path: root/forticlient-vpn.install

pre_install () {
	BACKUP_DIR=/etc/forticlient/.old
	FCT_CONFIG_DB=/etc/forticlient/config.db
	FCT_CONFIG=/etc/forticlient/config.xml
	EC_CONFIG=/opt/forticlient/XMLs/ecdata.xml

	# Backup old XML configurations if they exist so they can
	# be imported on start up if upgrading from an older FCT version
	if [ -f $FCT_CONFIG_DB ] || [ -f $FCT_CONFIG ] || [ -f $EC_CONFIG ]; then
	    mkdir $BACKUP_DIR && chmod 0600 $BACKUP_DIR
	else
	    exit 0
	fi

	if [ -d $BACKUP_DIR ] && [ $(stat -c "%a" $BACKUP_DIR) -eq 600 ] && [ -f $FCT_CONFIG_DB ]; then
	    cp $FCT_CONFIG_DB $BACKUP_DIR
	fi
	
	if [ -d $BACKUP_DIR ] && [ $(stat -c "%a" $BACKUP_DIR) -eq 600 ] && [ -f $FCT_CONFIG ]; then
	    cp $FCT_CONFIG $BACKUP_DIR
	fi

	if [ -d $BACKUP_DIR ] && [ $(stat -c "%a" $BACKUP_DIR) -eq 600 ] && [ -f $EC_CONFIG ]; then
	    cp $EC_CONFIG $BACKUP_DIR
	fi
	exit 0
}

pre_upgrade () {
	# Remove old symlink when upgrading from older versions
	if [ -f /usr/bin/forticlient ]; then
		pkill -f /usr/bin/forticlient
		rm -rf /usr/bin/forticlient
	fi
	if [ -f /usr/bin/fortivpn ]; then
		pkill -f /usr/bin/fortivpn
		rm -rf /usr/bin/fortivpn
	fi
	if [ -f /etc/xdg/autostart/Fortitray.desktop ]; then
		rm -rf /etc/xdg/autostart/Fortitray.desktop
	fi
}

post_install() {

	# Remove old configuration files when upgrading from older versions
	if [ -f /etc/forticlient/config.xml ]; then
		rm -rf /etc/forticlient/config.xml
	fi

	if [ -f /etc/forticlient/config_backup.xml ]; then
		rm -rf /etc/forticlient/config_backup.xml
	fi

	# Remove old pid lock
	if [ -f /tmp/.forticlient/fortivpn.pid ]; then
		rm -rf /tmp/.forticlient/fortivpn.pid
	fi

	# Restore permissions to all files
	if [ -f /opt/forticlient/.repackaged ] && [ -f /opt/forticlient/.acl ]; then
	(
		cd /
		setfacl --restore /opt/forticlient/.acl
	)
	fi

	if [ -f /etc/forticlient/servers.conf ]; then
		chmod 600 /etc/forticlient/servers.conf
	fi

	# Keep old database when upgrading from older versions
	if [ ! -d /var/lib/forticlient ] || [ ! -O /var/lib/forticlient ]; then
		rm -rf /var/lib/forticlient
		mkdir -m 755 /var/lib/forticlient
	fi

	if [ -f /etc/forticlient/config.db ]; then
		if [ -O /etc/forticlient/config.db ]; then
			mv /etc/forticlient/config.db /var/lib/forticlient/config.db
		else
			# Old database cannot be trusted and should be replaced
			# So ems connection info is lost and fct has to register to ems again
			rm -f /etc/forticlient/config.db /opt/forticlient/.fct_ec_registered
		fi
	fi

	if [ ! -f /var/lib/forticlient/config.db ]; then
		cp /opt/forticlient/.config.db.init /var/lib/forticlient/config.db
	fi

	chmod 600 /var/lib/forticlient/config.db

	# Launch fortitray
	if [ -f /opt/forticlient/fortitraylauncher ]; then
		if [ ! -z "$(logname 2>/dev/null)" ]; then
			user="$(logname 2>/dev/null)"
		elif [ ! -z "$SUDO_USER" ]; then
			user="$SUDO_USER"
		else
			user=$(users 2>/dev/null | cut -d ' ' -f1)
		fi

		GUI_ENV=

		# Attempt to get the GUI environment variables so fortitray will actually display correctly
		for p in $(pgrep -u "$user" dbus-daemon); do
			if [ -z "$(xargs -0 -L1 -a /proc/$p/cmdline | grep '^--config-file=')" ]; then
				continue
			fi

			OIFS="$IFS"
			IFS=$'\n'
			for e in $(xargs -0 -L1 -a /proc/$p/environ); do
				IFS== read -r left right <<< "$e"
				GUI_ENV="$GUI_ENV $left=\"$right\""
			done
			IFS="$OIFS"

			break
		done

		FORTITRAY_CMD="env -i $GUI_ENV setsid /opt/forticlient/fortitraylauncher &>/dev/null &"

		# Start fortitraylauncher while forwarding environment variables needed by Fortitray
		su $user -c "$FORTITRAY_CMD"
	fi

	# Update icons cache so icon will show correctly
	if [ -f /usr/share/icons/hicolor/48x48/apps/forticlient.png ]; then
		gtk-update-icon-cache -f /usr/share/icons/hicolor || true
	fi

	# Setup forticlient protocol handler
	if [ -f /usr/share/applications/forticlient-register.desktop ]; then
		update-desktop-database
	fi
	# Reload systemd
	if [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload
	fi
}

post_upgrade() {
cat << EOF

	==> After upgrade, to restore your config, copy old file from /etc/forticlient/.old/ to /etc/forticlient/

EOF
}

pre_remove() {
	# Check if forticlient is registered to EMS if it's an uninstall
	if [ -f /opt/forticlient/.fct_ec_registered ]; then
		echo "============================================================="
		echo "Error: Unable to uninstall forticlient while connected to EMS"
		echo "============================================================="
		exit 1
	fi

	# Stop fortitray
	if [ -f /tmp/.forticlient/fortitraylauncher ]; then
		echo "terminate" > /tmp/.forticlient/fortitraylauncher || true
	fi

	# Remove ZTNA browser certificates
	if [ -f /usr/bin/certutil ]; then
		find /home /root -regextype posix-extended \
			-regex '(/home/[^/]*|/root)/(.pki/nssdb|.mozilla/firefox/[^/]*default(-release)?)' \
			-maxdepth 5 -print0 2>/dev/null |
		while IFS= read -r -d $'\0' p; do
			RUN_USER=$(stat -c '%U' "$p")

			if [ $? -ne 0 ]; then
				continue
			fi

			su - "$RUN_USER" -c '/usr/bin/certutil -D -n "FortiClient ZTNA" -d sql:'"$p"' 2>/dev/null || true'
			su - "$RUN_USER" -c '/usr/bin/modutil -delete "FortiClient ZTNA" -dbdir sql:'"$p"' -force 2>/dev/null || true'
		done
	fi

	# Remove token from tpm2 database
	if [ -f /opt/forticlient/tpm2/tpm2_ptool/exe.linux-x86_64-3.7/tpm2_ptool ] && \
	[ -d /opt/forticlient/tpm2/bin/ ]; then
		PATH="/opt/forticlient/tpm2/bin:$PATH" \
			/opt/forticlient/tpm2/tpm2_ptool/exe.linux-x86_64-3.7/tpm2_ptool rmtoken \
			--label fct-ztna-token --path /opt/forticlient/
	fi

	# Remove service
	if [ -d /run/systemd/system ]; then
		systemctl stop forticlient.service
	fi

	pkill -f /opt/forticlient
	exit 0
}

post_remove() {
	# Remove shared memory
	rm -rf /var/run/fctc.s || true

	# Remove Fortitray.desktop symlink
	rm -rf /etc/xdg/autostart/Fortitray.desktop || true

	# Remove fortitraylauncher fifo
	rm -rf /tmp/.forticlient/fortitraylauncher || true

	# Remove GUI symlink
	rm -rf /usr/bin/forticlient || true

	# Remove fortivpn symlink
	rm -rf /usr/bin/fortivpn || true

	# Remove FortiClient service
	rm -rf /lib/systemd/system/forticlient.service || true

	# Remove FortiClient binaries
	rm -rf /opt/forticlient || true

	# Remove config files and perserve uuid
	rm -rf /var/lib/forticlient || true
	find /etc/forticlient -type f -not -name 'custom_machine_id.conf' -delete

	# Remove log files
	rm -rf /var/log/forticlient || true

	# Remove fortitray policy
	rm -rf /usr/share/polkit-1/actions/org.fortinet.fortitray.policy || true

	# Remove forticlient policy
	rm -rf /usr/share/polkit-1/actions/org.fortinet.forticlient.policy || true

	exit 0
}