SigningKeyFiles) != 2 { 201 | log.Println("signing key must have 2 files.") 202 | return ErrPreflightCheckFailed 203 | } 204 | if len(mConf.RootNodes) > node.ZT_WORLD_MAX_ROOTS { 205 | log.Println("root nodes are too many.") 206 | return ErrPreflightCheckFailed 207 | } 208 | for _, v := range mConf.RootNodes { 209 | if len(v.Endpoints) > node.ZT_WORLD_MAX_STABLE_ENDPOINTS_PER_ROOT { 210 | log.Println("stable endpoints for current root node are too many.") 211 | return ErrPreflightCheckFailed 212 | } 213 | } 214 | if mConf.PlanetID == node.ZT_WORLD_ID_EARTH || mConf.PlanetID == node.ZT_WORLD_ID_MARS || mConf.PlanetBirth == 1567191349589 { 215 | log.Println("!WARNING! You've specified a Planet ID / Birth that is currently in use.") 216 | return errUseRecommendValue 217 | } 218 | if mConf.PlanetBirth <= 1567191349589 { 219 | log.Println("!WARNING! You've been created a world older than official, timestamp should be larger than 1567191349589.") 220 | return errUseRecommendValue 221 | } 222 | return nil 223 | } 224 | 225 | func PreFlightSigningKeyCheck() error { 226 | var err1, err2 error 227 | // "signing": ["previous.c25519", "current.c25519"] 228 | tPrevkp, err1 := os.ReadFile(mConf.SigningKeyFiles[0]) 229 | tCurkp, err2 := os.ReadFile(mConf.SigningKeyFiles[1]) 230 | if err1 != nil || err2 != nil { 231 | log.Println("read world signing key failed: ", err1, " , ", err2) 232 | return ErrWorldSigningKeyIllegal 233 | } 234 | preqLen := node.ZT_C25519_PRIVATE_KEY_LEN + node.ZT_C25519_PUBLIC_KEY_LEN 235 | if len(prevkp) != preqLen || len(curkp) != preqLen { 236 | log.Println("existing world signing key does not satisfy required length.") 237 | return ErrWorldSigningKeyIllegal 238 | } else { 239 | curkp = tCurkp 240 | prevkp = tPrevkp 241 | } 242 | return nil 243 | } 244 | 245 | func buildPlanetNodeFromConfig() ([]*node.ZtWorldPlanetNode, error) { 246 | res := []*node.ZtWorldPlanetNode{} 247 | for _, v := range mConf.RootNodes { 248 | n1 := &node.ZtWorldPlanetNode{} 249 | n1ep := make([]*node.ZtNodeInetAddr, 0) 250 | n1id := &node.ZtWorldPlanetNodeIdentity{} 251 | err := n1id.FromString(v.IdentityStr, false) 252 | if err != nil { 253 | return nil, err 254 | } 255 | for _, v2 := range v.Endpoints { 256 | n1addr := &node.ZtNodeInetAddr{} 257 | err := n1addr.FromString(v2) 258 | if err != nil { 259 | return nil, err 260 | } 261 | n1ep = append(n1ep, n1addr) 262 | } 263 | n1.Identity = n1id 264 | n1.Endpoints = n1ep 265 | res = append(res, n1) 266 | } 267 | return res, nil 268 | } 269 | -------------------------------------------------------------------------------- /ztnodeid/go.mod: -------------------------------------------------------------------------------- 1 | module ztnodeid 2 | 3 | go 1.20 4 | 5 | require golang.org/x/crypto v0.31.0 6 | -------------------------------------------------------------------------------- /ztnodeid/go.sum: -------------------------------------------------------------------------------- 1 | golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= 2 | golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= 3 | -------------------------------------------------------------------------------- /ztnodeid/pkg/node/errs.go: -------------------------------------------------------------------------------- 1 | /* 2 | * SPDX-License-Identifier: AGPL-3.0-only 3 | * Copyright (C) 2023 by kmahyyg in Patmeow Limited 4 | */ 5 | 6 | package node 7 | 8 | import "errors" 9 | 10 | var ( 11 | ErrMaxEndpointsExceeded = errors.New("zerotier node has too many endpoints") 12 | ErrMaxRootsExceeded = errors.New("zerotier root exceeds limits") 13 | ErrSerializedDataTooLarge = errors.New("serialized data longer than restriction") 14 | ErrInvalidData = errors.New("data input invalid") 15 | ErrUnknown = errors.New("unknown error") 16 | ) 17 | -------------------------------------------------------------------------------- /ztnodeid/pkg/node/identity.go: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2021, ZeroTier, Inc. 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // 1. Redistributions of source code must retain the above copyright notice, this 8 | // list of conditions and the following disclaimer. 9 | // 10 | // 2. Redistributions in binary form must reproduce the above copyright notice, 11 | // this list of conditions and the following disclaimer in the documentation 12 | // and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its 15 | // contributors may be used to endorse or promote products derived from 16 | // this software without specific prior written permission. 17 | // 18 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 21 | // DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 22 | // FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 | // DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 24 | // SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 25 | // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 26 | // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 27 | // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 | 29 | package node 30 | 31 | /** 32 | * A ZeroTier identity 33 | * 34 | * An identity consists of a public key, a 40-bit ZeroTier address computed 35 | * from that key in a collision-resistant fashion, and a self-signature. 36 | * 37 | * The address derivation algorithm makes it computationally very expensive to 38 | * search for a different public key that duplicates an existing address. (See 39 | * code for deriveAddress() for this algorithm.) 40 | */ 41 | 42 | import ( 43 | "fmt" 44 | "ztnodeid/pkg/ztcrypto" 45 | ) 46 | 47 | const ztIdentityHashCashFirstByteLessThan = 17 48 | 49 | // ZeroTierIdentity contains a public key, a private key, and a string representation of the identity. 50 | type ZeroTierIdentity struct { 51 | address uint64 // ZeroTier address, only least significant 40 bits are used 52 | publicKey [64]byte 53 | privateKey *[64]byte 54 | } 55 | 56 | // NewZeroTierIdentity creates a new ZeroTier Identity. 57 | // This can be a little bit time-consuming due to one way proof of work requirements (usually a few hundred milliseconds). 58 | func NewZeroTierIdentity() (id ZeroTierIdentity) { 59 | for { 60 | pub, priv := ztcrypto.GenerateDualPair() 61 | dig := ztcrypto.ComputeZeroTierIdentityMemoryHardHash(pub[:]) 62 | if dig[0] < ztIdentityHashCashFirstByteLessThan && dig[59] != 0xff { 63 | id.address = uint64(dig[59]) 64 | id.address <<= 8 65 | id.address |= uint64(dig[60]) 66 | id.address <<= 8 67 | id.address |= uint64(dig[61]) 68 | id.address <<= 8 69 | id.address |= uint64(dig[62]) 70 | id.address <<= 8 71 | id.address |= uint64(dig[63]) 72 | if id.address != 0 { 73 | id.publicKey = pub 74 | id.privateKey = &priv 75 | break 76 | } 77 | } 78 | } 79 | return 80 | } 81 | 82 | // PrivateKeyString returns the full identity.secret if the private key is set, or an empty string if no private key is set. 83 | func (id *ZeroTierIdentity) PrivateKeyString() string { 84 | if id.privateKey != nil { 85 | s := fmt.Sprintf("%.10x:0:%x:%x", id.address, id.publicKey, *id.privateKey) 86 | return s 87 | } 88 | return "" 89 | } 90 | 91 | // PublicKeyString returns identity.public contents. 92 | func (id *ZeroTierIdentity) PublicKeyString() string { 93 | s := fmt.Sprintf("%.10x:0:%x", id.address, id.publicKey) 94 | return s 95 | } 96 | 97 | // IDString returns the NodeID as a 10-digit hex string 98 | func (id *ZeroTierIdentity) IDString() string { 99 | s := fmt.Sprintf("%.10x", id.address) 100 | return s 101 | } 102 | 103 | // ID returns the ZeroTier address as a uint64 104 | func (id *ZeroTierIdentity) ID() uint64 { 105 | return id.address 106 | } 107 | 108 | // PrivateKey returns the bytes of the private key (or nil if not set) 109 | func (id *ZeroTierIdentity) PrivateKey() *[64]byte { 110 | return id.privateKey 111 | } 112 | 113 | // PublicKey returns the public key bytes 114 | func (id *ZeroTierIdentity) PublicKey() [64]byte { 115 | return id.publicKey 116 | } 117 | -------------------------------------------------------------------------------- /ztnodeid/pkg/node/node.go: -------------------------------------------------------------------------------- 1 | /* 2 | * SPDX-License-Identifier: AGPL-3.0-only 3 | * Copyright (C) 2023 by kmahyyg in Patmeow Limited 4 | */ 5 | 6 | package node 7 | 8 | import ( 9 | "bytes" 10 | "encoding/hex" 11 | "fmt" 12 | "strings" 13 | ) 14 | 15 | const ( 16 | ZT_C25519_PUBLIC_KEY_LEN = 64 17 | ZT_C25519_PRIVATE_KEY_LEN = 64 18 | ZT_C25519_SIGNATURE_LEN = 96 19 | ) 20 | 21 | type ZtNormalNode struct { 22 | ZtNodeAddress [5]byte // but only use big-endian high 40 bits 23 | PublicKey [ZT_C25519_PUBLIC_KEY_LEN]byte 24 | privateKey [ZT_C25519_PRIVATE_KEY_LEN]byte 25 | } 26 | 27 | // HasPrivateKey return true if first 4 bytes are all null 28 | func (ztn ZtNormalNode) HasPrivateKey() bool { 29 | return !bytes.Equal(ztn.privateKey[0:4], []byte{0, 0, 0, 0}) 30 | } 31 | 32 | // ExposePrivateKey returns internal private key 33 | func (ztn ZtNormalNode) ExposePrivateKey() []byte { 34 | return ztn.privateKey[:] 35 | } 36 | 37 | // FromString import node identity using "identity.public", to use content of "identity.secret" with private key 38 | // imported at the same time, set hasPrivateKey to true 39 | func (ztn *ZtNormalNode) FromString(data string, hasPrivateKey bool) (err error) { 40 | tmpDt := strings.Split(data, ":") 41 | if len(tmpDt) != 3 && hasPrivateKey { 42 | return ErrInvalidData 43 | } 44 | if len(tmpDt) < 2 { 45 | return ErrInvalidData 46 | } 47 | if hasPrivateKey { 48 | tmpPrivk, err := hex.DecodeString(tmpDt[2]) 49 | if err != nil { 50 | return err 51 | } 52 | copy(ztn.privateKey[:], tmpPrivk) 53 | } 54 | tmpAddr, err := hex.DecodeString(tmpDt[0]) 55 | if err != nil { 56 | return err 57 | } 58 | copy(ztn.ZtNodeAddress[:], tmpAddr) 59 | tmpPubk, err := hex.DecodeString(tmpDt[2]) 60 | if err != nil { 61 | return err 62 | } 63 | copy(ztn.PublicKey[:], tmpPubk) 64 | return nil 65 | } 66 | 67 | func (ztn ZtNormalNode) ToString(exportPrivateKey bool) string { 68 | // the second field, its value 0 indicates Curve25519/Ed25519 identity type 69 | pub := fmt.Sprintf("%02x:0:%02x", ztn.ZtNodeAddress, ztn.PublicKey) 70 | if exportPrivateKey && ztn.HasPrivateKey() { 71 | return pub + fmt.Sprintf(":%02x", ztn.privateKey) 72 | } 73 | return pub 74 | } 75 | -------------------------------------------------------------------------------- /ztnodeid/pkg/node/world.go: -------------------------------------------------------------------------------- 1 | /* 2 | * SPDX-License-Identifier: AGPL-3.0-only 3 | * Copyright (C) 2023 by kmahyyg in Patmeow Limited 4 | */ 5 | 6 | package node 7 | 8 | import ( 9 | "bytes" 10 | "encoding/binary" 11 | "net" 12 | "strconv" 13 | "strings" 14 | "syscall" 15 | ) 16 | 17 | // Code reproduced from https://github.com/zerotier/ZeroTierOne/blob/e0a3291235230352148d5d30e51b341bfd9ad458/node/World.hpp 18 | 19 | const ( 20 | // ZT_WORLD_MAX_ROOTS is the Maximum number of roots (sanity limit, okay to increase) 21 | // 22 | // A given root can (through multi-homing) be distributed across any number of 23 | // physical endpoints, but having more than one is good to permit total failure 24 | // of one root or its withdrawal due to compromise without taking the whole net 25 | // down. 26 | ZT_WORLD_MAX_ROOTS = 4 27 | // ZT_WORLD_MAX_STABLE_ENDPOINTS_PER_ROOT is the Maximum number of stable endpoints per root (sanity limit, okay to increase) 28 | ZT_WORLD_MAX_STABLE_ENDPOINTS_PER_ROOT = 32 29 | // ZT_WORLD_MAX_SERIALIZED_LENGTH is the (more than) maximum length of a serialized World 30 | ZT_WORLD_MAX_SERIALIZED_LENGTH = ((1024 + (32 * ZT_WORLD_MAX_STABLE_ENDPOINTS_PER_ROOT)) * 31 | ZT_WORLD_MAX_ROOTS) + ZT_C25519_PUBLIC_KEY_LEN + ZT_C25519_SIGNATURE_LEN + 128 32 | ) 33 | 34 | type ZtWorldID = uint64 35 | 36 | const ( 37 | // ZT_WORLD_ID_EARTH is the official world in production ZeroTier Cloud 38 | ZT_WORLD_ID_EARTH ZtWorldID = 149604618 39 | // ZT_WORLD_ID_MARS is reserved world for future 40 | ZT_WORLD_ID_MARS = 227883110 41 | ) 42 | 43 | type ZtWorldType = uint8 44 | 45 | const ( 46 | // ZT_WORLD_TYPE_NULL should never be used in real world, but it's not invalid 47 | ZT_WORLD_TYPE_NULL ZtWorldType = iota 48 | // ZT_WORLD_TYPE_PLANET Planets, of which there is currently one (Earth) 49 | ZT_WORLD_TYPE_PLANET 50 | // ZT_WORLD_TYPE_MOON are user-created and many 51 | ZT_WORLD_TYPE_MOON = 127 52 | ) 53 | 54 | type ZtWorld struct { 55 | Type ZtWorldType 56 | ID ZtWorldID 57 | Timestamp uint64 58 | PublicKeyMustBeSignedByNextTime [ZT_C25519_PUBLIC_KEY_LEN]byte 59 | Nodes []*ZtWorldPlanetNode 60 | } 61 | 62 | type ZtNodeInetAddr struct { 63 | IP *net.IP // net.IP == []byte 64 | Port uint16 65 | } 66 | 67 | func (a *ZtNodeInetAddr) Family() int { 68 | if a == nil || len(*a.IP) <= net.IPv4len { 69 | return syscall.AF_INET 70 | } 71 | if a.IP.To4() != nil { 72 | return syscall.AF_INET 73 | } 74 | return syscall.AF_INET6 75 | } 76 | 77 | func (a *ZtNodeInetAddr) FromString(ipport string) error { 78 | // endpoint address use specific format: / 79 | // identity address use contents from identity.public 80 | tIpPort := strings.Split(ipport, "/") 81 | if len(tIpPort) != 2 { 82 | return ErrInvalidData 83 | } 84 | tPort, err := strconv.ParseUint(tIpPort[1], 10, 16) 85 | if err != nil { 86 | return err 87 | } 88 | tIp := net.ParseIP(tIpPort[0]) 89 | if tIp == nil { 90 | return ErrInvalidData 91 | } 92 | a.IP = &tIp 93 | a.Port = (uint16)(tPort) 94 | return nil 95 | } 96 | 97 | func (ztniaddr *ZtNodeInetAddr) Serialize() ([]byte, error) { 98 | var buf = make([]byte, 0) 99 | switch ztniaddr.Family() { 100 | case syscall.AF_INET: 101 | buf = append(buf, (uint8)(4)) 102 | // uint32_t in_addr_t in_addr = sin_addr.s_addr (4bytes) 103 | buf = append(buf, ztniaddr.IP.To4()...) 104 | // in case we have port, append port. (reserved, but not used) 105 | // port -> ntoh conversion, net-byteorder is always big-endian 106 | buf = binary.BigEndian.AppendUint16(buf, ztniaddr.Port) 107 | return buf, nil 108 | case syscall.AF_INET6: 109 | buf = append(buf, (uint8)(6)) 110 | // uint32_t in_addr_t in_addr = sin_addr.s_addr (4bytes) 111 | buf = append(buf, ztniaddr.IP.To16()...) 112 | // in case we have port, append port. (reserved, but not used) 113 | // port -> ntoh conversion, net-byteorder is always big-endian 114 | buf = binary.BigEndian.AppendUint16(buf, ztniaddr.Port) 115 | return buf, nil 116 | default: 117 | buf = []byte{0} 118 | return buf, ErrInvalidData 119 | } 120 | } 121 | 122 | type ZtWorldPlanetNodeIdentity = ZtNormalNode 123 | 124 | func (ztpnid ZtWorldPlanetNodeIdentity) Serialize(inclPrivKey bool) ([]byte, error) { 125 | var buf = make([]byte, 0) 126 | buf = append(buf, ztpnid.ZtNodeAddress[:]...) 127 | buf = append(buf, 0) 128 | buf = append(buf, ztpnid.PublicKey[:]...) 129 | if ztpnid.HasPrivateKey() && inclPrivKey { 130 | buf = append(buf, ZT_C25519_PRIVATE_KEY_LEN) 131 | buf = append(buf, ztpnid.privateKey[:]...) 132 | } else { 133 | buf = append(buf, 0) 134 | } 135 | return buf, nil 136 | } 137 | 138 | type ZtWorldPlanetNode struct { 139 | Identity *ZtWorldPlanetNodeIdentity 140 | Endpoints []*ZtNodeInetAddr 141 | } 142 | 143 | func (ztpn ZtWorldPlanetNode) Serialize() ([]byte, error) { 144 | var buf = make([]byte, 0) 145 | // node->identity.serialize(), then append 146 | idData, err := ztpn.Identity.Serialize(false) 147 | if err != nil { 148 | return nil, err 149 | } 150 | buf = append(buf, idData...) 151 | // node->endpoints.size() 152 | buf = append(buf, (uint8)(len(ztpn.Endpoints))) 153 | // for each endpoint, endpoint.serialize(), then append 154 | for _, ep := range ztpn.Endpoints { 155 | epData, err := ep.Serialize() 156 | if err != nil { 157 | return nil, err 158 | } 159 | buf = append(buf, epData...) 160 | } 161 | // check if exceed limit then return result 162 | if len(ztpn.Endpoints) > ZT_WORLD_MAX_STABLE_ENDPOINTS_PER_ROOT { 163 | return nil, ErrMaxEndpointsExceeded 164 | } 165 | return buf, nil 166 | } 167 | 168 | func (ztw ZtWorld) Serialize(forSign bool, c25519sig [ZT_C25519_SIGNATURE_LEN]byte) ([]byte, error) { 169 | var buf = make([]byte, 0) 170 | // by default, forSign = false 171 | if forSign { 172 | buf = binary.BigEndian.AppendUint64(buf, 0x7f7f7f7f7f7f7f7f) 173 | } 174 | buf = append(buf, ztw.Type) 175 | buf = binary.BigEndian.AppendUint64(buf, ztw.ID) 176 | buf = binary.BigEndian.AppendUint64(buf, ztw.Timestamp) 177 | buf = append(buf, ztw.PublicKeyMustBeSignedByNextTime[:]...) 178 | // make sure sig is not 0 179 | if !forSign && !bytes.Equal(c25519sig[:4], []byte{0, 0, 0, 0}) { 180 | buf = append(buf, c25519sig[:]...) 181 | } 182 | buf = append(buf, (uint8)(len(ztw.Nodes))) 183 | if len(ztw.Nodes) > ZT_WORLD_MAX_ROOTS { 184 | return nil, ErrMaxRootsExceeded 185 | } 186 | for _, n := range ztw.Nodes { 187 | nBytes, err := n.Serialize() 188 | if err != nil { 189 | return nil, err 190 | } 191 | buf = append(buf, nBytes...) 192 | } 193 | if ztw.Type == ZT_WORLD_TYPE_MOON { 194 | // official comments: no attached dictionary (for future use) 195 | buf = binary.BigEndian.AppendUint16(buf, 0) 196 | } 197 | if forSign { 198 | buf = binary.BigEndian.AppendUint64(buf, 0xf7f7f7f7f7f7f7f7) 199 | } 200 | if len(buf) > ZT_WORLD_MAX_SERIALIZED_LENGTH { 201 | return nil, ErrSerializedDataTooLarge 202 | } 203 | return buf, nil 204 | } 205 | -------------------------------------------------------------------------------- /ztnodeid/pkg/ztcrypto/identity.go: -------------------------------------------------------------------------------- 1 | /* 2 | * SPDX-License-Identifier: AGPL-3.0-only 3 | * Copyright (C) 2023 by kmahyyg in Patmeow Limited 4 | */ 5 | 6 | package ztcrypto 7 | 8 | import ( 9 | secrand "crypto/rand" 10 | "crypto/sha512" 11 | "encoding/binary" 12 | "golang.org/x/crypto/curve25519" 13 | "golang.org/x/crypto/ed25519" 14 | "golang.org/x/crypto/salsa20/salsa" 15 | ) 16 | 17 | const ztIdentityGenMemory = 2097152 18 | 19 | func ComputeZeroTierIdentityMemoryHardHash(publicKey []byte) []byte { 20 | s512 := sha512.Sum512(publicKey) 21 | 22 | var genmem [ztIdentityGenMemory]byte 23 | var s20key [32]byte 24 | var s20ctr [16]byte 25 | var s20ctri uint64 26 | copy(s20key[:], s512[0:32]) 27 | copy(s20ctr[0:8], s512[32:40]) 28 | salsa.XORKeyStream(genmem[0:64], genmem[0:64], &s20ctr, &s20key) 29 | s20ctri++ 30 | for i := 64; i < ztIdentityGenMemory; i += 64 { 31 | binary.LittleEndian.PutUint64(s20ctr[8:16], s20ctri) 32 | salsa.XORKeyStream(genmem[i:i+64], genmem[i-64:i], &s20ctr, &s20key) 33 | s20ctri++ 34 | } 35 | 36 | var tmp [8]byte 37 | for i := 0; i < ztIdentityGenMemory; { 38 | idx1 := uint(binary.BigEndian.Uint64(genmem[i:])&7) * 8 39 | i += 8 40 | idx2 := (uint(binary.BigEndian.Uint64(genmem[i:])) % uint(ztIdentityGenMemory/8)) * 8 41 | i += 8 42 | gm := genmem[idx2 : idx2+8] 43 | d := s512[idx1 : idx1+8] 44 | copy(tmp[:], gm) 45 | copy(gm, d) 46 | copy(d, tmp[:]) 47 | binary.LittleEndian.PutUint64(s20ctr[8:16], s20ctri) 48 | salsa.XORKeyStream(s512[:], s512[:], &s20ctr, &s20key) 49 | s20ctri++ 50 | } 51 | 52 | return s512[:] 53 | } 54 | 55 | // GenerateDualPair generates a key pair containing two pairs: one for curve25519 and one for ed25519. 56 | func GenerateDualPair() (pub [64]byte, priv [64]byte) { 57 | k0pub, k0priv, _ := ed25519.GenerateKey(secrand.Reader) 58 | var k1pub, k1priv [32]byte 59 | secrand.Read(k1priv[:]) 60 | curve25519.ScalarBaseMult(&k1pub, &k1priv) 61 | // https://www.eiken.dev/blog/2020/11/code-spotlight-the-reference-implementation-of-ed25519-part-1/ 62 | // First 32 bytes of pub and priv are the keys for ECDH key 63 | // agreement. This generates the public portion from the private. 64 | copy(pub[0:32], k1pub[:]) 65 | copy(priv[0:32], k1priv[:]) 66 | // Second 32 bytes of pub and priv are the keys for ed25519 67 | // signing and verification. 68 | copy(pub[32:64], k0pub[0:32]) 69 | copy(priv[32:64], k0priv[0:32]) 70 | // same as node/C25519.cpp 71 | return 72 | } 73 | 74 | func SignMessage(pub [64]byte, priv [64]byte, msg []byte) ([96]byte, error) { 75 | var sigBuf = make([]byte, 96) 76 | var finalSig = [96]byte{} 77 | // Zerotier Official: we sign the first 32 bytes of SHA-512(msg) 78 | h := sha512.New() 79 | h.Write(msg) 80 | s512 := h.Sum(nil) 81 | copy(sigBuf[64:], s512[:32]) 82 | // 83 | // in fact, it's ed25519 sign. 84 | // 85 | /** 86 | * This takes the SHA-512 of msg[] and then signs the first 32 bytes of this 87 | * digest, returning it and the 64-byte ed25519 signature in signature[]. 88 | * This results in a signature that verifies both the signer's authenticity 89 | * and the integrity of the message. 90 | * 91 | * This is based on the original ed25519 code from NaCl and the SUPERCOP 92 | * cipher benchmark suite, but with the modification that it always 93 | * produces a signature of fixed 96-byte length based on the hash of an 94 | * arbitrary-length message. 95 | * 96 | */ 97 | // 98 | // Signature = (R,S,Sha512-Of-First32-Msg) 99 | // 100 | goPrivK := make([]byte, 64) 101 | copy(goPrivK[:32], priv[32:64]) 102 | copy(goPrivK[32:], pub[32:64]) 103 | sigData := ed25519.Sign(goPrivK, s512[:32]) 104 | copy(sigBuf[:64], sigData) 105 | // finalize and return 106 | copy(finalSig[:], sigBuf) 107 | return finalSig, nil 108 | } 109 | --------------------------------------------------------------------------------