Update to 7.0.7.0246

4 files changed, 167 insertions, 79 deletions

diff --git a/.SRCINFO b/.SRCINFO
index d68ce5b43c33..cd75edcab81c 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,11 +1,13 @@
 pkgbase = forticlient-vpn
 	pkgdesc = Build through the official package of FortiClient VPN
-	pkgver = 7.0.0.0018
+	pkgver = 7.0.7.0246
 	pkgrel = 1
 	url = https://www.fortinet.com/support/product-downloads
 	install = forticlient-vpn.install
 	arch = x86_64
 	license = custom:fortinet
+	depends = systemd
+	depends = gzip
 	depends = nss
 	depends = gtk3
 	depends = libxss
@@ -14,6 +16,7 @@ pkgbase = forticlient-vpn
 	depends = libnotify
 	depends = org.freedesktop.secrets
 	depends = libappindicator-gtk2
+	depends = cups
 	optdepends = mate-polkit: for polkit authentication for the MATE
 	optdepends = polkit-gnome: for polkit authentication for the GNOME
 	optdepends = polkit-kde-agent: for polkit authentication for the KDE
@@ -22,8 +25,7 @@ pkgbase = forticlient-vpn
 	optdepends = lxqt-policykit: for polkit authentication for the LXQt
 	provides = fortivpn
 	provides = FortiClient
-	source = https://filestore.fortinet.com/forticlient/downloads/forticlient_vpn_7.0.0.0018_amd64.deb
-	sha256sums = 82e5817048a60ff95d2e88b4a95512f9f0035fa37240ce57580c203b5a8a79c9
+	source = https://repo.fortinet.com/repo/7.0/ubuntu/pool/multiverse/forticlient/forticlient_7.0.7.0246_amd64.deb
+	sha256sums = 634d27f412764d74a44b63c63258fcf63206417cfb97570934ac8ab4b52f53a1
 
 pkgname = forticlient-vpn
-
diff --git a/PKGBUILD b/PKGBUILD
index 2b36cfa5c759..463ac82cb1f6 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,12 +1,12 @@
-# Maintainer: Douglas Iuri Medeiros Cabral <douglasimc at outlook dot com>
+# Maintainer: Douglas Iuri Medeiros Cabral <douglasimcabral at zohomail dot com>
 pkgname=forticlient-vpn
-pkgver=7.0.0.0018
-pkgrel=2
+pkgver=7.0.7.0246
+pkgrel=1
 pkgdesc="Build through the official package of FortiClient VPN"
 arch=("x86_64")
 url="https://www.fortinet.com/support/product-downloads"
 license=('custom:fortinet')
-depends=('nss' 'gtk3' 'libxss' 'polkit' 'openssl' 'libnotify' 'org.freedesktop.secrets' 'libappindicator-gtk2', 'cups')
+depends=('systemd' 'gzip' 'nss' 'gtk3' 'libxss' 'polkit' 'openssl' 'libnotify' 'org.freedesktop.secrets' 'libappindicator-gtk2' 'cups')
 optdepends=(
 	'mate-polkit: for polkit authentication for the MATE'
 	'polkit-gnome: for polkit authentication for the GNOME'
@@ -17,30 +17,26 @@ optdepends=(
 )
 provides=('fortivpn' 'FortiClient')
 install='forticlient-vpn.install'
-source=("https://filestore.fortinet.com/forticlient/downloads/forticlient_vpn_${pkgver}_amd64.deb")
-sha256sums=('82e5817048a60ff95d2e88b4a95512f9f0035fa37240ce57580c203b5a8a79c9')
+source=("https://repo.fortinet.com/repo/7.0/ubuntu/pool/multiverse/forticlient/forticlient_${pkgver}_amd64.deb")
+sha256sums=('634d27f412764d74a44b63c63258fcf63206417cfb97570934ac8ab4b52f53a1')
 
 
 package() {
 
 	bsdtar -xf data.tar.xz -C "$pkgdir/"
 
-	install -Dm644  "${pkgdir}/lib/systemd/system/forticlient-scheduler.service" "${pkgdir}/usr/lib/systemd/system/forticlient-scheduler.service"
-
-	rm -rf "${pkgdir}/lib"
+	install -Dm644  "${pkgdir}/lib/systemd/system/forticlient.service" "${pkgdir}/usr/lib/systemd/system/forticlient.service"
 
 	# Install license
-    	install -Dm 644 "${pkgdir}/usr/share/doc/forticlient/copyright" "${pkgdir}/usr/share/licenses/fortinet/LICENSE"
+    install -Dm 644 "${pkgdir}/usr/share/doc/forticlient/copyright" "${pkgdir}/usr/share/licenses/fortinet/LICENSE"
 	
 	# Symbolic binaries which are located in /opt
 	mkdir -p ${pkgdir}/usr/bin
 	ln -sf '/opt/forticlient/fortivpn' "${pkgdir}/usr/bin/fortivpn"
-	ln -sf '/opt/forticlient/gui/FortiClient-linux-x64/FortiClient' "${pkgdir}/usr/bin/forticlient"
+	ln -sf '/opt/forticlient/forticlient-cli' "${pkgdir}/usr/bin/forticlient"
 
 	# Symbolic launchers
 	mkdir -p ${pkgdir}/etc/xdg/autostart
 	ln -sf '/opt/forticlient/Fortitray.desktop' "${pkgdir}/etc/xdg/autostart/Fortitray.desktop"
-	ln -sf '/opt/forticlient/Fortivpn.desktop' "${pkgdir}/etc/xdg/autostart/Fortivpn.desktop"
-
 }
 
diff --git a/forticlient-vpn.changelog b/forticlient-vpn.changelog
index 1e100f12badf..08d26af9aa1a 100644
--- a/forticlient-vpn.changelog
+++ b/forticlient-vpn.changelog
@@ -1,3 +1,8 @@
+## forticlient-vpn - 7.0.7.0246 - 2022-11-10
+* forticlient-vpn - 7.0.7.0246 - `release 1`
+  + nss and systemd moved to `depends`
+  + upgraded the install script
+
 ## forticlient-vpn - 7.0.0.0018 - 2021-06-13
 * forticlient-vpn - 7.0.0.0018 - `release 1`
   + libappindicator-gtk2 moved to `depends`
diff --git a/forticlient-vpn.install b/forticlient-vpn.install
index 567b72391f52..15c05037f757 100644
--- a/forticlient-vpn.install
+++ b/forticlient-vpn.install
@@ -27,115 +27,170 @@ pre_install () {
 }
 
 pre_upgrade () {
-# Remove old symlink when upgrading from older versions
-if [ -f /usr/bin/FortiClient ]; then
-    pkill -f /usr/bin/FortiClient
-    rm -rf /usr/bin/FortiClient
-fi
+	# Remove old symlink when upgrading from older versions
+	if [ -f /usr/bin/forticlient ]; then
+		pkill -f /usr/bin/forticlient
+		rm -rf /usr/bin/forticlient
+	fi
+	if [ -f /usr/bin/fortivpn ]; then
+		pkill -f /usr/bin/fortivpn
+		rm -rf /usr/bin/fortivpn
+	fi
+	if [ -f /etc/xdg/autostart/Fortitray.desktop ]; then
+		rm -rf /etc/xdg/autostart/Fortitray.desktop
+	fi
 }
 
 post_install() {
-	# Remove older version directories and files when upgrading
-	if [ -d /usr/bin/forticlient ]; then
-	    pkill -f /usr/bin/forticlient
-	    rm -rf /usr/bin/forticlient
-	fi
 
 	# Remove old configuration files when upgrading from older versions
 	if [ -f /etc/forticlient/config.xml ]; then
-	    rm -rf /etc/forticlient/config.xml
+		rm -rf /etc/forticlient/config.xml
 	fi
 
 	if [ -f /etc/forticlient/config_backup.xml ]; then
-	    rm -rf /etc/forticlient/config_backup.xml
+		rm -rf /etc/forticlient/config_backup.xml
 	fi
 
 	# Remove old pid lock
 	if [ -f /tmp/.forticlient/fortivpn.pid ]; then
-	    rm -rf /tmp/.forticlient/fortivpn.pid
+		rm -rf /tmp/.forticlient/fortivpn.pid
+	fi
+
+	# Restore permissions to all files
+	if [ -f /opt/forticlient/.repackaged ] && [ -f /opt/forticlient/.acl ]; then
+	(
+		cd /
+		setfacl --restore /opt/forticlient/.acl
+	)
 	fi
 
 	if [ -f /etc/forticlient/servers.conf ]; then
-	    chmod 600 /etc/forticlient/servers.conf
+		chmod 600 /etc/forticlient/servers.conf
+	fi
+
+	# Keep old database when upgrading from older versions
+	if [ ! -d /var/lib/forticlient ] || [ ! -O /var/lib/forticlient ]; then
+		rm -rf /var/lib/forticlient
+		mkdir -m 755 /var/lib/forticlient
+	fi
+
+	if [ -f /etc/forticlient/config.db ]; then
+		if [ -O /etc/forticlient/config.db ]; then
+			mv /etc/forticlient/config.db /var/lib/forticlient/config.db
+		else
+			# Old database cannot be trusted and should be replaced
+			# So ems connection info is lost and fct has to register to ems again
+			rm -f /etc/forticlient/config.db /opt/forticlient/.fct_ec_registered
+		fi
 	fi
 
-	# Create GUI symlink to launch from terminal
-	if [ -f /opt/forticlient/gui/FortiClient-linux-x64/FortiClient ]; then
-	    ln -sf /opt/forticlient/gui/FortiClient-linux-x64/FortiClient /usr/bin/forticlient
+	if [ ! -f /var/lib/forticlient/config.db ]; then
+		cp /opt/forticlient/.config.db.init /var/lib/forticlient/config.db
 	fi
 
+	chmod 600 /var/lib/forticlient/config.db
+
 	# Launch fortitray
 	if [ -f /opt/forticlient/fortitraylauncher ]; then
-	    if [ ! -z "$(logname 2>/dev/null)" ]; then
-		user="$(logname 2>/dev/null)"
-	    elif [ ! -z "$SUDO_USER" ]; then
-		user="$SUDO_USER"
-	    else
-		user=$(users 2>/dev/null | cut -d ' ' -f1)
-	    fi
-
-	    # Need to find the user DBUS address, otherwise Fortitray icon won't show
-	    DBUS_SESSION_BUS_ADDRESS=$(ps -u $(id -u $user) -o pid= | xargs -I{} cat /proc/{}/environ 2>/dev/null | tr '\0' '\n' 2>/dev/null | grep -m1 '^DBUS_SESSION_BUS_ADDRESS=')
-	    DBUS_SESSION_BUS_ADDRESS=${DBUS_SESSION_BUS_ADDRESS#*=}
-
-	    # XAUTHORITY and DISPLAY needed by Fortitray to run
-	    XAUTHORITY=$(ps -u $(id -u $user) -o pid= | xargs -I{} cat /proc/{}/environ 2>/dev/null | tr '\0' '\n' 2>/dev/null | grep -m1 '^XAUTHORITY=')
-	    XAUTHORITY=${XAUTHORITY#*=}
-
-	    DISPLAY=$(ps -u $(id -u $user) -o pid= | xargs -I{} cat /proc/{}/environ 2>/dev/null | tr '\0' '\n' 2>/dev/null | grep -m1 '^DISPLAY=')
-	    DISPLAY=${DISPLAY#*=}
-
-	    XDG_RUNTIME_DIR=$(ps -u $(id -u $user) -o pid= | xargs -I{} cat /proc/{}/environ 2>/dev/null | tr '\0' '\n' 2>/dev/null | grep -m1 '^XDG_RUNTIME_DIR=')
-	    XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR#*=}
-
-	    # Start fortitraylauncher while forwarding environment variables needed by Fortitray
-	    su ${user} -c "env XAUTHORITY=$XAUTHORITY \
-			       DISPLAY=$DISPLAY \
-			       DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS \
-			       XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR \
-			       setsid /opt/forticlient/fortitraylauncher &>/dev/null &"
-	fi
-	       
+		if [ ! -z "$(logname 2>/dev/null)" ]; then
+			user="$(logname 2>/dev/null)"
+		elif [ ! -z "$SUDO_USER" ]; then
+			user="$SUDO_USER"
+		else
+			user=$(users 2>/dev/null | cut -d ' ' -f1)
+		fi
+
+		GUI_ENV=
+
+		# Attempt to get the GUI environment variables so fortitray will actually display correctly
+		for p in $(pgrep -u "$user" dbus-daemon); do
+			if [ -z "$(xargs -0 -L1 -a /proc/$p/cmdline | grep '^--config-file=')" ]; then
+				continue
+			fi
+
+			OIFS="$IFS"
+			IFS=$'\n'
+			for e in $(xargs -0 -L1 -a /proc/$p/environ); do
+				IFS== read -r left right <<< "$e"
+				GUI_ENV="$GUI_ENV $left=\"$right\""
+			done
+			IFS="$OIFS"
+
+			break
+		done
+
+		FORTITRAY_CMD="env -i $GUI_ENV setsid /opt/forticlient/fortitraylauncher &>/dev/null &"
+
+		# Start fortitraylauncher while forwarding environment variables needed by Fortitray
+		su $user -c "$FORTITRAY_CMD"
+	fi
+
 	# Update icons cache so icon will show correctly
 	if [ -f /usr/share/icons/hicolor/48x48/apps/forticlient.png ]; then
-	    gtk-update-icon-cache -f /usr/share/icons/hicolor || true
+		gtk-update-icon-cache -f /usr/share/icons/hicolor || true
 	fi
-	
+
 	# Setup forticlient protocol handler
 	if [ -f /usr/share/applications/forticlient-register.desktop ]; then
-	    update-desktop-database
+		update-desktop-database
+	fi
+	# Reload systemd
+	if [ -d /run/systemd/system ]; then
+		systemctl --system daemon-reload
 	fi
 }
 
 post_upgrade() {
 cat << EOF
 
-==> After upgrade, to restore your config, copy old file from /etc/forticlient/.old/ to /etc/forticlient/
+	==> After upgrade, to restore your config, copy old file from /etc/forticlient/.old/ to /etc/forticlient/
 
 EOF
 }
 
 pre_remove() {
 	# Check if forticlient is registered to EMS if it's an uninstall
-	if [ -f /opt/forticlient/.fct_ec_registered ] && [ "$action" != "upgrade" ]; then
-	    echo "Error: Unable to uninstall forticlient while connected to EMS"
-	    exit 1
+	if [ -f /opt/forticlient/.fct_ec_registered ]; then
+		echo "============================================================="
+		echo "Error: Unable to uninstall forticlient while connected to EMS"
+		echo "============================================================="
+		exit 1
 	fi
 
 	# Stop fortitray
 	if [ -f /tmp/.forticlient/fortitraylauncher ]; then
-	    echo "terminate" > /tmp/.forticlient/fortitraylauncher || true
+		echo "terminate" > /tmp/.forticlient/fortitraylauncher || true
 	fi
 
 	# Remove ZTNA browser certificates
 	if [ -f /usr/bin/certutil ]; then
-	    find /home /root -regextype posix-extended \
-		-regex '(/home/[^/]*|/root)/(.pki/nssdb|.mozilla/firefox/[^/]*default(-release)?)' \
-		-maxdepth 5 -print0 2>/dev/null |
-	    while IFS= read -r -d $'\0' p; do
-		/usr/bin/certutil -F -n FCT_ZTNA    -d sql:"$p" 2>/dev/null || true;
-		/usr/bin/certutil -D -n FCT_ZTNA_CA -d sql:"$p" 2>/dev/null || true;
-	    done
+		find /home /root -regextype posix-extended \
+			-regex '(/home/[^/]*|/root)/(.pki/nssdb|.mozilla/firefox/[^/]*default(-release)?)' \
+			-maxdepth 5 -print0 2>/dev/null |
+		while IFS= read -r -d $'\0' p; do
+			RUN_USER=$(stat -c '%U' "$p")
+
+			if [ $? -ne 0 ]; then
+				continue
+			fi
+
+			su - "$RUN_USER" -c '/usr/bin/certutil -D -n "FortiClient ZTNA" -d sql:'"$p"' 2>/dev/null || true'
+			su - "$RUN_USER" -c '/usr/bin/modutil -delete "FortiClient ZTNA" -dbdir sql:'"$p"' -force 2>/dev/null || true'
+		done
+	fi
+
+	# Remove token from tpm2 database
+	if [ -f /opt/forticlient/tpm2/tpm2_ptool/exe.linux-x86_64-3.7/tpm2_ptool ] && \
+	[ -d /opt/forticlient/tpm2/bin/ ]; then
+		PATH="/opt/forticlient/tpm2/bin:$PATH" \
+			/opt/forticlient/tpm2/tpm2_ptool/exe.linux-x86_64-3.7/tpm2_ptool rmtoken \
+			--label fct-ztna-token --path /opt/forticlient/
+	fi
+
+	# Remove service
+	if [ -d /run/systemd/system ]; then
+		systemctl stop forticlient.service
 	fi
 
 	pkill -f /opt/forticlient
@@ -146,6 +201,36 @@ post_remove() {
 	# Remove shared memory
 	rm -rf /var/run/fctc.s || true
 
+	# Remove Fortitray.desktop symlink
+	rm -rf /etc/xdg/autostart/Fortitray.desktop || true
+
 	# Remove fortitraylauncher fifo
 	rm -rf /tmp/.forticlient/fortitraylauncher || true
+
+	# Remove GUI symlink
+	rm -rf /usr/bin/forticlient || true
+
+	# Remove fortivpn symlink
+	rm -rf /usr/bin/fortivpn || true
+
+	# Remove FortiClient service
+	rm -rf /lib/systemd/system/forticlient.service || true
+
+	# Remove FortiClient binaries
+	rm -rf /opt/forticlient || true
+
+	# Remove config files and perserve uuid
+	rm -rf /var/lib/forticlient || true
+	find /etc/forticlient -type f -not -name 'custom_machine_id.conf' -delete
+
+	# Remove log files
+	rm -rf /var/log/forticlient || true
+
+	# Remove fortitray policy
+	rm -rf /usr/share/polkit-1/actions/org.fortinet.fortitray.policy || true
+
+	# Remove forticlient policy
+	rm -rf /usr/share/polkit-1/actions/org.fortinet.forticlient.policy || true
+
+	exit 0
 }