ci: use gh to download release asset

.github/workflows/build.yaml

@@ -14,6 +14,11 @@ on:
       - release/*
     tags:
       - v*.*.*
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # Include arm64 if ref is a tag
   setup-matrix:
@@ -62,6 +67,47 @@ jobs:
         path: |
           source/gp/.build/tarball/*.tar.gz
 
+  tarball-offline:
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest
+    needs:
+    - tarball
+    steps:
+    - uses: pnpm/action-setup@v2
+      with:
+        version: 8
+
+    - name: Prepare workspace
+      run: rm -rf source-offline && mkdir source-offline
+
+    - name: Download tarball
+      uses: actions/download-artifact@v3
+      with:
+        name: artifact-source
+        path: source-offline
+
+    - name: Create offline tarball
+      run: |
+        cd source-offline
+
+        offline_tarball=$(basename *.tar.gz .tar.gz).offline.tar.gz
+
+        # Extract the tarball
+        tar -xzf *.tar.gz
+
+        cd */
+        make tarball OFFLINE=1
+
+        # Rename the tarball to .offline.tar.gz
+        mv -v .build/tarball/*.tar.gz ../$offline_tarball
+
+    - name: Upload offline tarball
+      uses: actions/upload-artifact@v3
+      with:
+        path: source-offline/*.offline.tar.gz
+        name: artifact-source-offline
+        if-no-files-found: error
+
   build-gp:
     needs:
     - setup-matrix
@@ -89,13 +135,13 @@ jobs:
       run: |
         docker run --rm \
           -v $(pwd)/build-gp-${{ matrix.package }}:/${{ matrix.package }} \
-          yuezk/gpdev:${{ matrix.package }}-builder-tauri2
+          yuezk/gpdev:${{ matrix.package }}-builder
     - name: Install ${{ matrix.package }} package in Docker
       run: |
         docker run --rm \
           -e GPGUI_INSTALLED=0 \
           -v $(pwd)/build-gp-${{ matrix.package }}:/${{ matrix.package }} \
-          yuezk/gpdev:${{ matrix.package }}-builder-tauri2 \
+          yuezk/gpdev:${{ matrix.package }}-builder \
           bash install.sh
     - name: Upload ${{ matrix.package }} package
       uses: actions/upload-artifact@v3
@@ -141,12 +187,12 @@ jobs:
       run: echo ${{ secrets.DOCKER_HUB_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
     - name: Build gpgui in Docker
       run: |
-        docker run --rm -v $(pwd)/gpgui-source:/gpgui yuezk/gpdev:gpgui-builder-tauri2
+        docker run --rm -v $(pwd)/gpgui-source:/gpgui yuezk/gpdev:gpgui-builder
     - name: Install gpgui in Docker
       run: |
         cd gpgui-source
         tar -xJf *.bin.tar.xz
-        docker run --rm -v $(pwd):/gpgui yuezk/gpdev:gpgui-builder-tauri2 \
+        docker run --rm -v $(pwd):/gpgui yuezk/gpdev:gpgui-builder \
           bash -c "cd /gpgui/gpgui_*/ && ./gpgui --version"
     - name: Upload gpgui
       uses: actions/upload-artifact@v3
@@ -162,6 +208,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - tarball
+      - tarball-offline
       - build-gp
       - build-gpgui
 

.github/workflows/publish.yaml

@@ -52,40 +52,43 @@ jobs:
         version: 8
     - name: Prepare workspace
       run: rm -rf publish-ppa && mkdir publish-ppa
-    - name: Download ${{ inputs.tag }} source code
+    - name: Download ${{ inputs.tag }} offline source code
       uses: robinraju/release-downloader@v1.9
       with:
         token: ${{ secrets.GH_PAT }}
         tag: ${{ inputs.tag }}
-        fileName: globalprotect-openconnect-*.tar.gz
+        fileName: globalprotect-openconnect-*.offline.tar.gz
         tarBall: false
         zipBall: false
         out-file-path: publish-ppa
-    - name: Make the offline tarball
+    - name: Patch the source code
       run: |
         cd publish-ppa
-        tar -xf globalprotect-openconnect-*.tar.gz
-        cd globalprotect-openconnect-*/
 
-        make tarball OFFLINE=1
+        # Rename the source tarball without the offline suffix
+        mv *.tar.gz $(basename *.tar.gz .offline.tar.gz).tar.gz
+
+        # Extract the source tarball
+        tar -xzf *.tar.gz
 
         # Prepare the debian directory with custom files
+        cd globalprotect-openconnect-*/
+
         mkdir -p .build/debian
-        sed 's/@RUST@/rust-all(>=1.70)/g' packaging/deb/control.in > .build/debian/control
+        sed 's/@RUST@/rust-all(>=1.71)/g' packaging/deb/control.in > .build/debian/control
         sed 's/@OFFLINE@/1/g' packaging/deb/rules.in > .build/debian/rules
         cp packaging/deb/postrm .build/debian/postrm
 
     - name: Publish to PPA
-      uses: yuezk/publish-ppa-package@gp
+      uses: yuezk/publish-ppa-package@gp_2.3.x
       with:
         repository: "yuezk/globalprotect-openconnect"
         gpg_private_key: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
         gpg_passphrase: ${{ secrets.PPA_GPG_PASSPHRASE }}
-        tarball: publish-ppa/globalprotect-openconnect-*/.build/tarball/*.tar.gz
+        tarball: publish-ppa/globalprotect-openconnect-*.tar.gz
         debian_dir: publish-ppa/globalprotect-openconnect-*/.build/debian
         deb_email: "k3vinyue@gmail.com"
         deb_fullname: "Kevin Yue"
-        extra_ppa: "yuezk/globalprotect-openconnect liushuyu-011/rust-updates-1.80"
-        # Ubuntu 18.04 and 20.04 are excluded because tauri2 no longer supports them
-        excluded_series: "bionic focal"
+        extra_ppa: "yuezk/globalprotect-openconnect liushuyu-011/rust-bpo-1.75"
+        series: "bionic focal"
         revision: ${{ inputs.revision }}

.github/workflows/release.yaml

@@ -96,15 +96,16 @@ jobs:
     steps:
     - name: Prepare workspace
       run: rm -rf build-${{ matrix.package }} && mkdir -p build-${{ matrix.package }}
+
     - name: Download ${{ inputs.tag }} source code
-      uses: robinraju/release-downloader@v1.9
-      with:
-        token: ${{ secrets.GH_PAT }}
-        tag: ${{ inputs.tag }}
-        fileName: globalprotect-openconnect-*.tar.gz
-        tarBall: false
-        zipBall: false
-        out-file-path: build-${{ matrix.package }}
+      env:
+        GH_TOKEN: ${{ secrets.GH_PAT }}
+      run: |
+        gh -R yuezk/GlobalProtect-openconnect \
+          release download ${{ inputs.tag }} \
+          --pattern '*[^offline].tar.gz' \
+          --dir build-${{ matrix.package }}
+
     - name: Docker Login
       run: echo ${{ secrets.DOCKER_HUB_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
     - name: Build ${{ matrix.package }} package in Docker
@@ -112,13 +113,13 @@ jobs:
         docker run --rm \
           -v $(pwd)/build-${{ matrix.package }}:/${{ matrix.package }} \
           -e INCLUDE_GUI=1 \
-          yuezk/gpdev:${{ matrix.package }}-builder-tauri2
+          yuezk/gpdev:${{ matrix.package }}-builder
 
     - name: Install ${{ matrix.package }} package in Docker
       run: |
         docker run --rm \
           -v $(pwd)/build-${{ matrix.package }}:/${{ matrix.package }} \
-          yuezk/gpdev:${{ matrix.package }}-builder-tauri2 \
+          yuezk/gpdev:${{ matrix.package }}-builder \
           bash install.sh
 
     - name: Upload ${{ matrix.package }} package

.gitignore

@@ -8,6 +8,3 @@
 .cargo
 .build
 SNAPSHOT
-
-# Tauri generated files
-gen

Cargo.toml

@@ -1,11 +1,17 @@
 [workspace]
 resolver = "2"
 
-members = ["crates/*", "apps/gpclient", "apps/gpservice", "apps/gpauth", "apps/gpgui-helper/src-tauri"]
+members = [
+  "crates/*",
+  "apps/gpclient",
+  "apps/gpservice",
+  "apps/gpauth",
+  "apps/gpgui-helper/src-tauri",
+]
 
 [workspace.package]
-rust-version = "1.80"
-version = "2.3.9"
+rust-version = "1.71.1"
+version = "2.3.11"
 authors = ["Kevin Yue <k3vinyue@gmail.com>"]
 homepage = "https://github.com/yuezk/GlobalProtect-openconnect"
 edition = "2021"
@@ -14,7 +20,7 @@ license = "GPL-3.0"
 [workspace.dependencies]
 anyhow = "1.0"
 base64 = "0.22"
-clap = { version = "4", features = ["derive"] }
+clap = { version = "~4.4.2", features = ["derive"] }
 ctrlc = "3.4"
 directories = "5.0"
 dns-lookup = "2.0.4"
@@ -22,35 +28,37 @@ env_logger = "0.11"
 is_executable = "1.0"
 log = "0.4"
 regex = "1"
-reqwest = { version = "0.12", features = ["native-tls-vendored", "json"] }
+reqwest = { version = "0.11", features = ["native-tls-vendored", "json"] }
 openssl = "0.10"
 pem = "3"
 roxmltree = "0.20"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
-sysinfo = "0.33"
+sysinfo = "0.30"
 tempfile = "3.8"
-tokio = { version = "1", features = ["full"] }
+tokio = { version = "1" }
 tokio-util = "0.7"
 url = "2.4"
 urlencoding = "2.1.3"
 axum = "0.7"
 futures = "0.3"
 futures-util = "0.3"
-tokio-tungstenite = "0.20.1"
+tokio-tungstenite = "0.26.1"
 uzers = "0.12"
 whoami = "1"
 thiserror = "2"
 redact-engine = "0.1"
 compile-time = "0.2"
 serde_urlencoded = "0.7"
-md5="0.7"
-sha256="1"
-which="7"
+md5 = "0.7"
+sha256 = "1"
+which = "7"
 
 # Tauri dependencies
-tauri = { version = "2" }
-specta = "=2.0.0-rc.20"
+tauri = { version = "1" }
+specta = "=2.0.0-rc.1"
+specta-macros = "=2.0.0-rc.1"
+rspc = { version = "1.0.0-rc.5", features = ["tauri"] }
 
 [profile.release]
 opt-level = 'z'   # Optimize for size

Makefile

@@ -117,6 +117,10 @@ install:
 		install -Dm755 .build/gpgui/gpgui_*/gpgui $(DESTDIR)/usr/bin/gpgui; \
 	fi
 
+	# Install the disconnect hooks
+	install -Dm755 packaging/files/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down
+	install -Dm755 packaging/files/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook
+
 	install -Dm644 packaging/files/usr/share/applications/gpgui.desktop $(DESTDIR)/usr/share/applications/gpgui.desktop
 	install -Dm644 packaging/files/usr/share/icons/hicolor/scalable/apps/gpgui.svg $(DESTDIR)/usr/share/icons/hicolor/scalable/apps/gpgui.svg
 	install -Dm644 packaging/files/usr/share/icons/hicolor/32x32/apps/gpgui.png $(DESTDIR)/usr/share/icons/hicolor/32x32/apps/gpgui.png
@@ -133,6 +137,9 @@ uninstall:
 	rm -f $(DESTDIR)/usr/bin/gpgui-helper
 	rm -f $(DESTDIR)/usr/bin/gpgui
 
+	rm -f $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down
+	rm -f $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook
+
 	rm -f $(DESTDIR)/usr/share/applications/gpgui.desktop
 	rm -f $(DESTDIR)/usr/share/icons/hicolor/scalable/apps/gpgui.svg
 	rm -f $(DESTDIR)/usr/share/icons/hicolor/32x32/apps/gpgui.png

apps/gpauth/Cargo.toml

@@ -1,13 +1,12 @@
 [package]
 name = "gpauth"
-rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 
 [build-dependencies]
-tauri-build = { version = "2", features = [] }
+tauri-build = { version = "1.5", features = [] }
 
 [dependencies]
 gpapi = { path = "../../crates/gpapi", features = [
@@ -15,9 +14,6 @@ gpapi = { path = "../../crates/gpapi", features = [
   "clap",
   "browser-auth",
 ] }
-
-tauri = { workspace = true }
-
 anyhow.workspace = true
 clap.workspace = true
 env_logger.workspace = true
@@ -28,7 +24,6 @@ tokio.workspace = true
 tokio-util.workspace = true
 tempfile.workspace = true
 html-escape = "0.2.13"
+webkit2gtk = "0.18.2"
+tauri = { workspace = true, features = ["http-all"] }
 compile-time.workspace = true
-
-[target.'cfg(not(target_os = "macos"))'.dependencies]
-webkit2gtk = "2"

apps/gpauth/src/auth_messenger.rs

@@ -1,108 +0,0 @@
-use anyhow::bail;
-use gpapi::auth::SamlAuthData;
-use log::{error, info};
-use tokio::sync::{mpsc, RwLock};
-use tokio_util::sync::CancellationToken;
-
-pub enum AuthError {
-  /// Failed to load page due to TLS error
-  TlsError,
-  /// 1. Found auth data in headers/body but it's invalid
-  /// 2. Loaded an empty page, failed to load page. etc.
-  Invalid,
-  /// No auth data found in headers/body
-  NotFound,
-}
-
-pub type AuthResult = anyhow::Result<SamlAuthData, AuthError>;
-
-pub enum AuthEvent {
-  Data(SamlAuthData),
-  Error(AuthError),
-  RaiseWindow,
-  Close,
-}
-
-pub struct AuthMessenger {
-  tx: mpsc::UnboundedSender<AuthEvent>,
-  rx: RwLock<mpsc::UnboundedReceiver<AuthEvent>>,
-  raise_window_cancel_token: RwLock<Option<CancellationToken>>,
-}
-
-impl AuthMessenger {
-  pub fn new() -> Self {
-    let (tx, rx) = mpsc::unbounded_channel();
-
-    Self {
-      tx,
-      rx: RwLock::new(rx),
-      raise_window_cancel_token: Default::default(),
-    }
-  }
-
-  pub async fn subscribe(&self) -> anyhow::Result<AuthEvent> {
-    let mut rx = self.rx.write().await;
-    if let Some(event) = rx.recv().await {
-      return Ok(event);
-    }
-    bail!("Failed to receive auth event");
-  }
-
-  pub fn send_auth_event(&self, event: AuthEvent) {
-    if let Err(event) = self.tx.send(event) {
-      error!("Failed to send auth event: {}", event);
-    }
-  }
-
-  pub fn send_auth_result(&self, result: AuthResult) {
-    match result {
-      Ok(data) => self.send_auth_data(data),
-      Err(err) => self.send_auth_error(err),
-    }
-  }
-
-  pub fn send_auth_error(&self, err: AuthError) {
-    self.send_auth_event(AuthEvent::Error(err));
-  }
-
-  pub fn send_auth_data(&self, data: SamlAuthData) {
-    self.send_auth_event(AuthEvent::Data(data));
-  }
-
-  pub fn schedule_raise_window(&self, delay: u64) {
-    let cancel_token = CancellationToken::new();
-    let cancel_token_clone = cancel_token.clone();
-
-    if let Ok(mut guard) = self.raise_window_cancel_token.try_write() {
-      // Cancel the previous raise window task if it exists
-      if let Some(token) = guard.take() {
-        token.cancel();
-      }
-      *guard = Some(cancel_token_clone);
-    }
-
-    let tx = self.tx.clone();
-    tokio::spawn(async move {
-      info!("Displaying the window in {} second(s)...", delay);
-
-      tokio::select! {
-        _ = tokio::time::sleep(tokio::time::Duration::from_secs(delay)) => {
-          if let Err(err) = tx.send(AuthEvent::RaiseWindow) {
-            error!("Failed to send raise window event: {}", err);
-          }
-        }
-        _ = cancel_token.cancelled() => {
-          info!("Cancelled raise window task");
-        }
-      }
-    });
-  }
-
-  pub fn cancel_raise_window(&self) {
-    if let Ok(mut cancel_token) = self.raise_window_cancel_token.try_write() {
-      if let Some(token) = cancel_token.take() {
-        token.cancel();
-      }
-    }
-  }
-}

apps/gpauth/src/auth_window.rs

@@ -1,8 +1,5 @@
 use std::{
-  borrow::Cow,
-  env::temp_dir,
-  fs,
-  os::unix::fs::PermissionsExt,
+  rc::Rc,
   sync::Arc,
   time::{Duration, Instant},
 };
@@ -10,278 +7,517 @@ use std::{
 use anyhow::bail;
 use gpapi::{
   auth::SamlAuthData,
-  error::PortalError,
+  error::AuthDataParseError,
   gp_params::GpParams,
   portal::{prelogin, Prelogin},
-  process::browser_authenticator::BrowserAuthenticator,
-  utils::window::WindowExt,
-  GP_CALLBACK_PORT_FILENAME,
+  utils::{redact::redact_uri, window::WindowExt},
 };
 use log::{info, warn};
-use tauri::{AppHandle, WebviewUrl, WebviewWindow, WindowEvent};
-use tokio::{
-  io::AsyncReadExt,
-  net::TcpListener,
-  sync::{oneshot, RwLock},
-  time,
+use regex::Regex;
+use tauri::{AppHandle, Window, WindowEvent, WindowUrl};
+use tokio::sync::{mpsc, oneshot, RwLock};
+use tokio_util::sync::CancellationToken;
+use webkit2gtk::{
+  gio::Cancellable,
+  glib::{GString, TimeSpan},
+  LoadEvent, SettingsExt, TLSErrorsPolicy, URIResponse, URIResponseExt, WebContextExt, WebResource, WebResourceExt,
+  WebView, WebViewExt, WebsiteDataManagerExtManual, WebsiteDataTypes,
 };
 
-use crate::{
-  auth_messenger::{AuthError, AuthEvent, AuthMessenger},
-  common::{AuthRequest, AuthSettings},
-  platform_impl,
-};
+enum AuthDataError {
+  /// Failed to load page due to TLS error
+  TlsError,
+  /// 1. Found auth data in headers/body but it's invalid
+  /// 2. Loaded an empty page, failed to load page. etc.
+  Invalid,
+  /// No auth data found in headers/body
+  NotFound,
+}
 
-pub struct AuthWindow<'a> {
+type AuthResult = Result<SamlAuthData, AuthDataError>;
+
+pub(crate) struct AuthWindow<'a> {
+  app_handle: AppHandle,
   server: &'a str,
-  gp_params: &'a GpParams,
-  auth_request: Option<&'a str>,
+  saml_request: &'a str,
+  user_agent: &'a str,
+  gp_params: Option<GpParams>,
   clean: bool,
-  is_retrying: RwLock<bool>,
 }
 
 impl<'a> AuthWindow<'a> {
-  pub fn new(server: &'a str, gp_params: &'a GpParams) -> Self {
+  pub fn new(app_handle: AppHandle) -> Self {
     Self {
-      server,
-      gp_params,
-      auth_request: None,
+      app_handle,
+      server: "",
+      saml_request: "",
+      user_agent: "",
+      gp_params: None,
       clean: false,
-      is_retrying: Default::default(),
     }
   }
 
-  pub fn with_auth_request(mut self, auth_request: &'a str) -> Self {
-    if !auth_request.is_empty() {
-      self.auth_request = Some(auth_request);
-    }
+  pub fn server(mut self, server: &'a str) -> Self {
+    self.server = server;
     self
   }
 
-  pub fn with_clean(mut self, clean: bool) -> Self {
+  pub fn saml_request(mut self, saml_request: &'a str) -> Self {
+    self.saml_request = saml_request;
+    self
+  }
+
+  pub fn user_agent(mut self, user_agent: &'a str) -> Self {
+    self.user_agent = user_agent;
+    self
+  }
+
+  pub fn gp_params(mut self, gp_params: GpParams) -> Self {
+    self.gp_params.replace(gp_params);
+    self
+  }
+
+  pub fn clean(mut self, clean: bool) -> Self {
     self.clean = clean;
     self
   }
 
-  pub async fn browser_authenticate(&self, browser: Option<&str>) -> anyhow::Result<SamlAuthData> {
-    let auth_request = self.initial_auth_request().await?;
-    let browser_auth = if let Some(browser) = browser {
-      BrowserAuthenticator::new_with_browser(&auth_request, browser)
-    } else {
-      BrowserAuthenticator::new(&auth_request)
-    };
+  pub async fn open(&self) -> anyhow::Result<SamlAuthData> {
+    info!("Open auth window, user_agent: {}", self.user_agent);
 
-    browser_auth.authenticate()?;
-    info!("Please continue the authentication process in the default browser");
-
-    wait_auth_data().await
-  }
-
-  pub async fn webview_authenticate(&self, app_handle: &AppHandle) -> anyhow::Result<SamlAuthData> {
-    let auth_window = WebviewWindow::builder(app_handle, "auth_window", WebviewUrl::default())
+    let window = Window::builder(&self.app_handle, "auth_window", WindowUrl::default())
       .title("GlobalProtect Login")
+      // .user_agent(self.user_agent)
       .focused(true)
       .visible(false)
       .center()
       .build()?;
 
-    self.auth_loop(&auth_window).await
+    let window = Arc::new(window);
+
+    let cancel_token = CancellationToken::new();
+    let cancel_token_clone = cancel_token.clone();
+
+    window.on_window_event(move |event| {
+      if let WindowEvent::CloseRequested { .. } = event {
+        cancel_token_clone.cancel();
+      }
+    });
+
+    let window_clone = Arc::clone(&window);
+    let timeout_secs = 15;
+    tokio::spawn(async move {
+      tokio::time::sleep(Duration::from_secs(timeout_secs)).await;
+      let visible = window_clone.is_visible().unwrap_or(false);
+      if !visible {
+        info!("Try to raise auth window after {} seconds", timeout_secs);
+        raise_window(&window_clone);
+      }
+    });
+
+    tokio::select! {
+      _ = cancel_token.cancelled() => {
+        bail!("Auth cancelled");
+      }
+      saml_result = self.auth_loop(&window) => {
+        window.close()?;
+        saml_result
+      }
+    }
   }
 
-  async fn auth_loop(&self, auth_window: &WebviewWindow) -> anyhow::Result<SamlAuthData> {
+  async fn auth_loop(&self, window: &Arc<Window>) -> anyhow::Result<SamlAuthData> {
+    let saml_request = self.saml_request.to_string();
+    let (auth_result_tx, mut auth_result_rx) = mpsc::unbounded_channel::<AuthResult>();
+    let raise_window_cancel_token: Arc<RwLock<Option<CancellationToken>>> = Default::default();
+    let gp_params = self.gp_params.as_ref().unwrap();
+    let tls_err_policy = if gp_params.ignore_tls_errors() {
+      TLSErrorsPolicy::Ignore
+    } else {
+      TLSErrorsPolicy::Fail
+    };
+
     if self.clean {
-      self.clear_webview_data(&auth_window).await?;
+      clear_webview_cookies(window).await?;
     }
 
-    let auth_messenger = self.setup_auth_window(&auth_window).await?;
+    let raise_window_cancel_token_clone = Arc::clone(&raise_window_cancel_token);
+    window.with_webview(move |wv| {
+      let wv = wv.inner();
+
+      if let Some(context) = wv.context() {
+        context.set_tls_errors_policy(tls_err_policy);
+      }
+
+      if let Some(settings) = wv.settings() {
+        let ua = settings.user_agent().unwrap_or("".into());
+        info!("Auth window user agent: {}", ua);
+      }
+
+      // Load the initial SAML request
+      load_saml_request(&wv, &saml_request);
+
+      let auth_result_tx_clone = auth_result_tx.clone();
+      wv.connect_load_changed(move |wv, event| {
+        if event == LoadEvent::Started {
+          let Ok(mut cancel_token) = raise_window_cancel_token_clone.try_write() else {
+            return;
+          };
+
+          // Cancel the raise window task
+          if let Some(cancel_token) = cancel_token.take() {
+            cancel_token.cancel();
+          }
+          return;
+        }
+
+        if event != LoadEvent::Finished {
+          return;
+        }
+
+        if let Some(main_resource) = wv.main_resource() {
+          let uri = main_resource.uri().unwrap_or("".into());
+
+          if uri.is_empty() {
+            warn!("Loaded an empty uri");
+            send_auth_result(&auth_result_tx_clone, Err(AuthDataError::Invalid));
+            return;
+          }
+
+          info!("Loaded uri: {}", redact_uri(&uri));
+          if uri.starts_with("globalprotectcallback:") {
+            return;
+          }
+
+          read_auth_data(&main_resource, auth_result_tx_clone.clone());
+        }
+      });
+
+      let auth_result_tx_clone = auth_result_tx.clone();
+      wv.connect_load_failed_with_tls_errors(move |_wv, uri, cert, err| {
+        let redacted_uri = redact_uri(uri);
+        warn!(
+          "Failed to load uri: {} with error: {}, cert: {}",
+          redacted_uri, err, cert
+        );
+
+        send_auth_result(&auth_result_tx_clone, Err(AuthDataError::TlsError));
+        true
+      });
+
+      wv.connect_load_failed(move |_wv, _event, uri, err| {
+        let redacted_uri = redact_uri(uri);
+        if !uri.starts_with("globalprotectcallback:") {
+          warn!("Failed to load uri: {} with error: {}", redacted_uri, err);
+        }
+        // NOTE: Don't send error here, since load_changed event will be triggered after this
+        // send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
+        // true to stop other handlers from being invoked for the event. false to propagate the event further.
+        true
+      });
+    })?;
+
+    let portal = self.server.to_string();
 
     loop {
-      match auth_messenger.subscribe().await? {
-        AuthEvent::Close => bail!("Authentication cancelled"),
-        AuthEvent::RaiseWindow => self.raise_window(auth_window),
-        AuthEvent::Error(AuthError::TlsError) => bail!(PortalError::TlsError),
-        AuthEvent::Error(AuthError::NotFound) => self.handle_not_found(auth_window, &auth_messenger),
-        AuthEvent::Error(AuthError::Invalid) => self.retry_auth(auth_window).await,
-        AuthEvent::Data(auth_data) => {
-          auth_window.close()?;
-          return Ok(auth_data);
+      if let Some(auth_result) = auth_result_rx.recv().await {
+        match auth_result {
+          Ok(auth_data) => return Ok(auth_data),
+          Err(AuthDataError::TlsError) => bail!("TLS error: certificate verify failed"),
+          Err(AuthDataError::NotFound) => {
+            info!("No auth data found, it may not be the /SAML20/SP/ACS endpoint");
+
+            // The user may need to interact with the auth window, raise it in 3 seconds
+            if !window.is_visible().unwrap_or(false) {
+              let window = Arc::clone(window);
+              let cancel_token = CancellationToken::new();
+
+              raise_window_cancel_token.write().await.replace(cancel_token.clone());
+
+              tokio::spawn(async move {
+                let delay_secs = 1;
+
+                info!("Raise window in {} second(s)", delay_secs);
+                tokio::select! {
+                  _ = tokio::time::sleep(Duration::from_secs(delay_secs)) => {
+                    raise_window(&window);
+                  }
+                  _ = cancel_token.cancelled() => {
+                    info!("Raise window cancelled");
+                  }
+                }
+              });
+            }
+          }
+          Err(AuthDataError::Invalid) => {
+            info!("Got invalid auth data, retrying...");
+
+            window.with_webview(|wv| {
+              let wv = wv.inner();
+              wv.run_javascript(r#"
+                  var loading = document.createElement("div");
+                  loading.innerHTML = '<div style="position: absolute; width: 100%; text-align: center; font-size: 20px; font-weight: bold; top: 50%; left: 50%; transform: translate(-50%, -50%);">Got invalid token, retrying...</div>';
+                  loading.style = "position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(255, 255, 255, 0.85); z-index: 99999;";
+                  document.body.appendChild(loading);
+              "#,
+                  Cancellable::NONE,
+                  |_| info!("Injected loading element successfully"),
+              );
+            })?;
+
+            let saml_request = portal_prelogin(&portal, gp_params).await?;
+            window.with_webview(move |wv| {
+              let wv = wv.inner();
+              load_saml_request(&wv, &saml_request);
+            })?;
+          }
         }
       }
     }
   }
+}
 
-  async fn initial_auth_request(&self) -> anyhow::Result<Cow<'a, str>> {
-    if let Some(auth_request) = self.auth_request {
-      return Ok(Cow::Borrowed(auth_request));
-    }
-
-    let auth_request = portal_prelogin(&self.server, &self.gp_params).await?;
-    Ok(Cow::Owned(auth_request))
-  }
-
-  async fn clear_webview_data(&self, auth_window: &WebviewWindow) -> anyhow::Result<()> {
-    info!("Clearing webview data...");
-
-    let (tx, rx) = oneshot::channel::<anyhow::Result<()>>();
-    let now = Instant::now();
-    auth_window.with_webview(|webview| {
-      platform_impl::clear_data(&webview.inner(), |result| {
-        if let Err(result) = tx.send(result) {
-          warn!("Failed to send clear data result: {:?}", result);
-        }
-      })
-    })?;
-
-    rx.await??;
-    info!("Webview data cleared in {:?}", now.elapsed());
-
-    Ok(())
-  }
-
-  async fn setup_auth_window(&self, auth_window: &WebviewWindow) -> anyhow::Result<Arc<AuthMessenger>> {
-    info!("Setting up auth window...");
-
-    let auth_messenger = Arc::new(AuthMessenger::new());
-    let auth_request = self.initial_auth_request().await?.into_owned();
-    let ignore_tls_errors = self.gp_params.ignore_tls_errors();
-
-    // Handle window close event
-    let auth_messenger_clone = Arc::clone(&auth_messenger);
-    auth_window.on_window_event(move |event| {
-      if let WindowEvent::CloseRequested { .. } = event {
-        auth_messenger_clone.send_auth_event(AuthEvent::Close);
-      }
-    });
-
-    // Show the window after 10 seconds, so that the user can see the window if the auth process is stuck
-    let auth_messenger_clone = Arc::clone(&auth_messenger);
-    tokio::spawn(async move {
-      time::sleep(Duration::from_secs(10)).await;
-      auth_messenger_clone.send_auth_event(AuthEvent::RaiseWindow);
-    });
-
-    // setup webview
-    let auth_messenger_clone = Arc::clone(&auth_messenger);
-    let (tx, rx) = oneshot::channel::<anyhow::Result<()>>();
-
-    auth_window.with_webview(move |webview| {
-      let auth_settings = AuthSettings {
-        auth_request: AuthRequest::new(&auth_request),
-        auth_messenger: auth_messenger_clone,
-        ignore_tls_errors,
-      };
-
-      let result = platform_impl::setup_webview(&webview.inner(), auth_settings);
-      if let Err(result) = tx.send(result) {
-        warn!("Failed to send setup auth window result: {:?}", result);
-      }
-    })?;
-
-    rx.await??;
-    info!("Auth window setup completed");
-
-    Ok(auth_messenger)
-  }
-
-  fn handle_not_found(&self, auth_window: &WebviewWindow, auth_messenger: &Arc<AuthMessenger>) {
-    info!("No auth data found, it may not be the /SAML20/SP/ACS endpoint");
-
-    let visible = auth_window.is_visible().unwrap_or(false);
-    if visible {
-      return;
-    }
-
-    auth_messenger.schedule_raise_window(1);
-  }
-
-  async fn retry_auth(&self, auth_window: &WebviewWindow) {
-    let mut is_retrying = self.is_retrying.write().await;
-    if *is_retrying {
-      info!("Already retrying authentication, skipping...");
-      return;
-    }
-
-    *is_retrying = true;
-    drop(is_retrying);
-
-    if let Err(err) = self.retry_auth_impl(auth_window).await {
-      warn!("Failed to retry authentication: {}", err);
-    }
-
-    *self.is_retrying.write().await = false;
-  }
-
-  async fn retry_auth_impl(&self, auth_window: &WebviewWindow) -> anyhow::Result<()> {
-    info!("Retrying authentication...");
-
-    auth_window.eval( r#"
-      var loading = document.createElement("div");
-      loading.innerHTML = '<div style="position: absolute; width: 100%; text-align: center; font-size: 20px; font-weight: bold; top: 50%; left: 50%; transform: translate(-50%, -50%);">Got invalid token, retrying...</div>';
-      loading.style = "position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(255, 255, 255, 0.85); z-index: 99999;";
-      document.body.appendChild(loading);
-    "#)?;
-
-    let auth_request = portal_prelogin(&self.server, &self.gp_params).await?;
-    let (tx, rx) = oneshot::channel::<()>();
-    auth_window.with_webview(move |webview| {
-      let auth_request = AuthRequest::new(&auth_request);
-      platform_impl::load_auth_request(&webview.inner(), &auth_request);
-
-      tx.send(()).expect("Failed to send message to the channel")
-    })?;
-
-    rx.await?;
-    Ok(())
-  }
-
-  fn raise_window(&self, auth_window: &WebviewWindow) {
-    let visible = auth_window.is_visible().unwrap_or(false);
-    if visible {
-      return;
-    }
-
-    info!("Raising auth window...");
-    if let Err(err) = auth_window.raise() {
+fn raise_window(window: &Arc<Window>) {
+  let visible = window.is_visible().unwrap_or(false);
+  if !visible {
+    if let Err(err) = window.raise() {
       warn!("Failed to raise window: {}", err);
     }
   }
 }
 
-async fn portal_prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<String> {
+pub async fn portal_prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<String> {
   match prelogin(portal, gp_params).await? {
     Prelogin::Saml(prelogin) => Ok(prelogin.saml_request().to_string()),
     Prelogin::Standard(_) => bail!("Received non-SAML prelogin response"),
   }
 }
 
-async fn wait_auth_data() -> anyhow::Result<SamlAuthData> {
-  // Start a local server to receive the browser authentication data
-  let listener = TcpListener::bind("127.0.0.1:0").await?;
-  let port = listener.local_addr()?.port();
-  let port_file = temp_dir().join(GP_CALLBACK_PORT_FILENAME);
-
-  // Write the port to a file
-  fs::write(&port_file, port.to_string())?;
-  fs::set_permissions(&port_file, fs::Permissions::from_mode(0o600))?;
-
-  // Remove the previous log file
-  let callback_log = temp_dir().join("gpcallback.log");
-  let _ = fs::remove_file(&callback_log);
-
-  info!("Listening authentication data on port {}", port);
-  info!(
-    "If it hangs, please check the logs at `{}` for more information",
-    callback_log.display()
-  );
-  let (mut socket, _) = listener.accept().await?;
-
-  info!("Received the browser authentication data from the socket");
-  let mut data = String::new();
-  socket.read_to_string(&mut data).await?;
-
-  // Remove the port file
-  fs::remove_file(&port_file)?;
-
-  let auth_data = SamlAuthData::from_gpcallback(&data)?;
-  Ok(auth_data)
+fn send_auth_result(auth_result_tx: &mpsc::UnboundedSender<AuthResult>, auth_result: AuthResult) {
+  if let Err(err) = auth_result_tx.send(auth_result) {
+    warn!("Failed to send auth event: {}", err);
+  }
+}
+
+fn load_saml_request(wv: &Rc<WebView>, saml_request: &str) {
+  if saml_request.starts_with("http") {
+    info!("Load the SAML request as URI...");
+    wv.load_uri(saml_request);
+  } else {
+    info!("Load the SAML request as HTML...");
+    wv.load_html(saml_request, None);
+  }
+}
+
+fn read_auth_data_from_headers(response: &URIResponse) -> AuthResult {
+  response.http_headers().map_or_else(
+    || {
+      info!("No headers found in response");
+      Err(AuthDataError::NotFound)
+    },
+    |mut headers| match headers.get("saml-auth-status") {
+      Some(status) if status == "1" => {
+        let username = headers.get("saml-username").map(GString::into);
+        let prelogin_cookie = headers.get("prelogin-cookie").map(GString::into);
+        let portal_userauthcookie = headers.get("portal-userauthcookie").map(GString::into);
+
+        if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
+          return Ok(SamlAuthData::new(
+            username.unwrap(),
+            prelogin_cookie,
+            portal_userauthcookie,
+          ));
+        }
+
+        info!("Found invalid auth data in headers");
+        Err(AuthDataError::Invalid)
+      }
+      Some(status) => {
+        info!("Found invalid SAML status: {} in headers", status);
+        Err(AuthDataError::Invalid)
+      }
+      None => {
+        info!("No saml-auth-status header found");
+        Err(AuthDataError::NotFound)
+      }
+    },
+  )
+}
+
+fn read_auth_data_from_body<F>(main_resource: &WebResource, callback: F)
+where
+  F: FnOnce(Result<SamlAuthData, AuthDataParseError>) + Send + 'static,
+{
+  main_resource.data(Cancellable::NONE, |data| match data {
+    Ok(data) => {
+      let html = String::from_utf8_lossy(&data);
+      callback(read_auth_data_from_html(&html));
+    }
+    Err(err) => {
+      info!("Failed to read response body: {}", err);
+      callback(Err(AuthDataParseError::Invalid))
+    }
+  });
+}
+
+fn read_auth_data_from_html(html: &str) -> Result<SamlAuthData, AuthDataParseError> {
+  if html.contains("Temporarily Unavailable") {
+    info!("Found 'Temporarily Unavailable' in HTML, auth failed");
+    return Err(AuthDataParseError::Invalid);
+  }
+
+  SamlAuthData::from_html(html).or_else(|err| {
+    if let Some(gpcallback) = extract_gpcallback(html) {
+      info!("Found gpcallback from html...");
+      SamlAuthData::from_gpcallback(&gpcallback)
+    } else {
+      Err(err)
+    }
+  })
+}
+
+fn extract_gpcallback(html: &str) -> Option<String> {
+  let re = Regex::new(r#"globalprotectcallback:[^"]+"#).unwrap();
+  re.captures(html)
+    .and_then(|captures| captures.get(0))
+    .map(|m| html_escape::decode_html_entities(m.as_str()).to_string())
+}
+
+fn read_auth_data(main_resource: &WebResource, auth_result_tx: mpsc::UnboundedSender<AuthResult>) {
+  let Some(response) = main_resource.response() else {
+    info!("No response found in main resource");
+    send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
+    return;
+  };
+
+  info!("Trying to read auth data from response headers...");
+
+  match read_auth_data_from_headers(&response) {
+    Ok(auth_data) => {
+      info!("Got auth data from headers");
+      send_auth_result(&auth_result_tx, Ok(auth_data));
+    }
+    Err(AuthDataError::Invalid) => {
+      info!("Found invalid auth data in headers, trying to read from body...");
+      read_auth_data_from_body(main_resource, move |auth_result| {
+        // Since we have already found invalid auth data in headers, which means this could be the `/SAML20/SP/ACS` endpoint
+        // any error result from body should be considered as invalid, and trigger a retry
+        let auth_result = auth_result.map_err(|err| {
+          info!("Failed to read auth data from body: {}", err);
+          AuthDataError::Invalid
+        });
+        send_auth_result(&auth_result_tx, auth_result);
+      });
+    }
+    Err(AuthDataError::NotFound) => {
+      info!("No auth data found in headers, trying to read from body...");
+
+      let is_acs_endpoint = main_resource.uri().map_or(false, |uri| uri.contains("/SAML20/SP/ACS"));
+
+      read_auth_data_from_body(main_resource, move |auth_result| {
+        // If the endpoint is `/SAML20/SP/ACS` and no auth data found in body, it should be considered as invalid
+        let auth_result = auth_result.map_err(|err| {
+          info!("Failed to read auth data from body: {}", err);
+
+          if !is_acs_endpoint && matches!(err, AuthDataParseError::NotFound) {
+            AuthDataError::NotFound
+          } else {
+            AuthDataError::Invalid
+          }
+        });
+
+        send_auth_result(&auth_result_tx, auth_result)
+      });
+    }
+    Err(AuthDataError::TlsError) => {
+      // NOTE: This is unreachable
+      info!("TLS error found in headers, trying to read from body...");
+      send_auth_result(&auth_result_tx, Err(AuthDataError::TlsError));
+    }
+  }
+}
+
+pub(crate) async fn clear_webview_cookies(window: &Window) -> anyhow::Result<()> {
+  let (tx, rx) = oneshot::channel::<Result<(), String>>();
+
+  window.with_webview(|wv| {
+    let send_result = move |result: Result<(), String>| {
+      if let Err(err) = tx.send(result) {
+        info!("Failed to send result: {:?}", err);
+      }
+    };
+
+    let wv = wv.inner();
+    let context = match wv.context() {
+      Some(context) => context,
+      None => {
+        send_result(Err("No webview context found".into()));
+        return;
+      }
+    };
+    let data_manager = match context.website_data_manager() {
+      Some(manager) => manager,
+      None => {
+        send_result(Err("No data manager found".into()));
+        return;
+      }
+    };
+
+    let now = Instant::now();
+    data_manager.clear(
+      WebsiteDataTypes::COOKIES,
+      TimeSpan(0),
+      Cancellable::NONE,
+      move |result| match result {
+        Err(err) => {
+          send_result(Err(err.to_string()));
+        }
+        Ok(_) => {
+          info!("Cookies cleared in {} ms", now.elapsed().as_millis());
+          send_result(Ok(()));
+        }
+      },
+    );
+  })?;
+
+  rx.await?.map_err(|err| anyhow::anyhow!(err))
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn extract_gpcallback_some() {
+    let html = r#"
+      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
+      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
+    "#;
+
+    assert_eq!(
+      extract_gpcallback(html).as_deref(),
+      Some("globalprotectcallback:PGh0bWw+PCEtLSA8c")
+    );
+  }
+
+  #[test]
+  fn extract_gpcallback_cas() {
+    let html = r#"
+      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:cas-as=1&amp;un=xyz@email.com&amp;token=very_long_string">
+    "#;
+
+    assert_eq!(
+      extract_gpcallback(html).as_deref(),
+      Some("globalprotectcallback:cas-as=1&un=xyz@email.com&token=very_long_string")
+    );
+  }
+
+  #[test]
+  fn extract_gpcallback_none() {
+    let html = r#"
+      <meta http-equiv="refresh" content="0; URL=PGh0bWw+PCEtLSA8c">
+    "#;
+
+    assert_eq!(extract_gpcallback(html), None);
+  }
 }

apps/gpauth/src/cli.rs

@@ -1,16 +1,21 @@
+use std::{env::temp_dir, fs, os::unix::fs::PermissionsExt};
+
 use clap::Parser;
 use gpapi::{
   auth::{SamlAuthData, SamlAuthResult},
-  clap::{args::Os, handle_error, Args},
+  clap::args::Os,
   gp_params::{ClientOs, GpParams},
-  utils::{env_utils, normalize_server, openssl},
+  process::browser_authenticator::BrowserAuthenticator,
+  utils::{normalize_server, openssl},
   GP_USER_AGENT,
 };
-use gpauth::auth_window::AuthWindow;
 use log::{info, LevelFilter};
 use serde_json::json;
-use tauri::RunEvent;
+use tauri::{App, AppHandle, RunEvent};
 use tempfile::NamedTempFile;
+use tokio::{io::AsyncReadExt, net::TcpListener};
+
+use crate::auth_window::{portal_prelogin, AuthWindow};
 
 const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), " (", compile_time::date_str!(), ")");
 
@@ -73,19 +78,74 @@ struct Cli {
   browser: Option<String>,
 }
 
-impl Args for Cli {
-  fn fix_openssl(&self) -> bool {
-    self.fix_openssl
-  }
-
-  fn ignore_tls_errors(&self) -> bool {
-    self.ignore_tls_errors
-  }
-}
-
 impl Cli {
+  async fn run(&mut self) -> anyhow::Result<()> {
+    if self.ignore_tls_errors {
+      info!("TLS errors will be ignored");
+    }
+
+    let mut openssl_conf = self.prepare_env()?;
+
+    self.server = normalize_server(&self.server)?;
+    let gp_params = self.build_gp_params();
+
+    // Get the initial SAML request
+    let saml_request = match self.saml_request {
+      Some(ref saml_request) => saml_request.clone(),
+      None => portal_prelogin(&self.server, &gp_params).await?,
+    };
+
+    let browser_auth = if let Some(browser) = &self.browser {
+      Some(BrowserAuthenticator::new_with_browser(&saml_request, browser))
+    } else if self.default_browser {
+      Some(BrowserAuthenticator::new(&saml_request))
+    } else {
+      None
+    };
+
+    if let Some(browser_auth) = browser_auth {
+      browser_auth.authenticate()?;
+
+      info!("Please continue the authentication process in the default browser");
+
+      let auth_result = match wait_auth_data().await {
+        Ok(auth_data) => SamlAuthResult::Success(auth_data),
+        Err(err) => SamlAuthResult::Failure(format!("{}", err)),
+      };
+
+      info!("Authentication completed");
+
+      println!("{}", json!(auth_result));
+
+      return Ok(());
+    }
+
+    self.saml_request.replace(saml_request);
+
+    let app = create_app(self.clone())?;
+
+    app.run(move |_app_handle, event| {
+      if let RunEvent::Exit = event {
+        if let Some(file) = openssl_conf.take() {
+          if let Err(err) = file.close() {
+            info!("Error closing OpenSSL config file: {}", err);
+          }
+        }
+      }
+    });
+
+    Ok(())
+  }
+
   fn prepare_env(&self) -> anyhow::Result<Option<NamedTempFile>> {
-    env_utils::patch_gui_runtime_env(self.hidpi);
+    std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
+
+    if self.hidpi {
+      info!("Setting GDK_SCALE=2 and GDK_DPI_SCALE=0.5");
+
+      std::env::set_var("GDK_SCALE", "2");
+      std::env::set_var("GDK_DPI_SCALE", "0.5");
+    }
 
     if self.fix_openssl {
       info!("Fixing OpenSSL environment");
@@ -97,64 +157,6 @@ impl Cli {
     Ok(None)
   }
 
-  async fn run(&self) -> anyhow::Result<()> {
-    if self.ignore_tls_errors {
-      info!("TLS errors will be ignored");
-    }
-
-    let mut openssl_conf = self.prepare_env()?;
-
-    let server = normalize_server(&self.server)?;
-    let server: &'static str = Box::leak(server.into_boxed_str());
-    let gp_params: &'static GpParams = Box::leak(Box::new(self.build_gp_params()));
-
-    let auth_request = self.saml_request.clone().unwrap_or_default();
-    let auth_request: &'static str = Box::leak(Box::new(auth_request));
-
-    let auth_window = AuthWindow::new(&server, gp_params)
-      .with_auth_request(&auth_request)
-      .with_clean(self.clean);
-
-    let browser = if let Some(browser) = self.browser.as_deref() {
-      Some(browser)
-    } else if self.default_browser {
-      Some("default")
-    } else {
-      None
-    };
-
-    if browser.is_some() {
-      let auth_result = auth_window.browser_authenticate(browser).await;
-      print_auth_result(auth_result);
-
-      return Ok(());
-    }
-
-    tauri::Builder::default()
-      .setup(move |app| {
-        let app_handle = app.handle().clone();
-
-        tauri::async_runtime::spawn(async move {
-          let auth_result = auth_window.webview_authenticate(&app_handle).await;
-          print_auth_result(auth_result);
-        });
-
-        Ok(())
-      })
-      .build(tauri::generate_context!())?
-      .run(move |_app_handle, event| {
-        if let RunEvent::Exit = event {
-          if let Some(file) = openssl_conf.take() {
-            if let Err(err) = file.close() {
-              info!("Error closing OpenSSL config file: {}", err);
-            }
-          }
-        }
-      });
-
-    Ok(())
-  }
-
   fn build_gp_params(&self) -> GpParams {
     let gp_params = GpParams::builder()
       .user_agent(&self.user_agent)
@@ -166,6 +168,37 @@ impl Cli {
 
     gp_params
   }
+
+  async fn saml_auth(&self, app_handle: AppHandle) -> anyhow::Result<SamlAuthData> {
+    let auth_window = AuthWindow::new(app_handle)
+      .server(&self.server)
+      .user_agent(&self.user_agent)
+      .gp_params(self.build_gp_params())
+      .saml_request(self.saml_request.as_ref().unwrap())
+      .clean(self.clean);
+
+    auth_window.open().await
+  }
+}
+
+fn create_app(cli: Cli) -> anyhow::Result<App> {
+  let app = tauri::Builder::default()
+    .setup(|app| {
+      let app_handle = app.handle();
+
+      tauri::async_runtime::spawn(async move {
+        let auth_result = match cli.saml_auth(app_handle.clone()).await {
+          Ok(auth_data) => SamlAuthResult::Success(auth_data),
+          Err(err) => SamlAuthResult::Failure(format!("{}", err)),
+        };
+
+        println!("{}", json!(auth_result));
+      });
+      Ok(())
+    })
+    .build(tauri::generate_context!())?;
+
+  Ok(app)
 }
 
 fn init_logger() {
@@ -173,22 +206,53 @@ fn init_logger() {
 }
 
 pub async fn run() {
-  let cli = Cli::parse();
+  let mut cli = Cli::parse();
 
   init_logger();
   info!("gpauth started: {}", VERSION);
 
   if let Err(err) = cli.run().await {
-    handle_error(err, &cli);
+    eprintln!("\nError: {}", err);
+
+    if err.to_string().contains("unsafe legacy renegotiation") && !cli.fix_openssl {
+      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
+      // Print the command
+      let args = std::env::args().collect::<Vec<_>>();
+      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
+    }
+
     std::process::exit(1);
   }
 }
 
-fn print_auth_result(auth_result: anyhow::Result<SamlAuthData>) {
-  let auth_result = match auth_result {
-    Ok(auth_data) => SamlAuthResult::Success(auth_data),
-    Err(err) => SamlAuthResult::Failure(format!("{}", err)),
-  };
+async fn wait_auth_data() -> anyhow::Result<SamlAuthData> {
+  // Start a local server to receive the browser authentication data
+  let listener = TcpListener::bind("127.0.0.1:0").await?;
+  let port = listener.local_addr()?.port();
+  let port_file = temp_dir().join("gpcallback.port");
 
-  println!("{}", json!(auth_result));
+  // Write the port to a file
+  fs::write(&port_file, port.to_string())?;
+  fs::set_permissions(&port_file, fs::Permissions::from_mode(0o600))?;
+
+  // Remove the previous log file
+  let callback_log = temp_dir().join("gpcallback.log");
+  let _ = fs::remove_file(&callback_log);
+
+  info!("Listening authentication data on port {}", port);
+  info!(
+    "If it hangs, please check the logs at `{}` for more information",
+    callback_log.display()
+  );
+  let (mut socket, _) = listener.accept().await?;
+
+  info!("Received the browser authentication data from the socket");
+  let mut data = String::new();
+  socket.read_to_string(&mut data).await?;
+
+  // Remove the port file
+  fs::remove_file(&port_file)?;
+
+  let auth_data = SamlAuthData::from_gpcallback(&data)?;
+  Ok(auth_data)
 }

apps/gpauth/src/common.rs

@@ -1,174 +0,0 @@
-use std::sync::Arc;
-
-use gpapi::{
-  auth::{AuthDataParseResult, SamlAuthData},
-  error::AuthDataParseError,
-};
-use log::{info, warn};
-use regex::Regex;
-
-use crate::auth_messenger::{AuthError, AuthMessenger};
-
-pub struct AuthSettings<'a> {
-  pub auth_request: AuthRequest<'a>,
-  pub auth_messenger: Arc<AuthMessenger>,
-  pub ignore_tls_errors: bool,
-}
-
-pub struct AuthRequest<'a>(&'a str);
-
-impl<'a> AuthRequest<'a> {
-  pub fn new(auth_request: &'a str) -> Self {
-    Self(auth_request)
-  }
-
-  pub fn is_url(&self) -> bool {
-    self.0.starts_with("http")
-  }
-
-  pub fn as_str(&self) -> &str {
-    self.0
-  }
-}
-
-/// Trait for handling authentication response
-pub trait AuthResponse {
-  fn get_header(&self, key: &str) -> Option<String>;
-  fn get_body<F>(&self, cb: F)
-  where
-    F: FnOnce(anyhow::Result<Vec<u8>>) + 'static;
-
-  fn url(&self) -> Option<String>;
-
-  fn is_acs_endpoint(&self) -> bool {
-    self.url().map_or(false, |url| url.ends_with("/SAML20/SP/ACS"))
-  }
-}
-
-pub fn read_auth_data(auth_response: &impl AuthResponse, auth_messenger: &Arc<AuthMessenger>) {
-  let auth_messenger = Arc::clone(auth_messenger);
-
-  match read_from_headers(auth_response) {
-    Ok(auth_data) => {
-      info!("Found auth data in headers");
-      auth_messenger.send_auth_data(auth_data);
-    }
-    Err(header_err) => {
-      info!("Failed to read auth data from headers: {}", header_err);
-
-      let is_acs_endpoint = auth_response.is_acs_endpoint();
-      read_from_body(auth_response, move |auth_result| {
-        // If the endpoint is `/SAML20/SP/ACS` and no auth data found in body, it should be considered as invalid
-        let auth_result = auth_result.map_err(move |e| {
-          info!("Failed to read auth data from body: {}", e);
-          if is_acs_endpoint || e.is_invalid() || header_err.is_invalid() {
-            AuthError::Invalid
-          } else {
-            AuthError::NotFound
-          }
-        });
-
-        auth_messenger.send_auth_result(auth_result);
-      });
-    }
-  }
-}
-
-fn read_from_headers(auth_response: &impl AuthResponse) -> AuthDataParseResult {
-  let Some(status) = auth_response.get_header("saml-auth-status") else {
-    info!("No SAML auth status found in headers");
-    return Err(AuthDataParseError::NotFound);
-  };
-
-  if status != "1" {
-    info!("Found invalid auth status: {}", status);
-    return Err(AuthDataParseError::Invalid);
-  }
-
-  let username = auth_response.get_header("saml-username");
-  let prelogin_cookie = auth_response.get_header("prelogin-cookie");
-  let portal_userauthcookie = auth_response.get_header("portal-userauthcookie");
-
-  SamlAuthData::new(username, prelogin_cookie, portal_userauthcookie).map_err(|e| {
-    warn!("Found invalid auth data: {}", e);
-    AuthDataParseError::Invalid
-  })
-}
-
-fn read_from_body<F>(auth_response: &impl AuthResponse, cb: F)
-where
-  F: FnOnce(AuthDataParseResult) + 'static,
-{
-  auth_response.get_body(|body| match body {
-    Ok(body) => {
-      let html = String::from_utf8_lossy(&body);
-      cb(read_from_html(&html))
-    }
-    Err(err) => {
-      info!("Failed to read body: {}", err);
-      cb(Err(AuthDataParseError::Invalid))
-    }
-  });
-}
-
-fn read_from_html(html: &str) -> AuthDataParseResult {
-  if html.contains("Temporarily Unavailable") {
-    info!("Found 'Temporarily Unavailable' in HTML, auth failed");
-    return Err(AuthDataParseError::Invalid);
-  }
-
-  SamlAuthData::from_html(html).or_else(|err| {
-    if let Some(gpcallback) = extract_gpcallback(html) {
-      info!("Found gpcallback from html...");
-      SamlAuthData::from_gpcallback(&gpcallback)
-    } else {
-      Err(err)
-    }
-  })
-}
-
-fn extract_gpcallback(html: &str) -> Option<String> {
-  let re = Regex::new(r#"globalprotectcallback:[^"]+"#).unwrap();
-  re.captures(html)
-    .and_then(|captures| captures.get(0))
-    .map(|m| html_escape::decode_html_entities(m.as_str()).to_string())
-}
-
-#[cfg(test)]
-mod tests {
-  use super::*;
-
-  #[test]
-  fn extract_gpcallback_some() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
-    "#;
-
-    assert_eq!(
-      extract_gpcallback(html).as_deref(),
-      Some("globalprotectcallback:PGh0bWw+PCEtLSA8c")
-    );
-  }
-
-  #[test]
-  fn extract_gpcallback_cas() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:cas-as=1&amp;un=xyz@email.com&amp;token=very_long_string">
-    "#;
-
-    assert_eq!(
-      extract_gpcallback(html).as_deref(),
-      Some("globalprotectcallback:cas-as=1&un=xyz@email.com&token=very_long_string")
-    );
-  }
-
-  #[test]
-  fn extract_gpcallback_none() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=PGh0bWw+PCEtLSA8c">
-    "#;
-
-    assert_eq!(extract_gpcallback(html), None);
-  }
-}

apps/gpauth/src/lib.rs

@@ -1,7 +0,0 @@
-mod auth_messenger;
-mod common;
-
-pub mod auth_window;
-
-#[cfg_attr(not(target_os = "macos"), path = "unix.rs")]
-mod platform_impl;

apps/gpauth/src/main.rs

@@ -1,5 +1,6 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
+mod auth_window;
 mod cli;
 
 #[tokio::main]

apps/gpauth/src/unix.rs

@@ -1,133 +0,0 @@
-use std::sync::Arc;
-
-use anyhow::bail;
-use gpapi::utils::redact::redact_uri;
-use log::{info, warn};
-use webkit2gtk::{
-  gio::Cancellable,
-  glib::{GString, TimeSpan},
-  LoadEvent, TLSErrorsPolicy, URIResponseExt, WebResource, WebResourceExt, WebView, WebViewExt, WebsiteDataManagerExt,
-  WebsiteDataManagerExtManual, WebsiteDataTypes,
-};
-
-use crate::{
-  auth_messenger::AuthError,
-  common::{read_auth_data, AuthRequest, AuthResponse, AuthSettings},
-};
-
-impl AuthResponse for WebResource {
-  fn get_header(&self, key: &str) -> Option<String> {
-    self
-      .response()
-      .and_then(|response| response.http_headers())
-      .and_then(|headers| headers.one(key))
-      .map(GString::into)
-  }
-
-  fn get_body<F>(&self, cb: F)
-  where
-    F: FnOnce(anyhow::Result<Vec<u8>>) + 'static,
-  {
-    let cancellable = Cancellable::NONE;
-    self.data(cancellable, |data| cb(data.map_err(|e| anyhow::anyhow!(e))));
-  }
-
-  fn url(&self) -> Option<String> {
-    self.uri().map(GString::into)
-  }
-}
-
-pub fn clear_data<F>(wv: &WebView, cb: F)
-where
-  F: FnOnce(anyhow::Result<()>) + Send + 'static,
-{
-  let Some(data_manager) = wv.website_data_manager() else {
-    cb(Err(anyhow::anyhow!("Failed to get website data manager")));
-    return;
-  };
-
-  data_manager.clear(
-    WebsiteDataTypes::COOKIES,
-    TimeSpan(0),
-    Cancellable::NONE,
-    move |result| {
-      cb(result.map_err(|e| anyhow::anyhow!(e)));
-    },
-  );
-}
-
-pub fn setup_webview(wv: &WebView, auth_settings: AuthSettings) -> anyhow::Result<()> {
-  let AuthSettings {
-    auth_request,
-    auth_messenger,
-    ignore_tls_errors,
-  } = auth_settings;
-  let auth_messenger_clone = Arc::clone(&auth_messenger);
-
-  let Some(data_manager) = wv.website_data_manager() else {
-    bail!("Failed to get website data manager");
-  };
-
-  if ignore_tls_errors {
-    data_manager.set_tls_errors_policy(TLSErrorsPolicy::Ignore);
-  }
-
-  wv.connect_load_changed(move |wv, event| {
-    if event == LoadEvent::Started {
-      auth_messenger_clone.cancel_raise_window();
-      return;
-    }
-
-    if event != LoadEvent::Finished {
-      return;
-    }
-
-    let Some(main_resource) = wv.main_resource() else {
-      return;
-    };
-
-    let uri = main_resource.uri().unwrap_or("".into());
-    if uri.is_empty() {
-      warn!("Loaded an empty URI");
-      auth_messenger_clone.send_auth_error(AuthError::Invalid);
-      return;
-    }
-
-    read_auth_data(&main_resource, &auth_messenger_clone);
-  });
-
-  wv.connect_load_failed_with_tls_errors(move |_wv, uri, cert, err| {
-    let redacted_uri = redact_uri(uri);
-    warn!(
-      "Failed to load uri: {} with error: {}, cert: {}",
-      redacted_uri, err, cert
-    );
-
-    auth_messenger.send_auth_error(AuthError::TlsError);
-    true
-  });
-
-  wv.connect_load_failed(move |_wv, _event, uri, err| {
-    let redacted_uri = redact_uri(uri);
-    if !uri.starts_with("globalprotectcallback:") {
-      warn!("Failed to load uri: {} with error: {}", redacted_uri, err);
-    }
-    // NOTE: Don't send error here, since load_changed event will be triggered after this
-    // true to stop other handlers from being invoked for the event. false to propagate the event further.
-    true
-  });
-
-  load_auth_request(wv, &auth_request);
-
-  Ok(())
-}
-
-pub fn load_auth_request(wv: &WebView, auth_request: &AuthRequest) {
-  if auth_request.is_url() {
-    info!("Loading auth request as URI...");
-    wv.load_uri(auth_request.as_str());
-  } else {
-    info!("Loading auth request as HTML...");
-    wv.load_html(auth_request.as_str(), None);
-  }
-}

apps/gpauth/tauri.conf.json

@@ -1,16 +1,47 @@
 {
-  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v2.1.1/crates/tauri-cli/config.schema.json",
+  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v1.5.0/tooling/cli/schema.json",
   "build": {
-    "frontendDist": ["index.html"],
+    "distDir": [
+      "index.html"
+    ],
+    "devPath": [
+      "index.html"
+    ],
     "beforeDevCommand": "",
-    "beforeBuildCommand": ""
+    "beforeBuildCommand": "",
+    "withGlobalTauri": false
   },
-  "identifier": "com.yuezk.gpauth",
-  "productName": "gpauth",
-  "app": {
-    "withGlobalTauri": false,
+  "package": {
+    "productName": "gpauth",
+    "version": "0.0.0"
+  },
+  "tauri": {
+    "allowlist": {
+      "all": false,
+      "http": {
+        "all": true,
+        "request": true,
+        "scope": [
+          "http://*",
+          "https://*"
+        ]
+      }
+    },
+    "bundle": {
+      "active": true,
+      "targets": "deb",
+      "identifier": "com.yuezk.gpauth",
+      "icon": [
+        "icons/32x32.png",
+        "icons/128x128.png",
+        "icons/128x128@2x.png",
+        "icons/icon.icns",
+        "icons/icon.ico"
+      ]
+    },
     "security": {
       "csp": null
-    }
+    },
+    "windows": []
   }
 }

apps/gpclient/Cargo.toml

@@ -1,6 +1,5 @@
 [package]
 name = "gpclient"
-rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
@@ -15,7 +14,7 @@ clap.workspace = true
 env_logger.workspace = true
 inquire = "0.6.2"
 log.workspace = true
-tokio.workspace = true
+tokio = { workspace = true, features = ["rt-multi-thread"] }
 sysinfo.workspace = true
 serde_json.workspace = true
 whoami.workspace = true

apps/gpclient/src/cli.rs

@@ -1,16 +1,13 @@
 use std::{env::temp_dir, fs::File};
 
 use clap::{Parser, Subcommand};
-use gpapi::{
-  clap::{handle_error, Args},
-  utils::openssl,
-};
+use gpapi::utils::openssl;
 use log::{info, LevelFilter};
 use tempfile::NamedTempFile;
 
 use crate::{
   connect::{ConnectArgs, ConnectHandler},
-  disconnect::DisconnectHandler,
+  disconnect::{DisconnectArgs, DisconnectHandler},
   launch_gui::{LaunchGuiArgs, LaunchGuiHandler},
 };
 
@@ -26,7 +23,7 @@ enum CliCommand {
   #[command(about = "Connect to a portal server")]
   Connect(Box<ConnectArgs>),
   #[command(about = "Disconnect from the server")]
-  Disconnect,
+  Disconnect(DisconnectArgs),
   #[command(about = "Launch the GUI")]
   LaunchGui(LaunchGuiArgs),
 }
@@ -53,25 +50,12 @@ struct Cli {
   #[command(subcommand)]
   command: CliCommand,
 
-  #[arg(
-    long,
-    help = "Uses extended compatibility mode for OpenSSL operations to support a broader range of systems and formats."
-  )]
+  #[arg(long, help = "Uses extended compatibility mode for OpenSSL operations to support a broader range of systems and formats.")]
   fix_openssl: bool,
   #[arg(long, help = "Ignore the TLS errors")]
   ignore_tls_errors: bool,
 }
 
-impl Args for Cli {
-  fn fix_openssl(&self) -> bool {
-    self.fix_openssl
-  }
-
-  fn ignore_tls_errors(&self) -> bool {
-    self.ignore_tls_errors
-  }
-}
-
 impl Cli {
   fn fix_openssl(&self) -> anyhow::Result<Option<NamedTempFile>> {
     if self.fix_openssl {
@@ -97,7 +81,7 @@ impl Cli {
 
     match &self.command {
       CliCommand::Connect(args) => ConnectHandler::new(args, &shared_args).handle().await,
-      CliCommand::Disconnect => DisconnectHandler::new().handle(),
+      CliCommand::Disconnect(args) => DisconnectHandler::new(args).handle().await,
       CliCommand::LaunchGui(args) => LaunchGuiHandler::new(args).handle().await,
     }
   }
@@ -129,7 +113,24 @@ pub(crate) async fn run() {
   info!("gpclient started: {}", VERSION);
 
   if let Err(err) = cli.run().await {
-    handle_error(err, &cli);
+    eprintln!("\nError: {}", err);
+
+    let err = err.to_string();
+
+    if err.contains("unsafe legacy renegotiation") && !cli.fix_openssl {
+      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
+      // Print the command
+      let args = std::env::args().collect::<Vec<_>>();
+      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
+    }
+
+    if err.contains("certificate verify failed") && !cli.ignore_tls_errors {
+      eprintln!("\nRe-run it with the `--ignore-tls-errors` option to ignore the certificate error, e.g.:\n");
+      // Print the command
+      let args = std::env::args().collect::<Vec<_>>();
+      eprintln!("{} --ignore-tls-errors {}\n", args[0], args[1..].join(" "));
+    }
+
     std::process::exit(1);
   }
 }

apps/gpclient/src/connect.rs

@@ -84,10 +84,10 @@ pub(crate) struct ConnectArgs {
   #[arg(long, default_value = GP_USER_AGENT, help = "The user agent to use")]
   user_agent: String,
 
-  #[arg(long, default_value = "Linux")]
+  #[arg(long, value_enum, default_value_t = ConnectArgs::default_os())]
   os: Os,
 
-  #[arg(long)]
+  #[arg(long, help = "If not specified, it will be computed based on the --os option")]
   os_version: Option<String>,
 
   #[arg(long, help = "Disable DTLS and ESP")]
@@ -110,9 +110,17 @@ pub(crate) struct ConnectArgs {
 }
 
 impl ConnectArgs {
+  fn default_os() -> Os {
+    if cfg!(target_os = "macos") {
+      Os::Mac
+    } else {
+      Os::Linux
+    }
+  }
+
   fn os_version(&self) -> String {
-    if let Some(os_version) = &self.os_version {
-      return os_version.to_owned();
+    if let Some(os_version) = self.os_version.as_deref() {
+      return os_version.to_string();
     }
 
     match self.os {

apps/gpclient/src/disconnect.rs

@@ -1,31 +1,63 @@
 use crate::GP_CLIENT_LOCK_FILE;
+use clap::Args;
+use gpapi::utils::lock_file::gpservice_lock_info;
 use log::{info, warn};
-use std::fs;
+use std::{fs, str::FromStr, thread, time::Duration};
 use sysinfo::{Pid, Signal, System};
 
-pub(crate) struct DisconnectHandler;
+#[derive(Args)]
+pub struct DisconnectArgs {
+  #[arg(
+    long,
+    required = false,
+    help = "The time in seconds to wait for the VPN connection to disconnect"
+  )]
+  wait: Option<u64>,
+}
 
-impl DisconnectHandler {
-  pub(crate) fn new() -> Self {
-    Self
+pub struct DisconnectHandler<'a> {
+  args: &'a DisconnectArgs,
+}
+
+impl<'a> DisconnectHandler<'a> {
+  pub fn new(args: &'a DisconnectArgs) -> Self {
+    Self { args }
   }
 
-  pub(crate) fn handle(&self) -> anyhow::Result<()> {
-    if fs::metadata(GP_CLIENT_LOCK_FILE).is_err() {
-      warn!("PID file not found, maybe the client is not running");
-      return Ok(());
+  pub async fn handle(&self) -> anyhow::Result<()> {
+    // Try to disconnect the CLI client
+    if let Ok(c) = fs::read_to_string(GP_CLIENT_LOCK_FILE) {
+      send_signal(c.trim(), Signal::Interrupt).unwrap_or_else(|err| {
+        warn!("Failed to send signal to client: {}", err);
+      });
+    };
+
+    // Try to disconnect the GUI service
+    if let Ok(c) = gpservice_lock_info().await {
+      send_signal(&c.pid.to_string(), Signal::User1).unwrap_or_else(|err| {
+        warn!("Failed to send signal to service: {}", err);
+      });
+    };
+
+    // sleep, to give the client and service time to disconnect
+    if let Some(wait) = self.args.wait {
+      thread::sleep(Duration::from_secs(wait));
     }
 
-    let pid = fs::read_to_string(GP_CLIENT_LOCK_FILE)?;
-    let pid = pid.trim().parse::<usize>()?;
-    let s = System::new_all();
-
-    if let Some(process) = s.process(Pid::from(pid)) {
-      info!("Found process {}, killing...", pid);
-      if process.kill_with(Signal::Interrupt).is_none() {
-        warn!("Failed to kill process {}", pid);
-      }
-    }
     Ok(())
   }
 }
+
+fn send_signal(pid: &str, signal: Signal) -> anyhow::Result<()> {
+  let s = System::new_all();
+  let pid = Pid::from_str(pid)?;
+
+  if let Some(process) = s.process(pid) {
+    info!("Found process {}, sending signal...", pid);
+
+    if process.kill_with(signal).is_none() {
+      warn!("Failed to kill process {}", pid);
+    }
+  }
+  Ok(())
+}

apps/gpclient/src/launch_gui.rs

@@ -4,8 +4,7 @@ use clap::Args;
 use directories::ProjectDirs;
 use gpapi::{
   process::service_launcher::ServiceLauncher,
-  utils::{endpoint::http_endpoint, env_utils, shutdown_signal},
-  GP_CALLBACK_PORT_FILENAME,
+  utils::{endpoint::http_endpoint, env_file, shutdown_signal},
 };
 use log::info;
 use tokio::io::AsyncWriteExt;
@@ -63,7 +62,7 @@ impl<'a> LaunchGuiHandler<'a> {
     extra_envs.insert("GP_LOG_FILE".into(), log_file_path.clone());
 
     // Persist the environment variables to a file
-    let env_file = env_utils::persist_env_vars(Some(extra_envs))?;
+    let env_file = env_file::persist_env_vars(Some(extra_envs))?;
     let env_file = env_file.into_temp_path();
     let env_file_path = env_file.to_string_lossy().to_string();
 
@@ -116,7 +115,7 @@ async fn feed_auth_data_gui(auth_data: &str) -> anyhow::Result<()> {
 async fn feed_auth_data_cli(auth_data: &str) -> anyhow::Result<()> {
   info!("Feeding auth data to the CLI");
 
-  let port_file = temp_dir().join(GP_CALLBACK_PORT_FILENAME);
+  let port_file = temp_dir().join("gpcallback.port");
   let port = tokio::fs::read_to_string(port_file).await?;
   let mut stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port.trim())).await?;
 

apps/gpgui-helper/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>GlobalProtect</title>
-    <script type="module" crossorigin src="/assets/main-DJgDj3te.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/main-B3YRsHQ2.css">
+    <script type="module" crossorigin src="/assets/main-c159dd55.js"></script>
+    <link rel="stylesheet" href="/assets/index-11e7064a.css">
   </head>
   <body>
     <script>
@@ -16,5 +16,6 @@
       document.documentElement.style.fontSize = 16 / ratio + "px";
     </script>
     <div id="root" data-tauri-drag-region></div>
+    
   </body>
 </html>

apps/gpgui-helper/package.json

@@ -9,29 +9,29 @@
     "tauri": "tauri"
   },
   "dependencies": {
-    "@emotion/react": "^11.14.0",
-    "@emotion/styled": "^11.14.0",
-    "@mui/icons-material": "^6.2.0",
-    "@mui/material": "^6.2.0",
-    "@tauri-apps/api": "^2.1.1",
+    "@emotion/react": "^11.13.0",
+    "@emotion/styled": "^11.13.0",
+    "@mui/icons-material": "^5.16.7",
+    "@mui/material": "^5.16.7",
+    "@tauri-apps/api": "^1.6.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.1.0",
-    "@types/node": "^22.10.2",
-    "@types/react": "^18.3.12",
-    "@types/react-dom": "^18.3.1",
-    "@typescript-eslint/eslint-plugin": "^8.18.0",
-    "@typescript-eslint/parser": "^8.18.0",
-    "@vitejs/plugin-react": "^4.3.4",
-    "eslint": "^9.16.0",
+    "@tauri-apps/cli": "^1.6.0",
+    "@types/node": "^20.14.15",
+    "@types/react": "^18.3.3",
+    "@types/react-dom": "^18.3.0",
+    "@typescript-eslint/eslint-plugin": "^6.21.0",
+    "@typescript-eslint/parser": "^6.21.0",
+    "@vitejs/plugin-react": "^4.3.1",
+    "eslint": "^8.57.0",
     "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-react": "^7.37.2",
-    "eslint-plugin-react-hooks": "^5.1.0",
-    "prettier": "3.4.2",
-    "typescript": "^5.7.2",
-    "vite": "^6.0.3"
+    "eslint-plugin-react": "^7.35.0",
+    "eslint-plugin-react-hooks": "^4.6.2",
+    "prettier": "3.1.0",
+    "typescript": "^5.5.4",
+    "vite": "^4.5.3"
   },
   "packageManager": "pnpm@8.15.7"
 }

apps/gpgui-helper/src-tauri/Cargo.toml

@@ -1,18 +1,16 @@
 [package]
 name = "gpgui-helper"
-rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 
 [build-dependencies]
-tauri-build = { version = "2", features = [] }
+tauri-build = { version = "1.5", features = [] }
 
 [dependencies]
 gpapi = { path = "../../../crates/gpapi", features = ["tauri"] }
-tauri.workspace = true
-
+tauri = { workspace = true, features = ["window-start-dragging"] }
 tokio.workspace = true
 anyhow.workspace = true
 log.workspace = true

apps/gpgui-helper/src-tauri/capabilities/default.json

@@ -1,12 +0,0 @@
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "Capability for the main window",
-  "windows": ["main"],
-  "permissions": [
-    "core:window:allow-start-dragging",
-    "core:event:allow-listen",
-    "core:event:allow-emit",
-    "core:event:allow-unlisten"
-  ]
-}

apps/gpgui-helper/src-tauri/src/app.rs

@@ -1,7 +1,8 @@
 use std::sync::Arc;
 
+use gpapi::utils::window::WindowExt;
 use log::info;
-use tauri::{Listener, Manager};
+use tauri::Manager;
 
 use crate::updater::{GuiUpdater, Installer, ProgressNotifier};
 
@@ -24,15 +25,15 @@ impl App {
 
     tauri::Builder::default()
       .setup(move |app| {
-        let win = app.get_webview_window("main").expect("no main window");
-        let _ = win.hide_menu();
+        let win = app.get_window("main").expect("no main window");
+        win.hide_menu();
 
         let notifier = ProgressNotifier::new(win.clone());
         let installer = Installer::new(api_key);
         let updater = Arc::new(GuiUpdater::new(gui_version, notifier, installer));
 
         let win_clone = win.clone();
-        app.listen_any("app://update-done", move |_event| {
+        app.listen_global("app://update-done", move |_event| {
           info!("Update done");
           let _ = win_clone.close();
         });
@@ -40,15 +41,12 @@ impl App {
         // Listen for the update event
         win.listen("app://update", move |_event| {
           let updater = Arc::clone(&updater);
-          if updater.is_in_progress() {
-            info!("Update already in progress");
-            updater.notify_progress();
-            return;
-          }
-
           tokio::spawn(async move { updater.update().await });
         });
 
+        // Update the GUI on startup
+        win.trigger("app://update", None);
+
         Ok(())
       })
       .run(tauri::generate_context!())?;

apps/gpgui-helper/src-tauri/src/cli.rs

@@ -1,5 +1,5 @@
 use clap::Parser;
-use gpapi::utils::{base64, env_utils};
+use gpapi::utils::base64;
 use log::{info, LevelFilter};
 
 use crate::app::App;
@@ -22,8 +22,6 @@ impl Cli {
     let api_key = self.read_api_key()?;
     let app = App::new(api_key, &self.gui_version);
 
-    env_utils::patch_gui_runtime_env(false);
-
     app.run()
   }
 

apps/gpgui-helper/src-tauri/src/updater.rs

@@ -1,39 +1,39 @@
-use std::sync::{Arc, RwLock};
+use std::sync::Arc;
 
 use gpapi::{
   service::request::UpdateGuiRequest,
   utils::{checksum::verify_checksum, crypto::Crypto, endpoint::http_endpoint},
 };
 use log::{info, warn};
-use tauri::{Emitter, WebviewWindow};
+use tauri::{Manager, Window};
 
 use crate::downloader::{ChecksumFetcher, FileDownloader};
 
 #[cfg(not(debug_assertions))]
 const SNAPSHOT: &str = match option_env!("SNAPSHOT") {
-  Some(val) => val,
-  None => "false",
+    Some(val) => val,
+    None => "false"
 };
 
 pub struct ProgressNotifier {
-  win: WebviewWindow,
+  win: Window,
 }
 
 impl ProgressNotifier {
-  pub fn new(win: WebviewWindow) -> Self {
+  pub fn new(win: Window) -> Self {
     Self { win }
   }
 
   fn notify(&self, progress: Option<f64>) {
-    let _ = self.win.emit("app://update-progress", progress);
+    let _ = self.win.emit_all("app://update-progress", progress);
   }
 
   fn notify_error(&self) {
-    let _ = self.win.emit("app://update-error", ());
+    let _ = self.win.emit_all("app://update-error", ());
   }
 
   fn notify_done(&self) {
-    let _ = self.win.emit("app://update-done", ());
+    let _ = self.win.emit_and_trigger("app://update-done", ());
   }
 }
 
@@ -72,8 +72,6 @@ pub struct GuiUpdater {
   version: String,
   notifier: Arc<ProgressNotifier>,
   installer: Installer,
-  in_progress: RwLock<bool>,
-  progress: Arc<RwLock<Option<f64>>>,
 }
 
 impl GuiUpdater {
@@ -82,8 +80,6 @@ impl GuiUpdater {
       version,
       notifier: Arc::new(notifier),
       installer,
-      in_progress: Default::default(),
-      progress: Default::default(),
     }
   }
 
@@ -116,23 +112,15 @@ impl GuiUpdater {
     let cf = ChecksumFetcher::new(&checksum_url);
     let notifier = Arc::clone(&self.notifier);
 
-    let progress_ref = Arc::clone(&self.progress);
-    dl.on_progress(move |progress| {
-      // Save progress to shared state so that it can be notified to the UI when needed
-      if let Ok(mut guard) = progress_ref.try_write() {
-        *guard = progress;
-      }
-      notifier.notify(progress);
-    });
+    dl.on_progress(move |progress| notifier.notify(progress));
 
-    self.set_in_progress(true);
     let res = tokio::try_join!(dl.download(), cf.fetch());
 
     let (file, checksum) = match res {
       Ok((file, checksum)) => (file, checksum),
       Err(err) => {
         warn!("Download error: {}", err);
-        self.notify_error();
+        self.notifier.notify_error();
         return;
       }
     };
@@ -142,7 +130,7 @@ impl GuiUpdater {
 
     if let Err(err) = verify_checksum(&file_path, &checksum) {
       warn!("Checksum error: {}", err);
-      self.notify_error();
+      self.notifier.notify_error();
       return;
     }
 
@@ -150,48 +138,10 @@ impl GuiUpdater {
 
     if let Err(err) = self.installer.install(&file_path, &checksum).await {
       warn!("Install error: {}", err);
-      self.notify_error();
+      self.notifier.notify_error();
     } else {
       info!("Install success");
-      self.notify_done();
+      self.notifier.notify_done();
     }
   }
-
-  pub fn is_in_progress(&self) -> bool {
-    if let Ok(guard) = self.in_progress.try_read() {
-      *guard
-    } else {
-      info!("Failed to acquire in_progress lock");
-      false
-    }
-  }
-
-  fn set_in_progress(&self, in_progress: bool) {
-    if let Ok(mut guard) = self.in_progress.try_write() {
-      *guard = in_progress;
-    } else {
-      info!("Failed to acquire in_progress lock");
-    }
-  }
-
-  fn notify_error(&self) {
-    self.set_in_progress(false);
-    self.notifier.notify_error();
-  }
-
-  fn notify_done(&self) {
-    self.set_in_progress(false);
-    self.notifier.notify_done();
-  }
-
-  pub fn notify_progress(&self) {
-    let progress = if let Ok(guard) = self.progress.try_read() {
-      *guard
-    } else {
-      info!("Failed to acquire progress lock");
-      None
-    };
-
-    self.notifier.notify(progress);
-  }
 }

apps/gpgui-helper/src-tauri/tauri.conf.json

@@ -1,15 +1,35 @@
 {
-  "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
+  "$schema": "../node_modules/@tauri-apps/cli/schema.json",
   "build": {
     "beforeDevCommand": "pnpm dev",
     "beforeBuildCommand": "pnpm build",
-    "devUrl": "http://localhost:1421",
-    "frontendDist": "../dist"
+    "devPath": "http://localhost:1421",
+    "distDir": "../dist",
+    "withGlobalTauri": false
   },
-  "identifier": "com.yuezk.gpgui-helper",
-  "productName": "gpgui-helper",
-  "app": {
-    "withGlobalTauri": false,
+  "package": {
+    "productName": "gpgui-helper"
+  },
+  "tauri": {
+    "allowlist": {
+      "all": false,
+      "window": {
+        "all": false,
+        "startDragging": true
+      }
+    },
+    "bundle": {
+      "active": false,
+      "targets": "deb",
+      "identifier": "com.yuezk.gpgui-helper",
+      "icon": [
+        "icons/32x32.png",
+        "icons/128x128.png",
+        "icons/128x128@2x.png",
+        "icons/icon.icns",
+        "icons/icon.ico"
+      ]
+    },
     "security": {
       "csp": null
     },
@@ -28,16 +48,5 @@
         "decorations": false
       }
     ]
-  },
-  "bundle": {
-    "active": false,
-    "targets": "deb",
-    "icon": [
-      "icons/32x32.png",
-      "icons/128x128.png",
-      "icons/128x128@2x.png",
-      "icons/icon.icns",
-      "icons/icon.ico"
-    ]
   }
 }

apps/gpgui-helper/src/components/App/App.tsx

@@ -1,12 +1,10 @@
 import { Box, Button, CssBaseline, LinearProgress, Typography } from "@mui/material";
-import { getCurrentWindow } from "@tauri-apps/api/window";
+import { appWindow } from "@tauri-apps/api/window";
 import logo from "../../assets/icon.svg";
 import { useEffect, useState } from "react";
 
 import "./styles.css";
 
-const appWindow = getCurrentWindow();
-
 function useUpdateProgress() {
   const [progress, setProgress] = useState<number | null>(null);
 
@@ -27,8 +25,6 @@ export default function App() {
   const [error, setError] = useState(false);
 
   useEffect(() => {
-    appWindow.emit("app://update");
-
     const unlisten = appWindow.listen("app://update-error", () => {
       setError(true);
     });

apps/gpservice/Cargo.toml

@@ -9,7 +9,7 @@ gpapi = { path = "../../crates/gpapi" }
 openconnect = { path = "../../crates/openconnect" }
 clap.workspace = true
 anyhow.workspace = true
-tokio.workspace = true
+tokio = { workspace = true, features = ["rt-multi-thread"] }
 tokio-util.workspace = true
 axum = { workspace = true, features = ["ws"] }
 futures.workspace = true

apps/gpservice/src/cli.rs

@@ -6,7 +6,7 @@ use clap::Parser;
 use gpapi::{
   process::gui_launcher::GuiLauncher,
   service::{request::WsRequest, vpn_state::VpnState},
-  utils::{crypto::generate_key, env_utils, lock_file::LockFile, redact::Redaction, shutdown_signal},
+  utils::{crypto::generate_key, env_file, lock_file::LockFile, redact::Redaction, shutdown_signal},
   GP_SERVICE_LOCK_FILE,
 };
 use log::{info, warn, LevelFilter};
@@ -30,7 +30,8 @@ struct Cli {
 
 impl Cli {
   async fn run(&mut self, redaction: Arc<Redaction>) -> anyhow::Result<()> {
-    let lock_file = Arc::new(LockFile::new(GP_SERVICE_LOCK_FILE));
+    let pid = std::process::id();
+    let lock_file = Arc::new(LockFile::new(GP_SERVICE_LOCK_FILE, pid));
 
     if lock_file.check_health().await {
       bail!("Another instance of the service is already running");
@@ -48,9 +49,17 @@ impl Cli {
 
     let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(4);
     let shutdown_tx_clone = shutdown_tx.clone();
-    let vpn_task_token = vpn_task.cancel_token();
+    let vpn_task_cancel_token = vpn_task.cancel_token();
     let server_token = ws_server.cancel_token();
 
+    #[cfg(unix)]
+    {
+      let vpn_ctx = vpn_task.context();
+      let ws_ctx = ws_server.context();
+
+      tokio::spawn(async move { signals::handle_signals(vpn_ctx, ws_ctx).await });
+    }
+
     let vpn_task_handle = tokio::spawn(async move { vpn_task.start(server_token).await });
     let ws_server_handle = tokio::spawn(async move { ws_server.start(shutdown_tx_clone).await });
 
@@ -63,7 +72,7 @@ impl Cli {
     if no_gui {
       info!("GUI is disabled");
     } else {
-      let envs = self.env_file.as_ref().map(env_utils::load_env_vars).transpose()?;
+      let envs = self.env_file.as_ref().map(env_file::load_env_vars).transpose()?;
 
       let minimized = self.minimized;
 
@@ -74,15 +83,15 @@ impl Cli {
     }
 
     tokio::select! {
-        _ = shutdown_signal() => {
-            info!("Shutdown signal received");
-        }
-        _ = shutdown_rx.recv() => {
-            info!("Shutdown request received, shutting down");
-        }
+      _ = shutdown_signal() => {
+        info!("Shutdown signal received");
+      }
+      _ = shutdown_rx.recv() => {
+        info!("Shutdown request received, shutting down");
+      }
     }
 
-    vpn_task_token.cancel();
+    vpn_task_cancel_token.cancel();
     let _ = tokio::join!(vpn_task_handle, ws_server_handle);
 
     lock_file.unlock()?;
@@ -125,6 +134,54 @@ fn init_logger() -> Arc<Redaction> {
   redaction
 }
 
+#[cfg(unix)]
+mod signals {
+  use std::sync::Arc;
+
+  use log::{info, warn};
+
+  use crate::vpn_task::VpnTaskContext;
+  use crate::ws_server::WsServerContext;
+
+  const DISCONNECTED_PID_FILE: &str = "/tmp/gpservice_disconnected.pid";
+
+  pub(crate) async fn handle_signals(vpn_ctx: Arc<VpnTaskContext>, ws_ctx: Arc<WsServerContext>) {
+    use gpapi::service::event::WsEvent;
+    use tokio::signal::unix::{signal, Signal, SignalKind};
+
+    let (mut user_sig1, mut user_sig2) = match || -> anyhow::Result<(Signal, Signal)> {
+      let user_sig1 = signal(SignalKind::user_defined1())?;
+      let user_sig2 = signal(SignalKind::user_defined2())?;
+      Ok((user_sig1, user_sig2))
+    }() {
+      Ok(signals) => signals,
+      Err(err) => {
+        warn!("Failed to create signal: {}", err);
+        return;
+      }
+    };
+
+    loop {
+      tokio::select! {
+        _ = user_sig1.recv() => {
+          info!("Received SIGUSR1 signal");
+          if vpn_ctx.disconnect().await {
+            // Write the PID to a dedicated file to indicate that the VPN task is disconnected via SIGUSR1
+            let pid = std::process::id();
+            if let Err(err) = tokio::fs::write(DISCONNECTED_PID_FILE, pid.to_string()).await {
+              warn!("Failed to write PID to file: {}", err);
+            }
+          }
+        }
+        _ = user_sig2.recv() => {
+          info!("Received SIGUSR2 signal");
+          ws_ctx.send_event(WsEvent::ResumeConnection).await;
+        }
+      }
+    }
+  }
+}
+
 async fn launch_gui(envs: Option<HashMap<String, String>>, api_key: Vec<u8>, mut minimized: bool) {
   loop {
     let gui_launcher = GuiLauncher::new(env!("CARGO_PKG_VERSION"), &api_key)

apps/gpservice/src/handlers.rs

@@ -43,7 +43,7 @@ pub(crate) async fn auth_data(State(ctx): State<Arc<WsServerContext>>, body: Str
   ctx.send_event(WsEvent::AuthData(body)).await;
 }
 
-pub async fn update_gui(State(ctx): State<Arc<WsServerContext>>, body: Bytes) -> Result<(), StatusCode> {
+pub(crate) async fn update_gui(State(ctx): State<Arc<WsServerContext>>, body: Bytes) -> Result<(), StatusCode> {
   let payload = match ctx.decrypt::<UpdateGuiRequest>(body.to_vec()) {
     Ok(payload) => payload,
     Err(err) => {

apps/gpservice/src/vpn_task.rs

@@ -87,7 +87,7 @@ impl VpnTaskContext {
     });
   }
 
-  pub async fn disconnect(&self) {
+  pub async fn disconnect(&self) -> bool {
     if let Some(disconnect_rx) = self.disconnect_rx.write().await.take() {
       info!("Disconnecting VPN...");
       if let Some(vpn) = self.vpn_handle.read().await.as_ref() {
@@ -98,9 +98,13 @@ impl VpnTaskContext {
       // Wait for the VPN to be disconnected
       disconnect_rx.await.ok();
       info!("VPN disconnected");
+
+      true
     } else {
       info!("VPN is not connected, skip disconnect");
       self.vpn_state_tx.send(VpnState::Disconnected).ok();
+
+      false
     }
   }
 }
@@ -143,6 +147,10 @@ impl VpnTask {
     server_cancel_token.cancel();
   }
 
+  pub fn context(&self) -> Arc<VpnTaskContext> {
+    return Arc::clone(&self.ctx);
+  }
+
   async fn recv(&mut self) {
     while let Some(req) = self.ws_req_rx.recv().await {
       tokio::spawn(process_ws_req(req, self.ctx.clone()));

apps/gpservice/src/ws_server.rs

@@ -113,6 +113,10 @@ impl WsServer {
     }
   }
 
+  pub fn context(&self) -> Arc<WsServerContext> {
+    Arc::clone(&self.ctx)
+  }
+
   pub fn cancel_token(&self) -> CancellationToken {
     self.cancel_token.clone()
   }
@@ -124,7 +128,7 @@ impl WsServer {
         warn!("Failed to start WS server: {}", err);
         let _ = shutdown_tx.send(()).await;
         return;
-      },
+      }
     };
 
     tokio::select! {
@@ -149,7 +153,7 @@ impl WsServer {
 
     info!("WS server listening on port: {}", port);
 
-    self.lock_file.lock(port.to_string())?;
+    self.lock_file.lock(&port.to_string())?;
 
     Ok(listener)
   }

changelog.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.3.11 - 2025-01-21
+
+- Update minimal Rust version to 1.71.1, so that the PPA can be built on Ubuntu 18.04.
+
+## 2.3.10 - 2025-01-20
+
+- Disconnect the VPN when sleep (fix [#166](https://github.com/yuezk/GlobalProtect-openconnect/issues/166), [#267](https://github.com/yuezk/GlobalProtect-openconnect/issues/267))
+
 ## 2.3.9 - 2024-11-02
 
 - Enhance the OpenSSL compatibility mode (fix [#437](https://github.com/yuezk/GlobalProtect-openconnect/issues/437))

crates/gpapi/Cargo.toml

@@ -1,6 +1,5 @@
 [package]
 name = "gpapi"
-rust-version.workspace = true
 version.workspace = true
 edition.workspace = true
 license = "MIT"
@@ -15,9 +14,10 @@ openssl.workspace = true
 pem.workspace = true
 roxmltree.workspace = true
 serde.workspace = true
-specta = { workspace = true, features = ["derive"] }
+specta.workspace = true
+specta-macros.workspace = true
 urlencoding.workspace = true
-tokio.workspace = true
+tokio = { workspace = true, features = ["process", "signal", "macros"] }
 serde_json.workspace = true
 whoami.workspace = true
 tempfile.workspace = true
@@ -32,6 +32,9 @@ md5.workspace = true
 sha256.workspace = true
 which.workspace = true
 
+# Pin the version of home because the latest version requires Rust 1.81
+home = "=0.5.9"
+
 tauri = { workspace = true, optional = true }
 clap = { workspace = true, optional = true }
 open = { version = "5", optional = true }

crates/gpapi/src/auth.rs

@@ -1,14 +1,11 @@
 use std::borrow::{Borrow, Cow};
 
-use anyhow::bail;
 use log::{info, warn};
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
 use crate::{error::AuthDataParseError, utils::base64::decode_to_string};
 
-pub type AuthDataParseResult = anyhow::Result<SamlAuthData, AuthDataParseError>;
-
 #[derive(Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SamlAuthData {
@@ -36,51 +33,33 @@ impl SamlAuthResult {
 }
 
 impl SamlAuthData {
-  pub fn new(
-    username: Option<String>,
-    prelogin_cookie: Option<String>,
-    portal_userauthcookie: Option<String>,
-  ) -> anyhow::Result<Self> {
-    let username = username.unwrap_or_default();
-    if username.is_empty() {
-      bail!("Invalid username: <empty>");
-    }
-
-    let prelogin_cookie = prelogin_cookie.unwrap_or_default();
-    let portal_userauthcookie = portal_userauthcookie.unwrap_or_default();
-
-    if prelogin_cookie.len() <= 5 && portal_userauthcookie.len() <= 5 {
-      bail!(
-        "Invalid prelogin-cookie: {}, portal-userauthcookie: {}",
-        prelogin_cookie,
-        portal_userauthcookie
-      );
-    }
-
-    Ok(Self {
+  pub fn new(username: String, prelogin_cookie: Option<String>, portal_userauthcookie: Option<String>) -> Self {
+    Self {
       username,
-      prelogin_cookie: Some(prelogin_cookie),
-      portal_userauthcookie: Some(portal_userauthcookie),
+      prelogin_cookie,
+      portal_userauthcookie,
       token: None,
-    })
+    }
   }
 
-  pub fn from_html(html: &str) -> AuthDataParseResult {
+  pub fn from_html(html: &str) -> anyhow::Result<SamlAuthData, AuthDataParseError> {
     match parse_xml_tag(html, "saml-auth-status") {
-      Some(status) if status == "1" => {
+      Some(saml_status) if saml_status == "1" => {
         let username = parse_xml_tag(html, "saml-username");
         let prelogin_cookie = parse_xml_tag(html, "prelogin-cookie");
         let portal_userauthcookie = parse_xml_tag(html, "portal-userauthcookie");
 
-        SamlAuthData::new(username, prelogin_cookie, portal_userauthcookie).map_err(|e| {
-          warn!("Failed to parse auth data: {}", e);
-          AuthDataParseError::Invalid
-        })
-      }
-      Some(status) => {
-        warn!("Found invalid auth status: {}", status);
-        Err(AuthDataParseError::Invalid)
+        if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
+          Ok(SamlAuthData::new(
+            username.unwrap(),
+            prelogin_cookie,
+            portal_userauthcookie,
+          ))
+        } else {
+          Err(AuthDataParseError::Invalid)
+        }
       }
+      Some(_) => Err(AuthDataParseError::Invalid),
       None => Err(AuthDataParseError::NotFound),
     }
   }
@@ -126,6 +105,27 @@ impl SamlAuthData {
   pub fn token(&self) -> Option<&str> {
     self.token.as_deref()
   }
+
+  pub fn check(
+    username: &Option<String>,
+    prelogin_cookie: &Option<String>,
+    portal_userauthcookie: &Option<String>,
+  ) -> bool {
+    let username_valid = username.as_ref().is_some_and(|username| !username.is_empty());
+    let prelogin_cookie_valid = prelogin_cookie.as_ref().is_some_and(|val| val.len() > 5);
+    let portal_userauthcookie_valid = portal_userauthcookie.as_ref().is_some_and(|val| val.len() > 5);
+
+    let is_valid = username_valid && (prelogin_cookie_valid || portal_userauthcookie_valid);
+
+    if !is_valid {
+      warn!(
+        "Invalid SAML auth data: username: {:?}, prelogin-cookie: {:?}, portal-userauthcookie: {:?}",
+        username, prelogin_cookie, portal_userauthcookie
+      );
+    }
+
+    is_valid
+  }
 }
 
 pub fn parse_xml_tag(html: &str, tag: &str) -> Option<String> {

crates/gpapi/src/clap/mod.rs

@@ -1,28 +1 @@
-use crate::error::PortalError;
-
 pub mod args;
-
-pub trait Args {
-  fn fix_openssl(&self) -> bool;
-  fn ignore_tls_errors(&self) -> bool;
-}
-
-pub fn handle_error(err: anyhow::Error, args: &impl Args) {
-  eprintln!("\nError: {}", err);
-
-  let Some(err) = err.downcast_ref::<PortalError>() else {
-    return;
-  };
-
-  if err.is_legacy_openssl_error() && !args.fix_openssl() {
-    eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
-    let args = std::env::args().collect::<Vec<_>>();
-    eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
-  }
-
-  if err.is_tls_error() && !args.ignore_tls_errors() {
-    eprintln!("\nRe-run it with the `--ignore-tls-errors` option to ignore the certificate error, e.g.:\n");
-    let args = std::env::args().collect::<Vec<_>>();
-    eprintln!("{} --ignore-tls-errors {}\n", args[0], args[1..].join(" "));
-  }
-}

crates/gpapi/src/error.rs

@@ -7,19 +7,7 @@ pub enum PortalError {
   #[error("Portal config error: {0}")]
   ConfigError(String),
   #[error("Network error: {0}")]
-  NetworkError(#[from] reqwest::Error),
-  #[error("TLS error")]
-  TlsError,
-}
-
-impl PortalError {
-  pub fn is_legacy_openssl_error(&self) -> bool {
-    format!("{:?}", self).contains("unsafe legacy renegotiation")
-  }
-
-  pub fn is_tls_error(&self) -> bool {
-    matches!(self, PortalError::TlsError) || format!("{:?}", self).contains("certificate verify failed")
-  }
+  NetworkError(String),
 }
 
 #[derive(Error, Debug)]
@@ -29,9 +17,3 @@ pub enum AuthDataParseError {
   #[error("Invalid auth data")]
   Invalid,
 }
-
-impl AuthDataParseError {
-  pub fn is_invalid(&self) -> bool {
-    matches!(self, AuthDataParseError::Invalid)
-  }
-}

crates/gpapi/src/gateway/login.rs

@@ -36,7 +36,7 @@ pub async fn gateway_login(gateway: &str, cred: &Credential, gp_params: &GpParam
     .form(&params)
     .send()
     .await
-    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e)))?;
+    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e.to_string())))?;
 
   let res = parse_gp_response(res).await.map_err(|err| {
     warn!("{err}");

crates/gpapi/src/lib.rs

@@ -16,7 +16,6 @@ pub const GP_API_KEY: &[u8; 32] = &[0; 32];
 
 pub const GP_USER_AGENT: &str = "PAN GlobalProtect";
 pub const GP_SERVICE_LOCK_FILE: &str = "/var/run/gpservice.lock";
-pub const GP_CALLBACK_PORT_FILENAME: &str = "gpcallback.port";
 
 #[cfg(not(debug_assertions))]
 pub const GP_CLIENT_BINARY: &str = "/usr/bin/gpclient";

crates/gpapi/src/portal/config.rs

@@ -116,7 +116,7 @@ pub async fn retrieve_config(portal: &str, cred: &Credential, gp_params: &GpPara
     .form(&params)
     .send()
     .await
-    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e)))?;
+    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e.to_string())))?;
 
   let res_xml = parse_gp_response(res).await.or_else(|err| {
     if err.status == StatusCode::NOT_FOUND {

crates/gpapi/src/portal/prelogin.rs

@@ -116,12 +116,14 @@ pub async fn prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<Prel
 
   let client = Client::try_from(gp_params)?;
 
+  info!("Perform prelogin, user_agent: {}", gp_params.user_agent());
+
   let res = client
     .post(&prelogin_url)
     .form(&params)
     .send()
     .await
-    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e)))?;
+    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e.to_string())))?;
 
   let res_xml = parse_gp_response(res).await.or_else(|err| {
     if err.status == StatusCode::NOT_FOUND {

crates/gpapi/src/service/event.rs

@@ -9,4 +9,5 @@ pub enum WsEvent {
   ActiveGui,
   /// External authentication data
   AuthData(String),
+  ResumeConnection,
 }

crates/gpapi/src/utils/endpoint.rs

@@ -1,10 +1,9 @@
-use tokio::fs;
-
-use crate::GP_SERVICE_LOCK_FILE;
+use super::lock_file::gpservice_lock_info;
 
 async fn read_port() -> anyhow::Result<String> {
-  let port = fs::read_to_string(GP_SERVICE_LOCK_FILE).await?;
-  Ok(port.trim().to_string())
+  let lock_info = gpservice_lock_info().await?;
+
+  Ok(lock_info.port.to_string())
 }
 
 pub async fn http_endpoint() -> anyhow::Result<String> {

crates/gpapi/src/utils/env_file.rs

@@ -3,7 +3,6 @@ use std::env;
 use std::io::Write;
 use std::path::Path;
 
-use log::info;
 use tempfile::NamedTempFile;
 
 pub fn persist_env_vars(extra: Option<HashMap<String, String>>) -> anyhow::Result<NamedTempFile> {
@@ -36,20 +35,3 @@ pub fn load_env_vars<T: AsRef<Path>>(env_file: T) -> anyhow::Result<HashMap<Stri
 
   Ok(env_vars)
 }
-
-pub fn patch_gui_runtime_env(hidpi: bool) {
-  // This is to avoid blank screen on some systems
-  std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
-
-  // Workaround for https://github.com/tauri-apps/tao/issues/929
-  let desktop = env::var("XDG_CURRENT_DESKTOP").unwrap_or_default().to_lowercase();
-  if desktop.contains("gnome") {
-    env::set_var("GDK_BACKEND", "x11");
-  }
-
-  if hidpi {
-    info!("Setting GDK_SCALE=2 and GDK_DPI_SCALE=0.5");
-    std::env::set_var("GDK_SCALE", "2");
-    std::env::set_var("GDK_DPI_SCALE", "0.5");
-  }
-}

crates/gpapi/src/utils/lock_file.rs

@@ -1,19 +1,24 @@
 use std::path::PathBuf;
 
+use thiserror::Error;
+use tokio::fs;
+
 pub struct LockFile {
   path: PathBuf,
+  pid: u32,
 }
 
 impl LockFile {
-  pub fn new<P: Into<PathBuf>>(path: P) -> Self {
-    Self { path: path.into() }
+  pub fn new<P: Into<PathBuf>>(path: P, pid: u32) -> Self {
+    Self { path: path.into(), pid }
   }
 
   pub fn exists(&self) -> bool {
     self.path.exists()
   }
 
-  pub fn lock(&self, content: impl AsRef<[u8]>) -> anyhow::Result<()> {
+  pub fn lock(&self, content: &str) -> anyhow::Result<()> {
+    let content = format!("{}:{}", self.pid, content);
     std::fs::write(&self.path, content)?;
     Ok(())
   }
@@ -37,3 +42,87 @@ impl LockFile {
     }
   }
 }
+
+#[derive(Error, Debug)]
+pub enum LockFileError {
+  #[error("Failed to read lock file: {0}")]
+  IoError(#[from] std::io::Error),
+
+  #[error("Invalid lock file format: expected 'pid:port'")]
+  InvalidFormat,
+
+  #[error("Invalid PID value: {0}")]
+  InvalidPid(std::num::ParseIntError),
+
+  #[error("Invalid port value: {0}")]
+  InvalidPort(std::num::ParseIntError),
+}
+
+pub struct LockInfo {
+  pub pid: u32,
+  pub port: u32,
+}
+
+impl LockInfo {
+  async fn from_file(path: impl AsRef<std::path::Path>) -> Result<Self, LockFileError> {
+    let content = fs::read_to_string(path).await?;
+    Self::parse(&content)
+  }
+
+  fn parse(content: &str) -> Result<Self, LockFileError> {
+    let mut parts = content.trim().split(':');
+
+    let pid = parts
+      .next()
+      .ok_or(LockFileError::InvalidFormat)?
+      .parse()
+      .map_err(LockFileError::InvalidPid)?;
+
+    let port = parts
+      .next()
+      .ok_or(LockFileError::InvalidFormat)?
+      .parse()
+      .map_err(LockFileError::InvalidPort)?;
+
+    // Ensure there are no extra parts after pid:port
+    if parts.next().is_some() {
+      return Err(LockFileError::InvalidFormat);
+    }
+
+    Ok(Self { pid, port })
+  }
+}
+
+pub async fn gpservice_lock_info() -> Result<LockInfo, LockFileError> {
+  LockInfo::from_file(crate::GP_SERVICE_LOCK_FILE).await
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn test_parse_valid_input() {
+    let info = LockInfo::parse("1234:8080").unwrap();
+    assert_eq!(info.pid, 1234);
+    assert_eq!(info.port, 8080);
+  }
+
+  #[test]
+  fn test_parse_invalid_format() {
+    assert!(matches!(
+      LockInfo::parse("123:456:789"),
+      Err(LockFileError::InvalidFormat)
+    ));
+  }
+
+  #[test]
+  fn test_parse_invalid_numbers() {
+    assert!(matches!(LockInfo::parse("abc:8080"), Err(LockFileError::InvalidPid(_))));
+
+    assert!(matches!(
+      LockInfo::parse("1234:abc"),
+      Err(LockFileError::InvalidPort(_))
+    ));
+  }
+}

crates/gpapi/src/utils/mod.rs

@@ -4,7 +4,7 @@ pub mod base64;
 pub mod checksum;
 pub mod crypto;
 pub mod endpoint;
-pub mod env_utils;
+pub mod env_file;
 pub mod lock_file;
 pub mod openssl;
 pub mod redact;

crates/gpapi/src/utils/window.rs

@@ -2,20 +2,25 @@ use std::{process::ExitStatus, time::Duration};
 
 use anyhow::bail;
 use log::info;
-use tauri::WebviewWindow;
+use tauri::Window;
 use tokio::process::Command;
 
 pub trait WindowExt {
   fn raise(&self) -> anyhow::Result<()>;
+  fn hide_menu(&self);
 }
 
-impl WindowExt for WebviewWindow {
+impl WindowExt for Window {
   fn raise(&self) -> anyhow::Result<()> {
     raise_window(self)
   }
+
+  fn hide_menu(&self) {
+    hide_menu(self);
+  }
 }
 
-pub fn raise_window(win: &WebviewWindow) -> anyhow::Result<()> {
+pub fn raise_window(win: &Window) -> anyhow::Result<()> {
   let is_wayland = std::env::var("XDG_SESSION_TYPE").unwrap_or_default() == "wayland";
 
   if is_wayland {
@@ -35,7 +40,7 @@ pub fn raise_window(win: &WebviewWindow) -> anyhow::Result<()> {
 
   // Calling window.show() on Windows will cause the menu to be shown.
   // We need to hide it again.
-  win.hide_menu()?;
+  hide_menu(win);
 
   Ok(())
 }
@@ -71,3 +76,22 @@ async fn wmctrl_try_raise_window(title: &str) -> anyhow::Result<ExitStatus> {
 
   Ok(exit_status)
 }
+
+fn hide_menu(win: &Window) {
+  let menu_handle = win.menu_handle();
+
+  tokio::spawn(async move {
+    loop {
+      let menu_visible = menu_handle.is_visible().unwrap_or(false);
+
+      if !menu_visible {
+        break;
+      }
+
+      if menu_visible {
+        let _ = menu_handle.hide();
+        tokio::time::sleep(Duration::from_millis(10)).await;
+      }
+    }
+  });
+}

packaging/binary/Makefile.in

@@ -10,6 +10,10 @@ install:
 		install -Dm755 artifacts/usr/bin/gpgui $(DESTDIR)/usr/bin/gpgui; \
 	fi
 
+	# Install the disconnect hooks
+	install -Dm755 artifacts/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down
+	install -Dm755 artifacts/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook
+
 	install -Dm644 artifacts/usr/share/applications/gpgui.desktop $(DESTDIR)/usr/share/applications/gpgui.desktop
 	install -Dm644 artifacts/usr/share/icons/hicolor/scalable/apps/gpgui.svg $(DESTDIR)/usr/share/icons/hicolor/scalable/apps/gpgui.svg
 	install -Dm644 artifacts/usr/share/icons/hicolor/32x32/apps/gpgui.png $(DESTDIR)/usr/share/icons/hicolor/32x32/apps/gpgui.png
@@ -26,6 +30,9 @@ uninstall:
 	rm -f $(DESTDIR)/usr/bin/gpgui-helper
 	rm -f $(DESTDIR)/usr/bin/gpgui
 
+	rm -f $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down
+	rm -f $(DESTDIR)/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook
+
 	rm -f $(DESTDIR)/usr/share/applications/gpgui.desktop
 	rm -f $(DESTDIR)/usr/share/icons/hicolor/scalable/apps/gpgui.svg
 	rm -f $(DESTDIR)/usr/share/icons/hicolor/32x32/apps/gpgui.png

packaging/deb/control.in

@@ -11,7 +11,7 @@ Build-Depends: debhelper (>= 9),
   libsecret-1-0,
   libayatana-appindicator3-1,
   gnome-keyring,
-  libwebkit2gtk-4.1-dev,
+  libwebkit2gtk-4.0-dev,
   libopenconnect-dev (>= 8.20),@RUST@
 Homepage: https://github.com/yuezk/GlobalProtect-openconnect
 

packaging/files/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# Resume the VPN connection if the network comes back up
+
+set -e
+
+PIDFILE=/tmp/gpservice_disconnected.pid
+
+resume_vpn() {
+  if [ -f $PIDFILE ]; then
+    PID=$(cat $PIDFILE)
+
+    # Always remove the PID file
+    rm $PIDFILE
+
+    # Ensure the PID is a gpservice process
+    if ps -p $PID -o comm= | grep -q gpservice; then
+      # Send a USR2 signal to the gpclient process to resume the VPN connection
+      kill -USR2 $PID
+    fi
+  fi
+}
+
+if [ "$2" = "up" ]; then
+  resume_vpn
+fi

packaging/files/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -e
+
+# Disconnect the VPN connection before the network goes down
+/usr/bin/gpclient disconnect --wait 3

packaging/pkgbuild/PKGBUILD.in

@@ -8,8 +8,8 @@ pkgdesc="A GUI for GlobalProtect VPN, based on OpenConnect, supports the SSO aut
 arch=('x86_64' 'aarch64')
 url="https://github.com/yuezk/GlobalProtect-openconnect"
 license=('GPL3')
-makedepends=('make' 'pkg-config' 'rust' 'cargo' 'jq' 'webkit2gtk-4.1' 'curl' 'wget' 'file' 'openssl' 'appmenu-gtk-module' 'libappindicator-gtk3' 'librsvg' 'openconnect' 'libsecret')
-depends=('openconnect>=8.20' webkit2gtk-4.1 libappindicator-gtk3 libsecret libxml2)
+makedepends=('make' 'pkg-config' 'rust' 'cargo' 'jq' 'webkit2gtk' 'curl' 'wget' 'file' 'openssl' 'appmenu-gtk-module' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libvips' 'libayatana-appindicator' 'openconnect' 'libsecret')
+depends=('openconnect>=8.20' webkit2gtk libappindicator-gtk3 libayatana-appindicator libsecret libxml2)
 optdepends=('wmctrl: for window management')
 
 provides=('globalprotect-openconnect' 'gpclient' 'gpservice' 'gpauth' 'gpgui')

packaging/rpm/globalprotect-openconnect.spec.in

@@ -19,11 +19,11 @@ BuildRequires:  wget
 BuildRequires:  file
 BuildRequires:  perl
 
-BuildRequires:  (webkit2gtk4.1-devel or webkit2gtk3-soup2-devel)
+BuildRequires:  (webkit2gtk4.0-devel or webkit2gtk3-soup2-devel)
 BuildRequires:  (libappindicator-gtk3-devel or libappindicator3-1)
 BuildRequires:  (librsvg2-devel or librsvg-devel)
 
-Requires:       openconnect >= 8.20, (libappindicator-gtk3 or libayatana-appindicator)
+Requires:       openconnect >= 8.20, (libayatana-appindicator or libappindicator-gtk3)
 Conflicts:      globalprotect-openconnect-snapshot
 
 %global debug_package %{nil}
@@ -55,6 +55,13 @@ make build OFFLINE=@OFFLINE@ BUILD_FE=0
 %{_datadir}/icons/hicolor/scalable/apps/gpgui.svg
 %{_datadir}/polkit-1/actions/com.yuezk.gpgui.policy
 
+%dir /usr/lib/NetworkManager
+%dir /usr/lib/NetworkManager/dispatcher.d
+%dir /usr/lib/NetworkManager/dispatcher.d/pre-down.d
+
+/usr/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down
+/usr/lib/NetworkManager/dispatcher.d/gpclient-nm-hook
+
 %dir %{_datadir}/icons/hicolor
 %dir %{_datadir}/icons/hicolor/32x32
 %dir %{_datadir}/icons/hicolor/32x32/apps

rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "1.71.1"

scripts/gh-release.sh

@@ -40,7 +40,7 @@ release_tag() {
   gh -R "$REPO" release create $TAG \
     --title "$TAG" \
     --notes "$RELEASE_NOTES" \
-    "$PROJECT_DIR"/.build/artifacts/artifact-source/* \
+    "$PROJECT_DIR"/.build/artifacts/artifact-source*/* \
     "$PROJECT_DIR"/.build/artifacts/artifact-gpgui-*/*
 }