Forgot one spot.

go/pkg/zerotier/api.go

@@ -456,11 +456,15 @@ func createAPIServer(basePath string, node *Node) (*http.Server, *http.Server, e
 			if apiReadObj(out, req, &nw) == nil {
 				n := node.GetNetwork(nw.ID)
 				if n == nil {
-					n, err := node.Join(nw.ID, nw.Settings, nil)
-					if err != nil {
-						_ = apiSendObj(out, req, http.StatusBadRequest, &APIErr{"only individual networks can be added or modified with POST/PUT"})
+					if nw.ControllerFingerprint != nil && nw.ControllerFingerprint.Address != nw.ID.Controller() {
+						_ = apiSendObj(out, req, http.StatusBadRequest, &APIErr{"fingerprint's address does not match what should be the controller's address"})
 					} else {
-						_ = apiSendObj(out, req, http.StatusOK, apiNetworkFromNetwork(n))
+						n, err := node.Join(nw.ID, nw.ControllerFingerprint, nw.Settings, nil)
+						if err != nil {
+							_ = apiSendObj(out, req, http.StatusBadRequest, &APIErr{"only individual networks can be added or modified with POST/PUT"})
+						} else {
+							_ = apiSendObj(out, req, http.StatusOK, apiNetworkFromNetwork(n))
+						}
 					}
 				} else {
 					if nw.Settings != nil {

go/pkg/zerotier/network.go

@@ -43,6 +43,11 @@ func NewNetworkIDFromBytes(b []byte) (NetworkID, error) {
 	return NetworkID(binary.BigEndian.Uint64(b)), nil
 }
 
+// Controller gets the Address of this network's controller.
+func (n NetworkID) Controller() Address {
+	return Address(uint64(n) >> 24)
+}
+
 // String returns this network ID's 16-digit hex identifier
 func (n NetworkID) String() string {
 	return fmt.Sprintf("%.16x", uint64(n))