Let the config choose protocol 2 or 3, and fall back for one session only.

The default stays v2. A reflector that refuses that version and names the other gets one session of it, then the station announces the configured protocol again.

Co-authored-by: Cursor <cursoragent@cursor.com>

CONTEXT.md

@@ -17,7 +17,7 @@ The conference that forwards audio among stations that have joined the same talk
 _Avoid_: server, bridge
 
 **Talk group**:
-A numbered audio room on the reflector. The station joins one talk group for the whole run.
+A numbered audio room on the reflector. The station is joined to one talk group at a time; changing it in the config starts a new session after Save.
 _Avoid_: channel, room
 
 **Talker**:
@@ -29,9 +29,33 @@ The uppercase amateur call sign that names this station on the reflector.
 _Avoid_: a lowercase spelling, username, node id
 
 **Auth key**:
-The secret the network issues for this station’s callsign, used to prove identity to the reflector.
+The shared secret the network issues for this station’s callsign. It proves the station on protocol 2.0, and on protocol 3.0 when the reflector has not signed a certificate yet.
-_Avoid_: certificate, a password sent in the clear
+_Avoid_: a password sent in the clear, the certificate
+
+**Certificate**:
+An X.509 certificate whose common name is this station’s callsign. It proves the station on protocol 3.0.
+_Avoid_: auth key, a PEM pasted into the config file
+
+**Certificate directory**:
+The directory the station config names. It holds the CA bundle and this station’s key and certificate.
+_Avoid_: PEM text inside the config file
+
+**CA bundle**:
+The reflector’s certificate authority, kept in the certificate directory. Protocol 3.0 uses it to check the reflector.
+_Avoid_: the station certificate
+
+**Protocol**:
+The reflector session this station speaks: 2.0 or 3.0. The config chooses v2 or v3; v2 is the default.
+_Avoid_: TYPE
 
 **Push-to-talk**:
 The operator holding the control that makes this station the talker. Releasing it returns the station to listening.
 _Avoid_: voice-operated transmit, a mute toggle
+
+**Config**:
+The JSON file that names how this station joins a reflector (host, port, callsign, auth key, talk group, protocol, certificate directory, logging). Default path `~/.funknetz.json`; `-c` may select another file.
+_Avoid_: settings file, preferences, treating PEMs as config fields
+
+**Config window**:
+The in-app form that edits the config. It fills the station window, which is resized to the form.
+_Avoid_: a separate OS window, settings window, preferences dialog, a raw JSON editor as the primary UI

app.go

@@ -5,17 +5,22 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/wailsapp/wails/v2/pkg/runtime"
+
 	"gitea.neitzel.de/konrad/funknetz/audio"
 	"gitea.neitzel.de/konrad/funknetz/station"
 )
 
 // App is the window's view of the station.
 type App struct {
+	ctx     context.Context
 	cancel  context.CancelFunc
 	station *station.Station
+	quit    func(context.Context)
 }
 
 func (a *App) startup(ctx context.Context) {
+	a.ctx = ctx
 	runCtx, cancel := context.WithCancel(ctx)
 	a.cancel = cancel
 	if err := audio.Start(runCtx, a.station.WriteMicrophone, a.station.TakePlayback); err != nil {
@@ -46,6 +51,29 @@ func (a *App) HoldSpace() { a.station.HoldSpace() }
 // ReleaseSpace reports that Space was released.
 func (a *App) ReleaseSpace() { a.station.ReleaseSpace() }
 
+// Config returns the Config window form.
+func (a *App) Config() station.ConfigState { return a.station.Config() }
+
+// OpenConfig opens the Config window, re-reading the file.
+func (a *App) OpenConfig() { a.station.OpenConfig() }
+
+// Save validates and writes the config form.
+func (a *App) Save(form station.ConfigForm) error { return a.station.Save(form) }
+
+// CancelConfig discards the form. When no config has loaded, it quits.
+func (a *App) CancelConfig() {
+	if !a.station.Cancel() {
+		return
+	}
+	quit := a.quit
+	if quit == nil {
+		quit = runtime.Quit
+	}
+	if a.ctx != nil {
+		quit(a.ctx)
+	}
+}
+
 func openStation(args []string) (*station.Station, error) {
 	path, err := resolveConfigPath(args)
 	if err != nil {
@@ -54,8 +82,9 @@ func openStation(args []string) (*station.Station, error) {
 	return station.New(station.Options{ConfigPath: path})
 }
 
-// openStationReported opens the station from args. A flag or config failure is
+// openStationReported opens the station from args. A flag or path failure is
-// one line on stderr and the returned error. The window is not opened.
+// one line on stderr and the returned error. A missing or invalid config still
+// returns a station so the window can open.
 func openStationReported(args []string, stderr io.Writer) (*station.Station, error) {
 	st, err := openStation(args)
 	if err != nil {

config_path_test.go

@@ -4,12 +4,11 @@ package main
 
 import (
 	"bytes"
+	"context"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
-
-	"encoding/json/v2"
 )
 
 func TestResolveConfigPathDefaultIsHome(t *testing.T) {
@@ -86,20 +85,15 @@ func TestOpenStationUsesResolvedPath(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "custom.json")
 
-	_, err := openStation([]string{"-c", path})
+	st, err := openStation([]string{"-c", path})
-	if err == nil {
-		t.Fatal("openStation() error = nil, want rejection after creating the file")
-	}
-	if !strings.Contains(err.Error(), "created") {
-		t.Fatalf("openStation() error = %q, want it to say the file was created", err.Error())
-	}
-
-	info, err := os.Stat(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got, want := info.Mode().Perm(), os.FileMode(0o600); got != want {
+	if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
-		t.Fatalf("mode = %o, want %o", got, want)
+		t.Fatalf("stat = %v, want the file absent until Save", statErr)
+	}
+	if !st.State().NeedsConfig || !st.State().ConfigOpen {
+		t.Fatalf("State = %+v, want the Config window open", st.State())
 	}
 
 	// Same rules as the home file: a second open with a filled config works.
@@ -116,7 +110,7 @@ func TestOpenStationUsesResolvedPath(t *testing.T) {
 	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	st, err := openStation([]string{"--config", path})
+	st, err = openStation([]string{"--config", path})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -136,52 +130,35 @@ func TestConfigEqualsFlagSelectsTheFile(t *testing.T) {
 	}
 }
 
-func TestCreatedFileViaFlagMatchesHomeTemplate(t *testing.T) {
+func TestMissingFileOpensWithoutStderr(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "lab.json")
 	var stderr bytes.Buffer
 	st, err := openStationReported([]string{"-c", path}, &stderr)
-	if st != nil {
-		t.Fatal("station = non-nil, want nil before the window")
-	}
-	if err == nil {
-		t.Fatal("error = nil, want the file created")
-	}
-	if got, want := err.Error(), "created "+path; got != want {
-		t.Fatalf("error = %q, want %q", got, want)
-	}
-	if got, want := stderr.String(), err.Error()+"\n"; got != want {
-		t.Fatalf("stderr = %q, want %q", got, want)
-	}
-	info, err := os.Stat(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got, want := info.Mode().Perm(), os.FileMode(0o600); got != want {
+	if st == nil {
-		t.Fatalf("mode = %o, want %o", got, want)
+		t.Fatal("station = nil, want a station so the window can open")
 	}
-	body, err := os.ReadFile(path)
+	if stderr.Len() != 0 {
-	if err != nil {
+		t.Fatalf("stderr = %q, want empty", stderr.String())
-		t.Fatal(err)
 	}
-	var got map[string]any
+	if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
-	if err := json.Unmarshal(body, &got); err != nil {
+		t.Fatalf("stat = %v, want the file absent", statErr)
-		t.Fatalf("created file is not JSON: %v\n%s", err, body)
 	}
-	if got["host"] != "" || got["callsign"] != "" || got["authKey"] != "" {
+	if !st.State().NeedsConfig || !st.State().ConfigOpen {
-		t.Fatalf("string fields = %#v, want empty host, callsign, and authKey", got)
+		t.Fatalf("State = %+v, want the Config window open", st.State())
 	}
-	if got["port"] != float64(0) || got["talkGroup"] != float64(0) {
+	form := st.Config().Form
-		t.Fatalf("numeric fields = %#v, want port and talkGroup at zero", got)
+	if form.Host != "" || form.Callsign != "" || form.AuthKey != "" || form.Port != 0 || form.TalkGroup != 0 || form.EnableLogging || form.CertificateDir != "./funknetz" {
-	}
+		t.Fatalf("Form = %+v, want template defaults", form)
-	if got["enableLogging"] != false {
-		t.Fatalf("enableLogging = %#v, want false", got["enableLogging"])
 	}
 	home, err := os.UserHomeDir()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got["logFile"] != filepath.Join(home, "funknetz.log") {
+	if form.LogFile != filepath.Join(home, "funknetz.log") {
-		t.Fatalf("logFile = %#v, want funknetz.log in the home directory", got["logFile"])
+		t.Fatalf("LogFile = %q, want funknetz.log in the home directory", form.LogFile)
 	}
 }
 
@@ -271,7 +248,7 @@ func TestExtraWordsDoNotChangeTheSelectedFile(t *testing.T) {
 
 func TestSelectedFileIsLeftByteForByte(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "lab.json")
-	original := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"a b\",\"talkGroup\":20,\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
+	original := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"a b\",\"talkGroup\":20,\"protocol\":\"v2\",\"certificateDir\":\"./funknetz\",\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
 	if err := os.WriteFile(path, original, 0o640); err != nil {
 		t.Fatal(err)
 	}
@@ -292,7 +269,7 @@ func TestSelectedFileIsLeftByteForByte(t *testing.T) {
 	}
 }
 
-func TestEmptyHostOnSelectedFileNamesHost(t *testing.T) {
+func TestEmptyHostOnSelectedFileOpensConfig(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "lab.json")
 	body := []byte("{\"host\":\"\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"key\",\"talkGroup\":20,\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
 	if err := os.WriteFile(path, body, 0o600); err != nil {
@@ -300,14 +277,64 @@ func TestEmptyHostOnSelectedFileNamesHost(t *testing.T) {
 	}
 	var stderr bytes.Buffer
 	st, err := openStationReported([]string{"-c", path}, &stderr)
-	if st != nil {
+	if err != nil {
-		t.Fatal("station = non-nil, want nil")
+		t.Fatal(err)
 	}
-	if err == nil || !strings.Contains(err.Error(), "host") {
+	if st == nil || !st.State().ConfigOpen || !strings.Contains(st.State().Detail, "host") {
-		t.Fatalf("error = %v, want it to name host", err)
+		t.Fatalf("State = %+v, want the Config window open naming host", st.State())
 	}
-	if stderr.String() != err.Error()+"\n" {
+	if stderr.Len() != 0 {
-		t.Fatalf("stderr = %q, want the error line", stderr.String())
+		t.Fatalf("stderr = %q, want empty", stderr.String())
+	}
+}
+
+func TestCancelWithoutALoadedConfigQuits(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "missing.json")
+	st, err := openStation([]string{"-c", path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	quit := false
+	app := &App{
+		station: st,
+		ctx:     t.Context(),
+		quit:    func(context.Context) { quit = true },
+	}
+	app.CancelConfig()
+	if !quit {
+		t.Fatal("CancelConfig() left the app running")
+	}
+}
+
+func TestCancelAfterLoadKeepsTheSession(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "lab.json")
+	body := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"key\",\"talkGroup\":20,\"protocol\":\"v2\",\"certificateDir\":\"./funknetz\",\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
+	if err := os.WriteFile(path, body, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	st, err := openStation([]string{"-c", path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	quit := false
+	app := &App{
+		station: st,
+		ctx:     t.Context(),
+		quit:    func(context.Context) { quit = true },
+	}
+	app.CancelConfig()
+	if quit {
+		t.Fatal("CancelConfig() quit after a loaded config")
+	}
+	if st.State().ConfigOpen {
+		t.Fatal("Config window stayed open")
+	}
+	got, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(body) {
+		t.Fatalf("file = %s, want it left unchanged", got)
 	}
 }
 

docs/adr/0002-home-directory-config.md

@@ -1,3 +1,3 @@
-# Hand-edited config in the home directory
+# Home-directory config and Config window
 
-The operator edits connection settings by hand. There is no settings window in version 1. The default file is `~/.funknetz.json`, created mode 0600 when missing. Application Support would match other Mac apps and would be a worse place to open in an editor. That default path is part of the station's contract; moving it later strands existing files. `-c` / `--config` may select another file; create, rewrite, and validate rules are the same—only the path changes.
+The station config is a JSON file. The default path is `~/.funknetz.json`; that path is part of the contract because moving it later strands existing files. Application Support would match other Mac apps but is a worse place for hand-editing, which remains supported alongside `-c` / `--config`. The primary editor is the in-app Config window (a modal form over the station UI). When the resolved file is missing or has never loaded successfully, the app opens that window and does not create the file until Save (mode 0600 on first create); Cancel in that state quits. Create, rewrite, and validate rules are the same for every path—only the path changes.

docs/adr/0004-ca-bundle-trust-on-first-use.md

@@ -0,0 +1,3 @@
+# Trust the first CA bundle
+
+Protocol 3.0 checks the reflector with the CA bundle in the certificate directory. When that file is missing, the station stores the bundle after the signature check with the certificate inside the same message. A later digest that differs from the stored file leaves the file in place. Replacing a stored bundle automatically was rejected because the reflector could swap the trust anchor.

docs/adr/0005-protocol-3-with-explicit-2-fallback.md

@@ -0,0 +1,5 @@
+Superseded by [ADR 0006](0006-configured-protocol.md).
+
+# Announce protocol 3.0, fall back only on an explicit 2.x maximum
+
+Every TCP connection announces protocol 3.0. The station opens one 2.0 session only when the reflector sends a downgrade, or an unsupported-version error, whose maximum is at least 2.0 and below 3.0. The connection after that 2.0 session ends announces 3.0 again. A maximum whose major is below 2 stops the station with the reflector’s message. A reflector `MsgError` stops the station until the operator quits. A bad CA signature, a TLS or hostname failure, a heartbeat timeout, and a dropped connection retry on 3.0, and the window keeps the reason between attempts. The Protocol line shows 2.0 or 3.0 while the session is up, so a plaintext session is visible. Staying on 3.0 after every failure was rejected because a reflector that still expects 2.0 would never accept the station. Falling back on any handshake failure was rejected because a TLS or CA problem would then send plaintext audio.

docs/adr/0006-configured-protocol.md

@@ -0,0 +1,3 @@
+# The config chooses the protocol; the other is one fallback session
+
+The station announces the protocol named in the config. The default is v2. It opens one session of the other protocol only when the reflector refuses the configured version and names the other as acceptable: a downgrade or an “at most 2.x” error when v3 was announced, and a downgrade to 3.0 or a “must be at least 3.0” error when v2 was announced. The connection after that session announces the configured protocol again. A TLS, CA, or hostname failure retries the configured protocol and does not switch, so a certificate problem does not become a plaintext session. Always announcing 3.0 was rejected because the operator has to be able to stay on v2.

docs/rfc.md

@@ -4,7 +4,7 @@
 **Scope:** The TCP control and UDP audio protocol a station uses to join one SvxReflector, as implemented by upstream SvxLink. Two self-contained memos: Protocol Version 2.0 and Protocol Version 3.0. Shared byte encoding is specified once and cited by both. Protocol 1.x is a short historical section because this server still accepts it and still emits a distinct talker body.  
 **Not this:** A Go client; production FM-Funknetz credentials or a live probe of that reflector; reflector-to-reflector trunking; MQTT; talk-group mapping policy.  
 **Upstream:** GitHub `sm0svx/svxlink` `master` HEAD on 2026-10-07 was still commit [`fcd13014810af75d1852b3f2cfc8d9806178d0ab`](https://github.com/sm0svx/svxlink/commit/fcd13014810af75d1852b3f2cfc8d9806178d0ab) (2026-07-26, “Prepare for release 26.05.1”). In that commit [`src/versions`](https://github.com/sm0svx/svxlink/blob/fcd13014810af75d1852b3f2cfc8d9806178d0ab/src/versions): `PROJECT=26.05.1`, `SVXLINK=1.10.1`, `SVXREFLECTOR=1.4.1`. There is no IETF RFC. If this text and the cited source disagree, the source wins.  
-**Fork check:** `dj1jay/jayReflector` `main` on 2026-10-07 was still [`50997ed21a37c7c05c132eca5ebb07bab4b80fc7`](https://github.com/dj1jay/jayReflector/commit/50997ed21a37c7c05c132eca5ebb07bab4b80fc7). Client-facing TCP and UDP message types match upstream; see the note after the memos.
+**Fork check:** `dj1jay/jayReflector` `main` on 2026-10-07 was still [`50997ed21a37c7c05c132eca5ebb07bab4b80fc7`](https://github.com/dj1jay/jayReflector/commit/50997ed21a37c7c05c132eca5ebb07bab4b80fc7). Client-facing TCP and UDP message types match upstream; see the note after the memos. The lab binary is now [GeuReflector](https://github.com/audric/GeuReflector) at [`dbad88e8c3e0f1adb8342db190bb0b3ad00106f4`](https://github.com/audric/GeuReflector/commit/dbad88e8c3e0f1adb8342db190bb0b3ad00106f4); the station message table in this file is unchanged.
 
 This note is **factual** except sections labeled **Inference**.
 

docs/svxlink.md

@@ -2,13 +2,13 @@
 
 Funknetz must be proven against a local reflector before it touches the live network. This document is that lab: how to run the reflector, what it will accept from a station, and what the wire protocol actually does—so a headset client can be tested without FM-Funknetz credentials.
 
-The lab runs **[jayReflector](https://github.com/dj1jay/jayReflector)** (DJ1JAY / FM-Funknetz), a Trunk/Satellite-capable fork of SvxReflector. The process is still named `svxreflector`. You do **not** need the `svxlink` node binary, LocalRx/LocalTx, or EchoLink to exercise the headset client.
+The lab runs **[GeuReflector](https://github.com/audric/GeuReflector)** (IW1GEU), a Trunk/Satellite-capable fork of SvxReflector. The process is still named `svxreflector`. You do **not** need the `svxlink` node binary, LocalRx/LocalTx, or EchoLink to exercise the headset client.
 
-Funknetz is a station on the conference: it connects to the local reflector on TCP+UDP. Optional FM-Funknetz uplink is Satellite (outbound) or Trunk — configured separately when DJ1JAY provides parameters.
+Funknetz is a station on the conference: it connects to the local reflector on TCP+UDP. Optional FM-Funknetz uplink is Satellite (outbound) or Trunk — configured separately when the parent operator provides parameters.
 
 ## Running a local reflector
 
-Lab compose lives in [`svxlink-docker/`](../svxlink-docker/). It builds jayReflector, mounts a minimal `svxreflector.conf`, publishes TCP **and** UDP on the listen port, and runs only `svxreflector`.
+Lab compose lives in [`svxlink-docker/`](../svxlink-docker/). It builds GeuReflector, mounts a minimal `svxreflector.conf`, publishes TCP **and** UDP on the listen port, and runs only `svxreflector`.
 
 ```sh
 cd svxlink-docker
@@ -18,7 +18,7 @@ docker compose up -d --build
 
 | Item | Lab value |
 | --- | --- |
-| Binary | jayReflector → `/usr/bin/svxreflector` |
+| Binary | GeuReflector → `/usr/bin/svxreflector` |
 | Listen port | **5300** TCP **and** UDP (local clients; FM-Funknetz production client port is often 5308) |
 | Config | `config/svxreflector.conf` → `/etc/svxlink/svxreflector.conf` |
 | Auth (protocol 2.0) | `[USERS]` → `[PASSWORDS]`; station `authKey` matches that secret |
@@ -45,6 +45,7 @@ Manual lab JSON (values match `.env` / the mounted conf; secrets are local-test
   "callsign": "DL0FN-1",
   "authKey": "local-lab-secret-change-me",
   "talkGroup": 9,
+  "protocol": "v2",
   "enableLogging": false,
   "logFile": "/tmp/funknetz.log"
 }
@@ -56,7 +57,7 @@ A second station can use callsign `DL0FN-2` with the same auth key. Do not reuse
 
 Default: `ENABLE_FM_LINK=0` — local island only. No network uplink.
 
-When DJ1JAY provides parameters:
+When the parent operator provides parameters:
 
 1. Edit [`config/svxreflector.link.conf`](../svxlink-docker/config/svxreflector.link.conf) (prefer **Satellite** for home labs).
 2. Set `ENABLE_FM_LINK=1` in `.env`.
@@ -69,21 +70,22 @@ The entrypoint appends the link file after the base conf. Local Funknetz setting
 With Satellite, **your container dials out** to the parent on TCP **5303**. The network does **not** open a connection toward you. You do **not** need public DNS, a static IP, or inbound port-forwarding for the uplink. Only your **local** clients need to reach host `:5300` (typically localhost).
 
 ```text
-Funknetz ──:5300──► jayReflector (lab) ──outbound :5303──► FM-Funknetz parent
+Funknetz ──:5300──► GeuReflector (lab) ──outbound :5303──► FM-Funknetz parent
 ```
 
-Fill from DJ1JAY (jayReflector README shape):
+Fill under `[GLOBAL]` in the link stub (GeuReflector README shape). `SATELLITE_ID` may contain only letters, digits, and dashes:
 
-- `SATELLITE_OF=parent.example.org:5303`
+- `SATELLITE_OF=parent.example.org`
+- `SATELLITE_PORT=5303`
 - `SATELLITE_ID=…`
 - `SATELLITE_SECRET=…`
 - optional `SATELLITE_FILTER=…` for “only some TGs”
 
 ### Trunk (only if agreed)
 
-Equal mesh peer: mutual TCP **5302**, matching `[TRUNK_x]` section name and `SECRET`, plus filters (`ALLOW_TGS` / `TG_MAP`). That **does** require the peer to reach your trunk port — not the default lab layout. Prefer Satellite unless DJ1JAY asks for Trunk.
+Equal mesh peer: mutual TCP **5302**, matching `[TRUNK_x]` section name and `SECRET`, plus filters (`ALLOW_TGS` / `TG_MAP`). That **does** require the peer to reach your trunk port — not the default lab layout. Prefer Satellite unless the parent operator asks for Trunk.
 
-Research baseline: [docs/research/2026-10-07-jayreflector-fm-funknetz.md](../../docs/research/2026-10-07-jayreflector-fm-funknetz.md).
+Research baseline: [docs/research/2026-10-11-geureflector-lab-baseline.md](../../docs/research/2026-10-11-geureflector-lab-baseline.md).
 
 ## What the reflector admits
 
@@ -103,7 +105,7 @@ For the lab and for production as FM-Funknetz documents it, the station speaks *
 
 ## Wire protocol
 
-The byte-level specification is [rfc.md](./rfc.md). It describes the protocol as implemented by SvxLink. The contract in that source is the message types in SvxLink / jayReflector (`ReflectorMsg.h` and the client logics). Control rides **TCP** as length-prefixed frames (4-byte big-endian length, then payload). Audio and UDP keepalives ride **UDP** to the same host and port. Message types are numeric. Protocol **2.0** authenticates with the auth-key HMAC and sends plaintext UDP with a header of type, client id, and sequence. Protocol **3.0** uses X.509/TLS and encrypts UDP (AES-128-GCM). Funknetz targets 2.0.
+The byte-level specification is [rfc.md](./rfc.md). It describes the protocol as implemented by SvxLink. The contract in that source is the message types in SvxLink / GeuReflector (`ReflectorMsg.h` and the client logics). Control rides **TCP** as length-prefixed frames (4-byte big-endian length, then payload). Audio and UDP keepalives ride **UDP** to the same host and port. Message types are numeric. Protocol **2.0** authenticates with the auth-key HMAC and sends plaintext UDP with a header of type, client id, and sequence. Protocol **3.0** uses X.509/TLS and encrypts UDP (AES-128-GCM). Funknetz targets 2.0.
 
 Typical protocol 2.0 login:
 
@@ -155,7 +157,7 @@ The codec name is negotiated in `MsgServerInfo`, not per audio packet. When Opus
 | Concept | What it is in this lab |
 | --- | --- |
 | Stock `sm0svx` peering | **Unsupported** — not what we build. |
-| jayReflector **Satellite** | Lab dials parent `:5303`; optional `SATELLITE_FILTER` for some TGs. Outbound only. |
+| GeuReflector **Satellite** | Lab dials parent `:5303`; optional `SATELLITE_FILTER` for some TGs. Outbound only. |
-| jayReflector **Trunk** | Mesh peer on `:5302` with filters / `TG_MAP`. Needs mutual reachability. |
+| GeuReflector **Trunk** | Mesh peer on `:5302` with filters / `TG_MAP`. Needs mutual reachability. |
 | `svxlink` dual ReflectorLogic bridge | Not required here; Satellite/Trunk replace that for FM-Funknetz attach. |
 | Same reflector, same TG, two stations | Normal conference — local test without any uplink. |

frontend/dist/app.css

@@ -1,25 +1,63 @@
+html,
+body {
+  height: 100%;
+}
+
 body {
   margin: 0;
+  overflow: hidden;
   background: #101418;
   color: #f2f4f6;
   font: 16px/1.4 system-ui, sans-serif;
 }
 
 main {
+  box-sizing: border-box;
+  height: 100%;
   padding: 24px;
+  overflow: auto;
+}
+
+body.config-open main {
+  display: none;
+}
+
+.status {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin: 0 0 16px;
 }
 
 #connection {
-  margin: 0 0 16px;
+  margin: 0;
   font-size: 14px;
 }
 
+#gear {
+  width: 32px;
+  height: 32px;
+  margin: 0;
+  padding: 0;
+  border: 0;
+  border-radius: 6px;
+  background: transparent;
+  color: #f2f4f6;
+  font-size: 20px;
+  line-height: 32px;
+}
+
+#protocol {
+  min-height: 1.4em;
+  margin: 0;
+}
+
 #detail {
   min-height: 1.4em;
   font-size: 20px;
 }
 
-button {
+#ptt {
   margin-top: 24px;
   width: 100%;
   height: 64px;
@@ -31,6 +69,133 @@ button {
   font-size: 18px;
 }
 
-button.down {
+#ptt.down {
   background: #9b2226;
 }
+
+#ptt:disabled {
+  background: #3a4248;
+  color: #9aa3ab;
+}
+
+#config {
+  box-sizing: border-box;
+  height: 100%;
+  padding: 16px;
+  overflow-x: hidden;
+  overflow-y: auto;
+  background: #101418;
+  scrollbar-color: #8b98a3 #0c1014;
+  scrollbar-width: auto;
+}
+
+#config::-webkit-scrollbar {
+  width: 12px;
+}
+
+#config::-webkit-scrollbar-track {
+  background: #0c1014;
+}
+
+#config::-webkit-scrollbar-thumb {
+  background: #8b98a3;
+  border: 2px solid #0c1014;
+  border-radius: 6px;
+}
+
+#config[hidden] {
+  display: none;
+}
+
+#config form {
+  box-sizing: border-box;
+  width: 100%;
+  margin: 0;
+  padding: 16px;
+  border: 1px solid #2c3640;
+  border-radius: 8px;
+  background: #101418;
+}
+
+#config h1 {
+  margin: 0 0 12px;
+  font-size: 18px;
+}
+
+#config-error {
+  margin: 0 0 12px;
+  color: #f4a261;
+}
+
+#config label {
+  display: block;
+  margin: 0 0 10px;
+  font-size: 14px;
+}
+
+#config input,
+#config select {
+  box-sizing: border-box;
+  display: block;
+  width: 100%;
+  margin-top: 4px;
+  padding: 8px;
+  border: 1px solid #2c3640;
+  border-radius: 6px;
+  background: #0c1014;
+  color: inherit;
+  font: inherit;
+}
+
+#config .check input {
+  display: inline-block;
+  width: auto;
+  margin: 0 0 0 8px;
+  vertical-align: middle;
+}
+
+.secret {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+}
+
+.secret input {
+  flex: 1;
+}
+
+#auth-toggle,
+#cancel,
+#save {
+  height: 40px;
+  margin: 0;
+  border: 0;
+  border-radius: 6px;
+  font: inherit;
+}
+
+#auth-toggle {
+  width: 72px;
+  background: #243038;
+  color: inherit;
+}
+
+.actions {
+  display: flex;
+  gap: 8px;
+  margin-top: 16px;
+}
+
+.actions button {
+  flex: 1;
+}
+
+#cancel {
+  background: #243038;
+  color: inherit;
+}
+
+#save {
+  background: #2d6a4f;
+  color: white;
+}

frontend/dist/app.js

@@ -1,4 +1,13 @@
 const button = document.getElementById("ptt");
+const config = document.getElementById("config");
+const configForm = document.getElementById("config-form");
+const configError = document.getElementById("config-error");
+const authKey = document.getElementById("authKey");
+const authToggle = document.getElementById("auth-toggle");
+
+let savedSize = null;
+let configLoading = false;
+let sizeToken = 0;
 
 function api() {
   if (!window.go || !window.go.main || !window.go.main.App) {
@@ -17,12 +26,146 @@ function line(state) {
   return "Idle";
 }
 
+function runtime() {
+  return window.runtime || null;
+}
+
+function fitConfigWindow() {
+  const rt = runtime();
+  if (!rt || !rt.WindowGetSize || !rt.WindowSetSize) {
+    return;
+  }
+  const token = ++sizeToken;
+  requestAnimationFrame(function () {
+    if (token !== sizeToken || config.hidden) {
+      return;
+    }
+    rt.WindowGetSize().then(function (size) {
+      if (token !== sizeToken || config.hidden || !size) {
+        return;
+      }
+      if (!savedSize) {
+        savedSize = size;
+      }
+      const needed = Math.ceil(configForm.getBoundingClientRect().height) + 32;
+      const width = Math.max(size.w, 420);
+      const applied = rt.WindowSetSize(width, needed);
+      const after = applied && applied.then ? applied.then(function () {
+        return rt.WindowGetSize();
+      }) : Promise.resolve(null);
+      return after.then(function (now) {
+        if (!now || token !== sizeToken || config.hidden) {
+          return;
+        }
+        const extra = Math.ceil(document.documentElement.scrollHeight - window.innerHeight);
+        if (extra > 1) {
+          rt.WindowSetSize(now.w, now.h + extra);
+        }
+      });
+    });
+  });
+}
+
+function restoreWindow() {
+  sizeToken++;
+  const rt = runtime();
+  if (!savedSize || !rt || !rt.WindowSetSize) {
+    savedSize = null;
+    return;
+  }
+  rt.WindowSetSize(savedSize.w, savedSize.h);
+  savedSize = null;
+}
+
+function showError(message) {
+  configError.hidden = !message;
+  configError.textContent = message || "";
+  if (!config.hidden) {
+    fitConfigWindow();
+  }
+}
+
+function fillForm(form) {
+  document.getElementById("host").value = form.host || "";
+  document.getElementById("port").value = String(form.port || 0);
+  document.getElementById("callsign-field").value = form.callsign || "";
+  authKey.value = form.authKey || "";
+  document.getElementById("talkGroup").value = String(form.talkGroup || 0);
+  document.getElementById("protocol-field").value = form.protocol === "v3" ? "v3" : "v2";
+  document.getElementById("certificateDir").value = form.certificateDir || "";
+  document.getElementById("enableLogging").checked = !!form.enableLogging;
+  document.getElementById("logFile").value = form.logFile || "";
+  authKey.type = "password";
+  authToggle.textContent = "Show";
+}
+
+function readForm() {
+  return {
+    host: document.getElementById("host").value,
+    port: numberValue("port"),
+    callsign: document.getElementById("callsign-field").value,
+    authKey: authKey.value,
+    talkGroup: numberValue("talkGroup"),
+    protocol: document.getElementById("protocol-field").value,
+    certificateDir: document.getElementById("certificateDir").value,
+    enableLogging: document.getElementById("enableLogging").checked,
+    logFile: document.getElementById("logFile").value
+  };
+}
+
+function numberValue(id) {
+  const text = document.getElementById(id).value.trim();
+  if (text === "") {
+    return 0;
+  }
+  const n = Number(text);
+  if (!Number.isInteger(n)) {
+    return 0;
+  }
+  return n;
+}
+
+function showConfig() {
+  const app = api();
+  if (!app || configLoading) {
+    return;
+  }
+  configLoading = true;
+  app.Config().then(function (cfg) {
+    if (!cfg.open) {
+      return;
+    }
+    fillForm(cfg.form || {});
+    config.hidden = false;
+    document.body.classList.add("config-open");
+    showError(cfg.error);
+  }).catch(function () {}).then(function () {
+    configLoading = false;
+  });
+}
+
+function hideConfig() {
+  config.hidden = true;
+  document.body.classList.remove("config-open");
+  configError.hidden = true;
+  configError.textContent = "";
+  restoreWindow();
+}
+
 function render(state) {
   document.getElementById("connection").textContent = state.connection;
   document.getElementById("callsign").textContent = state.callsign;
   document.getElementById("talkgroup").textContent = String(state.talkGroup);
+  const protocol = document.getElementById("protocol");
+  protocol.textContent = state.protocol ? "Protocol " + state.protocol : "";
   document.getElementById("detail").textContent = line(state);
   button.classList.toggle("down", !!state.transmitting);
+  button.disabled = !!state.configOpen;
+  if (state.configOpen && config.hidden) {
+    showConfig();
+  } else if (!state.configOpen && !config.hidden) {
+    hideConfig();
+  }
 }
 
 function refresh() {
@@ -33,7 +176,47 @@ function refresh() {
   app.State().then(render).catch(function () {});
 }
 
+function cancelConfig() {
+  const app = api();
+  if (app) {
+    app.CancelConfig();
+  }
+}
+
+document.getElementById("gear").addEventListener("click", function () {
+  const app = api();
+  if (app) {
+    app.OpenConfig();
+  }
+});
+
+configForm.addEventListener("submit", function (event) {
+  event.preventDefault();
+  const app = api();
+  if (!app) {
+    return;
+  }
+  app.Save(readForm()).then(function () {
+    refresh();
+  }).catch(function () {
+    app.Config().then(function (cfg) {
+      showError(cfg.error);
+    }).catch(function () {});
+  });
+});
+
+document.getElementById("cancel").addEventListener("click", cancelConfig);
+
+authToggle.addEventListener("click", function () {
+  const show = authKey.type === "password";
+  authKey.type = show ? "text" : "password";
+  authToggle.textContent = show ? "Hide" : "Show";
+});
+
 button.addEventListener("pointerdown", function (event) {
+  if (button.disabled) {
+    return;
+  }
   event.preventDefault();
   button.setPointerCapture(event.pointerId);
   const app = api();
@@ -55,11 +238,18 @@ button.addEventListener("pointercancel", releaseButton);
 let spaceHeld = false;
 
 window.addEventListener("keydown", function (event) {
+  if (event.code === "Escape") {
+    if (!config.hidden) {
+      event.preventDefault();
+      cancelConfig();
+    }
+    return;
+  }
   if (event.code !== "Space") {
     return;
   }
   event.preventDefault();
-  if (event.repeat || spaceHeld) {
+  if (!config.hidden || button.disabled || event.repeat || spaceHeld) {
     return;
   }
   spaceHeld = true;

frontend/dist/index.html

@@ -7,12 +7,45 @@
 </head>
 <body>
   <main>
-    <p id="connection">Disconnected</p>
+    <div class="status">
+      <p id="connection">Disconnected</p>
+      <button id="gear" type="button" aria-label="Config">⚙</button>
+    </div>
     <p>Callsign <span id="callsign"></span></p>
     <p>Talk group <span id="talkgroup"></span></p>
+    <p id="protocol"></p>
     <p id="detail">Idle</p>
     <button id="ptt" type="button">Push to talk</button>
   </main>
+  <div id="config" hidden>
+    <form id="config-form">
+      <h1>Config</h1>
+      <p id="config-error" hidden></p>
+      <label>Host <input id="host" name="host" autocomplete="off"></label>
+      <label>Port <input id="port" name="port" inputmode="numeric" autocomplete="off"></label>
+      <label>Callsign <input id="callsign-field" name="callsign" autocomplete="off"></label>
+      <label>Auth key
+        <span class="secret">
+          <input id="authKey" name="authKey" type="password" autocomplete="off">
+          <button id="auth-toggle" type="button">Show</button>
+        </span>
+      </label>
+      <label>Talk group <input id="talkGroup" name="talkGroup" inputmode="numeric" autocomplete="off"></label>
+      <label>Protocol
+        <select id="protocol-field" name="protocol">
+          <option value="v2">v2</option>
+          <option value="v3">v3</option>
+        </select>
+      </label>
+      <label>Certificate directory <input id="certificateDir" name="certificateDir" autocomplete="off"></label>
+      <label class="check">Enable logging <input id="enableLogging" name="enableLogging" type="checkbox"></label>
+      <label>Log file <input id="logFile" name="logFile" autocomplete="off"></label>
+      <div class="actions">
+        <button id="cancel" type="button">Cancel</button>
+        <button id="save" type="submit">Save</button>
+      </div>
+    </form>
+  </div>
   <script src="app.js"></script>
 </body>
 </html>

internal/gcm64/gcm.go

@@ -0,0 +1,63 @@
+// Package gcm64 seals and opens AES-GCM with the 8-byte tag this protocol uses.
+package gcm64
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/subtle"
+	"encoding/binary"
+	"errors"
+)
+
+// IV is the 12-byte nonce: a 6-byte prefix, the client id, and the counter.
+func IV(prefix []byte, clientID uint16, counter uint32) []byte {
+	iv := make([]byte, 12)
+	copy(iv, prefix)
+	binary.BigEndian.PutUint16(iv[6:8], clientID)
+	binary.BigEndian.PutUint32(iv[8:12], counter)
+	return iv
+}
+
+// Seal returns an 8-byte tag and the ciphertext. The tag is the leading 8
+// bytes of the ordinary 16-byte GCM tag, because crypto/cipher only builds
+// tags of 12 to 16 bytes.
+func Seal(key, nonce, plain, aad []byte) (tag, ct []byte, err error) {
+	g, err := full(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	out := g.Seal(nil, nonce, plain, aad)
+	ct = append([]byte(nil), out[:len(plain)]...)
+	tag = append([]byte(nil), out[len(plain):len(plain)+8]...)
+	return tag, ct, nil
+}
+
+// Open checks the 8-byte tag and returns the plaintext.
+func Open(key, nonce, tag, ct, aad []byte) ([]byte, error) {
+	if len(tag) != 8 {
+		return nil, errors.New("tag")
+	}
+	g, err := full(key)
+	if err != nil {
+		return nil, err
+	}
+	stream := g.Seal(nil, nonce, make([]byte, len(ct)), aad)
+	plain := make([]byte, len(ct))
+	subtle.XORBytes(plain, ct, stream[:len(ct)])
+	check := g.Seal(nil, nonce, plain, aad)
+	var got, want [8]byte
+	copy(got[:], tag)
+	copy(want[:], check[len(plain):len(plain)+8])
+	if subtle.ConstantTimeCompare(got[:], want[:]) != 1 {
+		return nil, errors.New("tag")
+	}
+	return plain, nil
+}
+
+func full(key []byte) (cipher.AEAD, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	return cipher.NewGCM(block)
+}

internal/opus/opus.go

@@ -5,6 +5,10 @@ package opus
 #cgo pkg-config: opus
 #include <opus.h>
 
+static void reset_decoder(OpusDecoder *dec) {
+	opus_decoder_ctl(dec, OPUS_RESET_STATE);
+}
+
 static int configure_encoder(OpusEncoder *enc) {
 	int err;
 	err = opus_encoder_ctl(enc, OPUS_SET_BITRATE(20000));
@@ -114,6 +118,14 @@ func (d *Decoder) Decode(packet []byte) ([]int16, error) {
 	return pcm, nil
 }
 
+// Reset clears decoder state after a gap in the received audio.
+func (d *Decoder) Reset() {
+	if d == nil || d.dec == nil {
+		return
+	}
+	C.reset_decoder(d.dec)
+}
+
 // Close releases the decoder.
 func (d *Decoder) Close() {
 	if d == nil || d.dec == nil {

main.go

@@ -25,7 +25,9 @@ func main() {
 	err = wails.Run(&options.App{
 		Title:            "funknetz",
 		Width:            420,
-		Height:           280,
+		Height:           480,
+		MinWidth:         420,
+		MinHeight:        480,
 		BackgroundColour: &options.RGBA{R: 16, G: 20, B: 24, A: 255},
 		AssetServer:      &assetserver.Options{Assets: assets},
 		OnStartup:        app.startup,

station/behavior_test.go

@@ -21,6 +21,7 @@ type loggedIn struct {
 	refl   *reflector
 	cancel context.CancelFunc
 	id     uint16
+	path   string
 }
 
 func login(t *testing.T, callsign, key string, tg int, id uint16, codecs []string) loggedIn {
@@ -43,19 +44,18 @@ func loginLog(t *testing.T, callsign, key string, tg int, id uint16, codecs []st
 	}
 	ctx, cancel := context.WithCancel(t.Context())
 	t.Cleanup(cancel)
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 	refl.accept(t)
-
+	expectVersion(t, refl, 2, 0)
-	typ, body := refl.readFrame(t)
-	if typ != 5 || len(body) != 4 || body[1] != 2 {
-		t.Fatalf("protocol frame type %d body %v", typ, body)
-	}
 	challenge := make([]byte, 20)
 	for i := range challenge {
 		challenge[i] = byte(i + 1)
 	}
 	refl.writeFrame(t, 10, appendBytes(nil, challenge))
-	typ, body = refl.readFrame(t)
+	typ, body := refl.readFrame(t)
 	if typ != 11 {
 		t.Fatalf("auth type %d", typ)
 	}
@@ -88,10 +88,47 @@ func loginLog(t *testing.T, callsign, key string, tg int, id uint16, codecs []st
 	if utyp != 1 || gotID != id || seq != 0 || len(ubody) != 0 {
 		t.Fatalf("udp heartbeat type %d id %d seq %d len %d", utyp, gotID, seq, len(ubody))
 	}
-	if _, err := st.Wait(ctx, func(s station.State) bool { return s.Connection == "Connected" }); err != nil {
+	got, err := st.Wait(ctx, func(s station.State) bool { return s.Connection == "Connected" })
+	if err != nil {
 		t.Fatal(err)
 	}
-	return loggedIn{st: st, clock: clock, refl: refl, cancel: cancel, id: id}
+	if got.Protocol != "2.0" {
+		t.Fatalf("Protocol = %q, want 2.0", got.Protocol)
+	}
+	return loggedIn{st: st, clock: clock, refl: refl, cancel: cancel, id: id, path: path}
+}
+
+func expectVersion(t *testing.T, refl *reflector, major, minor uint16) {
+	t.Helper()
+	typ, body := refl.readFrame(t)
+	if typ != 5 || !versionIs(body, major, minor) {
+		t.Fatalf("version type %d body %v, want %d.%d", typ, body, major, minor)
+	}
+}
+
+func declineTo2(t *testing.T, refl *reflector) {
+	t.Helper()
+	typ, body := refl.readFrame(t)
+	if typ != 5 || !versionIs(body, 3, 0) {
+		t.Fatalf("first version type %d body %v, want 3.0", typ, body)
+	}
+	refl.writeFrame(t, 6, versionWire(2, 0))
+	refl.accept(t)
+	typ, body = refl.readFrame(t)
+	if typ != 5 || !versionIs(body, 2, 0) {
+		t.Fatalf("fallback version type %d body %v, want 2.0", typ, body)
+	}
+}
+
+func versionWire(major, minor uint16) []byte {
+	return appendU16(appendU16(nil, major), minor)
+}
+
+func versionIs(body []byte, major, minor uint16) bool {
+	if len(body) != 4 {
+		return false
+	}
+	return binary.BigEndian.Uint16(body[0:2]) == major && binary.BigEndian.Uint16(body[2:4]) == minor
 }
 
 func TestQuietSessionSendsHeartbeats(t *testing.T) {
@@ -127,12 +164,15 @@ func TestDropRetriesUntilQuit(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
+	if got := in.st.State(); got.Protocol != "" {
+		t.Fatalf("Protocol = %q, want blank while disconnected", got.Protocol)
+	}
 	in.clock.BlockUntilWaiting(t)
 	in.clock.Advance(2 * time.Second)
 	in.refl.accept(t)
 	typ, body := in.refl.readFrame(t)
-	if typ != 5 || body[1] != 2 {
+	if typ != 5 || !versionIs(body, 2, 0) {
-		t.Fatalf("retry protocol type %d body %v", typ, body)
+		t.Fatalf("retry protocol type %d body %v, want 2.0", typ, body)
 	}
 	in.cancel()
 	in.clock.Advance(2 * time.Second)
@@ -159,7 +199,10 @@ func TestRefusedConnectionRetriesUntilQuit(t *testing.T) {
 	}
 	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 
 	if _, err := st.Wait(ctx, func(s station.State) bool { return s.Connection == "Disconnected" }); err != nil {
 		t.Fatal(err)
@@ -204,7 +247,10 @@ func TestReflectorErrorStopsRetries(t *testing.T) {
 			}
 			ctx, cancel := context.WithCancel(t.Context())
 			defer cancel()
-			go func() { _ = st.Run(ctx) }()
+			go func() {
+				// Run's error is observed through State, which is the station seam.
+				_ = st.Run(ctx)
+			}()
 			refl.accept(t)
 			refl.readFrame(t)
 			refl.writeFrame(t, 13, appendStr(nil, msg))
@@ -238,9 +284,12 @@ func TestMissingOpusStopsRetries(t *testing.T) {
 	}
 	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 	refl.accept(t)
-	refl.readFrame(t)
+	expectVersion(t, refl, 2, 0)
 	challenge := make([]byte, 20)
 	refl.writeFrame(t, 10, appendBytes(nil, challenge))
 	refl.readFrame(t)
@@ -508,14 +557,15 @@ func expectAudio(t *testing.T, refl *reflector, dec *opus.Decoder, id, seq uint1
 }
 
 func tryFrame(r *reflector) (uint16, []byte, bool) {
-	_ = r.tcp.SetReadDeadline(time.Now().Add(30 * time.Millisecond))
+	conn := r.conn()
+	_ = conn.SetReadDeadline(time.Now().Add(30 * time.Millisecond))
 	var hdr [4]byte
-	if _, err := io.ReadFull(r.tcp, hdr[:]); err != nil {
+	if _, err := io.ReadFull(conn, hdr[:]); err != nil {
 		return 0, nil, false
 	}
 	n := binary.BigEndian.Uint32(hdr[:])
 	buf := make([]byte, n)
-	if _, err := io.ReadFull(r.tcp, buf); err != nil {
+	if _, err := io.ReadFull(conn, buf); err != nil {
 		return 0, nil, false
 	}
 	if len(buf) < 2 {

station/cert.go

@@ -0,0 +1,316 @@
+package station
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+)
+
+const (
+	caFileName   = "ca.pem"
+	keyFileName  = "key.pem"
+	csrFileName  = "csr.pem"
+	certFileName = "cert.pem"
+)
+
+var (
+	oidBasicConstraints = asn1.ObjectIdentifier{2, 5, 29, 19}
+	oidKeyUsage         = asn1.ObjectIdentifier{2, 5, 29, 15}
+	oidExtKeyUsage      = asn1.ObjectIdentifier{2, 5, 29, 37}
+	oidClientAuth       = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2}
+)
+
+func ensureCertDir(path string) error {
+	err := os.Mkdir(path, 0o700)
+	if err != nil {
+		if !errors.Is(err, fs.ErrExist) {
+			return err
+		}
+		info, statErr := os.Stat(path)
+		if statErr != nil {
+			return statErr
+		}
+		if !info.IsDir() {
+			return err
+		}
+		return nil
+	}
+	return os.Chmod(path, 0o700)
+}
+
+func caDigest(dir string) (sum [32]byte, ok bool, err error) {
+	body, err := os.ReadFile(filepath.Join(dir, caFileName))
+	if errors.Is(err, fs.ErrNotExist) {
+		return sum, false, nil
+	}
+	if err != nil {
+		return sum, false, err
+	}
+	return sha256.Sum256(body), true, nil
+}
+
+func verifyCABundle(caPEM string, sig []byte, certPEM string) error {
+	block, _ := pem.Decode([]byte(certPEM))
+	if block == nil {
+		return errors.New("signing certificate")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return err
+	}
+	pub, ok := cert.PublicKey.(*rsa.PublicKey)
+	if !ok {
+		return errors.New("signing certificate")
+	}
+	sum := sha256.Sum256([]byte(caPEM))
+	return rsa.VerifyPKCS1v15(pub, crypto.SHA256, sum[:], sig)
+}
+
+func writeCABundle(dir, caPEM string) error {
+	return writeMode(filepath.Join(dir, caFileName), []byte(caPEM), 0o644)
+}
+
+func writeClientCert(dir, certPEM string) error {
+	return writeMode(filepath.Join(dir, certFileName), []byte(certPEM), 0o644)
+}
+
+func csrNewerThanCert(dir string) (bool, error) {
+	csrPath := filepath.Join(dir, csrFileName)
+	certPath := filepath.Join(dir, certFileName)
+	csr, err := os.Stat(csrPath)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return false, fmt.Errorf("stat %s: %w", csrPath, err)
+	}
+	if err != nil {
+		return false, nil
+	}
+	cert, err := os.Stat(certPath)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return false, fmt.Errorf("stat %s: %w", certPath, err)
+	}
+	if err != nil {
+		return false, nil
+	}
+	return csr.ModTime().After(cert.ModTime()), nil
+}
+
+func readCSR(dir string) (string, error) {
+	body, err := os.ReadFile(filepath.Join(dir, csrFileName))
+	if err != nil {
+		return "", err
+	}
+	return string(body), nil
+}
+
+// prepareIdentity checks a saved certificate or creates the key and signing
+// request. fatal is a window message when the station must stop.
+func prepareIdentity(dir, callsign string) (tls.Certificate, bool, string, error) {
+	certPath := filepath.Join(dir, certFileName)
+	keyPath := filepath.Join(dir, keyFileName)
+	_, certErr := os.Stat(certPath)
+	_, keyErr := os.Stat(keyPath)
+	certExists := certErr == nil
+	keyExists := keyErr == nil
+	if certErr != nil && !errors.Is(certErr, fs.ErrNotExist) {
+		return tls.Certificate{}, false, "Cannot create " + certPath, fmt.Errorf("stat certificate: %w", certErr)
+	}
+	if keyErr != nil && !errors.Is(keyErr, fs.ErrNotExist) {
+		return tls.Certificate{}, false, "Cannot create " + keyPath, fmt.Errorf("stat key: %w", keyErr)
+	}
+	if certExists && !keyExists {
+		return tls.Certificate{}, false, "Certificate key is missing", nil
+	}
+	if certExists && keyExists {
+		pair, msg, err := loadPair(certPath, keyPath, callsign)
+		if msg != "" {
+			return tls.Certificate{}, false, msg, err
+		}
+		if msg, err := ensureCSR(dir, callsign); msg != "" {
+			return tls.Certificate{}, false, msg, err
+		}
+		return pair, true, "", nil
+	}
+	if msg, err := ensureKeyAndCSR(dir, callsign, !keyExists); msg != "" {
+		return tls.Certificate{}, false, msg, err
+	}
+	return tls.Certificate{}, false, "", nil
+}
+
+func loadPair(certPath, keyPath, callsign string) (tls.Certificate, string, error) {
+	cert, err := loadCert(certPath)
+	if err != nil {
+		return tls.Certificate{}, "Cannot create " + certPath, fmt.Errorf("read certificate: %w", err)
+	}
+	key, err := loadKey(keyPath)
+	if err != nil {
+		return tls.Certificate{}, "Cannot create " + keyPath, fmt.Errorf("read key: %w", err)
+	}
+	pub, ok := cert.PublicKey.(*rsa.PublicKey)
+	if !ok || !pub.Equal(&key.PublicKey) {
+		return tls.Certificate{}, "Certificate does not match the key", nil
+	}
+	if cert.Subject.CommonName != callsign {
+		return tls.Certificate{}, "Certificate callsign does not match", nil
+	}
+	return tls.Certificate{
+		Certificate: [][]byte{cert.Raw},
+		PrivateKey:  key,
+		Leaf:        cert,
+	}, "", nil
+}
+
+func ensureCSR(dir, callsign string) (string, error) {
+	csrPath := filepath.Join(dir, csrFileName)
+	_, err := os.Stat(csrPath)
+	if err == nil {
+		return "", nil
+	}
+	if !errors.Is(err, fs.ErrNotExist) {
+		return "Cannot create " + csrPath, fmt.Errorf("stat signing request: %w", err)
+	}
+	key, err := loadKey(filepath.Join(dir, keyFileName))
+	if err != nil {
+		return "Cannot create " + csrPath, fmt.Errorf("read key: %w", err)
+	}
+	if err := writeCSR(csrPath, key, callsign); err != nil {
+		return "Cannot create " + csrPath, err
+	}
+	return "", nil
+}
+
+func ensureKeyAndCSR(dir, callsign string, created bool) (string, error) {
+	keyPath := filepath.Join(dir, keyFileName)
+	var key *rsa.PrivateKey
+	var err error
+	if created {
+		key, err = rsa.GenerateKey(rand.Reader, 2048)
+		if err != nil {
+			return "Cannot create " + keyPath, fmt.Errorf("generate key: %w", err)
+		}
+		der := x509.MarshalPKCS1PrivateKey(key)
+		body := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: der})
+		if err := writeNew(keyPath, body, 0o600); err != nil {
+			return "Cannot create " + keyPath, err
+		}
+	} else {
+		key, err = loadKey(keyPath)
+		if err != nil {
+			return "Cannot create " + keyPath, fmt.Errorf("read key: %w", err)
+		}
+	}
+	csrPath := filepath.Join(dir, csrFileName)
+	_, csrErr := os.Stat(csrPath)
+	if csrErr != nil && !errors.Is(csrErr, fs.ErrNotExist) {
+		return "Cannot create " + csrPath, fmt.Errorf("stat signing request: %w", csrErr)
+	}
+	if created || errors.Is(csrErr, fs.ErrNotExist) {
+		if err := writeCSR(csrPath, key, callsign); err != nil {
+			return "Cannot create " + csrPath, err
+		}
+	}
+	return "", nil
+}
+
+func writeCSR(path string, key *rsa.PrivateKey, callsign string) error {
+	bc, err := asn1.Marshal(struct {
+		CA bool
+	}{CA: false})
+	if err != nil {
+		return err
+	}
+	// digitalSignature, keyEncipherment, keyAgreement: bits 0, 2, and 4.
+	ku, err := asn1.Marshal(asn1.BitString{Bytes: []byte{0xA8}, BitLength: 5})
+	if err != nil {
+		return err
+	}
+	eku, err := asn1.Marshal([]asn1.ObjectIdentifier{oidClientAuth})
+	if err != nil {
+		return err
+	}
+	der, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
+		Subject: pkix.Name{CommonName: callsign},
+		ExtraExtensions: []pkix.Extension{
+			{Id: oidBasicConstraints, Critical: true, Value: bc},
+			{Id: oidKeyUsage, Critical: true, Value: ku},
+			{Id: oidExtKeyUsage, Critical: false, Value: eku},
+		},
+	}, key)
+	if err != nil {
+		return err
+	}
+	body := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: der})
+	return writeMode(path, body, 0o644)
+}
+
+func loadCert(path string) (*x509.Certificate, error) {
+	body, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(body)
+	if block == nil {
+		return nil, errors.New("certificate")
+	}
+	return x509.ParseCertificate(block.Bytes)
+}
+
+func loadKey(path string) (*rsa.PrivateKey, error) {
+	body, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(body)
+	if block == nil {
+		return nil, errors.New("key")
+	}
+	switch block.Type {
+	case "RSA PRIVATE KEY":
+		return x509.ParsePKCS1PrivateKey(block.Bytes)
+	case "PRIVATE KEY":
+		k, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, err
+		}
+		rk, ok := k.(*rsa.PrivateKey)
+		if !ok {
+			return nil, errors.New("key")
+		}
+		return rk, nil
+	default:
+		return nil, errors.New("key")
+	}
+}
+
+func writeNew(path string, body []byte, mode os.FileMode) error {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+	if err != nil {
+		return err
+	}
+	_, werr := f.Write(body)
+	cerr := f.Close()
+	if werr != nil {
+		return werr
+	}
+	if cerr != nil {
+		return cerr
+	}
+	return os.Chmod(path, mode)
+}
+
+func writeMode(path string, body []byte, mode os.FileMode) error {
+	if err := os.WriteFile(path, body, mode); err != nil {
+		return err
+	}
+	return os.Chmod(path, mode)
+}

station/cipher.go

@@ -0,0 +1,33 @@
+package station
+
+import (
+	"encoding/binary"
+
+	"gitea.neitzel.de/konrad/funknetz/internal/gcm64"
+)
+
+func counterAAD(counter uint32) []byte {
+	var b [4]byte
+	binary.BigEndian.PutUint32(b[:], counter)
+	return b[:]
+}
+
+func registrationAAD(clientID uint16) []byte {
+	b := counterAAD(0)
+	return appendU16(b, clientID)
+}
+
+func sealDatagram(key, prefix []byte, clientID uint16, counter uint32, aad, plain []byte) ([]byte, error) {
+	tag, ct, err := gcm64.Seal(key, gcm64.IV(prefix, clientID, counter), plain, aad)
+	if err != nil {
+		return nil, err
+	}
+	wire := make([]byte, 0, len(aad)+len(tag)+len(ct))
+	wire = append(wire, aad...)
+	wire = append(wire, tag...)
+	return append(wire, ct...), nil
+}
+
+func openDatagram(key, prefix []byte, clientID uint16, counter uint32, aad, tag, ct []byte) ([]byte, error) {
+	return gcm64.Open(key, gcm64.IV(prefix, clientID, counter), tag, ct, aad)
+}

station/config.go

@@ -15,108 +15,203 @@ import (
 )
 
 type loaded struct {
-	host          string
+	host           string
-	port          int
+	port           int
-	callsign      string
+	callsign       string
-	authKey       string
+	authKey        string
-	talkGroup     int
+	talkGroup      int
-	enableLogging bool
+	protocolMajor  uint16
-	logPath       string
+	certificateDir string
-	logNotice     string
+	certFatal      string
+	enableLogging  bool
+	logPath        string
+	logNotice      string
 }
 
 type fileShape struct {
-	Host          jsontext.Value `json:"host"`
+	Host           jsontext.Value `json:"host"`
-	Port          jsontext.Value `json:"port"`
+	Port           jsontext.Value `json:"port"`
-	Callsign      jsontext.Value `json:"callsign"`
+	Callsign       jsontext.Value `json:"callsign"`
-	AuthKey       jsontext.Value `json:"authKey"`
+	AuthKey        jsontext.Value `json:"authKey"`
-	TalkGroup     jsontext.Value `json:"talkGroup"`
+	TalkGroup      jsontext.Value `json:"talkGroup"`
-	EnableLogging jsontext.Value `json:"enableLogging"`
+	Protocol       jsontext.Value `json:"protocol"`
-	LogFile       jsontext.Value `json:"logFile"`
+	CertificateDir jsontext.Value `json:"certificateDir"`
+	EnableLogging  jsontext.Value `json:"enableLogging"`
+	LogFile        jsontext.Value `json:"logFile"`
 }
 
 type templateFile struct {
-	Host          string `json:"host"`
+	Host           string `json:"host"`
-	Port          int    `json:"port"`
+	Port           int    `json:"port"`
-	Callsign      string `json:"callsign"`
+	Callsign       string `json:"callsign"`
-	AuthKey       string `json:"authKey"`
+	AuthKey        string `json:"authKey"`
-	TalkGroup     int    `json:"talkGroup"`
+	TalkGroup      int    `json:"talkGroup"`
-	EnableLogging bool   `json:"enableLogging"`
+	Protocol       string `json:"protocol"`
-	LogFile       string `json:"logFile"`
+	CertificateDir string `json:"certificateDir"`
+	EnableLogging  bool   `json:"enableLogging"`
+	LogFile        string `json:"logFile"`
 }
 
 var callsignPattern = regexp.MustCompile(`^[A-Z0-9][A-Z]{0,2}\d[A-Z0-9]{0,3}[A-Z](?:-[A-Z0-9]{1,3})?$`)
 
-func loadConfig(path string) (loaded, error) {
+// configLoad is the result of reading a config path. err from loadConfig is
+// only a failure that still exits before the window, such as an unknown home
+// directory. A missing or invalid file is reported in detail with loaded false.
+type configLoad struct {
+	cfg    loaded
+	form   ConfigForm
+	loaded bool
+	detail string
+}
+
+func loadConfig(path string) (configLoad, error) {
 	body, err := os.ReadFile(path)
 	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
+		form, ferr := templateForm()
-			if err := writeTemplate(path); err != nil {
+		if ferr != nil {
-				return loaded{}, err
+			return configLoad{}, ferr
-			}
-			return loaded{}, fmt.Errorf("created %s", path)
 		}
-		return loaded{}, fmt.Errorf("the file could not be read: %w", err)
+		if errors.Is(err, fs.ErrNotExist) {
+			return configLoad{form: form}, nil
+		}
+		return configLoad{form: form, detail: fmt.Errorf("the file could not be read: %w", err).Error()}, nil
 	}
-	return parseConfig(path, body)
+	return parseConfig(path, body, true)
 }
 
-func writeTemplate(path string) error {
+// ConfigForm is the fields the Config window edits.
+type ConfigForm struct {
+	Host           string `json:"host"`
+	Port           int    `json:"port"`
+	Callsign       string `json:"callsign"`
+	AuthKey        string `json:"authKey"`
+	TalkGroup      int    `json:"talkGroup"`
+	Protocol       string `json:"protocol"`
+	CertificateDir string `json:"certificateDir"`
+	EnableLogging  bool   `json:"enableLogging"`
+	LogFile        string `json:"logFile"`
+}
+
+// ConfigState is what the Config window shows.
+type ConfigState struct {
+	Open        bool       `json:"open"`
+	NeedsConfig bool       `json:"needsConfig"`
+	Error       string     `json:"error"`
+	Form        ConfigForm `json:"form"`
+}
+
+func templateForm() (ConfigForm, error) {
 	logFile, err := defaultLogPath()
 	if err != nil {
-		return err
+		return ConfigForm{}, err
 	}
-	body, err := jsonv2.Marshal(templateFile{LogFile: logFile})
+	return ConfigForm{Protocol: "v2", CertificateDir: "./funknetz", LogFile: logFile}, nil
-	if err != nil {
-		return err
-	}
-	body = append(body, '\n')
-	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
-	if err != nil {
-		return err
-	}
-	_, werr := f.Write(body)
-	cerr := f.Close()
-	if werr != nil {
-		return werr
-	}
-	if cerr != nil {
-		return cerr
-	}
-	return os.Chmod(path, 0o600)
 }
 
-func parseConfig(path string, body []byte) (loaded, error) {
+func parseConfig(path string, body []byte, rewrite bool) (configLoad, error) {
 	var shape fileShape
 	if err := jsonv2.Unmarshal(body, &shape); err != nil {
-		return loaded{}, fmt.Errorf("the file could not be read: %w", err)
+		form, ferr := templateForm()
+		if ferr != nil {
+			return configLoad{}, ferr
+		}
+		return configLoad{form: form, detail: fmt.Errorf("the file could not be read: %w", err).Error()}, nil
 	}
-	if block, notice := blockedLog(shape); block {
+	certBad := present(shape.CertificateDir) && shape.CertificateDir.Kind() != jsontext.KindString
+	protoBad := present(shape.Protocol) && shape.Protocol.Kind() != jsontext.KindString
+	if block, notice := blockedLog(shape); block || certBad || protoBad {
 		cfg, err := parseOperational(shape)
 		if err != nil {
-			return loaded{}, err
+			return refused(shape, err)
 		}
 		cfg.logNotice = notice
-		return cfg, nil
+		if !block {
+			cfg = applyLog(cfg, shape)
+		}
+		return finish(shape, applyCertificate(cfg, shape, path))
 	}
-	if missingLog(shape) {
+	if missingCertificate(shape) || missingLog(shape) || missingProtocol(shape) {
 		if !operationalKindsOK(shape) {
-			return parseOperational(shape)
+			_, err := parseOperational(shape)
+			if err != nil {
+				return refused(shape, err)
+			}
 		}
 		var err error
 		shape, err = withLogDefaults(shape)
 		if err != nil {
-			return loaded{}, err
+			return configLoad{}, err
 		}
-		if err := rewriteConfig(path, shape); err != nil {
+		if rewrite {
-			return loaded{}, fmt.Errorf("the file could not be read: %w", err)
+			if err := rewriteConfig(path, shape); err != nil {
+				return configLoad{}, fmt.Errorf("the file could not be read: %w", err)
+			}
 		}
 	}
 	cfg, err := parseOperational(shape)
 	if err != nil {
-		return loaded{}, err
+		return refused(shape, err)
 	}
-	return applyLog(cfg, shape), nil
+	return finish(shape, applyLog(applyCertificate(cfg, shape, path), shape))
+}
+
+func finish(shape fileShape, cfg loaded) (configLoad, error) {
+	form := formFromShape(shape)
+	if cfg.certFatal != "" {
+		return configLoad{cfg: cfg, form: form, loaded: true, detail: cfg.certFatal}, nil
+	}
+	return configLoad{cfg: cfg, form: form, loaded: true, detail: cfg.logNotice}, nil
+}
+
+func refused(shape fileShape, cause error) (configLoad, error) {
+	return configLoad{form: formFromShape(shape), detail: cause.Error()}, nil
+}
+
+func formFromShape(shape fileShape) ConfigForm {
+	fallback, err := templateForm()
+	if err != nil {
+		fallback = ConfigForm{Protocol: "v2", CertificateDir: "./funknetz"}
+	}
+	return mergeSalvage(shape, fallback)
+}
+
+func mergeSalvage(shape fileShape, fallback ConfigForm) ConfigForm {
+	if s, err := stringField("host", shape.Host); err == nil && present(shape.Host) {
+		fallback.Host = s
+	}
+	if present(shape.Port) && shape.Port.Kind() == jsontext.KindNumber {
+		var n int
+		if jsonv2.Unmarshal(shape.Port, &n) == nil {
+			fallback.Port = n
+		}
+	}
+	if s, err := stringField("callsign", shape.Callsign); err == nil && present(shape.Callsign) {
+		fallback.Callsign = s
+	}
+	if s, err := stringField("authKey", shape.AuthKey); err == nil && present(shape.AuthKey) {
+		fallback.AuthKey = s
+	}
+	if present(shape.TalkGroup) && shape.TalkGroup.Kind() == jsontext.KindNumber {
+		var n int
+		if jsonv2.Unmarshal(shape.TalkGroup, &n) == nil {
+			fallback.TalkGroup = n
+		}
+	}
+	if s, err := stringField("protocol", shape.Protocol); err == nil && present(shape.Protocol) {
+		if label, ok := protocolLabel(s); ok {
+			fallback.Protocol = label
+		}
+	}
+	if s, err := stringField("certificateDir", shape.CertificateDir); err == nil && present(shape.CertificateDir) {
+		fallback.CertificateDir = s
+	}
+	if present(shape.EnableLogging) && isBool(shape.EnableLogging) {
+		fallback.EnableLogging = shape.EnableLogging.Kind() == jsontext.KindTrue
+	}
+	if s, err := stringField("logFile", shape.LogFile); err == nil && present(shape.LogFile) {
+		fallback.LogFile = s
+	}
+	return fallback
 }
 
 func parseOperational(shape fileShape) (loaded, error) {
@@ -140,6 +235,10 @@ func parseOperational(shape fileShape) (loaded, error) {
 	if err != nil {
 		return loaded{}, err
 	}
+	protocolMajor, err := protocolField(shape.Protocol)
+	if err != nil {
+		return loaded{}, err
+	}
 
 	host = strings.TrimSpace(host)
 	if host == "" {
@@ -152,7 +251,45 @@ func parseOperational(shape fileShape) (loaded, error) {
 	if !callsignPattern.MatchString(call) {
 		return loaded{}, fmt.Errorf("callsign is invalid")
 	}
-	return loaded{host: host, port: port, callsign: call, authKey: key, talkGroup: tg}, nil
+	return loaded{host: host, port: port, callsign: call, authKey: key, talkGroup: tg, protocolMajor: protocolMajor}, nil
+}
+
+func protocolField(v jsontext.Value) (uint16, error) {
+	if !present(v) {
+		return 2, nil
+	}
+	s, err := stringField("protocol", v)
+	if err != nil {
+		return 0, err
+	}
+	if strings.TrimSpace(s) == "" {
+		return 2, nil
+	}
+	if _, ok := protocolLabel(s); !ok {
+		return 0, fmt.Errorf("protocol is invalid")
+	}
+	if strings.TrimSpace(s) == "v3" {
+		return 3, nil
+	}
+	return 2, nil
+}
+
+func protocolLabel(s string) (string, bool) {
+	switch strings.TrimSpace(s) {
+	case "v2":
+		return "v2", true
+	case "v3":
+		return "v3", true
+	default:
+		return "", false
+	}
+}
+
+func protocolName(major uint16) string {
+	if major == 3 {
+		return "v3"
+	}
+	return "v2"
 }
 
 func stringField(name string, v jsontext.Value) (string, error) {
@@ -217,6 +354,18 @@ func missingLog(shape fileShape) bool {
 	return !present(shape.EnableLogging) || !present(shape.LogFile)
 }
 
+func missingCertificate(shape fileShape) bool {
+	return !present(shape.CertificateDir)
+}
+
+func missingProtocol(shape fileShape) bool {
+	if !present(shape.Protocol) {
+		return true
+	}
+	s, err := stringField("protocol", shape.Protocol)
+	return err == nil && strings.TrimSpace(s) == ""
+}
+
 func operationalKindsOK(shape fileShape) bool {
 	if present(shape.Host) && shape.Host.Kind() != jsontext.KindString {
 		return false
@@ -233,6 +382,9 @@ func operationalKindsOK(shape fileShape) bool {
 	if present(shape.TalkGroup) && shape.TalkGroup.Kind() != jsontext.KindNumber {
 		return false
 	}
+	if present(shape.Protocol) && shape.Protocol.Kind() != jsontext.KindString {
+		return false
+	}
 	return true
 }
 
@@ -259,6 +411,10 @@ func withLogDefaults(shape fileShape) (fileShape, error) {
 	shape.Callsign = rawOr(shape.Callsign, `""`)
 	shape.AuthKey = rawOr(shape.AuthKey, `""`)
 	shape.TalkGroup = rawOr(shape.TalkGroup, "0")
+	if missingProtocol(shape) {
+		shape.Protocol = jsontext.Value(`"v2"`)
+	}
+	shape.CertificateDir = rawOr(shape.CertificateDir, `"./funknetz"`)
 	shape.EnableLogging = rawOr(shape.EnableLogging, "false")
 	if !present(shape.LogFile) {
 		logFile, err := defaultLogPath()
@@ -291,13 +447,17 @@ func rewriteConfig(path string, shape fileShape) error {
 		return err
 	}
 	body = append(body, '\n')
+	return rewriteBytes(path, body, info.Mode().Perm())
+}
+
+func rewriteBytes(path string, body []byte, mode fs.FileMode) error {
 	tmp, err := os.CreateTemp(filepath.Dir(path), ".funknetz-*.json")
 	if err != nil {
 		return err
 	}
 	tmpName := tmp.Name()
 	_, werr := tmp.Write(body)
-	cerr := tmp.Chmod(info.Mode().Perm())
+	cerr := tmp.Chmod(mode)
 	clerr := tmp.Close()
 	if werr != nil || cerr != nil || clerr != nil {
 		os.Remove(tmpName)
@@ -316,6 +476,32 @@ func rewriteConfig(path string, shape fileShape) error {
 	return nil
 }
 
+func applyCertificate(cfg loaded, shape fileShape, configPath string) loaded {
+	if !present(shape.CertificateDir) {
+		cfg.certificateDir = resolveCertDir(configPath, "./funknetz")
+		return cfg
+	}
+	dir, err := stringField("certificateDir", shape.CertificateDir)
+	if err != nil {
+		cfg.certFatal = err.Error()
+		return cfg
+	}
+	if strings.TrimSpace(dir) == "" {
+		cfg.certFatal = "certificateDir is empty"
+		return cfg
+	}
+	cfg.certificateDir = resolveCertDir(configPath, dir)
+	return cfg
+}
+
+func resolveCertDir(configPath, dir string) string {
+	dir = strings.TrimSpace(dir)
+	if filepath.IsAbs(dir) {
+		return filepath.Clean(dir)
+	}
+	return filepath.Clean(filepath.Join(filepath.Dir(configPath), dir))
+}
+
 func applyLog(cfg loaded, shape fileShape) loaded {
 	if shape.EnableLogging.Kind() != jsontext.KindTrue {
 		return cfg

station/config_test.go

@@ -1,64 +1,68 @@
 package station_test
 
 import (
+	"context"
+	"fmt"
+	"net"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	jsonv2 "encoding/json/v2"
 
 	"gitea.neitzel.de/konrad/funknetz/station"
 )
 
-func TestMissingConfigIsCreatedAndRejected(t *testing.T) {
+func TestMissingConfigOpensWithoutCreating(t *testing.T) {
 	path := filepath.Join(t.TempDir(), ".funknetz.json")
 
-	_, err := station.New(station.Options{ConfigPath: path})
+	st, err := station.New(station.Options{ConfigPath: path})
-	if err == nil {
-		t.Fatal("New() error = nil, want a rejection after creating the file")
-	}
-	if !strings.Contains(err.Error(), "created") {
-		t.Fatalf("New() error = %q, want it to say the file was created", err.Error())
-	}
-
-	info, err := os.Stat(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got, want := info.Mode().Perm(), os.FileMode(0o600); got != want {
+	t.Cleanup(st.Close)
-		t.Fatalf("mode = %o, want %o", got, want)
+	if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
+		t.Fatalf("stat = %v, want the file absent", statErr)
 	}
 
-	body, err := os.ReadFile(path)
+	got := st.State()
-	if err != nil {
+	if !got.NeedsConfig || !got.ConfigOpen || got.Connection != "Disconnected" {
-		t.Fatal(err)
+		t.Fatalf("State = %+v, want Disconnected with the Config window open", got)
 	}
-	var got map[string]any
+	cfg := st.Config()
-	if err := jsonv2.Unmarshal(body, &got); err != nil {
+	if !cfg.Open || !cfg.NeedsConfig || cfg.Error != "" {
-		t.Fatalf("created file is not JSON: %v\n%s", err, body)
+		t.Fatalf("Config = %+v, want an open needs-config form and no error", cfg)
-	}
-	if got["host"] != "" || got["callsign"] != "" || got["authKey"] != "" {
-		t.Fatalf("string fields = %#v, want empty host, callsign, and authKey", got)
-	}
-	if got["port"] != float64(0) || got["talkGroup"] != float64(0) {
-		t.Fatalf("numeric fields = %#v, want port and talkGroup at zero", got)
 	}
 	home, err := os.UserHomeDir()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got["enableLogging"] != false {
+	form := cfg.Form
-		t.Fatalf("enableLogging = %#v, want false", got["enableLogging"])
+	if form.Host != "" || form.Callsign != "" || form.AuthKey != "" {
+		t.Fatalf("string fields = %+v, want empty host, callsign, and authKey", form)
 	}
-	if got["logFile"] != filepath.Join(home, "funknetz.log") {
+	if form.Port != 0 || form.TalkGroup != 0 {
-		t.Fatalf("logFile = %#v, want funknetz.log in the home directory", got["logFile"])
+		t.Fatalf("numeric fields = %+v, want port and talkGroup at zero", form)
+	}
+	if form.EnableLogging {
+		t.Fatal("EnableLogging = true, want false")
+	}
+	if form.Protocol != "v2" {
+		t.Fatalf("Protocol = %q, want v2", form.Protocol)
+	}
+	if form.CertificateDir != "./funknetz" {
+		t.Fatalf("CertificateDir = %q, want ./funknetz", form.CertificateDir)
+	}
+	if form.LogFile != filepath.Join(home, "funknetz.log") {
+		t.Fatalf("LogFile = %q, want funknetz.log in the home directory", form.LogFile)
 	}
 }
 
 func TestExistingConfigIsNotRewritten(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "funknetz.json")
-	original := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"a b\",\"talkGroup\":20,\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
+	original := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"a b\",\"talkGroup\":20,\"protocol\":\"v2\",\"certificateDir\":\"/var/funknetz\",\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
 	if err := os.WriteFile(path, original, 0o640); err != nil {
 		t.Fatal(err)
 	}
@@ -110,6 +114,8 @@ func TestInvalidConfigNamesTheField(t *testing.T) {
 		{name: "talk group negative", host: "127.0.0.1", port: 5308, callsign: "DL1ABC", authKey: "key", talkGroup: -3, want: "talkGroup is invalid"},
 		{name: "talk group type", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":"20"}`, want: "talkGroup has the wrong type"},
 		{name: "bad callsign", host: "127.0.0.1", port: 5308, callsign: "HELLO", authKey: "key", talkGroup: 1, want: "callsign is invalid"},
+		{name: "protocol type", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":1,"protocol":2}`, want: "protocol has the wrong type"},
+		{name: "protocol value", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":1,"protocol":"v1"}`, want: "protocol is invalid"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -125,12 +131,17 @@ func TestInvalidConfigNamesTheField(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			_, err = station.New(station.Options{ConfigPath: path})
+			st, err := station.New(station.Options{ConfigPath: path})
-			if err == nil {
+			if err != nil {
-				t.Fatal("New() error = nil, want a field rejection")
+				t.Fatal(err)
 			}
-			if err.Error() != tt.want {
+			t.Cleanup(st.Close)
-				t.Fatalf("New() error = %q, want %q", err.Error(), tt.want)
+			state := st.State()
+			if !state.NeedsConfig || !state.ConfigOpen || state.Detail != tt.want {
+				t.Fatalf("State = %+v, want the Config window open with detail %q", state, tt.want)
+			}
+			if st.Config().Error != tt.want {
+				t.Fatalf("Config error = %q, want %q", st.Config().Error, tt.want)
 			}
 			after, err := os.ReadFile(path)
 			if err != nil {
@@ -156,20 +167,55 @@ func TestInvalidConfigNamesTheField(t *testing.T) {
 	}
 }
 
+func TestBrokenFileSalvagesTheOtherFields(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "funknetz.json")
+	body := `{"host":1,"port":5308,"callsign":"DL1ABC","authKey":"a b","talkGroup":20,"certificateDir":"./radios","enableLogging":true,"logFile":"/tmp/funknetz.log"}`
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	form := st.Config().Form
+	if form.Host != "" || form.Port != 5308 || form.Callsign != "DL1ABC" || form.AuthKey != "a b" || form.TalkGroup != 20 {
+		t.Fatalf("Form = %+v, want the valid fields kept and host cleared", form)
+	}
+	if form.CertificateDir != "./radios" || !form.EnableLogging || form.LogFile != "/tmp/funknetz.log" {
+		t.Fatalf("Form = %+v, want certificate, logging, and log file kept", form)
+	}
+	after, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(after) != body {
+		t.Fatalf("file = %s, want it left untouched", after)
+	}
+}
+
 func TestBrokenConfigSaysTheFileCouldNotBeRead(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "funknetz.json")
 	if err := os.WriteFile(path, []byte("{"), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	_, err := station.New(station.Options{ConfigPath: path})
+	st, err := station.New(station.Options{ConfigPath: path})
-	if err == nil {
+	if err != nil {
-		t.Fatal("New() error = nil, want a read failure")
+		t.Fatal(err)
 	}
-	if !strings.Contains(err.Error(), "the file could not be read") {
+	t.Cleanup(st.Close)
-		t.Fatalf("New() error = %q, want it to say the file could not be read", err.Error())
+	got := st.Config()
+	if !got.Open || !got.NeedsConfig {
+		t.Fatalf("Config = %+v, want the Config window open", got)
 	}
-	if strings.Contains(err.Error(), "callsign") {
+	if !strings.Contains(got.Error, "the file could not be read") {
-		t.Fatalf("New() error = %q, want no field name", err.Error())
+		t.Fatalf("Config error = %q, want it to say the file could not be read", got.Error)
+	}
+	if strings.Contains(got.Error, "callsign") {
+		t.Fatalf("Config error = %q, want no field name", got.Error)
+	}
+	if got.Form.Host != "" || got.Form.Callsign != "" || got.Form.Port != 0 || got.Form.CertificateDir != "./funknetz" {
+		t.Fatalf("Form = %+v, want template defaults", got.Form)
 	}
 }
 
@@ -240,6 +286,13 @@ func TestMissingLogKeysAreRewritten(t *testing.T) {
 	if got["logFile"] != filepath.Join(home, "funknetz.log") {
 		t.Fatalf("logFile = %#v", got["logFile"])
 	}
+	if got["protocol"] != "v2" {
+		t.Fatalf("protocol = %#v, want v2", got["protocol"])
+	}
+	if got["certificateDir"] != "./funknetz" {
+		t.Fatalf("certificateDir = %#v, want ./funknetz", got["certificateDir"])
+	}
+	assertKeyOrder(t, body)
 	if st.State().Detail != "Idle" {
 		t.Fatalf("Detail = %q, want Idle", st.State().Detail)
 	}
@@ -314,9 +367,9 @@ func TestLogSettingsDoNotStopTheStation(t *testing.T) {
 		detail string
 		same   bool
 	}{
-		{name: "relative", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":true,"logFile":"funknetz.log"}`, detail: "Cannot write funknetz.log", same: true},
+		{name: "relative", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"protocol":"v2","certificateDir":"./funknetz","enableLogging":true,"logFile":"funknetz.log"}`, detail: "Cannot write funknetz.log", same: true},
-		{name: "empty", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":true,"logFile":"  "}`, detail: "Cannot write logFile", same: true},
+		{name: "empty", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"protocol":"v2","certificateDir":"./funknetz","enableLogging":true,"logFile":"  "}`, detail: "Cannot write logFile", same: true},
-		{name: "tilde", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":true,"logFile":"~/funknetz.log"}`, detail: "Cannot write ~/funknetz.log", same: true},
+		{name: "tilde", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"protocol":"v2","certificateDir":"./funknetz","enableLogging":true,"logFile":"~/funknetz.log"}`, detail: "Cannot write ~/funknetz.log", same: true},
 		{name: "enable type", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":"yes","logFile":"/tmp/funknetz.log"}`, detail: "enableLogging has the wrong type", same: true},
 		{name: "file type", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":true,"logFile":1}`, detail: "logFile has the wrong type", same: true},
 		{name: "both types", body: `{"host":"127.0.0.1","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":"yes","logFile":1}`, detail: "enableLogging has the wrong type", same: true},
@@ -348,15 +401,20 @@ func TestLogSettingsDoNotStopTheStation(t *testing.T) {
 		})
 	}
 
-	t.Run("bad host still quits", func(t *testing.T) {
+	t.Run("bad host opens the config window", func(t *testing.T) {
 		path := filepath.Join(t.TempDir(), "funknetz.json")
 		body := []byte(`{"host":"","port":5308,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"enableLogging":"yes"}`)
 		if err := os.WriteFile(path, body, 0o600); err != nil {
 			t.Fatal(err)
 		}
-		_, err := station.New(station.Options{ConfigPath: path})
+		st, err := station.New(station.Options{ConfigPath: path})
-		if err == nil || err.Error() != "host is empty" {
+		if err != nil {
-			t.Fatalf("New() error = %v, want host is empty", err)
+			t.Fatal(err)
+		}
+		t.Cleanup(st.Close)
+		got := st.State()
+		if !got.NeedsConfig || !got.ConfigOpen || got.Detail != "host is empty" {
+			t.Fatalf("State = %+v, want the Config window open with host is empty", got)
 		}
 		after, err := os.ReadFile(path)
 		if err != nil {
@@ -368,15 +426,239 @@ func TestLogSettingsDoNotStopTheStation(t *testing.T) {
 	})
 }
 
+func assertKeyOrder(t *testing.T, body []byte) {
+	t.Helper()
+	keys := []string{`"host"`, `"port"`, `"callsign"`, `"authKey"`, `"talkGroup"`, `"protocol"`, `"certificateDir"`, `"enableLogging"`, `"logFile"`}
+	last := -1
+	for _, key := range keys {
+		i := strings.Index(string(body), key)
+		if i < 0 || i < last {
+			t.Fatalf("key %s out of order in %s", key, body)
+		}
+		last = i
+	}
+}
+
+func TestInvalidSaveWritesNothingAndDoesNotConnect(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	port := ln.Addr().(*net.TCPAddr).Port
+	path := filepath.Join(t.TempDir(), "funknetz.json")
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+
+	err = st.Save(station.ConfigForm{
+		Host:           "",
+		Port:           port,
+		Callsign:       "DL1ABC",
+		AuthKey:        "key",
+		TalkGroup:      20,
+		CertificateDir: "./funknetz",
+		LogFile:        "/tmp/funknetz.log",
+	})
+	if err == nil || err.Error() != "host is empty" {
+		t.Fatalf("Save() error = %v, want host is empty", err)
+	}
+	if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
+		t.Fatalf("stat = %v, want the file absent", statErr)
+	}
+	cfg := st.Config()
+	if !cfg.Open || cfg.Error != "host is empty" || cfg.Form.Callsign != "DL1ABC" {
+		t.Fatalf("Config = %+v, want the window open with the host error and the edited callsign", cfg)
+	}
+	waitCtx, waitCancel := context.WithTimeout(t.Context(), 200*time.Millisecond)
+	defer waitCancel()
+	if _, err := st.Wait(waitCtx, func(s station.State) bool { return s.Connection != "Disconnected" }); err == nil {
+		t.Fatalf("State = %+v, want it to stay Disconnected", st.State())
+	}
+	ln.(*net.TCPListener).SetDeadline(time.Now().Add(200 * time.Millisecond))
+	if conn, err := ln.Accept(); err == nil {
+		conn.Close()
+		t.Fatal("opened a socket")
+	}
+}
+
+func TestValidSaveCreatesFileAndConnects(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	port := ln.Addr().(*net.TCPAddr).Port
+	dir := t.TempDir()
+	path := filepath.Join(dir, "funknetz.json")
+	logFile := filepath.Join(dir, "funknetz.log")
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+
+	err = st.Save(station.ConfigForm{
+		Host:           "  127.0.0.1  ",
+		Port:           port,
+		Callsign:       " dl1abc ",
+		AuthKey:        "a b",
+		TalkGroup:      20,
+		CertificateDir: "./funknetz",
+		LogFile:        logFile,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Config().Open || st.State().NeedsConfig {
+		t.Fatalf("State = %+v, Config open = %v, want the Config window closed", st.State(), st.Config().Open)
+	}
+	if st.State().Callsign != "DL1ABC" || st.State().TalkGroup != 20 {
+		t.Fatalf("State = %+v, want callsign DL1ABC talk group 20", st.State())
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := info.Mode().Perm(), os.FileMode(0o600); got != want {
+		t.Fatalf("mode = %o, want %o", got, want)
+	}
+	body, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := fmt.Sprintf("{\"host\":\"127.0.0.1\",\"port\":%d,\"callsign\":\"DL1ABC\",\"authKey\":\"a b\",\"talkGroup\":20,\"protocol\":\"v2\",\"certificateDir\":\"./funknetz\",\"enableLogging\":false,\"logFile\":%q}\n", port, logFile)
+	if string(body) != want {
+		t.Fatalf("file = %s, want %s", body, want)
+	}
+	assertKeyOrder(t, body)
+	ln.(*net.TCPListener).SetDeadline(time.Now().Add(2 * time.Second))
+	conn, err := ln.Accept()
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Close()
+}
+
+func TestMissingCertificateDirIsWrittenAfterTalkGroup(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "funknetz.json")
+	original := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"a b\",\"talkGroup\":20,\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
+	if err := os.WriteFile(path, original, 0o640); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := station.New(station.Options{ConfigPath: path}); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := info.Mode().Perm(), os.FileMode(0o640); got != want {
+		t.Fatalf("mode = %o, want %o", got, want)
+	}
+	body, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got map[string]any
+	if err := jsonv2.Unmarshal(body, &got); err != nil {
+		t.Fatal(err)
+	}
+	if got["authKey"] != "a b" || got["callsign"] != "DL1ABC" || got["certificateDir"] != "./funknetz" || got["protocol"] != "v2" {
+		t.Fatalf("fields = %#v", got)
+	}
+	if strings.Contains(string(body), t.TempDir()) {
+		t.Fatalf("file = %s, want the stored directory to stay relative", body)
+	}
+	assertKeyOrder(t, body)
+}
+
+func TestCertificateDirStopsBeforeASocket(t *testing.T) {
+	tests := []struct {
+		name string
+		dir  string
+		want string
+	}{
+		{name: "wrong type", dir: "1", want: "certificateDir has the wrong type"},
+		{name: "empty", dir: `""`, want: "certificateDir is empty"},
+		{name: "whitespace", dir: `"  "`, want: "certificateDir is empty"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ln, err := net.Listen("tcp", "127.0.0.1:0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer ln.Close()
+			port := ln.Addr().(*net.TCPAddr).Port
+			body := fmt.Sprintf(`{"host":"127.0.0.1","port":%d,"callsign":"DL1ABC","authKey":"key","talkGroup":20,"protocol":"v2","certificateDir":%s,"enableLogging":false,"logFile":"/tmp/funknetz.log"}`, port, tt.dir)
+			path := filepath.Join(t.TempDir(), "funknetz.json")
+			if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			st, err := station.New(station.Options{ConfigPath: path})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(st.Close)
+			got := st.State()
+			if got.Detail != tt.want || got.Connection != "Disconnected" || got.Callsign != "DL1ABC" {
+				t.Fatalf("State = %+v, want detail %q", got, tt.want)
+			}
+			after, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(after) != body {
+				t.Fatalf("file = %s, want it left untouched", after)
+			}
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			go func() {
+				// Run's error is observed through State, which is the station seam.
+				_ = st.Run(ctx)
+			}()
+			ln.(*net.TCPListener).SetDeadline(time.Now().Add(200 * time.Millisecond))
+			if conn, err := ln.Accept(); err == nil {
+				conn.Close()
+				t.Fatal("opened a socket")
+			}
+		})
+	}
+}
+
 func configJSON(t testing.TB, host string, port int, callsign, authKey string, talkGroup int) string {
 	t.Helper()
-	body, err := jsonv2.Marshal(map[string]any{
+	return configJSONProtocol(t, host, port, callsign, authKey, talkGroup, "")
+}
+
+func configJSONProtocol(t testing.TB, host string, port int, callsign, authKey string, talkGroup int, protocol string) string {
+	t.Helper()
+	fields := map[string]any{
 		"host":      host,
 		"port":      port,
 		"callsign":  callsign,
 		"authKey":   authKey,
 		"talkGroup": talkGroup,
-	})
+	}
+	if protocol != "" {
+		fields["protocol"] = protocol
+	}
+	body, err := jsonv2.Marshal(fields)
 	if err != nil {
 		t.Fatal(err)
 	}

station/config_window.go

@@ -0,0 +1,304 @@
+package station
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"strings"
+
+	"encoding/json/jsontext"
+	jsonv2 "encoding/json/v2"
+)
+
+// Cancel discards the Config window. It reports whether the app should quit
+// because no config has loaded successfully.
+func (s *Station) Cancel() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.loaded {
+		return true
+	}
+	s.configOpen = false
+	s.configErr = ""
+	s.publish()
+	return false
+}
+
+// OpenConfig re-reads the config file into the form. The live session is kept
+// when the re-read fails.
+func (s *Station) OpenConfig() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.configOpen {
+		return
+	}
+	if s.buttonHeld || s.spaceHeld {
+		s.openBlocked = "Release push-to-talk"
+		s.publish()
+		return
+	}
+	s.openBlocked = ""
+	form, detail, ok := readForm(s.path)
+	s.configOpen = true
+	s.form = form
+	if ok {
+		s.configErr = ""
+	} else {
+		s.configErr = detail
+	}
+	s.publish()
+}
+
+// Save validates form, writes the config file, and closes the Config window.
+// An invalid form or a write error leaves the window open and the session unchanged.
+func (s *Station) Save(form ConfigForm) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	next, stored, err := validateForm(s.path, form)
+	if err != nil {
+		s.keepForm(form, err.Error())
+		return err
+	}
+	if err := writeForm(s.path, stored); err != nil {
+		msg := fmt.Errorf("the file could not be written: %w", err).Error()
+		s.keepForm(form, msg)
+		return errors.New(msg)
+	}
+	prev := s.cfg
+	wasLoaded := s.loaded
+	s.cfg = next
+	s.form = stored
+	s.loaded = true
+	s.configErr = ""
+	s.configOpen = false
+	s.logPath = next.logPath
+	s.logNotice = next.logNotice
+	reconnect := wasLoaded && connectionChanged(prev, next)
+	if next.certFatal != "" {
+		s.fatal = next.certFatal
+		s.closeLogLocked()
+		if next.enableLogging {
+			s.openLog()
+		}
+		if wasLoaded {
+			s.kickReconnect()
+		}
+	} else if reconnect || !wasLoaded {
+		if !wasLoaded || s.fatal == prev.certFatal {
+			s.fatal = ""
+		}
+		s.closeLogLocked()
+		if next.enableLogging {
+			s.openLog()
+		}
+		if reconnect {
+			s.kickReconnect()
+		}
+	} else {
+		s.applyLogging(prev, next)
+	}
+	s.publish()
+	return nil
+}
+
+func (s *Station) kickReconnect() {
+	s.epoch++
+	s.kick = true
+	if s.cancelDial != nil {
+		s.cancelDial()
+	}
+	if s.conn != nil {
+		// Close unblocks the session read so Run can dial again.
+		_ = s.conn.Close()
+	}
+	select {
+	case s.apply <- struct{}{}:
+	default:
+	}
+}
+
+func (s *Station) drainApply() {
+	select {
+	case <-s.apply:
+	default:
+	}
+}
+
+func (s *Station) applyLogging(prev, next loaded) {
+	if prev.enableLogging == next.enableLogging && prev.logPath == next.logPath && prev.logNotice == next.logNotice {
+		return
+	}
+	s.closeLogLocked()
+	s.logNotice = next.logNotice
+	s.logPath = next.logPath
+	if next.enableLogging && next.logNotice == "" {
+		s.openLog()
+	}
+}
+
+func connectionChanged(prev, next loaded) bool {
+	return prev.host != next.host || prev.port != next.port || prev.callsign != next.callsign ||
+		prev.authKey != next.authKey || prev.talkGroup != next.talkGroup || prev.protocolMajor != next.protocolMajor ||
+		prev.certificateDir != next.certificateDir
+}
+
+func readForm(path string) (ConfigForm, string, bool) {
+	body, err := os.ReadFile(path)
+	if err != nil {
+		form, ferr := templateForm()
+		if ferr != nil {
+			form = ConfigForm{Protocol: "v2", CertificateDir: "./funknetz"}
+		}
+		return form, fmt.Errorf("the file could not be read: %w", err).Error(), false
+	}
+	out, err := parseConfig(path, body, false)
+	if err != nil {
+		return out.form, err.Error(), false
+	}
+	if !out.loaded {
+		msg := out.detail
+		if msg == "" {
+			msg = "the file could not be read"
+		}
+		return out.form, msg, false
+	}
+	return out.form, "", true
+}
+
+func (s *Station) keepForm(form ConfigForm, msg string) {
+	s.form = form
+	s.configErr = msg
+	s.configOpen = true
+	s.publish()
+}
+
+func validateForm(configPath string, form ConfigForm) (loaded, ConfigForm, error) {
+	shape, err := shapeFromForm(form)
+	if err != nil {
+		return loaded{}, form, err
+	}
+	cfg, err := parseOperational(shape)
+	if err != nil {
+		return loaded{}, form, err
+	}
+	cfg = applyCertificate(cfg, shape, configPath)
+	cfg = applyLog(cfg, shape)
+	stored := ConfigForm{
+		Host:           cfg.host,
+		Port:           cfg.port,
+		Callsign:       cfg.callsign,
+		AuthKey:        cfg.authKey,
+		TalkGroup:      cfg.talkGroup,
+		Protocol:       protocolName(cfg.protocolMajor),
+		CertificateDir: strings.TrimSpace(form.CertificateDir),
+		EnableLogging:  form.EnableLogging,
+		LogFile:        form.LogFile,
+	}
+	return cfg, stored, nil
+}
+
+func shapeFromForm(form ConfigForm) (fileShape, error) {
+	host, err := jsonValue(form.Host)
+	if err != nil {
+		return fileShape{}, err
+	}
+	port, err := jsonValue(form.Port)
+	if err != nil {
+		return fileShape{}, err
+	}
+	call, err := jsonValue(form.Callsign)
+	if err != nil {
+		return fileShape{}, err
+	}
+	key, err := jsonValue(form.AuthKey)
+	if err != nil {
+		return fileShape{}, err
+	}
+	tg, err := jsonValue(form.TalkGroup)
+	if err != nil {
+		return fileShape{}, err
+	}
+	protocol, err := jsonValue(form.Protocol)
+	if err != nil {
+		return fileShape{}, err
+	}
+	dir, err := jsonValue(form.CertificateDir)
+	if err != nil {
+		return fileShape{}, err
+	}
+	en, err := jsonValue(form.EnableLogging)
+	if err != nil {
+		return fileShape{}, err
+	}
+	logFile, err := jsonValue(form.LogFile)
+	if err != nil {
+		return fileShape{}, err
+	}
+	return fileShape{
+		Host:           host,
+		Port:           port,
+		Callsign:       call,
+		AuthKey:        key,
+		TalkGroup:      tg,
+		Protocol:       protocol,
+		CertificateDir: dir,
+		EnableLogging:  en,
+		LogFile:        logFile,
+	}, nil
+}
+
+func jsonValue(v any) (jsontext.Value, error) {
+	raw, err := jsonv2.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	return jsontext.Value(raw), nil
+}
+
+func writeForm(path string, form ConfigForm) error {
+	body, err := jsonv2.Marshal(templateFile{
+		Host:           form.Host,
+		Port:           form.Port,
+		Callsign:       form.Callsign,
+		AuthKey:        form.AuthKey,
+		TalkGroup:      form.TalkGroup,
+		Protocol:       form.Protocol,
+		CertificateDir: form.CertificateDir,
+		EnableLogging:  form.EnableLogging,
+		LogFile:        form.LogFile,
+	})
+	if err != nil {
+		return err
+	}
+	body = append(body, '\n')
+	info, err := os.Stat(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return createExclusive(path, body)
+	}
+	if err != nil {
+		return err
+	}
+	return rewriteBytes(path, body, info.Mode().Perm())
+}
+
+func createExclusive(path string, body []byte) error {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return err
+	}
+	_, werr := f.Write(body)
+	cerr := f.Close()
+	if werr != nil || cerr != nil {
+		os.Remove(path)
+		if werr != nil {
+			return werr
+		}
+		return cerr
+	}
+	if err := os.Chmod(path, 0o600); err != nil {
+		os.Remove(path)
+		return err
+	}
+	return nil
+}

station/config_window_test.go

@@ -0,0 +1,508 @@
+package station_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.neitzel.de/konrad/funknetz/station"
+)
+
+func TestOpenConfigRereadsTheFile(t *testing.T) {
+	path := writeConfigFile(t, fullConfig("127.0.0.1", 5308, "DL1ABC", "key", 20, "/tmp/funknetz.log"))
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	edited := fullConfig("127.0.0.1", 5308, "DL1ABD", "key", 21, "/tmp/funknetz.log")
+	if err := os.WriteFile(path, []byte(edited), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	st.OpenConfig()
+	cfg := st.Config()
+	if !cfg.Open || cfg.Error != "" || cfg.Form.Callsign != "DL1ABD" || cfg.Form.TalkGroup != 21 {
+		t.Fatalf("Config = %+v, want the hand-edited callsign and talk group", cfg)
+	}
+	if st.State().Callsign != "DL1ABC" || st.State().TalkGroup != 20 {
+		t.Fatalf("State = %+v, want the session to keep the loaded config", st.State())
+	}
+}
+
+func TestFailedRereadKeepsTheSession(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	if err := os.WriteFile(in.path, []byte("{"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	in.st.OpenConfig()
+	cfg := in.st.Config()
+	if !cfg.Open || !strings.Contains(cfg.Error, "the file could not be read") {
+		t.Fatalf("Config = %+v, want an open window and a read error", cfg)
+	}
+	got := in.st.State()
+	if got.Connection != "Connected" || got.Callsign != "DL1ABC" || got.TalkGroup != 20 {
+		t.Fatalf("State = %+v, want the live session kept", got)
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCancelAfterLoadLeavesFileAndSession(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	before, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	in.st.OpenConfig()
+	outside := []byte(fullConfig("127.0.0.1", in.refl.port, "DL1ABD", "other", 21, "/tmp/funknetz.log"))
+	if err := os.WriteFile(in.path, outside, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if in.st.Cancel() {
+		t.Fatal("Cancel() quit after a loaded config")
+	}
+	if in.st.State().ConfigOpen || in.st.State().Connection != "Connected" || in.st.State().Callsign != "DL1ABC" {
+		t.Fatalf("State = %+v, want the window closed and the session kept", in.st.State())
+	}
+	got, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(outside) {
+		t.Fatalf("file = %s, want the outside edit left in place", got)
+	}
+	if string(before) == string(got) {
+		t.Fatal("file did not change, so the test did not prove Cancel left it alone")
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSaveRewritesAndReconnects(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	if err := os.Chmod(in.path, 0o640); err != nil {
+		t.Fatal(err)
+	}
+	in.st.OpenConfig()
+	form := in.st.Config().Form
+	form.TalkGroup = 21
+	if err := in.st.Save(form); err != nil {
+		t.Fatal(err)
+	}
+	if in.st.Config().Open {
+		t.Fatal("Config window stayed open")
+	}
+	info, err := os.Stat(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := info.Mode().Perm(), os.FileMode(0o640); got != want {
+		t.Fatalf("mode = %o, want %o", got, want)
+	}
+	body, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(body), `"talkGroup":21`) || !strings.HasSuffix(string(body), "\n") {
+		t.Fatalf("file = %s, want talk group 21 and a trailing newline", body)
+	}
+	assertKeyOrder(t, body)
+
+	in.refl.accept(t)
+	expectVersion(t, in.refl, 2, 0)
+	challenge := make([]byte, 20)
+	for i := range challenge {
+		challenge[i] = byte(i + 1)
+	}
+	in.refl.writeFrame(t, 10, appendBytes(nil, challenge))
+	typ, _ := in.refl.readFrame(t)
+	if typ != 11 {
+		t.Fatalf("auth type %d, want 11", typ)
+	}
+	in.refl.writeFrame(t, 12, nil)
+	in.refl.writeFrame(t, 100, serverInfo(7, []string{"db0abc"}, []string{"OPUS"}))
+	typ, _ = in.refl.readFrame(t)
+	if typ != 111 {
+		t.Fatalf("type %d, want software identity", typ)
+	}
+	typ, tgBody := in.refl.readFrame(t)
+	if typ != 106 {
+		t.Fatalf("type %d, want select talk group", typ)
+	}
+	gotTG, _ := takeU32(t, tgBody)
+	if gotTG != 21 {
+		t.Fatalf("talk group %d, want 21", gotTG)
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 2*time.Second)
+	defer cancel()
+	state, err := in.st.Wait(ctx, func(s station.State) bool { return s.Connection == "Connected" && s.TalkGroup == 21 })
+	if err != nil {
+		t.Fatal(err)
+	}
+	if state.Callsign != "DL1ABC" {
+		t.Fatalf("Callsign = %q, want DL1ABC", state.Callsign)
+	}
+}
+
+func TestInvalidSaveLeavesTheSession(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	before, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	in.st.OpenConfig()
+	form := in.st.Config().Form
+	form.Host = ""
+	err = in.st.Save(form)
+	if err == nil || err.Error() != "host is empty" {
+		t.Fatalf("Save() error = %v, want host is empty", err)
+	}
+	got, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(before) {
+		t.Fatalf("file = %s, want it unchanged", got)
+	}
+	state := in.st.State()
+	if !state.ConfigOpen || state.Connection != "Connected" || state.Callsign != "DL1ABC" || state.Detail != "host is empty" {
+		t.Fatalf("State = %+v, want the window open, the session up, and the host error", state)
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestPushToTalkIsOffWhileConfigIsOpen(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	in.st.OpenConfig()
+	in.st.HoldButton()
+	if in.st.State().Transmitting || in.st.State().Connection != "Connected" {
+		t.Fatalf("State = %+v, want listening with push-to-talk off", in.st.State())
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestConfigStaysClosedWhilePushToTalkIsHeld(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	in.st.HoldButton()
+	if !in.st.State().Transmitting {
+		t.Fatal("Transmitting = false, want the button held")
+	}
+	in.st.OpenConfig()
+	state := in.st.State()
+	if state.ConfigOpen || state.Detail != "Release push-to-talk" || !state.Transmitting {
+		t.Fatalf("State = %+v, want no Config window and a push-to-talk notice", state)
+	}
+	in.st.ReleaseButton()
+	if in.st.State().Detail == "Release push-to-talk" || in.st.State().Transmitting {
+		t.Fatalf("State = %+v, want the notice cleared after release", in.st.State())
+	}
+}
+
+func TestCertificateProblemStaysOnTheStation(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "funknetz.json")
+	body := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"key\",\"talkGroup\":20,\"certificateDir\":\"\",\"enableLogging\":false,\"logFile\":\"/tmp/funknetz.log\"}\n")
+	if err := os.WriteFile(path, body, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	got := st.State()
+	if got.ConfigOpen || got.NeedsConfig || got.Detail != "certificateDir is empty" || got.Connection != "Disconnected" {
+		t.Fatalf("State = %+v, want the station window with the certificate detail", got)
+	}
+	if st.Cancel() {
+		t.Fatal("Cancel() quit after a certificate-directory problem")
+	}
+}
+
+func TestOpenConfigDoesNotRewriteAHandEdit(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "funknetz.json")
+	body := []byte(fullConfig("127.0.0.1", 5308, "DL1ABC", "key", 20, filepath.Join(dir, "funknetz.log")))
+	if err := os.WriteFile(path, body, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	edited := []byte("{\"host\":\"127.0.0.1\",\"port\":5308,\"callsign\":\"DL1ABC\",\"authKey\":\"key\",\"talkGroup\":20,\"enableLogging\":false,\"logFile\":\"" + filepath.Join(dir, "funknetz.log") + "\"}\n")
+	if err := os.WriteFile(path, edited, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	st.OpenConfig()
+	if st.Cancel() {
+		t.Fatal("Cancel() quit")
+	}
+	got, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(edited) {
+		t.Fatalf("file = %s, want the hand-edit left unchanged", got)
+	}
+	if st.State().Callsign != "DL1ABC" || st.State().ConfigOpen {
+		t.Fatalf("State = %+v, want the loaded session and a closed Config window", st.State())
+	}
+}
+
+func TestSaveEmptyCertificateDirDoesNotConnect(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	port := ln.Addr().(*net.TCPAddr).Port
+	path := filepath.Join(t.TempDir(), "funknetz.json")
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	err = st.Save(station.ConfigForm{
+		Host:           "127.0.0.1",
+		Port:           port,
+		Callsign:       "DL1ABC",
+		AuthKey:        "key",
+		TalkGroup:      20,
+		CertificateDir: "",
+		LogFile:        "/tmp/funknetz.log",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := st.State()
+	if got.ConfigOpen || got.Detail != "certificateDir is empty" || got.Connection != "Disconnected" {
+		t.Fatalf("State = %+v, want the window closed and the certificate detail", got)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Fatalf("mode = %o, want 600", info.Mode().Perm())
+	}
+	ln.(*net.TCPListener).SetDeadline(time.Now().Add(200 * time.Millisecond))
+	if conn, err := ln.Accept(); err == nil {
+		conn.Close()
+		t.Fatal("opened a socket")
+	}
+}
+
+func TestLoggingOnlySaveKeepsTheSession(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	logPath := filepath.Join(t.TempDir(), "station.log")
+	in.st.OpenConfig()
+	form := in.st.Config().Form
+	form.EnableLogging = true
+	form.LogFile = logPath
+	if err := in.st.Save(form); err != nil {
+		t.Fatal(err)
+	}
+	if in.st.Config().Open {
+		t.Fatal("Config window stayed open")
+	}
+	state := in.st.State()
+	if state.Connection != "Connected" || state.TalkGroup != 20 || state.Callsign != "DL1ABC" {
+		t.Fatalf("State = %+v, want the session kept", state)
+	}
+	if _, err := os.Stat(logPath); err != nil {
+		t.Fatalf("log file: %v", err)
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoggingSaveDoesNotClearAFatalStop(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	port := ln.Addr().(*net.TCPAddr).Port
+	dir := t.TempDir()
+	path := writeConfigFile(t, fullConfig("127.0.0.1", port, "DL1ABC", "key", 20, filepath.Join(dir, "funknetz.log")))
+	st, err := station.New(station.Options{ConfigPath: path})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(st.Close)
+	st.Fail("could not open the audio device")
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+
+	st.OpenConfig()
+	form := st.Config().Form
+	form.EnableLogging = true
+	form.LogFile = filepath.Join(dir, "station.log")
+	if err := st.Save(form); err != nil {
+		t.Fatal(err)
+	}
+	if st.State().Detail != "could not open the audio device" || st.State().Connection != "Disconnected" {
+		t.Fatalf("State = %+v, want the fatal stop kept", st.State())
+	}
+	ln.(*net.TCPListener).SetDeadline(time.Now().Add(200 * time.Millisecond))
+	if conn, err := ln.Accept(); err == nil {
+		conn.Close()
+		t.Fatal("opened a socket")
+	}
+}
+
+func TestUnchangedSaveDoesNotReconnect(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	in.st.OpenConfig()
+	form := in.st.Config().Form
+	if err := in.st.Save(form); err != nil {
+		t.Fatal(err)
+	}
+	if in.st.Config().Open || in.st.State().Connection != "Connected" {
+		t.Fatalf("State = %+v, Config open = %v, want the window closed and the session kept", in.st.State(), in.st.Config().Open)
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSaveWriteFailureKeepsTheSession(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	before, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := filepath.Dir(in.path)
+	if err := os.Chmod(dir, 0o555); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		// Restore the directory so the test temp dir can be removed.
+		_ = os.Chmod(dir, 0o755)
+	})
+	in.st.OpenConfig()
+	form := in.st.Config().Form
+	form.TalkGroup = 21
+	err = in.st.Save(form)
+	if err == nil || !strings.Contains(err.Error(), "the file could not be written") {
+		t.Fatalf("Save() error = %v, want a write failure", err)
+	}
+	state := in.st.State()
+	if !state.ConfigOpen || state.Connection != "Connected" || state.TalkGroup != 20 || !strings.Contains(state.Detail, "the file could not be written") {
+		t.Fatalf("State = %+v, want the window open, the session kept, and the write error", state)
+	}
+	if err := os.Chmod(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	got, err := os.ReadFile(in.path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(before) {
+		t.Fatalf("file = %s, want it unchanged", got)
+	}
+	if err := connStillOpen(in.refl.conn()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestEachConnectionFieldReconnects(t *testing.T) {
+	tests := []struct {
+		name string
+		edit func(*station.ConfigForm, int)
+	}{
+		{name: "host", edit: func(f *station.ConfigForm, _ int) { f.Host = "localhost" }},
+		{name: "callsign", edit: func(f *station.ConfigForm, _ int) { f.Callsign = "DL1ABD" }},
+		{name: "authKey", edit: func(f *station.ConfigForm, _ int) { f.AuthKey = "other-key" }},
+		{name: "protocol", edit: func(f *station.ConfigForm, _ int) { f.Protocol = "v3" }},
+		{name: "certificateDir", edit: func(f *station.ConfigForm, _ int) { f.CertificateDir = "./radios" }},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+			in.st.OpenConfig()
+			form := in.st.Config().Form
+			tt.edit(&form, in.refl.port)
+			if err := in.st.Save(form); err != nil {
+				t.Fatal(err)
+			}
+			if in.st.Config().Open {
+				t.Fatal("Config window stayed open")
+			}
+			old := in.refl.conn()
+			in.refl.accept(t)
+			if err := connStillOpen(old); err == nil {
+				t.Fatal("old session stayed open")
+			}
+		})
+	}
+
+	t.Run("port", func(t *testing.T) {
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer ln.Close()
+		in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+		in.st.OpenConfig()
+		form := in.st.Config().Form
+		form.Port = ln.Addr().(*net.TCPAddr).Port
+		if err := in.st.Save(form); err != nil {
+			t.Fatal(err)
+		}
+		old := in.refl.conn()
+		ln.(*net.TCPListener).SetDeadline(time.Now().Add(2 * time.Second))
+		conn, err := ln.Accept()
+		if err != nil {
+			t.Fatal(err)
+		}
+		conn.Close()
+		if err := connStillOpen(old); err == nil {
+			t.Fatal("old session stayed open")
+		}
+	})
+}
+
+func fullConfig(host string, port int, callsign, authKey string, talkGroup int, logFile string) string {
+	return "{\"host\":\"" + host + "\",\"port\":" + strconv.Itoa(port) + ",\"callsign\":\"" + callsign + "\",\"authKey\":\"" + authKey + "\",\"talkGroup\":" + strconv.Itoa(talkGroup) + ",\"protocol\":\"v2\",\"certificateDir\":\"./funknetz\",\"enableLogging\":false,\"logFile\":\"" + logFile + "\"}\n"
+}
+
+func connStillOpen(conn net.Conn) error {
+	if err := conn.SetReadDeadline(time.Now().Add(200 * time.Millisecond)); err != nil {
+		return err
+	}
+	var hdr [4]byte
+	_, err := io.ReadFull(conn, hdr[:])
+	if err == nil {
+		return nil
+	}
+	if ne, ok := errors.AsType[net.Error](err); ok && ne.Timeout() {
+		return nil
+	}
+	return err
+}

station/lab_reflector_test.go

@@ -2,9 +2,11 @@ package station_test
 
 import (
 	"context"
+	"errors"
 	"net"
 	"os"
 	"strconv"
+	"syscall"
 	"testing"
 	"time"
 
@@ -30,6 +32,9 @@ func TestConnectsToLabReflector(t *testing.T) {
 		t.Skipf("lab reflector not listening on %s: %v", addr, err)
 	}
 	conn.Close()
+	if !labUDPReachable() {
+		t.Skipf("lab UDP port %s is not reachable", addr)
+	}
 
 	path := writeConfigFile(t, configJSON(t, labHost, labPort, labCallsign, labAuthKey, labTalkGroup))
 	st, err := station.New(station.Options{ConfigPath: path})
@@ -39,7 +44,10 @@ func TestConnectsToLabReflector(t *testing.T) {
 
 	ctx, cancel := context.WithTimeout(t.Context(), 15*time.Second)
 	defer cancel()
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 
 	state, err := st.Wait(ctx, func(s station.State) bool {
 		return s.Connection == "Connected"
@@ -54,3 +62,20 @@ func TestConnectsToLabReflector(t *testing.T) {
 		t.Fatalf("talkGroup = %d, want %d", state.TalkGroup, labTalkGroup)
 	}
 }
+
+func labUDPReachable() bool {
+	peer := &net.UDPAddr{IP: net.ParseIP(labHost), Port: labPort}
+	conn, err := net.DialUDP("udp", nil, peer)
+	if err != nil {
+		return false
+	}
+	defer conn.Close()
+	_, _ = conn.Write([]byte{0})
+	_ = conn.SetReadDeadline(time.Now().Add(200 * time.Millisecond))
+	_, err = conn.Read(make([]byte, 1))
+	if err == nil {
+		return true
+	}
+	var op *net.OpError
+	return !errors.As(err, &op) || !errors.Is(op.Err, syscall.ECONNREFUSED)
+}

station/log.go

@@ -93,6 +93,10 @@ func (s *Station) noteDownLocked(now time.Time, dial bool) {
 }
 
 func (s *Station) endFatal(msg string, log bool) {
+	s.endFatalCause(msg, nil, log)
+}
+
+func (s *Station) endFatalCause(msg string, cause error, log bool) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if s.fatal != "" {
@@ -107,7 +111,11 @@ func (s *Station) endFatal(msg string, log bool) {
 	if log {
 		s.up = false
 		s.outage = true
-		s.writeLog(now, oneLine(msg))
+		line := oneLine(msg)
+		if cause != nil {
+			line += ": " + oneLine(cause.Error())
+		}
+		s.writeLog(now, line)
 	}
 	s.publish()
 }

station/log_test.go

@@ -131,7 +131,10 @@ func TestFirstDialFailureIsLoggedOnce(t *testing.T) {
 	}
 	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 
 	want := "2026-10-03T12:00:00Z disconnected\n"
 	deadline := time.Now().Add(2 * time.Second)
@@ -160,7 +163,10 @@ func TestReflectorErrorsAreOneLogLine(t *testing.T) {
 	}
 	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 	refl.accept(t)
 	refl.readFrame(t)
 	refl.writeFrame(t, 13, appendStr(nil, "bad\nline"))

station/protocol.go

@@ -4,26 +4,47 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
+	"regexp"
+	"strconv"
 )
 
 const (
 	tcpHeartbeat     = 1
 	tcpProtoVer      = 5
+	tcpProtoDown     = 6
 	tcpAuthChallenge = 10
 	tcpAuthResponse  = 11
 	tcpAuthOK        = 12
 	tcpError         = 13
+	tcpStartEncReq   = 14
+	tcpStartEnc      = 15
+	tcpCsrReq        = 16
+	tcpCsr           = 17
+	tcpClientCert    = 18
+	tcpCAInfo        = 19
+	tcpCABundleReq   = 20
+	tcpCABundle      = 21
 	tcpServerInfo    = 100
+	tcpNodeList      = 101
+	tcpNodeJoined    = 102
+	tcpNodeLeft      = 103
 	tcpTalkerStart   = 104
 	tcpTalkerStop    = 105
 	tcpSelectTG      = 106
+	tcpRequestQSY    = 109
+	tcpStateEvent    = 110
 	tcpNodeInfo      = 111
+	tcpSignal        = 112
+	tcpTxStatus      = 113
+	tcpStartUDPEnc   = 114
 
-	udpHeartbeat = 1
+	udpHeartbeat  = 1
-	udpAudio     = 101
+	udpAudio      = 101
-	udpFlush     = 102
+	udpFlush      = 102
+	udpAllFlushed = 103
 
-	maxFrame = 32768
+	maxFrame     = 32768
+	maxPreauth20 = 64
 )
 
 type frame struct {
@@ -45,12 +66,16 @@ func writeFrame(w io.Writer, typ uint16, body []byte) error {
 }
 
 func readFrame(r io.Reader) (frame, error) {
+	return readFrameMax(r, maxFrame)
+}
+
+func readFrameMax(r io.Reader, max uint32) (frame, error) {
 	var hdr [4]byte
 	if _, err := io.ReadFull(r, hdr[:]); err != nil {
 		return frame{}, err
 	}
 	n := binary.BigEndian.Uint32(hdr[:])
-	if n < 2 || n > maxFrame {
+	if n < 2 || n > max {
 		return frame{}, fmt.Errorf("frame length %d", n)
 	}
 	buf := make([]byte, n)
@@ -149,6 +174,79 @@ func parseServerInfo(b []byte) (uint16, []string, error) {
 	return id, codecs, nil
 }
 
+func versionWire(major, minor uint16) []byte {
+	return appendU16(appendU16(nil, major), minor)
+}
+
+func parseVersion(b []byte) (uint16, uint16, error) {
+	major, rest, err := parseU16(b)
+	if err != nil {
+		return 0, 0, err
+	}
+	minor, rest, err := parseU16(rest)
+	if err != nil {
+		return 0, 0, err
+	}
+	if len(rest) != 0 {
+		return 0, 0, io.ErrUnexpectedEOF
+	}
+	return major, minor, nil
+}
+
+var atMostVersion = regexp.MustCompile(`^Unsupported protocol version \d+\.\d+\. May be at most (\d+)\.(\d+)\.$`)
+var atLeastVersion = regexp.MustCompile(`^Unsupported protocol version \d+\.\d+\. Must be at least (\d+)\.(\d+)\.$`)
+
+// wantsOther reports that the reflector refused the announced major and named the other one.
+func wantsOther(announced uint16, msg string) bool {
+	if announced >= 3 {
+		return fallback20(msg)
+	}
+	return fallback30(msg)
+}
+
+// acceptsOther reports that a downgrade names the protocol this station did not announce.
+func acceptsOther(announced, gotMajor, gotMinor uint16) bool {
+	if announced >= 3 {
+		return gotMajor == 2
+	}
+	return gotMajor == 3 && gotMinor == 0
+}
+
+// fallback20 reports that the reflector's maximum is at least 2.0 and below 3.0.
+func fallback20(msg string) bool {
+	m := atMostVersion.FindStringSubmatch(msg)
+	if m == nil {
+		return false
+	}
+	major, err1 := strconv.Atoi(m[1])
+	minor, err2 := strconv.Atoi(m[2])
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	return !versionBelow(major, minor, 2, 0) && versionBelow(major, minor, 3, 0)
+}
+
+// fallback30 reports that the reflector's minimum is exactly 3.0.
+func fallback30(msg string) bool {
+	m := atLeastVersion.FindStringSubmatch(msg)
+	if m == nil {
+		return false
+	}
+	major, err1 := strconv.Atoi(m[1])
+	minor, err2 := strconv.Atoi(m[2])
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	return major == 3 && minor == 0
+}
+
+func versionBelow(major, minor, maj, min int) bool {
+	if major != maj {
+		return major < maj
+	}
+	return minor < min
+}
+
 func hasOPUS(codecs []string) bool {
 	for _, c := range codecs {
 		if c == "OPUS" {

station/protocol2_test.go

@@ -0,0 +1,244 @@
+package station_test
+
+import (
+	"context"
+	"encoding/binary"
+	"testing"
+	"time"
+
+	"gitea.neitzel.de/konrad/funknetz/internal/opus"
+	"gitea.neitzel.de/konrad/funknetz/station"
+)
+
+func TestProtocol2DropsASequenceTooFarBehind(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	enc, err := opus.NewEncoder()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer enc.Close()
+	pkt, err := enc.Encode(make([]int16, opus.FrameSamples))
+	if err != nil {
+		t.Fatal(err)
+	}
+	in.refl.writeUDP(t, 101, 7, 32768, appendBytes(nil, pkt))
+	in.refl.writeUDP(t, 101, 7, 4, appendBytes(nil, pkt))
+	if _, err := in.st.WaitPlayback(t.Context(), opus.FrameSamples); err != nil {
+		t.Fatal(err)
+	}
+	if extra := in.st.TakePlayback(); len(extra) != 0 {
+		t.Fatalf("played %d extra samples from the old sequence", len(extra))
+	}
+}
+
+func TestProtocol2FlushCompletesOnce(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	in.st.HoldButton()
+	in.st.ReleaseButton()
+	typ, id, _, body := in.refl.readUDP(t)
+	if typ != 102 || id != 7 || len(body) != 0 {
+		t.Fatalf("flush type %d id %d len %d", typ, id, len(body))
+	}
+	in.refl.writeUDP(t, 103, 7, 0, nil)
+	in.clock.BlockUntilWaiting(t)
+	in.clock.Advance(3 * time.Second)
+	if pkt, _, ok := tryUDP(in.refl); ok {
+		t.Fatalf("sent %d bytes after flush-complete", len(pkt))
+	}
+	if got := in.st.State(); got.Connection != "Connected" || got.Protocol != "2.0" {
+		t.Fatalf("State = %+v", got)
+	}
+}
+
+func TestProtocol2FlushTimesOutWithoutASecondFlush(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	in.st.HoldButton()
+	in.st.ReleaseButton()
+	typ, _, _, _ := in.refl.readUDP(t)
+	if typ != 102 {
+		t.Fatalf("type %d, want flush", typ)
+	}
+	in.clock.BlockUntilWaiting(t)
+	in.clock.Advance(3 * time.Second)
+	if pkt, _, ok := tryUDP(in.refl); ok {
+		t.Fatalf("sent %d bytes when flush-complete did not arrive", len(pkt))
+	}
+}
+
+func TestSilenceFreesPushToTalkAndKeepsTheTalker(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	enc, err := opus.NewEncoder()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer enc.Close()
+	pkt, err := enc.Encode(make([]int16, opus.FrameSamples))
+	if err != nil {
+		t.Fatal(err)
+	}
+	in.refl.writeUDP(t, 101, 7, 0, appendBytes(nil, pkt))
+	if _, err := in.st.WaitPlayback(t.Context(), opus.FrameSamples); err != nil {
+		t.Fatal(err)
+	}
+	in.refl.writeFrame(t, 104, appendStr(appendU32(nil, 20), "DB0XYZ"))
+	if _, err := in.st.Wait(t.Context(), func(s station.State) bool { return s.Talker == "DB0XYZ" }); err != nil {
+		t.Fatal(err)
+	}
+	in.clock.BlockUntilWaiting(t)
+	in.clock.Advance(3 * time.Second)
+	in.st.HoldButton()
+	in.st.WriteMicrophone(make([]int16, opus.FrameSamples))
+	if _, _, ok := tryUDP(in.refl); ok {
+		t.Fatal("push-to-talk sent audio at exactly 3 seconds")
+	}
+	in.st.ReleaseButton()
+	in.clock.BlockUntilWaiting(t)
+	gen := in.clock.Generation()
+	in.clock.Advance(time.Second)
+	waitClock(t, in.clock, gen)
+	if got := in.st.State(); got.Talker != "DB0XYZ" || got.Transmitting {
+		t.Fatalf("State = %+v, want the talker kept and the button free", got)
+	}
+	in.st.HoldButton()
+	if !in.st.State().Transmitting {
+		t.Fatal("push-to-talk stayed blocked after the gap")
+	}
+	in.st.WriteMicrophone(make([]int16, opus.FrameSamples))
+	utyp, id, _, _ := in.refl.readUDP(t)
+	if utyp != 101 || id != 7 {
+		t.Fatalf("audio type %d id %d", utyp, id)
+	}
+}
+
+func TestUDPLimitRunsBeforeAnyDatagram(t *testing.T) {
+	refl := newReflector(t)
+	path := writeConfigFile(t, configJSON(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20))
+	clock := newFakeClock()
+	st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	refl.accept(t)
+	expectVersion(t, refl, 2, 0)
+	for step := 0; step < 6; step++ {
+		clock.BlockUntilWaiting(t)
+		clock.Advance(10 * time.Second)
+		if st.State().Connection == "Disconnected" && step < 5 {
+			t.Fatalf("dropped on step %d", step)
+		}
+		replyTCP(t, refl)
+	}
+	if _, err := st.Wait(t.Context(), func(s station.State) bool { return s.Connection == "Disconnected" }); err != nil {
+		t.Fatal(err)
+	}
+	if got := st.State().Detail; got != "udp receive timeout" {
+		t.Fatalf("Detail = %q, want udp receive timeout", got)
+	}
+	clock.BlockUntilWaiting(t)
+	clock.Advance(2 * time.Second)
+	refl.accept(t)
+	typ, body := refl.readFrame(t)
+	if typ != 5 || !versionIs(body, 2, 0) {
+		t.Fatalf("retry type %d body %v, want 2.0", typ, body)
+	}
+}
+
+func TestOversizedFrameBeforeAuthRetries(t *testing.T) {
+	refl := newReflector(t)
+	path := writeConfigFile(t, configJSON(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20))
+	clock := newFakeClock()
+	st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	refl.accept(t)
+	expectVersion(t, refl, 2, 0)
+	payload := make([]byte, 65)
+	var hdr [4]byte
+	binary.BigEndian.PutUint32(hdr[:], 65)
+	if _, err := refl.tcp.Write(append(hdr[:], payload...)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.Wait(ctx, func(s station.State) bool { return s.Connection == "Disconnected" }); err != nil {
+		t.Fatal(err)
+	}
+	clock.BlockUntilWaiting(t)
+	clock.Advance(2 * time.Second)
+	refl.accept(t)
+	typ, body := refl.readFrame(t)
+	if typ != 5 || !versionIs(body, 2, 0) {
+		t.Fatalf("retry type %d body %v, want 2.0", typ, body)
+	}
+}
+
+func TestApplicationMessageBeforeLoginRetries(t *testing.T) {
+	refl := newReflector(t)
+	path := writeConfigFile(t, configJSON(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20))
+	clock := newFakeClock()
+	st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	refl.accept(t)
+	expectVersion(t, refl, 2, 0)
+	refl.writeFrame(t, 100, serverInfo(1, nil, []string{"OPUS"}))
+	got, err := st.Wait(t.Context(), func(s station.State) bool { return s.Detail == "Protocol error" })
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Connection != "Disconnected" || got.Protocol != "" {
+		t.Fatalf("State = %+v", got)
+	}
+	clock.BlockUntilWaiting(t)
+	clock.Advance(2 * time.Second)
+	refl.accept(t)
+	typ, body := refl.readFrame(t)
+	if typ != 5 || !versionIs(body, 2, 0) {
+		t.Fatalf("retry type %d body %v, want 2.0", typ, body)
+	}
+	if st.State().Detail != "Protocol error" {
+		t.Fatalf("Detail = %q, want the reason kept", st.State().Detail)
+	}
+}
+
+func TestIgnoredNoticesDoNotChangeTheStation(t *testing.T) {
+	in := login(t, "DL1ABC", "key", 20, 7, []string{"OPUS"})
+	in.refl.writeFrame(t, 101, appendStr(appendU16(nil, 1), "DB0XYZ"))
+	in.refl.writeFrame(t, 102, appendStr(nil, "DB0XYZ"))
+	in.refl.writeFrame(t, 103, appendStr(nil, "DB0XYZ"))
+	in.refl.writeFrame(t, 109, appendU32(nil, 99))
+	body := appendStr(nil, "src")
+	body = appendStr(body, "name")
+	body = appendStr(body, "msg")
+	in.refl.writeFrame(t, 110, body)
+	in.refl.writeFrame(t, 112, append(appendU16(nil, 1), []byte{1, 40, 1}...))
+	in.refl.writeFrame(t, 113, append(appendU16(nil, 1), []byte{1, 1}...))
+	in.clock.BlockUntilWaiting(t)
+	in.clock.Advance(10 * time.Second)
+	typ, _ := in.refl.readFrame(t)
+	if typ != 1 {
+		t.Fatalf("TCP type %d, want a heartbeat", typ)
+	}
+	got := in.st.State()
+	if got.Connection != "Connected" || got.Protocol != "2.0" || got.TalkGroup != 20 || got.Talker != "" {
+		t.Fatalf("State = %+v", got)
+	}
+}

station/protocol_select_test.go

@@ -0,0 +1,214 @@
+package station_test
+
+import (
+	"context"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"gitea.neitzel.de/konrad/funknetz/station"
+)
+
+func TestVersionErrorFallsBackWhenTheMaximumIs2(t *testing.T) {
+	for _, msg := range []string{
+		"Unsupported protocol version 3.0. May be at most 2.0.",
+		"Unsupported protocol version 3.0. May be at most 2.5.",
+	} {
+		t.Run(msg, func(t *testing.T) {
+			refl := newReflector(t)
+			path := writeConfigFile(t, configJSONProtocol(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20, "v3"))
+			clock := newFakeClock()
+			st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+			if err != nil {
+				t.Fatal(err)
+			}
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			go func() {
+				// Run's error is observed through State, which is the station seam.
+				_ = st.Run(ctx)
+			}()
+			refl.accept(t)
+			typ, body := refl.readFrame(t)
+			if typ != 5 || !versionIs(body, 3, 0) {
+				t.Fatalf("type %d body %v", typ, body)
+			}
+			refl.writeFrame(t, 13, appendStr(nil, msg))
+			refl.accept(t)
+			typ, body = refl.readFrame(t)
+			if typ != 5 || !versionIs(body, 2, 0) {
+				t.Fatalf("fallback type %d body %v", typ, body)
+			}
+		})
+	}
+}
+
+func TestVersionErrorBelow2Stops(t *testing.T) {
+	for _, msg := range []string{
+		"Unsupported protocol version 3.0. May be at most 1.9.",
+		"Unsupported protocol version 3.0. May be at most 0.6.",
+	} {
+		t.Run(msg, func(t *testing.T) {
+			refl := newReflector(t)
+			path := writeConfigFile(t, configJSONProtocol(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20, "v3"))
+			clock := newFakeClock()
+			st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+			if err != nil {
+				t.Fatal(err)
+			}
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			go func() {
+				// Run's error is observed through State, which is the station seam.
+				_ = st.Run(ctx)
+			}()
+			refl.accept(t)
+			refl.readFrame(t)
+			refl.writeFrame(t, 13, appendStr(nil, msg))
+			got, err := st.Wait(ctx, func(s station.State) bool { return s.Detail == msg })
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got.Connection != "Disconnected" || got.Protocol != "" {
+				t.Fatalf("State = %+v", got)
+			}
+			clock.Advance(2 * time.Second)
+			refl.ln.(*net.TCPListener).SetDeadline(time.Now().Add(150 * time.Millisecond))
+			if conn, err := refl.ln.Accept(); err == nil {
+				conn.Close()
+				t.Fatal("retried")
+			}
+		})
+	}
+}
+
+func TestDowngradeOtherThan2Stops(t *testing.T) {
+	for _, tc := range []struct {
+		major, minor uint16
+		want         string
+	}{
+		{1, 0, "Unsupported protocol version 1.0"},
+		{4, 2, "Unsupported protocol version 4.2"},
+	} {
+		t.Run(tc.want, func(t *testing.T) {
+			refl := newReflector(t)
+			path := writeConfigFile(t, configJSONProtocol(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20, "v3"))
+			clock := newFakeClock()
+			st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+			if err != nil {
+				t.Fatal(err)
+			}
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			go func() {
+				// Run's error is observed through State, which is the station seam.
+				_ = st.Run(ctx)
+			}()
+			refl.accept(t)
+			refl.readFrame(t)
+			refl.writeFrame(t, 6, versionWire(tc.major, tc.minor))
+			got, err := st.Wait(ctx, func(s station.State) bool { return s.Detail == tc.want })
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got.Protocol != "" || got.Connection != "Disconnected" {
+				t.Fatalf("State = %+v", got)
+			}
+			clock.Advance(2 * time.Second)
+			refl.ln.(*net.TCPListener).SetDeadline(time.Now().Add(150 * time.Millisecond))
+			if conn, err := refl.ln.Accept(); err == nil {
+				conn.Close()
+				t.Fatal("retried")
+			}
+		})
+	}
+}
+
+func TestDowngradeDoesNotCreateTheCertificateDirectory(t *testing.T) {
+	refl := newReflector(t)
+	dir := t.TempDir()
+	path := dir + "/funknetz.json"
+	body := configWithDir(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20, "./funknetz", "")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	clock := newFakeClock()
+	st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	refl.accept(t)
+	declineTo2(t, refl)
+	if _, err := os.Stat(dir + "/funknetz"); err == nil {
+		t.Fatal("created the certificate directory on a 2.0 fallback")
+	}
+}
+
+func TestConfiguredV2FallsBackTo3ThenReturns(t *testing.T) {
+	refl := newReflector(t)
+	path := writeConfigFile(t, configJSON(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20))
+	clock := newFakeClock()
+	st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	refl.accept(t)
+	expectVersion(t, refl, 2, 0)
+	refl.writeFrame(t, 13, appendStr(nil, "Unsupported protocol version 2.0. Must be at least 3.0."))
+	refl.accept(t)
+	expectVersion(t, refl, 3, 0)
+	refl.tcp.Close()
+	if _, err := st.Wait(ctx, func(s station.State) bool { return s.Connection == "Disconnected" }); err != nil {
+		t.Fatal(err)
+	}
+	clock.BlockUntilWaiting(t)
+	clock.Advance(2 * time.Second)
+	refl.accept(t)
+	expectVersion(t, refl, 2, 0)
+}
+
+func TestV2DoesNotFallBackAbove3(t *testing.T) {
+	refl := newReflector(t)
+	path := writeConfigFile(t, configJSON(t, "127.0.0.1", refl.port, "DL1ABC", "key", 20))
+	clock := newFakeClock()
+	st, err := station.New(station.Options{ConfigPath: path, Clock: clock})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
+	refl.accept(t)
+	expectVersion(t, refl, 2, 0)
+	msg := "Unsupported protocol version 2.0. Must be at least 3.1."
+	refl.writeFrame(t, 13, appendStr(nil, msg))
+	got, err := st.Wait(ctx, func(s station.State) bool { return s.Detail == msg })
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Connection != "Disconnected" || got.Protocol != "" {
+		t.Fatalf("State = %+v", got)
+	}
+	clock.Advance(2 * time.Second)
+	refl.ln.(*net.TCPListener).SetDeadline(time.Now().Add(150 * time.Millisecond))
+	if conn, err := refl.ln.Accept(); err == nil {
+		conn.Close()
+		t.Fatal("retried")
+	}
+}

station/reflector_test.go

@@ -1,6 +1,7 @@
 package station_test
 
 import (
+	"crypto/tls"
 	"encoding/binary"
 	"encoding/json"
 	"io"
@@ -133,21 +134,39 @@ type reflector struct {
 	ln   net.Listener
 	udp  *net.UDPConn
 	tcp  net.Conn
+	tls  *tls.Conn
 	peer *net.UDPAddr
 	port int
 }
 
+func (r *reflector) conn() net.Conn {
+	if r.tls != nil {
+		return r.tls
+	}
+	return r.tcp
+}
+
 func newReflector(t *testing.T) *reflector {
 	t.Helper()
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	var ln net.Listener
-	if err != nil {
+	var udp *net.UDPConn
-		t.Fatal(err)
+	var port int
-	}
+	for range 8 {
-	port := ln.Addr().(*net.TCPAddr).Port
+		var err error
-	udp, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: port})
+		ln, err = net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
+		if err != nil {
+			t.Fatal(err)
+		}
+		port = ln.Addr().(*net.TCPAddr).Port
+		udp, err = net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: port})
+		if err == nil {
+			break
+		}
 		ln.Close()
-		t.Fatal(err)
+		ln = nil
+	}
+	if udp == nil {
+		t.Fatal("udp port stayed in use")
 	}
 	t.Cleanup(func() {
 		if ln != nil {
@@ -166,16 +185,18 @@ func (r *reflector) accept(t *testing.T) {
 		t.Fatal(err)
 	}
 	r.tcp = conn
+	r.tls = nil
 	t.Cleanup(func() { conn.Close() })
 }
 
 func (r *reflector) readFrame(t *testing.T) (uint16, []byte) {
 	t.Helper()
-	if err := r.tcp.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+	conn := r.conn()
+	if err := conn.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
 		t.Fatal(err)
 	}
 	var hdr [4]byte
-	if _, err := io.ReadFull(r.tcp, hdr[:]); err != nil {
+	if _, err := io.ReadFull(conn, hdr[:]); err != nil {
 		t.Fatal(err)
 	}
 	n := binary.BigEndian.Uint32(hdr[:])
@@ -183,7 +204,7 @@ func (r *reflector) readFrame(t *testing.T) (uint16, []byte) {
 		t.Fatalf("frame length %d", n)
 	}
 	buf := make([]byte, n)
-	if _, err := io.ReadFull(r.tcp, buf); err != nil {
+	if _, err := io.ReadFull(conn, buf); err != nil {
 		t.Fatal(err)
 	}
 	if len(buf) < 2 {
@@ -199,14 +220,30 @@ func (r *reflector) writeFrame(t *testing.T, typ uint16, body []byte) {
 	copy(payload[2:], body)
 	var hdr [4]byte
 	binary.BigEndian.PutUint32(hdr[:], uint32(len(payload)))
-	if err := r.tcp.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {
+	conn := r.conn()
+	if err := conn.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := r.tcp.Write(append(hdr[:], payload...)); err != nil {
+	if _, err := conn.Write(append(hdr[:], payload...)); err != nil {
 		t.Fatal(err)
 	}
 }
 
+func (r *reflector) handshake(t *testing.T, cfg *tls.Config) error {
+	t.Helper()
+	r.tls = tls.Server(r.tcp, cfg)
+	if err := r.tls.SetDeadline(time.Now().Add(2 * time.Second)); err != nil {
+		return err
+	}
+	err := r.tls.Handshake()
+	// Clearing the deadline is best-effort; the handshake error is the result.
+	_ = r.tls.SetDeadline(time.Time{})
+	if err != nil {
+		r.tls = nil
+	}
+	return err
+}
+
 func (r *reflector) readUDP(t *testing.T) (typ, id, seq uint16, body []byte) {
 	t.Helper()
 	if err := r.udp.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
@@ -228,6 +265,33 @@ func (r *reflector) readUDP(t *testing.T) (typ, id, seq uint16, body []byte) {
 	return typ, id, seq, body
 }
 
+func (r *reflector) readRawUDP(t *testing.T) []byte {
+	t.Helper()
+	if err := r.udp.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 2048)
+	n, addr, err := r.udp.ReadFromUDP(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.peer = addr
+	return append([]byte(nil), buf[:n]...)
+}
+
+func (r *reflector) writeRawUDP(t *testing.T, pkt []byte) {
+	t.Helper()
+	if r.peer == nil {
+		t.Fatal("no udp peer")
+	}
+	if err := r.udp.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := r.udp.WriteToUDP(pkt, r.peer); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func (r *reflector) writeUDP(t *testing.T, typ, id, seq uint16, body []byte) {
 	t.Helper()
 	if r.peer == nil {
@@ -294,8 +358,11 @@ func requireSoftwareIdentity(t *testing.T, body []byte) {
 	if err := json.Unmarshal([]byte(raw), &got); err != nil {
 		t.Fatalf("software identity %q: %v", raw, err)
 	}
-	if len(got) != 2 || got["sw"] != station.SoftwareName || got["swVer"] != station.SoftwareVersion {
+	if len(got) != 3 || got["sw"] != station.SoftwareName || got["swVer"] != station.SoftwareVersion || got["projVer"] != station.SoftwareVersion {
-		t.Fatalf("software identity = %#v, want sw %q and swVer %q only", got, station.SoftwareName, station.SoftwareVersion)
+		t.Fatalf("software identity = %#v, want sw, swVer, and projVer %q", got, station.SoftwareName)
+	}
+	if _, ok := got["machineArch"]; ok {
+		t.Fatal("protocol 2.0 node information includes machineArch")
 	}
 }
 

station/session.go

@@ -4,11 +4,16 @@ import (
 	"context"
 	"crypto/hmac"
 	"crypto/sha1"
+	"crypto/tls"
 	"encoding/binary"
 	"errors"
+	"fmt"
+	"io"
 	"net"
 	"strconv"
+	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"gitea.neitzel.de/konrad/funknetz/internal/opus"
@@ -16,27 +21,58 @@ import (
 
 const noOpus = "The reflector did not offer OPUS."
 
-var errStopped = errors.New("session stopped")
+var (
+	errStopped   = errors.New("session stopped")
+	errFallback  = errors.New("fallback")
+	errReconnect = errors.New("reconnect")
+)
 
 // Run keeps the reflector session until ctx is canceled.
 func (s *Station) Run(ctx context.Context) error {
 	defer s.Close()
+	var major uint16
+	holdMajor := false
 	for {
 		if ctx.Err() != nil {
 			return nil
 		}
-		s.mu.Lock()
+		if !holdMajor {
-		if s.fatal != "" {
+			major = s.configuredMajor()
-			s.mu.Unlock()
-			<-ctx.Done()
-			return nil
 		}
+		s.mu.Lock()
+		if s.fatal != "" || !s.loaded {
+			s.mu.Unlock()
+			select {
+			case <-ctx.Done():
+				return nil
+			case <-s.wake:
+			}
+			continue
+		}
+		s.kick = false
 		s.state.Connection = "Connecting"
 		s.publish()
 		host, port := s.cfg.host, s.cfg.port
+		epoch := s.epoch
+		dialCtx, dialCancel := context.WithCancel(ctx)
+		s.cancelDial = dialCancel
 		s.mu.Unlock()
 
-		conn, err := dialStation(ctx, host, port)
+		conn, err := dialStation(dialCtx, host, port)
+		dialCancel()
+		s.mu.Lock()
+		s.cancelDial = nil
+		stale := s.epoch != epoch
+		s.mu.Unlock()
+		if stale {
+			holdMajor = false
+			if conn != nil {
+				// This dial used the config from before Save.
+				_ = conn.Close()
+			}
+			s.drainApply()
+			continue
+		}
 		if err != nil {
 			if ctx.Err() != nil {
 				return nil
@@ -50,12 +86,42 @@ func (s *Station) Run(ctx context.Context) error {
 			continue
 		}
 
-		err = s.session(ctx, conn)
+		err = s.session(ctx, conn, major, epoch, major == s.configuredMajor())
 		conn.Close()
+		fallback := errors.Is(err, errFallback)
+		reconnect := errors.Is(err, errReconnect)
 		s.mu.Lock()
 		s.closeUDP()
+		if s.conn == conn {
+			s.conn = nil
+		}
 		s.mic = nil
 		s.play = nil
+		s.audioHeard = false
+		s.flushWaiting = false
+		kicked := s.kick
+		if kicked {
+			s.kick = false
+			s.drainApply()
+			if s.up {
+				s.noteDownLocked(s.clock.Now(), false)
+			}
+		}
+		if fallback || reconnect || kicked {
+			s.roomBusy = false
+			s.remoteTalker = ""
+			s.mu.Unlock()
+			if ctx.Err() != nil {
+				return nil
+			}
+			if fallback {
+				major = otherMajor(major)
+				holdMajor = true
+			} else {
+				holdMajor = false
+			}
+			continue
+		}
 		if s.fatal == "" {
 			s.noteDownLocked(s.clock.Now(), false)
 		} else {
@@ -63,14 +129,11 @@ func (s *Station) Run(ctx context.Context) error {
 		}
 		fatal := s.fatal != ""
 		s.mu.Unlock()
+		holdMajor = false
 		if ctx.Err() != nil {
 			return nil
 		}
-		if fatal {
+		if fatal || errors.Is(err, errStopped) {
-			<-ctx.Done()
-			return nil
-		}
-		if err != nil && errors.Is(err, errStopped) {
 			<-ctx.Done()
 			return nil
 		}
@@ -94,10 +157,182 @@ func (s *Station) wait(ctx context.Context, d time.Duration) bool {
 		return false
 	case <-timer.C():
 		return true
+	case <-s.apply:
+		return true
 	}
 }
 
-func (s *Station) session(ctx context.Context, conn net.Conn) error {
+type framed struct {
+	conn      net.Conn
+	mu        sync.Mutex
+	w         io.Writer
+	frames    chan frame
+	errs      chan error
+	upgrade   chan *tls.Config
+	handshake chan error
+	max       atomic.Uint32
+}
+
+// exchange is the state one TCP session's frame handlers share.
+type exchange struct {
+	ph       phase
+	authed   bool
+	client   tls.Certificate
+	haveCert bool
+	done     chan struct{}
+	udpCh    chan []byte
+	udpErr   chan error
+	udpReady bool
+	lastTCP  time.Time
+	limit    time.Time
+}
+
+func newFramed(conn net.Conn, max uint32) *framed {
+	f := &framed{
+		conn:      conn,
+		w:         conn,
+		frames:    make(chan frame, 8),
+		errs:      make(chan error, 1),
+		upgrade:   make(chan *tls.Config, 1),
+		handshake: make(chan error, 1),
+	}
+	f.max.Store(max)
+	return f
+}
+
+func (f *framed) Write(p []byte) (int, error) {
+	f.mu.Lock()
+	w := f.w
+	f.mu.Unlock()
+	return w.Write(p)
+}
+
+func (f *framed) setMax(n uint32) { f.max.Store(n) }
+
+var errTLSTimeout = errors.New("tls timeout")
+
+func (s *Station) startTLS(ctx context.Context, f *framed, cfg *tls.Config, until time.Time) error {
+	select {
+	case f.upgrade <- cfg:
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+	if err := f.conn.SetReadDeadline(time.Now()); err != nil {
+		return err
+	}
+	wait := until.Sub(s.clock.Now())
+	if wait < 0 {
+		wait = 0
+	}
+	timer := s.clock.NewTimer(wait)
+	defer timer.Stop()
+	select {
+	case err := <-f.handshake:
+		return err
+	case <-ctx.Done():
+		if err := f.conn.SetDeadline(time.Now()); err != nil {
+			return err
+		}
+		return ctx.Err()
+	case <-timer.C():
+		if err := f.conn.SetDeadline(time.Now()); err != nil {
+			return err
+		}
+		select {
+		case <-f.handshake:
+		case <-ctx.Done():
+		}
+		return errTLSTimeout
+	}
+}
+
+func (f *framed) read(done <-chan struct{}) {
+	src := io.Reader(f.conn)
+	for {
+		fr, err := readFrameMax(src, f.max.Load())
+		if err != nil {
+			if ne, ok := errors.AsType[net.Error](err); ok && ne.Timeout() {
+				select {
+				case cfg := <-f.upgrade:
+					if derr := f.conn.SetReadDeadline(time.Time{}); derr != nil {
+						f.handshake <- derr
+						return
+					}
+					tc := tls.Client(f.conn, cfg)
+					herr := tc.Handshake()
+					if herr != nil {
+						f.handshake <- herr
+						return
+					}
+					f.mu.Lock()
+					f.w = tc
+					f.mu.Unlock()
+					src = tc
+					f.handshake <- nil
+					continue
+				case <-done:
+					return
+				}
+			}
+			select {
+			case f.errs <- err:
+			case <-done:
+			}
+			return
+		}
+		select {
+		case f.frames <- fr:
+		case <-done:
+			return
+		}
+	}
+}
+
+type phase int
+
+const (
+	phCA phase = iota
+	phBundle
+	phStart
+	phIdent
+	phServer
+	phUDP
+	phBeat
+	phRun
+	phChallenge
+)
+
+func (s *Station) configuredMajor() uint16 {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.cfg.protocolMajor == 3 {
+		return 3
+	}
+	return 2
+}
+
+func otherMajor(major uint16) uint16 {
+	if major == 2 {
+		return 3
+	}
+	return 2
+}
+
+func (s *Station) session(ctx context.Context, conn net.Conn, major uint16, epoch uint64, allowFallback bool) error {
+	s.mu.Lock()
+	s.conn = conn
+	stale := s.epoch != epoch
+	s.mu.Unlock()
+	if stale {
+		return errReconnect
+	}
+	defer func() {
+		s.mu.Lock()
+		if s.conn == conn {
+			s.conn = nil
+		}
+		s.mu.Unlock()
+	}()
 	done := make(chan struct{})
 	var closeOnce sync.Once
 	closeConn := func() { closeOnce.Do(func() { conn.Close() }) }
@@ -110,38 +345,56 @@ func (s *Station) session(ctx context.Context, conn net.Conn) error {
 		}
 	}()
 
-	tcpCh := make(chan frame, 8)
+	frameMax := uint32(maxFrame)
-	tcpErr := make(chan error, 1)
+	ex := &exchange{ph: phCA, done: done, lastTCP: s.clock.Now()}
-	go readTCP(conn, tcpCh, tcpErr, done)
+	label := "3.0"
+	if major < 3 {
+		frameMax = maxPreauth20
+		ex.ph = phChallenge
+		label = "2.0"
+	}
+	wire := newFramed(conn, frameMax)
+	go wire.read(done)
+	s.mu.Lock()
+	s.protocol = label
+	s.rxSeq = 0
+	s.rxCounter = 0
+	s.txCounter = 1
+	s.secure = false
+	s.udpWait = false
+	s.seq = 0
+	s.ivPrefix = nil
+	s.udpKey = nil
+	s.mu.Unlock()
 
-	if err := writeFrame(conn, tcpProtoVer, []byte{0, 2, 0, 0}); err != nil {
+	if err := writeFrame(wire, tcpProtoVer, versionWire(major, 0)); err != nil {
 		return err
 	}
-	lastTCP := s.clock.Now()
+	now := ex.lastTCP
-	tcpRx := lastTCP.Add(15 * time.Second)
+	tcpRx := now.Add(15 * time.Second)
-
+	udpRx := now.Add(60 * time.Second)
-	var udpCh chan []byte
-	var udpErr chan error
-	udpReady := false
-	var udpRx time.Time
 
 	for {
 		s.mu.Lock()
 		lastUDP := s.lastUDPSend
+		silence, silenceOK := s.nextSilence()
 		s.mu.Unlock()
 
-		next := lastTCP.Add(10 * time.Second)
+		next := ex.lastTCP.Add(10 * time.Second)
-		if tcpRx.Before(next) {
+		if t := tcpRx; t.Before(next) {
-			next = tcpRx
+			next = t
 		}
-		if udpReady {
+		if t := udpRx; t.Before(next) {
-			if u := lastUDP.Add(15 * time.Second); u.Before(next) {
+			next = t
-				next = u
+		}
-			}
+		if ex.udpReady {
-			if udpRx.Before(next) {
+			if t := lastUDP.Add(15 * time.Second); t.Before(next) {
-				next = udpRx
+				next = t
 			}
 		}
+		if silenceOK && silence.Before(next) {
+			next = silence
+		}
 		wait := next.Sub(s.clock.Now())
 		if wait < 0 {
 			wait = 0
@@ -150,9 +403,9 @@ func (s *Station) session(ctx context.Context, conn net.Conn) error {
 
 		var udpRecv <-chan []byte
 		var udpFail <-chan error
-		if udpCh != nil {
+		if ex.udpCh != nil {
-			udpRecv = udpCh
+			udpRecv = ex.udpCh
-			udpFail = udpErr
+			udpFail = ex.udpErr
 		}
 
 		var reason string
@@ -162,13 +415,13 @@ func (s *Station) session(ctx context.Context, conn net.Conn) error {
 		case <-ctx.Done():
 			timer.Stop()
 			return ctx.Err()
-		case err := <-tcpErr:
+		case err := <-wire.errs:
 			timer.Stop()
 			return err
 		case err := <-udpFail:
 			timer.Stop()
 			return err
-		case tcpf = <-tcpCh:
+		case tcpf = <-wire.frames:
 			timer.Stop()
 			reason = "tcp"
 		case udpp = <-udpRecv:
@@ -176,7 +429,7 @@ func (s *Station) session(ctx context.Context, conn net.Conn) error {
 			reason = "udp"
 		case <-timer.C():
 			select {
-			case tcpf = <-tcpCh:
+			case tcpf = <-wire.frames:
 				reason = "tcp"
 			default:
 				select {
@@ -188,36 +441,47 @@ func (s *Station) session(ctx context.Context, conn net.Conn) error {
 			}
 		}
 
-		now := s.clock.Now()
+		now = s.clock.Now()
 		switch reason {
 		case "tcp":
 			tcpRx = now.Add(15 * time.Second)
-			if err := s.onTCP(conn, tcpf, done, &udpCh, &udpErr, &udpReady, &udpRx, &lastTCP); err != nil {
+			ex.limit = tcpRx
+			if udpRx.Before(ex.limit) {
+				ex.limit = udpRx
+			}
+			err := s.onFrame(ctx, wire, major, tcpf, ex, allowFallback)
+			if err != nil {
 				return err
 			}
 		case "udp":
-			s.mu.Lock()
+			if err := s.onUDP(wire, udpp, ex, &udpRx, now); err != nil {
-			if clientIDOf(udpp) == s.clientID {
+				return err
-				udpRx = now.Add(60 * time.Second)
-				s.onDatagram(udpp)
 			}
-			s.mu.Unlock()
 		default:
+			s.mu.Lock()
+			s.onClock(now)
+			s.mu.Unlock()
 			if !now.Before(tcpRx) {
-				return errors.New("tcp receive timeout")
+				return s.retry("tcp receive timeout", nil)
 			}
-			if udpReady && !now.Before(udpRx) {
+			if !now.Before(udpRx) {
-				return errors.New("udp receive timeout")
+				return s.retry("udp receive timeout", nil)
 			}
-			if !now.Before(lastTCP.Add(10 * time.Second)) {
+			if !now.Before(ex.lastTCP.Add(10 * time.Second)) {
-				if err := writeFrame(conn, tcpHeartbeat, nil); err != nil {
+				if err := writeFrame(wire, tcpHeartbeat, nil); err != nil {
 					return err
 				}
-				lastTCP = s.clock.Now()
+				ex.lastTCP = s.clock.Now()
 			}
 			s.mu.Lock()
-			if udpReady && s.udp != nil && !s.clock.Now().Before(s.lastUDPSend.Add(15*time.Second)) {
+			if ex.udpReady && s.udp != nil && !s.clock.Now().Before(s.lastUDPSend.Add(15*time.Second)) {
-				if err := s.sendUDP(udpHeartbeat, nil); err != nil {
+				var err error
+				if s.udpWait {
+					err = s.sendRegistration()
+				} else {
+					err = s.sendUDP(udpHeartbeat, nil)
+				}
+				if err != nil {
 					s.mu.Unlock()
 					return err
 				}
@@ -227,127 +491,172 @@ func (s *Station) session(ctx context.Context, conn net.Conn) error {
 	}
 }
 
-func readTCP(conn net.Conn, out chan<- frame, errc chan<- error, done <-chan struct{}) {
+func (s *Station) retry(detail string, cause error) error {
-	for {
+	s.mu.Lock()
-		f, err := readFrame(conn)
+	s.retryReason = detail
-		if err != nil {
+	s.mu.Unlock()
-			select {
+	text := strings.ToLower(detail)
-			case errc <- err:
+	if cause == nil {
-			case <-done:
+		return errors.New(text)
-			}
+	}
-			return
+	return fmt.Errorf("%s: %w", text, cause)
+}
+
+func (s *Station) nextSilence() (time.Time, bool) {
+	var next time.Time
+	ok := false
+	if s.audioHeard {
+		next = s.lastAudio.Add(3*time.Second + time.Nanosecond)
+		ok = true
+	}
+	if s.flushWaiting {
+		at := s.flushAt.Add(3 * time.Second)
+		if !ok || at.Before(next) {
+			next = at
+			ok = true
 		}
-		select {
+	}
-		case out <- f:
+	return next, ok
-		case <-done:
+}
-			return
+
+func (s *Station) onClock(now time.Time) {
+	if s.flushWaiting && !now.Before(s.flushAt.Add(3*time.Second)) {
+		s.flushWaiting = false
+	}
+	if s.audioHeard && now.After(s.lastAudio.Add(3*time.Second)) {
+		if s.dec != nil {
+			s.dec.Reset()
 		}
+		s.audioHeard = false
+		s.roomBusy = false
+		s.publish()
 	}
 }
 
-func readUDP(conn *net.UDPConn, out chan<- []byte, errc chan<- error, done <-chan struct{}) {
+func (s *Station) onFrame(ctx context.Context, wire *framed, major uint16, f frame, ex *exchange, allowFallback bool) error {
-	buf := make([]byte, 2048)
-	for {
-		n, err := conn.Read(buf)
-		if err != nil {
-			select {
-			case errc <- err:
-			case <-done:
-			}
-			return
-		}
-		pkt := append([]byte(nil), buf[:n]...)
-		select {
-		case out <- pkt:
-		case <-done:
-			return
-		}
-	}
-}
-
-func (s *Station) onTCP(conn net.Conn, f frame, done <-chan struct{}, udpCh *chan []byte, udpErr *chan error, udpReady *bool, udpRx *time.Time, lastTCP *time.Time) error {
 	switch f.typ {
-	case tcpHeartbeat, tcpAuthOK:
+	case tcpHeartbeat:
-		return nil
-	case tcpAuthChallenge:
-		chal, _, err := parseBlob(f.body)
-		if err != nil || len(chal) != 20 {
-			return errors.New("bad challenge")
-		}
-		mac := hmac.New(sha1.New, []byte(s.cfg.authKey))
-		mac.Write(chal)
-		body := appendString(nil, s.cfg.callsign)
-		body = appendBlob(body, mac.Sum(nil))
-		if err := writeFrame(conn, tcpAuthResponse, body); err != nil {
-			return err
-		}
-		*lastTCP = s.clock.Now()
 		return nil
 	case tcpError:
-		msg, _, err := parseString(f.body)
+		return s.onReflectorError(f.body, major, allowFallback)
-		if err != nil {
+	case tcpProtoDown:
-			msg = "could not be read"
+		return s.onDowngrade(f.body, major, allowFallback)
-		}
+	}
-		s.endFatal(msg, true)
+	if !ex.authed && f.typ >= 100 {
-		return errStopped
+		return s.retry("Protocol error", nil)
+	}
+	if major < 3 {
+		return s.onV2(wire, f, ex)
+	}
+	return s.onV3(ctx, wire, f, ex)
+}
+
+func (s *Station) onReflectorError(body []byte, major uint16, allowFallback bool) error {
+	msg, _, err := parseString(body)
+	if err != nil {
+		s.endFatalCause("could not be read", err, true)
+		return fmt.Errorf("could not be read: %w", err)
+	}
+	if allowFallback && wantsOther(major, msg) {
+		return errFallback
+	}
+	s.endFatal(msg, true)
+	return errStopped
+}
+
+func (s *Station) onDowngrade(body []byte, major uint16, allowFallback bool) error {
+	gotMajor, gotMinor, err := parseVersion(body)
+	if err != nil {
+		return err
+	}
+	if allowFallback && acceptsOther(major, gotMajor, gotMinor) {
+		return errFallback
+	}
+	s.endFatal("Unsupported protocol version "+strconvU(gotMajor)+"."+strconvU(gotMinor), true)
+	return errStopped
+}
+
+func strconvU(v uint16) string {
+	return strconv.FormatUint(uint64(v), 10)
+}
+
+func (s *Station) onV2(wire *framed, f frame, ex *exchange) error {
+	switch f.typ {
+	case tcpAuthOK:
+		ex.authed = true
+		ex.ph = phServer
+		wire.setMax(maxFrame)
+		return nil
+	case tcpAuthChallenge:
+		return s.answerChallenge(wire, f.body, ex)
 	case tcpServerInfo:
-		return s.onServerInfo(conn, f.body, done, udpCh, udpErr, udpReady, udpRx, lastTCP)
+		if ex.ph != phServer {
+			return s.retry("Protocol error", nil)
+		}
+		return s.finishV2(wire, f.body, ex)
 	case tcpTalkerStart:
 		s.onTalker(f.body, true)
 		return nil
 	case tcpTalkerStop:
 		s.onTalker(f.body, false)
 		return nil
+	case tcpNodeList, tcpNodeJoined, tcpNodeLeft, tcpRequestQSY, tcpStateEvent, tcpSignal, tcpTxStatus:
+		if err := unpackIgnored(f); err != nil {
+			return s.retry("Protocol error", err)
+		}
+		return nil
 	default:
 		return nil
 	}
 }
 
-func (s *Station) onServerInfo(conn net.Conn, body []byte, done <-chan struct{}, udpCh *chan []byte, udpErr *chan error, udpReady *bool, udpRx *time.Time, lastTCP *time.Time) error {
+func (s *Station) answerChallenge(w io.Writer, body []byte, ex *exchange) error {
-	id, codecs, err := parseServerInfo(body)
+	chal, _, err := parseBlob(body)
+	if err != nil {
+		return fmt.Errorf("bad challenge: %w", err)
+	}
+	if len(chal) != 20 {
+		return errors.New("bad challenge")
+	}
+	mac := hmac.New(sha1.New, []byte(s.cfg.authKey))
+	mac.Write(chal)
+	out := appendString(nil, s.cfg.callsign)
+	out = appendBlob(out, mac.Sum(nil))
+	if err := writeFrame(w, tcpAuthResponse, out); err != nil {
+		return err
+	}
+	ex.lastTCP = s.clock.Now()
+	return nil
+}
+
+func (s *Station) finishV2(wire *framed, body []byte, ex *exchange) error {
+	id, enc, dec, err := s.acceptServer(body)
 	if err != nil {
 		return err
 	}
-	if !hasOPUS(codecs) {
+	if enc == nil {
-		s.endFatal(noOpus, true)
 		return errStopped
 	}
-	enc, err := opus.NewEncoder()
-	if err != nil {
-		return err
-	}
-	dec, err := opus.NewDecoder()
-	if err != nil {
-		enc.Close()
-		return err
-	}
 	info, err := softwareIdentityBody()
 	if err != nil {
 		enc.Close()
 		dec.Close()
 		return err
 	}
-	if err := writeFrame(conn, tcpNodeInfo, info); err != nil {
+	if err := writeFrame(wire, tcpNodeInfo, info); err != nil {
 		enc.Close()
 		dec.Close()
 		return err
 	}
 	var tg [4]byte
 	binary.BigEndian.PutUint32(tg[:], uint32(s.cfg.talkGroup))
-	if err := writeFrame(conn, tcpSelectTG, tg[:]); err != nil {
+	if err := writeFrame(wire, tcpSelectTG, tg[:]); err != nil {
 		enc.Close()
 		dec.Close()
 		return err
 	}
-	*lastTCP = s.clock.Now()
+	ex.lastTCP = s.clock.Now()
-
+	udpConn, peer, err := dialAudio(wire.conn)
-	remote, ok := conn.RemoteAddr().(*net.TCPAddr)
-	if !ok {
-		enc.Close()
-		dec.Close()
-		return errors.New("tcp peer has no address")
-	}
-	udpConn, err := net.DialUDP("udp", nil, &net.UDPAddr{IP: remote.IP, Port: remote.Port})
 	if err != nil {
 		enc.Close()
 		dec.Close()
@@ -355,14 +664,16 @@ func (s *Station) onServerInfo(conn net.Conn, body []byte, done <-chan struct{},
 	}
 	ch := make(chan []byte, 32)
 	errc := make(chan error, 1)
-	go readUDP(udpConn, ch, errc, done)
+	go readUDP(udpConn, peer, ch, errc, ex.done)
-
 	s.mu.Lock()
 	s.clientID = id
+	s.udpPeer = peer
 	s.seq = 0
+	s.rxSeq = 0
 	s.udp = udpConn
 	s.enc = enc
 	s.dec = dec
+	s.secure = false
 	err = s.sendUDP(udpHeartbeat, nil)
 	if err != nil {
 		s.mu.Unlock()
@@ -378,14 +689,33 @@ func (s *Station) onServerInfo(conn net.Conn, body []byte, done <-chan struct{},
 	s.writeLog(s.clock.Now(), "connected")
 	s.publish()
 	s.mu.Unlock()
-
+	ex.udpCh = ch
-	*udpCh = ch
+	ex.udpErr = errc
-	*udpErr = errc
+	ex.udpReady = true
-	*udpReady = true
-	*udpRx = s.clock.Now().Add(60 * time.Second)
 	return nil
 }
 
+func (s *Station) acceptServer(body []byte) (uint16, *opus.Encoder, *opus.Decoder, error) {
+	id, codecs, err := parseServerInfo(body)
+	if err != nil {
+		return 0, nil, nil, err
+	}
+	if !hasOPUS(codecs) {
+		s.endFatal(noOpus, true)
+		return 0, nil, nil, errStopped
+	}
+	enc, err := opus.NewEncoder()
+	if err != nil {
+		return 0, nil, nil, err
+	}
+	dec, err := opus.NewDecoder()
+	if err != nil {
+		enc.Close()
+		return 0, nil, nil, err
+	}
+	return id, enc, dec, nil
+}
+
 func (s *Station) stop(msg string) { s.endFatal(msg, false) }
 
 // Fail stops retries and shows message until the operator quits.
@@ -425,69 +755,21 @@ func (s *Station) onTalker(body []byte, start bool) {
 	s.publish()
 }
 
-func (s *Station) onDatagram(pkt []byte) {
-	if len(pkt) < 6 {
-		return
-	}
-	typ := binary.BigEndian.Uint16(pkt[:2])
-	if typ != udpAudio || s.dec == nil {
-		return
-	}
-	if s.transmitting() {
-		return
-	}
-	packet, _, err := parseBlob(pkt[6:])
-	if err != nil {
-		return
-	}
-	pcm, err := s.dec.Decode(packet)
-	if err != nil {
-		return
-	}
-	s.play = append(s.play, pcm...)
-	s.roomBusy = true
-	s.publish()
-}
-
-func clientIDOf(pkt []byte) uint16 {
-	if len(pkt) < 6 {
-		return ^uint16(0)
-	}
-	return binary.BigEndian.Uint16(pkt[2:4])
-}
-
-func (s *Station) sendUDP(typ uint16, body []byte) error {
-	if s.udp == nil {
-		return errors.New("udp is down")
-	}
-	buf := make([]byte, 6+len(body))
-	binary.BigEndian.PutUint16(buf[0:2], typ)
-	binary.BigEndian.PutUint16(buf[2:4], s.clientID)
-	binary.BigEndian.PutUint16(buf[4:6], s.seq)
-	s.seq++
-	copy(buf[6:], body)
-	if _, err := s.udp.Write(buf); err != nil {
-		return err
-	}
-	s.lastUDPSend = s.clock.Now()
-	return nil
-}
-
 func (s *Station) endTransmit() {
 	if s.enc != nil && s.udp != nil && len(s.mic) > 0 {
 		frame := make([]int16, opus.FrameSamples)
 		copy(frame, s.mic)
 		s.mic = nil
 		if pkt, err := s.enc.Encode(frame); err == nil {
-			// A lost datagram ends the session when the receive timer expires.
 			_ = s.sendUDP(udpAudio, appendBlob(nil, pkt))
 		}
 	} else {
 		s.mic = nil
 	}
 	if s.udp != nil {
-		// A lost datagram ends the session when the receive timer expires.
 		_ = s.sendUDP(udpFlush, nil)
+		s.flushWaiting = true
+		s.flushAt = s.clock.Now()
 	}
 }
 
@@ -496,6 +778,7 @@ func (s *Station) closeUDP() {
 		s.udp.Close()
 		s.udp = nil
 	}
+	s.udpPeer = nil
 	if s.enc != nil {
 		s.enc.Close()
 		s.enc = nil
@@ -507,7 +790,7 @@ func (s *Station) closeUDP() {
 }
 
 func (s *Station) transmitting() bool {
-	if s.fatal != "" || s.state.Connection != "Connected" || s.roomBusy {
+	if s.configOpen || s.fatal != "" || s.state.Connection != "Connected" || s.roomBusy {
 		return false
 	}
 	return s.buttonHeld || s.spaceHeld
@@ -517,13 +800,15 @@ func (s *Station) publish() {
 	s.noteTransmitLocked()
 	s.state.Callsign = s.cfg.callsign
 	s.state.TalkGroup = s.cfg.talkGroup
+	s.state.NeedsConfig = !s.loaded
+	s.state.ConfigOpen = s.configOpen
 	if s.fatal != "" {
 		s.state.Connection = "Disconnected"
 		s.state.Detail = s.fatal
 		s.state.Talker = ""
 		s.state.Transmitting = false
+		s.state.Protocol = ""
 	} else {
-		s.state.Detail = "Idle"
 		tx := s.transmitting()
 		s.state.Transmitting = tx
 		if tx {
@@ -532,12 +817,73 @@ func (s *Station) publish() {
 		} else {
 			s.state.Talker = s.remoteTalker
 		}
-		if s.state.Talker == "" && s.logNotice != "" {
+		if s.state.Connection == "Connected" {
-			s.state.Detail = s.logNotice
+			s.state.Protocol = s.protocol
+			s.retryReason = ""
+			s.state.Detail = "Idle"
+			if s.state.Talker == "" && s.logNotice != "" {
+				s.state.Detail = s.logNotice
+			}
+		} else {
+			s.state.Protocol = ""
+			if s.retryReason != "" {
+				s.state.Detail = s.retryReason
+			} else if s.state.Talker == "" && s.logNotice != "" {
+				s.state.Detail = s.logNotice
+			} else {
+				s.state.Detail = "Idle"
+			}
 		}
 	}
+	if s.configOpen && s.configErr != "" {
+		s.state.Detail = s.configErr
+	} else if s.openBlocked != "" {
+		s.state.Detail = s.openBlocked
+	}
 	select {
 	case s.wake <- struct{}{}:
 	default:
 	}
 }
+
+func unpackIgnored(f frame) error {
+	switch f.typ {
+	case tcpNodeList:
+		_, _, err := parseStringList(f.body)
+		return err
+	case tcpNodeJoined, tcpNodeLeft:
+		_, _, err := parseString(f.body)
+		return err
+	case tcpRequestQSY:
+		_, _, err := parseU32(f.body)
+		return err
+	case tcpStateEvent:
+		_, rest, err := parseString(f.body)
+		if err != nil {
+			return err
+		}
+		_, rest, err = parseString(rest)
+		if err != nil {
+			return err
+		}
+		_, _, err = parseString(rest)
+		return err
+	case tcpSignal:
+		return unpackRecords(f.body, 3)
+	case tcpTxStatus:
+		return unpackRecords(f.body, 2)
+	default:
+		return nil
+	}
+}
+
+func unpackRecords(b []byte, size int) error {
+	n, rest, err := parseU16(b)
+	if err != nil {
+		return err
+	}
+	if len(rest) != int(n)*size {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}

station/session_test.go

@@ -21,19 +21,22 @@ func TestLoginAnnouncesProtocolAndJoinsTheTalkGroup(t *testing.T) {
 	}
 	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
-	go func() { _ = st.Run(ctx) }()
+	go func() {
+		// Run's error is observed through State, which is the station seam.
+		_ = st.Run(ctx)
+	}()
 
 	got, err := st.Wait(ctx, func(s station.State) bool { return s.Connection == "Connecting" })
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got.Callsign != "DL1ABC" || got.TalkGroup != 20 || got.Detail != "Idle" {
+	if got.Callsign != "DL1ABC" || got.TalkGroup != 20 || got.Detail != "Idle" || got.Protocol != "" {
-		t.Fatalf("State = %+v, want DL1ABC talk group 20 Idle", got)
+		t.Fatalf("State = %+v, want DL1ABC talk group 20 Idle and a blank protocol", got)
 	}
 
 	refl.accept(t)
 	typ, body := refl.readFrame(t)
-	if typ != 5 || len(body) != 4 || body[0] != 0 || body[1] != 2 || body[2] != 0 || body[3] != 0 {
+	if typ != 5 || !versionIs(body, 2, 0) {
 		t.Fatalf("first frame type %d body %v, want protocol 2.0", typ, body)
 	}
 
@@ -91,8 +94,8 @@ func TestLoginAnnouncesProtocolAndJoinsTheTalkGroup(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got.Detail != "Idle" || got.Talker != "" {
+	if got.Detail != "Idle" || got.Talker != "" || got.Protocol != "2.0" {
-		t.Fatalf("State = %+v, want Connected Idle", got)
+		t.Fatalf("State = %+v, want Connected Idle protocol 2.0", got)
 	}
 
 	// No other talk group: the next TCP message is a heartbeat, not a monitor set.

station/session_udp.go

@@ -0,0 +1,246 @@
+package station
+
+import (
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"time"
+)
+
+func (s *Station) finishV3UDP(conn net.Conn, ex *exchange) error {
+	udpConn, peer, err := dialAudio(conn)
+	if err != nil {
+		s.dropAudio()
+		return err
+	}
+	ch := make(chan []byte, 32)
+	errc := make(chan error, 1)
+	go readUDP(udpConn, peer, ch, errc, ex.done)
+	s.mu.Lock()
+	s.udp = udpConn
+	s.udpPeer = peer
+	s.udpWait = true
+	s.txCounter = 1
+	s.rxCounter = 0
+	err = s.sendRegistration()
+	s.mu.Unlock()
+	if err != nil {
+		s.dropAudio()
+		udpConn.Close()
+		return err
+	}
+	ex.udpCh = ch
+	ex.udpErr = errc
+	ex.udpReady = true
+	ex.ph = phBeat
+	return nil
+}
+
+func dialAudio(conn net.Conn) (*net.UDPConn, *net.UDPAddr, error) {
+	remote, ok := conn.RemoteAddr().(*net.TCPAddr)
+	if !ok {
+		return nil, nil, errors.New("tcp peer has no address")
+	}
+	local := &net.UDPAddr{Port: 0}
+	if tcpLocal, ok := conn.LocalAddr().(*net.TCPAddr); ok && tcpLocal.IP != nil {
+		local.IP = tcpLocal.IP
+	}
+	udpConn, err := net.ListenUDP("udp", local)
+	if err != nil {
+		return nil, nil, err
+	}
+	return udpConn, &net.UDPAddr{IP: append(net.IP(nil), remote.IP...), Port: remote.Port}, nil
+}
+
+func (s *Station) dropAudio() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.enc != nil {
+		s.enc.Close()
+		s.enc = nil
+	}
+	if s.dec != nil {
+		s.dec.Close()
+		s.dec = nil
+	}
+}
+
+func readUDP(conn *net.UDPConn, peer *net.UDPAddr, out chan<- []byte, errc chan<- error, done <-chan struct{}) {
+	buf := make([]byte, 2048)
+	for {
+		n, addr, err := conn.ReadFromUDP(buf)
+		if err != nil {
+			select {
+			case errc <- err:
+			case <-done:
+			}
+			return
+		}
+		if addr == nil || peer == nil || !addr.IP.Equal(peer.IP) || addr.Port != peer.Port {
+			continue
+		}
+		pkt := append([]byte(nil), buf[:n]...)
+		select {
+		case out <- pkt:
+		case <-done:
+			return
+		}
+	}
+}
+
+func (s *Station) onUDP(w io.Writer, pkt []byte, ex *exchange, udpRx *time.Time, now time.Time) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.secure {
+		plain, ok := s.openSecure(pkt)
+		if !ok {
+			return nil
+		}
+		*udpRx = now.Add(60 * time.Second)
+		if len(plain) < 2 {
+			return nil
+		}
+		typ := binary.BigEndian.Uint16(plain[:2])
+		body := plain[2:]
+		if s.udpWait {
+			if typ != udpHeartbeat {
+				return nil
+			}
+			s.udpWait = false
+			s.mu.Unlock()
+			var tg [4]byte
+			binary.BigEndian.PutUint32(tg[:], uint32(s.cfg.talkGroup))
+			err := writeFrame(w, tcpSelectTG, tg[:])
+			s.mu.Lock()
+			if err != nil {
+				return err
+			}
+			ex.lastTCP = s.clock.Now()
+			s.state.Connection = "Connected"
+			s.up = true
+			s.outage = false
+			s.noteTransmitLocked()
+			s.writeLog(s.clock.Now(), "connected")
+			s.publish()
+			ex.ph = phRun
+			return nil
+		}
+		s.onPlain(typ, body, now)
+		return nil
+	}
+	if !s.acceptV2(pkt) {
+		return nil
+	}
+	*udpRx = now.Add(60 * time.Second)
+	typ := binary.BigEndian.Uint16(pkt[:2])
+	s.onPlain(typ, pkt[6:], now)
+	return nil
+}
+
+func (s *Station) openSecure(pkt []byte) ([]byte, bool) {
+	if len(pkt) < 12 || s.udpKey == nil {
+		return nil, false
+	}
+	counter := binary.BigEndian.Uint32(pkt[:4])
+	if counter < s.rxCounter {
+		return nil, false
+	}
+	tag := pkt[4:12]
+	ct := pkt[12:]
+	plain, err := openDatagram(s.udpKey, s.ivPrefix, 0, counter, pkt[:4], tag, ct)
+	if err != nil {
+		return nil, false
+	}
+	s.rxCounter = counter + 1
+	return plain, true
+}
+
+func (s *Station) acceptV2(pkt []byte) bool {
+	if len(pkt) < 6 {
+		return false
+	}
+	if binary.BigEndian.Uint16(pkt[2:4]) != s.clientID {
+		return false
+	}
+	seq := binary.BigEndian.Uint16(pkt[4:6])
+	diff := seq - s.rxSeq
+	if diff > 32767 {
+		return false
+	}
+	s.rxSeq = seq + 1
+	return true
+}
+
+func (s *Station) onPlain(typ uint16, body []byte, now time.Time) {
+	switch typ {
+	case udpAllFlushed:
+		s.flushWaiting = false
+	case udpAudio:
+		if s.dec == nil || s.transmitting() {
+			return
+		}
+		packet, _, err := parseBlob(body)
+		if err != nil {
+			return
+		}
+		pcm, err := s.dec.Decode(packet)
+		if err != nil {
+			return
+		}
+		s.play = append(s.play, pcm...)
+		s.roomBusy = true
+		s.audioHeard = true
+		s.lastAudio = now
+		s.publish()
+	}
+}
+
+func (s *Station) sendRegistration() error {
+	return s.sendSecure(udpHeartbeat, nil, 0, true)
+}
+
+func (s *Station) sendUDP(typ uint16, body []byte) error {
+	if s.udp == nil {
+		return errors.New("udp is down")
+	}
+	if s.secure {
+		return s.sendSecure(typ, body, s.txCounter, false)
+	}
+	buf := make([]byte, 6+len(body))
+	binary.BigEndian.PutUint16(buf[0:2], typ)
+	binary.BigEndian.PutUint16(buf[2:4], s.clientID)
+	binary.BigEndian.PutUint16(buf[4:6], s.seq)
+	s.seq++
+	copy(buf[6:], body)
+	if _, err := s.udp.WriteToUDP(buf, s.udpPeer); err != nil {
+		return err
+	}
+	s.lastUDPSend = s.clock.Now()
+	return nil
+}
+
+func (s *Station) sendSecure(typ uint16, body []byte, counter uint32, reg bool) error {
+	plain := appendU16(nil, typ)
+	plain = append(plain, body...)
+	var aad []byte
+	id := s.clientID
+	if reg {
+		aad = registrationAAD(s.clientID)
+		counter = 0
+	} else {
+		aad = counterAAD(counter)
+	}
+	wire, err := sealDatagram(s.udpKey, s.ivPrefix, id, counter, aad, plain)
+	if err != nil {
+		return err
+	}
+	if _, err := s.udp.WriteToUDP(wire, s.udpPeer); err != nil {
+		return err
+	}
+	s.lastUDPSend = s.clock.Now()
+	if !reg {
+		s.txCounter = counter + 1
+	}
+	return nil
+}

station/session_v3.go

@@ -0,0 +1,259 @@
+package station
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+func (s *Station) onV3(ctx context.Context, wire *framed, f frame, ex *exchange) error {
+	switch f.typ {
+	case tcpCAInfo:
+		if ex.ph != phCA {
+			return nil
+		}
+		return s.onCAInfo(wire, f.body, ex)
+	case tcpCABundle:
+		if ex.ph != phBundle {
+			return nil
+		}
+		return s.onCABundle(wire, f.body, ex)
+	case tcpStartEnc:
+		if ex.ph != phStart {
+			return nil
+		}
+		return s.onStartEncryption(ctx, wire, ex)
+	case tcpCsrReq:
+		return s.sendCSR(wire, ex)
+	case tcpAuthChallenge:
+		return s.answerChallenge(wire, f.body, ex)
+	case tcpAuthOK:
+		ex.authed = true
+		ex.ph = phServer
+		newer, err := csrNewerThanCert(s.cfg.certificateDir)
+		if err != nil {
+			s.endFatalCause("Cannot create "+s.cfg.certificateDir, err, true)
+			return errStopped
+		}
+		if newer {
+			if err := s.sendCSR(wire, ex); err != nil {
+				return err
+			}
+		}
+		return nil
+	case tcpClientCert:
+		return s.saveCert(f.body)
+	case tcpServerInfo:
+		if !ex.authed {
+			return s.retry("Protocol error", nil)
+		}
+		return s.finishV3Server(wire, f.body, ex)
+	case tcpStartUDPEnc:
+		if ex.ph != phUDP {
+			return nil
+		}
+		return s.finishV3UDP(wire.conn, ex)
+	case tcpTalkerStart:
+		s.onTalker(f.body, true)
+		return nil
+	case tcpTalkerStop:
+		s.onTalker(f.body, false)
+		return nil
+	case tcpNodeList, tcpNodeJoined, tcpNodeLeft, tcpRequestQSY, tcpStateEvent, tcpSignal, tcpTxStatus:
+		if err := unpackIgnored(f); err != nil {
+			return s.retry("Protocol error", err)
+		}
+		return nil
+	default:
+		return nil
+	}
+}
+
+func (s *Station) onCAInfo(w io.Writer, body []byte, ex *exchange) error {
+	_, digest, err := parseCAInfo(body)
+	if err != nil {
+		return s.retry("Protocol error", err)
+	}
+	if err := ensureCertDir(s.cfg.certificateDir); err != nil {
+		s.endFatalCause("Cannot create "+s.cfg.certificateDir, err, true)
+		return errStopped
+	}
+	sum, ok, err := caDigest(s.cfg.certificateDir)
+	if err != nil {
+		s.endFatalCause("Cannot create "+s.cfg.certificateDir, err, true)
+		return errStopped
+	}
+	if ok {
+		if !bytes.Equal(sum[:], digest) {
+			s.mu.Lock()
+			s.writeLog(s.clock.Now(), "CA digest differs")
+			s.mu.Unlock()
+		}
+		if err := writeFrame(w, tcpStartEncReq, nil); err != nil {
+			return err
+		}
+		ex.lastTCP = s.clock.Now()
+		ex.ph = phStart
+		return nil
+	}
+	if err := writeFrame(w, tcpCABundleReq, nil); err != nil {
+		return err
+	}
+	ex.lastTCP = s.clock.Now()
+	ex.ph = phBundle
+	return nil
+}
+
+func parseCAInfo(b []byte) (uint16, []byte, error) {
+	size, rest, err := parseU16(b)
+	if err != nil {
+		return 0, nil, err
+	}
+	digest, rest, err := parseBlob(rest)
+	if err != nil {
+		return 0, nil, err
+	}
+	if len(digest) != sha256Len || len(rest) != 0 {
+		return 0, nil, io.ErrUnexpectedEOF
+	}
+	return size, digest, nil
+}
+
+const sha256Len = 32
+
+func (s *Station) onCABundle(w io.Writer, body []byte, ex *exchange) error {
+	caPEM, rest, err := parseString(body)
+	if err != nil {
+		return s.retry("CA signature rejected", err)
+	}
+	sig, rest, err := parseBlob(rest)
+	if err != nil {
+		return s.retry("CA signature rejected", err)
+	}
+	certPEM, rest, err := parseString(rest)
+	if err != nil {
+		return s.retry("CA signature rejected", err)
+	}
+	if len(rest) != 0 {
+		return s.retry("CA signature rejected", nil)
+	}
+	if err := verifyCABundle(caPEM, sig, certPEM); err != nil {
+		return s.retry("CA signature rejected", err)
+	}
+	if err := writeCABundle(s.cfg.certificateDir, caPEM); err != nil {
+		s.endFatalCause("Cannot create "+s.cfg.certificateDir, err, true)
+		return errStopped
+	}
+	if err := writeFrame(w, tcpStartEncReq, nil); err != nil {
+		return err
+	}
+	ex.lastTCP = s.clock.Now()
+	ex.ph = phStart
+	return nil
+}
+
+func (s *Station) onStartEncryption(ctx context.Context, wire *framed, ex *exchange) error {
+	pair, present, fatal, cause := prepareIdentity(s.cfg.certificateDir, s.cfg.callsign)
+	if fatal != "" {
+		s.endFatalCause(fatal, cause, true)
+		return errStopped
+	}
+	ex.client = pair
+	ex.haveCert = present
+	caPath := filepath.Join(s.cfg.certificateDir, caFileName)
+	caPEM, err := os.ReadFile(caPath)
+	if err != nil {
+		s.endFatalCause("Cannot create "+caPath, err, true)
+		return errStopped
+	}
+	cfg, err := tlsConfig(s.cfg.host, caPEM, pair, present)
+	if err != nil {
+		return s.retry("TLS handshake failed", err)
+	}
+	if err := s.startTLS(ctx, wire, cfg, ex.limit); err != nil {
+		if errors.Is(err, errHostMismatch) {
+			return s.retry("Reflector certificate does not match the host", err)
+		}
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		return s.retry("TLS handshake failed", err)
+	}
+	ex.ph = phIdent
+	return nil
+}
+
+func (s *Station) sendCSR(w io.Writer, ex *exchange) error {
+	csrPath := filepath.Join(s.cfg.certificateDir, csrFileName)
+	pem, err := readCSR(s.cfg.certificateDir)
+	if err != nil {
+		s.endFatalCause("Cannot create "+csrPath, err, true)
+		return errStopped
+	}
+	if err := writeFrame(w, tcpCsr, appendString(nil, pem)); err != nil {
+		return err
+	}
+	ex.lastTCP = s.clock.Now()
+	return nil
+}
+
+func (s *Station) saveCert(body []byte) error {
+	pem, _, err := parseString(body)
+	if err != nil || pem == "" {
+		return s.retry("Protocol error", err)
+	}
+	certPath := filepath.Join(s.cfg.certificateDir, certFileName)
+	if err := writeClientCert(s.cfg.certificateDir, pem); err != nil {
+		s.endFatalCause("Cannot create "+certPath, err, true)
+		return errStopped
+	}
+	return errReconnect
+}
+func (s *Station) finishV3Server(wire *framed, body []byte, ex *exchange) error {
+	id, enc, dec, err := s.acceptServer(body)
+	if err != nil {
+		return err
+	}
+	if enc == nil {
+		return errStopped
+	}
+	iv := make([]byte, 6)
+	key := make([]byte, 16)
+	if _, err := rand.Read(iv); err != nil {
+		enc.Close()
+		dec.Close()
+		return fmt.Errorf("udp key: %w", err)
+	}
+	if _, err := rand.Read(key); err != nil {
+		enc.Close()
+		dec.Close()
+		return fmt.Errorf("udp key: %w", err)
+	}
+	info, err := identityV3(iv, key)
+	if err != nil {
+		enc.Close()
+		dec.Close()
+		return err
+	}
+	if err := writeFrame(wire, tcpNodeInfo, info); err != nil {
+		enc.Close()
+		dec.Close()
+		return err
+	}
+	ex.lastTCP = s.clock.Now()
+	s.mu.Lock()
+	s.clientID = id
+	s.enc = enc
+	s.dec = dec
+	s.ivPrefix = iv
+	s.udpKey = key
+	s.secure = true
+	s.mu.Unlock()
+	ex.ph = phUDP
+	return nil
+}

station/software.go

@@ -1,6 +1,11 @@
 package station
 
-import jsonv2 "encoding/json/v2"
+import (
+	"bytes"
+	jsonv2 "encoding/json/v2"
+
+	"golang.org/x/sys/unix"
+)
 
 // SoftwareName and SoftwareVersion are the identity sent to the reflector
 // after login. Edit them here.
@@ -9,16 +14,57 @@ const (
 	SoftwareVersion = "1.0.0"
 )
 
+type softwareIdentity struct {
+	SW          string `json:"sw"`
+	SWVer       string `json:"swVer"`
+	ProjVer     string `json:"projVer"`
+	MachineArch string `json:"machineArch,omitzero"`
+}
+
 func softwareIdentityBody() ([]byte, error) {
-	raw, err := jsonv2.Marshal(struct {
+	raw, err := marshalIdentity(false)
-		SW    string `json:"sw"`
-		SWVer string `json:"swVer"`
-	}{
-		SW:    SoftwareName,
-		SWVer: SoftwareVersion,
-	})
 	if err != nil {
 		return nil, err
 	}
 	return appendString(nil, string(raw)), nil
 }
+
+func identityV3(iv, key []byte) ([]byte, error) {
+	raw, err := marshalIdentity(true)
+	if err != nil {
+		return nil, err
+	}
+	body := appendBlob(nil, iv)
+	body = appendBlob(body, key)
+	return appendString(body, string(raw)), nil
+}
+
+func marshalIdentity(arch bool) ([]byte, error) {
+	info := softwareIdentity{
+		SW:      SoftwareName,
+		SWVer:   SoftwareVersion,
+		ProjVer: SoftwareVersion,
+	}
+	if arch {
+		if name, ok := MachineArch(); ok {
+			info.MachineArch = name
+		}
+	}
+	return jsonv2.Marshal(info)
+}
+
+// MachineArch is the hardware name from uname, when it can be read.
+func MachineArch() (string, bool) {
+	var u unix.Utsname
+	if err := unix.Uname(&u); err != nil {
+		return "", false
+	}
+	b := u.Machine[:]
+	if i := bytes.IndexByte(b, 0); i >= 0 {
+		b = b[:i]
+	}
+	if len(b) == 0 {
+		return "", false
+	}
+	return string(b), true
+}

station/station.go

@@ -24,14 +24,28 @@ type State struct {
 	Detail       string `json:"detail"`
 	Callsign     string `json:"callsign"`
 	TalkGroup    int    `json:"talkGroup"`
+	Protocol     string `json:"protocol"`
 	Talker       string `json:"talker"`
 	Transmitting bool   `json:"transmitting"`
+	NeedsConfig  bool   `json:"needsConfig"`
+	ConfigOpen   bool   `json:"configOpen"`
 }
 
 // Station is the seam tests and the window use.
 type Station struct {
-	cfg   loaded
+	cfg         loaded
-	clock Clock
+	clock       Clock
+	path        string
+	loaded      bool
+	configOpen  bool
+	configErr   string
+	openBlocked string
+	form        ConfigForm
+	epoch       uint64
+	kick        bool
+	conn        net.Conn
+	cancelDial  context.CancelFunc
+	apply       chan struct{}
 
 	mu           sync.Mutex
 	state        State
@@ -39,13 +53,27 @@ type Station struct {
 	buttonHeld   bool
 	spaceHeld    bool
 	fatal        string
+	retryReason  string
+	protocol     string
 	remoteTalker string
 	roomBusy     bool
+	audioHeard   bool
+	lastAudio    time.Time
+	flushWaiting bool
+	flushAt      time.Time
+	rxSeq        uint16
+	secure       bool
+	udpWait      bool
+	ivPrefix     []byte
+	udpKey       []byte
+	rxCounter    uint32
+	txCounter    uint32
 	mic          []int16
 	play         []int16
 	clientID     uint16
 	seq          uint16
 	udp          *net.UDPConn
+	udpPeer      *net.UDPAddr
 	lastUDPSend  time.Time
 	enc          *opus.Encoder
 	dec          *opus.Decoder
@@ -61,35 +89,55 @@ type Station struct {
 	talkStart time.Time
 }
 
-// New loads the config at opt.ConfigPath. A missing file is created mode 0600
+// New loads the config at opt.ConfigPath. A missing or invalid file does not
-// and New returns an error so the caller can exit before opening a window.
+// stop the station: the Config window opens and the file is left uncreated
+// until Save. New returns an error when the path cannot be prepared, such as
+// an unknown home directory.
 func New(opt Options) (*Station, error) {
-	cfg, err := loadConfig(opt.ConfigPath)
-	if err != nil {
-		return nil, err
-	}
 	clock := opt.Clock
 	if clock == nil {
 		clock = wallClock{}
 	}
+	out, err := loadConfig(opt.ConfigPath)
+	if err != nil {
+		return nil, err
+	}
 	detail := "Idle"
-	if cfg.logNotice != "" {
+	if out.detail != "" {
-		detail = cfg.logNotice
+		detail = out.detail
+	}
+	call, tg := out.cfg.callsign, out.cfg.talkGroup
+	if !out.loaded && out.cfg.callsign == "" {
+		call = out.form.Callsign
+		tg = out.form.TalkGroup
+	}
+	errText := ""
+	if !out.loaded {
+		errText = out.detail
 	}
 	s := &Station{
-		cfg:       cfg,
+		cfg:        out.cfg,
-		clock:     clock,
+		clock:      clock,
-		wake:      make(chan struct{}, 1),
+		path:       opt.ConfigPath,
-		logPath:   cfg.logPath,
+		loaded:     out.loaded,
-		logNotice: cfg.logNotice,
+		configOpen: !out.loaded,
+		configErr:  errText,
+		form:       out.form,
+		wake:       make(chan struct{}, 1),
+		apply:      make(chan struct{}, 1),
+		logPath:    out.cfg.logPath,
+		logNotice:  out.cfg.logNotice,
+		fatal:      out.cfg.certFatal,
 		state: State{
-			Connection: "Disconnected",
+			Connection:  "Disconnected",
-			Detail:     detail,
+			Detail:      detail,
-			Callsign:   cfg.callsign,
+			Callsign:    call,
-			TalkGroup:  cfg.talkGroup,
+			TalkGroup:   tg,
+			NeedsConfig: !out.loaded,
+			ConfigOpen:  !out.loaded,
 		},
 	}
-	if cfg.enableLogging {
+	if out.loaded && out.cfg.enableLogging {
 		s.openLog()
 	}
 	return s, nil
@@ -102,6 +150,18 @@ func (s *Station) State() State {
 	return s.state
 }
 
+// Config returns the Config window's form and whether it is open.
+func (s *Station) Config() ConfigState {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return ConfigState{
+		Open:        s.configOpen,
+		NeedsConfig: !s.loaded,
+		Error:       s.configErr,
+		Form:        s.form,
+	}
+}
+
 // Wait blocks until pred is true or ctx ends.
 func (s *Station) Wait(ctx context.Context, pred func(State) bool) (State, error) {
 	s.mu.Lock()
@@ -151,6 +211,9 @@ func (s *Station) afterHold(was bool) {
 	if was && !s.transmitting() {
 		s.endTransmit()
 	}
+	if !s.buttonHeld && !s.spaceHeld {
+		s.openBlocked = ""
+	}
 	s.publish()
 }
 

station/tls.go

@@ -0,0 +1,60 @@
+package station
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"strings"
+)
+
+var errHostMismatch = errors.New("host mismatch")
+
+func tlsConfig(host string, caPEM []byte, client tls.Certificate, present bool) (*tls.Config, error) {
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(caPEM) {
+		return nil, errors.New("ca bundle")
+	}
+	cfg := &tls.Config{
+		MinVersion:         tls.VersionTLS12,
+		RootCAs:            pool,
+		InsecureSkipVerify: true,
+		VerifyConnection: func(cs tls.ConnectionState) error {
+			return verifyPeer(host, pool, cs)
+		},
+	}
+	if present {
+		cfg.Certificates = []tls.Certificate{client}
+	}
+	return cfg, nil
+}
+
+func verifyPeer(host string, pool *x509.CertPool, cs tls.ConnectionState) error {
+	if len(cs.PeerCertificates) == 0 {
+		return errors.New("no peer certificate")
+	}
+	leaf := cs.PeerCertificates[0]
+	opts := x509.VerifyOptions{Roots: pool, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}}
+	if len(cs.PeerCertificates) > 1 {
+		opts.Intermediates = x509.NewCertPool()
+		for _, cert := range cs.PeerCertificates[1:] {
+			opts.Intermediates.AddCert(cert)
+		}
+	}
+	if _, err := leaf.Verify(opts); err != nil {
+		return err
+	}
+	host = strings.TrimSuffix(host, ".")
+	if ip := net.ParseIP(host); ip != nil {
+		for _, cand := range leaf.IPAddresses {
+			if cand.Equal(ip) {
+				return nil
+			}
+		}
+		return errHostMismatch
+	}
+	if err := leaf.VerifyHostname(host); err != nil {
+		return errHostMismatch
+	}
+	return nil
+}

svxlink-docker/.env.example

@@ -5,7 +5,7 @@ TZ=Europe/Berlin
 LISTEN_PORT=5300
 
 # 0 = local lab only (default). 1 = append config/svxreflector.link.conf
-# (Satellite/Trunk from DJ1JAY). Satellite dials out — no public DNS needed.
+# (GeuReflector Satellite/Trunk). Satellite dials out — no public DNS needed.
 ENABLE_FM_LINK=0
 
 SVXREFLECTOR_CONF=/etc/svxlink/svxreflector.conf

svxlink-docker/Dockerfile

@@ -1,6 +1,7 @@
-# Build jayReflector (DJ1JAY / FM-Funknetz) for the Funknetz local lab.
+# Build GeuReflector (IW1GEU) for the Funknetz local lab.
 # Binary name remains svxreflector; Trunk/Satellite are opt-in via config.
-# Upstream pattern: dj1jay/jayReflector Dockerfile (clone + cmake, not stock sm0svx).
+# Pin: audric/GeuReflector dbad88e8c3e0f1adb8342db190bb0b3ad00106f4
+# (master, 2026-07-16; release line v1.3.17).
 
 # =========================================================
 # STAGE 1 — BUILD
@@ -13,27 +14,27 @@ RUN apt-get update && apt-get -y install --no-install-recommends \
     build-essential cmake \
     libsigc++-2.0-dev libssl-dev libjsoncpp-dev libpopt-dev \
     libopus-dev libgsm1-dev \
+    libmosquitto-dev libhiredis-dev \
     && rm -rf /var/lib/apt/lists/*
 
-ARG GIT_URL=https://github.com/dj1jay/jayReflector.git
+ARG GIT_URL=https://github.com/audric/GeuReflector.git
-ARG GIT_BRANCH=main
+ARG GIT_BRANCH=master
 ARG GIT_REF=
 ARG NUM_CORES=4
 
 WORKDIR /build
 RUN set -eux; \
     if [ -n "${GIT_REF}" ]; then \
-      git clone --recursive "${GIT_URL}" jayReflector; \
+      git clone --recursive "${GIT_URL}" GeuReflector; \
-      cd jayReflector && git checkout "${GIT_REF}"; \
+      cd GeuReflector && git checkout "${GIT_REF}"; \
     else \
-      git clone --recursive --depth 1 --branch "${GIT_BRANCH}" "${GIT_URL}" jayReflector; \
+      git clone --recursive --depth 1 --branch "${GIT_BRANCH}" "${GIT_URL}" GeuReflector; \
     fi
 
-WORKDIR /build/jayReflector
+WORKDIR /build/GeuReflector
 RUN set -eux; \
     cmake -S src -B build \
       -DLOCAL_STATE_DIR=/var \
-      -DUSE_QT=OFF \
       -DUSE_ALSA=OFF \
       -DCMAKE_BUILD_TYPE=Release; \
     cmake --build build --target svxreflector -j"${NUM_CORES}"
@@ -48,10 +49,11 @@ RUN apt-get update && apt-get -y install --no-install-recommends \
     ca-certificates openssl \
     libsigc++-2.0-0v5 libssl3 libjsoncpp25 libpopt0 \
     libopus0 libgsm1 \
+    libmosquitto1 libhiredis0.14 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=builder /build/jayReflector/build/bin/svxreflector /usr/bin/svxreflector
+COPY --from=builder /build/GeuReflector/build/bin/svxreflector /usr/bin/svxreflector
-COPY --from=builder /build/jayReflector/build/lib/lib*.so* /usr/lib/
+COPY --from=builder /build/GeuReflector/build/lib/lib*.so* /usr/lib/
 
 RUN mkdir -p /etc/svxlink /etc/svxlink/pki /var/log/svxlink /var/lib/svxlink && \
     ldconfig && \

svxlink-docker/config/svxreflector.conf

@@ -1,5 +1,5 @@
 ###################################################################
-# Local lab jayReflector for Funknetz (protocol 2.0 / ReflectorV2)
+# Local lab GeuReflector for Funknetz (protocol 2.0 / ReflectorV2)
 # Secrets here are placeholders — do not reuse production keys.
 #
 # Standalone by default: local clients only. FM-Funknetz Satellite/Trunk
@@ -17,8 +17,8 @@ CERT_PKI_DIR=/etc/svxlink/pki/
 # Optional status JSON (publish 8080 in compose if you enable this):
 # HTTP_SRV_PORT=8080
 
-# jayReflector / modern SvxReflector bootstraps a local PKI even for
+# GeuReflector bootstraps a local PKI even for protocol 2.0 AUTH_KEY
-# protocol 2.0 AUTH_KEY clients. COMMON_NAME is required on first start.
+# clients. COMMON_NAME is required on first start.
 [SERVER_CERT]
 COMMON_NAME=funknetz-lab.local
 SUBJECT_ALT_NAME=DNS:funknetz-lab.local,DNS:localhost,IP:127.0.0.1

svxlink-docker/config/svxreflector.link.conf

@@ -1,33 +1,43 @@
 ###################################################################
-# Optional FM-Funknetz link stub (jayReflector)
+# Optional FM-Funknetz link stub (GeuReflector)
 #
 # Default: leave ENABLE_FM_LINK=0 in .env — this file is ignored.
-# When DJ1JAY provides values:
+# When the parent operator provides values:
-#   1. Fill ONE of the blocks below (prefer Satellite for home/NAT labs).
+#   1. Uncomment ONE of the blocks below (prefer Satellite for home/NAT labs).
 #   2. Set ENABLE_FM_LINK=1 in .env
 #   3. docker compose up -d
 #
+# The entrypoint appends this file after the base lab conf, which already
+# ends in [PASSWORDS]. Satellite keys belong in [GLOBAL]; the section
+# header below merges with the base [GLOBAL] section.
+#
 # Satellite (recommended): this reflector dials OUT to the parent on
 # TCP 5303. No public DNS, no inbound peer port, no port-forward required
 # for the link. Local Funknetz clients still use host :5300 only.
+# SATELLITE_ID may contain only letters, digits, and dashes.
+# Do not set LOCAL_PREFIX or a [TRUNK_x] section on a satellite.
 #
 # Trunk: equal mesh peer; needs mutual reachability on TCP 5302 and a
 # matching [TRUNK_x] section name + SECRET on both sides.
+# Do not enable Satellite and Trunk in the same file.
 #
-# Do not commit real secrets. Prefer a local override or keep secrets
+# Do not commit real secrets.
-# only in your private .env workflow if you copy this file.
+# Docs: docs/research/2026-10-11-geureflector-lab-baseline.md
-# Docs: docs/research/2026-10-07-jayreflector-fm-funknetz.md
+# README: https://github.com/audric/GeuReflector#satellite-reflectors
-# README: https://github.com/dj1jay/jayReflector
 ###################################################################
 
-# --- Satellite (fill from DJ1JAY; uncomment to use) ---
+# --- Satellite (uncomment the section and keys to use) ---
-# SATELLITE_OF=parent.example.org:5303
+# [GLOBAL]
+# SATELLITE_OF=parent.example.org
+# SATELLITE_PORT=5303
 # SATELLITE_ID=lab-yourcall
-# SATELLITE_SECRET="replace-with-secret-from-dj1jay"
+# SATELLITE_SECRET="replace-with-secret-from-operator"
 # Only these TGs cross to/from the parent (bidirectional). Omit for all TGs.
+# Syntax: exact "26200", prefix "24*", range "2427-2438", comma-separated.
 # SATELLITE_FILTER=2621,2629,20
 
-# --- Trunk peer alternative (fill from DJ1JAY; usually leave commented) ---
+# --- Trunk peer alternative (uncomment to use; leave Satellite commented) ---
+# [GLOBAL]
 # LOCAL_PREFIX=9
 # TRUNK_LISTEN_PORT=5302
 #
@@ -38,4 +48,5 @@
 # REMOTE_PREFIX=262
 # ALLOW_TGS=2621,2629,20
 # # TG_MAP=1:2624100
-# MQTT_NAME=Lab-YourCall
+# MQTT stays off. If enabled later, MQTT_NAME belongs in a [MQTT] section,
+# not under [TRUNK_x].

svxlink-docker/docker-compose.yml

@@ -1,8 +1,8 @@
-# Local jayReflector lab for Funknetz.
+# Local GeuReflector lab for Funknetz.
 # Build once, then: docker compose up -d --build
 # Connect the app with host/port/callsign/authKey from .env (see FUNKNETZ_*).
 #
-# FM-Funknetz link (optional): fill config/svxreflector.link.conf from DJ1JAY,
+# FM-Funknetz link (optional): fill config/svxreflector.link.conf,
 # set ENABLE_FM_LINK=1, recreate. Satellite mode is outbound-only (no DNS/inbound).
 
 services:
@@ -11,11 +11,11 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        GIT_URL: https://github.com/dj1jay/jayReflector.git
+        GIT_URL: https://github.com/audric/GeuReflector.git
-        GIT_BRANCH: main
+        GIT_BRANCH: master
-        # Optional pin (overrides branch clone when set), e.g.:
+        # Pin (overrides the branch clone). master on 2026-10-11; release line v1.3.17.
-        # GIT_REF: 50997ed21a37c7c05c132eca5ebb07bab4b80fc7
+        GIT_REF: dbad88e8c3e0f1adb8342db190bb0b3ad00106f4
-    image: funknetz-jayreflector:local
+    image: funknetz-geureflector:local
     container_name: funknetz-svxreflector
     restart: unless-stopped
     env_file:

svxlink-docker/entrypoint.sh

@@ -55,11 +55,11 @@ stop_all() {
 
 trap 'stop_all; exit 0' INT TERM
 
-command -v svxreflector >/dev/null 2>&1 || die "svxreflector binary not found (jayReflector build)"
+command -v svxreflector >/dev/null 2>&1 || die "svxreflector binary not found (GeuReflector build)"
 [ -f "$SVXREFLECTOR_CONF" ] || die "Config not found: $SVXREFLECTOR_CONF (expected volume mount)"
 
 # Local-only by default. When ENABLE_FM_LINK=1, append the link stub
-# (Satellite or Trunk keys from DJ1JAY) after the base lab conf.
+# (GeuReflector Satellite or Trunk keys) after the base lab conf.
 if [ "$ENABLE_FM_LINK" = "1" ]; then
   [ -f "$SVXREFLECTOR_LINK_CONF" ] || die "ENABLE_FM_LINK=1 but link config missing: $SVXREFLECTOR_LINK_CONF"
   {
@@ -82,7 +82,7 @@ mkdir -p /etc/svxlink/pki /var/lib/svxlink/pki
 
 start_bg "svxreflector" svxreflector --config "$conf_path" $SVXREFLECTOR_ARGS
 
-log "jayReflector (svxreflector) is running. Waiting…"
+log "GeuReflector (svxreflector) is running. Waiting…"
 
 exit_code=0
 for pid in $pids; do

teststart.sh

@@ -96,6 +96,7 @@ cat >"$GENERATED" <<EOF
   "callsign": $call_json,
   "authKey": $key_json,
   "talkGroup": $FUNKNETZ_TALK_GROUP,
+  "protocol": "v2",
   "enableLogging": true,
   "logFile": $log_json
 }