Updated media folder

.gitignore

@@ -3,6 +3,7 @@
 hemtt
 hemtt.exe
 *.biprivatekey
+.hemttprivatekey
 source/
 .vscode
 releases/

Cargo.toml

@@ -9,6 +9,10 @@ chrono = "0.4.39"
 lazy_static = "1.5.0"
 log = "0.4.22"
 log4rs = "1.3.0"
+reqwest = { version = "0.12.15", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+rcgen = { version = "0.13.2", default-features = false, features = ["crypto", "pem", "aws_lc_rs"] }
+rustls = "0.23.23"
+rustls-pemfile = "2.2.0"
 serde = { version = "1.0.210", features = ["derive"] }
 
 [dependencies.uuid]

README.md

@@ -4,6 +4,10 @@
 
 ARMATAK is a server side Arma 3 addons for streaming unit positions to TAK Clients in sessions on real locations maps. It can be runned both as a clientside mod or a serverside mod, when runned serverside, it will create a TCP Socket connection between Arma 3 and the TAK Server, sending the game session information into it. When used clientside, Arma 3 will host a websocket server that you can connect to your phone and mock the phone's location to the player's in game location.
 
+The server-side CoT router supports two transports:
+- Plain TCP, for legacy TAK ingress.
+- Mutual TLS, using the TAK Server authentication API, so the Arma session can publish as an authenticated TAK device on port `8089`.
+
 ## Get in Touch
 
 [Join the Discord Server for ARMATAK!](https://discord.gg/svK64PCycU)  

addons/main/XEH_postInit.sqf

@@ -35,7 +35,12 @@ addMissionEventHandler ["ExtensionCallback", {
 			[_function, "success", _name] call FUNC(notify);
 		};
 		case "TCP SOCKET ERROR": {
-			[_function, "error", _name] call FUNC(notify);
+			_message = _function;
+			if (_data isNotEqualTo "") then {
+				_message = format ["%1: %2", _function, _data];
+			};
+
+			[_message, "error", _name] call FUNC(notify);
 		};
 		case "VIDEO": {
 			[_function, "success", _name] call FUNC(notify);

addons/server/CfgVehicles.hpp

@@ -1,34 +1,28 @@
 class CfgVehicles {
-  	class Logic;
+	class Logic;
-	class Module_F : Logic
+	class Module_F : Logic {
-	{
+		class AttributesBase {
-		class AttributesBase
-		{
 			class Edit;
 			class ModuleDescription;
 		};
-
 		class ModuleDescription;
 	};
 
 	class GVAR(moduleBase): Module_F {
-    author = PROJECT_AUTHOR;
+		author = PROJECT_AUTHOR;
-    category = QEGVAR(main,moduleCategory);
+		category = QEGVAR(main,moduleCategory);
-    function = QUOTE({});
+		function = QUOTE({});
-    functionPriority = 1;
+		functionPriority = 1;
-    isGlobal = 1;
+		isGlobal = 1;
-    isTriggerActivated = 0;
+		isTriggerActivated = 0;
-    scope = 1;
+		scope = 1;
-    scopeCurator = 2;
+		scopeCurator = 2;
-  };
+	};
 
-	class GVAR(coreModule): GVAR(moduleBase) {
+	class GVAR(connectionModuleBase): GVAR(moduleBase) {
-		scope = 2;
 		scopeCurator = 0;
-		displayname = "CoT Router";
 		icon = "\a3\Modules_F_Curator\Data\iconRadio_ca.paa";
 		category = QEGVAR(main,moduleCategory);
-		function = QFUNC(3denCoreModuleConfig);
 		functionPriority = 1;
 		isGlobal = 0;
 		isTriggerActivated = 1;
@@ -39,19 +33,25 @@ class CfgVehicles {
 		canSetArea = 0;
 		canSetAreaShape = 0;
 		canSetAreaHeight = 0;
+	};
+
+	class GVAR(tcpModule): GVAR(connectionModuleBase) {
+		scope = 2;
+		displayName = "CoT Router (TCP)";
+		function = QFUNC(3denTcpModuleConfig);
 
 		class Attributes: AttributesBase {
 			class GVAR(moduleInstanceAddress): Edit {
 				property = QGVAR(moduleInstanceAddress);
-				displayname = "TAK Server Address";
+				displayName = "TAK Server Address";
-				tooltip = "TAK Server Instance Address";
+				tooltip = "Hostname or IP address for the TAK or IronTAK server.";
 				typeName = "STRING";
-				defaultValue = "localhost";
+				defaultValue = "'localhost'";
 			};
 			class GVAR(moduleInstancePort): Edit {
 				property = QGVAR(moduleInstancePort);
-				displayname = "TAK Server TCP Port";
+				displayName = "TAK Server TCP Port";
-				tooltip = "TAK Server instance Port for TCP connection";
+				tooltip = "Port for the unauthenticated TCP socket.";
 				typeName = "NUMBER";
 				defaultValue = "8088";
 			};
@@ -59,24 +59,75 @@ class CfgVehicles {
 		};
 
 		class ModuleDescription: ModuleDescription {
-			description = "Generate the initial ARMATAK configuration, syncronizing all players to the TAK server instance";
+			description = "Connect ArmaTAK to a TAK server over plain TCP.";
 			sync[] = {"LocationArea_F"};
 		};
 	};
 
-	class GVAR(coreModuleCurator): GVAR(coreModule) {
+	class GVAR(enrollModule): GVAR(connectionModuleBase) {
+		scope = 2;
+		displayName = "CoT Router (Authenticated)";
+		function = QFUNC(3denEnrollModuleConfig);
+
+		class Attributes: AttributesBase {
+			class GVAR(moduleInstanceAddress): Edit {
+				property = QGVAR(moduleInstanceAddress);
+				displayname = "TAK Server Address";
+				tooltip = "Hostname or IP address used for enrollment and the final TLS connection.";
+				typeName = "STRING";
+				defaultValue = "'localhost'";
+			};
+			class GVAR(moduleEnrollmentPort): Edit {
+				property = QGVAR(moduleEnrollmentPort);
+				displayName = "Enrollment HTTPS Port";
+				tooltip = "Port used for GET /Marti/api/tls/config and POST /Marti/api/tls/signClient/v2.";
+				typeName = "NUMBER";
+				defaultValue = "8446";
+			};
+			class GVAR(moduleEnrollmentUsername): Edit {
+				property = QGVAR(moduleEnrollmentUsername);
+				displayName = "Enrollment Username";
+				tooltip = "Username used in Basic Auth for client certificate enrollment.";
+				typeName = "STRING";
+				defaultValue = "''";
+			};
+			class GVAR(moduleEnrollmentPassword): Edit {
+				property = QGVAR(moduleEnrollmentPassword);
+				displayName = "Enrollment Password";
+				tooltip = "Password used in Basic Auth for client certificate enrollment.";
+				typeName = "STRING";
+				defaultValue = "''";
+			};
+			class ModuleDescription: ModuleDescription {};
+		};
+
+		class ModuleDescription: ModuleDescription {
+			description = "Enroll a client certificate and connect ArmaTAK over mTLS.";
+			sync[] = {"LocationArea_F"};
+		};
+	};
+
+	class GVAR(tcpModuleCurator): GVAR(tcpModule) {
 		scope = 1;
 		scopeCurator = 2;
 		function = "";
-		displayName = "CoT Router (Zeus)";
+		displayName = "CoT Router (TCP, Zeus)";
-		curatorInfoType = "armatak_zeus_core_module_dialog";
+		curatorInfoType = "armatak_zeus_tcp_module_dialog";
+	};
+
+	class GVAR(enrollModuleCurator): GVAR(enrollModule) {
+		scope = 1;
+		scopeCurator = 2;
+		function = "";
+		displayName = "CoT Router (Authenticated, Zeus)";
+		curatorInfoType = "armatak_zeus_enroll_module_dialog";
 	};
 
 	class GVAR(markEntity): GVAR(moduleBase) {
-    curatorCanAttach = 1;
+		curatorCanAttach = 1;
-    category = QEGVAR(main,moduleCategory);
+		category = QEGVAR(main,moduleCategory);
 		displayname = "Mark Entity";
-    function = QFUNC(routerEntityAdd);
+		function = QFUNC(routerEntityAdd);
-    icon = "\a3\Modules_F_Curator\Data\iconRadio_ca.paa";
+		icon = "\a3\Modules_F_Curator\Data\iconRadio_ca.paa";
-  };
+	};
 };

addons/server/XEH_PREP.hpp

@@ -1,4 +1,7 @@
-PREP(3denCoreModuleConfig);
+PREP(3denEnrollModuleConfig);
+PREP(3denTcpModuleConfig);
 PREP(routerEntityAdd);
 PREP(routerEntityRemove);
-PREP(ZeusCoreModuleConfig);
+PREP(startCotRouter);
+PREP(ZeusEnrollModuleConfig);
+PREP(ZeusTcpModuleConfig);

addons/server/config.cpp

@@ -4,8 +4,10 @@ class CfgPatches {
   class ADDON {
     name = COMPONENT_NAME;
     units[] = {
-			QGVAR(coreModule),
+			QGVAR(tcpModule),
-			QGVAR(coreModuleCurator),
+			QGVAR(tcpModuleCurator),
+			QGVAR(enrollModule),
+			QGVAR(enrollModuleCurator),
       QGVAR(markEntity)
 		};
     weapons[] = {};

addons/server/dialog.hpp

@@ -3,69 +3,172 @@ class RscBackground;
 class RscButton;
 class RscEdit;
 
-class armatak_zeus_core_module_dialog {
+class armatak_zeus_tcp_module_dialog {
   idd = 999991;
   movingEnable = 0;
   class ControlsBackground {
-    class armatak_gui_module_zeus_core_dialog_main_frame: RscBackground {
+    class main_frame: RscBackground {
       idc = 1800;
       x = "0.386562 * safezoneW + safezoneX";
-      y = "0.401 * safezoneH + safezoneY";
+      y = "0.29 * safezoneH + safezoneY";
       w = "0.216563 * safezoneW";
-      h = "0.242 * safezoneH";
+      h = "0.32 * safezoneH";
-      colorBackground[]={0,0,0,0.45};
+      colorBackground[] = {0,0,0,0.45};
     };
   };
   class Controls {
-    class armatak_gui_module_zeus_core_dialog_address_edit: RscEdit {
+    class address_text: RscText {
-      idc = 14000;
-      text = "localhost";
-      x = "0.391719 * safezoneW + safezoneX";
-      y = "0.445 * safezoneH + safezoneY";
-      w = "0.20625 * safezoneW";
-      h = "0.044 * safezoneH";
-      colorBackground[]={0,0,0,0.5};
-    };
-    class armatak_gui_module_zeus_core_dialog_address_port_edit: RscEdit {
-      idc = 14001;
-      text = "8088";
-      x = "0.391719 * safezoneW + safezoneX";
-      y = "0.522 * safezoneH + safezoneY";
-      w = "0.20625 * safezoneW";
-      h = "0.044 * safezoneH";
-      colorBackground[]={0,0,0,0.5};
-    };
-    class armatak_gui_module_zeus_core_dialog_address_text: RscText {
       idc = 1000;
       text = "TAK Server Address";
       x = "0.391719 * safezoneW + safezoneX";
-      y = "0.412 * safezoneH + safezoneY";
+      y = "0.332 * safezoneH + safezoneY";
       w = "0.20625 * safezoneW";
       h = "0.033 * safezoneH";
     };
-    class armatak_gui_module_zeus_core_dialog_address_port_text: RscText {
+    class address_edit: RscEdit {
+      idc = 14000;
+      text = "localhost";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.365 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.044 * safezoneH";
+      colorBackground[] = {0,0,0,0.5};
+    };
+    class port_text: RscText {
       idc = 1001;
       text = "TAK Server Port";
       x = "0.391719 * safezoneW + safezoneX";
-      y = "0.489 * safezoneH + safezoneY";
+      y = "0.425 * safezoneH + safezoneY";
       w = "0.20625 * safezoneW";
       h = "0.033 * safezoneH";
     };
-    class armatak_gui_module_zeus_core_dialog_address_button_cancel: RscButton {
+    class port_edit: RscEdit {
+      idc = 14001;
+      text = "8088";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.458 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.044 * safezoneH";
+      colorBackground[] = {0,0,0,0.5};
+    };
+    class button_cancel: RscButton {
       idc = 1601;
       text = "Cancel";
       action = "closeDialog 2;";
       x = "0.551563 * safezoneW + safezoneX";
-      y = "0.577 * safezoneH + safezoneY";
+      y = "0.535 * safezoneH + safezoneY";
       w = "0.0464063 * safezoneW";
       h = "0.055 * safezoneH";
     };
-    class armatak_gui_module_zeus_core_dialog_address_button_ok: RscButton {
+    class button_ok: RscButton {
       idc = 1600;
       text = "Ok";
-      action = QUOTE(call FUNC(zeusCoreModuleConfig));
+      action = QUOTE(call FUNC(ZeusTcpModuleConfig));
       x = "0.5 * safezoneW + safezoneX";
-      y = "0.577 * safezoneH + safezoneY";
+      y = "0.535 * safezoneH + safezoneY";
+      w = "0.0464063 * safezoneW";
+      h = "0.055 * safezoneH";
+    };
+  };
+};
+
+class armatak_zeus_enroll_module_dialog {
+  idd = 999992;
+  movingEnable = 0;
+  class ControlsBackground {
+    class main_frame: RscBackground {
+      idc = 1810;
+      x = "0.386562 * safezoneW + safezoneX";
+      y = "0.2 * safezoneH + safezoneY";
+      w = "0.216563 * safezoneW";
+      h = "0.52 * safezoneH";
+      colorBackground[] = {0,0,0,0.45};
+    };
+  };
+  class Controls {
+    class address_text: RscText {
+      idc = 1010;
+      text = "TAK Server Address";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.242 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.033 * safezoneH";
+    };
+    class address_edit: RscEdit {
+      idc = 14100;
+      text = "localhost";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.275 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.044 * safezoneH";
+      colorBackground[] = {0,0,0,0.5};
+    };
+    class enroll_port_text: RscText {
+      idc = 1011;
+      text = "Enrollment HTTPS Port";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.335 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.033 * safezoneH";
+    };
+    class enroll_port_edit: RscEdit {
+      idc = 14101;
+      text = "8446";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.368 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.044 * safezoneH";
+      colorBackground[] = {0,0,0,0.5};
+    };
+    class username_text: RscText {
+      idc = 1012;
+      text = "Enrollment Username";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.428 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.033 * safezoneH";
+    };
+    class username_edit: RscEdit {
+      idc = 14102;
+      text = "";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.461 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.044 * safezoneH";
+      colorBackground[] = {0,0,0,0.5};
+    };
+    class password_text: RscText {
+      idc = 1013;
+      text = "Enrollment Password";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.521 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.033 * safezoneH";
+    };
+    class password_edit: RscEdit {
+      idc = 14103;
+      text = "";
+      x = "0.391719 * safezoneW + safezoneX";
+      y = "0.554 * safezoneH + safezoneY";
+      w = "0.20625 * safezoneW";
+      h = "0.044 * safezoneH";
+      colorBackground[] = {0,0,0,0.5};
+    };
+    class button_cancel: RscButton {
+      idc = 1611;
+      text = "Cancel";
+      action = "closeDialog 2;";
+      x = "0.551563 * safezoneW + safezoneX";
+      y = "0.645 * safezoneH + safezoneY";
+      w = "0.0464063 * safezoneW";
+      h = "0.055 * safezoneH";
+    };
+    class button_ok: RscButton {
+      idc = 1610;
+      text = "Ok";
+      action = QUOTE(call FUNC(ZeusEnrollModuleConfig));
+      x = "0.5 * safezoneW + safezoneX";
+      y = "0.645 * safezoneH + safezoneY";
       w = "0.0464063 * safezoneW";
       h = "0.055 * safezoneH";
     };

addons/server/functions/fnc_3denCoreModuleConfig.sqf

@@ -1,64 +0,0 @@
-#include "..\script_component.hpp"
-
-params [
-	["_logic", objNull, [objNull]],
-	["_units", [], [[]]],
-	["_activated", true, [true]]
-];
-
-if (isServer) exitWith {
-	["Connecting to TCP Socket", "success", "TCP Socket"] call EFUNC(main,notify);
-
-	_tak_server_instance_address = _logic getVariable QGVAR(moduleInstanceAddress);
-	_tak_server_instance_port = _logic getVariable QGVAR(moduleInstancePort);
-
-	_tak_server_fulladdress = _tak_server_instance_address + ":" + (str _tak_server_instance_port);
-
-	missionNamespace setVariable ["armatak_server_instance", _tak_server_fulladdress];
-	missionNamespace setVariable ["armatak_tcp_socket_is_running", true];
-
-	"armatak" callExtension ["tcp_socket:start", [_tak_server_fulladdress]];
-
-	_syncUnits = synchronizedObjects _logic;
-
-	missionNamespace setVariable ["armatak_server_syncedUnits", _syncUnits];
-
-	GVAR(syncedUnits) = missionNamespace getVariable "armatak_server_syncedUnits";
-
-	[{
-		GVAR(syncedUnits) = missionNamespace getVariable "armatak_server_syncedUnits";
-
-		{
-			_objectType = _x call BIS_fnc_objectType;
-			switch (true) do {
-				case ((_objectType select 0) == "Soldier"): {
-					_callsign = [_x] call armatak_fnc_extract_unit_callsign;
-					_group_name = [group _x] call armatak_fnc_extract_group_color;
-					_group_role = [_x] call armatak_fnc_extract_group_role;
-
-					[_x, _callsign, _group_name, _group_role] call armatak_fnc_send_eud_cot;
-					[_x] call armatak_fnc_send_digital_pointer_cot;
-				};
-				case ((_objectType select 0) == "Vehicle"): {
-					_atak_type = [_x] call armatak_fnc_extract_role;
-					_callsign = [_x] call armatak_fnc_extract_marker_callsign;
-
-					[_x, _atak_type, _callsign] call armatak_fnc_send_marker_cot;
-
-					_x call armatak_fnc_extract_sensor_data;
-				};
-				case ((_objectType select 0) == "VehicleAutonomous"): {
-					_atak_type = [_x] call armatak_fnc_extract_role;
-					_callsign = [_x] call armatak_fnc_extract_marker_callsign;
-
-					[_x, _atak_type, _callsign] call armatak_fnc_send_drone_cot;
-					[_x] call armatak_fnc_send_digital_pointer_cot;
-
-					_x call armatak_fnc_extract_sensor_data;
-				};
-			};
-		} forEach GVAR(syncedUnits);
-	}, 1, []] call CBA_fnc_addPerFrameHandler;
-};
-
-true;

addons/server/functions/fnc_3denEnrollModuleConfig.sqf

@@ -0,0 +1,37 @@
+#include "..\script_component.hpp"
+
+params [
+	["_logic", objNull, [objNull]],
+	["_units", [], [[]]],
+	["_activated", true, [true]]
+];
+
+if (isServer) exitWith {
+	if (missionNamespace getVariable ["armatak_tcp_socket_is_running", false]) exitWith {
+		["Socket was called twice", "error", "TCP Socket"] call EFUNC(main,notify);
+	};
+
+	["Connecting to authenticated TAK socket", "success", "TCP Socket"] call EFUNC(main,notify);
+
+	_tak_server_instance_address = _logic getVariable [QGVAR(moduleInstanceAddress), "localhost"];
+	_tak_server_enrollment_port = _logic getVariable [QGVAR(moduleEnrollmentPort), 8446];
+	_tak_server_enrollment_username = _logic getVariable [QGVAR(moduleEnrollmentUsername), ""];
+	_tak_server_enrollment_password = _logic getVariable [QGVAR(moduleEnrollmentPassword), ""];
+
+	"armatak" callExtension [
+		"tcp_socket:start_enroll_mtls",
+		[
+			_tak_server_instance_address,
+			_tak_server_instance_address,
+			str _tak_server_enrollment_port,
+			_tak_server_enrollment_username,
+			_tak_server_enrollment_password,
+			""
+		]
+	];
+
+	missionNamespace setVariable ["armatak_server_syncedUnits", synchronizedObjects _logic];
+	_tak_server_instance_address call FUNC(startCotRouter);
+};
+
+true

addons/server/functions/fnc_3denTcpModuleConfig.sqf

@@ -0,0 +1,26 @@
+#include "..\script_component.hpp"
+
+params [
+	["_logic", objNull, [objNull]],
+	["_units", [], [[]]],
+	["_activated", true, [true]]
+];
+
+if (isServer) exitWith {
+	if (missionNamespace getVariable ["armatak_tcp_socket_is_running", false]) exitWith {
+		["Socket was called twice", "error", "TCP Socket"] call EFUNC(main,notify);
+	};
+
+	["Connecting to TCP Socket", "success", "TCP Socket"] call EFUNC(main,notify);
+
+	_tak_server_instance_address = _logic getVariable [QGVAR(moduleInstanceAddress), "localhost"];
+	_tak_server_instance_port = _logic getVariable [QGVAR(moduleInstancePort), 8088];
+	_tak_server_fulladdress = _tak_server_instance_address + ":" + (str _tak_server_instance_port);
+
+	"armatak" callExtension ["tcp_socket:start", [_tak_server_fulladdress]];
+
+	missionNamespace setVariable ["armatak_server_syncedUnits", synchronizedObjects _logic];
+	_tak_server_fulladdress call FUNC(startCotRouter);
+};
+
+true

addons/server/functions/fnc_ZeusCoreModuleConfig.sqf

@@ -1,67 +0,0 @@
-#include "..\script_component.hpp"
-
-params ["_logic"];
-
-_socket_is_running = missionNamespace getVariable ["armatak_tcp_socket_is_running", false];
-
-if (_socket_is_running) exitWith {
-	["Socket was called twice", "error", "TCP Socket"] call EFUNC(main,notify);
-	closeDialog 1;
-};
-
-disableSerialization;
-
-["Connecting to TCP Socket", "success", "TCP Socket"] call EFUNC(main,notify);
-
-_tak_server_instance_address = ctrlText 14000;
-_tak_server_instance_port = ctrlText 14001;
-
-_tak_server_fulladdress = ((_tak_server_instance_address) + ":" + (_tak_server_instance_port));
-
-missionNamespace setVariable ["armatak_server_instance", _tak_server_fulladdress];
-missionNamespace setVariable ["armatak_tcp_socket_is_running", true];
-
-"armatak" callExtension ["tcp_socket:start", [_tak_server_fulladdress]];
-
-_syncUnits = [];
-
-missionNamespace setVariable ["armatak_server_syncedUnits", _syncUnits];
-
-	GVAR(syncedUnits) = missionNamespace getVariable "armatak_server_syncedUnits";
-
-	[{
-		GVAR(syncedUnits) = missionNamespace getVariable "armatak_server_syncedUnits";
-
-		{
-			_objectType = _x call BIS_fnc_objectType;
-			switch (true) do {
-				case ((_objectType select 0) == "Soldier"): {
-					_callsign = [_x] call armatak_fnc_extract_unit_callsign;
-					_group_name = [group _x] call armatak_fnc_extract_group_color;
-					_group_role = [_x] call armatak_fnc_extract_group_role;
-
-					[_x, _callsign, _group_name, _group_role] call armatak_fnc_send_eud_cot;
-					[_x] call armatak_fnc_send_digital_pointer_cot;
-				};
-				case ((_objectType select 0) == "Vehicle"): {
-					_atak_type = [_x] call armatak_fnc_extract_role;
-					_callsign = [_x] call armatak_fnc_extract_marker_callsign;
-
-					[_x, _atak_type, _callsign] call armatak_fnc_send_marker_cot;
-
-					_x call armatak_fnc_extract_sensor_data;
-				};
-				case ((_objectType select 0) == "VehicleAutonomous"): {
-					_atak_type = [_x] call armatak_fnc_extract_role;
-					_callsign = [_x] call armatak_fnc_extract_marker_callsign;
-
-					[_x, _atak_type, _callsign] call armatak_fnc_send_drone_cot;
-					[_x] call armatak_fnc_send_digital_pointer_cot;
-
-					_x call armatak_fnc_extract_sensor_data;
-				};
-			};
-		} forEach GVAR(syncedUnits);
-	}, 1, []] call CBA_fnc_addPerFrameHandler;
-deleteVehicle _logic;
-closeDialog 1;

addons/server/functions/fnc_ZeusEnrollModuleConfig.sqf

@@ -0,0 +1,33 @@
+#include "..\script_component.hpp"
+
+params ["_logic"];
+
+if (missionNamespace getVariable ["armatak_tcp_socket_is_running", false]) exitWith {
+	["Socket was called twice", "error", "TCP Socket"] call EFUNC(main,notify);
+	closeDialog 1;
+};
+
+disableSerialization;
+
+["Connecting to authenticated TAK socket", "success", "TCP Socket"] call EFUNC(main,notify);
+
+_tak_server_instance_address = ctrlText 14100;
+_tak_server_enrollment_port = ctrlText 14101;
+_tak_server_enrollment_username = ctrlText 14102;
+_tak_server_enrollment_password = ctrlText 14103;
+
+"armatak" callExtension [
+	"tcp_socket:start_enroll_mtls",
+	[
+		_tak_server_instance_address,
+		_tak_server_instance_address,
+		_tak_server_enrollment_port,
+		_tak_server_enrollment_username,
+		_tak_server_enrollment_password,
+		""
+	]
+];
+
+_tak_server_instance_address call FUNC(startCotRouter);
+deleteVehicle _logic;
+closeDialog 1;

addons/server/functions/fnc_ZeusTcpModuleConfig.sqf

@@ -0,0 +1,22 @@
+#include "..\script_component.hpp"
+
+params ["_logic"];
+
+if (missionNamespace getVariable ["armatak_tcp_socket_is_running", false]) exitWith {
+	["Socket was called twice", "error", "TCP Socket"] call EFUNC(main,notify);
+	closeDialog 1;
+};
+
+disableSerialization;
+
+["Connecting to TCP Socket", "success", "TCP Socket"] call EFUNC(main,notify);
+
+_tak_server_instance_address = ctrlText 14000;
+_tak_server_instance_port = ctrlText 14001;
+_tak_server_fulladdress = _tak_server_instance_address + ":" + _tak_server_instance_port;
+
+"armatak" callExtension ["tcp_socket:start", [_tak_server_fulladdress]];
+
+_tak_server_fulladdress call FUNC(startCotRouter);
+deleteVehicle _logic;
+closeDialog 1;

addons/server/functions/fnc_startCotRouter.sqf

@@ -0,0 +1,47 @@
+#include "..\script_component.hpp"
+
+params [["_server_instance", "", [""]]];
+
+missionNamespace setVariable ["armatak_server_instance", _server_instance];
+missionNamespace setVariable ["armatak_tcp_socket_is_running", true];
+
+if (isNil { missionNamespace getVariable "armatak_server_syncedUnits" }) then {
+	missionNamespace setVariable ["armatak_server_syncedUnits", []];
+};
+
+GVAR(syncedUnits) = missionNamespace getVariable "armatak_server_syncedUnits";
+
+[{
+	GVAR(syncedUnits) = missionNamespace getVariable "armatak_server_syncedUnits";
+
+	{
+		_objectType = _x call BIS_fnc_objectType;
+		switch (true) do {
+			case ((_objectType select 0) == "Soldier"): {
+				_callsign = [_x] call armatak_fnc_extract_unit_callsign;
+				_group_name = [group _x] call armatak_fnc_extract_group_color;
+				_group_role = [_x] call armatak_fnc_extract_group_role;
+
+				[_x, _callsign, _group_name, _group_role] call armatak_fnc_send_eud_cot;
+				[_x] call armatak_fnc_send_digital_pointer_cot;
+			};
+			case ((_objectType select 0) == "Vehicle"): {
+				_atak_type = [_x] call armatak_fnc_extract_role;
+				_callsign = [_x] call armatak_fnc_extract_marker_callsign;
+
+				[_x, _atak_type, _callsign] call armatak_fnc_send_marker_cot;
+				_x call armatak_fnc_extract_sensor_data;
+			};
+			case ((_objectType select 0) == "VehicleAutonomous"): {
+				_atak_type = [_x] call armatak_fnc_extract_role;
+				_callsign = [_x] call armatak_fnc_extract_marker_callsign;
+
+				[_x, _atak_type, _callsign] call armatak_fnc_send_drone_cot;
+				[_x] call armatak_fnc_send_digital_pointer_cot;
+				_x call armatak_fnc_extract_sensor_data;
+			};
+		};
+	} forEach GVAR(syncedUnits);
+}, 1, []] call CBA_fnc_addPerFrameHandler;
+
+true

addons/video/config.cpp

@@ -4,7 +4,7 @@ class CfgPatches {
   class ADDON {
     name = COMPONENT_NAME;
     units[] = {
-      QGVAR(videoModule)
+      //QGVAR(videoModule)
     };
     weapons[] = {};
     requiredAddons[] = {

src/cot/cot.rs

@@ -1,5 +1,5 @@
-use uuid::Uuid;
 use chrono::{Duration, SecondsFormat, Utc};
+use uuid::Uuid;
 
 pub struct CursorOverTime {
     pub uuid: Option<String>,

src/cot/digital_pointer.rs

@@ -1,45 +1,45 @@
-use arma_rs::{FromArma, FromArmaError};
 use super::cot::CursorOverTime;
+use arma_rs::{FromArma, FromArmaError};
 
 pub struct DigitalPointerPayload {
-  pub link_uid: String,
+    pub link_uid: String,
-  pub contact_callsign: String,
+    pub contact_callsign: String,
-  pub point_lat: f64,
+    pub point_lat: f64,
-  pub point_lon: f64,
+    pub point_lon: f64,
-  pub point_hae: f32,
+    pub point_hae: f32,
 }
 
 impl FromArma for DigitalPointerPayload {
-  fn from_arma(data: String) -> Result<DigitalPointerPayload, FromArmaError> {
+    fn from_arma(data: String) -> Result<DigitalPointerPayload, FromArmaError> {
-      let (link_uid, contact_callsign, point_lat, point_lon, point_hae) =
+        let (link_uid, contact_callsign, point_lat, point_lon, point_hae) =
-          <(String, String, f64, f64, f32)>::from_arma(data)?;
+            <(String, String, f64, f64, f32)>::from_arma(data)?;
-      Ok(Self {
+        Ok(Self {
-          link_uid,
+            link_uid,
-          contact_callsign,
+            contact_callsign,
-          point_lat,
+            point_lat,
-          point_lon,
+            point_lon,
-          point_hae,
+            point_hae,
-      })
+        })
-  }
+    }
 }
 
 impl DigitalPointerPayload {
-  pub fn to_cot(&self) -> CursorOverTime {
+    pub fn to_cot(&self) -> CursorOverTime {
-      CursorOverTime {
+        CursorOverTime {
-          uuid: Some(format!("{}{}", self.link_uid.clone(), ".SPI1")),
+            uuid: Some(format!("{}{}", self.link_uid.clone(), ".SPI1")),
-          r#type: Some("b-m-p-s-p-i".to_string()),
+            r#type: Some("b-m-p-s-p-i".to_string()),
-          point_lat: self.point_lat,
+            point_lat: self.point_lat,
-          point_lon: self.point_lon,
+            point_lon: self.point_lon,
-          point_hae: self.point_hae,
+            point_hae: self.point_hae,
-          point_ce: None,
+            point_ce: None,
-          point_le: None,
+            point_le: None,
-          contact_callsign: self.contact_callsign.clone(),
+            contact_callsign: self.contact_callsign.clone(),
-          group_name: None,
+            group_name: None,
-          group_role: None,
+            group_role: None,
-          track_course: None,
+            track_course: None,
-          track_speed: None,
+            track_speed: None,
-          link_uid: Some(self.link_uid.clone()),
+            link_uid: Some(self.link_uid.clone()),
-          remarker: None,
+            remarker: None,
-      }
+        }
-  }
+    }
 }

src/cot/eud.rs

@@ -1,62 +1,62 @@
-use arma_rs::{FromArma, FromArmaError};
 use super::cot::CursorOverTime;
+use arma_rs::{FromArma, FromArmaError};
 
 pub struct EudCoTPayload {
-  pub uuid: String,
+    pub uuid: String,
-  pub point_lat: f64,
+    pub point_lat: f64,
-  pub point_lon: f64,
+    pub point_lon: f64,
-  pub point_hae: f32,
+    pub point_hae: f32,
-  pub contact_callsign: String,
+    pub contact_callsign: String,
-  pub group_name: String,
+    pub group_name: String,
-  pub group_role: String,
+    pub group_role: String,
-  pub track_course: i32,
+    pub track_course: i32,
-  pub track_speed: f32,
+    pub track_speed: f32,
 }
 
 impl FromArma for EudCoTPayload {
-  fn from_arma(data: String) -> Result<EudCoTPayload, FromArmaError> {
+    fn from_arma(data: String) -> Result<EudCoTPayload, FromArmaError> {
-      let (
+        let (
-          uuid,
+            uuid,
-          point_lat,
+            point_lat,
-          point_lon,
+            point_lon,
-          point_hae,
+            point_hae,
-          contact_callsign,
+            contact_callsign,
-          group_name,
+            group_name,
-          group_role,
+            group_role,
-          track_course,
+            track_course,
-          track_speed,
+            track_speed,
-      ) = <(String, f64, f64, f32, String, String, String, i32, f32)>::from_arma(data)?;
+        ) = <(String, f64, f64, f32, String, String, String, i32, f32)>::from_arma(data)?;
-      Ok(Self {
+        Ok(Self {
-          uuid,
+            uuid,
-          point_lat,
+            point_lat,
-          point_lon,
+            point_lon,
-          point_hae,
+            point_hae,
-          contact_callsign,
+            contact_callsign,
-          group_name,
+            group_name,
-          group_role,
+            group_role,
-          track_course,
+            track_course,
-          track_speed,
+            track_speed,
-      })
+        })
-  }
+    }
 }
 
 impl EudCoTPayload {
-  pub fn to_cot(&self) -> CursorOverTime {
+    pub fn to_cot(&self) -> CursorOverTime {
-      CursorOverTime {
+        CursorOverTime {
-          uuid: Some(self.uuid.clone()),
+            uuid: Some(self.uuid.clone()),
-          r#type: None,
+            r#type: None,
-          point_lat: self.point_lat,
+            point_lat: self.point_lat,
-          point_lon: self.point_lon,
+            point_lon: self.point_lon,
-          point_hae: self.point_hae,
+            point_hae: self.point_hae,
-          point_ce: None,
+            point_ce: None,
-          point_le: None,
+            point_le: None,
-          contact_callsign: self.contact_callsign.clone(),
+            contact_callsign: self.contact_callsign.clone(),
-          group_name: Some(self.group_name.clone()),
+            group_name: Some(self.group_name.clone()),
-          group_role: Some(self.group_role.clone()),
+            group_role: Some(self.group_role.clone()),
-          track_course: Some(self.track_course),
+            track_course: Some(self.track_course),
-          track_speed: Some(self.track_speed),
+            track_speed: Some(self.track_speed),
-          link_uid: None,
+            link_uid: None,
-          remarker: None,
+            remarker: None,
-      }
+        }
-  }
+    }
 }

src/cot/gps.rs

@@ -1,5 +1,5 @@
-use arma_rs::{FromArma, FromArmaError};
 use super::cot::CursorOverTime;
+use arma_rs::{FromArma, FromArmaError};
 
 pub struct ExternalPositionPayload {
     pub uuid: String,
@@ -13,47 +13,47 @@ pub struct ExternalPositionPayload {
 }
 
 impl FromArma for ExternalPositionPayload {
-  fn from_arma(data: String) -> Result<ExternalPositionPayload, FromArmaError> {
+    fn from_arma(data: String) -> Result<ExternalPositionPayload, FromArmaError> {
-      let (
+        let (
-          uuid,
+            uuid,
-          point_lat,
+            point_lat,
-          point_lon,
+            point_lon,
-          point_hae,
+            point_hae,
-          contact_callsign,
+            contact_callsign,
-          track_course,
+            track_course,
-          track_speed,
+            track_speed,
-          remarker,
+            remarker,
-      ) = <(String, f64, f64, f32, String, i32, f32, String)>::from_arma(data)?;
+        ) = <(String, f64, f64, f32, String, i32, f32, String)>::from_arma(data)?;
-      Ok(Self {
+        Ok(Self {
-          uuid,
+            uuid,
-          point_lat,
+            point_lat,
-          point_lon,
+            point_lon,
-          point_hae,
+            point_hae,
-          contact_callsign,
+            contact_callsign,
-          track_course,
+            track_course,
-          track_speed,
+            track_speed,
-          remarker,
+            remarker,
-      })
+        })
-  }
+    }
 }
 
 impl ExternalPositionPayload {
-  pub fn to_cot(&self) -> CursorOverTime {
+    pub fn to_cot(&self) -> CursorOverTime {
-      CursorOverTime {
+        CursorOverTime {
-          uuid: Some(self.uuid.clone()),
+            uuid: Some(self.uuid.clone()),
-          r#type: None,
+            r#type: None,
-          point_lat: self.point_lat,
+            point_lat: self.point_lat,
-          point_lon: self.point_lon,
+            point_lon: self.point_lon,
-          point_hae: self.point_hae,
+            point_hae: self.point_hae,
-          point_ce: None,
+            point_ce: None,
-          point_le: None,
+            point_le: None,
-          contact_callsign: self.contact_callsign.clone(),
+            contact_callsign: self.contact_callsign.clone(),
-          group_name: None,
+            group_name: None,
-          group_role: None,
+            group_role: None,
-          track_course: Some(self.track_course),
+            track_course: Some(self.track_course),
-          track_speed: Some(self.track_speed),
+            track_speed: Some(self.track_speed),
-          link_uid: None,
+            link_uid: None,
-          remarker: Some(self.remarker.clone()),
+            remarker: Some(self.remarker.clone()),
-      }
+        }
-  }
+    }
 }

src/cot/message.rs

@@ -1,5 +1,5 @@
 use arma_rs::{FromArma, FromArmaError};
-use chrono::{Utc, Duration, SecondsFormat};
+use chrono::{Duration, SecondsFormat, Utc};
 use uuid::Uuid;
 
 pub struct MessagePayload {
@@ -14,8 +14,7 @@ pub struct MessagePayload {
 
 impl FromArma for MessagePayload {
     fn from_arma(data: String) -> Result<Self, FromArmaError> {
-        let (sender_callsign, chatroom, message_text,
+        let (sender_callsign, chatroom, message_text, point_lat, point_lon, point_hae, sender_uid) =
-            point_lat, point_lon, point_hae, sender_uid) =
             <(String, String, String, f64, f64, f32, String)>::from_arma(data)?;
 
         Ok(Self {
@@ -55,8 +54,8 @@ impl MessageCot {
 
     pub fn to_xml(&self) -> String {
         let created_time = Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true);
-        let stale_time = (Utc::now() + Duration::days(1))
+        let stale_time =
-            .to_rfc3339_opts(SecondsFormat::Millis, true);
+            (Utc::now() + Duration::days(1)).to_rfc3339_opts(SecondsFormat::Millis, true);
 
         // MESSAGE ID (random UUID)
         let message_uuid = Uuid::new_v4().to_string();
@@ -98,10 +97,7 @@ impl MessageCot {
             format!(
                 "<__chat parent=\"RootContactGroup\" groupOwner=\"false\" \
                  messageId=\"{}\" chatroom=\"{}\" id=\"{}\" senderCallsign=\"{}\">",
-                message_uuid,
+                message_uuid, self.chatroom, self.chatroom, self.sender_callsign,
-                self.chatroom,
-                self.chatroom,
-                self.sender_callsign,
             )
             .as_str(),
         );
@@ -109,9 +105,7 @@ impl MessageCot {
         xml.push_str(
             format!(
                 "<chatgrp uid0=\"{}\" uid1=\"{}\" id=\"{}\" />",
-                self.sender_uid,
+                self.sender_uid, self.chatroom, self.chatroom
-                self.chatroom,
-                self.chatroom
             )
             .as_str(),
         );

src/cot/mod.rs

@@ -1,6 +1,6 @@
-pub mod draws;
 pub mod cot;
 pub mod digital_pointer;
+pub mod draws;
 pub mod eud;
 pub mod gps;
 pub mod message;

src/lib.rs

@@ -1,4 +1,5 @@
 use arma_rs::{arma, Extension, Group};
+use rustls::crypto::aws_lc_rs;
 mod structs;
 mod tcp;
 mod tests;
@@ -31,6 +32,9 @@ pub fn init() -> Extension {
 
     log4rs::init_config(config).unwrap();
 
+    let _ = aws_lc_rs::default_provider().install_default();
+    log::info!("Initialized rustls aws-lc crypto provider.");
+
     Extension::build()
         .command("local_ip", utils::address::get_local_address)
         .command("uuid", utils::uuid::get_uuid)
@@ -47,6 +51,8 @@ pub fn init() -> Extension {
             "tcp_socket",
             Group::new()
                 .command("start", tcp::start)
+                .command("start_mtls", tcp::start_mtls)
+                .command("start_enroll_mtls", tcp::start_enroll_mtls)
                 .command("stop", tcp::stop)
                 .command("send_payload", tcp::send_payload)
                 .group(

src/structs.rs

@@ -10,9 +10,6 @@ pub struct LogPayload {
 impl FromArma for LogPayload {
     fn from_arma(data: String) -> Result<LogPayload, FromArmaError> {
         let (status, message) = <(String, String)>::from_arma(data)?;
-        Ok(Self {
+        Ok(Self { status, message })
-            status,
-            message
-        })
     }
 }

src/tcp/client.rs

@@ -0,0 +1,280 @@
+use arma_rs::Context;
+use log::{info, warn};
+use std::collections::VecDeque;
+use std::panic::{self, AssertUnwindSafe};
+use std::sync::mpsc::{self, Receiver, RecvTimeoutError, Sender, TryRecvError};
+use std::thread;
+use std::time::Duration;
+
+use super::config::ConnectionConfig;
+use super::transport::{connect_stream, TransportStream};
+use super::TCP_CLIENT;
+
+const CONNECT_POLL_INTERVAL: Duration = Duration::from_millis(200);
+const MAX_PENDING_MESSAGES: usize = 128;
+
+pub enum TcpCommand {
+    SendMessage(String, Context),
+    Stop,
+}
+
+pub struct TcpClient {
+    pub(crate) tx: Sender<TcpCommand>,
+}
+
+enum ConnectionState {
+    Connecting,
+    Connected,
+    Failed(String),
+}
+
+enum ConnectEvent {
+    Connected(TransportStream),
+    Failed(String),
+}
+
+fn describe_panic_payload(payload: Box<dyn std::any::Any + Send>) -> String {
+    if let Some(message) = payload.downcast_ref::<&str>() {
+        (*message).to_string()
+    } else if let Some(message) = payload.downcast_ref::<String>() {
+        message.clone()
+    } else {
+        "unknown panic payload".to_string()
+    }
+}
+
+fn log_message_preview(message: &str) -> String {
+    message.chars().take(96).collect::<String>()
+}
+
+fn send_over_stream(
+    stream: &mut TransportStream,
+    context: &Context,
+    message: String,
+) -> Result<(), String> {
+    let message_len = message.len();
+    info!("Sending TCP payload ({} bytes)", message_len);
+    stream
+        .write_message(message.as_bytes())
+        .map_err(|e| {
+            let message = e.to_string();
+            let _ = context.callback_data(
+                "TCP SOCKET ERROR",
+                "TAK Socket disconnected",
+                message.clone(),
+            );
+            message
+        })
+}
+
+fn flush_pending_messages(
+    connection: &mut Option<TransportStream>,
+    pending_messages: &mut VecDeque<(String, Context)>,
+    state: &mut ConnectionState,
+) {
+    if pending_messages.is_empty() {
+        return;
+    }
+
+    let Some(stream) = connection.as_mut() else {
+        return;
+    };
+
+    info!(
+        "Flushing {} queued TCP payload(s) after connection became active",
+        pending_messages.len()
+    );
+
+    while let Some((message, context)) = pending_messages.pop_front() {
+        if let Err(error) = send_over_stream(stream, &context, message) {
+            info!("Failed to send queued message: {}", error);
+            *state = ConnectionState::Failed(error);
+            *connection = None;
+            return;
+        }
+    }
+}
+
+fn poll_connect_event(
+    connect_rx: &Receiver<ConnectEvent>,
+    connection: &mut Option<TransportStream>,
+    state: &mut ConnectionState,
+    pending_messages: &mut VecDeque<(String, Context)>,
+    ctx: &Context,
+    connection_message: &str,
+    target: &str,
+) {
+    loop {
+        match connect_rx.try_recv() {
+            Ok(ConnectEvent::Connected(stream)) => {
+                info!("TCP connection established successfully: {}", target);
+                let _ = ctx.callback_data("TCP SOCKET", connection_message, target.to_string());
+                *connection = Some(stream);
+                *state = ConnectionState::Connected;
+                flush_pending_messages(connection, pending_messages, state);
+            }
+            Ok(ConnectEvent::Failed(error)) => {
+                info!("Failed to connect to TCP server: {}", error);
+                let _ = ctx.callback_data(
+                    "TCP SOCKET ERROR",
+                    "TAK Socket connection failed",
+                    error.clone(),
+                );
+                *state = ConnectionState::Failed(error);
+            }
+            Err(TryRecvError::Empty) => break,
+            Err(TryRecvError::Disconnected) => break,
+        }
+    }
+}
+
+impl TcpClient {
+    pub fn start(&self, config: ConnectionConfig, rx: Receiver<TcpCommand>, ctx: Context) {
+        if let Some(ref client) = *TCP_CLIENT.lock().unwrap() {
+            info!("Existing TCP client detected; stopping previous instance before restart.");
+            client.stop();
+        }
+
+        thread::spawn(move || {
+            let mut running = true;
+            let connection_message = config.connected_message();
+            let config_description = config.describe();
+            let target = config.target();
+            let mut state = ConnectionState::Connecting;
+            let mut connection: Option<TransportStream> = None;
+            let mut pending_messages: VecDeque<(String, Context)> = VecDeque::new();
+            let (connect_tx, connect_rx) = mpsc::channel();
+
+            info!("TCP worker thread started with config: {}", config_description);
+
+            let tcp_thread = thread::spawn(move || {
+                let connect_result = panic::catch_unwind(AssertUnwindSafe(|| connect_stream(&config)));
+
+                match connect_result {
+                    Ok(Ok(stream)) => {
+                        let _ = connect_tx.send(ConnectEvent::Connected(stream));
+                    }
+                    Ok(Err(error)) => {
+                        let _ = connect_tx.send(ConnectEvent::Failed(error));
+                    }
+                    Err(payload) => {
+                        let message = format!(
+                            "TCP connection worker panicked: {}",
+                            describe_panic_payload(payload)
+                        );
+                        let _ = connect_tx.send(ConnectEvent::Failed(message));
+                    }
+                }
+            });
+
+            while running {
+                poll_connect_event(
+                    &connect_rx,
+                    &mut connection,
+                    &mut state,
+                    &mut pending_messages,
+                    &ctx,
+                    connection_message,
+                    &target,
+                );
+
+                match rx.recv_timeout(CONNECT_POLL_INTERVAL) {
+                    Ok(TcpCommand::SendMessage(message, context)) => {
+                        let message_len = message.len();
+                        match &mut state {
+                            ConnectionState::Connected => {
+                                if let Some(stream) = connection.as_mut() {
+                                    if let Err(error) = send_over_stream(stream, &context, message) {
+                                        info!("Failed to send message: {}", error);
+                                        state = ConnectionState::Failed(error);
+                                        connection = None;
+                                    }
+                                } else {
+                                    warn!(
+                                        "Connection state said connected, but no socket was present; queuing payload."
+                                    );
+                                    pending_messages.push_back((message, context));
+                                }
+                            }
+                            ConnectionState::Connecting => {
+                                if pending_messages.len() >= MAX_PENDING_MESSAGES {
+                                    let preview = log_message_preview(&message);
+                                    warn!(
+                                        "Dropping TCP payload because connection is still pending and queue is full ({} bytes, preview={:?})",
+                                        message_len, preview
+                                    );
+                                    let _ = context.callback_data(
+                                        "TCP SOCKET ERROR",
+                                        "TAK Socket is still connecting",
+                                        format!(
+                                            "queue full while connecting; dropped payload ({} bytes, preview={:?})",
+                                            message_len, preview
+                                        ),
+                                    );
+                                } else {
+                                    info!(
+                                        "Queueing TCP payload while connection is pending ({} bytes, queued={})",
+                                        message_len,
+                                        pending_messages.len() + 1
+                                    );
+                                    pending_messages.push_back((message, context));
+                                }
+                            }
+                            ConnectionState::Failed(error) => {
+                                let preview = log_message_preview(&message);
+                                warn!(
+                                    "Dropping TCP payload because connection is in failed state ({} bytes, preview={:?}, error={})",
+                                    message_len, preview, error
+                                );
+                                let _ = context.callback_data(
+                                    "TCP SOCKET ERROR",
+                                    "TAK Socket is not connected",
+                                    error.clone(),
+                                );
+                            }
+                        }
+                    }
+                    Ok(TcpCommand::Stop) => {
+                        running = false;
+                        info!("Stopping TCP client.");
+                    }
+                    Err(RecvTimeoutError::Timeout) => {}
+                    Err(RecvTimeoutError::Disconnected) => {
+                        warn!("TCP command channel disconnected.");
+                        running = false;
+                    }
+                }
+            }
+
+            info!("Waiting for TCP connection thread to finish.");
+            match tcp_thread.join() {
+                Ok(()) => info!("TCP connection thread joined successfully."),
+                Err(payload) => warn!(
+                    "TCP connection thread join reported a panic: {}",
+                    describe_panic_payload(payload)
+                ),
+            }
+            info!("TCP worker thread finished.");
+        });
+    }
+
+    pub fn send_payload(&self, context: Context, payload: String) {
+        let tx = self.tx.clone();
+        thread::spawn(move || {
+            info!("Dispatching queued TCP payload command.");
+            if let Err(error) = tx.send(TcpCommand::SendMessage(payload, context)) {
+                warn!("Failed to dispatch TCP payload command: {}", error);
+            }
+        });
+    }
+
+    pub fn stop(&self) {
+        let tx = self.tx.clone();
+        thread::spawn(move || {
+            info!("Dispatching TCP stop command.");
+            if let Err(error) = tx.send(TcpCommand::Stop) {
+                warn!("Failed to dispatch TCP stop command: {}", error);
+            }
+        });
+    }
+}

src/tcp/config.rs

@@ -0,0 +1,64 @@
+pub enum ConnectionConfig {
+    Plain {
+        address: String,
+    },
+    Mtls {
+        address: String,
+        server_name: String,
+        ca_cert_path: String,
+        client_cert_path: String,
+        client_key_path: String,
+    },
+    EnrollMtls {
+        host: String,
+        server_name: String,
+        enroll_port: String,
+        username: String,
+        password: String,
+        client_uid: String,
+    },
+}
+
+impl ConnectionConfig {
+    pub fn connected_message(&self) -> &'static str {
+        match self {
+            Self::Plain { .. } => "Connected to TCP Server",
+            Self::Mtls { .. } => "Connected to TAK Server via mTLS",
+            Self::EnrollMtls { .. } => "Connected to TAK Server via enrolled mTLS certificate",
+        }
+    }
+
+    pub fn target(&self) -> String {
+        match self {
+            Self::Plain { address } | Self::Mtls { address, .. } => address.clone(),
+            Self::EnrollMtls { host, .. } => host.clone(),
+        }
+    }
+
+    pub fn describe(&self) -> String {
+        match self {
+            Self::Plain { address } => format!("plain tcp -> {}", address),
+            Self::Mtls {
+                address,
+                server_name,
+                ca_cert_path,
+                client_cert_path,
+                client_key_path,
+            } => format!(
+                "manual mtls -> {} (server_name={}, ca={}, cert={}, key={})",
+                address, server_name, ca_cert_path, client_cert_path, client_key_path
+            ),
+            Self::EnrollMtls {
+                host,
+                server_name,
+                enroll_port,
+                username,
+                client_uid,
+                ..
+            } => format!(
+                "enroll mtls -> host={} enroll_port={} server_name={} username={} client_uid={}",
+                host, enroll_port, server_name, username, client_uid
+            ),
+        }
+    }
+}

src/tcp/cot.rs

@@ -9,21 +9,30 @@ pub fn send_eud_cot(ctx: Context, cursor_over_time: cot::eud::EudCoTPayload) ->
     "Sending End User Device Cursor Over Time to TCP server"
 }
 
-pub fn send_marker_cot(ctx: Context, cursor_over_time: cot::nato::MarkerCoTPayload) -> &'static str {
+pub fn send_marker_cot(
+    ctx: Context,
+    cursor_over_time: cot::nato::MarkerCoTPayload,
+) -> &'static str {
     let payload = cursor_over_time.to_cot().convert_to_xml();
     send_payload(ctx, payload);
 
     "Sending Marker Cursor Over Time to TCP server"
 }
 
-pub fn send_digital_pointer_cot(ctx: Context, cursor_over_time: cot::digital_pointer::DigitalPointerPayload) -> &'static str {
+pub fn send_digital_pointer_cot(
+    ctx: Context,
+    cursor_over_time: cot::digital_pointer::DigitalPointerPayload,
+) -> &'static str {
     let payload = cursor_over_time.to_cot().convert_to_xml();
     send_payload(ctx, payload);
 
     "Sending Digital Pointer Cursor Over Time to TCP server"
 }
 
-pub fn send_message_cot(ctx: Context, message_payload: cot::message::MessagePayload) -> &'static str {
+pub fn send_message_cot(
+    ctx: Context,
+    message_payload: cot::message::MessagePayload,
+) -> &'static str {
     let message_cot = cot::message::MessageCot::from_payload(message_payload);
     let payload = message_cot.to_xml();
     send_payload(ctx, payload);

src/tcp/draw.rs

@@ -2,7 +2,10 @@ use arma_rs::Context;
 
 use crate::{cot, tcp::send_payload};
 
-pub fn send_circle_cot(ctx: Context, circle_payload: cot::draws::circle::CircleCoTPayload) -> &'static str {
+pub fn send_circle_cot(
+    ctx: Context,
+    circle_payload: cot::draws::circle::CircleCoTPayload,
+) -> &'static str {
     let shape_circle_cot = circle_payload.to_cot();
     let now = chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Millis, true);
     let stale = (chrono::Utc::now() + chrono::Duration::days(1))
@@ -14,21 +17,21 @@ pub fn send_circle_cot(ctx: Context, circle_payload: cot::draws::circle::CircleC
 }
 
 pub fn send_ellipse_cot(ctx: Context) -> &'static str {
-  let _ = ctx;
+    let _ = ctx;
-  "Not implemented: send_ellipse_cot"
+    "Not implemented: send_ellipse_cot"
 }
 
 pub fn send_rectangle_cot(ctx: Context) -> &'static str {
-  let _ = ctx;
+    let _ = ctx;
-  "Not implemented: send_ellipse_cot"
+    "Not implemented: send_ellipse_cot"
 }
 
 pub fn send_freedraw_cot(ctx: Context) -> &'static str {
-  let _ = ctx;
+    let _ = ctx;
-  "Not implemented: send_ellipse_cot"
+    "Not implemented: send_ellipse_cot"
 }
 
 pub fn send_vectordraw_cot(ctx: Context) -> &'static str {
-  let _ = ctx;
+    let _ = ctx;
-  "Not implemented: send_ellipse_cot"
+    "Not implemented: send_ellipse_cot"
 }

src/tcp/mod.rs

@@ -1,120 +1,90 @@
 use arma_rs::Context;
 use lazy_static::lazy_static;
 use log::info;
-use std::io::Write;
-use std::net::TcpStream;
 use std::sync::mpsc::{self, Receiver, Sender};
 use std::sync::{Arc, Mutex};
-use std::thread;
+
+mod client;
+mod config;
+mod tls;
+mod transport;
 
 pub mod cot;
 pub mod draw;
 
-pub enum TcpCommand {
+use client::{TcpClient, TcpCommand};
-    SendMessage(String, Context),
+use config::ConnectionConfig;
-    Stop,
-}
-
-pub struct TcpClient {
-    pub(crate) tx: Sender<TcpCommand>,
-}
-
-impl TcpClient {
-    pub fn start(&self, address: String, rx: Receiver<TcpCommand>, ctx: Context) {
-        if let Some(ref client) = *TCP_CLIENT.lock().unwrap() {
-            client.stop();
-        }
-
-        let connection = Arc::new(Mutex::new(None));
-        let connection_clone = Arc::clone(&connection);
-
-        thread::spawn(move || {
-            let mut running = true;
-
-            let tcp_thread = thread::spawn(move || match TcpStream::connect(&address) {
-                Ok(stream) => {
-                    let _ = ctx.callback_data("TCP SOCKET", "Connected to TCP Server", address);
-                    *connection_clone.lock().unwrap() = Some(stream);
-                }
-                Err(e) => {
-                    let _ = ctx.callback_data(
-                        "TCP SOCKET ERROR",
-                        "TAK Socket connection failed",
-                        e.to_string(),
-                    );
-                    info!("Failed to connect to TCP server: {}", e);
-                }
-            });
-
-            while running {
-                match rx.recv() {
-                    Ok(TcpCommand::SendMessage(message, context)) => {
-                        if let Some(mut stream) = connection.lock().unwrap().as_ref() {
-                            if let Err(e) = stream.write_all(message.as_bytes()) {
-                                info!("Failed to send message: {}", e);
-
-                                let _ = context.callback_data(
-                                    "TCP SOCKET ERROR",
-                                    "TAK Socket disconnected",
-                                    e.to_string(),
-                                );
-
-                                running = false;
-                            }
-                        } else {
-                            let _ = context.callback_null(
-                                "TCP SOCKET ERROR",
-                                "TAK Socket is not active",
-                            );
-                        }
-                    }
-                    Ok(TcpCommand::Stop) => {
-                        running = false;
-                        info!("Stopping TCP client.");
-                    }
-                    Err(error) => {
-                        info!("Error receiving command: {}", error.to_string());
-                    }
-                }
-            }
-
-            tcp_thread.join().unwrap();
-        });
-    }
-
-    pub fn send_payload(&self, context: Context, payload: String) {
-        let tx = self.tx.clone();
-        thread::spawn(move || {
-            tx.send(TcpCommand::SendMessage(payload, context)).unwrap();
-        });
-    }
-
-    pub fn stop(&self) {
-        let tx = self.tx.clone();
-        thread::spawn(move || {
-            tx.send(TcpCommand::Stop).unwrap();
-        });
-    }
-}
 
 lazy_static! {
     static ref TCP_CLIENT: Arc<Mutex<Option<TcpClient>>> = Arc::new(Mutex::new(None));
 }
 
-pub fn start(ctx: Context, address: String) -> &'static str {
+fn start_with_config(ctx: Context, config: ConnectionConfig) {
+    info!("Starting TCP client with config: {}", config.describe());
     let (tx, rx): (Sender<TcpCommand>, Receiver<TcpCommand>) = mpsc::channel();
 
     let client = TcpClient { tx };
-    client.start(address, rx, ctx);
+    client.start(config, rx, ctx);
 
     let mut client_guard = TCP_CLIENT.lock().unwrap();
     *client_guard = Some(client);
+}
+
+pub fn start(ctx: Context, address: String) -> &'static str {
+    start_with_config(ctx, ConnectionConfig::Plain { address });
 
     "Starting TCP Client"
 }
 
+pub fn start_mtls(
+    ctx: Context,
+    address: String,
+    server_name: String,
+    ca_cert_path: String,
+    client_cert_path: String,
+    client_key_path: String,
+) -> &'static str {
+    start_with_config(
+        ctx,
+        ConnectionConfig::Mtls {
+            address,
+            server_name,
+            ca_cert_path,
+            client_cert_path,
+            client_key_path,
+        },
+    );
+
+    "Starting mTLS TCP Client"
+}
+
+pub fn start_enroll_mtls(
+    ctx: Context,
+    host: String,
+    server_name: String,
+    enroll_port: String,
+    username: String,
+    password: String,
+    client_uid: String,
+) -> &'static str {
+    start_with_config(
+        ctx,
+        ConnectionConfig::EnrollMtls {
+            host,
+            server_name,
+            enroll_port,
+            username,
+            password,
+            client_uid,
+        },
+    );
+
+    "Starting enrolled mTLS TCP Client"
+}
+
 pub fn send_payload(ctx: Context, payload: String) -> &'static str {
     if let Some(ref client) = *TCP_CLIENT.lock().unwrap() {
+        info!("Queueing TCP payload ({} bytes)", payload.len());
         client.send_payload(ctx, payload);
     } else {
         let _ = ctx.callback_null("TCP SOCKET ERROR", "TCP Client is not running");
@@ -126,6 +96,7 @@ pub fn send_payload(ctx: Context, payload: String) -> &'static str {
 
 pub fn stop(ctx: Context) -> &'static str {
     if let Some(ref client) = *TCP_CLIENT.lock().unwrap() {
+        info!("Stopping TCP client via extension command.");
         client.stop();
         let _ = ctx.callback_null("TCP SOCKET", "TCP client stopped");
     } else {

src/tcp/tls/connector.rs

@@ -0,0 +1,221 @@
+use log::info;
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
+use rustls::{ClientConfig, ClientConnection, RootCertStore, StreamOwned};
+use rustls_pemfile::{certs, private_key};
+use std::fs::File;
+use std::io::BufReader;
+use std::io::Cursor;
+use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
+use std::time::Duration;
+use std::sync::Arc;
+
+use crate::tcp::transport::TransportStream;
+
+const TCP_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+const SOCKET_IO_TIMEOUT: Duration = Duration::from_secs(10);
+
+fn load_certificates(path: &str) -> Result<Vec<CertificateDer<'static>>, String> {
+    let file = File::open(path).map_err(|e| format!("failed to open cert file {}: {}", path, e))?;
+    let mut reader = BufReader::new(file);
+
+    certs(&mut reader)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|e| format!("failed to read certs from {}: {}", path, e))
+}
+
+fn load_private_key(path: &str) -> Result<PrivateKeyDer<'static>, String> {
+    let file = File::open(path).map_err(|e| format!("failed to open key file {}: {}", path, e))?;
+    let mut reader = BufReader::new(file);
+
+    private_key(&mut reader)
+        .map_err(|e| format!("failed to read private key from {}: {}", path, e))?
+        .ok_or_else(|| format!("no supported private key found in {}", path))
+}
+
+fn load_certificates_from_pem(pem: &str) -> Result<Vec<CertificateDer<'static>>, String> {
+    let mut reader = Cursor::new(pem.as_bytes());
+
+    certs(&mut reader)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|e| format!("failed to read certs from PEM payload: {}", e))
+}
+
+fn load_private_key_from_pem(pem: &str) -> Result<PrivateKeyDer<'static>, String> {
+    let mut reader = Cursor::new(pem.as_bytes());
+
+    private_key(&mut reader)
+        .map_err(|e| format!("failed to read private key from PEM payload: {}", e))?
+        .ok_or_else(|| "no supported private key found in PEM payload".to_string())
+}
+
+fn infer_server_name(address: &str) -> &str {
+    address
+        .trim()
+        .trim_start_matches('[')
+        .split(']')
+        .next()
+        .unwrap_or(address)
+        .split(':')
+        .next()
+        .unwrap_or(address)
+}
+
+fn resolve_address(address: &str) -> Result<SocketAddr, String> {
+    address
+        .to_socket_addrs()
+        .map_err(|e| format!("failed to resolve {}: {}", address, e))?
+        .next()
+        .ok_or_else(|| format!("failed to resolve {}: no socket addresses returned", address))
+}
+
+fn connect_tcp(address: &str) -> Result<TcpStream, String> {
+    let socket_addr = resolve_address(address)?;
+    info!(
+        "Opening TCP connection to {} (resolved={}) with timeout {:?}",
+        address, socket_addr, TCP_CONNECT_TIMEOUT
+    );
+
+    let tcp_stream = TcpStream::connect_timeout(&socket_addr, TCP_CONNECT_TIMEOUT)
+        .map_err(|e| format!("failed to connect to {}: {}", address, e))?;
+
+    tcp_stream
+        .set_read_timeout(Some(SOCKET_IO_TIMEOUT))
+        .map_err(|e| format!("failed to set read timeout on {}: {}", address, e))?;
+    tcp_stream
+        .set_write_timeout(Some(SOCKET_IO_TIMEOUT))
+        .map_err(|e| format!("failed to set write timeout on {}: {}", address, e))?;
+
+    Ok(tcp_stream)
+}
+
+pub fn connect_mtls(
+    address: &str,
+    server_name: &str,
+    ca_cert_path: &str,
+    client_cert_path: &str,
+    client_key_path: &str,
+) -> Result<TransportStream, String> {
+    info!(
+        "Connecting mTLS from file paths to {} using server_name={}",
+        address, server_name
+    );
+    let mut root_store = RootCertStore::empty();
+    let ca_certificates = load_certificates(ca_cert_path)?;
+    info!(
+        "Loaded {} CA certificate(s) from {}",
+        ca_certificates.len(),
+        ca_cert_path
+    );
+    for certificate in ca_certificates {
+        root_store
+            .add(certificate)
+            .map_err(|e| format!("failed to add CA certificate from {}: {}", ca_cert_path, e))?;
+    }
+
+    let client_certificates = load_certificates(client_cert_path)?;
+    info!(
+        "Loaded {} client certificate(s) from {}",
+        client_certificates.len(),
+        client_cert_path
+    );
+    let client_key = load_private_key(client_key_path)?;
+    info!("Loaded client private key from {}", client_key_path);
+
+    let tls_config = ClientConfig::builder()
+        .with_root_certificates(root_store)
+        .with_client_auth_cert(client_certificates, client_key)
+        .map_err(|e| format!("failed to configure mTLS client: {}", e))?;
+    info!("Constructed rustls client config for {}", address);
+
+    let tcp_stream = connect_tcp(address)?;
+    let resolved_server_name = if server_name.trim().is_empty() {
+        infer_server_name(address).to_string()
+    } else {
+        server_name.trim().to_string()
+    };
+
+    let server_name = ServerName::try_from(resolved_server_name.clone())
+        .map_err(|_| format!("invalid TLS server name: {}", resolved_server_name))?;
+    let mut tls_stream = StreamOwned::new(
+        ClientConnection::new(Arc::new(tls_config), server_name)
+            .map_err(|e| format!("failed to create TLS client: {}", e))?,
+        tcp_stream,
+    );
+
+    info!("Starting mTLS handshake for {}", address);
+    while tls_stream.conn.is_handshaking() {
+        tls_stream
+            .conn
+            .complete_io(&mut tls_stream.sock)
+            .map_err(|e| format!("TLS handshake failed: {}", e))?;
+    }
+
+    info!("mTLS handshake completed successfully for {}", address);
+
+    Ok(TransportStream::Mtls(tls_stream))
+}
+
+pub fn connect_mtls_from_pem(
+    address: &str,
+    server_name: &str,
+    ca_cert_pem: &str,
+    client_cert_pem: &str,
+    client_key_pem: &str,
+) -> Result<TransportStream, String> {
+    info!(
+        "Connecting mTLS from in-memory PEM payloads to {} using server_name={}",
+        address, server_name
+    );
+    let mut root_store = RootCertStore::empty();
+    let ca_certificates = load_certificates_from_pem(ca_cert_pem)?;
+    info!(
+        "Loaded {} CA certificate(s) from enrollment payload",
+        ca_certificates.len()
+    );
+    for certificate in ca_certificates {
+        root_store
+            .add(certificate)
+            .map_err(|e| format!("failed to add CA certificate from PEM payload: {}", e))?;
+    }
+
+    let client_certificates = load_certificates_from_pem(client_cert_pem)?;
+    info!(
+        "Loaded {} client certificate(s) from enrollment payload",
+        client_certificates.len()
+    );
+    let client_key = load_private_key_from_pem(client_key_pem)?;
+    info!("Loaded client private key from enrollment payload");
+
+    let tls_config = ClientConfig::builder()
+        .with_root_certificates(root_store)
+        .with_client_auth_cert(client_certificates, client_key)
+        .map_err(|e| format!("failed to configure mTLS client: {}", e))?;
+    info!("Constructed rustls client config for {}", address);
+
+    let tcp_stream = connect_tcp(address)?;
+    let resolved_server_name = if server_name.trim().is_empty() {
+        infer_server_name(address).to_string()
+    } else {
+        server_name.trim().to_string()
+    };
+
+    let server_name = ServerName::try_from(resolved_server_name.clone())
+        .map_err(|_| format!("invalid TLS server name: {}", resolved_server_name))?;
+    let mut tls_stream = StreamOwned::new(
+        ClientConnection::new(Arc::new(tls_config), server_name)
+            .map_err(|e| format!("failed to create TLS client: {}", e))?,
+        tcp_stream,
+    );
+
+    info!("Starting mTLS handshake for {}", address);
+    while tls_stream.conn.is_handshaking() {
+        tls_stream
+            .conn
+            .complete_io(&mut tls_stream.sock)
+            .map_err(|e| format!("TLS handshake failed: {}", e))?;
+    }
+
+    info!("mTLS handshake completed successfully for {}", address);
+
+    Ok(TransportStream::Mtls(tls_stream))
+}

src/tcp/tls/enrollment.rs

@@ -0,0 +1,228 @@
+use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_RSA_SHA256};
+use log::info;
+use reqwest::blocking::Client;
+use serde::Deserialize;
+use uuid::Uuid;
+
+use super::connector::connect_mtls_from_pem;
+use crate::tcp::transport::TransportStream;
+
+#[derive(Deserialize)]
+struct EnrollmentResponse {
+    #[serde(rename = "signedCert")]
+    signed_cert: String,
+    ca0: String,
+}
+
+struct EnrollmentConfig {
+    server_port: String,
+    enroll_path: String,
+}
+
+fn extract_tag_value(xml: &str, tag_name: &str) -> Option<String> {
+    let open_tag = format!("<{}>", tag_name);
+    let close_tag = format!("</{}>", tag_name);
+    let start = xml.find(&open_tag)? + open_tag.len();
+    let end = xml[start..].find(&close_tag)? + start;
+    Some(xml[start..end].trim().to_string())
+}
+
+fn wrap_pem_body(base64_body: &str, begin: &str, end: &str) -> String {
+    let mut wrapped = String::new();
+    let normalized = base64_body.trim().replace(['\r', '\n'], "");
+
+    wrapped.push_str(begin);
+    wrapped.push('\n');
+    for chunk in normalized.as_bytes().chunks(64) {
+        wrapped.push_str(std::str::from_utf8(chunk).unwrap_or_default());
+        wrapped.push('\n');
+    }
+    wrapped.push_str(end);
+    wrapped.push('\n');
+    wrapped
+}
+
+fn enrollment_http_client() -> Result<Client, String> {
+    Client::builder()
+        .danger_accept_invalid_certs(true)
+        .build()
+        .map_err(|e| format!("failed to build enrollment HTTP client: {}", e))
+}
+
+fn response_error_details(response: reqwest::blocking::Response) -> String {
+    let status = response.status();
+    match response.text() {
+        Ok(body) => {
+            let trimmed = body.trim();
+            if trimmed.is_empty() {
+                status.to_string()
+            } else {
+                format!("{}: {}", status, trimmed)
+            }
+        }
+        Err(_) => status.to_string(),
+    }
+}
+
+fn fetch_enrollment_config(host: &str, enroll_port: &str) -> Result<EnrollmentConfig, String> {
+    let url = format!(
+        "https://{}:{}/Marti/api/tls/config",
+        host.trim(),
+        enroll_port.trim()
+    );
+    info!("Fetching TAK enrollment config from {}", url);
+
+    let response = enrollment_http_client()?
+        .get(&url)
+        .send()
+        .map_err(|e| format!("failed to fetch {}: {}", url, e))?;
+
+    if !response.status().is_success() {
+        return Err(format!(
+            "failed to fetch {}: {}",
+            url,
+            response_error_details(response)
+        ));
+    }
+
+    let response_text = response
+        .text()
+        .map_err(|e| format!("failed to read config response from {}: {}", url, e))?;
+
+    let server_port = extract_tag_value(&response_text, "serverPort")
+        .ok_or_else(|| "missing serverPort in /Marti/api/tls/config response".to_string())?;
+    let enroll_path = extract_tag_value(&response_text, "enrollPath")
+        .ok_or_else(|| "missing enrollPath in /Marti/api/tls/config response".to_string())?;
+
+    info!(
+        "Enrollment config received: server_port={} enroll_path={}",
+        server_port, enroll_path
+    );
+
+    Ok(EnrollmentConfig {
+        server_port,
+        enroll_path,
+    })
+}
+
+fn enroll_client_certificate(
+    host: &str,
+    enroll_port: &str,
+    enroll_path: &str,
+    username: &str,
+    password: &str,
+    client_uid: &str,
+) -> Result<(String, String, String), String> {
+    info!(
+        "Generating RSA client keypair and CSR for enrolled TAK client {}",
+        client_uid
+    );
+    let key_pair = KeyPair::generate_for(&PKCS_RSA_SHA256)
+        .map_err(|e| format!("failed to generate client keypair: {}", e))?;
+
+    let mut distinguished_name = DistinguishedName::new();
+    distinguished_name.push(DnType::CommonName, client_uid);
+    distinguished_name.push(DnType::OrganizationName, "ArmaTAK");
+    distinguished_name.push(DnType::OrganizationalUnitName, "ArmaTAK Session");
+
+    let mut params = CertificateParams::new(vec![])
+        .map_err(|e| format!("failed to create CSR params: {}", e))?;
+    params.distinguished_name = distinguished_name;
+
+    let csr = params
+        .serialize_request(&key_pair)
+        .map_err(|e| format!("failed to generate CSR: {}", e))?;
+    let csr_der = csr.der().as_ref().to_vec();
+
+    let url = format!(
+        "https://{}:{}{}?clientUid={}",
+        host.trim(),
+        enroll_port.trim(),
+        enroll_path.trim(),
+        client_uid.trim()
+    );
+    info!(
+        "Submitting client certificate enrollment request for {} to {}",
+        client_uid, url
+    );
+
+    let response = enrollment_http_client()?
+        .post(&url)
+        .basic_auth(username.trim(), Some(password.to_string()))
+        .header("Accept", "application/json")
+        .header("Content-Type", "application/pkcs10")
+        .body(csr_der)
+        .send()
+        .map_err(|e| format!("failed to enroll client certificate at {}: {}", url, e))?;
+
+    if !response.status().is_success() {
+        return Err(format!(
+            "failed to enroll client certificate at {}: {}",
+            url,
+            response_error_details(response)
+        ));
+    }
+
+    let enrollment: EnrollmentResponse = response
+        .json()
+        .map_err(|e| format!("failed to parse enrollment response: {}", e))?;
+    info!(
+        "Enrollment response parsed successfully for {} (signed_cert_len={}, ca_len={})",
+        client_uid,
+        enrollment.signed_cert.len(),
+        enrollment.ca0.len()
+    );
+
+    let cert_pem = wrap_pem_body(
+        &enrollment.signed_cert,
+        "-----BEGIN CERTIFICATE-----",
+        "-----END CERTIFICATE-----",
+    );
+    let key_pem = key_pair.serialize_pem();
+
+    Ok((enrollment.ca0, cert_pem, key_pem))
+}
+
+pub fn enroll_and_connect(
+    host: &str,
+    server_name: &str,
+    enroll_port: &str,
+    username: &str,
+    password: &str,
+    client_uid: &str,
+) -> Result<TransportStream, String> {
+    let normalized_client_uid = if client_uid.trim().is_empty() {
+        format!("armatak-{}", Uuid::new_v4())
+    } else {
+        client_uid.trim().to_string()
+    };
+    info!(
+        "Starting enroll_and_connect for host={} enroll_port={} server_name={} client_uid={}",
+        host,
+        enroll_port,
+        server_name,
+        normalized_client_uid
+    );
+
+    let enrollment_config = fetch_enrollment_config(host, enroll_port)?;
+    let (ca_cert_pem, client_cert_pem, client_key_pem) = enroll_client_certificate(
+        host,
+        enroll_port,
+        &enrollment_config.enroll_path,
+        username,
+        password,
+        &normalized_client_uid,
+    )?;
+
+    connect_mtls_from_pem(
+        &format!("{}:{}", host.trim(), enrollment_config.server_port.trim()),
+        if server_name.trim().is_empty() {
+            host.trim()
+        } else {
+            server_name.trim()
+        },
+        &ca_cert_pem,
+        &client_cert_pem,
+        &client_key_pem,
+    )
+}

src/tcp/tls/mod.rs

@@ -0,0 +1,5 @@
+mod connector;
+mod enrollment;
+
+pub use connector::connect_mtls;
+pub use enrollment::enroll_and_connect;

src/tcp/transport.rs

@@ -0,0 +1,90 @@
+use log::info;
+use rustls::{ClientConnection, StreamOwned};
+use std::io::Write;
+use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
+use std::time::Duration;
+
+use super::config::ConnectionConfig;
+use super::tls::{connect_mtls, enroll_and_connect};
+
+const TCP_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+const SOCKET_IO_TIMEOUT: Duration = Duration::from_secs(10);
+
+pub enum TransportStream {
+    Plain(TcpStream),
+    Mtls(StreamOwned<ClientConnection, TcpStream>),
+}
+
+impl TransportStream {
+    pub fn write_message(&mut self, message: &[u8]) -> Result<(), std::io::Error> {
+        match self {
+            Self::Plain(stream) => {
+                stream.write_all(message)?;
+                stream.flush()
+            }
+            Self::Mtls(stream) => {
+                stream.write_all(message)?;
+                stream.flush()
+            }
+        }
+    }
+}
+
+fn connect_plain(address: &str) -> Result<TransportStream, String> {
+    let socket_addr: SocketAddr = address
+        .to_socket_addrs()
+        .map_err(|e| format!("failed to resolve {}: {}", address, e))?
+        .next()
+        .ok_or_else(|| format!("failed to resolve {}: no socket addresses returned", address))?;
+
+    info!(
+        "Opening plain TCP connection to {} (resolved={}) with timeout {:?}",
+        address, socket_addr, TCP_CONNECT_TIMEOUT
+    );
+
+    let stream = TcpStream::connect_timeout(&socket_addr, TCP_CONNECT_TIMEOUT)
+        .map_err(|e| format!("failed to connect to {}: {}", address, e))?;
+    stream
+        .set_read_timeout(Some(SOCKET_IO_TIMEOUT))
+        .map_err(|e| format!("failed to set read timeout on {}: {}", address, e))?;
+    stream
+        .set_write_timeout(Some(SOCKET_IO_TIMEOUT))
+        .map_err(|e| format!("failed to set write timeout on {}: {}", address, e))?;
+
+    Ok(TransportStream::Plain(stream))
+}
+
+pub fn connect_stream(config: &ConnectionConfig) -> Result<TransportStream, String> {
+    info!("connect_stream invoked for {}", config.describe());
+    match config {
+        ConnectionConfig::Plain { address } => connect_plain(address),
+        ConnectionConfig::Mtls {
+            address,
+            server_name,
+            ca_cert_path,
+            client_cert_path,
+            client_key_path,
+        } => connect_mtls(
+            address,
+            server_name,
+            ca_cert_path,
+            client_cert_path,
+            client_key_path,
+        ),
+        ConnectionConfig::EnrollMtls {
+            host,
+            server_name,
+            enroll_port,
+            username,
+            password,
+            client_uid,
+        } => enroll_and_connect(
+            host,
+            server_name,
+            enroll_port,
+            username,
+            password,
+            client_uid,
+        ),
+    }
+}

src/tests.rs

@@ -1,25 +1,25 @@
 #[cfg(test)]
 mod tests {
-        use crate::init;
+    use crate::init;
-        use uuid::Uuid;
+    use std::vec;
-        use std::vec;
+    use uuid::Uuid;
 
-        #[test]
+    #[test]
-        fn uuid_output_is_uuid4_identifier() {
+    fn uuid_output_is_uuid4_identifier() {
-            let extension = init().testing();
+        let extension = init().testing();
-            let (output, _) = extension.call("uuid", None);
+        let (output, _) = extension.call("uuid", None);
 
-            let validation = Uuid::parse_str(&output);
+        let validation = Uuid::parse_str(&output);
 
-            assert!(validation.is_ok())
+        assert!(validation.is_ok())
-        }
+    }
 
-        #[test]
+    #[test]
-        fn uuid_output_throws_if_passed_args() {
+    fn uuid_output_throws_if_passed_args() {
-            let extension = init().testing();
+        let extension = init().testing();
-            let args: Vec<String> = vec![1.to_string(),2.to_string()];
+        let args: Vec<String> = vec![1.to_string(), 2.to_string()];
-            let (output, _) = extension.call("uuid", Some(args));
+        let (output, _) = extension.call("uuid", Some(args));
 
-            assert_eq!(output,"")
+        assert_eq!(output, "")
-        }
+    }
 }

src/udp_socket.rs

@@ -9,116 +9,119 @@ use std::thread;
 use crate::cot;
 
 pub enum UdpCommand {
-  SendMessage(String, Context),
+    SendMessage(String, Context),
-  Stop,
+    Stop,
 }
 
 pub struct UdpClient {
-  pub(crate) tx: Sender<UdpCommand>,
+    pub(crate) tx: Sender<UdpCommand>,
 }
 
 impl UdpClient {
-  pub fn start(&self, address: String, rx: Receiver<UdpCommand>, ctx: Context) {
+    pub fn start(&self, address: String, rx: Receiver<UdpCommand>, ctx: Context) {
-    if let Some(ref client) = *UDP_CLIENT.lock().unwrap() {
+        if let Some(ref client) = *UDP_CLIENT.lock().unwrap() {
-      client.stop();
+            client.stop();
+        }
+
+        thread::spawn(move || {
+            let socket = match UdpSocket::bind("0.0.0.0:0") {
+                Ok(s) => s,
+                Err(e) => {
+                    let _ = ctx.callback_data(
+                        "UDP SOCKET ERROR",
+                        "Failed to bind UDP socket",
+                        e.to_string(),
+                    );
+                    info!("Failed to bind UDP socket: {}", e);
+                    return;
+                }
+            };
+
+            let _ = ctx.callback_data("UDP SOCKET", "EUD Connected", address.clone());
+
+            let mut running = true;
+            while running {
+                match rx.recv() {
+                    Ok(UdpCommand::SendMessage(message, context)) => {
+                        if let Err(e) = socket.send_to(message.as_bytes(), &address) {
+                            info!("Failed to send UDP message: {}", e);
+                            let _ = context.callback_data(
+                                "UDP SOCKET ERROR",
+                                "Failed to send UDP message",
+                                e.to_string(),
+                            );
+                        }
+                    }
+                    Ok(UdpCommand::Stop) => {
+                        running = false;
+                        info!("Stopping UDP client.");
+                    }
+                    Err(error) => {
+                        info!("Error receiving command: {}", error.to_string());
+                    }
+                }
+            }
+        });
     }
 
-    thread::spawn(move || {
+    pub fn send_payload(&self, context: Context, payload: String) {
-      let socket = match UdpSocket::bind("0.0.0.0:0") {
+        let tx = self.tx.clone();
-        Ok(s) => s,
+        thread::spawn(move || {
-        Err(e) => {
+            tx.send(UdpCommand::SendMessage(payload, context)).unwrap();
-          let _ = ctx.callback_data(
+        });
-            "UDP SOCKET ERROR",
+    }
-            "Failed to bind UDP socket",
-            e.to_string(),
-          );
-          info!("Failed to bind UDP socket: {}", e);
-          return;
-        }
-      };
 
-      let _ = ctx.callback_data("UDP SOCKET", "EUD Connected", address.clone());
+    pub fn stop(&self) {
-
+        let tx = self.tx.clone();
-      let mut running = true;
+        thread::spawn(move || {
-      while running {
+            tx.send(UdpCommand::Stop).unwrap();
-        match rx.recv() {
+        });
-          Ok(UdpCommand::SendMessage(message, context)) => {
+    }
-            if let Err(e) = socket.send_to(message.as_bytes(), &address) {
-              info!("Failed to send UDP message: {}", e);
-              let _ = context.callback_data(
-                "UDP SOCKET ERROR",
-                "Failed to send UDP message",
-                e.to_string(),
-              );
-            }
-          }
-          Ok(UdpCommand::Stop) => {
-            running = false;
-            info!("Stopping UDP client.");
-          }
-          Err(error) => {
-            info!("Error receiving command: {}", error.to_string());
-          }
-        }
-      }
-    });
-  }
-
-  pub fn send_payload(&self, context: Context, payload: String) {
-    let tx = self.tx.clone();
-    thread::spawn(move || {
-      tx.send(UdpCommand::SendMessage(payload, context)).unwrap();
-    });
-  }
-
-  pub fn stop(&self) {
-    let tx = self.tx.clone();
-    thread::spawn(move || {
-      tx.send(UdpCommand::Stop).unwrap();
-    });
-  }
 }
 
 lazy_static! {
-  static ref UDP_CLIENT: Arc<Mutex<Option<UdpClient>>> = Arc::new(Mutex::new(None));
+    static ref UDP_CLIENT: Arc<Mutex<Option<UdpClient>>> = Arc::new(Mutex::new(None));
 }
 
 pub fn start(ctx: Context, address: String) -> &'static str {
-  let (tx, rx): (Sender<UdpCommand>, Receiver<UdpCommand>) = mpsc::channel();
+    let (tx, rx): (Sender<UdpCommand>, Receiver<UdpCommand>) = mpsc::channel();
 
-  let client = UdpClient { tx };
+    let client = UdpClient { tx };
-  client.start(address, rx, ctx);
+    client.start(address, rx, ctx);
 
-  let mut client_guard = UDP_CLIENT.lock().unwrap();
+    let mut client_guard = UDP_CLIENT.lock().unwrap();
-  *client_guard = Some(client);
+    *client_guard = Some(client);
 
-  "Starting UDP Client"
+    "Starting UDP Client"
 }
 
 pub fn send_payload(ctx: Context, payload: String) -> &'static str {
-  if let Some(ref client) = *UDP_CLIENT.lock().unwrap() {
+    if let Some(ref client) = *UDP_CLIENT.lock().unwrap() {
-    client.send_payload(ctx, payload);
+        client.send_payload(ctx, payload);
-  } else {
+    } else {
-    let _ = ctx.callback_null("UDP SOCKET ERROR", "UDP Socket is not running");
+        let _ = ctx.callback_null("UDP SOCKET ERROR", "UDP Socket is not running");
-  }
+    }
 
-  "Sending payload to UDP server"
+    "Sending payload to UDP server"
 }
 
-pub fn send_gps_cot(ctx: Context, cursor_over_time: cot::gps::ExternalPositionPayload) -> &'static str {
+pub fn send_gps_cot(
-  let payload = cursor_over_time.to_cot().convert_to_xml();
+    ctx: Context,
-  send_payload(ctx, payload);
+    cursor_over_time: cot::gps::ExternalPositionPayload,
+) -> &'static str {
+    let payload = cursor_over_time.to_cot().convert_to_xml();
+    send_payload(ctx, payload);
 
-  "Sending GPS Cursor Over Time to UDP server"
+    "Sending GPS Cursor Over Time to UDP server"
 }
 
 pub fn stop(ctx: Context) -> &'static str {
-  if let Some(ref client) = *UDP_CLIENT.lock().unwrap() {
+    if let Some(ref client) = *UDP_CLIENT.lock().unwrap() {
-    client.stop();
+        client.stop();
-    let _ = ctx.callback_null("UDP SOCKET", "EUD Disconnected");
+        let _ = ctx.callback_null("UDP SOCKET", "EUD Disconnected");
-  } else {
+    } else {
-    let _ = ctx.callback_null("UDP SOCKET ERROR", "UDP Socket is not running");
+        let _ = ctx.callback_null("UDP SOCKET ERROR", "UDP Socket is not running");
-  }
+    }
 
-  "Stopping UDP Client"
+    "Stopping UDP Client"
 }

src/utils/address.rs

@@ -1,23 +1,23 @@
 use std::net::{IpAddr, UdpSocket};
 
 pub fn get_local_address() -> String {
-  fn get_local_ip() -> Result<IpAddr, String> {
+    fn get_local_ip() -> Result<IpAddr, String> {
-      let socket = UdpSocket::bind("0.0.0.0:0").map_err(|e| e.to_string())?;
+        let socket = UdpSocket::bind("0.0.0.0:0").map_err(|e| e.to_string())?;
-      socket.connect("8.8.8.8:80").map_err(|e| e.to_string())?;
+        socket.connect("8.8.8.8:80").map_err(|e| e.to_string())?;
-      socket
+        socket
-          .local_addr()
+            .local_addr()
-          .map(|addr| addr.ip())
+            .map(|addr| addr.ip())
-          .map_err(|e| e.to_string())
+            .map_err(|e| e.to_string())
-  }
+    }
 
-  let parsed_data = get_local_ip();
+    let parsed_data = get_local_ip();
 
-  match parsed_data {
+    match parsed_data {
-      Ok(ip) => {
+        Ok(ip) => {
-          return format!("ws://{}:4152", ip.to_string());
+            return format!("ws://{}:4152", ip.to_string());
-      }
+        }
-      Err(_) => {
+        Err(_) => {
-          return "not provided".to_string();
+            return "not provided".to_string();
-      }
+        }
-  }
+    }
 }

src/utils/log.rs

@@ -2,11 +2,11 @@ use crate::structs::LogPayload;
 use log::{error, info, warn};
 
 pub fn log_info(data: LogPayload) -> String {
-  match data.status.as_str() {
+    match data.status.as_str() {
-      "info" => info!("{}", data.message),
+        "info" => info!("{}", data.message),
-      "warn" => warn!("{}", data.message),
+        "warn" => warn!("{}", data.message),
-      "error" => error!("{}", data.message),
+        "error" => error!("{}", data.message),
-      _ => error!("{}", "Wrong log call"),
+        _ => error!("{}", "Wrong log call"),
-  }
+    }
-  "logged".to_string()
+    "logged".to_string()
 }

src/utils/mod.rs

@@ -1,3 +1,3 @@
-pub mod uuid;
 pub mod address;
 pub mod log;
+pub mod uuid;

src/utils/uuid.rs

@@ -1,7 +1,7 @@
 pub fn get_uuid() -> String {
-  use uuid::Uuid;
+    use uuid::Uuid;
 
-  let id = Uuid::new_v4().to_string();
+    let id = Uuid::new_v4().to_string();
 
-  return id;
+    return id;
 }

src/video_stream.rs

@@ -16,7 +16,13 @@ lazy_static! {
 #[cfg(target_os = "windows")]
 const CREATE_NO_WINDOW: u32 = 0x08000000;
 
-fn build_rtsp_url(address: &str, port: &str, stream_path: &str, username: &str, password: &str) -> String {
+fn build_rtsp_url(
+    address: &str,
+    port: &str,
+    stream_path: &str,
+    username: &str,
+    password: &str,
+) -> String {
     if username.is_empty() || password.is_empty() {
         format!("rtsp://{}:{}/{}", address, port, stream_path)
     } else {
@@ -28,20 +34,22 @@ fn build_rtsp_url(address: &str, port: &str, stream_path: &str, username: &str,
 }
 
 #[cfg(any(target_os = "windows", target_os = "linux"))]
-fn spawn_ffmpeg(
+fn spawn_ffmpeg(rtsp_url: String, stop_rx: Receiver<()>, status_tx: Sender<Result<(), String>>) {
-    rtsp_url: String,
-    stop_rx: Receiver<()>,
-    status_tx: Sender<Result<(), String>>,
-) {
     thread::spawn(move || {
         let mut cmd = Command::new("ffmpeg");
         cmd.args(&[
-            "-f","x11grab",
+            "-f",
-            "-framerate","30",
+            "x11grab",
-            "-video_size","1920x1080",
+            "-framerate",
-            "-i" ,":0",
+            "30",
-            "-f","rtsp",
+            "-video_size",
-            "-rtsp_transport","tcp",
+            "1920x1080",
+            "-i",
+            ":0",
+            "-f",
+            "rtsp",
+            "-rtsp_transport",
+            "tcp",
             &rtsp_url,
         ]);