Big refactor mostly builds. We now have a uniform backward compatible netconf.

14 files changed, 715 insertions, 772 deletions

diff --git a/include/ZeroTierOne.h b/include/ZeroTierOne.h
index efba90a8..d16e2a68 100644
--- a/include/ZeroTierOne.h
+++ b/include/ZeroTierOne.h
@@ -412,6 +412,8 @@ enum ZT_VirtualNetworkRuleType
 	 */
 	ZT_NETWORK_RULE_ACTION_REDIRECT = 3,
 
+	// <32 == actions
+
 	/**
 	 * Source ZeroTier address -- analogous to an Ethernet port ID on a switch
 	 */
diff --git a/node/CertificateOfMembership.hpp b/node/CertificateOfMembership.hpp
index 43c8c0af..0342bc33 100644
--- a/node/CertificateOfMembership.hpp
+++ b/node/CertificateOfMembership.hpp
@@ -295,7 +295,6 @@ public:
 	 * @param s String to deserialize
 	 */
 	void fromString(const char *s);
-	inline void fromString(const std::string &s) { fromString(s.c_str()); }
 #endif // ZT_SUPPORT_OLD_STYLE_NETCONF
 
 	/**
diff --git a/node/Dictionary.hpp b/node/Dictionary.hpp
index 66072952..ccca00c8 100644
--- a/node/Dictionary.hpp
+++ b/node/Dictionary.hpp
@@ -21,11 +21,12 @@
 
 #include "Constants.hpp"
 #include "Utils.hpp"
+#include "Buffer.hpp"
+#include "Address.hpp"
 
 #include <stdint.h>
 
-#include <string>
-
+// Can be increased if it's ever needed, but not too much.
 #define ZT_DICTIONARY_MAX_SIZE 16384
 
 namespace ZeroTier {
@@ -45,7 +46,8 @@ namespace ZeroTier {
  * Keys cannot contain binary data, CR/LF, nulls, or the equals (=) sign.
  * Adding such a key will result in an invalid entry (but isn't dangerous).
  *
- * There is code to test and fuzz this in selftest.cpp.
+ * There is code to test and fuzz this in selftest.cpp. Fuzzing a blob of
+ * pointer tricks like this is important after any modifications.
  */
 class Dictionary
 {
@@ -60,9 +62,32 @@ public:
 		Utils::scopy(_d,sizeof(_d),s);
 	}
 
-	inline void load(const char *s)
+	Dictionary(const char *s,unsigned int len)
 	{
-		Utils::scopy(_d,sizeof(_d),s);
+		memcpy(_d,s,(len > ZT_DICTIONARY_MAX_SIZE) ? (unsigned int)ZT_DICTIONARY_MAX_SIZE : len);
+		_d[ZT_DICTIONARY_MAX_SIZE-1] = (char)0;
+	}
+
+	Dictionary(const Dictionary &d)
+	{
+		Utils::scopy(_d,sizeof(_d),d._d);
+	}
+
+	inline Dictionary &operator=(const Dictionary &d)
+	{
+		Utils::scopy(_d,sizeof(_d),d._d);
+		return *this;
+	}
+
+	/**
+	 * Load a dictionary from a C-string
+	 *
+	 * @param s Dictionary in string form
+	 * @return False if 's' was longer than ZT_DICTIONARY_MAX_SIZE
+	 */
+	inline bool load(const char *s)
+	{
+		return Utils::scopy(_d,sizeof(_d),s);
 	}
 
 	/**
@@ -103,9 +128,7 @@ public:
 	inline int get(const char *key,char *dest,unsigned int destlen) const
 	{
 		const char *p = _d;
-		const char *const eof = p + ZT_DICTIONARY_MAX_SIZE;
 		const char *k,*s;
-		unsigned int dptr = 0;
 		bool esc;
 		int j;
 
@@ -185,34 +208,48 @@ public:
 	}
 
 	/**
+	 * Get the contents of a key into a buffer
+	 *
+	 * @param key Key to get
+	 * @param dest Destination buffer
+	 * @return True if key was found (if false, dest will be empty)
+	 */
+	template<unsigned int C>
+	inline bool get(const char *key,Buffer<C> &dest) const
+	{
+		const int r = this->get(key,const_cast<char *>(reinterpret_cast<const char *>(dest.data())),C);
+		if (r >= 0) {
+			dest.setSize((unsigned int)r);
+			return true;
+		} else {
+			dest.clear();
+			return false;
+		}
+	}
+
+	/**
+	 * Get a boolean value
+	 *
 	 * @param key Key to look up
-	 * @param dfl Default value if not found in dictionary (a key with an empty value is considered not found)
+	 * @param dfl Default value if not found in dictionary
 	 * @return Boolean value of key or 'dfl' if not found
 	 */
-	bool getBoolean(const char *key,bool dfl = false) const
+	bool getB(const char *key,bool dfl = false) const
 	{
-		char tmp[128];
-		if (this->get(key,tmp,sizeof(tmp)) >= 1) {
-			switch(tmp[0]) {
-				case '1':
-				case 't':
-				case 'T':
-				case 'y':
-				case 'Y':
-					return true;
-				default:
-					return false;
-			}
-		}
+		char tmp[4];
+		if (this->get(key,tmp,sizeof(tmp)) >= 0)
+			return ((*tmp == '1')||(*tmp == 't')||(*tmp == 'T'));
 		return dfl;
 	}
 
 	/**
+	 * Get an unsigned int64 stored as hex in the dictionary
+	 *
 	 * @param key Key to look up
 	 * @param dfl Default value or 0 if unspecified
 	 * @return Decoded hex UInt value or 'dfl' if not found
 	 */
-	inline uint64_t getHexUInt(const char *key,uint64_t dfl = 0) const
+	inline uint64_t getUI(const char *key,uint64_t dfl = 0) const
 	{
 		char tmp[128];
 		if (this->get(key,tmp,sizeof(tmp)) >= 1)
@@ -227,6 +264,8 @@ public:
 	 * will always be returned by get(). There is no erase(). This is designed
 	 * to be generated and shipped, not as an editable data structure.
 	 *
+	 * Use the vlen parameter to add binary values. Nulls will be escaped.
+	 *
 	 * @param key Key -- nulls, CR/LF, and equals (=) are illegal characters
 	 * @param value Value to set
 	 * @param vlen Length of value in bytes or -1 to treat value[] as a C-string and look for terminating 0
@@ -249,20 +288,22 @@ public:
 				int k = 0;
 				while ((*p)&&((vlen < 0)||(k < vlen))) {
 					switch(*p) {
+						case 0:
 						case '\r':
 						case '\n':
-						case '\0':
 						case '\t':
+						case '\\':
 							_d[j++] = '\\';
 							if (j == ZT_DICTIONARY_MAX_SIZE) {
 								_d[i] = (char)0;
 								return false;
 							}
 							switch(*p) {
+								case 0: _d[j++] = '0'; break;
 								case '\r': _d[j++] = 'r'; break;
 								case '\n': _d[j++] = 'n'; break;
-								case '\0': _d[j++] = '0'; break;
 								case '\t': _d[j++] = 't'; break;
+								case '\\': _d[j++] = '\\'; break;
 							}
 							if (j == ZT_DICTIONARY_MAX_SIZE) {
 								_d[i] = (char)0;
@@ -290,19 +331,38 @@ public:
 	/**
 	 * Add a boolean as a '1' or a '0'
 	 */
-	inline void add(const char *key,bool value)
+	inline bool add(const char *key,bool value)
 	{
-		this->add(key,(value) ? "1" : "0",1);
+		return this->add(key,(value) ? "1" : "0",1);
 	}
 
 	/** 
 	 * Add a 64-bit integer (unsigned) as a hex value
 	 */
-	inline void add(const char *key,uint64_t value)
+	inline bool add(const char *key,uint64_t value)
 	{
-		char tmp[128];
+		char tmp[32];
 		Utils::snprintf(tmp,sizeof(tmp),"%llx",(unsigned long long)value);
-		this->add(key,tmp,-1);
+		return this->add(key,tmp,-1);
+	}
+
+	/** 
+	 * Add a 64-bit integer (unsigned) as a hex value
+	 */
+	inline bool add(const char *key,const Address &a)
+	{
+		char tmp[32];
+		Utils::snprintf(tmp,sizeof(tmp),"%.10llx",(unsigned long long)a.toInt());
+		return this->add(key,tmp,-1);
+	}
+
+	/**
+	 * Add a binary buffer
+	 */
+	template<unsigned int C>
+	inline bool add(const char *key,const Buffer<C> &value)
+	{
+		return this->add(key,(const char *)value.data(),(int)value.size());
 	}
 
 	/**
diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 9e0226b9..f57fa2a8 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -403,8 +403,12 @@ bool IncomingPacket::_doOK(const RuntimeEnvironment *RR,const SharedPtr<Peer> &p
 				if ((nw)&&(nw->controller() == peer->address())) {
 					const unsigned int nclen = at<uint16_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST__OK__IDX_DICT_LEN);
 					if (nclen) {
-						nw->setConfiguration(field(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST__OK__IDX_DICT,nclen),nclen,true);
-						TRACE("got network configuration for network %.16llx from %s",(unsigned long long)nw->id(),source().toString().c_str());
+						Dictionary dconf((const char *)field(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST__OK__IDX_DICT,nclen),nclen);
+						NetworkConfig nconf;
+						if (nconf.fromDictionary(dconf)) {
+							nw->setConfiguration(nconf,true);
+							TRACE("got network configuration for network %.16llx from %s",(unsigned long long)nw->id(),source().toString().c_str());
+						}
 					}
 				}
 			}	break;
@@ -679,27 +683,8 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 		const uint64_t nwid = at<uint64_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_NETWORK_ID);
 
 		const unsigned int metaDataLength = at<uint16_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT_LEN);
-		const uint8_t *metaDataBytes = (const uint8_t *)field(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT,metaDataLength);
-
-		NetworkConfigRequestMetaData metaData;
-		bool haveNewStyleMetaData = false;
-		for(unsigned int i=0;i<metaDataLength;++i) {
-			if ((metaDataBytes[i] == 0)&&(i < (metaDataLength - 2))) {
-				haveNewStyleMetaData = true;
-				break;
-			}
-		}
-		if (haveNewStyleMetaData) {
-			Buffer<4096> md(metaDataBytes,metaDataLength);
-			metaData.deserialize(md,0); // the meta-data deserializer automatically skips old-style meta-data
-		} else {
-#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
-			const Dictionary oldStyleMetaData((const char *)metaDataBytes,metaDataLength);
-			metaData.majorVersion = (unsigned int)oldStyleMetaData.getHexUInt(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION,0);
-			metaData.minorVersion = (unsigned int)oldStyleMetaData.getHexUInt(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION,0);
-			metaData.revision = (unsigned int)oldStyleMetaData.getHexUInt(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION,0);
-#endif
-		}
+		const char *metaDataBytes = (const char *)field(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT,metaDataLength);
+		const Dictionary metaData(metaDataBytes,metaDataLength);
 
 		//const uint64_t haveRevision = ((ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT + metaDataLength + 8) <= size()) ? at<uint64_t>(ZT_PROTO_VERB_NETWORK_CONFIG_REQUEST_IDX_DICT + metaDataLength) : 0ULL;
 
@@ -708,22 +693,21 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 		peer->received(_localAddress,_remoteAddress,h,pid,Packet::VERB_NETWORK_CONFIG_REQUEST,0,Packet::VERB_NOP);
 
 		if (RR->localNetworkController) {
-			Buffer<8194> netconf;
+			NetworkConfig netconf;
 			switch(RR->localNetworkController->doNetworkConfigRequest((h > 0) ? InetAddress() : _remoteAddress,RR->identity,peer->identity(),nwid,metaData,netconf)) {
 
 				case NetworkController::NETCONF_QUERY_OK: {
-					Packet outp(peer->address(),RR->identity.address(),Packet::VERB_OK);
-					outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
-					outp.append(pid);
-					outp.append(nwid);
-					outp.append((uint16_t)netconf.size());
-					outp.append(netconf.data(),(unsigned int)netconf.size());
-					outp.compress();
-					outp.armor(peer->key(),true);
-					if (outp.size() > ZT_PROTO_MAX_PACKET_LENGTH) { // sanity check
-						//TRACE("NETWORK_CONFIG_REQUEST failed: internal error: netconf size %u is too large",(unsigned int)netconfStr.length());
-					} else {
-						RR->node->putPacket(_localAddress,_remoteAddress,outp.data(),outp.size());
+					Dictionary dconf;
+					if (netconf.toDictionary(dconf,metaData.getUI(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,0) < 6)) {
+						Packet outp(peer->address(),RR->identity.address(),Packet::VERB_OK);
+						outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
+						outp.append(pid);
+						outp.append(nwid);
+						const unsigned int dlen = dconf.sizeBytes();
+						outp.append((uint16_t)dlen);
+						outp.append((const void *)dconf.data(),dlen);
+						outp.compress();
+						RR->sw->send(outp,true,0);
 					}
 				}	break;
 
diff --git a/node/Network.cpp b/node/Network.cpp
index 076977a8..82011c3d 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -64,9 +64,13 @@ Network::Network(const RuntimeEnvironment *renv,uint64_t nwid,void *uptr) :
 		try {
 			std::string conf(RR->node->dataStoreGet(confn));
 			if (conf.length()) {
-				this->setConfiguration((const void *)conf.data(),(unsigned int)conf.length(),false);
-				_lastConfigUpdate = 0; // we still want to re-request a new config from the network
-				gotConf = true;
+				Dictionary dconf(conf.c_str());
+				NetworkConfig nconf;
+				if (nconf.fromDictionary(dconf)) {
+					this->setConfiguration(nconf,false);
+					_lastConfigUpdate = 0; // we still want to re-request a new config from the network
+					gotConf = true;
+				}
 			}
 		} catch ( ... ) {} // ignore invalids, we'll re-request
 
@@ -177,49 +181,21 @@ bool Network::applyConfiguration(const NetworkConfig &conf)
 	return false;
 }
 
-int Network::setConfiguration(const void *confBytes,unsigned int confLen,bool saveToDisk)
+int Network::setConfiguration(const NetworkConfig &nconf,bool saveToDisk)
 {
 	try {
-		if (confLen <= 1)
-			return 0;
-
-		NetworkConfig newConfig;
-
-		// Find the length of any string-serialized old-style Dictionary,
-		// including its terminating NULL (if any). If this is before
-		// the end of the config, that tells us there is a new-style
-		// binary config which is preferred.
-		unsigned int dictLen = 0;
-		while (dictLen < confLen) {
-			if (!(reinterpret_cast<const uint8_t *>(confBytes)[dictLen++]))
-				break;
-		}
-
-		if (dictLen < (confLen - 2)) {
-			Buffer<8194> tmp(reinterpret_cast<const uint8_t *>(confBytes) + dictLen,confLen - dictLen);
-			newConfig.deserialize(tmp,0);
-		} else {
-#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
-			newConfig.fromDictionary(reinterpret_cast<const char *>(confBytes),confLen); // throws if invalid
-#else
-			return 0;
-#endif
-		}
-
-		if (!newConfig)
-			return 0;
-
 		{
 			Mutex::Lock _l(_lock);
-			if (_config == newConfig)
+			if (_config == nconf)
 				return 1; // OK config, but duplicate of what we already have
 		}
-
-		if (applyConfiguration(newConfig)) {
+		if (applyConfiguration(nconf)) {
 			if (saveToDisk) {
-				char n[128];
+				char n[64];
 				Utils::snprintf(n,sizeof(n),"networks.d/%.16llx.conf",_id);
-				RR->node->dataStorePut(n,confBytes,confLen,true);
+				Dictionary d;
+				if (nconf.toDictionary(d,false))
+					RR->node->dataStorePut(n,(const void *)d.data(),d.sizeBytes(),true);
 			}
 			return 2; // OK and configuration has changed
 		}
@@ -234,12 +210,19 @@ void Network::requestConfiguration()
 	if (_id == ZT_TEST_NETWORK_ID) // pseudo-network-ID, uses locally generated static config
 		return;
 
+	Dictionary rmd;
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION,(uint64_t)ZT_NETWORKCONFIG_VERSION);
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION,(uint64_t)ZT_PROTO_VERSION);
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION,(uint64_t)ZEROTIER_ONE_VERSION_MAJOR);
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION,(uint64_t)ZEROTIER_ONE_VERSION_MINOR);
+	rmd.add(ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION,(uint64_t)ZEROTIER_ONE_VERSION_REVISION);
+
 	if (controller() == RR->identity.address()) {
 		if (RR->localNetworkController) {
-			Buffer<8194> tmp;
-			switch(RR->localNetworkController->doNetworkConfigRequest(InetAddress(),RR->identity,RR->identity,_id,NetworkConfigRequestMetaData(),tmp)) {
+			NetworkConfig nconf;
+			switch(RR->localNetworkController->doNetworkConfigRequest(InetAddress(),RR->identity,RR->identity,_id,rmd,nconf)) {
 				case NetworkController::NETCONF_QUERY_OK:
-					this->setConfiguration(tmp.data(),tmp.size(),true);
+					this->setConfiguration(nconf,true);
 					return;
 				case NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND:
 					this->setNotFound();
@@ -258,16 +241,13 @@ void Network::requestConfiguration()
 
 	TRACE("requesting netconf for network %.16llx from controller %s",(unsigned long long)_id,controller().toString().c_str());
 
-	NetworkConfigRequestMetaData metaData;
-	metaData.initWithDefaults();
-	Buffer<4096> mds;
-	metaData.serialize(mds); // this always includes legacy fields to support old controllers
-
 	Packet outp(controller(),RR->identity.address(),Packet::VERB_NETWORK_CONFIG_REQUEST);
 	outp.append((uint64_t)_id);
-	outp.append((uint16_t)mds.size());
-	outp.append(mds.data(),mds.size());
+	const unsigned int rmdSize = rmd.sizeBytes();
+	outp.append((uint16_t)rmdSize);
+	outp.append((const void *)rmd.data(),rmdSize);
 	outp.append((_config) ? (uint64_t)_config.revision : (uint64_t)0);
+	outp.compress();
 	RR->sw->send(outp,true,0);
 }
 
diff --git a/node/Network.hpp b/node/Network.hpp
index f316e050..17eed4bd 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -151,12 +151,11 @@ public:
 	/**
 	 * Set or update this network's configuration
 	 *
-	 * @param confBytes Network configuration in old-style Dictionary or new-style serialized format
-	 * @param confLen Length of network configuration in bytes
+	 * @param nconf Network configuration
 	 * @param saveToDisk IF true (default), write config to disk
 	 * @return 0 -- rejected, 1 -- accepted but not new, 2 -- accepted new config
 	 */
-	int setConfiguration(const void *confBytes,unsigned int confLen,bool saveToDisk);
+	int setConfiguration(const NetworkConfig &nconf,bool saveToDisk);
 
 	/**
 	 * Set netconf failure to 'access denied' -- called in IncomingPacket when controller reports this
diff --git a/node/NetworkConfig.cpp b/node/NetworkConfig.cpp
index 58a48fa0..0f222340 100644
--- a/node/NetworkConfig.cpp
+++ b/node/NetworkConfig.cpp
@@ -23,158 +23,460 @@
 
 namespace ZeroTier {
 
-#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
-
-void NetworkConfig::fromDictionary(const char *ds,unsigned int dslen)
+bool NetworkConfig::toDictionary(Dictionary &d,bool includeLegacy) const
 {
-	static const std::string zero("0");
-	static const std::string one("1");
-
-	Dictionary d(ds,dslen);
+	Buffer<ZT_DICTIONARY_MAX_SIZE> tmp;
 
-	memset(this,0,sizeof(NetworkConfig));
+	d.clear();
 
-	// NOTE: d.get(name) throws if not found, d.get(name,default) returns default
+	// Try to put the more human-readable fields first
 
-	networkId = Utils::hexStrToU64(d.get(ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID,"0").c_str());
-	if (!networkId)
-		throw std::invalid_argument("configuration contains zero network ID");
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_VERSION,(uint64_t)ZT_NETWORKCONFIG_VERSION)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID,this->networkId)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP,this->timestamp)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_REVISION,this->revision)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO,this->issuedTo)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_FLAGS,this->flags)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,(uint64_t)this->multicastLimit)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_TYPE,(uint64_t)this->type)) return false;
+	if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NAME,this->name)) return false;
 
-	timestamp = Utils::hexStrToU64(d.get(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP,"0").c_str());
-	revision = Utils::hexStrToU64(d.get(ZT_NETWORKCONFIG_DICT_KEY_REVISION,"1").c_str()); // older controllers don't send this, so default to 1
-	issuedTo = Address(d.get(ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO,"0"));
+#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
+	if (includeLegacy) {
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD,this->allowPassiveBridging())) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST_OLD,this->enableBroadcast())) return false;
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_PRIVATE_OLD,this->isPrivate())) return false;
 
-	multicastLimit = Utils::hexStrToUInt(d.get(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,zero).c_str());
-	if (multicastLimit == 0) multicastLimit = ZT_MULTICAST_DEFAULT_LIMIT;
+		std::string v4s;
+		for(unsigned int i=0;i<staticIpCount;++i) {
+			if (this->staticIps[i].ss_family == AF_INET) {
+				if (v4s.length() > 0)
+					v4s.push_back(',');
+				v4s.append(this->staticIps[i].toString());
+			}
+		}
+		if (v4s.length() > 0) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC_OLD,v4s.c_str())) return false;
+		}
+		std::string v6s;
+		for(unsigned int i=0;i<staticIpCount;++i) {
+			if (this->staticIps[i].ss_family == AF_INET6) {
+				if (v6s.length() > 0)
+					v6s.push_back(',');
+				v6s.append(this->staticIps[i].toString());
+			}
+		}
+		if (v6s.length() > 0) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC_OLD,v6s.c_str())) return false;
+		}
 
-	flags |= ((Utils::hexStrToUInt(d.get(ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING,zero).c_str()) != 0) ? ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING : 0);
-	flags |= ((Utils::hexStrToUInt(d.get(ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST,one).c_str()) != 0) ? ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST : 0);
+		std::string ets;
+		unsigned int et = 0;
+		ZT_VirtualNetworkRuleType lastrt = ZT_NETWORK_RULE_ACTION_ACCEPT;
+		for(unsigned int i=0;i<ruleCount;++i) {
+			ZT_VirtualNetworkRuleType rt = (ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f);
+			if (rt == ZT_NETWORK_RULE_MATCH_ETHERTYPE) {
+				et = rules[i].v.etherType;
+			} else if (rt == ZT_NETWORK_RULE_ACTION_ACCEPT) {
+				if (((int)lastrt < 32)||(lastrt == ZT_NETWORK_RULE_MATCH_ETHERTYPE)) {
+					if (ets.length() > 0)
+						ets.push_back(',');
+					char tmp[16];
+					Utils::snprintf(tmp,sizeof(tmp),"%x",et);
+					ets.append(tmp);
+				}
+				et = 0;
+			}
+			lastrt = rt;
+		}
+		if (ets.length() > 0) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES_OLD,ets.c_str())) return false;
+		}
 
-	this->type = (Utils::hexStrToUInt(d.get(ZT_NETWORKCONFIG_DICT_KEY_PRIVATE,one).c_str()) != 0) ? ZT_NETWORK_TYPE_PRIVATE : ZT_NETWORK_TYPE_PUBLIC;
+		if (this->com) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP_OLD,this->com.toString().c_str())) return false;
+		}
 
-	std::string nametmp(d.get(ZT_NETWORKCONFIG_DICT_KEY_NAME,""));
-	for(unsigned long i=0;((i<ZT_MAX_NETWORK_SHORT_NAME_LENGTH)&&(i<nametmp.length()));++i)
-		name[i] = (char)nametmp[i];
-	// we zeroed the entire structure above and _name is ZT_MAX_NETWORK_SHORT_NAME_LENGTH+1, so it will always null-terminate
+		std::string ab;
+		for(unsigned int i=0;i<this->specialistCount;++i) {
+			if ((this->specialists[i] & ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE) != 0) {
+				if (ab.length() > 0)
+					ab.push_back(',');
+				ab.append(Address(this->specialists[i]).toString().c_str());
+			}
+		}
+		if (ab.length() > 0) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES_OLD,ab.c_str())) return false;
+		}
 
-	std::vector<std::string> activeBridgesSplit(Utils::split(d.get(ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES,"").c_str(),",","",""));
-	for(std::vector<std::string>::const_iterator a(activeBridgesSplit.begin());a!=activeBridgesSplit.end();++a) {
-		if (a->length() == ZT_ADDRESS_LENGTH_HEX) { // ignore empty or garbage fields
-			Address tmp(*a);
-			if (!tmp.isReserved()) {
-				uint64_t specialist = tmp.toInt();
-				for(unsigned int i=0;i<specialistCount;++i) {
-					if ((specialists[i] & 0xffffffffffULL) == specialist) {
-						specialists[i] |= ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE;
-						specialist = 0;
-						break;
-					}
-				}
-				if ((specialist)&&(specialistCount < ZT_MAX_NETWORK_SPECIALISTS))
-					specialists[specialistCount++] = specialist | ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE;
+		std::vector<Relay> rvec(this->relays());
+		std::string rl;
+		for(std::vector<Relay>::const_iterator i(rvec.begin());i!=rvec.end();++i) {
+			if (rl.length() > 0)
+				rl.push_back(',');
+			rl.append(i->address.toString());
+			if (i->phy4) {
+				rl.push_back(';');
+				rl.append(i->phy4.toString());
+			} else if (i->phy6) {
+				rl.push_back(';');
+				rl.append(i->phy6.toString());
 			}
 		}
+		if (rl.length() > 0) {
+			if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_RELAYS_OLD,rl.c_str())) return false;
+		}
 	}
+#endif // ZT_SUPPORT_OLD_STYLE_NETCONF
 
-	std::string ipAddrs(d.get(ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC,std::string()));
-	{
-		std::string v6s(d.get(ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC,std::string()));
-		if (v6s.length()) {
-			if (ipAddrs.length())
-				ipAddrs.push_back(',');
-			ipAddrs.append(v6s);
-		}
+	// Then add binary blobs
+
+	if (this->com) {
+		tmp.clear();
+		this->com.serialize(tmp);
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_COM,tmp)) return false;
+	}
+
+	tmp.clear();
+	for(unsigned int i=0;i<this->specialistCount;++i) {
+		tmp.append((uint64_t)this->specialists[i]);
+	}
+	if (tmp.size()) {
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS,tmp)) return false;
+	}
+
+	tmp.clear();
+	for(unsigned int i=0;i<this->routeCount;++i) {
+		reinterpret_cast<const InetAddress *>(&(this->routes[i].target))->serialize(tmp);
+		reinterpret_cast<const InetAddress *>(&(this->routes[i].via))->serialize(tmp);
+		tmp.append((uint16_t)this->routes[i].flags);
+		tmp.append((uint16_t)this->routes[i].metric);
+	}
+	if (tmp.size()) {
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_ROUTES,tmp)) return false;
+	}
+
+	tmp.clear();
+	for(unsigned int i=0;i<this->staticIpCount;++i) {
+		this->staticIps[i].serialize(tmp);
+	}
+	if (tmp.size()) {
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS,tmp)) return false;
+	}
+
+	tmp.clear();
+	for(unsigned int i=0;i<this->pinnedCount;++i) {
+		this->pinned[i].zt.appendTo(tmp);
+		this->pinned[i].phy.serialize(tmp);
 	}
-	std::vector<std::string> ipAddrsSplit(Utils::split(ipAddrs.c_str(),",","",""));
-	for(std::vector<std::string>::const_iterator ipstr(ipAddrsSplit.begin());ipstr!=ipAddrsSplit.end();++ipstr) {
-		InetAddress addr(*ipstr);
-		switch(addr.ss_family) {
-			case AF_INET:
-				if ((!addr.netmaskBits())||(addr.netmaskBits() > 32))
-					continue;
+	if (tmp.size()) {
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_PINNED,tmp)) return false;
+	}
+
+	tmp.clear();
+	for(unsigned int i=0;i<this->ruleCount;++i) {
+		tmp.append((uint8_t)rules[i].t);
+		switch((ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f)) {
+			//case ZT_NETWORK_RULE_ACTION_DROP:
+			//case ZT_NETWORK_RULE_ACTION_ACCEPT:
+			default:
+				tmp.append((uint8_t)0);
 				break;
-			case AF_INET6:
-				if ((!addr.netmaskBits())||(addr.netmaskBits() > 128))
-					continue;
+			case ZT_NETWORK_RULE_ACTION_TEE:
+			case ZT_NETWORK_RULE_ACTION_REDIRECT:
+			case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
+			case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:
+				tmp.append((uint8_t)5);
+				Address(rules[i].v.zt).appendTo(tmp);
+				break;
+			case ZT_NETWORK_RULE_MATCH_VLAN_ID:
+				tmp.append((uint8_t)2);
+				tmp.append((uint16_t)rules[i].v.vlanId);
+				break;
+			case ZT_NETWORK_RULE_MATCH_VLAN_PCP:
+				tmp.append((uint8_t)1);
+				tmp.append((uint8_t)rules[i].v.vlanPcp);
+				break;
+			case ZT_NETWORK_RULE_MATCH_VLAN_DEI:
+				tmp.append((uint8_t)1);
+				tmp.append((uint8_t)rules[i].v.vlanDei);
+				break;
+			case ZT_NETWORK_RULE_MATCH_ETHERTYPE:
+				tmp.append((uint8_t)2);
+				tmp.append((uint16_t)rules[i].v.etherType);
+				break;
+			case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
+			case ZT_NETWORK_RULE_MATCH_MAC_DEST:
+				tmp.append((uint8_t)6);
+				tmp.append(rules[i].v.mac,6);
+				break;
+			case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
+			case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
+				tmp.append((uint8_t)5);
+				tmp.append(&(rules[i].v.ipv4.ip),4);
+				tmp.append((uint8_t)rules[i].v.ipv4.mask);
+				break;
+			case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
+			case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
+				tmp.append((uint8_t)17);
+				tmp.append(rules[i].v.ipv6.ip,16);
+				tmp.append((uint8_t)rules[i].v.ipv6.mask);
+				break;
+			case ZT_NETWORK_RULE_MATCH_IP_TOS:
+				tmp.append((uint8_t)1);
+				tmp.append((uint8_t)rules[i].v.ipTos);
+				break;
+			case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:
+				tmp.append((uint8_t)1);
+				tmp.append((uint8_t)rules[i].v.ipProtocol);
+				break;
+			case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:
+			case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:
+				tmp.append((uint8_t)4);
+				tmp.append((uint16_t)rules[i].v.port[0]);
+				tmp.append((uint16_t)rules[i].v.port[1]);
+				break;
+			case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
+				tmp.append((uint8_t)8);
+				tmp.append((uint64_t)rules[i].v.characteristics);
+				break;
+			case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
+				tmp.append((uint8_t)4);
+				tmp.append((uint16_t)rules[i].v.frameSize[0]);
+				tmp.append((uint16_t)rules[i].v.frameSize[1]);
+				break;
+			case ZT_NETWORK_RULE_MATCH_TCP_RELATIVE_SEQUENCE_NUMBER_RANGE:
+				tmp.append((uint8_t)8);
+				tmp.append((uint32_t)rules[i].v.tcpseq[0]);
+				tmp.append((uint32_t)rules[i].v.tcpseq[1]);
 				break;
-			default: // ignore unrecognized address types or junk/empty fields
-				continue;
-		}
-		if (!addr.isNetwork()) {
-			if ((staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)&&(std::find(&(staticIps[0]),&(staticIps[staticIpCount]),addr) == &(staticIps[staticIpCount])))
-				staticIps[staticIpCount++] = addr;
 		}
 	}
-	std::sort(&(staticIps[0]),&(staticIps[staticIpCount]));
-
-	/* Old versions don't support gateways anyway, so ignore this in old netconfs
-	std::vector<std::string> gatewaysSplit(Utils::split(d.get(ZT_NETWORKCONFIG_DICT_KEY_GATEWAYS,"").c_str(),",","",""));
-	for(std::vector<std::string>::const_iterator gwstr(gatewaysSplit.begin());gwstr!=gatewaysSplit.end();++gwstr) {
-		InetAddress gw(*gwstr);
-		if ((gw)&&(_gatewayCount < ZT_MAX_NETWORK_GATEWAYS)&&(std::find(&(_gateways[0]),&(_gateways[_gatewayCount]),gw) == &(_gateways[_gatewayCount])))
-			_gateways[_gatewayCount++] = gw;
+	if (tmp.size()) {
+		if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_RULES,tmp)) return false;
 	}
-	std::sort(&(_gateways[0]),&(_gateways[_gatewayCount]));
-	*/
-
-	std::vector<std::string> relaysSplit(Utils::split(d.get(ZT_NETWORKCONFIG_DICT_KEY_RELAYS,"").c_str(),",","",""));
-	for(std::vector<std::string>::const_iterator r(relaysSplit.begin());r!=relaysSplit.end();++r) {
-		if (r->length() >= ZT_ADDRESS_LENGTH_HEX) {
-			Address zt(r->substr(0,ZT_ADDRESS_LENGTH_HEX).c_str());
-			InetAddress phy[2];
-			unsigned int phyCount = 0;
-			const std::size_t semi(r->find(';'));
-			if ((semi > ZT_ADDRESS_LENGTH_HEX)&&(semi < (r->length() - 2))) {
-				std::vector<std::string> phySplit(Utils::split(r->substr(semi+1).c_str(),",","",""));
-				for(std::vector<std::string>::const_iterator p(phySplit.begin());((p!=phySplit.end())&&(phyCount < 2));++p) {
-					phy[phyCount] = InetAddress(*p);
-					if (phy[phyCount])
-						++phyCount;
-					else phy[phyCount].zero();
+
+	return true;
+}
+
+bool NetworkConfig::fromDictionary(const Dictionary &d)
+{
+	try {
+		Buffer<ZT_DICTIONARY_MAX_SIZE> tmp;
+		char tmp2[ZT_DICTIONARY_MAX_SIZE];
+
+		memset(this,0,sizeof(NetworkConfig));
+
+		const uint64_t ver = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_VERSION,0);
+
+		// Fields that are always present, new or old
+		this->networkId = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID,0);
+		if (this->networkId)
+			return false;
+		this->timestamp = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP,0);
+		this->revision = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_REVISION,0);
+		this->issuedTo = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO,0);
+		if (!this->issuedTo)
+			return false;
+		this->multicastLimit = (unsigned int)d.getUI(ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT,0);
+		d.get(ZT_NETWORKCONFIG_DICT_KEY_NAME,this->name,sizeof(this->name));
+
+		if (ver < ZT_NETWORKCONFIG_VERSION) {
+	#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
+			// Decode legacy fields if version is old
+			if (d.getB(ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD))
+				this->flags |= ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING;
+			if (d.getB(ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST_OLD))
+				this->flags |= ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST;
+			this->type = (d.getB(ZT_NETWORKCONFIG_DICT_KEY_PRIVATE_OLD,true)) ? ZT_NETWORK_TYPE_PRIVATE : ZT_NETWORK_TYPE_PUBLIC;
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC_OLD,tmp2,sizeof(tmp2)) > 0) {
+				char *saveptr = (char *)0;
+				for(char *f=Utils::stok(tmp2,",",&saveptr);(f);f=Utils::stok((char *)0,",",&saveptr)) {
+					if (this->staticIpCount >= ZT_MAX_ZT_ASSIGNED_ADDRESSES) break;
+					this->staticIps[this->staticIpCount++] = InetAddress(f);
+				}
+			}
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC_OLD,tmp2,sizeof(tmp2)) > 0) {
+				char *saveptr = (char *)0;
+				for(char *f=Utils::stok(tmp2,",",&saveptr);(f);f=Utils::stok((char *)0,",",&saveptr)) {
+					if (this->staticIpCount >= ZT_MAX_ZT_ASSIGNED_ADDRESSES) break;
+					this->staticIps[this->staticIpCount++] = InetAddress(f);
+				}
+			}
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP_OLD,tmp2,sizeof(tmp2)) > 0) {
+				this->com.fromString(tmp2);
+			}
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES_OLD,tmp2,sizeof(tmp2)) > 0) {
+				char *saveptr = (char *)0;
+				for(char *f=Utils::stok(tmp2,",",&saveptr);(f);f=Utils::stok((char *)0,",",&saveptr)) {
+					unsigned int et = Utils::hexStrToUInt(f) & 0xffff;
+					if ((this->ruleCount + 2) > ZT_MAX_NETWORK_RULES) break;
+					if (et > 0) {
+						this->rules[this->ruleCount].t = (uint8_t)ZT_NETWORK_RULE_MATCH_ETHERTYPE;
+						this->rules[this->ruleCount].v.etherType = (uint16_t)et;
+						++this->ruleCount;
+					}
+					this->rules[this->ruleCount++].t = (uint8_t)ZT_NETWORK_RULE_ACTION_ACCEPT;
+				}
+			} else {
+				this->rules[0].t = ZT_NETWORK_RULE_ACTION_ACCEPT;
+				this->ruleCount = 1;
+			}
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES_OLD,tmp2,sizeof(tmp2)) > 0) {
+				char *saveptr = (char *)0;
+				for(char *f=Utils::stok(tmp2,",",&saveptr);(f);f=Utils::stok((char *)0,",",&saveptr)) {
+					this->addSpecialist(Address(f),ZT_NETWORKCONFIG_SPECIALIST_TYPE_ACTIVE_BRIDGE);
 				}
 			}
 
-			uint64_t specialist = zt.toInt();
-			for(unsigned int i=0;i<specialistCount;++i) {
-				if ((specialists[i] & 0xffffffffffULL) == specialist) {
-					specialists[i] |= ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY;
-					specialist = 0;
-					break;
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_RELAYS_OLD,tmp2,sizeof(tmp2)) > 0) {
+				char *saveptr = (char *)0;
+				for(char *f=Utils::stok(tmp2,",",&saveptr);(f);f=Utils::stok((char *)0,",",&saveptr)) {
+					char tmp3[256];
+					Utils::scopy(tmp3,sizeof(tmp3),f);
+
+					InetAddress phy;
+					char *semi = tmp3;
+					while (*semi) {
+						if (*semi == ';') {
+							*semi = (char)0;
+							++semi;
+							phy = InetAddress(semi);
+						} else ++semi;
+					}
+					Address zt(tmp3);
+
+					this->addSpecialist(zt,ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY);
+					if ((phy)&&(this->pinnedCount < ZT_MAX_NETWORK_PINNED)) {
+						this->pinned[this->pinnedCount].zt = zt;
+						this->pinned[this->pinnedCount].phy = phy;
+						++this->pinnedCount;
+					}
 				}
 			}
+	#else
+			return false;
+	#endif // ZT_SUPPORT_OLD_STYLE_NETCONF
+		} else {
+			// Otherwise we can use the new fields
+			this->flags = d.getUI(ZT_NETWORKCONFIG_DICT_KEY_FLAGS,0);
+			this->type = (ZT_VirtualNetworkType)d.getUI(ZT_NETWORKCONFIG_DICT_KEY_TYPE,(uint64_t)ZT_NETWORK_TYPE_PRIVATE);
 
-			if ((specialist)&&(specialistCount < ZT_MAX_NETWORK_SPECIALISTS))
-				specialists[specialistCount++] = specialist | ZT_NETWORKCONFIG_SPECIALIST_TYPE_NETWORK_PREFERRED_RELAY;
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_COM,tmp)) {
+				this->com.deserialize(tmp,0);
+			}
 
-			if ((phy[0])&&(pinnedCount < ZT_MAX_NETWORK_PINNED)) {
-				pinned[pinnedCount].zt = zt;
-				pinned[pinnedCount].phy = phy[0];
-				++pinnedCount;
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS,tmp)) {
+				unsigned int p = 0;
+				while (((p + 8) <= tmp.size())&&(specialistCount < ZT_MAX_NETWORK_SPECIALISTS)) {
+					this->specialists[this->specialistCount++] = tmp.at<uint64_t>(p);
+					p += 8;
+				}
 			}
-			if ((phy[1])&&(pinnedCount < ZT_MAX_NETWORK_PINNED)) {
-				pinned[pinnedCount].zt = zt;
-				pinned[pinnedCount].phy = phy[0];
-				++pinnedCount;
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_ROUTES,tmp)) {
+				unsigned int p = 0;
+				while ((p < tmp.size())&&(routeCount < ZT_MAX_NETWORK_ROUTES)) {
+					p += reinterpret_cast<InetAddress *>(&(this->routes[this->routeCount].target))->deserialize(tmp,p);
+					p += reinterpret_cast<InetAddress *>(&(this->routes[this->routeCount].via))->deserialize(tmp,p);
+					this->routes[this->routeCount].flags = tmp.at<uint16_t>(p); p += 2;
+					this->routes[this->routeCount].metric = tmp.at<uint16_t>(p); p += 2;
+					++this->routeCount;
+				}
 			}
-		}
-	}
 
-	std::vector<std::string> ets(Utils::split(d.get(ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES,"").c_str(),",","",""));
-	for(std::vector<std::string>::const_iterator et(ets.begin());et!=ets.end();++et) {
-		unsigned int et2 = Utils::hexStrToUInt(et->c_str()) & 0xffff;
-		if ((ruleCount + 1) < ZT_MAX_NETWORK_RULES) {
-			if (et2) {
-				rules[ruleCount].t = ZT_NETWORK_RULE_MATCH_ETHERTYPE;
-				rules[ruleCount].v.etherType = (uint16_t)et2;
-				++ruleCount;
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS,tmp)) {
+				unsigned int p = 0;
+				while ((p < tmp.size())&&(staticIpCount < ZT_MAX_ZT_ASSIGNED_ADDRESSES)) {
+					p += this->staticIps[this->staticIpCount++].deserialize(tmp,p);
+				}
+			}
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_PINNED,tmp)) {
+				unsigned int p = 0;
+				while ((p < tmp.size())&&(pinnedCount < ZT_MAX_NETWORK_PINNED)) {
+					this->pinned[this->pinnedCount].zt.setTo(tmp.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH;
+					p += this->pinned[this->pinnedCount].phy.deserialize(tmp,p);
+					++this->pinnedCount;
+				}
+			}
+
+			if (d.get(ZT_NETWORKCONFIG_DICT_KEY_RULES,tmp)) {
+				unsigned int p = 0;
+				while ((p < tmp.size())&&(ruleCount < ZT_MAX_NETWORK_RULES)) {
+					rules[ruleCount].t = (uint8_t)tmp[p++];
+					unsigned int fieldLen = (unsigned int)tmp[p++];
+					switch((ZT_VirtualNetworkRuleType)(rules[ruleCount].t & 0x7f)) {
+						default:
+							break;
+						case ZT_NETWORK_RULE_ACTION_TEE:
+						case ZT_NETWORK_RULE_ACTION_REDIRECT:
+						case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
+						case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:
+							rules[ruleCount].v.zt = Address(tmp.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH).toInt();
+							break;
+						case ZT_NETWORK_RULE_MATCH_VLAN_ID:
+							rules[ruleCount].v.vlanId = tmp.at<uint16_t>(p);
+							break;
+						case ZT_NETWORK_RULE_MATCH_VLAN_PCP:
+							rules[ruleCount].v.vlanPcp = (uint8_t)tmp[p];
+							break;
+						case ZT_NETWORK_RULE_MATCH_VLAN_DEI:
+							rules[ruleCount].v.vlanDei = (uint8_t)tmp[p];
+							break;
+						case ZT_NETWORK_RULE_MATCH_ETHERTYPE:
+							rules[ruleCount].v.etherType = tmp.at<uint16_t>(p);
+							break;
+						case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
+						case ZT_NETWORK_RULE_MATCH_MAC_DEST:
+							memcpy(rules[ruleCount].v.mac,tmp.field(p,6),6);
+							break;
+						case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
+						case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
+							memcpy(&(rules[ruleCount].v.ipv4.ip),tmp.field(p,4),4);
+							rules[ruleCount].v.ipv4.mask = (uint8_t)tmp[p + 4];
+							break;
+						case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
+						case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
+							memcpy(rules[ruleCount].v.ipv6.ip,tmp.field(p,16),16);
+							rules[ruleCount].v.ipv6.mask = (uint8_t)tmp[p + 16];
+							break;
+						case ZT_NETWORK_RULE_MATCH_IP_TOS:
+							rules[ruleCount].v.ipTos = (uint8_t)tmp[p];
+							break;
+						case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:
+							rules[ruleCount].v.ipProtocol = (uint8_t)tmp[p];
+							break;
+						case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:
+						case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:
+							rules[ruleCount].v.port[0] = tmp.at<uint16_t>(p);
+							rules[ruleCount].v.port[1] = tmp.at<uint16_t>(p + 2);
+							break;
+						case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
+							rules[ruleCount].v.characteristics = tmp.at<uint64_t>(p);
+							break;
+						case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
+							rules[ruleCount].v.frameSize[0] = tmp.at<uint16_t>(p);
+							rules[ruleCount].v.frameSize[0] = tmp.at<uint16_t>(p + 2);
+							break;
+						case ZT_NETWORK_RULE_MATCH_TCP_RELATIVE_SEQUENCE_NUMBER_RANGE:
+							rules[ruleCount].v.tcpseq[0] = tmp.at<uint32_t>(p);
+							rules[ruleCount].v.tcpseq[1] = tmp.at<uint32_t>(p + 4);
+							break;
+					}
+					p += fieldLen;
+					++ruleCount;
+				}
 			}
-			rules[ruleCount++].t = ZT_NETWORK_RULE_ACTION_ACCEPT;
 		}
+		return true;
+	} catch ( ... ) {
+		return false;
 	}
-
-	this->com.fromString(d.get(ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP,std::string()));
 }
 
-#endif // ZT_SUPPORT_OLD_STYLE_NETCONF
-
 } // namespace ZeroTier
diff --git a/node/NetworkConfig.hpp b/node/NetworkConfig.hpp
index bf513df1..4bc2546b 100644
--- a/node/NetworkConfig.hpp
+++ b/node/NetworkConfig.hpp
@@ -35,21 +35,17 @@
 #include "MulticastGroup.hpp"
 #include "Address.hpp"
 #include "CertificateOfMembership.hpp"
-
-#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
 #include "Dictionary.hpp"
-#include <string>
-#endif
 
 /**
  * Flag: allow passive bridging (experimental)
  */
-#define ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING 0x0001
+#define ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING 0x0000000000000001ULL
 
 /**
  * Flag: enable broadcast
  */
-#define ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST 0x0002
+#define ZT_NETWORKCONFIG_FLAG_ENABLE_BROADCAST 0x0000000000000002ULL
 
 /**
  * Device is a network preferred relay
@@ -68,18 +64,20 @@
 
 namespace ZeroTier {
 
-#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
+// Network config version
+#define ZT_NETWORKCONFIG_VERSION 6
 
 // Fields for meta-data sent with network config requests
+#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_VERSION "v"
+#define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_PROTOCOL_VERSION "pv"
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MAJOR_VERSION "majv"
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_MINOR_VERSION "minv"
 #define ZT_NETWORKCONFIG_REQUEST_METADATA_KEY_NODE_REVISION "revv"
 
-// These dictionary keys are short so they don't take up much room in
-// netconf response packets.
+// These dictionary keys are short so they don't take up much room.
 
-// integer(hex)[,integer(hex),...]
-#define ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES "et"
+// network config version
+#define ZT_NETWORKCONFIG_DICT_KEY_VERSION "v"
 // network ID
 #define ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID "nwid"
 // integer(hex)
@@ -88,34 +86,49 @@ namespace ZeroTier {
 #define ZT_NETWORKCONFIG_DICT_KEY_REVISION "r"
 // address of member
 #define ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO "id"
+// flags(hex)
+#define ZT_NETWORKCONFIG_DICT_KEY_FLAGS "f"
 // integer(hex)
 #define ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_LIMIT "ml"
-// 0/1
-#define ZT_NETWORKCONFIG_DICT_KEY_PRIVATE "p"
+// network type (hex)
+#define ZT_NETWORKCONFIG_DICT_KEY_TYPE "t"
 // text
 #define ZT_NETWORKCONFIG_DICT_KEY_NAME "n"
-// text
-#define ZT_NETWORKCONFIG_DICT_KEY_DESC "d"
+// binary serialized certificate of membership
+#define ZT_NETWORKCONFIG_DICT_KEY_COM "C"
+// specialists (binary array of uint64_t)
+#define ZT_NETWORKCONFIG_DICT_KEY_SPECIALISTS "S"
+// routes (binary blob)
+#define ZT_NETWORKCONFIG_DICT_KEY_ROUTES "RT"
+// static IPs (binary blob)
+#define ZT_NETWORKCONFIG_DICT_KEY_STATIC_IPS "I"
+// pinned address physical route mappings (binary blob)
+#define ZT_NETWORKCONFIG_DICT_KEY_PINNED "P"
+// rules (binary blob)
+#define ZT_NETWORKCONFIG_DICT_KEY_RULES "R"
+
+// Legacy fields -- these are obsoleted but are included when older clients query
+
+// boolean (now a flag)
+#define ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING_OLD "pb"
+// boolean (now a flag)
+#define ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST_OLD "eb"
 // IP/bits[,IP/bits,...]
 // Note that IPs that end in all zeroes are routes with no assignment in them.
-#define ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC "v4s"
+#define ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC_OLD "v4s"
 // IP/bits[,IP/bits,...]
 // Note that IPs that end in all zeroes are routes with no assignment in them.
-#define ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC "v6s"
-// serialized CertificateOfMembership
-#define ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP "com"
+#define ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC_OLD "v6s"
 // 0/1
-#define ZT_NETWORKCONFIG_DICT_KEY_ENABLE_BROADCAST "eb"
-// 0/1
-#define ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING "pb"
+#define ZT_NETWORKCONFIG_DICT_KEY_PRIVATE_OLD "p"
+// integer(hex)[,integer(hex),...]
+#define ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES_OLD "et"
+// string-serialized CertificateOfMembership
+#define ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP_OLD "com"
 // node[,node,...]
-#define ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES "ab"
+#define ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES_OLD "ab"
 // node;IP/port[,node;IP/port]
-#define ZT_NETWORKCONFIG_DICT_KEY_RELAYS "rl"
-// IP/metric[,IP/metric,...]
-#define ZT_NETWORKCONFIG_DICT_KEY_GATEWAYS "gw"
-
-#endif // ZT_SUPPORT_OLD_STYLE_NETCONF
+#define ZT_NETWORKCONFIG_DICT_KEY_RELAYS_OLD "rl"
 
 /**
  * Network configuration received from network controller nodes
@@ -215,6 +228,23 @@ public:
 	}
 
 	/**
+	 * Write this network config to a dictionary for transport
+	 *
+	 * @param d Dictionary
+	 * @param includeLegacy If true, include legacy fields for old node versions
+	 * @return True if dictionary was successfully created, false if e.g. overflow
+	 */
+	bool toDictionary(Dictionary &d,bool includeLegacy) const;
+
+	/**
+	 * Read this network config from a dictionary
+	 *
+	 * @param d Dictionary
+	 * @return True if dictionary was valid and network config successfully initialized
+	 */
+	bool fromDictionary(const Dictionary &d);
+
+	/**
 	 * @return True if passive bridging is allowed (experimental)
 	 */
 	inline bool allowPassiveBridging() const throw() { return ((this->flags & ZT_NETWORKCONFIG_FLAG_ALLOW_PASSIVE_BRIDGING) != 0); }
@@ -350,269 +380,6 @@ public:
 	inline bool operator==(const NetworkConfig &nc) const { return (memcmp(this,&nc,sizeof(NetworkConfig)) == 0); }
 	inline bool operator!=(const NetworkConfig &nc) const { return (!(*this == nc)); }
 
-	template<unsigned int C>
-	inline void serialize(Buffer<C> &b) const
-	{
-		b.append((uint16_t)1); // version
-
-		b.append((uint64_t)networkId);
-		b.append((uint64_t)timestamp);
-		b.append((uint64_t)revision);
-		issuedTo.appendTo(b);
-		b.append((uint64_t)flags);
-		b.append((uint32_t)multicastLimit);
-		b.append((uint8_t)type);
-
-		unsigned int nl = (unsigned int)strlen(name);
-		if (nl > 255) nl = 255; // sanity check
-		b.append((uint8_t)nl);
-		b.append((const void *)name,nl);
-
-		b.append((uint16_t)specialistCount);
-		for(unsigned int i=0;i<specialistCount;++i)
-			b.append((uint64_t)specialists[i]);
-
-		b.append((uint16_t)routeCount);
-		for(unsigned int i=0;i<routeCount;++i) {
-			reinterpret_cast<const InetAddress *>(&(routes[i].target))->serialize(b);
-			reinterpret_cast<const InetAddress *>(&(routes[i].via))->serialize(b);
-			b.append((uint16_t)routes[i].flags);
-			b.append((uint16_t)routes[i].metric);
-		}
-
-		b.append((uint16_t)staticIpCount);
-		for(unsigned int i=0;i<staticIpCount;++i)
-			staticIps[i].serialize(b);
-
-		b.append((uint16_t)pinnedCount);
-		for(unsigned int i=0;i<pinnedCount;++i) {
-			pinned[i].zt.appendTo(b);
-			pinned[i].phy.serialize(b);
-		}
-
-		b.append((uint16_t)ruleCount);
-		for(unsigned int i=0;i<ruleCount;++i) {
-			b.append((uint8_t)rules[i].t);
-			switch((ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f)) {
-				//case ZT_NETWORK_RULE_ACTION_DROP:
-				//case ZT_NETWORK_RULE_ACTION_ACCEPT:
-				default:
-					b.append((uint8_t)0);
-					break;
-				case ZT_NETWORK_RULE_ACTION_TEE:
-				case ZT_NETWORK_RULE_ACTION_REDIRECT:
-				case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
-				case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS:
-					b.append((uint8_t)5);
-					Address(rules[i].v.zt).appendTo(b);
-					break;
-				case ZT_NETWORK_RULE_MATCH_VLAN_ID:
-					b.append((uint8_t)2);
-					b.append((uint16_t)rules[i].v.vlanId);
-					break;
-				case ZT_NETWORK_RULE_MATCH_VLAN_PCP:
-					b.append((uint8_t)1);
-					b.append((uint8_t)rules[i].v.vlanPcp);
-					break;
-				case ZT_NETWORK_RULE_MATCH_VLAN_DEI:
-					b.append((uint8_t)1);
-					b.append((uint8_t)rules[i].v.vlanDei);
-					break;
-				case ZT_NETWORK_RULE_MATCH_ETHERTYPE:
-					b.append((uint8_t)2);
-					b.append((uint16_t)rules[i].v.etherType);
-					break;
-				case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
-				case ZT_NETWORK_RULE_MATCH_MAC_DEST:
-					b.append((uint8_t)6);
-					b.append(rules[i].v.mac,6);
-					break;
-				case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
-				case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
-					b.append((uint8_t)5);
-					b.append(&(rules[i].v.ipv4.ip),4);
-					b.append((uint8_t)rules[i].v.ipv4.mask);
-					break;
-				case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
-				case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
-					b.append((uint8_t)17);
-					b.append(rules[i].v.ipv6.ip,16);
-					b.append((uint8_t)rules[i].v.ipv6.mask);
-					break;
-				case ZT_NETWORK_RULE_MATCH_IP_TOS:
-					b.append((uint8_t)1);
-					b.append((uint8_t)rules[i].v.ipTos);
-					break;
-				case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:
-					b.append((uint8_t)1);
-					b.append((uint8_t)rules[i].v.ipProtocol);
-					break;
-				case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:
-				case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:
-					b.append((uint8_t)4);
-					b.append((uint16_t)rules[i].v.port[0]);
-					b.append((uint16_t)rules[i].v.port[1]);
-					break;
-				case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
-					b.append((uint8_t)8);
-					b.append((uint64_t)rules[i].v.characteristics);
-					break;
-				case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
-					b.append((uint8_t)4);
-					b.append((uint16_t)rules[i].v.frameSize[0]);
-					b.append((uint16_t)rules[i].v.frameSize[1]);
-					break;
-				case ZT_NETWORK_RULE_MATCH_TCP_RELATIVE_SEQUENCE_NUMBER_RANGE:
-					b.append((uint8_t)8);
-					b.append((uint32_t)rules[i].v.tcpseq[0]);
-					b.append((uint32_t)rules[i].v.tcpseq[1]);
-					break;
-			}
-		}
-
-		this->com.serialize(b);
-
-		b.append((uint16_t)0); // extended bytes, currently 0 since unused
-	}
-
-	template<unsigned int C>
-	inline unsigned int deserialize(const Buffer<C> &b,unsigned int startAt = 0)
-	{
-		memset(this,0,sizeof(NetworkConfig));
-
-		unsigned int p = startAt;
-
-		if (b.template at<uint16_t>(p) != 1)
-			throw std::invalid_argument("unrecognized version");
-		p += 2;
-
-		networkId = b.template at<uint64_t>(p); p += 8;
-		timestamp = b.template at<uint64_t>(p); p += 8;
-		revision = b.template at<uint64_t>(p); p += 8;
-		issuedTo.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH;
-		flags = b.template at<uint64_t>(p); p += 8;
-		multicastLimit = (unsigned int)b.template at<uint32_t>(p); p += 4;
-		type = (ZT_VirtualNetworkType)b[p++];
-
-		unsigned int nl = (unsigned int)b[p++];
-		memcpy(this->name,b.field(p,nl),std::min(nl,(unsigned int)ZT_MAX_NETWORK_SHORT_NAME_LENGTH));
-		p += nl;
-		// _name will always be null terminated since field size is ZT_MAX_NETWORK_SHORT_NAME_LENGTH + 1
-
-		specialistCount = (unsigned int)b.template at<uint16_t>(p); p += 2;
-		if (specialistCount > ZT_MAX_NETWORK_SPECIALISTS)
-			throw std::invalid_argument("overflow (specialists)");
-		for(unsigned int i=0;i<specialistCount;++i) {
-			specialists[i] = b.template at<uint64_t>(p); p += 8;
-		}
-
-		routeCount = (unsigned int)b.template at<uint16_t>(p); p += 2;
-		if (routeCount > ZT_MAX_NETWORK_ROUTES)
-			throw std::invalid_argument("overflow (routes)");
-		for(unsigned int i=0;i<routeCount;++i) {
-			p += reinterpret_cast<InetAddress *>(&(routes[i].target))->deserialize(b,p);
-			p += reinterpret_cast<InetAddress *>(&(routes[i].via))->deserialize(b,p);
-			routes[i].flags = b.template at<uint16_t>(p); p += 2;
-			routes[i].metric = b.template at<uint16_t>(p); p += 2;
-		}
-
-		staticIpCount = (unsigned int)b.template at<uint16_t>(p); p += 2;
-		if (staticIpCount > ZT_MAX_ZT_ASSIGNED_ADDRESSES)
-			throw std::invalid_argument("overflow (static IPs)");
-		for(unsigned int i=0;i<staticIpCount;++i) {
-			p += staticIps[i].deserialize(b,p);
-		}
-
-		pinnedCount = (unsigned int)b.template at<uint16_t>(p); p += 2;
-		if (pinnedCount > ZT_MAX_NETWORK_PINNED)
-			throw std::invalid_argument("overflow (static addresses)");
-		for(unsigned int i=0;i<pinnedCount;++i) {
-			pinned[i].zt.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH); p += ZT_ADDRESS_LENGTH;
-			p += pinned[i].phy.deserialize(b,p);
-		}
-
-		ruleCount = (unsigned int)b.template at<uint16_t>(p); p += 2;
-		if (ruleCount > ZT_MAX_NETWORK_RULES)
-			throw std::invalid_argument("overflow (rules)");
-		for(unsigned int i=0;i<ruleCount;++i) {
-			rules[i].t = (uint8_t)b[p++];
-			unsigned int rlen = (unsigned int)b[p++];
-			switch((ZT_VirtualNetworkRuleType)(rules[i].t & 0x7f)) {
-				//case ZT_NETWORK_RULE_ACTION_DROP:
-				//case ZT_NETWORK_RULE_ACTION_ACCEPT:
-				default:
-					break;
-				case ZT_NETWORK_RULE_ACTION_TEE:
-				case ZT_NETWORK_RULE_ACTION_REDIRECT:
-				case ZT_NETWORK_RULE_MATCH_SOURCE_ZEROTIER_ADDRESS:
-				case ZT_NETWORK_RULE_MATCH_DEST_ZEROTIER_ADDRESS: {
-					Address tmp;
-					tmp.setTo(b.field(p,ZT_ADDRESS_LENGTH),ZT_ADDRESS_LENGTH);
-					rules[i].v.zt = tmp.toInt();
-				}	break;
-				case ZT_NETWORK_RULE_MATCH_VLAN_ID:
-					rules[i].v.vlanId = b.template at<uint16_t>(p);
-					break;
-				case ZT_NETWORK_RULE_MATCH_VLAN_PCP:
-					rules[i].v.vlanPcp = (uint8_t)b[p];
-					break;
-				case ZT_NETWORK_RULE_MATCH_VLAN_DEI:
-					rules[i].v.vlanDei = (uint8_t)b[p];
-					break;
-				case ZT_NETWORK_RULE_MATCH_ETHERTYPE:
-					rules[i].v.etherType = b.template at<uint16_t>(p);
-					break;
-				case ZT_NETWORK_RULE_MATCH_MAC_SOURCE:
-				case ZT_NETWORK_RULE_MATCH_MAC_DEST:
-					memcpy(rules[i].v.mac,b.field(p,6),6);
-					break;
-				case ZT_NETWORK_RULE_MATCH_IPV4_SOURCE:
-				case ZT_NETWORK_RULE_MATCH_IPV4_DEST:
-					memcpy(&(rules[i].v.ipv4.ip),b.field(p,4),4);
-					rules[i].v.ipv4.mask = (uint8_t)b[p+4];
-					break;
-				case ZT_NETWORK_RULE_MATCH_IPV6_SOURCE:
-				case ZT_NETWORK_RULE_MATCH_IPV6_DEST:
-					memcpy(rules[i].v.ipv6.ip,b.field(p,16),16);
-					rules[i].v.ipv6.mask = (uint8_t)b[p+16];
-					break;
-				case ZT_NETWORK_RULE_MATCH_IP_TOS:
-					rules[i].v.ipTos = (uint8_t)b[p];
-					break;
-				case ZT_NETWORK_RULE_MATCH_IP_PROTOCOL:
-					rules[i].v.ipProtocol = (uint8_t)b[p];
-					break;
-				case ZT_NETWORK_RULE_MATCH_IP_SOURCE_PORT_RANGE:
-				case ZT_NETWORK_RULE_MATCH_IP_DEST_PORT_RANGE:
-					rules[i].v.port[0] = b.template at<uint16_t>(p);
-					rules[i].v.port[1] = b.template at<uint16_t>(p+2);
-					break;
-				case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
-					rules[i].v.characteristics = b.template at<uint64_t>(p);
-					break;
-				case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
-					rules[i].v.frameSize[0] = b.template at<uint16_t>(p);
-					rules[i].v.frameSize[1] = b.template at<uint16_t>(p+2);
-					break;
-				case ZT_NETWORK_RULE_MATCH_TCP_RELATIVE_SEQUENCE_NUMBER_RANGE:
-					rules[i].v.tcpseq[0] = b.template at<uint32_t>(p);
-					rules[i].v.tcpseq[1] = b.template at<uint32_t>(p + 4);
-					break;
-			}
-			p += rlen;
-		}
-
-		p += this->com.deserialize(b,p);
-
-		p += b.template at<uint16_t>(p) + 2;
-
-		return (p - startAt);
-	}
-
-#ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
-	void fromDictionary(const char *ds,unsigned int dslen);
-#endif
-
 	/*
 	inline void dump() const
 	{
@@ -629,6 +396,8 @@ public:
 		for(unsigned int i=0;i<routeCount;++i) {
 			printf("  routes[i].target==%s\n",reinterpret_cast<const struct sockaddr_storage *>(&(routes[i].target))->toString().c_str());
 			printf("  routes[i].via==%s\n",reinterpret_cast<const struct sockaddr_storage *>(&(routes[i].via))->toIpString().c_str());
+			printf("  routes[i].flags==%.4x\n",(unsigned int)routes[i].flags);
+			printf("  routes[i].metric==%u\n",(unsigned int)routes[i].metric);
 		}
 		printf("staticIpCount==%u\n",staticIpCount);
 		for(unsigned int i=0;i<staticIpCount;++i)
@@ -645,6 +414,32 @@ public:
 	*/
 
 	/**
+	 * Add a specialist or mask flags if already present
+	 *
+	 * This masks the existing flags if the specialist is already here or adds
+	 * it otherwise.
+	 *
+	 * @param a Address of specialist
+	 * @param f Flags (OR of specialist role/type flags)
+	 * @return True if successfully masked or added
+	 */
+	inline bool addSpecialist(const Address &a,const uint64_t f)
+	{
+		const uint64_t aint = a.toInt();
+		for(unsigned int i=0;i<specialistCount;++i) {
+			if ((specialists[i] & 0xffffffffffULL) == aint) {
+				specialists[i] |= f;
+				return true;
+			}
+		}
+		if (specialistCount >= ZT_MAX_NETWORK_SPECIALISTS) {
+			specialists[specialistCount++] = f | aint;
+			return true;
+		}
+		return false;
+	}
+
+	/**
 	 * Network ID that this configuration applies to
 	 */
 	uint64_t networkId;
diff --git a/node/NetworkConfigRequestMetaData.hpp b/node/NetworkConfigRequestMetaData.hpp
deleted file mode 100644
index 2516e5e0..00000000
--- a/node/NetworkConfigRequestMetaData.hpp
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * ZeroTier One - Network Virtualization Everywhere
- * Copyright (C) 2011-2016  ZeroTier, Inc.  https://www.zerotier.com/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef ZT_NETWORKCONFIGREQUESTMETADATA_HPP
-#define ZT_NETWORKCONFIGREQUESTMETADATA_HPP
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "Constants.hpp"
-#include "NetworkConfig.hpp"
-#include "Buffer.hpp"
-#include "Packet.hpp"
-
-#include "../version.h"
-
-/**
- * Maximum length of the auth field (including terminating NULL, since it's a C-style string)
- *
- * Actual max length not including NULL is this minus one.
- */
-#define ZT_NETWORK_CONFIG_REQUEST_METADATA_MAX_AUTH_LENGTH 2048
-
-namespace ZeroTier {
-
-/**
- * Network configuration request meta data
- */
-class NetworkConfigRequestMetaData
-{
-public:
-	/**
-	 * Construct an empty meta-data object with zero/null values
-	 */
-	NetworkConfigRequestMetaData()
-	{
-		memset(this,0,sizeof(NetworkConfigRequestMetaData));
-	}
-
-	/**
-	 * Initialize with defaults from this node's config and version
-	 */
-	inline void initWithDefaults()
-	{
-		memset(this,0,sizeof(NetworkConfigRequestMetaData));
-		vendor = ZT_VENDOR_ZEROTIER;
-		platform = ZT_PLATFORM_UNSPECIFIED;
-		architecture = ZT_ARCHITECTURE_UNSPECIFIED;
-		majorVersion = ZEROTIER_ONE_VERSION_MAJOR;
-		minorVersion = ZEROTIER_ONE_VERSION_MINOR;
-		revision = ZEROTIER_ONE_VERSION_REVISION;
-		protocolVersion = ZT_PROTO_VERSION;
-	}
-
-	/**
-	 * Zero/null everything
-	 */
-	inline void clear()
-	{
-		memset(this,0,sizeof(NetworkConfigRequestMetaData));
-	}
-
-	template<unsigned int C>
-	inline void serialize(Buffer<C> &b) const
-	{
-		/* Unlike network config we always send the old fields. Newer network
-		 * controllers will detect the presence of the new serialized data by
-		 * detecting extra data after the terminating NULL. But always sending
-		 * these maintains backward compatibility with old controllers. This
-		 * appends a terminating NULL which seperates the old legacy meta-data
-		 * from the new packed binary format that we send after. */
-		b.appendCString("majv=" ZEROTIER_ONE_VERSION_MAJOR_S_HEX "\nminv=" ZEROTIER_ONE_VERSION_MINOR_S_HEX "\nrevv=" ZEROTIER_ONE_VERSION_REVISION_S_HEX "\n");
-
-		b.append((uint16_t)1); // serialization version
-
-		b.append((uint64_t)buildId);
-		b.append((uint64_t)flags);
-		b.append((uint16_t)vendor);
-		b.append((uint16_t)platform);
-		b.append((uint16_t)architecture);
-		b.append((uint16_t)majorVersion);
-		b.append((uint16_t)minorVersion);
-		b.append((uint16_t)revision);
-		b.append((uint16_t)protocolVersion);
-
-		const unsigned int tl = strlen(auth);
-		b.append((uint16_t)tl);
-		b.append((const void *)auth,tl);
-
-		b.append((uint16_t)0); // extended bytes, currently 0 since unused
-	}
-
-	template<unsigned int C>
-	inline unsigned int deserialize(const Buffer<C> &b,unsigned int startAt = 0)
-	{
-		memset(this,0,sizeof(NetworkConfigRequestMetaData));
-
-		unsigned int p = startAt;
-
-		// Seek past old style meta-data
-		while (b[p]) ++p;
-		++p;
-
-		if (b.template at<uint16_t>(p) != 1)
-			throw std::invalid_argument("unrecognized version");
-		p += 2;
-
-		buildId = b.template at<uint64_t>(p); p += 8;
-		flags = b.template at<uint64_t>(p); p += 8;
-		vendor = (ZT_Vendor)b.template at<uint16_t>(p); p += 2;
-		platform = (ZT_Platform)b.template at<uint16_t>(p); p += 2;
-		architecture = (ZT_Architecture)b.template at<uint16_t>(p); p += 2;
-		majorVersion = b.template at<uint16_t>(p); p += 2;
-		minorVersion = b.template at<uint16_t>(p); p += 2;
-		revision = b.template at<uint16_t>(p); p += 2;
-		protocolVersion = b.template at<uint16_t>(p); p += 2;
-
-		const unsigned int tl = b.template at<uint16_t>(p); p += 2;
-		memcpy(auth,b.field(p,tl),std::max(tl,(unsigned int)(ZT_NETWORK_CONFIG_REQUEST_METADATA_MAX_AUTH_LENGTH - 1)));
-		p += tl;
-
-		p += b.template at<uint16_t>(p) + 2;
-
-		return (p - startAt);
-	}
-
-	/**
-	 * Authentication data (e.g. bearer=<token>) as a C-style string (always null terminated)
-	 */
-	char auth[ZT_NETWORK_CONFIG_REQUEST_METADATA_MAX_AUTH_LENGTH];
-
-	/**
-	 * Build ID (currently unused, must be 0)
-	 */
-	uint64_t buildId;
-
-	/**
-	 * Flags (currently unused, must be 0)
-	 */
-	uint64_t flags;
-
-	/**
-	 * ZeroTier vendor or 0 for unspecified
-	 */
-	ZT_Vendor vendor;
-
-	/**
-	 * ZeroTier platform or 0 for unspecified
-	 */
-	ZT_Platform platform;
-
-	/**
-	 * ZeroTier architecture or 0 for unspecified
-	 */
-	ZT_Architecture architecture;
-
-	/**
-	 * ZeroTier software major version
-	 */
-	unsigned int majorVersion;
-
-	/**
-	 * ZeroTier software minor version
-	 */
-	unsigned int minorVersion;
-
-	/**
-	 * ZeroTier software revision
-	 */
-	unsigned int revision;
-
-	/**
-	 * ZeroTier protocol version
-	 */
-	unsigned int protocolVersion;
-};
-
-} // namespace ZeroTier
-
-#endif
diff --git a/node/NetworkController.hpp b/node/NetworkController.hpp
index 4ab6403a..b91ada1b 100644
--- a/node/NetworkController.hpp
+++ b/node/NetworkController.hpp
@@ -22,15 +22,15 @@
 #include <stdint.h>
 
 #include "Constants.hpp"
-#include "InetAddress.hpp"
-#include "Address.hpp"
-#include "Identity.hpp"
-#include "NetworkConfigRequestMetaData.hpp"
-#include "Buffer.hpp"
 
 namespace ZeroTier {
 
 class RuntimeEnvironment;
+class NetworkConfig;
+class Dictionary;
+class Identity;
+class Address;
+struct InetAddress;
 
 /**
  * Interface for network controller implementations
@@ -67,16 +67,16 @@ public:
 	 * @param identity Originating peer ZeroTier identity
 	 * @param nwid 64-bit network ID
 	 * @param metaData Meta-data bundled with request (if any)
-	 * @param result Buffer to receive serialized network configuration data (any existing data in buffer is preserved)
-	 * @return Returns NETCONF_QUERY_OK if result dictionary is valid, or an error code on error
+	 * @param nc NetworkConfig to fill with results
+	 * @return Returns NETCONF_QUERY_OK if result 'nc' is valid, or an error code on error
 	 */
 	virtual NetworkController::ResultCode doNetworkConfigRequest(
 		const InetAddress &fromAddr,
 		const Identity &signingId,
 		const Identity &identity,
 		uint64_t nwid,
-		const NetworkConfigRequestMetaData &metaData,
-		Buffer<8194> &result) = 0;
+		const Dictionary &metaData,
+		NetworkConfig &nc) = 0;
 };
 
 } // namespace ZeroTier
diff --git a/node/Utils.cpp b/node/Utils.cpp
index 00aeea33..2d9515ee 100644
--- a/node/Utils.cpp
+++ b/node/Utils.cpp
@@ -262,6 +262,24 @@ std::vector<std::string> Utils::split(const char *s,const char *const sep,const
 	return fields;
 }
 
+bool Utils::scopy(char *dest,unsigned int len,const char *src)
+{
+	if (!len)
+		return false; // sanity check
+	if (!src) {
+		*dest = (char)0;
+		return true;
+	}
+	char *end = dest + len;
+	while ((*dest++ = *src++)) {
+		if (dest == end) {
+			*(--dest) = (char)0;
+			return false;
+		}
+	}
+	return true;
+}
+
 unsigned int Utils::snprintf(char *buf,unsigned int len,const char *fmt,...)
 	throw(std::length_error)
 {
diff --git a/node/Utils.hpp b/node/Utils.hpp
index 04838f1c..cfe56501 100644
--- a/node/Utils.hpp
+++ b/node/Utils.hpp
@@ -49,7 +49,6 @@ public:
 	 * @return True if strings are equal
 	 */
 	static inline bool secureEq(const void *a,const void *b,unsigned int len)
-		throw()
 	{
 		uint8_t diff = 0;
 		for(unsigned int i=0;i<len;++i)
@@ -235,23 +234,7 @@ public:
 	 * @param src Source string (if NULL, dest will receive a zero-length string and true is returned)
 	 * @return True on success, false on overflow (buffer will still be 0-terminated)
 	 */
-	static inline bool scopy(char *dest,unsigned int len,const char *src)
-	{
-		if (!len)
-			return false; // sanity check
-		if (!src) {
-			*dest = (char)0;
-			return true;
-		}
-		char *end = dest + len;
-		while ((*dest++ = *src++)) {
-			if (dest == end) {
-				*(--dest) = (char)0;
-				return false;
-			}
-		}
-		return true;
-	}
+	static bool scopy(char *dest,unsigned int len,const char *src);
 
 	/**
 	 * Variant of snprintf that is portable and throws an exception
@@ -275,7 +258,6 @@ public:
 	 * @return Number of bits set in this integer (0-32)
 	 */
 	static inline uint32_t countBits(uint32_t v)
-		throw()
 	{
 		v = v - ((v >> 1) & (uint32_t)0x55555555);
 		v = (v & (uint32_t)0x33333333) + ((v >> 2) & (uint32_t)0x33333333);
@@ -290,7 +272,6 @@ public:
 	 * @return True if memory is all zero
 	 */
 	static inline bool isZero(const void *p,unsigned int len)
-		throw()
 	{
 		for(unsigned int i=0;i<len;++i) {
 			if (((const unsigned char *)p)[i])
diff --git a/selftest.cpp b/selftest.cpp
index 33ec9e40..9e6e077a 100644
--- a/selftest.cpp
+++ b/selftest.cpp
@@ -766,23 +766,45 @@ static int testOther()
 
 	std::cout << "[other] Testing Dictionary... "; std::cout.flush();
 	for(int k=0;k<1000;++k) {
-		Dictionary a,b;
-		int nk = rand() % 32;
-		for(int q=0;q<nk;++q) {
-			std::string k,v;
-			int kl = (rand() % 512);
-			int vl = (rand() % 512);
-			for(int i=0;i<kl;++i)
-				k.push_back((char)rand());
-			for(int i=0;i<vl;++i)
-				v.push_back((char)rand());
-			a[k] = v;
+		Dictionary td;
+		char key[128][16];
+		char value[128][128];
+		for(unsigned int q=0;q<128;++q) {
+			Utils::snprintf(key[q],16,"%.8lx",(unsigned long)rand());
+			int r = rand() % 128;
+			for(int x=0;x<r;++x)
+				value[q][x] = ("0123456789\0\t\r\n= ")[rand() % 16];
+			value[q][r] = (char)0;
+			test.set(key[q],value[q]);
 		}
-		std::string aser = a.toString();
-		b.fromString(aser);
-		if (a != b) {
-			std::cout << "FAIL!" << std::endl;
-			return -1;
+		for(unsigned int q=0;q<1024;++q) {
+			int r = rand() % 128;
+			char tmp[128];
+			if (test.get(key[r],tmp,sizeof(tmp)) >= 0) {
+				if (strcmp(value[r],tmp)) {
+					std::cout << "FAILED (invalid value)!" << std::endl;
+					return -1;
+				}
+			} else {
+				std::cout << "FAILED (can't find key)!" << std::endl;
+				return -1;
+			}
+		}
+	}
+	int foo = 0;
+	volatile int *volatile bar = &foo; // force compiler not to optimize out test.get() below
+	for(int k=0;k<100000;++k) {
+		int r = rand() % 16384;
+		unsigned char tmp[16384];
+		for(int q=0;q<r;++q)
+			tmp[q] = (unsigned char)((rand() % 254) + 1);
+		tmp[r] = 0;
+		Dictionary test(tmp);
+		for(unsigned int q=0;q<1024;++q) {
+			char tmp[16];
+			Utils::snprintf(tmp,16,"%.8lx",(unsigned long)rand());
+			char value[128];
+			*bar = test.get(tmp,value,sizeof(value));
 		}
 	}
 	std::cout << "PASS" << std::endl;
diff --git a/version.h b/version.h
index 526a3cd9..62045ed8 100644
--- a/version.h
+++ b/version.h
@@ -23,18 +23,15 @@
  * Major version
  */
 #define ZEROTIER_ONE_VERSION_MAJOR 1
-#define ZEROTIER_ONE_VERSION_MAJOR_S_HEX "1"
 
 /**
  * Minor version
  */
 #define ZEROTIER_ONE_VERSION_MINOR 1
-#define ZEROTIER_ONE_VERSION_MINOR_S_HEX "1"
 
 /**
  * Revision
  */
 #define ZEROTIER_ONE_VERSION_REVISION 5
-#define ZEROTIER_ONE_VERSION_REVISION_S_HEX "5"
 
 #endif