Add Windows platform support (#45)

Gate platform-specific code behind cfg attributes and add full Windows
  support: TUN device via wintun, TCP control socket on localhost:21210,
  Windows Service lifecycle (--install-service/--uninstall-service/--service),
  CI build and test matrix, and packaging with ZIP builder and PowerShell
  service management scripts.

  Key changes:

  - Cargo.toml: move tun/libc/rtnetlink behind cfg(unix); add wintun and
    windows-service dependencies for Windows
  - upper/tun.rs: wintun-based TUN implementation with netsh configuration
    for IPv6 address, MTU, and fd00::/8 routing
  - control/mod.rs: split into unix_impl/windows_impl; Windows uses TCP on
    localhost:21210 with shared connection handler
  - bin/fips.rs: refactor main() into run_daemon() accepting a shutdown
    signal; add Windows Service support via windows-service crate
  - transport/udp/socket.rs: platform-gated modules; Windows uses
    tokio::net::UdpSocket (kernel drop count unavailable, returns 0)
  - transport/ethernet: gate to cfg(unix); add Windows stub types
  - config: platform-conditional default paths (socket, hosts) for Windows
  - CI: add windows-latest to build matrix and test-windows job with
    cargo-nextest
  - packaging/windows: build-zip.ps1, install-service.ps1,
    uninstall-service.ps1, and package-windows.yml workflow
  - README/docs: Windows build instructions, service management, and
    control socket platform differences

  Linux and macOS behavior is unchanged.

packaging/Makefile

@@ -9,6 +9,7 @@
 #   make ipk        Build an OpenWrt .ipk package
 #   make aur        Build fips-git AUR package and validate with namcap
 #   make pkg        Build a macOS .pkg installer
+#   make zip        Build a Windows .zip package
 #   make all        Build deb and tarball (default)
 #   make clean      Remove deploy/ directory
 
@@ -16,7 +17,7 @@ SHELL := /bin/bash
 PACKAGING_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 PROJECT_ROOT  := $(abspath $(PACKAGING_DIR)/..)
 
-.PHONY: all deb tarball ipk aur pkg clean
+.PHONY: all deb tarball ipk aur pkg zip clean
 
 all: deb tarball
 
@@ -35,5 +36,8 @@ aur:
 pkg:
 	@bash $(PACKAGING_DIR)/macos/build-pkg.sh
 
+zip:
+	@powershell -File $(PACKAGING_DIR)/windows/build-zip.ps1
+
 clean:
 	rm -rf $(PROJECT_ROOT)/deploy

packaging/README.md

@@ -11,6 +11,7 @@ make tarball    # systemd install tarball
 make ipk        # OpenWrt .ipk
 make aur        # Arch Linux AUR package (fips-git, local build + namcap)
 make pkg        # macOS .pkg installer
+make zip        # Windows .zip package
 make all        # deb + tarball (default)
 ```
 
@@ -24,6 +25,7 @@ packaging/
   macos/          macOS .pkg installer via pkgbuild
   systemd/        Generic Linux systemd tarball packaging
   openwrt/        OpenWrt .ipk packaging via cargo-zigbuild
+  windows/        Windows .zip package with service scripts
 ```
 
 ## Formats
@@ -101,6 +103,31 @@ sudo installer -pkg deploy/fips-<version>-macos-<arch>.pkg -target /
 sudo packaging/macos/uninstall.sh
 ```
 
+### Windows (`.zip`)
+
+A ZIP archive containing binaries, default config, and PowerShell
+service helper scripts. Requires the [wintun](https://www.wintun.net/)
+driver for TUN support.
+
+```powershell
+# Build
+make zip
+
+# Or directly
+powershell -File packaging/windows/build-zip.ps1
+
+# Extract and install as service (requires Administrator)
+Expand-Archive deploy\fips-<version>-windows-x86_64.zip -DestinationPath fips
+cd fips
+powershell -File install-service.ps1
+
+# Uninstall (preserves config)
+powershell -File uninstall-service.ps1
+
+# Uninstall and remove config
+powershell -File uninstall-service.ps1 -RemoveAll
+```
+
 ### Arch Linux (AUR)
 
 Two AUR packages are maintained: `fips` (release, builds from tagged

packaging/windows/build-zip.ps1

@@ -0,0 +1,120 @@
+# Build a Windows ZIP package for FIPS.
+#
+# Usage: powershell -File packaging/windows/build-zip.ps1 [-Version <version>] [-NoBuild]
+# Output: deploy/fips-<version>-windows-x86_64.zip
+#
+# Prerequisites: Rust toolchain installed
+
+param(
+    [string]$Version = "",
+    [switch]$NoBuild
+)
+
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$PackagingDir = Split-Path -Parent $ScriptDir
+$ProjectRoot = Split-Path -Parent $PackagingDir
+
+# Derive version from Cargo.toml if not provided
+if (-not $Version) {
+    $cargoToml = Get-Content "$ProjectRoot\Cargo.toml" -Raw
+    if ($cargoToml -match 'version\s*=\s*"([^"]+)"') {
+        $Version = $Matches[1]
+    } else {
+        Write-Error "Could not determine version from Cargo.toml"
+        exit 1
+    }
+}
+
+$Arch = "x86_64"
+$PkgName = "fips-$Version-windows-$Arch"
+$DeployDir = "$ProjectRoot\deploy"
+$StagingDir = "$env:TEMP\fips-staging-$([guid]::NewGuid().ToString('N'))"
+$BinaryDir = "$ProjectRoot\target\release"
+
+Write-Host "Building FIPS v$Version for Windows $Arch..."
+
+# Build release binaries
+if (-not $NoBuild) {
+    Push-Location $ProjectRoot
+    cargo build --release --no-default-features --features tui
+    if ($LASTEXITCODE -ne 0) {
+        Write-Error "cargo build failed"
+        exit 1
+    }
+    Pop-Location
+}
+
+# Verify binaries exist
+$Binaries = @("fips.exe", "fipsctl.exe", "fipstop.exe")
+foreach ($bin in $Binaries) {
+    if (-not (Test-Path "$BinaryDir\$bin")) {
+        Write-Error "Missing binary: $BinaryDir\$bin"
+        exit 1
+    }
+}
+
+# Create staging directory
+New-Item -ItemType Directory -Force -Path $StagingDir | Out-Null
+
+# Copy binaries
+foreach ($bin in $Binaries) {
+    Copy-Item "$BinaryDir\$bin" "$StagingDir\$bin"
+}
+
+# Copy config
+Copy-Item "$PackagingDir\common\fips.yaml" "$StagingDir\fips.yaml"
+Copy-Item "$PackagingDir\common\hosts" "$StagingDir\hosts"
+
+# Copy helper scripts
+Copy-Item "$ScriptDir\install-service.ps1" "$StagingDir\install-service.ps1"
+Copy-Item "$ScriptDir\uninstall-service.ps1" "$StagingDir\uninstall-service.ps1"
+
+# Create README
+@"
+FIPS v$Version for Windows
+==========================
+
+Quick Start (foreground mode):
+  .\fips.exe -c fips.yaml
+
+Windows Service:
+  # Install (requires Administrator)
+  powershell -File install-service.ps1
+
+  # Manage
+  sc start fips
+  sc stop fips
+
+  # Uninstall
+  powershell -File uninstall-service.ps1
+
+TUN Support:
+  Download wintun.dll from https://www.wintun.net/ and place it
+  in the same directory as fips.exe. Running the daemon requires
+  Administrator privileges for TUN creation.
+
+Control Socket:
+  The control socket uses TCP on localhost:21210.
+  fipsctl and fipstop connect to this port automatically.
+
+Configuration:
+  Edit fips.yaml before starting. Place it in the same directory
+  as fips.exe, or in %APPDATA%\fips\, or set FIPS_CONFIG.
+"@ | Out-File -FilePath "$StagingDir\README.txt" -Encoding UTF8
+
+# Create ZIP
+New-Item -ItemType Directory -Force -Path $DeployDir | Out-Null
+$ZipPath = "$DeployDir\$PkgName.zip"
+if (Test-Path $ZipPath) { Remove-Item $ZipPath }
+Compress-Archive -Path "$StagingDir\*" -DestinationPath $ZipPath
+
+# Cleanup
+Remove-Item -Recurse -Force $StagingDir
+
+Write-Host ""
+Write-Host "Package built: deploy\$PkgName.zip"
+Write-Host "  Size: $([math]::Round((Get-Item $ZipPath).Length / 1MB, 2)) MB"
+Write-Host ""
+Write-Host "Extract and run: .\fips.exe -c fips.yaml"

packaging/windows/install-service.ps1

@@ -0,0 +1,89 @@
+# Install FIPS as a Windows service.
+#
+# Usage: powershell -File install-service.ps1
+# Requires: Administrator privileges
+
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+# Check for admin
+$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Error "This script requires Administrator privileges. Right-click PowerShell and select 'Run as Administrator'."
+    exit 1
+}
+
+$InstallDir = "$env:ProgramFiles\fips"
+$ConfigDir = "$env:ProgramData\fips"
+
+Write-Host "Installing FIPS service..."
+
+# Create directories
+New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null
+New-Item -ItemType Directory -Force -Path $ConfigDir | Out-Null
+
+# Copy binaries
+$Binaries = @("fips.exe", "fipsctl.exe", "fipstop.exe")
+foreach ($bin in $Binaries) {
+    $src = "$ScriptDir\$bin"
+    if (Test-Path $src) {
+        Copy-Item $src "$InstallDir\$bin" -Force
+        Write-Host "  Installed $bin"
+    } else {
+        Write-Warning "Missing $bin in $ScriptDir"
+    }
+}
+
+# Copy wintun.dll if present
+if (Test-Path "$ScriptDir\wintun.dll") {
+    Copy-Item "$ScriptDir\wintun.dll" "$InstallDir\wintun.dll" -Force
+    Write-Host "  Installed wintun.dll"
+}
+
+# Install config (preserve existing)
+if (-not (Test-Path "$ConfigDir\fips.yaml")) {
+    if (Test-Path "$ScriptDir\fips.yaml") {
+        Copy-Item "$ScriptDir\fips.yaml" "$ConfigDir\fips.yaml"
+        Write-Host "  Installed default config"
+    }
+} else {
+    Write-Host "  Config already exists, preserving"
+}
+
+if (-not (Test-Path "$ConfigDir\hosts")) {
+    if (Test-Path "$ScriptDir\hosts") {
+        Copy-Item "$ScriptDir\hosts" "$ConfigDir\hosts"
+    }
+}
+
+# Set FIPS_CONFIG environment variable (machine-wide)
+[Environment]::SetEnvironmentVariable("FIPS_CONFIG", "$ConfigDir\fips.yaml", "Machine")
+Write-Host "  Set FIPS_CONFIG=$ConfigDir\fips.yaml"
+
+# Add install dir to system PATH if not already there
+$machinePath = [Environment]::GetEnvironmentVariable("Path", "Machine")
+if ($machinePath -notlike "*$InstallDir*") {
+    [Environment]::SetEnvironmentVariable("Path", "$machinePath;$InstallDir", "Machine")
+    Write-Host "  Added $InstallDir to system PATH"
+}
+
+# Install the service (run from install dir so current_exe() points to the right path)
+Write-Host "  Registering Windows service..."
+Push-Location $InstallDir
+& "$InstallDir\fips.exe" --install-service
+$exitCode = $LASTEXITCODE
+Pop-Location
+if ($exitCode -ne 0) {
+    Write-Error "Failed to install service"
+    exit 1
+}
+
+Write-Host ""
+Write-Host "FIPS service installed successfully."
+Write-Host ""
+Write-Host "Edit config:  notepad $ConfigDir\fips.yaml"
+Write-Host "Start:        sc start fips"
+Write-Host "Stop:         sc stop fips"
+Write-Host "Status:       sc query fips"
+Write-Host "Uninstall:    powershell -File uninstall-service.ps1"

packaging/windows/uninstall-service.ps1

@@ -0,0 +1,73 @@
+# Uninstall the FIPS Windows service.
+#
+# Usage: powershell -File uninstall-service.ps1 [-RemoveAll]
+# Requires: Administrator privileges
+#
+# By default preserves config in %ProgramData%\fips\.
+# Pass -RemoveAll to remove config and identity keys too.
+
+param(
+    [switch]$RemoveAll
+)
+
+$ErrorActionPreference = "Stop"
+
+# Check for admin
+$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Error "This script requires Administrator privileges. Right-click PowerShell and select 'Run as Administrator'."
+    exit 1
+}
+
+$InstallDir = "$env:ProgramFiles\fips"
+$ConfigDir = "$env:ProgramData\fips"
+
+Write-Host "Uninstalling FIPS service..."
+
+# Stop the service if running
+$svc = Get-Service -Name "fips" -ErrorAction SilentlyContinue
+if ($svc -and $svc.Status -eq "Running") {
+    Write-Host "  Stopping service..."
+    Stop-Service -Name "fips" -Force
+}
+
+# Uninstall the service
+if (Test-Path "$InstallDir\fips.exe") {
+    Write-Host "  Removing service registration..."
+    & "$InstallDir\fips.exe" --uninstall-service
+}
+
+# Remove binaries
+if (Test-Path $InstallDir) {
+    Write-Host "  Removing $InstallDir"
+    Remove-Item -Recurse -Force $InstallDir
+}
+
+# Remove from PATH
+$machinePath = [Environment]::GetEnvironmentVariable("Path", "Machine")
+if ($machinePath -like "*$InstallDir*") {
+    $newPath = ($machinePath -split ";" | Where-Object { $_ -ne $InstallDir }) -join ";"
+    [Environment]::SetEnvironmentVariable("Path", $newPath, "Machine")
+    Write-Host "  Removed from system PATH"
+}
+
+# Remove FIPS_CONFIG env var
+[Environment]::SetEnvironmentVariable("FIPS_CONFIG", $null, "Machine")
+
+# Config removal
+if ($RemoveAll) {
+    if (Test-Path $ConfigDir) {
+        Write-Host "  Removing config and keys at $ConfigDir"
+        Remove-Item -Recurse -Force $ConfigDir
+    }
+} else {
+    if (Test-Path $ConfigDir) {
+        Write-Host "  Preserving config at $ConfigDir"
+    }
+}
+
+Write-Host ""
+Write-Host "FIPS service uninstalled."
+if (-not $RemoveAll) {
+    Write-Host "Config preserved at $ConfigDir (use -RemoveAll to delete)"
+}