From 0c4c3858857fc0848d5b8c46aa93415973eaa708 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 3 Apr 2022 12:48:06 +0100
Subject: [PATCH 01/21] Fix regression in Path MTU discovery
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the past we used to send back anything up to 900 bytes of the packet in the ICMPv6 Packet Too Big response, whereas now we seemingly only send back 40 bytes.

It turns out that sending back only the 40 bytes of IPv6 headers isn't enough for most operating systems to positively ID the flow to reduce the MTU. This PR updates it so that we can send up to 512 bytes instead (900 is probably excessive) — that should leave plenty of room for any number of IPv6 extension headers and the next protocol headers and some of the payload.

This seems to fix the problem in my testing.
---
 src/ipv6rwc/ipv6rwc.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/ipv6rwc/ipv6rwc.go b/src/ipv6rwc/ipv6rwc.go
index fc2a688..a87dc92 100644
--- a/src/ipv6rwc/ipv6rwc.go
+++ b/src/ipv6rwc/ipv6rwc.go
@@ -237,11 +237,11 @@ func (k *keyStore) readPC(p []byte) (int, error) {
 		k.mutex.Unlock()
 		if len(bs) > mtu {
 			// Using bs would make it leak off the stack, so copy to buf
-			buf := make([]byte, 40)
-			copy(buf, bs)
+			buf := make([]byte, 512)
+			cn := copy(buf, bs)
 			ptb := &icmp.PacketTooBig{
 				MTU:  mtu,
-				Data: buf[:40],
+				Data: buf[:cn],
 			}
 			if packet, err := CreateICMPv6(buf[8:24], buf[24:40], ipv6.ICMPTypePacketTooBig, 0, ptb); err == nil {
 				_, _ = k.writePC(packet)

From 93c94e38f99f5d97edfbef83d1938e083919a4b0 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 17 Apr 2022 17:24:34 +0100
Subject: [PATCH 02/21] GitHub Actions

---
 .github/workflows/ci.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..03e1e76
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: Yggdrasil
+
+on:
+  push:
+    branches: [ master develop ]
+  pull_request:
+    branches: [ master develop ]
+  release:
+
+jobs:
+  build-test:
+    name: Go ${{ matrix.goversion }}
+  
+    strategy:
+      matrix:
+        goversion: ["1.16", "1.17", "1.18"]
+        
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Go
+      uses: actions/setup-go@v3
+      with:
+        go-version: ${{ matrix.goversion }}
+
+    - name: Build Yggdrasil
+      run: go build -v ./...
+
+    - name: Unit tests
+      run: go test -v ./...

From c7ffbc05a5d80da9eb47cee2089899d38ebe5658 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 17 Apr 2022 17:53:55 +0100
Subject: [PATCH 03/21] Update GitHub Actions

---
 .github/workflows/ci.yml | 83 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 78 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 03e1e76..42ff201 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,19 +2,33 @@ name: Yggdrasil
 
 on:
   push:
-    branches: [ master develop ]
   pull_request:
-    branches: [ master develop ]
   release:
+  workflow_dispatch:
 
 jobs:
-  build-test:
-    name: Go ${{ matrix.goversion }}
-  
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+      - uses: actions/checkout@v3
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          args: --issues-exit-code=1
+
+  build-linux:
     strategy:
+      fail-fast: false
       matrix:
         goversion: ["1.16", "1.17", "1.18"]
         
+    name: Build & Test (Linux, Go ${{ matrix.goversion }})
+    needs: [lint]
+        
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
@@ -29,3 +43,62 @@ jobs:
 
     - name: Unit tests
       run: go test -v ./...
+
+  build-windows:
+    strategy:
+      fail-fast: false
+      matrix:
+        goversion: ["1.16", "1.17", "1.18"]
+  
+    name: Build & Test (Windows, Go ${{ matrix.goversion }})
+    needs: [lint]
+        
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Go
+      uses: actions/setup-go@v3
+      with:
+        go-version: ${{ matrix.goversion }}
+
+    - name: Build Yggdrasil
+      run: go build -v ./...
+
+    - name: Unit tests
+      run: go test -v ./...
+      
+  build-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        goversion: ["1.16", "1.17", "1.18"]
+  
+    name: Build & Test (macOS, Go ${{ matrix.goversion }})
+    needs: [lint]
+        
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Go
+      uses: actions/setup-go@v3
+      with:
+        go-version: ${{ matrix.goversion }}
+
+    - name: Build Yggdrasil
+      run: go build -v ./...
+
+    - name: Unit tests
+      run: go test -v ./...
+
+  tests-ok:
+    name: All tests passed
+    needs: [build-linux, build-windows, build-macos]
+    runs-on: ubuntu-latest
+    if: ${{ !cancelled() }}
+    steps:
+      - name: Check all tests passed
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}

From 90f9be38c56343d3f54e3b1483c7ea1c62a33e79 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 17 Apr 2022 17:56:54 +0100
Subject: [PATCH 04/21] Fix lint errors

---
 src/admin/admin.go         | 3 +--
 src/ipv6rwc/ipv6rwc.go     | 2 +-
 src/multicast/multicast.go | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/admin/admin.go b/src/admin/admin.go
index ce83139..5616453 100644
--- a/src/admin/admin.go
+++ b/src/admin/admin.go
@@ -83,8 +83,7 @@ func (a *AdminSocket) Init(c *core.Core, nc *config.NodeConfig, log *log.Logger,
 		}
 		return res, nil
 	})
-	a.core.SetAdmin(a)
-	return nil
+	return a.core.SetAdmin(a)
 }
 
 func (a *AdminSocket) SetupAdminHandlers(na *AdminSocket) {
diff --git a/src/ipv6rwc/ipv6rwc.go b/src/ipv6rwc/ipv6rwc.go
index a87dc92..bbaa870 100644
--- a/src/ipv6rwc/ipv6rwc.go
+++ b/src/ipv6rwc/ipv6rwc.go
@@ -153,7 +153,7 @@ func (k *keyStore) update(key ed25519.PublicKey) *keyInfo {
 	k.resetTimeout(info)
 	k.mutex.Unlock()
 	for _, packet := range packets {
-		k.core.WriteTo(packet, iwt.Addr(info.key[:]))
+		_, _ = k.core.WriteTo(packet, iwt.Addr(info.key[:]))
 	}
 	return info
 }
diff --git a/src/multicast/multicast.go b/src/multicast/multicast.go
index 882911d..9093e4c 100644
--- a/src/multicast/multicast.go
+++ b/src/multicast/multicast.go
@@ -300,7 +300,7 @@ func (m *Multicast) _announce() {
 				if li, err := m.core.Listen(u, iface.Name); err == nil {
 					m.log.Debugln("Started multicasting on", iface.Name)
 					// Store the listener so that we can stop it later if needed
-					linfo = &listenerInfo{listener: li, time: time.Now()}
+					linfo = &listenerInfo{listener: li, time: time.Now(), port: info.port}
 					m.listeners[iface.Name] = linfo
 				} else {
 					m.log.Warnln("Not multicasting on", iface.Name, "due to error:", err)

From 41d890bb64eafe6c29e94c9656cc347daf324d29 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 17 Apr 2022 18:02:25 +0100
Subject: [PATCH 05/21] Run `goimports`

---
 contrib/mobile/mobile_android.go   |  1 +
 contrib/mobile/mobile_ios.go       |  1 +
 contrib/mobile/mobile_other.go     |  1 +
 src/core/debug.go                  | 14 ++++++++------
 src/core/proto.go                  |  4 ++--
 src/multicast/multicast_unix.go    |  7 +++++--
 src/multicast/multicast_windows.go |  7 +++++--
 7 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/contrib/mobile/mobile_android.go b/contrib/mobile/mobile_android.go
index f3206ac..39bebec 100644
--- a/contrib/mobile/mobile_android.go
+++ b/contrib/mobile/mobile_android.go
@@ -1,3 +1,4 @@
+//go:build android
 // +build android
 
 package mobile
diff --git a/contrib/mobile/mobile_ios.go b/contrib/mobile/mobile_ios.go
index 253bbc0..fedee2d 100644
--- a/contrib/mobile/mobile_ios.go
+++ b/contrib/mobile/mobile_ios.go
@@ -1,3 +1,4 @@
+//go:build ios
 // +build ios
 
 package mobile
diff --git a/contrib/mobile/mobile_other.go b/contrib/mobile/mobile_other.go
index 7b7ed74..aceeb7e 100644
--- a/contrib/mobile/mobile_other.go
+++ b/contrib/mobile/mobile_other.go
@@ -1,3 +1,4 @@
+//go:build !android && !ios
 // +build !android,!ios
 
 package mobile
diff --git a/src/core/debug.go b/src/core/debug.go
index eb40679..ee1f1ed 100644
--- a/src/core/debug.go
+++ b/src/core/debug.go
@@ -3,14 +3,16 @@
 
 package core
 
-import "fmt"
+import (
+	"fmt"
 
-import _ "net/http/pprof"
-import "net/http"
-import "runtime"
-import "os"
+	"net/http"
+	_ "net/http/pprof"
+	"os"
+	"runtime"
 
-import "github.com/gologme/log"
+	"github.com/gologme/log"
+)
 
 // Start the profiler in debug builds, if the required environment variable is set.
 func init() {
diff --git a/src/core/proto.go b/src/core/proto.go
index 3045972..5af59cc 100644
--- a/src/core/proto.go
+++ b/src/core/proto.go
@@ -47,9 +47,9 @@ func (p *protoHandler) init(core *Core) {
 	p.core = core
 	p.nodeinfo.init(p)
 
-	p.selfRequests  = make(map[keyArray]*reqInfo)
+	p.selfRequests = make(map[keyArray]*reqInfo)
 	p.peersRequests = make(map[keyArray]*reqInfo)
-	p.dhtRequests   = make(map[keyArray]*reqInfo)
+	p.dhtRequests = make(map[keyArray]*reqInfo)
 }
 
 // Common functions
diff --git a/src/multicast/multicast_unix.go b/src/multicast/multicast_unix.go
index 9c822fc..c59d876 100644
--- a/src/multicast/multicast_unix.go
+++ b/src/multicast/multicast_unix.go
@@ -3,8 +3,11 @@
 
 package multicast
 
-import "syscall"
-import "golang.org/x/sys/unix"
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
 
 func (m *Multicast) _multicastStarted() {
 
diff --git a/src/multicast/multicast_windows.go b/src/multicast/multicast_windows.go
index 515412a..fa194ac 100644
--- a/src/multicast/multicast_windows.go
+++ b/src/multicast/multicast_windows.go
@@ -3,8 +3,11 @@
 
 package multicast
 
-import "syscall"
-import "golang.org/x/sys/windows"
+import (
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
 
 func (m *Multicast) _multicastStarted() {
 

From 073799d3ded35f6d57ea216329e5b06857fea2cb Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 17 Apr 2022 18:22:26 +0100
Subject: [PATCH 06/21] Require Go 1.17

---
 .github/workflows/ci.yml | 74 ++++++++++++++++++++--------------------
 README.md                |  5 +--
 go.mod                   | 21 ++++++++----
 3 files changed, 55 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42ff201..c9268f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,73 +24,73 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        goversion: ["1.16", "1.17", "1.18"]
-        
+        goversion: ["1.17", "1.18"]
+
     name: Build & Test (Linux, Go ${{ matrix.goversion }})
     needs: [lint]
-        
+
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v3
 
-    - name: Set up Go
-      uses: actions/setup-go@v3
-      with:
-        go-version: ${{ matrix.goversion }}
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.goversion }}
 
-    - name: Build Yggdrasil
-      run: go build -v ./...
+      - name: Build Yggdrasil
+        run: go build -v ./...
 
-    - name: Unit tests
-      run: go test -v ./...
+      - name: Unit tests
+        run: go test -v ./...
 
   build-windows:
     strategy:
       fail-fast: false
       matrix:
-        goversion: ["1.16", "1.17", "1.18"]
-  
+        goversion: ["1.17", "1.18"]
+
     name: Build & Test (Windows, Go ${{ matrix.goversion }})
     needs: [lint]
-        
+
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v3
 
-    - name: Set up Go
-      uses: actions/setup-go@v3
-      with:
-        go-version: ${{ matrix.goversion }}
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.goversion }}
 
-    - name: Build Yggdrasil
-      run: go build -v ./...
+      - name: Build Yggdrasil
+        run: go build -v ./...
+
+      - name: Unit tests
+        run: go test -v ./...
 
-    - name: Unit tests
-      run: go test -v ./...
-      
   build-macos:
     strategy:
       fail-fast: false
       matrix:
-        goversion: ["1.16", "1.17", "1.18"]
-  
+        goversion: ["1.17", "1.18"]
+
     name: Build & Test (macOS, Go ${{ matrix.goversion }})
     needs: [lint]
-        
+
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v3
 
-    - name: Set up Go
-      uses: actions/setup-go@v3
-      with:
-        go-version: ${{ matrix.goversion }}
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.goversion }}
 
-    - name: Build Yggdrasil
-      run: go build -v ./...
+      - name: Build Yggdrasil
+        run: go build -v ./...
 
-    - name: Unit tests
-      run: go test -v ./...
+      - name: Unit tests
+        run: go test -v ./...
 
   tests-ok:
     name: All tests passed
diff --git a/README.md b/README.md
index f1f71d1..2bfb5b1 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ connectivity - it also works over IPv4.
 Yggdrasil works on a number of platforms, including Linux, macOS, Ubiquiti
 EdgeRouter, VyOS, Windows, FreeBSD, OpenBSD and OpenWrt.
 
-Please see our [Installation](https://yggdrasil-network.github.io/installation.html) 
+Please see our [Installation](https://yggdrasil-network.github.io/installation.html)
 page for more information. You may also find other platform-specific wrappers, scripts
 or tools in the `contrib` folder.
 
@@ -25,7 +25,7 @@ or tools in the `contrib` folder.
 If you want to build from source, as opposed to installing one of the pre-built
 packages:
 
-1. Install [Go](https://golang.org) (requires Go 1.16 or later)
+1. Install [Go](https://golang.org) (requires Go 1.17 or later)
 2. Clone this repository
 2. Run `./build`
 
@@ -57,6 +57,7 @@ other configuration such as listen addresses or multicast addresses, etc.
 ### Run Yggdrasil
 
 To run with the generated static configuration:
+
 ```
 ./yggdrasil -useconffile /path/to/yggdrasil.conf
 ```
diff --git a/go.mod b/go.mod
index 9c95755..236877c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,22 +1,17 @@
 module github.com/yggdrasil-network/yggdrasil-go
 
-go 1.16
+go 1.17
 
 require (
 	github.com/Arceliar/ironwood v0.0.0-20211125050254-8951369625d0
 	github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979
-	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/cheggaaa/pb/v3 v3.0.8
-	github.com/fatih/color v1.12.0 // indirect
 	github.com/gologme/log v1.2.0
 	github.com/hashicorp/go-syslog v1.0.0
 	github.com/hjson/hjson-go v3.1.0+incompatible
 	github.com/kardianos/minwinsvc v1.0.0
-	github.com/mattn/go-isatty v0.0.13 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/mitchellh/mapstructure v1.4.1
 	github.com/vishvananda/netlink v1.1.0
-	github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f // indirect
 	golang.org/x/mobile v0.0.0-20220112015953-858099ff7816
 	golang.org/x/net v0.0.0-20211101193420-4a448f8816b3
 	golang.org/x/sys v0.0.0-20211102192858-4dd72447c267
@@ -24,3 +19,17 @@ require (
 	golang.zx2c4.com/wireguard v0.0.0-20211017052713-f87e87af0d9a
 	golang.zx2c4.com/wireguard/windows v0.4.12
 )
+
+require (
+	github.com/VividCortex/ewma v1.2.0 // indirect
+	github.com/fatih/color v1.12.0 // indirect
+	github.com/mattn/go-colorable v0.1.8 // indirect
+	github.com/mattn/go-isatty v0.0.13 // indirect
+	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f // indirect
+	golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
+	golang.org/x/mod v0.4.2 // indirect
+	golang.org/x/tools v0.1.8-0.20211022200916-316ba0b74098 // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+)

From bc78530fcbc144a77c979cef4e971610dc301a83 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Sun, 17 Apr 2022 23:38:16 +0100
Subject: [PATCH 07/21] Build packages in GitHub Actions

---
 .github/workflows/ci.yml | 132 +++++++++++++++++++++++++++++++++++++++
 contrib/msi/build-msi.sh |  38 ++++-------
 contrib/semver/name.sh   |  11 ++--
 3 files changed, 148 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9268f1..a884d76 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,3 +102,135 @@ jobs:
         uses: re-actors/alls-green@release/v1
         with:
           jobs: ${{ toJSON(needs) }}
+
+  build-packages-debian:
+    strategy:
+      fail-fast: false
+      matrix:
+        pkgarch: ["amd64", "i386", "mips", "mipsel", "armhf", "armel", "arm64"]
+
+    name: Create Package (Debian, ${{ matrix.pkgarch }})
+    needs: [tests-ok]
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Build package
+        env:
+          PKGARCH: ${{ matrix.pkgarch }}
+        run: sh contrib/deb/generate.sh
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: Debian package (${{ matrix.pkgarch }})
+          path: "*.deb"
+          if-no-files-found: error
+
+  build-packages-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        pkgarch: ["amd64", "arm64"]
+
+    name: Create Package (macOS, ${{ matrix.pkgarch }})
+    needs: [tests-ok]
+
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Build package
+        env:
+          PKGARCH: ${{ matrix.pkgarch }}
+        run: sh contrib/macos/create-pkg.sh
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: macOS package (${{ matrix.pkgarch }})
+          path: "*.pkg"
+          if-no-files-found: error
+
+  build-packages-windows:
+    strategy:
+      fail-fast: false
+      matrix:
+        pkgarch: ["x64", "x86", "arm", "arm64"]
+
+    name: Create Package (Windows, ${{ matrix.pkgarch }})
+    needs: [tests-ok]
+
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Build package
+        run: sh contrib/msi/build-msi.sh ${{ matrix.pkgarch }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: Windows package (${{ matrix.pkgarch }})
+          path: "*.msi"
+          if-no-files-found: error
+
+  build-packages-router:
+    strategy:
+      fail-fast: false
+      matrix:
+        pkgarch: ["edgerouter-x", "edgerouter-lite", "vyos-amd64", "vyos-i386"]
+
+    name: Create Package (Router, ${{ matrix.pkgarch }})
+    needs: [tests-ok]
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          path: yggdrasil
+
+      - uses: actions/checkout@v3
+        with:
+          repository: neilalexander/vyatta-yggdrasil
+          path: vyatta-yggdrasil
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Build package
+        env:
+          BUILDDIR_YGG: /home/runner/work/yggdrasil-go/yggdrasil-go/yggdrasil
+        run: cd /home/runner/work/yggdrasil-go/yggdrasil-go/vyatta-yggdrasil && ./build-${{ matrix.pkgarch }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: Router package (${{ matrix.pkgarch }})
+          path: "/home/runner/work/yggdrasil-go/yggdrasil-go/vyatta-yggdrasil/*.deb"
+          if-no-files-found: error
diff --git a/contrib/msi/build-msi.sh b/contrib/msi/build-msi.sh
index 888075c..38b9b81 100644
--- a/contrib/msi/build-msi.sh
+++ b/contrib/msi/build-msi.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
 # This script generates an MSI file for Yggdrasil for a given architecture. It
-# needs to run on Windows within MSYS2 and Go 1.13 or later must be installed on
-# the system and within the PATH. This is ran currently by Appveyor (see
-# appveyor.yml in the repository root) for both x86 and x64.
+# needs to run on Windows within MSYS2 and Go 1.17 or later must be installed on
+# the system and within the PATH. This is ran currently by GitHub Actions (see
+# the workflows in the repository).
 #
 # Author: Neil Alexander <neilalexander@users.noreply.github.com>
 
@@ -11,37 +11,21 @@
 PKGARCH=$1
 if [ "${PKGARCH}" == "" ];
 then
-  echo "tell me the architecture: x86, x64 or arm"
+  echo "tell me the architecture: x86, x64, arm or arm64"
   exit 1
 fi
 
-# Get the rest of the repository history. This is needed within Appveyor because
-# otherwise we don't get all of the branch histories and therefore the semver
-# scripts don't work properly.
-if [ "${APPVEYOR_PULL_REQUEST_HEAD_REPO_BRANCH}" != "" ];
-then
-  git fetch --all
-#  git checkout ${APPVEYOR_PULL_REQUEST_HEAD_REPO_BRANCH}
-elif [ "${APPVEYOR_REPO_BRANCH}" != "" ];
-then
-  git fetch --all
-  git checkout ${APPVEYOR_REPO_BRANCH}
-fi
-
-# Install prerequisites within MSYS2
-pacman -S --needed --noconfirm unzip git curl
-
 # Download the wix tools!
 if [ ! -d wixbin ];
 then
-  curl -LO https://github.com/wixtoolset/wix3/releases/download/wix3112rtm/wix311-binaries.zip
-  if [ `md5sum wix311-binaries.zip | cut -f 1 -d " "` != "47a506f8ab6666ee3cc502fb07d0ee2a" ];
+  curl -LO https://wixtoolset.org/downloads/v3.14.0.3910/wix314-binaries.zip
+  if [ `md5sum wix314-binaries.zip | cut -f 1 -d " "` != "34f655cf108086838dd5a76d4318063b" ];
   then
     echo "wix package didn't match expected checksum"
     exit 1
   fi
   mkdir -p wixbin
-  unzip -o wix311-binaries.zip -d wixbin || (
+  unzip -o wix314-binaries.zip -d wixbin || (
     echo "failed to unzip WiX"
     exit 1
   )
@@ -51,7 +35,7 @@ fi
 [ "${PKGARCH}" == "x64" ] && GOOS=windows GOARCH=amd64 CGO_ENABLED=0 ./build
 [ "${PKGARCH}" == "x86" ] && GOOS=windows GOARCH=386 CGO_ENABLED=0 ./build
 [ "${PKGARCH}" == "arm" ] && GOOS=windows GOARCH=arm CGO_ENABLED=0 ./build
-#[ "${PKGARCH}" == "arm64" ] && GOOS=windows GOARCH=arm64 CGO_ENABLED=0 ./build
+[ "${PKGARCH}" == "arm64" ] && GOOS=windows GOARCH=arm64 CGO_ENABLED=0 ./build
 
 # Create the postinstall script
 cat > updateconfig.bat << EOF
@@ -69,7 +53,7 @@ EOF
 PKGNAME=$(sh contrib/semver/name.sh)
 PKGVERSION=$(sh contrib/msi/msversion.sh --bare)
 PKGVERSIONMS=$(echo $PKGVERSION | tr - .)
-[ "${PKGARCH}" == "x64" ] && \
+([ "${PKGARCH}" == "x64" ] || [ "${PKGARCH}" == "arm64" ]) && \
   PKGGUID="77757838-1a23-40a5-a720-c3b43e0260cc" PKGINSTFOLDER="ProgramFiles64Folder" || \
   PKGGUID="54a3294e-a441-4322-aefb-3bb40dd022bb" PKGINSTFOLDER="ProgramFilesFolder"
 
@@ -85,8 +69,8 @@ elif [ $PKGARCH = "x86" ]; then
   PKGWINTUNDLL=wintun/bin/x86/wintun.dll
 elif [ $PKGARCH = "arm" ]; then
   PKGWINTUNDLL=wintun/bin/arm/wintun.dll
-#elif [ $PKGARCH = "arm64" ]; then
-#  PKGWINTUNDLL=wintun/bin/arm64/wintun.dll
+elif [ $PKGARCH = "arm64" ]; then
+  PKGWINTUNDLL=wintun/bin/arm64/wintun.dll
 else
   echo "wasn't sure which architecture to get wintun for"
   exit 1
diff --git a/contrib/semver/name.sh b/contrib/semver/name.sh
index 53f56d5..6294f89 100644
--- a/contrib/semver/name.sh
+++ b/contrib/semver/name.sh
@@ -1,13 +1,12 @@
 #!/bin/sh
 
 # Get the current branch name
-BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null)
+BRANCH="$GITHUB_REF_NAME"
+if [ -z "$BRANCH" ]; then
+  BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null)
+fi
 
-if [ -n "$APPVEYOR_PULL_REQUEST_NUMBER" ]; then
-  printf "yggdrasil-pr%s" "$APPVEYOR_PULL_REQUEST_NUMBER"
-  exit 0
-# Complain if the git history is not available
-elif [ $? != 0 ] || [ -z "$BRANCH" ]; then
+if [ $? != 0 ] || [ -z "$BRANCH" ]; then
   printf "yggdrasil"
   exit 0
 fi

From d2308f8d3a42a123daed4ac1e147b0076f685684 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:25:05 +0100
Subject: [PATCH 08/21] Remove Appveyor and CircleCI configs

---
 .circleci/config.yml | 234 -------------------------------------------
 appveyor.yml         |  23 -----
 2 files changed, 257 deletions(-)
 delete mode 100644 .circleci/config.yml
 delete mode 100644 appveyor.yml

diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 065f2b0..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,234 +0,0 @@
-# Golang CircleCI 2.0 configuration file
-#
-# Check https://circleci.com/docs/2.0/language-go/ for more details
-version: 2.1
-jobs:
-  lint:
-    docker:
-      - image: circleci/golang:1.17
-
-    steps:
-      - checkout
-
-      - run:
-          name: Run golangci-lint
-          command: |
-              go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.31.0
-              golangci-lint run
-
-      - run:
-          name: Run Go tests
-          command: |
-              go test ./...
-
-  build-linux:
-    docker:
-      - image: circleci/golang:1.17
-
-    steps:
-      - checkout
-
-      - run:
-          name: Create artifact upload directory and set variables
-          command: |
-              mkdir /tmp/upload
-              echo 'export CINAME=$(sh contrib/semver/name.sh)' >> $BASH_ENV
-              echo 'export CIVERSION=$(sh contrib/semver/version.sh --bare)' >> $BASH_ENV
-              echo 'export CIVERSIONRPM=$(sh contrib/semver/version.sh --bare | tr "-" ".")' >> $BASH_ENV
-              echo 'export CIBRANCH=$(echo $CIRCLE_BRANCH | tr -d "/")' >> $BASH_ENV
-              case "$CINAME" in \
-                "yggdrasil") (echo 'export CICONFLICTS=yggdrasil-develop' >> $BASH_ENV) ;; \
-                "yggdrasil-develop") (echo 'export CICONFLICTS=yggdrasil' >> $BASH_ENV) ;; \
-                *) (echo 'export CICONFLICTS="yggdrasil yggdrasil-develop"' >> $BASH_ENV) ;; \
-              esac
-              git config --global user.email "$(git log --format='%ae' HEAD -1)";
-              git config --global user.name "$(git log --format='%an' HEAD -1)";
-
-      - run:
-          name: Install RPM utilities
-          command: |
-              sudo apt-get update
-              sudo apt-get install -y rpm file
-              mkdir -p ~/rpmbuild/BUILD ~/rpmbuild/RPMS ~/rpmbuild/SOURCES ~/rpmbuild/SPECS ~/rpmbuild/SRPMS
-
-      - run:
-          name: Test debug builds
-          command: |
-              ./build -d
-              test -f yggdrasil && test -f yggdrasilctl
-
-      - run:
-          name: Build for Linux (including Debian packages)
-          command: |
-              rm -f {yggdrasil,yggdrasilctl}
-              PKGARCH=amd64 sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-amd64 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-amd64;
-              PKGARCH=i386 sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-i386 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-i386;
-              PKGARCH=mipsel sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-mipsel && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-mipsel;
-              PKGARCH=mips sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-mips && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-mips;
-              PKGARCH=armhf sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-armhf && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-armhf;
-              PKGARCH=armel sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-armel && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-armel;
-              PKGARCH=arm64 sh contrib/deb/generate.sh && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-linux-arm64 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-linux-arm64;
-              mv *.deb /tmp/upload/
-
-      - run:
-          name: Build for Linux (RPM packages)
-          command: |
-              git clone https://github.com/yggdrasil-network/yggdrasil-package-rpm ~/rpmbuild/SPECS
-              cd ../ && tar -czvf ~/rpmbuild/SOURCES/v$CIVERSIONRPM --transform "s/project/yggdrasil-go-$CIBRANCH-$CIVERSIONRPM/" project
-              sed -i "s/yggdrasil-go/yggdrasil-go-$CIBRANCH/" ~/rpmbuild/SPECS/yggdrasil.spec
-              sed -i "s/^PKGNAME=yggdrasil/PKGNAME=yggdrasil-$CIBRANCH/" ~/rpmbuild/SPECS/yggdrasil.spec
-              sed -i "s/^Name\:.*/Name\:           $CINAME/" ~/rpmbuild/SPECS/yggdrasil.spec
-              sed -i "s/^Version\:.*/Version\:        $CIVERSIONRPM/" ~/rpmbuild/SPECS/yggdrasil.spec
-              sed -i "s/^Conflicts\:.*/Conflicts\:      $CICONFLICTS/" ~/rpmbuild/SPECS/yggdrasil.spec
-              cat ~/rpmbuild/SPECS/yggdrasil.spec
-              GOARCH=amd64 rpmbuild -v --nodeps --target=x86_64 -ba ~/rpmbuild/SPECS/yggdrasil.spec
-              #GOARCH=386 rpmbuild -v --nodeps --target=i386 -bb ~/rpmbuild/SPECS/yggdrasil.spec
-              find ~/rpmbuild/RPMS/ -name '*.rpm' -exec mv {} /tmp/upload \;
-              find ~/rpmbuild/SRPMS/ -name '*.rpm' -exec mv {} /tmp/upload \;
-
-      - run:
-          name: Build for EdgeRouter and VyOS
-          command: |
-              rm -f {yggdrasil,yggdrasilctl}
-              git clone https://github.com/neilalexander/vyatta-yggdrasil /tmp/vyatta-yggdrasil;
-              cd /tmp/vyatta-yggdrasil;
-              BUILDDIR_YGG=$CIRCLE_WORKING_DIRECTORY ./build-edgerouter-x $CIRCLE_BRANCH;
-              BUILDDIR_YGG=$CIRCLE_WORKING_DIRECTORY ./build-edgerouter-lite $CIRCLE_BRANCH;
-              BUILDDIR_YGG=$CIRCLE_WORKING_DIRECTORY ./build-vyos-i386 $CIRCLE_BRANCH
-              BUILDDIR_YGG=$CIRCLE_WORKING_DIRECTORY ./build-vyos-amd64 $CIRCLE_BRANCH
-              mv *.deb /tmp/upload;
-
-      - persist_to_workspace:
-          root: /tmp
-          paths:
-            - upload
-
-  build-macos:
-    macos:
-      xcode: "13.0.0"
-
-    working_directory: ~/go/src/github.com/yggdrasil-network/yggdrasil-go
-
-    steps:
-      - checkout
-
-      - run:
-          name: Create artifact upload directory and set variables
-          command: |
-              mkdir /tmp/upload
-              echo 'export CINAME=$(sh contrib/semver/name.sh)' >> $BASH_ENV
-              echo 'export CIVERSION=$(sh contrib/semver/version.sh --bare)' >> $BASH_ENV
-              echo 'export PATH=$PATH:/usr/local/go/bin:~/go/bin' >> $BASH_ENV
-              git config --global user.email "$(git log --format='%ae' HEAD -1)";
-              git config --global user.name "$(git log --format='%an' HEAD -1)";
-              echo -e "Host *\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
-
-      - run:
-          name: Install Go 1.17
-          command: |
-              cd /tmp
-              curl -LO https://dl.google.com/go/go1.17.darwin-amd64.pkg
-              sudo installer -pkg /tmp/go1.17.darwin-amd64.pkg -target /
-
-      #- run:
-      #    name: Install Gomobile
-      #    command: |
-      #        GO111MODULE=off go get golang.org/x/mobile/cmd/gomobile
-      #        gomobile init
-
-      - run:
-          name: Build for macOS
-          command: |
-              GO111MODULE=on GOOS=darwin GOARCH=amd64 ./build
-              cp yggdrasil /tmp/upload/$CINAME-$CIVERSION-darwin-amd64
-              cp yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-darwin-amd64;
-              GO111MODULE=on GOOS=darwin GOARCH=arm64 ./build
-              cp yggdrasil /tmp/upload/$CINAME-$CIVERSION-darwin-arm64
-              cp yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-darwin-arm64;
-
-      - run:
-          name: Build for macOS (.pkg format)
-          command: |
-              PKGARCH=amd64 sh contrib/macos/create-pkg.sh
-              PKGARCH=arm64 sh contrib/macos/create-pkg.sh
-              mv *.pkg /tmp/upload/
-
-      #- run:
-      #    name: Build framework for iOS (.framework format)
-      #    command: |
-      #        sudo GO111MODULE=off go get -v github.com/yggdrasil-network/yggdrasil-go/cmd/...
-      #        sudo GO111MODULE=off go get -v github.com/yggdrasil-network/yggdrasil-go/src/...
-      #        GO111MODULE=off ./build -i
-      #        mv *.framework /tmp/upload
-
-      - persist_to_workspace:
-          root: /tmp
-          paths:
-            - upload
-
-  build-other:
-    docker:
-      - image: circleci/golang:1.17
-
-    steps:
-      - checkout
-
-      - run:
-          name: Create artifact upload directory and set variables
-          command: |
-              mkdir /tmp/upload
-              echo 'export CINAME=$(sh contrib/semver/name.sh)' >> $BASH_ENV
-              echo 'export CIVERSION=$(sh contrib/semver/version.sh --bare)' >> $BASH_ENV
-              git config --global user.email "$(git log --format='%ae' HEAD -1)";
-              git config --global user.name "$(git log --format='%an' HEAD -1)";
-
-      - run:
-          name: Build for OpenBSD
-          command: |
-              rm -f {yggdrasil,yggdrasilctl}
-              GOOS=openbsd GOARCH=amd64 ./build && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-openbsd-amd64 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-openbsd-amd64;
-              GOOS=openbsd GOARCH=386 ./build && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-openbsd-i386 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-openbsd-i386;
-
-      - run:
-          name: Build for FreeBSD
-          command: |
-              rm -f {yggdrasil,yggdrasilctl}
-              GOOS=freebsd GOARCH=amd64 ./build && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-freebsd-amd64 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-freebsd-amd64;
-              GOOS=freebsd GOARCH=386 ./build && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-freebsd-i386 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-freebsd-i386;
-
-      - run:
-          name: Build for Windows
-          command: |
-              rm -f {yggdrasil,yggdrasilctl}
-              GOOS=windows GOARCH=amd64 ./build && mv yggdrasil.exe /tmp/upload/$CINAME-$CIVERSION-windows-amd64.exe && mv yggdrasilctl.exe /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-windows-amd64.exe;
-              GOOS=windows GOARCH=386 ./build && mv yggdrasil.exe /tmp/upload/$CINAME-$CIVERSION-windows-i386.exe && mv yggdrasilctl.exe /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-windows-i386.exe;
-
-      - persist_to_workspace:
-          root: /tmp
-          paths:
-            - upload
-
-  upload:
-    machine: true
-
-    steps:
-      - attach_workspace:
-          at: /tmp
-
-      - store_artifacts:
-          path: /tmp/upload
-          destination: /
-
-workflows:
-  version: 2.1
-  build:
-    jobs:
-      - lint
-      - build-linux
-      - build-macos
-      - build-other
-      - upload:
-          requires:
-            - build-linux
-            - build-macos
-            - build-other
diff --git a/appveyor.yml b/appveyor.yml
deleted file mode 100644
index 27ff7fb..0000000
--- a/appveyor.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-version: '{build}'
-pull_requests:
-  do_not_increment_build_number: true
-os: Visual Studio 2019
-shallow_clone: false
-
-environment:
-  MSYS2_PATH_TYPE: inherit
-  CHERE_INVOKING: enabled_from_arguments
-
-build_script:
-- cmd: cd %APPVEYOR_BUILD_FOLDER%
-- curl -o C:\projects\golang.zip https://dl.google.com/go/go1.17.5.windows-amd64.zip
-- 7z x C:\projects\golang.zip -oC:\projects\
-- cmd: set PATH=C:\projects\go\bin;%PATH%
-- cmd: set GOROOT=C:\projects\go
-- c:\msys64\usr\bin\bash -lc "./contrib/msi/build-msi.sh x64"
-- c:\msys64\usr\bin\bash -lc "./contrib/msi/build-msi.sh x86"
-
-test: off
-
-artifacts:
-- path: '*.msi'

From e9caf989b84522be85fac176a61a901a724f3e77 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:27:43 +0100
Subject: [PATCH 09/21] Enable CodeQL

---
 .github/workflows/codeql.yml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..0e94b04
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,36 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ develop, future, master ]
+  pull_request:
+    branches: [ develop, master ]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

From 55f7874b357cbe0f591d1b14be4b6102ca6c1406 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:30:40 +0100
Subject: [PATCH 10/21] Limit concurrency of CI runs

---
 .github/workflows/ci.yml     |  4 ++++
 .github/workflows/codeql.yml | 30 +++++++++++++++++-------------
 2 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a884d76..0ce6655 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
   release:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     name: Lint
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0e94b04..14cbec4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,9 +2,13 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ develop, future, master ]
+    branches: [develop, future, master]
   pull_request:
-    branches: [ develop, master ]
+    branches: [develop, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   analyze:
@@ -18,19 +22,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'go' ]
+        language: ["go"]
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
+      - name: Checkout repository
+        uses: actions/checkout@v3
 
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
 
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

From c3de1542b075b4f65dee147f701addb00a07a4ab Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:33:33 +0100
Subject: [PATCH 11/21] Move CodeQL into main CI workflow

---
 .github/workflows/ci.yml     | 30 ++++++++++++++++++++++++++-
 .github/workflows/codeql.yml | 40 ------------------------------------
 2 files changed, 29 insertions(+), 41 deletions(-)
 delete mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ce6655..6bb7c7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,34 @@ jobs:
         with:
           args: --issues-exit-code=1
 
+  codeql:
+    name: Analyse
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["go"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+
   build-linux:
     strategy:
       fail-fast: false
@@ -98,7 +126,7 @@ jobs:
 
   tests-ok:
     name: All tests passed
-    needs: [build-linux, build-windows, build-macos]
+    needs: [lint, codeql, build-linux, build-windows, build-macos]
     runs-on: ubuntu-latest
     if: ${{ !cancelled() }}
     steps:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 14cbec4..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [develop, future, master]
-  pull_request:
-    branches: [develop, master]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["go"]
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
-        with:
-          languages: ${{ matrix.language }}
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2

From b77b018c4d996ae101c98794287888f229311335 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 10:35:05 +0100
Subject: [PATCH 12/21] Modify workflow strategy

---
 .github/workflows/ci.yml | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6bb7c7f..b41e433 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,11 +32,6 @@ jobs:
       contents: read
       security-events: write
 
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["go"]
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
@@ -44,7 +39,7 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
         with:
-          languages: ${{ matrix.language }}
+          languages: go
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@v2

From 5e89ab706faa06ca45dbcbb8cd54fde44df995c2 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 15:20:45 +0100
Subject: [PATCH 13/21] Update README.md

---
 README.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 2bfb5b1..d0afae4 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,6 @@
 # Yggdrasil
 
-[![CircleCI](https://circleci.com/gh/yggdrasil-network/yggdrasil-go.svg?style=shield&circle-token=:circle-token
-)](https://circleci.com/gh/yggdrasil-network/yggdrasil-go)
+[![Build status](https://github.com/yggdrasil-network/yggdrasil-go/actions/workflows/ci.yml/badge.svg)](https://github.com/yggdrasil-network/yggdrasil-go/actions/workflows/ci.yml)
 
 ## Introduction
 

From 42d4298e197e9f4455b9ed34e9b49847cc10af63 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 15:23:52 +0100
Subject: [PATCH 14/21] Update ironwood to latest commit on `archive-ygg0.4`
 branch

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 236877c..c93b8a0 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/yggdrasil-network/yggdrasil-go
 go 1.17
 
 require (
-	github.com/Arceliar/ironwood v0.0.0-20211125050254-8951369625d0
+	github.com/Arceliar/ironwood v0.0.0-20220409035209-b7f71f05435a
 	github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979
 	github.com/cheggaaa/pb/v3 v3.0.8
 	github.com/gologme/log v1.2.0
diff --git a/go.sum b/go.sum
index 063b599..c87112f 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-github.com/Arceliar/ironwood v0.0.0-20211125050254-8951369625d0 h1:QUqcb7BOcBU2p7Nax7pESOb8hrZYtI0Ts6j4v4mvcQo=
-github.com/Arceliar/ironwood v0.0.0-20211125050254-8951369625d0/go.mod h1:RP72rucOFm5udrnEzTmIWLRVGQiV/fSUAQXJ0RST/nk=
+github.com/Arceliar/ironwood v0.0.0-20220409035209-b7f71f05435a h1:yfbnOyqPcx2gi5cFIJ2rlPz5M6rFPHT/c8FgZmFjCdc=
+github.com/Arceliar/ironwood v0.0.0-20220409035209-b7f71f05435a/go.mod h1:RP72rucOFm5udrnEzTmIWLRVGQiV/fSUAQXJ0RST/nk=
 github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979 h1:WndgpSW13S32VLQ3ugUxx2EnnWmgba1kCqPkd4Gk1yQ=
 github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979/go.mod h1:6Lkn+/zJilRMsKmbmG1RPoamiArC6HS73xbwRyp3UyI=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=

From e13657d2cad33cec5a58a6ebb9d31c407b5047a0 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 15:27:47 +0100
Subject: [PATCH 15/21] Version 0.4.4 changelog

---
 CHANGELOG.md | 193 +++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 158 insertions(+), 35 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9c7e47..498d833 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,5 @@
 # Changelog
+
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
@@ -25,89 +26,114 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - in case of vulnerabilities.
 -->
 
+## [0.4.4] - 2022-04-18
+
+### Fixed
+
+- ICMPv6 "Packet Too Big" payload size has been increased, which should fix Path MTU Discovery (PMTUD) when two nodes have different `IfMTU` values configured
+
+### Changed
+
+- Go 1.17 is now required
+
 ## [0.4.3] - 2022-02-06
+
 ### Added
+
 - `bytes_sent`, `bytes_recvd` and `uptime` have been added to `getPeers`
 - Clearer logging when connections are rejected due to incompatible peer versions
 
 ### Fixed
+
 - Latency-based parent selection tiebreak is now reliable on platforms even with low timer resolution
 - Tree distance calculation offsets have been corrected
 
 ## [0.4.2] - 2021-11-03
+
 ### Fixed
+
 - Reverted a dependency update which resulted in problems building with Go 1.16 and running on Windows
 
 ## [0.4.1] - 2021-11-03
+
 ### Added
+
 - TLS peerings now support Server Name Indication (SNI)
-    - The SNI is sent automatically if the peering URI contains a DNS name
-    - A custom SNI can be specified by adding the `?sni=domain.com` parameter to the peering URI
+  - The SNI is sent automatically if the peering URI contains a DNS name
+  - A custom SNI can be specified by adding the `?sni=domain.com` parameter to the peering URI
 - A new `ipv6rwc` API package now implements the IPv6-specific logic separate from the `tun` package
 
 ### Fixed
+
 - A crash when calculating the partial public key for very high IPv6 addresses has been fixed
 - A crash due to a concurrent map write has been fixed
 - A crash due to missing TUN configuration has been fixed
 - A race condition in the keystore code has been fixed
 
 ## [0.4.0] - 2021-07-04
+
 ### Added
+
 - New routing scheme, which is backwards incompatible with previous versions of Yggdrasil
-    - The wire protocol version number, exchanged as part of the peer setup handshake, has been increased to 0.4
-    - Nodes running this new version **will not** be able to peer with earlier versions of Yggdrasil
-    - Please note that **the network may be temporarily unstable** while infrastructure is being upgraded to the new release
+  - The wire protocol version number, exchanged as part of the peer setup handshake, has been increased to 0.4
+  - Nodes running this new version **will not** be able to peer with earlier versions of Yggdrasil
+  - Please note that **the network may be temporarily unstable** while infrastructure is being upgraded to the new release
 - TLS connections now use public key pinning
-    - If no public key was already pinned, then the public key received as part of the TLS handshake is pinned to the connection
-    - The public key received as part of the handshake is checked against the pinned keys, and if no match is found, the connection is rejected
+  - If no public key was already pinned, then the public key received as part of the TLS handshake is pinned to the connection
+  - The public key received as part of the handshake is checked against the pinned keys, and if no match is found, the connection is rejected
 
 ### Changed
+
 - IP addresses are now derived from ed25519 public (signing) keys
-    - Previously, addresses were derived from a hash of X25519 (Diffie-Hellman) keys
-    - Importantly, this means that **all internal IPv6 addresses will change with this release** — this will affect anyone running public services or relying on Yggdrasil for remote access
+  - Previously, addresses were derived from a hash of X25519 (Diffie-Hellman) keys
+  - Importantly, this means that **all internal IPv6 addresses will change with this release** — this will affect anyone running public services or relying on Yggdrasil for remote access
 - It is now recommended to peer over TLS
-    - Link-local peers from multicast peer discovery will now connect over TLS, with the key from the multicast beacon pinned to the connection
-    - `socks://` peers now expect the destination endpoint to be a `tls://` listener, instead of a `tcp://` listener
+  - Link-local peers from multicast peer discovery will now connect over TLS, with the key from the multicast beacon pinned to the connection
+  - `socks://` peers now expect the destination endpoint to be a `tls://` listener, instead of a `tcp://` listener
 - Multicast peer discovery is now more configurable
-    - There are separate configuration options to control if beacons are sent, what port to listen on for incoming connections (if sending beacons), and whether or not to listen for beacons from other nodes (and open connections when receiving a beacon)
-    - Each configuration entry in the list specifies a regular expression to match against interface names
-    - If an interface matches multiple regex in the list, it will use the settings for the first entry in the list that it matches with
+  - There are separate configuration options to control if beacons are sent, what port to listen on for incoming connections (if sending beacons), and whether or not to listen for beacons from other nodes (and open connections when receiving a beacon)
+  - Each configuration entry in the list specifies a regular expression to match against interface names
+  - If an interface matches multiple regex in the list, it will use the settings for the first entry in the list that it matches with
 - The session and routing code has been entirely redesigned and rewritten
-    - This is still an early work-in-progress, so the code hasn't been as well tested or optimized as the old code base — please bear with us for these next few releases as we work through any bugs or issues
-    - Generally speaking, we expect to see reduced bandwidth use and improved reliability with the new design, especially in cases where nodes move around or change peerings frequently
-    - Cryptographic sessions no longer use a single shared (ephemeral) secret for the entire life of the session. Keys are now rotated regularly for ongoing sessions (currently rotated at least once per round trip exchange of traffic, subject to change in future releases)
-    - Source routing has been added. Under normal circumstances, this is what is used to forward session traffic (e.g. the user's IPv6 traffic)
-    - DHT-based routing has been added. This is used when the sender does not know a source route to the destination. Forwarding through the DHT is less efficient, but the only information that it requires the sender to know is the destination node's (static) key. This is primarily used during the key exchange at session setup, or as a temporary fallback when a source route fails due to changes in the network
-    - The new DHT design is no longer RPC-based, does not support crawling and does not inherently allow nodes to look up the owner of an arbitrary key. Responding to lookups is now implemented at the application level and a response is only sent if the destination key matches the node's `/128` IP or `/64` prefix
-    - The greedy routing scheme, used to forward all traffic in previous releases, is now only used for protocol traffic (i.e. DHT setup and source route discovery)
-    - The routing logic now lives in a [standalone library](https://github.com/Arceliar/ironwood). You are encouraged **not** to use it, as it's still considered pre-alpha, but it's available for those who want to experiment with the new routing algorithm in other contexts
-    - Session MTUs may be slightly lower now, in order to accommodate large packet headers if required
+  - This is still an early work-in-progress, so the code hasn't been as well tested or optimized as the old code base — please bear with us for these next few releases as we work through any bugs or issues
+  - Generally speaking, we expect to see reduced bandwidth use and improved reliability with the new design, especially in cases where nodes move around or change peerings frequently
+  - Cryptographic sessions no longer use a single shared (ephemeral) secret for the entire life of the session. Keys are now rotated regularly for ongoing sessions (currently rotated at least once per round trip exchange of traffic, subject to change in future releases)
+  - Source routing has been added. Under normal circumstances, this is what is used to forward session traffic (e.g. the user's IPv6 traffic)
+  - DHT-based routing has been added. This is used when the sender does not know a source route to the destination. Forwarding through the DHT is less efficient, but the only information that it requires the sender to know is the destination node's (static) key. This is primarily used during the key exchange at session setup, or as a temporary fallback when a source route fails due to changes in the network
+  - The new DHT design is no longer RPC-based, does not support crawling and does not inherently allow nodes to look up the owner of an arbitrary key. Responding to lookups is now implemented at the application level and a response is only sent if the destination key matches the node's `/128` IP or `/64` prefix
+  - The greedy routing scheme, used to forward all traffic in previous releases, is now only used for protocol traffic (i.e. DHT setup and source route discovery)
+  - The routing logic now lives in a [standalone library](https://github.com/Arceliar/ironwood). You are encouraged **not** to use it, as it's still considered pre-alpha, but it's available for those who want to experiment with the new routing algorithm in other contexts
+  - Session MTUs may be slightly lower now, in order to accommodate large packet headers if required
 - Many of the admin functions available over `yggdrasilctl` have been changed or removed as part of rewrites to the code
-    - Several remote `debug` functions have been added temporarily, to allow for crawling and census gathering during the transition to the new version, but we intend to remove this at some point in the (possibly distant) future
-    - The list of available functions will likely be expanded in future releases
+  - Several remote `debug` functions have been added temporarily, to allow for crawling and census gathering during the transition to the new version, but we intend to remove this at some point in the (possibly distant) future
+  - The list of available functions will likely be expanded in future releases
 - The configuration file format has been updated in response to the changed/removed features
 
 ### Removed
+
 - Tunnel routing (a.k.a. crypto-key routing or "CKR") has been removed
-    - It was far too easy to accidentally break routing altogether by capturing the route to peers with the TUN adapter
-    - We recommend tunnelling an existing standard over Yggdrasil instead (e.g. `ip6gre`, `ip6gretap` or other similar encapsulations, using Yggdrasil IPv6 addresses as the tunnel endpoints)
-    - All `TunnelRouting` configuration options will no longer take effect
+  - It was far too easy to accidentally break routing altogether by capturing the route to peers with the TUN adapter
+  - We recommend tunnelling an existing standard over Yggdrasil instead (e.g. `ip6gre`, `ip6gretap` or other similar encapsulations, using Yggdrasil IPv6 addresses as the tunnel endpoints)
+  - All `TunnelRouting` configuration options will no longer take effect
 - Session firewall has been removed
-    - This was never a true firewall — it didn't behave like a stateful IP firewall, often allowed return traffic unexpectedly and was simply a way to prevent a node from being flooded with unwanted sessions, so the name could be misleading and usually lead to a false sense of security
-    - Due to design changes, the new code needs to address the possible memory exhaustion attacks in other ways and a single configurable list no longer makes sense
-    - Users who want a firewall or other packet filter mechansim should configure something supported by their OS instead (e.g. `ip6tables`)
-    - All `SessionFirewall` configuration options will no longer take effect
+  - This was never a true firewall — it didn't behave like a stateful IP firewall, often allowed return traffic unexpectedly and was simply a way to prevent a node from being flooded with unwanted sessions, so the name could be misleading and usually lead to a false sense of security
+  - Due to design changes, the new code needs to address the possible memory exhaustion attacks in other ways and a single configurable list no longer makes sense
+  - Users who want a firewall or other packet filter mechansim should configure something supported by their OS instead (e.g. `ip6tables`)
+  - All `SessionFirewall` configuration options will no longer take effect
 - `SIGHUP` handling to reload the configuration at runtime has been removed
-    - It was not obvious which parts of the configuration could be reloaded at runtime, and which required the application to be killed and restarted to take effect
-    - Reloading the config without restarting was also a delicate and bug-prone process, and was distracting from more important developments
-    - `SIGHUP` will be handled normally (i.e. by exiting)
+  - It was not obvious which parts of the configuration could be reloaded at runtime, and which required the application to be killed and restarted to take effect
+  - Reloading the config without restarting was also a delicate and bug-prone process, and was distracting from more important developments
+  - `SIGHUP` will be handled normally (i.e. by exiting)
 - `cmd/yggrasilsim` has been removed, and is unlikely to return to this repository
 
 ## [0.3.16] - 2021-03-18
+
 ### Added
+
 - New simulation code under `cmd/yggdrasilsim` (work-in-progress)
 
 ### Changed
+
 - Multi-threading in the switch
   - Swich lookups happen independently for each (incoming) peer connection, instead of being funneled to a single dedicated switch worker
   - Packets are queued for each (outgoing) peer connection, instead of being handled by a single dedicated switch worker
@@ -123,13 +149,16 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Upgrade build to Go 1.16
 
 ### Fixed
+
 - Fixed a bug where the connection listener could exit prematurely due to resoruce exhaustion (if e.g. too many connections were opened)
 - Fixed DefaultIfName for OpenBSD (`/dev/tun0` -> `tun0`)
 - Fixed an issue where a peer could sometimes never be added to the switch
 - Fixed a goroutine leak that could occur if a peer with an open connection continued to spam additional connection attempts
 
 ## [0.3.15] - 2020-09-27
+
 ### Added
+
 - Support for pinning remote public keys in peering strings has been added, e.g.
   - By signing public key: `tcp://host:port?ed25519=key`
   - By encryption public key: `tcp://host:port?curve25519=key`
@@ -139,25 +168,32 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added support for SOCKS proxy authentication, e.g. `socks://user@password:host/...`
 
 ### Fixed
+
 - Some bugs in the multicast code that could cause unnecessary CPU usage have been fixed
 - A possible multicast deadlock on macOS when enumerating interfaces has been fixed
 - A deadlock in the connection code has been fixed
 - Updated HJSON dependency that caused some build problems
 
 ### Changed
+
 - `DisconnectPeer` and `RemovePeer` have been separated and implemented properly now
 - Less nodes are stored in the DHT now, reducing ambient network traffic and possible instability
 - Default config file for FreeBSD is now at `/usr/local/etc/yggdrasil.conf` instead of `/etc/yggdrasil.conf`
 
 ## [0.3.14] - 2020-03-28
+
 ### Fixed
+
 - Fixes a memory leak that may occur if packets are incorrectly never removed from a switch queue
 
 ### Changed
+
 - Make DHT searches a bit more reliable by tracking the 16 most recently visited nodes
 
 ## [0.3.13] - 2020-02-21
+
 ### Added
+
 - Support for the Wireguard TUN driver, which now replaces Water and provides far better support and performance on Windows
 - Windows `.msi` installer files are now supported (bundling the Wireguard TUN driver)
 - NodeInfo code is now actorised, should be more reliable
@@ -165,6 +201,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - The Yggdrasil API now supports dialing a remote node using the public key instead of the Node ID
 
 ### Changed
+
 - The `-loglevel` command line parameter is now cumulative and automatically includes all levels below the one specified
 - DHT search code has been significantly simplified and processes rumoured nodes in parallel, speeding up search time
 - DHT search results are now sorted
@@ -172,26 +209,32 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - The Yggdrasil API now returns public keys instead of node IDs when querying for local and remote addresses
 
 ### Fixed
+
 - The multicast code no longer panics when shutting down the node
 - A potential OOB error when calculating IPv4 flow labels (when tunnel routing is enabled) has been fixed
 - A bug resulting in incorrect idle notifications in the switch should now be fixed
 - MTUs are now using a common datatype throughout the codebase
 
 ### Removed
+
 - TAP mode has been removed entirely, since it is no longer supported with the Wireguard TUN package. Please note that if you are using TAP mode, you may need to revise your config!
 - NetBSD support has been removed until the Wireguard TUN package supports NetBSD
 
 ## [0.3.12] - 2019-11-24
+
 ### Added
+
 - New API functions `SetMaximumSessionMTU` and `GetMaximumSessionMTU`
 - New command line parameters `-address` and `-subnet` for getting the address/subnet from the config file, for use with `-useconffile` or `-useconf`
 - A warning is now produced in the Yggdrasil output at startup when the MTU in the config is invalid or has been adjusted for some reason
 
 ### Changed
+
 - On Linux, outgoing `InterfacePeers` connections now use `SO_BINDTODEVICE` to prefer an outgoing interface
 - The `genkeys` utility is now in `cmd` rather than `misc`
 
 ### Fixed
+
 - A data race condition has been fixed when updating session coordinates
 - A crash when shutting down when no multicast interfaces are configured has been fixed
 - A deadlock when calling `AddPeer` multiple times has been fixed
@@ -200,10 +243,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - The MTU calculation now correctly accounts for ethernet headers when running in TAP mode
 
 ## [0.3.11] - 2019-10-25
+
 ### Added
+
 - Support for TLS listeners and peers has been added, allowing the use of `tls://host:port` in `Peers`, `InterfacePeers` and `Listen` configuration settings - this allows hiding Yggdrasil peerings inside regular TLS connections
 
 ### Changed
+
 - Go 1.13 or later is now required for building Yggdrasil
 - Some exported API functions have been updated to work with standard Go interfaces:
   - `net.Conn` instead of `yggdrasil.Conn`
@@ -213,27 +259,35 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Multicast module reloading behaviour has been improved
 
 ### Fixed
+
 - An incorrectly held mutex in the crypto-key routing code has been fixed
 - Multicast module no longer opens a listener socket if no multicast interfaces are configured
 
 ## [0.3.10] - 2019-10-10
+
 ### Added
+
 - The core library now includes several unit tests for peering and `yggdrasil.Conn` connections
 
 ### Changed
+
 - On recent Linux kernels, Yggdrasil will now set the `tcp_congestion_control` algorithm used for its own TCP sockets to [BBR](https://github.com/google/bbr), which reduces latency under load
 - The systemd service configuration in `contrib` (and, by extension, some of our packages) now attempts to load the `tun` module, in case TUN/TAP support is available but not loaded, and it restricts Yggdrasil to the `CAP_NET_ADMIN` capability for managing the TUN/TAP adapter, rather than letting it do whatever the (typically `root`) user can do
 
 ### Fixed
+
 - The `yggdrasil.Conn.RemoteAddr()` function no longer blocks, fixing a deadlock when CKR is used while under heavy load
 
 ## [0.3.9] - 2019-09-27
+
 ### Added
+
 - Yggdrasil will now complain more verbosely when a peer URI is incorrectly formatted
 - Soft-shutdown methods have been added, allowing a node to shut down gracefully when terminated
 - New multicast interval logic which sends multicast beacons more often when Yggdrasil is first started to increase the chance of finding nearby nodes quickly after startup
 
 ### Changed
+
 - The switch now buffers packets more eagerly in an attempt to give the best link a chance to send, which appears to reduce packet reordering when crossing aggregate sets of peerings
 - Substantial amounts of the codebase have been refactored to use the actor model, which should substantially reduce the chance of deadlocks
 - Nonce tracking in sessions has been modified so that memory usage is reduced whilst still only allowing duplicate packets within a small window
@@ -242,6 +296,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - The maximum queue size is now managed exclusively by the switch rather than by the core
 
 ### Fixed
+
 - The broken `hjson-go` dependency which affected builds of the previous version has now been resolved in the module manifest
 - Some minor memory leaks in the switch have been fixed, which improves memory usage on mobile builds
 - A memory leak in the add-peer loop has been fixed
@@ -253,10 +308,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - A panic which could occur when the TUN/TAP interface reads an undersized/corrupted packet has been fixed
 
 ### Removed
+
 - A number of legacy debug functions have now been removed and a number of exported API functions are now better documented
 
 ## [0.3.8] - 2019-08-21
+
 ### Changed
+
 - Yggdrasil can now send multiple packets from the switch at once, which results in improved throughput with smaller packets or lower MTUs
 - Performance has been slightly improved by not allocating cancellations where not necessary
 - Crypto-key routing options have been renamed for clarity
@@ -269,20 +327,25 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - New nonce tracking should help to reduce the number of packets dropped as a result of multiple/aggregate paths or congestion control in the switch
 
 ### Fixed
+
 - A deadlock was fixed in the session code which could result in Yggdrasil failing to pass traffic after some time
 
 ### Security
+
 - Address verification was not strict enough, which could result in a malicious session sending traffic with unexpected or spoofed source or destination addresses which Yggdrasil could fail to reject
   - Versions `0.3.6` and `0.3.7` are vulnerable - users of these versions should upgrade as soon as possible
   - Versions `0.3.5` and earlier are not affected
 
 ## [0.3.7] - 2019-08-14
+
 ### Changed
+
 - The switch should now forward packets along a single path more consistently in cases where congestion is low and multiple equal-length paths exist, which should improve stability and result in fewer out-of-order packets
 - Sessions should now be more tolerant of out-of-order packets, by replacing a bitmask with a variable sized heap+map structure to track recently received nonces, which should reduce the number of packets dropped due to reordering when multiple paths are used or multiple independent flows are transmitted through the same session
 - The admin socket can no longer return a dotfile representation of the known parts of the network, this could be rebuilt by clients using information from `getSwitchPeers`,`getDHT` and `getSessions`
 
 ### Fixed
+
 - A number of significant performance regressions introduced in version 0.3.6 have been fixed, resulting in better performance
 - Flow labels are now used to prioritise traffic flows again correctly
 - In low-traffic scenarios where there are multiple peerings between a pair of nodes, Yggdrasil now prefers the most active peering instead of the least active, helping to reduce packet reordering
@@ -296,13 +359,16 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - A number of minor allocation and pointer fixes
 
 ## [0.3.6] - 2019-08-03
+
 ### Added
+
 - Yggdrasil now has a public API with interfaces such as `yggdrasil.ConnDialer`, `yggdrasil.ConnListener` and `yggdrasil.Conn` for using Yggdrasil as a transport directly within applications
 - Session gatekeeper functions, part of the API, which can be used to control whether to allow or reject incoming or outgoing sessions dynamically (compared to the previous fixed whitelist/blacklist approach)
 - Support for logging to files or syslog (where supported)
 - Platform defaults now include the ability to set sane defaults for multicast interfaces
 
 ### Changed
+
 - Following a massive refactoring exercise, Yggdrasil's codebase has now been broken out into modules
 - Core node functionality in the `yggdrasil` package with a public API
   - This allows Yggdrasil to be integrated directly into other applications and used as a transport
@@ -315,6 +381,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Upstream dependency references have been updated, which includes a number of fixes in the Water library
 
 ### Fixed
+
 - Multicast discovery is no longer disabled if the nominated interfaces aren't available on the system yet, e.g. during boot
 - Multicast interfaces are now re-evaluated more frequently so that Yggdrasil doesn't need to be restarted to use interfaces that have become available since startup
 - Admin socket error cases are now handled better
@@ -329,12 +396,16 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Lots of small bug tweaks and clean-ups throughout the codebase
 
 ## [0.3.5] - 2019-03-13
+
 ### Fixed
+
 - The `AllowedEncryptionPublicKeys` option has now been fixed to handle incoming connections properly and no longer blocks outgoing connections (this was broken in v0.3.4)
 - Multicast TCP listeners will now be stopped correctly when the link-local address on the interface changes or disappears altogether
 
 ## [0.3.4] - 2019-03-12
+
 ### Added
+
 - Support for multiple listeners (although currently only TCP listeners are supported)
 - New multicast behaviour where each multicast interface is given its own link-local listener and does not depend on the `Listen` configuration
 - Blocking detection in the switch to avoid parenting a blocked peer
@@ -345,6 +416,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added `LinkLocalTCPPort` option for controlling the port number that link-local TCP listeners will listen on by default when setting up `MulticastInterfaces` (a node restart is currently required for changes to `LinkLocalTCPPort` to take effect - it cannot be updated by reloading config during runtime)
 
 ### Changed
+
 - The `Listen` configuration statement is now an array instead of a string
 - The `Listen` configuration statement should now conform to the same formatting as peers with the protocol prefix, e.g. `tcp://[::]:0`
 - Session workers are now non-blocking
@@ -353,6 +425,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Peer forwarding is now prioritised instead of randomised
 
 ### Fixed
+
 - Admin socket `getTunTap` call now returns properly instead of claiming no interface is enabled in all cases
 - Handling of `getRoutes` etc in `yggdrasilctl` is now working
 - Local interface names are no longer leaked in multicast packets
@@ -360,7 +433,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Yggdrasil now correctly responds to multicast interfaces going up and down during runtime
 
 ## [0.3.3] - 2019-02-18
+
 ### Added
+
 - Dynamic reconfiguration, which allows reloading the configuration file to make changes during runtime by sending a `SIGHUP` signal (note: this only works with `-useconffile` and not `-useconf` and currently reconfiguring TUN/TAP is not supported)
 - Support for building Yggdrasil as an iOS or Android framework if the appropriate tools (e.g. `gomobile`/`gobind` + SDKs) are available
 - Connection contexts used for TCP connections which allow more exotic socket options to be set, e.g.
@@ -369,26 +444,33 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Flexible logging support, which allows for logging at different levels of verbosity
 
 ### Changed
+
 - Switch changes to improve parent selection
 - Node configuration is now stored centrally, rather than having fragments/copies distributed at startup time
 - Significant refactoring in various areas, including for link types (TCP, AWDL etc), generic streams and adapters
 - macOS builds through CircleCI are now 64-bit only
 
 ### Fixed
+
 - Simplified `systemd` service now in `contrib`
 
 ### Removed
+
 - `ReadTimeout` option is now deprecated
 
 ## [0.3.2] - 2018-12-26
+
 ### Added
+
 - The admin socket is now multithreaded, greatly improving performance of the crawler and allowing concurrent lookups to take place
 - The ability to hide NodeInfo defaults through either setting the `NodeInfoPrivacy` option or through setting individual `NodeInfo` attributes to `null`
 
 ### Changed
+
 - The `armhf` build now targets ARMv6 instead of ARMv7, adding support for Raspberry Pi Zero and other older models, amongst others
 
 ### Fixed
+
 - DHT entries are now populated using a copy in memory to fix various potential DHT bugs
 - DHT traffic should now throttle back exponentially to reduce idle traffic
 - Adjust how nodes are inserted into the DHT which should help to reduce some incorrect DHT traffic
@@ -396,7 +478,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - In TUN mode, ICMPv6 packets are now ignored whereas they were incorrectly processed before
 
 ## [0.3.1] - 2018-12-17
+
 ### Added
+
 - Build name and version is now imprinted onto the binaries if available/specified during build
 - Ability to disable admin socket with `AdminListen: none`
 - `AF_UNIX` domain sockets for the admin socket
@@ -406,18 +490,22 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Adds flags `-c`, `-l` and `-t` to `build` script for specifying `GCFLAGS`, `LDFLAGS` or whether to keep symbol/DWARF tables
 
 ### Changed
+
 - Default `AdminListen` in newly generated config is now `unix:///var/run/yggdrasil.sock`
 - Formatting of `getRoutes` in the admin socket has been improved
 - Debian package now adds `yggdrasil` group to assist with `AF_UNIX` admin socket permissions
 - Crypto, address and other utility code refactored into separate Go packages
 
 ### Fixed
+
 - Switch peer convergence is now much faster again (previously it was taking up to a minute once the peering was established)
 - `yggdrasilctl` is now less prone to crashing when parameters are specified incorrectly
 - Panic fixed when `Peers` or `InterfacePeers` was commented out
 
 ## [0.3.0] - 2018-12-12
+
 ### Added
+
 - Crypto-key routing support for tunnelling both IPv4 and IPv6 over Yggdrasil
 - Add advanced `SwitchOptions` in configuration file for tuning the switch
 - Add `dhtPing` to the admin socket to aid in crawling the network
@@ -430,6 +518,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - `yggdrasilctl` now returns more useful logging in the event of a fatal error
 
 ### Changed
+
 - Switched to Chord DHT (instead of Kademlia, although still compatible at the protocol level)
 - The `AdminListen` option and `yggdrasilctl` now default to `unix:///var/run/yggdrasil.sock` on BSDs, macOS and Linux
 - Cleaned up some of the parameter naming in the admin socket
@@ -439,12 +528,15 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - `yggdrasilctl` now has more useful help text (with `-help` or when no arguments passed)
 
 ### Fixed
+
 - Memory leaks in the DHT fixed
 - Crash fixed where the ICMPv6 NDP goroutine would incorrectly start in TUN mode
 - Removing peers from the switch table if they stop sending switch messages but keep the TCP connection alive
 
 ## [0.2.7] - 2018-10-13
+
 ### Added
+
 - Session firewall, which makes it possible to control who can open sessions with your node
 - Add `getSwitchQueues` to admin socket
 - Add `InterfacePeers` for configuring static peerings via specific network interfaces
@@ -452,81 +544,106 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - FreeBSD service script in `contrib`
 
 ## Changed
+
 - CircleCI builds are now built with Go 1.11 instead of Go 1.9
 
 ## Fixed
+
 - Race condition in the switch table, reported by trn
 - Debug builds are now tested by CircleCI as well as platform release builds
 - Port number fixed on admin graph from unknown nodes
 
 ## [0.2.6] - 2018-07-31
+
 ### Added
+
 - Configurable TCP timeouts to assist in peering over Tor/I2P
 - Prefer IPv6 flow label when extending coordinates to sort backpressure queues
 - `arm64` builds through CircleCI
 
 ### Changed
+
 - Sort dot graph links by integer value
 
 ## [0.2.5] - 2018-07-19
+
 ### Changed
+
 - Make `yggdrasilctl` less case sensitive
 - More verbose TCP disconnect messages
 
 ### Fixed
+
 - Fixed debug builds
 - Cap maximum MTU on Linux in TAP mode
 - Process successfully-read TCP traffic before checking for / handling errors (fixes EOF behavior)
 
 ## [0.2.4] - 2018-07-08
+
 ### Added
+
 - Support for UNIX domain sockets for the admin socket using `unix:///path/to/file.sock`
 - Centralised platform-specific defaults
 
 ### Changed
+
 - Backpressure tuning, including reducing resource consumption
 
 ### Fixed
+
 - macOS local ping bug, which previously prevented you from pinging your own `utun` adapter's IPv6 address
 
 ## [0.2.3] - 2018-06-29
+
 ### Added
+
 - Begin keeping changelog (incomplete and possibly inaccurate information before this point).
 - Build RPMs in CircleCI using alien. This provides package support for Fedora, Red Hat Enterprise Linux, CentOS and other RPM-based distributions.
 
 ### Changed
+
 - Local backpressure improvements.
 - Change `box_pub_key` to `key` in admin API for simplicity.
 - Session cleanup.
 
 ## [0.2.2] - 2018-06-21
+
 ### Added
+
 - Add `yggdrasilconf` utility for testing with the `vyatta-yggdrasil` package.
 - Add a randomized retry delay after TCP disconnects, to prevent synchronization livelocks.
 
 ### Changed
+
 - Update build script to strip by default, which significantly reduces the size of the binary.
 - Add debug `-d` and UPX `-u` flags to the `build` script.
 - Start pprof in debug builds based on an environment variable (e.g. `PPROFLISTEN=localhost:6060`), instead of a flag.
 
 ### Fixed
+
 - Fix typo in big-endian BOM so that both little-endian and big-endian UTF-16 files are detected correctly.
 
 ## [0.2.1] - 2018-06-15
+
 ### Changed
+
 - The address range was moved from `fd00::/8` to `200::/7`. This range was chosen as it is marked as deprecated. The change prevents overlap with other ULA privately assigned ranges.
 
 ### Fixed
+
 - UTF-16 detection conversion for configuration files, which can particularly be a problem on Windows 10 if a configuration file is generated from within PowerShell.
 - Fixes to the Debian package control file.
 - Fixes to the launchd service for macOS.
 - Fixes to the DHT and switch.
 
 ## [0.2.0] - 2018-06-13
+
 ### Added
+
 - Exchange version information during connection setup, to prevent connections with incompatible versions.
 
 ### Changed
+
 - Wire format changes (backwards incompatible).
 - Less maintenance traffic per peer.
 - Exponential back-off for DHT maintenance traffic (less maintenance traffic for known good peers).
@@ -534,18 +651,24 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Use local queue sizes for a sort of local-only backpressure routing, instead of the removed bandwidth estimates, when deciding where to send a packet.
 
 ### Removed
+
 - UDP peering, this may be added again if/when a better implementation appears.
 - Per peer bandwidth estimation, as this has been replaced with an early local backpressure implementation.
 
 ## [0.1.0] - 2018-02-01
+
 ### Added
+
 - Adopt semantic versioning.
 
 ### Changed
+
 - Wire format changes (backwards incompatible).
 - Many other undocumented changes leading up to this release and before the next one.
 
 ## [0.0.1] - 2017-12-28
+
 ### Added
+
 - First commit.
 - Initial public release.

From 4ddebb338d6e115d6c09fffadb338869c4745b12 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Mon, 18 Apr 2022 15:29:43 +0100
Subject: [PATCH 16/21] Update changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 498d833..6c6aa50 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,7 +34,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Changed
 
-- Go 1.17 is now required
+- Go 1.17 is now required to build Yggdrasil
 
 ## [0.4.3] - 2022-02-06
 

From c19319df5e4e773d8668d5a5b4999a639c8113c0 Mon Sep 17 00:00:00 2001
From: Rubikoid <rubikoid@rubikoid.ru>
Date: Thu, 17 Mar 2022 02:43:28 +0300
Subject: [PATCH 17/21] Fix coords print

---
 cmd/yggdrasilctl/main.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/yggdrasilctl/main.go b/cmd/yggdrasilctl/main.go
index 788b4f1..180bea0 100644
--- a/cmd/yggdrasilctl/main.go
+++ b/cmd/yggdrasilctl/main.go
@@ -300,7 +300,7 @@ func handleGetSelf(res map[string]interface{}, verbose bool) {
 		if boxSigKey, ok := v.(map[string]interface{})["key"].(string); ok {
 			fmt.Println("Public key:", boxSigKey)
 		}
-		if coords, ok := v.(map[string]interface{})["coords"].(string); ok {
+		if coords, ok := v.(map[string]interface{})["coords"].([]interface{}); ok {
 			fmt.Println("Coords:", coords)
 		}
 		if verbose {

From 88a0a3e8fbdb174938f7222acc1dad41eca76df0 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Thu, 7 Jul 2022 17:03:29 +0100
Subject: [PATCH 18/21] Fix data races in `handleProto` (observed by
 @majestrate)

---
 src/core/proto.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/core/proto.go b/src/core/proto.go
index 5af59cc..3c68c0e 100644
--- a/src/core/proto.go
+++ b/src/core/proto.go
@@ -65,10 +65,16 @@ func (p *protoHandler) handleProto(from phony.Actor, key keyArray, bs []byte) {
 	case typeProtoNodeInfoResponse:
 		p.nodeinfo.handleRes(p, key, bs[1:])
 	case typeProtoDebug:
-		p._handleDebug(key, bs[1:])
+		p.handleDebug(from, key, bs[1:])
 	}
 }
 
+func (p *protoHandler) handleDebug(from phony.Actor, key keyArray, bs []byte) {
+	p.Act(from, func() {
+		p._handleDebug(key, bs)
+	})
+}
+
 func (p *protoHandler) _handleDebug(key keyArray, bs []byte) {
 	if len(bs) == 0 {
 		return

From 234addc81f3495e110db31d1f9fb9822adcae701 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Thu, 7 Jul 2022 18:17:27 +0100
Subject: [PATCH 19/21] Update changelog

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c6aa50..0341e6d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Fixed
 
 - ICMPv6 "Packet Too Big" payload size has been increased, which should fix Path MTU Discovery (PMTUD) when two nodes have different `IfMTU` values configured
+- A crash has been fixed when handling debug packet responses
+- `yggdrasilctl getSelf` should now report coordinates correctly again
 
 ### Changed
 

From df7ca3a5b888ac487026e469bcb9af037d8c9aa6 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Thu, 7 Jul 2022 18:17:39 +0100
Subject: [PATCH 20/21] Update changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0341e6d..3400154 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,7 +26,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - in case of vulnerabilities.
 -->
 
-## [0.4.4] - 2022-04-18
+## [0.4.4] - 2022-07-07
 
 ### Fixed
 

From 8c454a146cb70aa07ee2c87af964f5c1394da299 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Thu, 7 Jul 2022 18:19:15 +0100
Subject: [PATCH 21/21] Silence incorrect linter warning

---
 src/address/address.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/address/address.go b/src/address/address.go
index c7f2eb4..d56be80 100644
--- a/src/address/address.go
+++ b/src/address/address.go
@@ -108,7 +108,7 @@ func SubnetForKey(publicKey ed25519.PublicKey) *Subnet {
 	}
 	var snet Subnet
 	copy(snet[:], addr[:])
-	prefix := GetPrefix()
+	prefix := GetPrefix() // nolint:staticcheck
 	snet[len(prefix)-1] |= 0x01
 	return &snet
 }
@@ -117,7 +117,7 @@ func SubnetForKey(publicKey ed25519.PublicKey) *Subnet {
 // This is used for key lookup.
 func (a *Address) GetKey() ed25519.PublicKey {
 	var key [ed25519.PublicKeySize]byte
-	prefix := GetPrefix()
+	prefix := GetPrefix() // nolint:staticcheck
 	ones := int(a[len(prefix)])
 	for idx := 0; idx < ones; idx++ {
 		key[idx/8] |= 0x80 >> byte(idx%8)