Bump version 2.0.0-beta4

fix link in Readme

.devcontainer/Dockerfile

@@ -0,0 +1,62 @@
+FROM ubuntu:18.04
+
+ARG USERNAME=vscode
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+ENV RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH \
+    RUST_VERSION=1.75.0
+
+RUN set -eux; \
+  apt-get update; \
+  apt-get install -y --no-install-recommends \
+    sudo \
+    ca-certificates \
+    curl \
+    gnupg \
+    git \
+    less \
+    software-properties-common \
+    # Tauri dependencies
+    libwebkit2gtk-4.0-dev build-essential wget libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev; \
+  # Install openconnect
+  add-apt-repository ppa:yuezk/globalprotect-openconnect; \
+  apt-get update; \
+  apt-get install -y openconnect libopenconnect-dev; \
+  # Create a non-root user
+  groupadd --gid $USER_GID $USERNAME; \
+  useradd --uid $USER_UID --gid $USER_GID -m $USERNAME; \
+  echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME; \
+  chmod 0440 /etc/sudoers.d/$USERNAME; \
+  # Install Node.js
+  mkdir -p /etc/apt/keyrings; \
+  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg; \
+  echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_16.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list; \
+  apt-get update; \
+  apt-get install -y nodejs; \
+  corepack enable; \
+  # Install diff-so-fancy
+  npm install -g diff-so-fancy; \
+  # Install Rust
+  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $RUST_VERSION; \
+  chown -R $USERNAME:$USERNAME $RUSTUP_HOME $CARGO_HOME; \
+  rustup --version; \
+  cargo --version; \
+  rustc --version
+
+USER $USERNAME
+
+# Install Oh My Zsh
+RUN sh -c "$(wget -O- https://github.com/deluan/zsh-in-docker/releases/download/v1.1.5/zsh-in-docker.sh)" -- \
+    -t https://github.com/denysdovhan/spaceship-prompt \
+    -a 'SPACESHIP_PROMPT_ADD_NEWLINE="false"' \
+    -a 'SPACESHIP_PROMPT_SEPARATE_LINE="false"' \
+    -p git \
+    -p https://github.com/zsh-users/zsh-autosuggestions \
+    -p https://github.com/zsh-users/zsh-completions; \
+    # Change the default shell
+    sudo chsh -s /bin/zsh $USERNAME; \
+    # Change the XTERM to xterm-256color
+    sed -i 's/TERM=xterm/TERM=xterm-256color/g' $HOME/.zshrc;

.devcontainer/devcontainer.json

@@ -0,0 +1,10 @@
+{
+  "build": {
+    "dockerfile": "Dockerfile"
+  },
+  "runArgs": [
+    "--privileged",
+    "--cap-add=NET_ADMIN",
+    "--device=/dev/net/tun"
+  ]
+}

.editorconfig

@@ -7,15 +7,3 @@ indent_size = 2
 end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
-
-[*.{rs,toml}]
-indent_size = 4
-
-[*.{c,h}]
-indent_size = 4
-
-[*.{js,jsx,ts,tsx}]
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+ko_fi: yuezk
+custom: ["https://buymeacoffee.com/yuezk", "https://paypal.me/zongkun"]

.github/workflows/build.yaml

@@ -0,0 +1,116 @@
+name: Build GPGUI
+on:
+  push:
+    paths-ignore:
+      - LICENSE
+      - "*.md"
+      - .vscode
+      - .devcontainer
+    branches:
+      - main
+    # tags:
+    #   - v*.*.*
+jobs:
+  # Include arm64 if ref is a tag
+  setup-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Set up matrix
+        id: set-matrix
+        run: |
+          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+            echo "matrix=[\"amd64\", \"arm64\"]" >> $GITHUB_OUTPUT
+          else
+            echo "matrix=[\"amd64\"]" >> $GITHUB_OUTPUT
+          fi
+
+  build-fe:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout gpgui repo
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GH_PAT }}
+          repository: yuezk/gpgui
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - uses: pnpm/action-setup@v2
+        with:
+          version: 8
+
+      - name: Install dependencies
+        run: |
+          cd app
+          pnpm install
+      - name: Build
+        run: |
+          cd app
+          pnpm run build
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: gpgui-fe
+          path: app/dist
+
+  build-tauri:
+    needs: [setup-matrix, build-fe]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        arch: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+      - name: Checkout gpgui repo
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GH_PAT }}
+          repository: yuezk/gpgui
+          path: gpgui
+
+      - name: Checkout gp repo
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GH_PAT }}
+          repository: yuezk/GlobalProtect-openconnect
+          path: gp
+
+      - name: Download gpgui-fe artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: gpgui-fe
+          path: gpgui/app/dist
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: ${{ matrix.arch }}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Build Tauri in Docker
+        run: |
+          docker run \
+            --rm \
+            -v $(pwd):/${{ github.workspace }} \
+            -w ${{ github.workspace }} \
+            -e CI=true \
+            --platform linux/${{ matrix.arch }} \
+            yuezk/gpdev:main \
+            "./gpgui/scripts/build.sh"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifact-${{ matrix.arch }}-tauri
+          path: |
+            gpgui/.tmp/artifact

.gitignore

@@ -1,35 +1,4 @@
-# Created by https://www.toptal.com/developers/gitignore/api/rust,visualstudiocode
+.idea
-# Edit at https://www.toptal.com/developers/gitignore?templates=rust,visualstudiocode
+/target
-
+.pnpm-store
-### Rust ###
+.env
-# Generated by Cargo
-# will have compiled files and executables
-debug/
-target/
-
-# These are backup files generated by rustfmt
-**/*.rs.bk
-
-# MSVC Windows builds of rustc generate these, which store debugging information
-*.pdb
-
-### VisualStudioCode ###
-.vscode/*
-!.vscode/settings.json
-!.vscode/tasks.json
-!.vscode/launch.json
-!.vscode/extensions.json
-!.vscode/*.code-snippets
-
-# Local History for Visual Studio Code
-.history/
-
-# Built Visual Studio Code Extensions
-*.vsix
-
-### VisualStudioCode Patch ###
-# Ignore all local history of files
-.history
-.ionide
-
-# End of https://www.toptal.com/developers/gitignore/api/rust,visualstudiocode

.vscode/extensions.json

@@ -0,0 +1,9 @@
+{
+    "recommendations": [
+        "rust-lang.rust-analyzer",
+        "tamasfe.even-better-toml",
+        "eamodio.gitlens",
+        "EditorConfig.EditorConfig",
+        "streetsidesoftware.code-spell-checker",
+    ]
+}

.vscode/settings.json

@@ -1,52 +1,54 @@
 {
     "cSpell.words": [
         "authcookie",
-    "bindgen",
+        "bincode",
-    "clickaway",
+        "chacha",
-    "clientgpversion",
         "clientos",
-    "configparser",
+        "datetime",
-    "consts",
+        "disconnectable",
-    "devicename",
         "distro",
+        "dotenv",
+        "dotenvy",
+        "getconfig",
+        "globalprotect",
+        "gpapi",
+        "gpauth",
+        "gpclient",
         "gpcommon",
-    "gpconf",
         "gpgui",
         "gpservice",
-    "humantime",
+        "hidpi",
-    "Immer",
         "jnlp",
-    "lexopt",
+        "LOGNAME",
-    "notistack",
         "oneshot",
         "openconnect",
         "pkexec",
-    "prelogin",
+        "Prelogin",
         "prelogon",
         "prelogonuserauthcookie",
         "repr",
-    "rustc",
+        "reqwest",
+        "roxmltree",
+        "rspc",
         "servercert",
-    "shlex",
+        "specta",
+        "sysinfo",
+        "tanstack",
         "tauri",
-    "tempdir",
         "tempfile",
         "thiserror",
+        "tungstenite",
+        "unistd",
         "unlisten",
+        "urlencoding",
         "userauthcookie",
+        "utsbuf",
+        "uzers",
+        "Vite",
         "vpnc",
-    "vpninfo"
+        "vpninfo",
-  ],
+        "wmctrl",
-  "files.associations": {
+        "XAUTHORITY",
-    "*.css": "css",
+        "yuezk"
-    "errno.h": "c",
+    ]
-    "stdarg.h": "c",
-    "wrapper.h": "c",
-    "cstdlib": "c",
-    "stdio.h": "c",
-    "openconnect.h": "c",
-    "compare": "c",
-    "stdlib.h": "c",
-    "vpn.h": "c"
-  }
 }

Cargo.toml

@@ -1,12 +1,52 @@
 [workspace]
+resolver = "2"
 
-members = [
+members = ["crates/*", "apps/gpclient", "apps/gpservice", "apps/gpauth"]
-    "gpcommon",
+
-    "gpclient",
+[workspace.package]
-    "gpservice",
+version = "2.0.0-beta4"
-    "gpgui/src-tauri"
+authors = ["Kevin Yue <k3vinyue@gmail.com>"]
-]
+homepage = "https://github.com/yuezk/GlobalProtect-openconnect"
+edition = "2021"
+license = "GPL-3.0"
+
+[workspace.dependencies]
+anyhow = "1.0"
+base64 = "0.21"
+clap = { version = "4.4.2", features = ["derive"] }
+ctrlc = "3.4"
+directories = "5.0"
+env_logger = "0.10"
+is_executable = "1.0"
+log = "0.4"
+regex = "1"
+reqwest = { version = "0.11", features = ["native-tls-vendored", "json"] }
+roxmltree = "0.18"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+sysinfo = "0.29"
+tempfile = "3.8"
+tokio = { version = "1", features = ["full"] }
+tokio-util = "0.7"
+url = "2.4"
+urlencoding = "2.1.3"
+axum = "0.7"
+futures = "0.3"
+futures-util = "0.3"
+tokio-tungstenite = "0.20.1"
+specta = "=2.0.0-rc.1"
+specta-macros = "=2.0.0-rc.1"
+uzers = "0.11"
+whoami = "1"
+tauri = { version = "1.5" }
+thiserror = "1"
+redact-engine = "0.1"
+dotenvy_macro = "0.15"
+compile-time = "0.2"
 
 [profile.release]
-strip = true
+opt-level = 'z'   # Optimize for size
-opt-level = "z"
+lto = true        # Enable link-time optimization
+codegen-units = 1 # Reduce number of codegen units to increase optimizations
+panic = 'abort'   # Abort on panic
+strip = true      # Strip symbols from binary*

LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -1,42 +1,127 @@
+# GlobalProtect-openconnect
+
+A GUI for GlobalProtect VPN, based on OpenConnect, supports the SSO authentication method. Inspired by [gp-saml-gui](https://github.com/dlenski/gp-saml-gui).
+
 <p align="center">
   <img width="300" src="https://github.com/yuezk/GlobalProtect-openconnect/assets/3297602/9242df9c-217d-42ab-8c21-8f9f69cd4eb5">
 </p>
 
-## Development
+## Features
 
-### Dependencies
+- [x] Better Linux support
+- [x] Support both CLI and GUI
+- [x] Support both SSO and non-SSO authentication
+- [x] Support multiple portals
+- [x] Support gateway selection
+- [x] Support auto-connect on startup
+- [x] Support system tray icon
 
-The following packages will be required to build depending on your environment:
+## Usage
 
-- [Cargo](https://doc.rust-lang.org/cargo/getting-started/installation.html)
+### CLI
-- [pnpm](https://pnpm.io/installation)
-- openconnect-devel (containing `openconnect.h`): `sudo apt install libopenconnect-dev` or `sudo yum install openconnect-devel`
-- GDK dependencies `sudo apt install libgdk3.0-cil-dev libcairo2-dev libsoup2.4-dev libgdk-pixbuf-2.0-dev libjavascriptcoregtk-4.0-dev libatk1.0-dev libpango1.0-dev libwebkit2gtk-4.0-dev`
 
-### Build the service
+The CLI version is always free and open source in this repo. It has almost the same features as the GUI version.
 
-```sh
+```
-# Build the client first
+Usage: gpclient [OPTIONS] <COMMAND>
-cargo build -p gpclient
 
-# Build the service
+Commands:
-cargo build -p gpservice
+  connect     Connect to a portal server
+  disconnect  Disconnect from the server
+  launch-gui  Launch the GUI
+  help        Print this message or the help of the given subcommand(s)
+
+Options:
+      --fix-openssl        Get around the OpenSSL `unsafe legacy renegotiation` error
+      --ignore-tls-errors  Ignore the TLS errors
+  -h, --help               Print help
+  -V, --version            Print version
+
+See 'gpclient help <command>' for more information on a specific command.
 ```
 
-### Start the service
+### GUI
 
-```sh
+The GUI version is also available after you installed it. You can launch it from the application menu or run `gpclient launch-gui` in the terminal.
-sudo ./target/debug/gpservice
+
+> [!Note]
+>
+> The GUI version is partially open source. Its background service is open sourced in this repo as [gpservice](./apps/gpservice/). The GUI part is a wrapper of the background service, which is not open sourced.
+
+## Installation
+
+> [!Note]
+>
+> This instruction is for the 2.x version. The 1.x version is still available on the [1.x](https://github.com/yuezk/GlobalProtect-openconnect/tree/1.x) branch, you can build it from the source code by following the instructions in the `README.md` file.
+
+> [!Warning]
+>
+> The client requires `openconnect >= 8.20`, please make sure you have it installed, you can check it with `openconnect --version`.
+> Installing the client from PPA will automatically install the required version of `openconnect`.
+
+### Debian/Ubuntu based distributions
+
+#### Install from PPA
+
+```
+sudo add-apt-repository ppa:yuezk/globalprotect-openconnect
+sudo apt-get update
+sudo apt-get install globalprotect-openconnect
 ```
 
-### Start the GUI
+> [!Note]
+>
+> For Linux Mint, you might need to import the GPG key with: `sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7937C393082992E5D6E4A60453FC26B43838D761` if you encountered an error `gpg: keyserver receive failed: General error`.
 
-```sh
+#### Install from deb package
-cd gpgui
+
-pnpm install
+Download the latest deb package from [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page. Then install it with `dpkg`:
-pnpm tauri dev
+
+```bash
+sudo dpkg -i globalprotect-openconnect_*.deb
 ```
 
-### Open the DevTools
+### Arch Linux / Manjaro
 
-Right-click on the GUI window and select "Inspect Element".
+#### Install from AUR
+
+Install from AUR: [globalprotect-openconnect-git](https://aur.archlinux.org/packages/globalprotect-openconnect-git/)
+
+```
+yay -S globalprotect-openconnect-git
+```
+
+#### Install from package
+
+Download the latest package from [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page. Then install it with `pacman`:
+
+```bash
+sudo pacman -U globalprotect-openconnect-*.pkg.tar.zst
+```
+
+### Fedora/OpenSUSE/CentOS/RHEL
+
+#### Install from COPR
+
+The package is available on [COPR](https://copr.fedorainfracloud.org/coprs/yuezk/globalprotect-openconnect/) for various RPM-based distributions. You can install it with the following commands:
+
+```
+sudo dnf copr enable yuezk/globalprotect-openconnect
+sudo dnf install globalprotect-openconnect
+```
+
+#### Install from OBS
+
+The package is also available on [OBS](https://build.opensuse.org/package/show/home:yuezk/globalprotect-openconnect) for various RPM-based distributions. You can follow the instructions [on this page](https://software.opensuse.org//download.html?project=home%3Ayuezk&package=globalprotect-openconnect) to install it.
+
+#### Install from RPM package
+
+Download the latest RPM package from [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page.
+
+### Other distributions
+
+The project depends on `openconnect >= 8.20`, `webkit2gtk`, `libsecret`, `libayatana-appindicator` or `libappindicator-gtk3`. You can install them first and then download the latest binary release (i.e., `*.bin.tar.gz`) from [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page.
+
+## [License](./LICENSE)
+
+GPLv3

apps/gpauth/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "gpauth"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[build-dependencies]
+tauri-build = { version = "1.5", features = [] }
+
+[dependencies]
+gpapi = { path = "../../crates/gpapi", features = ["tauri", "clap"] }
+anyhow.workspace = true
+clap.workspace = true
+env_logger.workspace = true
+log.workspace = true
+regex.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tokio-util.workspace = true
+tempfile.workspace = true
+webkit2gtk = "0.18.2"
+tauri = { workspace = true, features = ["http-all"] }
+compile-time.workspace = true

apps/gpauth/index.html

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>GlobalProtect Login</title>
+</head>
+<body>
+  <p>Redirecting to GlobalProtect Login...</p>
+</body>
+</html>

apps/gpauth/src/auth_window.rs

@@ -0,0 +1,486 @@
+use std::{
+  rc::Rc,
+  sync::Arc,
+  time::{Duration, Instant},
+};
+
+use anyhow::bail;
+use gpapi::{
+  auth::SamlAuthData,
+  gp_params::GpParams,
+  portal::{prelogin, Prelogin},
+  utils::{redact::redact_uri, window::WindowExt},
+};
+use log::{info, warn};
+use regex::Regex;
+use tauri::{AppHandle, Window, WindowEvent, WindowUrl};
+use tokio::sync::{mpsc, oneshot, RwLock};
+use tokio_util::sync::CancellationToken;
+use webkit2gtk::{
+  gio::Cancellable,
+  glib::{GString, TimeSpan},
+  LoadEvent, SettingsExt, TLSErrorsPolicy, URIResponse, URIResponseExt, WebContextExt, WebResource,
+  WebResourceExt, WebView, WebViewExt, WebsiteDataManagerExtManual, WebsiteDataTypes,
+};
+
+enum AuthDataError {
+  /// Failed to load page due to TLS error
+  TlsError,
+  /// 1. Found auth data in headers/body but it's invalid
+  /// 2. Loaded an empty page, failed to load page. etc.
+  Invalid,
+  /// No auth data found in headers/body
+  NotFound,
+}
+
+type AuthResult = Result<SamlAuthData, AuthDataError>;
+
+pub(crate) struct AuthWindow<'a> {
+  app_handle: AppHandle,
+  server: &'a str,
+  saml_request: &'a str,
+  user_agent: &'a str,
+  gp_params: Option<GpParams>,
+  clean: bool,
+}
+
+impl<'a> AuthWindow<'a> {
+  pub fn new(app_handle: AppHandle) -> Self {
+    Self {
+      app_handle,
+      server: "",
+      saml_request: "",
+      user_agent: "",
+      gp_params: None,
+      clean: false,
+    }
+  }
+
+  pub fn server(mut self, server: &'a str) -> Self {
+    self.server = server;
+    self
+  }
+
+  pub fn saml_request(mut self, saml_request: &'a str) -> Self {
+    self.saml_request = saml_request;
+    self
+  }
+
+  pub fn user_agent(mut self, user_agent: &'a str) -> Self {
+    self.user_agent = user_agent;
+    self
+  }
+
+  pub fn gp_params(mut self, gp_params: GpParams) -> Self {
+    self.gp_params.replace(gp_params);
+    self
+  }
+
+  pub fn clean(mut self, clean: bool) -> Self {
+    self.clean = clean;
+    self
+  }
+
+  pub async fn open(&self) -> anyhow::Result<SamlAuthData> {
+    info!("Open auth window, user_agent: {}", self.user_agent);
+
+    let window = Window::builder(&self.app_handle, "auth_window", WindowUrl::default())
+      .title("GlobalProtect Login")
+      // .user_agent(self.user_agent)
+      .focused(true)
+      .visible(false)
+      .center()
+      .build()?;
+
+    let window = Arc::new(window);
+
+    let cancel_token = CancellationToken::new();
+    let cancel_token_clone = cancel_token.clone();
+
+    window.on_window_event(move |event| {
+      if let WindowEvent::CloseRequested { .. } = event {
+        cancel_token_clone.cancel();
+      }
+    });
+
+    let window_clone = Arc::clone(&window);
+    let timeout_secs = 15;
+    tokio::spawn(async move {
+      tokio::time::sleep(Duration::from_secs(timeout_secs)).await;
+      let visible = window_clone.is_visible().unwrap_or(false);
+      if !visible {
+        info!("Try to raise auth window after {} seconds", timeout_secs);
+        raise_window(&window_clone);
+      }
+    });
+
+    tokio::select! {
+      _ = cancel_token.cancelled() => {
+        bail!("Auth cancelled");
+      }
+      saml_result = self.auth_loop(&window) => {
+        window.close()?;
+        saml_result
+      }
+    }
+  }
+
+  async fn auth_loop(&self, window: &Arc<Window>) -> anyhow::Result<SamlAuthData> {
+    let saml_request = self.saml_request.to_string();
+    let (auth_result_tx, mut auth_result_rx) = mpsc::unbounded_channel::<AuthResult>();
+    let raise_window_cancel_token: Arc<RwLock<Option<CancellationToken>>> = Default::default();
+    let gp_params = self.gp_params.as_ref().unwrap();
+    let tls_err_policy = if gp_params.ignore_tls_errors() {
+      TLSErrorsPolicy::Ignore
+    } else {
+      TLSErrorsPolicy::Fail
+    };
+
+    if self.clean {
+      clear_webview_cookies(window).await?;
+    }
+
+    let raise_window_cancel_token_clone = Arc::clone(&raise_window_cancel_token);
+    window.with_webview(move |wv| {
+      let wv = wv.inner();
+
+      if let Some(context) = wv.context() {
+        context.set_tls_errors_policy(tls_err_policy);
+      }
+
+      if let Some(settings) = wv.settings() {
+        let ua = settings.user_agent().unwrap_or("".into());
+        info!("Auth window user agent: {}", ua);
+      }
+
+      // Load the initial SAML request
+      load_saml_request(&wv, &saml_request);
+
+      let auth_result_tx_clone = auth_result_tx.clone();
+      wv.connect_load_changed(move |wv, event| {
+        if event == LoadEvent::Started {
+          let Ok(mut cancel_token) = raise_window_cancel_token_clone.try_write() else {
+            return;
+          };
+
+          // Cancel the raise window task
+          if let Some(cancel_token) = cancel_token.take() {
+            cancel_token.cancel();
+          }
+          return;
+        }
+
+        if event != LoadEvent::Finished {
+          return;
+        }
+
+        if let Some(main_resource) = wv.main_resource() {
+          let uri = main_resource.uri().unwrap_or("".into());
+
+          if uri.is_empty() {
+            warn!("Loaded an empty uri");
+            send_auth_result(&auth_result_tx_clone, Err(AuthDataError::Invalid));
+            return;
+          }
+
+          info!("Loaded uri: {}", redact_uri(&uri));
+          read_auth_data(&main_resource, auth_result_tx_clone.clone());
+        }
+      });
+
+      let auth_result_tx_clone = auth_result_tx.clone();
+      wv.connect_load_failed_with_tls_errors(move |_wv, uri, cert, err| {
+        let redacted_uri = redact_uri(uri);
+        warn!(
+          "Failed to load uri: {} with error: {}, cert: {}",
+          redacted_uri, err, cert
+        );
+
+        send_auth_result(&auth_result_tx_clone, Err(AuthDataError::TlsError));
+        true
+      });
+
+      wv.connect_load_failed(move |_wv, _event, uri, err| {
+        let redacted_uri = redact_uri(uri);
+        warn!("Failed to load uri: {} with error: {}", redacted_uri, err);
+        // NOTE: Don't send error here, since load_changed event will be triggered after this
+        // send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
+        // true to stop other handlers from being invoked for the event. false to propagate the event further.
+        true
+      });
+    })?;
+
+    let portal = self.server.to_string();
+
+    loop {
+      if let Some(auth_result) = auth_result_rx.recv().await {
+        match auth_result {
+          Ok(auth_data) => return Ok(auth_data),
+          Err(AuthDataError::TlsError) => {
+            return Err(anyhow::anyhow!("TLS error: certificate verify failed"))
+          }
+          Err(AuthDataError::NotFound) => {
+            info!("No auth data found, it may not be the /SAML20/SP/ACS endpoint");
+
+            // The user may need to interact with the auth window, raise it in 3 seconds
+            if !window.is_visible().unwrap_or(false) {
+              let window = Arc::clone(window);
+              let cancel_token = CancellationToken::new();
+
+              raise_window_cancel_token
+                .write()
+                .await
+                .replace(cancel_token.clone());
+
+              tokio::spawn(async move {
+                let delay_secs = 1;
+
+                info!("Raise window in {} second(s)", delay_secs);
+                tokio::select! {
+                  _ = tokio::time::sleep(Duration::from_secs(delay_secs)) => {
+                    raise_window(&window);
+                  }
+                  _ = cancel_token.cancelled() => {
+                    info!("Raise window cancelled");
+                  }
+                }
+              });
+            }
+          }
+          Err(AuthDataError::Invalid) => {
+            info!("Got invalid auth data, retrying...");
+
+            window.with_webview(|wv| {
+              let wv = wv.inner();
+              wv.run_javascript(r#"
+                  var loading = document.createElement("div");
+                  loading.innerHTML = '<div style="position: absolute; width: 100%; text-align: center; font-size: 20px; font-weight: bold; top: 50%; left: 50%; transform: translate(-50%, -50%);">Got invalid token, retrying...</div>';
+                  loading.style = "position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(255, 255, 255, 0.85); z-index: 99999;";
+                  document.body.appendChild(loading);
+              "#,
+                  Cancellable::NONE,
+                  |_| info!("Injected loading element successfully"),
+              );
+            })?;
+
+            let saml_request = portal_prelogin(&portal, gp_params).await?;
+            window.with_webview(move |wv| {
+              let wv = wv.inner();
+              load_saml_request(&wv, &saml_request);
+            })?;
+          }
+        }
+      }
+    }
+  }
+}
+
+fn raise_window(window: &Arc<Window>) {
+  let visible = window.is_visible().unwrap_or(false);
+  if !visible {
+    if let Err(err) = window.raise() {
+      warn!("Failed to raise window: {}", err);
+    }
+  }
+}
+
+pub(crate) async fn portal_prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<String> {
+  info!("Portal prelogin...");
+
+  match prelogin(portal, gp_params).await? {
+    Prelogin::Saml(prelogin) => Ok(prelogin.saml_request().to_string()),
+    Prelogin::Standard(_) => Err(anyhow::anyhow!("Received non-SAML prelogin response")),
+  }
+}
+
+fn send_auth_result(auth_result_tx: &mpsc::UnboundedSender<AuthResult>, auth_result: AuthResult) {
+  if let Err(err) = auth_result_tx.send(auth_result) {
+    warn!("Failed to send auth event: {}", err);
+  }
+}
+
+fn load_saml_request(wv: &Rc<WebView>, saml_request: &str) {
+  if saml_request.starts_with("http") {
+    info!("Load the SAML request as URI...");
+    wv.load_uri(saml_request);
+  } else {
+    info!("Load the SAML request as HTML...");
+    wv.load_html(saml_request, None);
+  }
+}
+
+fn read_auth_data_from_headers(response: &URIResponse) -> AuthResult {
+  response.http_headers().map_or_else(
+    || {
+      info!("No headers found in response");
+      Err(AuthDataError::NotFound)
+    },
+    |mut headers| match headers.get("saml-auth-status") {
+      Some(status) if status == "1" => {
+        let username = headers.get("saml-username").map(GString::into);
+        let prelogin_cookie = headers.get("prelogin-cookie").map(GString::into);
+        let portal_userauthcookie = headers.get("portal-userauthcookie").map(GString::into);
+
+        if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
+          return Ok(SamlAuthData::new(
+            username.unwrap(),
+            prelogin_cookie,
+            portal_userauthcookie,
+          ));
+        }
+
+        info!("Found invalid auth data in headers");
+        Err(AuthDataError::Invalid)
+      }
+      Some(status) => {
+        info!("Found invalid SAML status: {} in headers", status);
+        Err(AuthDataError::Invalid)
+      }
+      None => {
+        info!("No saml-auth-status header found");
+        Err(AuthDataError::NotFound)
+      }
+    },
+  )
+}
+
+fn read_auth_data_from_body<F>(main_resource: &WebResource, callback: F)
+where
+  F: FnOnce(AuthResult) + Send + 'static,
+{
+  main_resource.data(Cancellable::NONE, |data| match data {
+    Ok(data) => {
+      let html = String::from_utf8_lossy(&data);
+      callback(read_auth_data_from_html(&html));
+    }
+    Err(err) => {
+      info!("Failed to read response body: {}", err);
+      callback(Err(AuthDataError::Invalid))
+    }
+  });
+}
+
+fn read_auth_data_from_html(html: &str) -> AuthResult {
+  if html.contains("Temporarily Unavailable") {
+    info!("Found 'Temporarily Unavailable' in HTML, auth failed");
+    return Err(AuthDataError::Invalid);
+  }
+
+  match parse_xml_tag(html, "saml-auth-status") {
+    Some(saml_status) if saml_status == "1" => {
+      let username = parse_xml_tag(html, "saml-username");
+      let prelogin_cookie = parse_xml_tag(html, "prelogin-cookie");
+      let portal_userauthcookie = parse_xml_tag(html, "portal-userauthcookie");
+
+      if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
+        return Ok(SamlAuthData::new(
+          username.unwrap(),
+          prelogin_cookie,
+          portal_userauthcookie,
+        ));
+      }
+
+      info!("Found invalid auth data in HTML");
+      Err(AuthDataError::Invalid)
+    }
+    Some(status) => {
+      info!("Found invalid SAML status {} in HTML", status);
+      Err(AuthDataError::Invalid)
+    }
+    None => {
+      info!("No auth data found in HTML");
+      Err(AuthDataError::NotFound)
+    }
+  }
+}
+
+fn read_auth_data(main_resource: &WebResource, auth_result_tx: mpsc::UnboundedSender<AuthResult>) {
+  if main_resource.response().is_none() {
+    info!("No response found in main resource");
+    send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
+    return;
+  }
+
+  let response = main_resource.response().unwrap();
+  info!("Trying to read auth data from response headers...");
+
+  match read_auth_data_from_headers(&response) {
+    Ok(auth_data) => {
+      info!("Got auth data from headers");
+      send_auth_result(&auth_result_tx, Ok(auth_data));
+    }
+    Err(AuthDataError::Invalid) => {
+      info!("Found invalid auth data in headers, trying to read from body...");
+      read_auth_data_from_body(main_resource, move |auth_result| {
+        // Since we have already found invalid auth data in headers, which means this could be the `/SAML20/SP/ACS` endpoint
+        // any error result from body should be considered as invalid, and trigger a retry
+        let auth_result = auth_result.map_err(|_| AuthDataError::Invalid);
+        send_auth_result(&auth_result_tx, auth_result);
+      });
+    }
+    Err(AuthDataError::NotFound) => {
+      info!("No auth data found in headers, trying to read from body...");
+      read_auth_data_from_body(main_resource, move |auth_result| {
+        send_auth_result(&auth_result_tx, auth_result)
+      });
+    }
+    Err(AuthDataError::TlsError) => {
+      // NOTE: This is unreachable
+      info!("TLS error found in headers, trying to read from body...");
+      send_auth_result(&auth_result_tx, Err(AuthDataError::TlsError));
+    }
+  }
+}
+
+fn parse_xml_tag(html: &str, tag: &str) -> Option<String> {
+  let re = Regex::new(&format!("<{}>(.*)</{}>", tag, tag)).unwrap();
+  re.captures(html)
+    .and_then(|captures| captures.get(1))
+    .map(|m| m.as_str().to_string())
+}
+
+pub(crate) async fn clear_webview_cookies(window: &Window) -> anyhow::Result<()> {
+  let (tx, rx) = oneshot::channel::<Result<(), String>>();
+
+  window.with_webview(|wv| {
+    let send_result = move |result: Result<(), String>| {
+      if let Err(err) = tx.send(result) {
+        info!("Failed to send result: {:?}", err);
+      }
+    };
+
+    let wv = wv.inner();
+    let context = match wv.context() {
+      Some(context) => context,
+      None => {
+        send_result(Err("No webview context found".into()));
+        return;
+      }
+    };
+    let data_manager = match context.website_data_manager() {
+      Some(manager) => manager,
+      None => {
+        send_result(Err("No data manager found".into()));
+        return;
+      }
+    };
+
+    let now = Instant::now();
+    data_manager.clear(
+      WebsiteDataTypes::COOKIES,
+      TimeSpan(0),
+      Cancellable::NONE,
+      move |result| match result {
+        Err(err) => {
+          send_result(Err(err.to_string()));
+        }
+        Ok(_) => {
+          info!("Cookies cleared in {} ms", now.elapsed().as_millis());
+          send_result(Ok(()));
+        }
+      },
+    );
+  })?;
+
+  rx.await?.map_err(|err| anyhow::anyhow!(err))
+}

apps/gpauth/src/cli.rs

@@ -0,0 +1,164 @@
+use clap::Parser;
+use gpapi::{
+  auth::{SamlAuthData, SamlAuthResult},
+  clap::args::Os,
+  gp_params::{ClientOs, GpParams},
+  utils::{normalize_server, openssl},
+  GP_USER_AGENT,
+};
+use log::{info, LevelFilter};
+use serde_json::json;
+use tauri::{App, AppHandle, RunEvent};
+use tempfile::NamedTempFile;
+
+use crate::auth_window::{portal_prelogin, AuthWindow};
+
+const VERSION: &str = concat!(
+  env!("CARGO_PKG_VERSION"),
+  " (",
+  compile_time::date_str!(),
+  ")"
+);
+
+#[derive(Parser, Clone)]
+#[command(version = VERSION)]
+struct Cli {
+  server: String,
+  #[arg(long)]
+  saml_request: Option<String>,
+  #[arg(long, default_value = GP_USER_AGENT)]
+  user_agent: String,
+  #[arg(long, default_value = "Linux")]
+  os: Os,
+  #[arg(long)]
+  os_version: Option<String>,
+  #[arg(long)]
+  hidpi: bool,
+  #[arg(long)]
+  fix_openssl: bool,
+  #[arg(long)]
+  ignore_tls_errors: bool,
+  #[arg(long)]
+  clean: bool,
+}
+
+impl Cli {
+  async fn run(&mut self) -> anyhow::Result<()> {
+    if self.ignore_tls_errors {
+      info!("TLS errors will be ignored");
+    }
+
+    let mut openssl_conf = self.prepare_env()?;
+
+    self.server = normalize_server(&self.server)?;
+    let gp_params = self.build_gp_params();
+
+    // Get the initial SAML request
+    let saml_request = match self.saml_request {
+      Some(ref saml_request) => saml_request.clone(),
+      None => portal_prelogin(&self.server, &gp_params).await?,
+    };
+
+    self.saml_request.replace(saml_request);
+
+    let app = create_app(self.clone())?;
+
+    app.run(move |_app_handle, event| {
+      if let RunEvent::Exit = event {
+        if let Some(file) = openssl_conf.take() {
+          if let Err(err) = file.close() {
+            info!("Error closing OpenSSL config file: {}", err);
+          }
+        }
+      }
+    });
+
+    Ok(())
+  }
+
+  fn prepare_env(&self) -> anyhow::Result<Option<NamedTempFile>> {
+    std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
+
+    if self.hidpi {
+      info!("Setting GDK_SCALE=2 and GDK_DPI_SCALE=0.5");
+
+      std::env::set_var("GDK_SCALE", "2");
+      std::env::set_var("GDK_DPI_SCALE", "0.5");
+    }
+
+    if self.fix_openssl {
+      info!("Fixing OpenSSL environment");
+      let file = openssl::fix_openssl_env()?;
+
+      return Ok(Some(file));
+    }
+
+    Ok(None)
+  }
+
+  fn build_gp_params(&self) -> GpParams {
+    let gp_params = GpParams::builder()
+      .user_agent(&self.user_agent)
+      .client_os(ClientOs::from(&self.os))
+      .os_version(self.os_version.clone())
+      .ignore_tls_errors(self.ignore_tls_errors)
+      .build();
+
+    gp_params
+  }
+
+  async fn saml_auth(&self, app_handle: AppHandle) -> anyhow::Result<SamlAuthData> {
+    let auth_window = AuthWindow::new(app_handle)
+      .server(&self.server)
+      .user_agent(&self.user_agent)
+      .gp_params(self.build_gp_params())
+      .saml_request(self.saml_request.as_ref().unwrap())
+      .clean(self.clean);
+
+    auth_window.open().await
+  }
+}
+
+fn create_app(cli: Cli) -> anyhow::Result<App> {
+  let app = tauri::Builder::default()
+    .setup(|app| {
+      let app_handle = app.handle();
+
+      tauri::async_runtime::spawn(async move {
+        let auth_result = match cli.saml_auth(app_handle.clone()).await {
+          Ok(auth_data) => SamlAuthResult::Success(auth_data),
+          Err(err) => SamlAuthResult::Failure(format!("{}", err)),
+        };
+
+        println!("{}", json!(auth_result));
+      });
+      Ok(())
+    })
+    .build(tauri::generate_context!())?;
+
+  Ok(app)
+}
+
+fn init_logger() {
+  env_logger::builder().filter_level(LevelFilter::Info).init();
+}
+
+pub async fn run() {
+  let mut cli = Cli::parse();
+
+  init_logger();
+  info!("gpauth started: {}", VERSION);
+
+  if let Err(err) = cli.run().await {
+    eprintln!("\nError: {}", err);
+
+    if err.to_string().contains("unsafe legacy renegotiation") && !cli.fix_openssl {
+      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
+      // Print the command
+      let args = std::env::args().collect::<Vec<_>>();
+      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
+    }
+
+    std::process::exit(1);
+  }
+}

apps/gpauth/src/main.rs

@@ -0,0 +1,9 @@
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+mod auth_window;
+mod cli;
+
+#[tokio::main]
+async fn main() {
+  cli::run().await;
+}

apps/gpauth/tauri.conf.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v1.5.0/tooling/cli/schema.json",
+  "build": {
+    "distDir": [
+      "index.html"
+    ],
+    "devPath": [
+      "index.html"
+    ],
+    "beforeDevCommand": "",
+    "beforeBuildCommand": "",
+    "withGlobalTauri": false
+  },
+  "package": {
+    "productName": "gpauth",
+    "version": "0.0.0"
+  },
+  "tauri": {
+    "allowlist": {
+      "all": false,
+      "http": {
+        "all": true,
+        "request": true,
+        "scope": [
+          "http://**",
+          "https://**"
+        ]
+      }
+    },
+    "bundle": {
+      "active": true,
+      "targets": "deb",
+      "identifier": "com.yuezk.gpauth",
+      "icon": [
+        "icons/32x32.png",
+        "icons/128x128.png",
+        "icons/128x128@2x.png",
+        "icons/icon.icns",
+        "icons/icon.ico"
+      ]
+    },
+    "security": {
+      "csp": null
+    },
+    "windows": []
+  }
+}

apps/gpclient/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "gpclient"
+authors.workspace = true
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+gpapi = { path = "../../crates/gpapi", features = ["clap"] }
+openconnect = { path = "../../crates/openconnect" }
+anyhow.workspace = true
+clap.workspace = true
+env_logger.workspace = true
+inquire = "0.6.2"
+log.workspace = true
+tokio.workspace = true
+sysinfo.workspace = true
+serde_json.workspace = true
+whoami.workspace = true
+tempfile.workspace = true
+reqwest.workspace = true
+directories = "5.0"
+compile-time.workspace = true

apps/gpclient/src/cli.rs

@@ -0,0 +1,129 @@
+use clap::{Parser, Subcommand};
+use gpapi::utils::openssl;
+use log::{info, LevelFilter};
+use tempfile::NamedTempFile;
+
+use crate::{
+  connect::{ConnectArgs, ConnectHandler},
+  disconnect::DisconnectHandler,
+  launch_gui::{LaunchGuiArgs, LaunchGuiHandler},
+};
+
+const VERSION: &str = concat!(
+  env!("CARGO_PKG_VERSION"),
+  " (",
+  compile_time::date_str!(),
+  ")"
+);
+
+pub(crate) struct SharedArgs {
+  pub(crate) fix_openssl: bool,
+  pub(crate) ignore_tls_errors: bool,
+}
+
+#[derive(Subcommand)]
+enum CliCommand {
+  #[command(about = "Connect to a portal server")]
+  Connect(ConnectArgs),
+  #[command(about = "Disconnect from the server")]
+  Disconnect,
+  #[command(about = "Launch the GUI")]
+  LaunchGui(LaunchGuiArgs),
+}
+
+#[derive(Parser)]
+#[command(
+  version = VERSION,
+  author,
+  about = "The GlobalProtect VPN client, based on OpenConnect, supports the SSO authentication method.",
+  help_template = "\
+{before-help}{name} {version}
+{author}
+
+{about}
+
+{usage-heading} {usage}
+
+{all-args}{after-help}
+
+See 'gpclient help <command>' for more information on a specific command.
+"
+)]
+struct Cli {
+  #[command(subcommand)]
+  command: CliCommand,
+
+  #[arg(
+    long,
+    help = "Get around the OpenSSL `unsafe legacy renegotiation` error"
+  )]
+  fix_openssl: bool,
+  #[arg(long, help = "Ignore the TLS errors")]
+  ignore_tls_errors: bool,
+}
+
+impl Cli {
+  fn fix_openssl(&self) -> anyhow::Result<Option<NamedTempFile>> {
+    if self.fix_openssl {
+      let file = openssl::fix_openssl_env()?;
+      return Ok(Some(file));
+    }
+
+    Ok(None)
+  }
+
+  async fn run(&self) -> anyhow::Result<()> {
+    // The temp file will be dropped automatically when the file handle is dropped
+    // So, declare it here to ensure it's not dropped
+    let _file = self.fix_openssl()?;
+    let shared_args = SharedArgs {
+      fix_openssl: self.fix_openssl,
+      ignore_tls_errors: self.ignore_tls_errors,
+    };
+
+    if self.ignore_tls_errors {
+      info!("TLS errors will be ignored");
+    }
+
+    match &self.command {
+      CliCommand::Connect(args) => ConnectHandler::new(args, &shared_args).handle().await,
+      CliCommand::Disconnect => DisconnectHandler::new().handle(),
+      CliCommand::LaunchGui(args) => LaunchGuiHandler::new(args).handle().await,
+    }
+  }
+}
+
+fn init_logger() {
+  env_logger::builder().filter_level(LevelFilter::Info).init();
+}
+
+pub(crate) async fn run() {
+  let cli = Cli::parse();
+
+  init_logger();
+  info!("gpclient started: {}", VERSION);
+
+  if let Err(err) = cli.run().await {
+    eprintln!("\nError: {}", err);
+
+    let err = err.to_string();
+
+    if err.contains("unsafe legacy renegotiation") && !cli.fix_openssl {
+      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
+      // Print the command
+      let args = std::env::args().collect::<Vec<_>>();
+      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
+    }
+
+    if err.contains("certificate verify failed") {
+      eprintln!(
+        "\nRe-run it with the `--ignore-tls-errors` option to ignore the certificate error, e.g.:\n"
+      );
+      // Print the command
+      let args = std::env::args().collect::<Vec<_>>();
+      eprintln!("{} --ignore-tls-errors {}\n", args[0], args[1..].join(" "));
+    }
+
+    std::process::exit(1);
+  }
+}

apps/gpclient/src/connect.rs

@@ -0,0 +1,175 @@
+use std::{fs, sync::Arc};
+
+use clap::Args;
+use gpapi::{
+  clap::args::Os,
+  credential::{Credential, PasswordCredential},
+  gateway::gateway_login,
+  gp_params::{ClientOs, GpParams},
+  portal::{prelogin, retrieve_config, Prelogin},
+  process::auth_launcher::SamlAuthLauncher,
+  utils::{self, shutdown_signal},
+  GP_USER_AGENT,
+};
+use inquire::{Password, PasswordDisplayMode, Select, Text};
+use log::info;
+use openconnect::Vpn;
+
+use crate::{cli::SharedArgs, GP_CLIENT_LOCK_FILE};
+
+#[derive(Args)]
+pub(crate) struct ConnectArgs {
+  #[arg(help = "The portal server to connect to")]
+  server: String,
+  #[arg(
+    short,
+    long,
+    help = "The gateway to connect to, it will prompt if not specified"
+  )]
+  gateway: Option<String>,
+  #[arg(
+    short,
+    long,
+    help = "The username to use, it will prompt if not specified"
+  )]
+  user: Option<String>,
+  #[arg(long, short, help = "The VPNC script to use")]
+  script: Option<String>,
+  #[arg(long, default_value = GP_USER_AGENT, help = "The user agent to use")]
+  user_agent: String,
+  #[arg(long, default_value = "Linux")]
+  os: Os,
+  #[arg(long)]
+  os_version: Option<String>,
+  #[arg(long, help = "The HiDPI mode, useful for high resolution screens")]
+  hidpi: bool,
+  #[arg(long, help = "Do not reuse the remembered authentication cookie")]
+  clean: bool,
+}
+
+impl ConnectArgs {
+  fn os_version(&self) -> String {
+    if let Some(os_version) = &self.os_version {
+      return os_version.to_owned();
+    }
+
+    match self.os {
+      Os::Linux => format!("Linux {}", whoami::distro()),
+      Os::Windows => String::from("Microsoft Windows 11 Pro , 64-bit"),
+      Os::Mac => String::from("Apple Mac OS X 13.4.0"),
+    }
+  }
+}
+
+pub(crate) struct ConnectHandler<'a> {
+  args: &'a ConnectArgs,
+  shared_args: &'a SharedArgs,
+}
+
+impl<'a> ConnectHandler<'a> {
+  pub(crate) fn new(args: &'a ConnectArgs, shared_args: &'a SharedArgs) -> Self {
+    Self { args, shared_args }
+  }
+
+  pub(crate) async fn handle(&self) -> anyhow::Result<()> {
+    let portal = utils::normalize_server(self.args.server.as_str())?;
+
+    let gp_params = GpParams::builder()
+      .user_agent(&self.args.user_agent)
+      .client_os(ClientOs::from(&self.args.os))
+      .os_version(self.args.os_version())
+      .ignore_tls_errors(self.shared_args.ignore_tls_errors)
+      .build();
+
+    let prelogin = prelogin(&portal, &gp_params).await?;
+    let portal_credential = self.obtain_portal_credential(&prelogin).await?;
+    let mut portal_config = retrieve_config(&portal, &portal_credential, &gp_params).await?;
+
+    let selected_gateway = match &self.args.gateway {
+      Some(gateway) => portal_config
+        .find_gateway(gateway)
+        .ok_or_else(|| anyhow::anyhow!("Cannot find gateway {}", gateway))?,
+      None => {
+        portal_config.sort_gateways(prelogin.region());
+        let gateways = portal_config.gateways();
+
+        if gateways.len() > 1 {
+          Select::new("Which gateway do you want to connect to?", gateways)
+            .with_vim_mode(true)
+            .prompt()?
+        } else {
+          gateways[0]
+        }
+      }
+    };
+
+    let gateway = selected_gateway.server();
+    let cred = portal_config.auth_cookie().into();
+    let token = gateway_login(gateway, &cred, &gp_params).await?;
+
+    let vpn = Vpn::builder(gateway, &token)
+      .user_agent(self.args.user_agent.clone())
+      .script(self.args.script.clone())
+      .build();
+
+    let vpn = Arc::new(vpn);
+    let vpn_clone = vpn.clone();
+
+    // Listen for the interrupt signal in the background
+    tokio::spawn(async move {
+      shutdown_signal().await;
+      info!("Received the interrupt signal, disconnecting...");
+      vpn_clone.disconnect();
+    });
+
+    vpn.connect(write_pid_file);
+
+    if fs::metadata(GP_CLIENT_LOCK_FILE).is_ok() {
+      info!("Removing PID file");
+      fs::remove_file(GP_CLIENT_LOCK_FILE)?;
+    }
+
+    Ok(())
+  }
+
+  async fn obtain_portal_credential(&self, prelogin: &Prelogin) -> anyhow::Result<Credential> {
+    match prelogin {
+      Prelogin::Saml(prelogin) => {
+        SamlAuthLauncher::new(&self.args.server)
+          .saml_request(prelogin.saml_request())
+          .user_agent(&self.args.user_agent)
+          .os(self.args.os.as_str())
+          .os_version(Some(&self.args.os_version()))
+          .hidpi(self.args.hidpi)
+          .fix_openssl(self.shared_args.fix_openssl)
+          .ignore_tls_errors(self.shared_args.ignore_tls_errors)
+          .clean(self.args.clean)
+          .launch()
+          .await
+      }
+      Prelogin::Standard(prelogin) => {
+        println!("{}", prelogin.auth_message());
+
+        let user = self.args.user.as_ref().map_or_else(
+          || Text::new(&format!("{}:", prelogin.label_username())).prompt(),
+          |user| Ok(user.to_owned()),
+        )?;
+        let password = Password::new(&format!("{}:", prelogin.label_password()))
+          .without_confirmation()
+          .with_display_mode(PasswordDisplayMode::Masked)
+          .prompt()?;
+
+        let password_cred = PasswordCredential::new(&user, &password);
+
+        Ok(password_cred.into())
+      }
+    }
+  }
+}
+
+fn write_pid_file() {
+  let pid = std::process::id();
+
+  fs::write(GP_CLIENT_LOCK_FILE, pid.to_string()).unwrap();
+  info!("Wrote PID {} to {}", pid, GP_CLIENT_LOCK_FILE);
+}

apps/gpclient/src/disconnect.rs

@@ -0,0 +1,31 @@
+use crate::GP_CLIENT_LOCK_FILE;
+use log::{info, warn};
+use std::fs;
+use sysinfo::{Pid, ProcessExt, Signal, System, SystemExt};
+
+pub(crate) struct DisconnectHandler;
+
+impl DisconnectHandler {
+  pub(crate) fn new() -> Self {
+    Self
+  }
+
+  pub(crate) fn handle(&self) -> anyhow::Result<()> {
+    if fs::metadata(GP_CLIENT_LOCK_FILE).is_err() {
+      warn!("PID file not found, maybe the client is not running");
+      return Ok(());
+    }
+
+    let pid = fs::read_to_string(GP_CLIENT_LOCK_FILE)?;
+    let pid = pid.trim().parse::<usize>()?;
+    let s = System::new_all();
+
+    if let Some(process) = s.process(Pid::from(pid)) {
+      info!("Found process {}, killing...", pid);
+      if process.kill_with(Signal::Interrupt).is_none() {
+        warn!("Failed to kill process {}", pid);
+      }
+    }
+    Ok(())
+  }
+}

apps/gpclient/src/launch_gui.rs

@@ -0,0 +1,88 @@
+use std::{collections::HashMap, fs, path::PathBuf};
+
+use clap::Args;
+use directories::ProjectDirs;
+use gpapi::{
+  process::service_launcher::ServiceLauncher,
+  utils::{endpoint::http_endpoint, env_file, shutdown_signal},
+};
+use log::info;
+
+#[derive(Args)]
+pub(crate) struct LaunchGuiArgs {
+  #[clap(long, help = "Launch the GUI minimized")]
+  minimized: bool,
+}
+
+pub(crate) struct LaunchGuiHandler<'a> {
+  args: &'a LaunchGuiArgs,
+}
+
+impl<'a> LaunchGuiHandler<'a> {
+  pub(crate) fn new(args: &'a LaunchGuiArgs) -> Self {
+    Self { args }
+  }
+
+  pub(crate) async fn handle(&self) -> anyhow::Result<()> {
+    // `launch-gui`cannot be run as root
+    let user = whoami::username();
+    if user == "root" {
+      anyhow::bail!("`launch-gui` cannot be run as root");
+    }
+
+    if try_active_gui().await.is_ok() {
+      info!("The GUI is already running");
+      return Ok(());
+    }
+
+    tokio::spawn(async move {
+      shutdown_signal().await;
+      info!("Shutting down...");
+    });
+
+    let log_file = get_log_file()?;
+    let log_file_path = log_file.to_string_lossy().to_string();
+
+    info!("Log file: {}", log_file_path);
+
+    let mut extra_envs = HashMap::<String, String>::new();
+    extra_envs.insert("GP_LOG_FILE".into(), log_file_path.clone());
+
+    // Persist the environment variables to a file
+    let env_file = env_file::persist_env_vars(Some(extra_envs))?;
+    let env_file = env_file.into_temp_path();
+    let env_file_path = env_file.to_string_lossy().to_string();
+
+    let exit_status = ServiceLauncher::new()
+      .minimized(self.args.minimized)
+      .env_file(&env_file_path)
+      .log_file(&log_file_path)
+      .launch()
+      .await?;
+
+    info!("Service exited with status: {}", exit_status);
+
+    Ok(())
+  }
+}
+
+async fn try_active_gui() -> anyhow::Result<()> {
+  let service_endpoint = http_endpoint().await?;
+
+  reqwest::Client::default()
+    .post(format!("{}/active-gui", service_endpoint))
+    .send()
+    .await?
+    .error_for_status()?;
+
+  Ok(())
+}
+
+pub fn get_log_file() -> anyhow::Result<PathBuf> {
+  let dirs = ProjectDirs::from("com.yuezk", "GlobalProtect-openconnect", "gpclient")
+    .ok_or_else(|| anyhow::anyhow!("Failed to get project dirs"))?;
+
+  fs::create_dir_all(dirs.data_dir())?;
+
+  Ok(dirs.data_dir().join("gpclient.log"))
+}

apps/gpclient/src/main.rs

@@ -0,0 +1,11 @@
+mod cli;
+mod connect;
+mod disconnect;
+mod launch_gui;
+
+pub(crate) const GP_CLIENT_LOCK_FILE: &str = "/var/run/gpclient.lock";
+
+#[tokio::main]
+async fn main() {
+  cli::run().await;
+}

apps/gpservice/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "gpservice"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+gpapi = { path = "../../crates/gpapi" }
+openconnect = { path = "../../crates/openconnect" }
+clap.workspace = true
+anyhow.workspace = true
+tokio.workspace = true
+tokio-util.workspace = true
+axum = { workspace = true, features = ["ws"] }
+futures.workspace = true
+serde_json.workspace = true
+env_logger.workspace = true
+log.workspace = true
+compile-time.workspace = true

apps/gpservice/com.yuezk.gpservice.policy

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>GlobalProtect-openconnect</vendor>
+  <vendor_url>https://github.com/yuezk/GlobalProtect-openconnect</vendor_url>
+  <icon_name>gpgui</icon_name>
+  <action id="com.yuezk.gpservice">
+    <description>Run GPService as root</description>
+    <message>Authentication is required to run the GPService as root</message>
+    <defaults>
+      <allow_any>yes</allow_any>
+      <allow_inactive>yes</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/home/kevin/Documents/repos/gp/target/debug/gpservice</annotate>
+    <annotate key="org.freedesktop.policykit.exec.argv1">--with-gui</annotate>
+    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
+  </action>
+</policyconfig>

apps/gpservice/src/cli.rs

@@ -0,0 +1,182 @@
+use std::sync::Arc;
+use std::{collections::HashMap, io::Write};
+
+use anyhow::bail;
+use clap::Parser;
+use gpapi::{
+  process::gui_launcher::GuiLauncher,
+  service::{request::WsRequest, vpn_state::VpnState},
+  utils::{
+    crypto::generate_key, env_file, lock_file::LockFile, redact::Redaction, shutdown_signal,
+  },
+  GP_SERVICE_LOCK_FILE,
+};
+use log::{info, warn, LevelFilter};
+use tokio::sync::{mpsc, watch};
+
+use crate::{vpn_task::VpnTask, ws_server::WsServer};
+
+const VERSION: &str = concat!(
+  env!("CARGO_PKG_VERSION"),
+  " (",
+  compile_time::date_str!(),
+  ")"
+);
+
+#[derive(Parser)]
+#[command(version = VERSION)]
+struct Cli {
+  #[clap(long)]
+  minimized: bool,
+  #[clap(long)]
+  env_file: Option<String>,
+  #[cfg(debug_assertions)]
+  #[clap(long)]
+  no_gui: bool,
+}
+
+impl Cli {
+  async fn run(&mut self, redaction: Arc<Redaction>) -> anyhow::Result<()> {
+    let lock_file = Arc::new(LockFile::new(GP_SERVICE_LOCK_FILE));
+
+    if lock_file.check_health().await {
+      bail!("Another instance of the service is already running");
+    }
+
+    let api_key = self.prepare_api_key();
+
+    // Channel for sending requests to the VPN task
+    let (ws_req_tx, ws_req_rx) = mpsc::channel::<WsRequest>(32);
+    // Channel for receiving the VPN state from the VPN task
+    let (vpn_state_tx, vpn_state_rx) = watch::channel(VpnState::Disconnected);
+
+    let mut vpn_task = VpnTask::new(ws_req_rx, vpn_state_tx);
+    let ws_server = WsServer::new(
+      api_key.clone(),
+      ws_req_tx,
+      vpn_state_rx,
+      lock_file.clone(),
+      redaction,
+    );
+
+    let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(4);
+    let shutdown_tx_clone = shutdown_tx.clone();
+    let vpn_task_token = vpn_task.cancel_token();
+    let server_token = ws_server.cancel_token();
+
+    let vpn_task_handle = tokio::spawn(async move { vpn_task.start(server_token).await });
+    let ws_server_handle = tokio::spawn(async move { ws_server.start(shutdown_tx_clone).await });
+
+    #[cfg(debug_assertions)]
+    let no_gui = self.no_gui;
+
+    #[cfg(not(debug_assertions))]
+    let no_gui = false;
+
+    if no_gui {
+      info!("GUI is disabled");
+    } else {
+      let envs = self
+        .env_file
+        .as_ref()
+        .map(env_file::load_env_vars)
+        .transpose()?;
+
+      let minimized = self.minimized;
+
+      tokio::spawn(async move {
+        launch_gui(envs, api_key, minimized).await;
+        let _ = shutdown_tx.send(()).await;
+      });
+    }
+
+    tokio::select! {
+        _ = shutdown_signal() => {
+            info!("Shutdown signal received");
+        }
+        _ = shutdown_rx.recv() => {
+            info!("Shutdown request received, shutting down");
+        }
+    }
+
+    vpn_task_token.cancel();
+    let _ = tokio::join!(vpn_task_handle, ws_server_handle);
+
+    lock_file.unlock()?;
+
+    info!("gpservice stopped");
+
+    Ok(())
+  }
+
+  fn prepare_api_key(&self) -> Vec<u8> {
+    #[cfg(debug_assertions)]
+    if self.no_gui {
+      return gpapi::GP_API_KEY.to_vec();
+    }
+
+    generate_key().to_vec()
+  }
+}
+
+fn init_logger() -> Arc<Redaction> {
+  let redaction = Arc::new(Redaction::new());
+  let redaction_clone = Arc::clone(&redaction);
+  // let target = Box::new(File::create("log.txt").expect("Can't create file"));
+  env_logger::builder()
+    .filter_level(LevelFilter::Info)
+    .format(move |buf, record| {
+      let timestamp = buf.timestamp();
+      writeln!(
+        buf,
+        "[{} {} {}] {}",
+        timestamp,
+        record.level(),
+        record.module_path().unwrap_or_default(),
+        redaction_clone.redact_str(&record.args().to_string())
+      )
+    })
+    // .target(env_logger::Target::Pipe(target))
+    .init();
+
+  redaction
+}
+
+async fn launch_gui(envs: Option<HashMap<String, String>>, api_key: Vec<u8>, mut minimized: bool) {
+  loop {
+    let api_key_clone = api_key.clone();
+    let gui_launcher = GuiLauncher::new()
+      .envs(envs.clone())
+      .api_key(api_key_clone)
+      .minimized(minimized);
+
+    match gui_launcher.launch().await {
+      Ok(exit_status) => {
+        // Exit code 99 means that the GUI needs to be restarted
+        if exit_status.code() != Some(99) {
+          info!("GUI exited with code {:?}", exit_status.code());
+          break;
+        }
+
+        info!("GUI exited with code 99, restarting");
+        minimized = false;
+      }
+      Err(err) => {
+        warn!("Failed to launch GUI: {}", err);
+        break;
+      }
+    }
+  }
+}
+
+pub async fn run() {
+  let mut cli = Cli::parse();
+
+  let redaction = init_logger();
+  info!("gpservice started: {}", VERSION);
+
+  if let Err(e) = cli.run(redaction).await {
+    eprintln!("Error: {}", e);
+    std::process::exit(1);
+  }
+}

apps/gpservice/src/handlers.rs

@@ -0,0 +1,94 @@
+use std::{borrow::Cow, ops::ControlFlow, sync::Arc};
+
+use axum::{
+  extract::{
+    ws::{self, CloseFrame, Message, WebSocket},
+    State, WebSocketUpgrade,
+  },
+  response::IntoResponse,
+};
+use futures::{SinkExt, StreamExt};
+use gpapi::service::event::WsEvent;
+use log::{info, warn};
+
+use crate::ws_server::WsServerContext;
+
+pub(crate) async fn health() -> impl IntoResponse {
+  "OK"
+}
+
+pub(crate) async fn active_gui(State(ctx): State<Arc<WsServerContext>>) -> impl IntoResponse {
+  ctx.send_event(WsEvent::ActiveGui).await;
+}
+
+pub(crate) async fn ws_handler(
+  ws: WebSocketUpgrade,
+  State(ctx): State<Arc<WsServerContext>>,
+) -> impl IntoResponse {
+  ws.on_upgrade(move |socket| handle_socket(socket, ctx))
+}
+
+async fn handle_socket(mut socket: WebSocket, ctx: Arc<WsServerContext>) {
+  // Send ping message
+  if let Err(err) = socket.send(Message::Ping("Hi".into())).await {
+    warn!("Failed to send ping: {}", err);
+    return;
+  }
+
+  // Wait for pong message
+  if socket.recv().await.is_none() {
+    warn!("Failed to receive pong");
+    return;
+  }
+
+  info!("New client connected");
+
+  let (mut sender, mut receiver) = socket.split();
+  let (connection, mut msg_rx) = ctx.add_connection().await;
+
+  let send_task = tokio::spawn(async move {
+    while let Some(msg) = msg_rx.recv().await {
+      if let Err(err) = sender.send(msg).await {
+        info!("Failed to send message: {}", err);
+        break;
+      }
+    }
+
+    let close_msg = Message::Close(Some(CloseFrame {
+      code: ws::close_code::NORMAL,
+      reason: Cow::from("Goodbye"),
+    }));
+
+    if let Err(err) = sender.send(close_msg).await {
+      warn!("Failed to close socket: {}", err);
+    }
+  });
+
+  let conn = Arc::clone(&connection);
+  let ctx_clone = Arc::clone(&ctx);
+  let recv_task = tokio::spawn(async move {
+    while let Some(Ok(msg)) = receiver.next().await {
+      let ControlFlow::Continue(ws_req) = conn.recv_msg(msg) else {
+        break;
+      };
+
+      if let Err(err) = ctx_clone.forward_req(ws_req).await {
+        info!("Failed to forward request: {}", err);
+        break;
+      }
+    }
+  });
+
+  tokio::select! {
+    _ = send_task => {
+        info!("WS server send task completed");
+    },
+    _ = recv_task => {
+        info!("WS server recv task completed");
+    }
+  }
+
+  info!("Client disconnected");
+
+  ctx.remove_connection(connection).await;
+}

apps/gpservice/src/main.rs

@@ -0,0 +1,11 @@
+mod cli;
+mod handlers;
+mod routes;
+mod vpn_task;
+mod ws_server;
+mod ws_connection;
+
+#[tokio::main]
+async fn main() {
+  cli::run().await;
+}

apps/gpservice/src/routes.rs

@@ -0,0 +1,13 @@
+use std::sync::Arc;
+
+use axum::{routing::{get, post}, Router};
+
+use crate::{handlers, ws_server::WsServerContext};
+
+pub(crate) fn routes(ctx: Arc<WsServerContext>) -> Router {
+  Router::new()
+    .route("/health", get(handlers::health))
+    .route("/active-gui", post(handlers::active_gui))
+    .route("/ws", get(handlers::ws_handler))
+    .with_state(ctx)
+}

apps/gpservice/src/vpn_task.rs

@@ -0,0 +1,144 @@
+use std::{sync::Arc, thread};
+
+use gpapi::service::{
+  request::{ConnectRequest, WsRequest},
+  vpn_state::VpnState,
+};
+use log::info;
+use openconnect::Vpn;
+use tokio::sync::{mpsc, oneshot, watch, RwLock};
+use tokio_util::sync::CancellationToken;
+
+pub(crate) struct VpnTaskContext {
+  vpn_handle: Arc<RwLock<Option<Vpn>>>,
+  vpn_state_tx: Arc<watch::Sender<VpnState>>,
+  disconnect_rx: RwLock<Option<oneshot::Receiver<()>>>,
+}
+
+impl VpnTaskContext {
+  pub fn new(vpn_state_tx: watch::Sender<VpnState>) -> Self {
+    Self {
+      vpn_handle: Default::default(),
+      vpn_state_tx: Arc::new(vpn_state_tx),
+      disconnect_rx: Default::default(),
+    }
+  }
+
+  pub async fn connect(&self, req: ConnectRequest) {
+    let vpn_state = self.vpn_state_tx.borrow().clone();
+    if !matches!(vpn_state, VpnState::Disconnected) {
+      info!("VPN is not disconnected, ignore the request");
+      return;
+    }
+
+    let info = req.info().clone();
+    let vpn_handle = self.vpn_handle.clone();
+    let args = req.args();
+    let vpn = Vpn::builder(req.gateway().server(), args.cookie())
+      .user_agent(args.user_agent())
+      .script(args.vpnc_script())
+      .os(args.openconnect_os())
+      .build();
+
+    // Save the VPN handle
+    vpn_handle.write().await.replace(vpn);
+
+    let vpn_state_tx = self.vpn_state_tx.clone();
+    let connect_info = Box::new(info.clone());
+    vpn_state_tx.send(VpnState::Connecting(connect_info)).ok();
+
+    let (disconnect_tx, disconnect_rx) = oneshot::channel::<()>();
+    self.disconnect_rx.write().await.replace(disconnect_rx);
+
+    // Spawn a new thread to process the VPN connection, cannot use tokio::spawn here.
+    // Otherwise, it will block the tokio runtime and cannot send the VPN state to the channel
+    thread::spawn(move || {
+      let vpn_state_tx_clone = vpn_state_tx.clone();
+
+      vpn_handle.blocking_read().as_ref().map(|vpn| {
+        vpn.connect(move || {
+          let connect_info = Box::new(info.clone());
+          vpn_state_tx.send(VpnState::Connected(connect_info)).ok();
+        })
+      });
+
+      // Notify the VPN is disconnected
+      vpn_state_tx_clone.send(VpnState::Disconnected).ok();
+      // Remove the VPN handle
+      vpn_handle.blocking_write().take();
+
+      disconnect_tx.send(()).ok();
+    });
+  }
+
+  pub async fn disconnect(&self) {
+    if let Some(disconnect_rx) = self.disconnect_rx.write().await.take() {
+      if let Some(vpn) = self.vpn_handle.read().await.as_ref() {
+        self.vpn_state_tx.send(VpnState::Disconnecting).ok();
+        vpn.disconnect()
+      }
+      // Wait for the VPN to be disconnected
+      disconnect_rx.await.ok();
+      info!("VPN disconnected");
+    } else {
+      info!("VPN is not connected, skip disconnect");
+      self.vpn_state_tx.send(VpnState::Disconnected).ok();
+    }
+  }
+}
+
+pub(crate) struct VpnTask {
+  ws_req_rx: mpsc::Receiver<WsRequest>,
+  ctx: Arc<VpnTaskContext>,
+  cancel_token: CancellationToken,
+}
+
+impl VpnTask {
+  pub fn new(ws_req_rx: mpsc::Receiver<WsRequest>, vpn_state_tx: watch::Sender<VpnState>) -> Self {
+    let ctx = Arc::new(VpnTaskContext::new(vpn_state_tx));
+    let cancel_token = CancellationToken::new();
+
+    Self {
+      ws_req_rx,
+      ctx,
+      cancel_token,
+    }
+  }
+
+  pub fn cancel_token(&self) -> CancellationToken {
+    self.cancel_token.clone()
+  }
+
+  pub async fn start(&mut self, server_cancel_token: CancellationToken) {
+    let cancel_token = self.cancel_token.clone();
+
+    tokio::select! {
+        _ = self.recv() => {
+            info!("VPN task stopped");
+        }
+        _ = cancel_token.cancelled() => {
+            info!("VPN task cancelled");
+            self.ctx.disconnect().await;
+        }
+    }
+
+    server_cancel_token.cancel();
+  }
+
+  async fn recv(&mut self) {
+    while let Some(req) = self.ws_req_rx.recv().await {
+      tokio::spawn(process_ws_req(req, self.ctx.clone()));
+    }
+  }
+}
+
+async fn process_ws_req(req: WsRequest, ctx: Arc<VpnTaskContext>) {
+  match req {
+    WsRequest::Connect(req) => {
+      ctx.connect(*req).await;
+    }
+    WsRequest::Disconnect(_) => {
+      ctx.disconnect().await;
+    }
+  }
+}

apps/gpservice/src/ws_connection.rs

@@ -0,0 +1,53 @@
+use std::{ops::ControlFlow, sync::Arc};
+
+use axum::extract::ws::{CloseFrame, Message};
+use gpapi::{
+  service::{event::WsEvent, request::WsRequest},
+  utils::crypto::Crypto,
+};
+use log::{info, warn};
+use tokio::sync::mpsc;
+
+pub(crate) struct WsConnection {
+  crypto: Arc<Crypto>,
+  tx: mpsc::Sender<Message>,
+}
+
+impl WsConnection {
+  pub fn new(crypto: Arc<Crypto>, tx: mpsc::Sender<Message>) -> Self {
+    Self { crypto, tx }
+  }
+
+  pub async fn send_event(&self, event: &WsEvent) -> anyhow::Result<()> {
+    let encrypted = self.crypto.encrypt(event)?;
+    let msg = Message::Binary(encrypted);
+
+    self.tx.send(msg).await?;
+
+    Ok(())
+  }
+
+  pub fn recv_msg(&self, msg: Message) -> ControlFlow<(), WsRequest> {
+    match msg {
+      Message::Binary(data) => match self.crypto.decrypt(data) {
+        Ok(ws_req) => ControlFlow::Continue(ws_req),
+        Err(err) => {
+          info!("Failed to decrypt message: {}", err);
+          ControlFlow::Break(())
+        }
+      },
+      Message::Close(cf) => {
+        if let Some(CloseFrame { code, reason }) = cf {
+          info!("Client sent close, code {} and reason `{}`", code, reason);
+        } else {
+          info!("Client somehow sent close message without CloseFrame");
+        }
+        ControlFlow::Break(())
+      }
+      _ => {
+        warn!("WS server received unexpected message: {:?}", msg);
+        ControlFlow::Break(())
+      }
+    }
+  }
+}

apps/gpservice/src/ws_server.rs

@@ -0,0 +1,158 @@
+use std::sync::Arc;
+
+use axum::extract::ws::Message;
+use gpapi::{
+  service::{event::WsEvent, request::WsRequest, vpn_state::VpnState},
+  utils::{crypto::Crypto, lock_file::LockFile, redact::Redaction},
+};
+use log::{info, warn};
+use tokio::{
+  net::TcpListener,
+  sync::{mpsc, watch, RwLock},
+};
+use tokio_util::sync::CancellationToken;
+
+use crate::{routes, ws_connection::WsConnection};
+
+pub(crate) struct WsServerContext {
+  crypto: Arc<Crypto>,
+  ws_req_tx: mpsc::Sender<WsRequest>,
+  vpn_state_rx: watch::Receiver<VpnState>,
+  redaction: Arc<Redaction>,
+  connections: RwLock<Vec<Arc<WsConnection>>>,
+}
+
+impl WsServerContext {
+  pub fn new(
+    api_key: Vec<u8>,
+    ws_req_tx: mpsc::Sender<WsRequest>,
+    vpn_state_rx: watch::Receiver<VpnState>,
+    redaction: Arc<Redaction>,
+  ) -> Self {
+    Self {
+      crypto: Arc::new(Crypto::new(api_key)),
+      ws_req_tx,
+      vpn_state_rx,
+      redaction,
+      connections: Default::default(),
+    }
+  }
+
+  pub async fn send_event(&self, event: WsEvent) {
+    let connections = self.connections.read().await;
+
+    for conn in connections.iter() {
+      let _ = conn.send_event(&event).await;
+    }
+  }
+
+  pub async fn add_connection(&self) -> (Arc<WsConnection>, mpsc::Receiver<Message>) {
+    let (tx, rx) = mpsc::channel::<Message>(32);
+    let conn = Arc::new(WsConnection::new(Arc::clone(&self.crypto), tx));
+
+    // Send current VPN state to new client
+    info!("Sending current VPN state to new client");
+    let vpn_state = self.vpn_state_rx.borrow().clone();
+    if let Err(err) = conn.send_event(&WsEvent::VpnState(vpn_state)).await {
+      warn!("Failed to send VPN state to new client: {}", err);
+    }
+
+    self.connections.write().await.push(Arc::clone(&conn));
+
+    (conn, rx)
+  }
+
+  pub async fn remove_connection(&self, conn: Arc<WsConnection>) {
+    let mut connections = self.connections.write().await;
+    connections.retain(|c| !Arc::ptr_eq(c, &conn));
+  }
+
+  fn vpn_state_rx(&self) -> watch::Receiver<VpnState> {
+    self.vpn_state_rx.clone()
+  }
+
+  pub async fn forward_req(&self, req: WsRequest) -> anyhow::Result<()> {
+    if let WsRequest::Connect(ref req) = req {
+      self
+        .redaction
+        .add_values(&[req.gateway().server(), req.args().cookie()])?
+    }
+
+    self.ws_req_tx.send(req).await?;
+
+    Ok(())
+  }
+}
+
+pub(crate) struct WsServer {
+  ctx: Arc<WsServerContext>,
+  cancel_token: CancellationToken,
+  lock_file: Arc<LockFile>,
+}
+
+impl WsServer {
+  pub fn new(
+    api_key: Vec<u8>,
+    ws_req_tx: mpsc::Sender<WsRequest>,
+    vpn_state_rx: watch::Receiver<VpnState>,
+    lock_file: Arc<LockFile>,
+    redaction: Arc<Redaction>,
+  ) -> Self {
+    let ctx = Arc::new(WsServerContext::new(
+      api_key,
+      ws_req_tx,
+      vpn_state_rx,
+      redaction,
+    ));
+    let cancel_token = CancellationToken::new();
+
+    Self {
+      ctx,
+      cancel_token,
+      lock_file,
+    }
+  }
+
+  pub fn cancel_token(&self) -> CancellationToken {
+    self.cancel_token.clone()
+  }
+
+  pub async fn start(&self, shutdown_tx: mpsc::Sender<()>) {
+    if let Ok(listener) = TcpListener::bind("127.0.0.1:0").await {
+      let local_addr = listener.local_addr().unwrap();
+
+      self.lock_file.lock(local_addr.port().to_string()).unwrap();
+
+      info!("WS server listening on port: {}", local_addr.port());
+
+      tokio::select! {
+        _ = watch_vpn_state(self.ctx.vpn_state_rx(), Arc::clone(&self.ctx)) => {
+          info!("VPN state watch task completed");
+        }
+        _ = start_server(listener, self.ctx.clone()) => {
+            info!("WS server stopped");
+        }
+        _ = self.cancel_token.cancelled() => {
+          info!("WS server cancelled");
+        }
+      }
+    }
+
+    let _ = shutdown_tx.send(()).await;
+  }
+}
+
+async fn watch_vpn_state(mut vpn_state_rx: watch::Receiver<VpnState>, ctx: Arc<WsServerContext>) {
+  while vpn_state_rx.changed().await.is_ok() {
+    let vpn_state = vpn_state_rx.borrow().clone();
+    ctx.send_event(WsEvent::VpnState(vpn_state)).await;
+  }
+}
+
+async fn start_server(listener: TcpListener, ctx: Arc<WsServerContext>) -> anyhow::Result<()> {
+  let routes = routes::routes(ctx);
+
+  axum::serve(listener, routes).await?;
+
+  Ok(())
+}

com.yuezk.gp.policy

@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
-<policyconfig>
-  <vendor>The GlobalProtect-openconnect Project</vendor>
-  <vendor_url>https://github.com/yuezk/GlobalProtect-openconnect</vendor_url>
-  <icon_name>gpgui</icon_name>
-  <action id="com.yuezk.gp.update-gpconf">
-    <description>Update the /etc/gpservice/gp.conf</description>
-    <message>Authentication is required to update the GlobalProtect service configuration</message>
-    <defaults>
-      <allow_any>auth_admin</allow_any>
-      <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/tee</annotate>
-    <annotate key="org.freedesktop.policykit.exec.argv1">/etc/gpservice/gp.conf</annotate>
-    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
-  </action>
-</policyconfig>

crates/gpapi/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "gpapi"
+version.workspace = true
+edition.workspace = true
+license = "MIT"
+
+[dependencies]
+anyhow.workspace = true
+base64.workspace = true
+log.workspace = true
+reqwest.workspace = true
+roxmltree.workspace = true
+serde.workspace = true
+specta.workspace = true
+specta-macros.workspace = true
+urlencoding.workspace = true
+tokio.workspace = true
+serde_json.workspace = true
+whoami.workspace = true
+tempfile.workspace = true
+thiserror.workspace = true
+chacha20poly1305 = { version = "0.10", features = ["std"] }
+redact-engine.workspace = true
+url.workspace = true
+regex.workspace = true
+dotenvy_macro.workspace = true
+uzers.workspace = true
+
+tauri = { workspace = true, optional = true }
+clap = { workspace = true, optional = true }
+
+[features]
+tauri = ["dep:tauri"]
+clap = ["dep:clap"]

crates/gpapi/src/auth.rs

@@ -0,0 +1,63 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SamlAuthData {
+  username: String,
+  prelogin_cookie: Option<String>,
+  portal_userauthcookie: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum SamlAuthResult {
+  Success(SamlAuthData),
+  Failure(String),
+}
+
+impl SamlAuthResult {
+  pub fn is_success(&self) -> bool {
+    match self {
+      SamlAuthResult::Success(_) => true,
+      SamlAuthResult::Failure(_) => false,
+    }
+  }
+}
+
+impl SamlAuthData {
+  pub fn new(
+    username: String,
+    prelogin_cookie: Option<String>,
+    portal_userauthcookie: Option<String>,
+  ) -> Self {
+    Self {
+      username,
+      prelogin_cookie,
+      portal_userauthcookie,
+    }
+  }
+
+  pub fn username(&self) -> &str {
+    &self.username
+  }
+
+  pub fn prelogin_cookie(&self) -> Option<&str> {
+    self.prelogin_cookie.as_deref()
+  }
+
+  pub fn check(
+    username: &Option<String>,
+    prelogin_cookie: &Option<String>,
+    portal_userauthcookie: &Option<String>,
+  ) -> bool {
+    let username_valid = username
+      .as_ref()
+      .is_some_and(|username| !username.is_empty());
+    let prelogin_cookie_valid = prelogin_cookie.as_ref().is_some_and(|val| val.len() > 5);
+    let portal_userauthcookie_valid = portal_userauthcookie
+      .as_ref()
+      .is_some_and(|val| val.len() > 5);
+
+    username_valid && (prelogin_cookie_valid || portal_userauthcookie_valid)
+  }
+}

crates/gpapi/src/clap/args.rs

@@ -0,0 +1,64 @@
+use clap::{builder::PossibleValue, ValueEnum};
+
+use crate::gp_params::ClientOs;
+
+#[derive(Debug, Clone)]
+pub enum Os {
+  Linux,
+  Windows,
+  Mac,
+}
+
+impl Os {
+  pub fn as_str(&self) -> &'static str {
+    match self {
+      Os::Linux => "Linux",
+      Os::Windows => "Windows",
+      Os::Mac => "Mac",
+    }
+  }
+}
+
+impl From<&str> for Os {
+  fn from(os: &str) -> Self {
+    match os.to_lowercase().as_str() {
+      "linux" => Os::Linux,
+      "windows" => Os::Windows,
+      "mac" => Os::Mac,
+      _ => Os::Linux,
+    }
+  }
+}
+
+impl From<&Os> for ClientOs {
+  fn from(value: &Os) -> Self {
+    match value {
+      Os::Linux => ClientOs::Linux,
+      Os::Windows => ClientOs::Windows,
+      Os::Mac => ClientOs::Mac,
+    }
+  }
+}
+
+impl ValueEnum for Os {
+  fn value_variants<'a>() -> &'a [Self] {
+    &[Os::Linux, Os::Windows, Os::Mac]
+  }
+
+  fn to_possible_value(&self) -> Option<clap::builder::PossibleValue> {
+    match self {
+      Os::Linux => Some(PossibleValue::new("Linux")),
+      Os::Windows => Some(PossibleValue::new("Windows")),
+      Os::Mac => Some(PossibleValue::new("Mac")),
+    }
+  }
+
+  fn from_str(input: &str, _: bool) -> Result<Self, String> {
+    match input.to_lowercase().as_str() {
+      "linux" => Ok(Os::Linux),
+      "windows" => Ok(Os::Windows),
+      "mac" => Ok(Os::Mac),
+      _ => Err(format!("Invalid OS: {}", input)),
+    }
+  }
+}

crates/gpapi/src/clap/mod.rs

@@ -0,0 +1 @@
+pub mod args;

crates/gpapi/src/credential.rs

@@ -0,0 +1,226 @@
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+use crate::auth::SamlAuthData;
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct PasswordCredential {
+  username: String,
+  password: String,
+}
+
+impl PasswordCredential {
+  pub fn new(username: &str, password: &str) -> Self {
+    Self {
+      username: username.to_string(),
+      password: password.to_string(),
+    }
+  }
+
+  pub fn username(&self) -> &str {
+    &self.username
+  }
+
+  pub fn password(&self) -> &str {
+    &self.password
+  }
+}
+
+impl From<&CachedCredential> for PasswordCredential {
+  fn from(value: &CachedCredential) -> Self {
+    Self::new(value.username(), value.password().unwrap_or_default())
+  }
+}
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct PreloginCookieCredential {
+  username: String,
+  prelogin_cookie: String,
+}
+
+impl PreloginCookieCredential {
+  pub fn new(username: &str, prelogin_cookie: &str) -> Self {
+    Self {
+      username: username.to_string(),
+      prelogin_cookie: prelogin_cookie.to_string(),
+    }
+  }
+
+  pub fn username(&self) -> &str {
+    &self.username
+  }
+
+  pub fn prelogin_cookie(&self) -> &str {
+    &self.prelogin_cookie
+  }
+}
+
+impl TryFrom<SamlAuthData> for PreloginCookieCredential {
+  type Error = anyhow::Error;
+
+  fn try_from(value: SamlAuthData) -> Result<Self, Self::Error> {
+    let username = value.username().to_string();
+    let prelogin_cookie = value
+      .prelogin_cookie()
+      .ok_or_else(|| anyhow::anyhow!("Missing prelogin cookie"))?
+      .to_string();
+
+    Ok(Self::new(&username, &prelogin_cookie))
+  }
+}
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct AuthCookieCredential {
+  username: String,
+  user_auth_cookie: String,
+  prelogon_user_auth_cookie: String,
+}
+
+impl AuthCookieCredential {
+  pub fn new(username: &str, user_auth_cookie: &str, prelogon_user_auth_cookie: &str) -> Self {
+    Self {
+      username: username.to_string(),
+      user_auth_cookie: user_auth_cookie.to_string(),
+      prelogon_user_auth_cookie: prelogon_user_auth_cookie.to_string(),
+    }
+  }
+
+  pub fn username(&self) -> &str {
+    &self.username
+  }
+
+  pub fn user_auth_cookie(&self) -> &str {
+    &self.user_auth_cookie
+  }
+
+  pub fn prelogon_user_auth_cookie(&self) -> &str {
+    &self.prelogon_user_auth_cookie
+  }
+}
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct CachedCredential {
+  username: String,
+  password: Option<String>,
+  auth_cookie: AuthCookieCredential,
+}
+
+impl CachedCredential {
+  pub fn new(
+    username: String,
+    password: Option<String>,
+    auth_cookie: AuthCookieCredential,
+  ) -> Self {
+    Self {
+      username,
+      password,
+      auth_cookie,
+    }
+  }
+
+  pub fn username(&self) -> &str {
+    &self.username
+  }
+
+  pub fn password(&self) -> Option<&str> {
+    self.password.as_deref()
+  }
+
+  pub fn auth_cookie(&self) -> &AuthCookieCredential {
+    &self.auth_cookie
+  }
+
+  pub fn set_auth_cookie(&mut self, auth_cookie: AuthCookieCredential) {
+    self.auth_cookie = auth_cookie;
+  }
+}
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum Credential {
+  Password(PasswordCredential),
+  PreloginCookie(PreloginCookieCredential),
+  AuthCookie(AuthCookieCredential),
+  CachedCredential(CachedCredential),
+}
+
+impl Credential {
+  pub fn username(&self) -> &str {
+    match self {
+      Credential::Password(cred) => cred.username(),
+      Credential::PreloginCookie(cred) => cred.username(),
+      Credential::AuthCookie(cred) => cred.username(),
+      Credential::CachedCredential(cred) => cred.username(),
+    }
+  }
+
+  pub fn to_params(&self) -> HashMap<&str, &str> {
+    let mut params = HashMap::new();
+    params.insert("user", self.username());
+
+    let (passwd, prelogin_cookie, portal_userauthcookie, portal_prelogonuserauthcookie) = match self
+    {
+      Credential::Password(cred) => (Some(cred.password()), None, None, None),
+      Credential::PreloginCookie(cred) => (None, Some(cred.prelogin_cookie()), None, None),
+      Credential::AuthCookie(cred) => (
+        None,
+        None,
+        Some(cred.user_auth_cookie()),
+        Some(cred.prelogon_user_auth_cookie()),
+      ),
+      Credential::CachedCredential(cred) => (
+        cred.password(),
+        None,
+        Some(cred.auth_cookie.user_auth_cookie()),
+        Some(cred.auth_cookie.prelogon_user_auth_cookie()),
+      ),
+    };
+
+    params.insert("passwd", passwd.unwrap_or_default());
+    params.insert("prelogin-cookie", prelogin_cookie.unwrap_or_default());
+    params.insert(
+      "portal-userauthcookie",
+      portal_userauthcookie.unwrap_or_default(),
+    );
+    params.insert(
+      "portal-prelogonuserauthcookie",
+      portal_prelogonuserauthcookie.unwrap_or_default(),
+    );
+
+    params
+  }
+}
+
+impl TryFrom<SamlAuthData> for Credential {
+  type Error = anyhow::Error;
+
+  fn try_from(value: SamlAuthData) -> Result<Self, Self::Error> {
+    let prelogin_cookie = PreloginCookieCredential::try_from(value)?;
+
+    Ok(Self::PreloginCookie(prelogin_cookie))
+  }
+}
+
+impl From<PasswordCredential> for Credential {
+  fn from(value: PasswordCredential) -> Self {
+    Self::Password(value)
+  }
+}
+
+impl From<&AuthCookieCredential> for Credential {
+  fn from(value: &AuthCookieCredential) -> Self {
+    Self::AuthCookie(value.clone())
+  }
+}
+
+impl From<&CachedCredential> for Credential {
+  fn from(value: &CachedCredential) -> Self {
+    Self::CachedCredential(value.clone())
+  }
+}

crates/gpapi/src/gateway/login.rs

@@ -0,0 +1,68 @@
+use log::info;
+use reqwest::Client;
+use roxmltree::Document;
+use urlencoding::encode;
+
+use crate::{credential::Credential, gp_params::GpParams};
+
+pub async fn gateway_login(
+  gateway: &str,
+  cred: &Credential,
+  gp_params: &GpParams,
+) -> anyhow::Result<String> {
+  let login_url = format!("https://{}/ssl-vpn/login.esp", gateway);
+  let client = Client::builder()
+    .user_agent(gp_params.user_agent())
+    .build()?;
+
+  let mut params = cred.to_params();
+  let extra_params = gp_params.to_params();
+
+  params.extend(extra_params);
+  params.insert("server", gateway);
+
+  info!("Gateway login, user_agent: {}", gp_params.user_agent());
+
+  let res = client.post(&login_url).form(&params).send().await?;
+  let res_xml = res.error_for_status()?.text().await?;
+
+  let doc = Document::parse(&res_xml)?;
+
+  build_gateway_token(&doc, gp_params.computer())
+}
+
+fn build_gateway_token(doc: &Document, computer: &str) -> anyhow::Result<String> {
+  let args = doc
+    .descendants()
+    .filter(|n| n.has_tag_name("argument"))
+    .map(|n| n.text().unwrap_or("").to_string())
+    .collect::<Vec<_>>();
+
+  let params = [
+    read_args(&args, 1, "authcookie")?,
+    read_args(&args, 3, "portal")?,
+    read_args(&args, 4, "user")?,
+    read_args(&args, 7, "domain")?,
+    read_args(&args, 15, "preferred-ip")?,
+    ("computer", computer),
+  ];
+
+  let token = params
+    .iter()
+    .map(|(k, v)| format!("{}={}", k, encode(v)))
+    .collect::<Vec<_>>()
+    .join("&");
+
+  Ok(token)
+}
+
+fn read_args<'a>(
+  args: &'a [String],
+  index: usize,
+  key: &'a str,
+) -> anyhow::Result<(&'a str, &'a str)> {
+  args
+    .get(index)
+    .ok_or_else(|| anyhow::anyhow!("Failed to read {key} from args"))
+    .map(|s| (key, s.as_ref()))
+}

crates/gpapi/src/gateway/mod.rs

@@ -0,0 +1,41 @@
+mod login;
+mod parse_gateways;
+
+pub use login::*;
+pub(crate) use parse_gateways::*;
+
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+use std::fmt::Display;
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+pub(crate) struct PriorityRule {
+  pub(crate) name: String,
+  pub(crate) priority: u32,
+}
+
+#[derive(Debug, Serialize, Deserialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct Gateway {
+  pub(crate) name: String,
+  pub(crate) address: String,
+  pub(crate) priority: u32,
+  pub(crate) priority_rules: Vec<PriorityRule>,
+}
+
+impl Display for Gateway {
+  fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    write!(f, "{} ({})", self.name, self.address)
+  }
+}
+
+impl Gateway {
+  pub fn name(&self) -> &str {
+    &self.name
+  }
+
+  pub fn server(&self) -> &str {
+    &self.address
+  }
+}

crates/gpapi/src/gateway/parse_gateways.rs

@@ -0,0 +1,63 @@
+use roxmltree::Document;
+
+use super::{Gateway, PriorityRule};
+
+pub(crate) fn parse_gateways(doc: &Document) -> Option<Vec<Gateway>> {
+  let node_gateways = doc.descendants().find(|n| n.has_tag_name("gateways"))?;
+  let list_gateway = node_gateways
+    .descendants()
+    .find(|n| n.has_tag_name("list"))?;
+
+  let gateways = list_gateway
+    .children()
+    .filter_map(|gateway_item| {
+      if !gateway_item.has_tag_name("entry") {
+        return None;
+      }
+      let address = gateway_item.attribute("name").unwrap_or("").to_string();
+      let name = gateway_item
+        .children()
+        .find(|n| n.has_tag_name("description"))
+        .and_then(|n| n.text())
+        .unwrap_or("")
+        .to_string();
+      let priority = gateway_item
+        .children()
+        .find(|n| n.has_tag_name("priority"))
+        .and_then(|n| n.text())
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(u32::MAX);
+      let priority_rules = gateway_item
+        .children()
+        .find(|n| n.has_tag_name("priority-rule"))
+        .map(|n| {
+          n.children()
+            .filter_map(|n| {
+              if !n.has_tag_name("entry") {
+                return None;
+              }
+              let name = n.attribute("name").unwrap_or("").to_string();
+              let priority: u32 = n
+                .children()
+                .find(|n| n.has_tag_name("priority"))
+                .and_then(|n| n.text())
+                .and_then(|s| s.parse().ok())
+                .unwrap_or(u32::MAX);
+
+              Some(PriorityRule { name, priority })
+            })
+            .collect()
+        })
+        .unwrap_or_default();
+
+      Some(Gateway {
+        name,
+        address,
+        priority,
+        priority_rules,
+      })
+    })
+    .collect();
+
+  Some(gateways)
+}

crates/gpapi/src/gp_params.rs

@@ -0,0 +1,166 @@
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+use crate::GP_USER_AGENT;
+
+#[derive(Debug, Serialize, Deserialize, Clone, Type, Default)]
+pub enum ClientOs {
+  #[default]
+  Linux,
+  Windows,
+  Mac,
+}
+
+impl From<&str> for ClientOs {
+  fn from(os: &str) -> Self {
+    match os {
+      "Linux" => ClientOs::Linux,
+      "Windows" => ClientOs::Windows,
+      "Mac" => ClientOs::Mac,
+      _ => ClientOs::Linux,
+    }
+  }
+}
+
+impl ClientOs {
+  pub fn as_str(&self) -> &str {
+    match self {
+      ClientOs::Linux => "Linux",
+      ClientOs::Windows => "Windows",
+      ClientOs::Mac => "Mac",
+    }
+  }
+
+  pub fn to_openconnect_os(&self) -> &str {
+    match self {
+      ClientOs::Linux => "linux",
+      ClientOs::Windows => "win",
+      ClientOs::Mac => "mac-intel",
+    }
+  }
+}
+
+#[derive(Debug, Serialize, Deserialize, Type, Default)]
+pub struct GpParams {
+  user_agent: String,
+  client_os: ClientOs,
+  os_version: Option<String>,
+  client_version: Option<String>,
+  computer: String,
+  ignore_tls_errors: bool,
+}
+
+impl GpParams {
+  pub fn builder() -> GpParamsBuilder {
+    GpParamsBuilder::new()
+  }
+
+  pub(crate) fn user_agent(&self) -> &str {
+    &self.user_agent
+  }
+
+  pub(crate) fn computer(&self) -> &str {
+    &self.computer
+  }
+
+  pub fn ignore_tls_errors(&self) -> bool {
+    self.ignore_tls_errors
+  }
+
+  pub(crate) fn to_params(&self) -> HashMap<&str, &str> {
+    let mut params: HashMap<&str, &str> = HashMap::new();
+    let client_os = self.client_os.as_str();
+
+    // Common params
+    params.insert("prot", "https:");
+    params.insert("jnlpReady", "jnlpReady");
+    params.insert("ok", "Login");
+    params.insert("direct", "yes");
+    params.insert("ipv6-support", "yes");
+    params.insert("inputStr", "");
+    params.insert("clientVer", "4100");
+    params.insert("clientos", client_os);
+    params.insert("computer", &self.computer);
+
+    if let Some(os_version) = &self.os_version {
+      params.insert("os-version", os_version);
+    }
+
+    if let Some(client_version) = &self.client_version {
+      params.insert("clientgpversion", client_version);
+    }
+
+    params
+  }
+}
+
+pub struct GpParamsBuilder {
+  user_agent: String,
+  client_os: ClientOs,
+  os_version: Option<String>,
+  client_version: Option<String>,
+  computer: String,
+  ignore_tls_errors: bool,
+}
+
+impl GpParamsBuilder {
+  pub fn new() -> Self {
+    Self {
+      user_agent: GP_USER_AGENT.to_string(),
+      client_os: ClientOs::Linux,
+      os_version: Default::default(),
+      client_version: Default::default(),
+      computer: whoami::hostname(),
+      ignore_tls_errors: false,
+    }
+  }
+
+  pub fn user_agent(&mut self, user_agent: &str) -> &mut Self {
+    self.user_agent = user_agent.to_string();
+    self
+  }
+
+  pub fn client_os(&mut self, client_os: ClientOs) -> &mut Self {
+    self.client_os = client_os;
+    self
+  }
+
+  pub fn os_version<T: Into<Option<String>>>(&mut self, os_version: T) -> &mut Self {
+    self.os_version = os_version.into();
+    self
+  }
+
+  pub fn client_version<T: Into<Option<String>>>(&mut self, client_version: T) -> &mut Self {
+    self.client_version = client_version.into();
+    self
+  }
+
+  pub fn computer(&mut self, computer: &str) -> &mut Self {
+    self.computer = computer.to_string();
+    self
+  }
+
+  pub fn ignore_tls_errors(&mut self, ignore_tls_errors: bool) -> &mut Self {
+    self.ignore_tls_errors = ignore_tls_errors;
+    self
+  }
+
+  pub fn build(&self) -> GpParams {
+    GpParams {
+      user_agent: self.user_agent.clone(),
+      client_os: self.client_os.clone(),
+      os_version: self.os_version.clone(),
+      client_version: self.client_version.clone(),
+      computer: self.computer.clone(),
+      ignore_tls_errors: self.ignore_tls_errors,
+    }
+  }
+}
+
+impl Default for GpParamsBuilder {
+  fn default() -> Self {
+    Self::new()
+  }
+}

crates/gpapi/src/lib.rs

@@ -0,0 +1,35 @@
+pub mod auth;
+pub mod credential;
+pub mod gateway;
+pub mod gp_params;
+pub mod portal;
+pub mod process;
+pub mod service;
+pub mod utils;
+
+#[cfg(feature = "clap")]
+pub mod clap;
+
+#[cfg(debug_assertions)]
+pub const GP_API_KEY: &[u8; 32] = &[0; 32];
+
+pub const GP_USER_AGENT: &str = "PAN GlobalProtect";
+pub const GP_SERVICE_LOCK_FILE: &str = "/var/run/gpservice.lock";
+
+#[cfg(not(debug_assertions))]
+pub const GP_CLIENT_BINARY: &str = "/usr/bin/gpclient";
+#[cfg(not(debug_assertions))]
+pub const GP_SERVICE_BINARY: &str = "/usr/bin/gpservice";
+#[cfg(not(debug_assertions))]
+pub const GP_GUI_BINARY: &str = "/usr/bin/gpgui";
+#[cfg(not(debug_assertions))]
+pub(crate) const GP_AUTH_BINARY: &str = "/usr/bin/gpauth";
+
+#[cfg(debug_assertions)]
+pub const GP_CLIENT_BINARY: &str = dotenvy_macro::dotenv!("GP_CLIENT_BINARY");
+#[cfg(debug_assertions)]
+pub const GP_SERVICE_BINARY: &str = dotenvy_macro::dotenv!("GP_SERVICE_BINARY");
+#[cfg(debug_assertions)]
+pub const GP_GUI_BINARY: &str = dotenvy_macro::dotenv!("GP_GUI_BINARY");
+#[cfg(debug_assertions)]
+pub(crate) const GP_AUTH_BINARY: &str = dotenvy_macro::dotenv!("GP_AUTH_BINARY");

crates/gpapi/src/portal/config.rs

@@ -0,0 +1,174 @@
+use anyhow::ensure;
+use log::info;
+use reqwest::Client;
+use roxmltree::Document;
+use serde::Serialize;
+use specta::Type;
+use thiserror::Error;
+
+use crate::{
+  credential::{AuthCookieCredential, Credential},
+  gateway::{parse_gateways, Gateway},
+  gp_params::GpParams,
+  utils::{normalize_server, xml},
+};
+
+#[derive(Debug, Serialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PortalConfig {
+  portal: String,
+  auth_cookie: AuthCookieCredential,
+  gateways: Vec<Gateway>,
+  config_digest: Option<String>,
+}
+
+impl PortalConfig {
+  pub fn new(
+    portal: String,
+    auth_cookie: AuthCookieCredential,
+    gateways: Vec<Gateway>,
+    config_digest: Option<String>,
+  ) -> Self {
+    Self {
+      portal,
+      auth_cookie,
+      gateways,
+      config_digest,
+    }
+  }
+
+  pub fn portal(&self) -> &str {
+    &self.portal
+  }
+
+  pub fn gateways(&self) -> Vec<&Gateway> {
+    self.gateways.iter().collect()
+  }
+
+  pub fn auth_cookie(&self) -> &AuthCookieCredential {
+    &self.auth_cookie
+  }
+
+  /// In-place sort the gateways by region
+  pub fn sort_gateways(&mut self, region: &str) {
+    let preferred_gateway = self.find_preferred_gateway(region);
+    let preferred_gateway_index = self
+      .gateways()
+      .iter()
+      .position(|gateway| gateway.name == preferred_gateway.name)
+      .unwrap();
+
+    // Move the preferred gateway to the front of the list
+    self.gateways.swap(0, preferred_gateway_index);
+  }
+
+  /// Find a gateway by name or address
+  pub fn find_gateway(&self, name_or_address: &str) -> Option<&Gateway> {
+    self
+      .gateways
+      .iter()
+      .find(|gateway| gateway.name == name_or_address || gateway.address == name_or_address)
+  }
+
+  /// Find the preferred gateway for the given region
+  /// Iterates over the gateways and find the first one that
+  /// has the lowest priority for the given region.
+  /// If no gateway is found, returns the gateway with the lowest priority.
+  pub fn find_preferred_gateway(&self, region: &str) -> &Gateway {
+    let mut preferred_gateway: Option<&Gateway> = None;
+    let mut lowest_region_priority = u32::MAX;
+
+    for gateway in &self.gateways {
+      for rule in &gateway.priority_rules {
+        if (rule.name == region || rule.name == "Any") && rule.priority < lowest_region_priority {
+          preferred_gateway = Some(gateway);
+          lowest_region_priority = rule.priority;
+        }
+      }
+    }
+
+    // If no gateway is found, return the gateway with the lowest priority
+    preferred_gateway.unwrap_or_else(|| {
+      self
+        .gateways
+        .iter()
+        .min_by_key(|gateway| gateway.priority)
+        .unwrap()
+    })
+  }
+}
+
+#[derive(Error, Debug)]
+pub enum PortalConfigError {
+  #[error("Empty response, retrying can help")]
+  EmptyResponse,
+  #[error("Empty auth cookie, retrying can help")]
+  EmptyAuthCookie,
+  #[error("Invalid auth cookie, retrying can help")]
+  InvalidAuthCookie,
+  #[error("Empty gateways, retrying can help")]
+  EmptyGateways,
+}
+
+pub async fn retrieve_config(
+  portal: &str,
+  cred: &Credential,
+  gp_params: &GpParams,
+) -> anyhow::Result<PortalConfig> {
+  let portal = normalize_server(portal)?;
+  let server = remove_url_scheme(&portal);
+
+  let url = format!("{}/global-protect/getconfig.esp", portal);
+  let client = Client::builder()
+    .user_agent(gp_params.user_agent())
+    .build()?;
+
+  let mut params = cred.to_params();
+  let extra_params = gp_params.to_params();
+
+  params.extend(extra_params);
+  params.insert("server", &server);
+  params.insert("host", &server);
+
+  info!("Portal config, user_agent: {}", gp_params.user_agent());
+
+  let res = client.post(&url).form(&params).send().await?;
+  let res_xml = res.error_for_status()?.text().await?;
+
+  ensure!(!res_xml.is_empty(), PortalConfigError::EmptyResponse);
+
+  let doc = Document::parse(&res_xml)?;
+  let gateways = parse_gateways(&doc).ok_or_else(|| anyhow::anyhow!("Failed to parse gateways"))?;
+
+  let user_auth_cookie = xml::get_child_text(&doc, "portal-userauthcookie").unwrap_or_default();
+  let prelogon_user_auth_cookie =
+    xml::get_child_text(&doc, "portal-prelogonuserauthcookie").unwrap_or_default();
+  let config_digest = xml::get_child_text(&doc, "config-digest");
+
+  ensure!(
+    !user_auth_cookie.is_empty() && !prelogon_user_auth_cookie.is_empty(),
+    PortalConfigError::EmptyAuthCookie
+  );
+
+  ensure!(
+    user_auth_cookie != "empty" && prelogon_user_auth_cookie != "empty",
+    PortalConfigError::InvalidAuthCookie
+  );
+
+  ensure!(!gateways.is_empty(), PortalConfigError::EmptyGateways);
+
+  Ok(PortalConfig::new(
+    server.to_string(),
+    AuthCookieCredential::new(
+      cred.username(),
+      &user_auth_cookie,
+      &prelogon_user_auth_cookie,
+    ),
+    gateways,
+    config_digest,
+  ))
+}
+
+fn remove_url_scheme(s: &str) -> String {
+  s.replace("http://", "").replace("https://", "")
+}

crates/gpapi/src/portal/mod.rs

@@ -0,0 +1,5 @@
+mod config;
+mod prelogin;
+
+pub use config::*;
+pub use prelogin::*;

crates/gpapi/src/portal/prelogin.rs

@@ -0,0 +1,156 @@
+use anyhow::bail;
+use log::{info, trace};
+use reqwest::Client;
+use roxmltree::Document;
+use serde::Serialize;
+use specta::Type;
+
+use crate::{
+  gp_params::GpParams,
+  utils::{base64, normalize_server, xml},
+};
+
+const REQUIRED_PARAMS: [&str; 8] = [
+  "tmp",
+  "clientVer",
+  "clientos",
+  "os-version",
+  "host-id",
+  "ipv6-support",
+  "default-browser",
+  "cas-support",
+];
+
+#[derive(Debug, Serialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct SamlPrelogin {
+  region: String,
+  saml_request: String,
+}
+
+impl SamlPrelogin {
+  pub fn region(&self) -> &str {
+    &self.region
+  }
+
+  pub fn saml_request(&self) -> &str {
+    &self.saml_request
+  }
+}
+
+#[derive(Debug, Serialize, Type, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct StandardPrelogin {
+  region: String,
+  auth_message: String,
+  label_username: String,
+  label_password: String,
+}
+
+impl StandardPrelogin {
+  pub fn region(&self) -> &str {
+    &self.region
+  }
+
+  pub fn auth_message(&self) -> &str {
+    &self.auth_message
+  }
+
+  pub fn label_username(&self) -> &str {
+    &self.label_username
+  }
+
+  pub fn label_password(&self) -> &str {
+    &self.label_password
+  }
+}
+
+#[derive(Debug, Serialize, Type, Clone)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum Prelogin {
+  Saml(SamlPrelogin),
+  Standard(StandardPrelogin),
+}
+
+impl Prelogin {
+  pub fn region(&self) -> &str {
+    match self {
+      Prelogin::Saml(saml) => saml.region(),
+      Prelogin::Standard(standard) => standard.region(),
+    }
+  }
+}
+
+pub async fn prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<Prelogin> {
+  let user_agent = gp_params.user_agent();
+  info!("Portal prelogin, user_agent: {}", user_agent);
+
+  let portal = normalize_server(portal)?;
+  let prelogin_url = format!(
+    "{}/global-protect/prelogin.esp?kerberos-support=yes",
+    portal
+  );
+  let mut params = gp_params.to_params();
+  params.insert("tmp", "tmp");
+  params.insert("default-browser", "0");
+  params.insert("cas-support", "yes");
+
+  params.retain(|k, _| {
+    REQUIRED_PARAMS
+      .iter()
+      .any(|required_param| required_param == k)
+  });
+
+  let client = Client::builder()
+    .danger_accept_invalid_certs(gp_params.ignore_tls_errors())
+    .user_agent(user_agent)
+    .build()?;
+
+  let res = client.post(&prelogin_url).form(&params).send().await?;
+  let res_xml = res.error_for_status()?.text().await?;
+
+  trace!("Prelogin response: {}", res_xml);
+  let doc = Document::parse(&res_xml)?;
+
+  let status = xml::get_child_text(&doc, "status")
+    .ok_or_else(|| anyhow::anyhow!("Prelogin response does not contain status element"))?;
+  // Check the status of the prelogin response
+  if status.to_uppercase() != "SUCCESS" {
+    let msg = xml::get_child_text(&doc, "msg").unwrap_or(String::from("Unknown error"));
+    bail!("Prelogin failed: {}", msg)
+  }
+
+  let region = xml::get_child_text(&doc, "region")
+    .ok_or_else(|| anyhow::anyhow!("Prelogin response does not contain region element"))?;
+
+  let saml_method = xml::get_child_text(&doc, "saml-auth-method");
+  let saml_request = xml::get_child_text(&doc, "saml-request");
+  // Check if the prelogin response is SAML
+  if saml_method.is_some() && saml_request.is_some() {
+    let saml_request = base64::decode_to_string(&saml_request.unwrap())?;
+    let saml_prelogin = SamlPrelogin {
+      region,
+      saml_request,
+    };
+
+    return Ok(Prelogin::Saml(saml_prelogin));
+  }
+
+  let label_username = xml::get_child_text(&doc, "username-label");
+  let label_password = xml::get_child_text(&doc, "password-label");
+  // Check if the prelogin response is standard login
+  if label_username.is_some() && label_password.is_some() {
+    let auth_message = xml::get_child_text(&doc, "authentication-message")
+      .unwrap_or(String::from("Please enter the login credentials"));
+    let standard_prelogin = StandardPrelogin {
+      region,
+      auth_message,
+      label_username: label_username.unwrap(),
+      label_password: label_password.unwrap(),
+    };
+
+    return Ok(Prelogin::Standard(standard_prelogin));
+  }
+
+  bail!("Invalid prelogin response");
+}

crates/gpapi/src/process/auth_launcher.rs

@@ -0,0 +1,129 @@
+use std::process::Stdio;
+
+use tokio::process::Command;
+
+use crate::{auth::SamlAuthResult, credential::Credential, GP_AUTH_BINARY};
+
+use super::command_traits::CommandExt;
+
+pub struct SamlAuthLauncher<'a> {
+  server: &'a str,
+  saml_request: Option<&'a str>,
+  user_agent: Option<&'a str>,
+  os: Option<&'a str>,
+  os_version: Option<&'a str>,
+  hidpi: bool,
+  fix_openssl: bool,
+  ignore_tls_errors: bool,
+  clean: bool,
+}
+
+impl<'a> SamlAuthLauncher<'a> {
+  pub fn new(server: &'a str) -> Self {
+    Self {
+      server,
+      saml_request: None,
+      user_agent: None,
+      os: None,
+      os_version: None,
+      hidpi: false,
+      fix_openssl: false,
+      ignore_tls_errors: false,
+      clean: false,
+    }
+  }
+
+  pub fn saml_request(mut self, saml_request: &'a str) -> Self {
+    self.saml_request = Some(saml_request);
+    self
+  }
+
+  pub fn user_agent(mut self, user_agent: &'a str) -> Self {
+    self.user_agent = Some(user_agent);
+    self
+  }
+
+  pub fn os(mut self, os: &'a str) -> Self {
+    self.os = Some(os);
+    self
+  }
+
+  pub fn os_version(mut self, os_version: Option<&'a str>) -> Self {
+    self.os_version = os_version;
+    self
+  }
+
+  pub fn hidpi(mut self, hidpi: bool) -> Self {
+    self.hidpi = hidpi;
+    self
+  }
+
+  pub fn fix_openssl(mut self, fix_openssl: bool) -> Self {
+    self.fix_openssl = fix_openssl;
+    self
+  }
+
+  pub fn ignore_tls_errors(mut self, ignore_tls_errors: bool) -> Self {
+    self.ignore_tls_errors = ignore_tls_errors;
+    self
+  }
+
+  pub fn clean(mut self, clean: bool) -> Self {
+    self.clean = clean;
+    self
+  }
+
+  /// Launch the authenticator binary as the current user or SUDO_USER if available.
+  pub async fn launch(self) -> anyhow::Result<Credential> {
+    let mut auth_cmd = Command::new(GP_AUTH_BINARY);
+    auth_cmd.arg(self.server);
+
+    if let Some(saml_request) = self.saml_request {
+      auth_cmd.arg("--saml-request").arg(saml_request);
+    }
+
+    if let Some(user_agent) = self.user_agent {
+      auth_cmd.arg("--user-agent").arg(user_agent);
+    }
+
+    if let Some(os) = self.os {
+      auth_cmd.arg("--os").arg(os);
+    }
+
+    if let Some(os_version) = self.os_version {
+      auth_cmd.arg("--os-version").arg(os_version);
+    }
+
+    if self.hidpi {
+      auth_cmd.arg("--hidpi");
+    }
+
+    if self.fix_openssl {
+      auth_cmd.arg("--fix-openssl");
+    }
+
+    if self.ignore_tls_errors {
+      auth_cmd.arg("--ignore-tls-errors");
+    }
+
+    if self.clean {
+      auth_cmd.arg("--clean");
+    }
+
+    let mut non_root_cmd = auth_cmd.into_non_root()?;
+    let output = non_root_cmd
+      .kill_on_drop(true)
+      .stdout(Stdio::piped())
+      .spawn()?
+      .wait_with_output()
+      .await?;
+
+    let auth_result: SamlAuthResult = serde_json::from_slice(&output.stdout)
+      .map_err(|_| anyhow::anyhow!("Failed to parse auth data"))?;
+
+    match auth_result {
+      SamlAuthResult::Success(auth_data) => Credential::try_from(auth_data),
+      SamlAuthResult::Failure(msg) => Err(anyhow::anyhow!(msg)),
+    }
+  }
+}

crates/gpapi/src/process/command_traits.rs

@@ -0,0 +1,64 @@
+use anyhow::bail;
+use std::{env, ffi::OsStr};
+use tokio::process::Command;
+use uzers::{os::unix::UserExt, User};
+
+pub trait CommandExt {
+  fn new_pkexec<S: AsRef<OsStr>>(program: S) -> Command;
+  fn into_non_root(self) -> anyhow::Result<Command>;
+}
+
+impl CommandExt for Command {
+  fn new_pkexec<S: AsRef<OsStr>>(program: S) -> Command {
+    let mut cmd = Command::new("pkexec");
+    cmd
+      .arg("--disable-internal-agent")
+      .arg("--user")
+      .arg("root")
+      .arg(program);
+
+    cmd
+  }
+
+  fn into_non_root(mut self) -> anyhow::Result<Command> {
+    let user =
+      get_non_root_user().map_err(|_| anyhow::anyhow!("{:?} cannot be run as root", self))?;
+
+    self
+      .env("HOME", user.home_dir())
+      .env("USER", user.name())
+      .env("LOGNAME", user.name())
+      .env("USERNAME", user.name())
+      .uid(user.uid())
+      .gid(user.primary_group_id());
+
+    Ok(self)
+  }
+}
+
+fn get_non_root_user() -> anyhow::Result<User> {
+  let current_user = whoami::username();
+
+  let user = if current_user == "root" {
+    get_real_user()?
+  } else {
+    uzers::get_user_by_name(&current_user)
+      .ok_or_else(|| anyhow::anyhow!("User ({}) not found", current_user))?
+  };
+
+  if user.uid() == 0 {
+    bail!("Non-root user not found")
+  }
+
+  Ok(user)
+}
+
+fn get_real_user() -> anyhow::Result<User> {
+  // Read the UID from SUDO_UID or PKEXEC_UID environment variable if available.
+  let uid = match env::var("SUDO_UID") {
+    Ok(uid) => uid.parse::<u32>()?,
+    _ => env::var("PKEXEC_UID")?.parse::<u32>()?,
+  };
+
+  uzers::get_user_by_uid(uid).ok_or_else(|| anyhow::anyhow!("User not found"))
+}

crates/gpapi/src/process/gui_launcher.rs

@@ -0,0 +1,91 @@
+use std::{
+  collections::HashMap,
+  path::PathBuf,
+  process::{ExitStatus, Stdio},
+};
+
+use tokio::{io::AsyncWriteExt, process::Command};
+
+use crate::{utils::base64, GP_GUI_BINARY};
+
+use super::command_traits::CommandExt;
+
+pub struct GuiLauncher {
+  program: PathBuf,
+  api_key: Option<Vec<u8>>,
+  minimized: bool,
+  envs: Option<HashMap<String, String>>,
+}
+
+impl Default for GuiLauncher {
+  fn default() -> Self {
+    Self::new()
+  }
+}
+
+impl GuiLauncher {
+  pub fn new() -> Self {
+    Self {
+      program: GP_GUI_BINARY.into(),
+      api_key: None,
+      minimized: false,
+      envs: None,
+    }
+  }
+
+  pub fn envs<T: Into<Option<HashMap<String, String>>>>(mut self, envs: T) -> Self {
+    self.envs = envs.into();
+    self
+  }
+
+  pub fn api_key(mut self, api_key: Vec<u8>) -> Self {
+    self.api_key = Some(api_key);
+    self
+  }
+
+  pub fn minimized(mut self, minimized: bool) -> Self {
+    self.minimized = minimized;
+    self
+  }
+
+  pub async fn launch(&self) -> anyhow::Result<ExitStatus> {
+    let mut cmd = Command::new(&self.program);
+
+    if let Some(envs) = &self.envs {
+      cmd.env_clear();
+      cmd.envs(envs);
+    }
+
+    if self.api_key.is_some() {
+      cmd.arg("--api-key-on-stdin");
+    }
+
+    if self.minimized {
+      cmd.arg("--minimized");
+    }
+
+    let mut non_root_cmd = cmd.into_non_root()?;
+
+    let mut child = non_root_cmd
+      .kill_on_drop(true)
+      .stdin(Stdio::piped())
+      .spawn()?;
+
+    let mut stdin = child
+      .stdin
+      .take()
+      .ok_or_else(|| anyhow::anyhow!("Failed to open stdin"))?;
+
+    if let Some(api_key) = &self.api_key {
+      let api_key = base64::encode(api_key);
+      tokio::spawn(async move {
+        stdin.write_all(api_key.as_bytes()).await.unwrap();
+        drop(stdin);
+      });
+    }
+
+    let exit_status = child.wait().await?;
+
+    Ok(exit_status)
+  }
+}

crates/gpapi/src/process/mod.rs

@@ -0,0 +1,5 @@
+pub(crate) mod command_traits;
+
+pub mod auth_launcher;
+pub mod gui_launcher;
+pub mod service_launcher;

crates/gpapi/src/process/service_launcher.rs

@@ -0,0 +1,72 @@
+use std::{
+  fs::File,
+  path::PathBuf,
+  process::{ExitStatus, Stdio},
+};
+
+use tokio::process::Command;
+
+use crate::GP_SERVICE_BINARY;
+
+use super::command_traits::CommandExt;
+
+pub struct ServiceLauncher {
+  program: PathBuf,
+  minimized: bool,
+  env_file: Option<String>,
+  log_file: Option<String>,
+}
+
+impl Default for ServiceLauncher {
+  fn default() -> Self {
+    Self::new()
+  }
+}
+
+impl ServiceLauncher {
+  pub fn new() -> Self {
+    Self {
+      program: GP_SERVICE_BINARY.into(),
+      minimized: false,
+      env_file: None,
+      log_file: None,
+    }
+  }
+
+  pub fn minimized(mut self, minimized: bool) -> Self {
+    self.minimized = minimized;
+    self
+  }
+
+  pub fn env_file(mut self, env_file: &str) -> Self {
+    self.env_file = Some(env_file.to_string());
+    self
+  }
+
+  pub fn log_file(mut self, log_file: &str) -> Self {
+    self.log_file = Some(log_file.to_string());
+    self
+  }
+
+  pub async fn launch(&self) -> anyhow::Result<ExitStatus> {
+    let mut cmd = Command::new_pkexec(&self.program);
+
+    if self.minimized {
+      cmd.arg("--minimized");
+    }
+
+    if let Some(env_file) = &self.env_file {
+      cmd.arg("--env-file").arg(env_file);
+    }
+
+    if let Some(log_file) = &self.log_file {
+      let log_file = File::create(log_file)?;
+      let stdio = Stdio::from(log_file);
+      cmd.stderr(stdio);
+    }
+
+    let exit_status = cmd.kill_on_drop(true).spawn()?.wait().await?;
+
+    Ok(exit_status)
+  }
+}

crates/gpapi/src/service/event.rs

@@ -0,0 +1,10 @@
+use serde::{Deserialize, Serialize};
+
+use super::vpn_state::VpnState;
+
+/// Events that can be emitted by the service
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub enum WsEvent {
+  VpnState(VpnState),
+  ActiveGui,
+}

crates/gpapi/src/service/mod.rs

@@ -0,0 +1,3 @@
+pub mod event;
+pub mod request;
+pub mod vpn_state;

crates/gpapi/src/service/request.rs

@@ -0,0 +1,118 @@
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+use crate::{gateway::Gateway, gp_params::ClientOs};
+
+use super::vpn_state::ConnectInfo;
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct LaunchGuiRequest {
+  user: String,
+  envs: HashMap<String, String>,
+}
+
+impl LaunchGuiRequest {
+  pub fn new(user: String, envs: HashMap<String, String>) -> Self {
+    Self { user, envs }
+  }
+
+  pub fn user(&self) -> &str {
+    &self.user
+  }
+
+  pub fn envs(&self) -> &HashMap<String, String> {
+    &self.envs
+  }
+}
+
+#[derive(Debug, Deserialize, Serialize, Type)]
+pub struct ConnectArgs {
+  cookie: String,
+  vpnc_script: Option<String>,
+  user_agent: Option<String>,
+  os: Option<ClientOs>,
+}
+
+impl ConnectArgs {
+  pub fn new(cookie: String) -> Self {
+    Self {
+      cookie,
+      vpnc_script: None,
+      user_agent: None,
+      os: None,
+    }
+  }
+
+  pub fn cookie(&self) -> &str {
+    &self.cookie
+  }
+
+  pub fn vpnc_script(&self) -> Option<String> {
+    self.vpnc_script.clone()
+  }
+
+  pub fn user_agent(&self) -> Option<String> {
+    self.user_agent.clone()
+  }
+
+  pub fn openconnect_os(&self) -> Option<String> {
+    self
+      .os
+      .as_ref()
+      .map(|os| os.to_openconnect_os().to_string())
+  }
+}
+
+#[derive(Debug, Deserialize, Serialize, Type)]
+pub struct ConnectRequest {
+  info: ConnectInfo,
+  args: ConnectArgs,
+}
+
+impl ConnectRequest {
+  pub fn new(info: ConnectInfo, cookie: String) -> Self {
+    Self {
+      info,
+      args: ConnectArgs::new(cookie),
+    }
+  }
+
+  pub fn with_vpnc_script<T: Into<Option<String>>>(mut self, vpnc_script: T) -> Self {
+    self.args.vpnc_script = vpnc_script.into();
+    self
+  }
+
+  pub fn with_user_agent<T: Into<Option<String>>>(mut self, user_agent: T) -> Self {
+    self.args.user_agent = user_agent.into();
+    self
+  }
+
+  pub fn with_os<T: Into<Option<ClientOs>>>(mut self, os: T) -> Self {
+    self.args.os = os.into();
+    self
+  }
+
+  pub fn gateway(&self) -> &Gateway {
+    self.info.gateway()
+  }
+
+  pub fn info(&self) -> &ConnectInfo {
+    &self.info
+  }
+
+  pub fn args(&self) -> &ConnectArgs {
+    &self.args
+  }
+}
+
+#[derive(Debug, Deserialize, Serialize, Type)]
+pub struct DisconnectRequest;
+
+/// Requests that can be sent to the service
+#[derive(Debug, Deserialize, Serialize)]
+pub enum WsRequest {
+  Connect(Box<ConnectRequest>),
+  Disconnect(DisconnectRequest),
+}

crates/gpapi/src/service/vpn_state.rs

@@ -0,0 +1,34 @@
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+use crate::gateway::Gateway;
+
+#[derive(Debug, Deserialize, Serialize, Type, Clone)]
+pub struct ConnectInfo {
+  portal: String,
+  gateway: Gateway,
+  gateways: Vec<Gateway>,
+}
+
+impl ConnectInfo {
+  pub fn new(portal: String, gateway: Gateway, gateways: Vec<Gateway>) -> Self {
+    Self {
+      portal,
+      gateway,
+      gateways,
+    }
+  }
+
+  pub fn gateway(&self) -> &Gateway {
+    &self.gateway
+  }
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub enum VpnState {
+  Disconnected,
+  Connecting(Box<ConnectInfo>),
+  Connected(Box<ConnectInfo>),
+  Disconnecting,
+}

crates/gpapi/src/utils/base64.rs

@@ -0,0 +1,21 @@
+use base64::{engine::general_purpose, Engine};
+
+pub fn encode(data: &[u8]) -> String {
+  let engine = general_purpose::STANDARD;
+
+  engine.encode(data)
+}
+
+pub fn decode_to_vec(s: &str) -> anyhow::Result<Vec<u8>> {
+  let engine = general_purpose::STANDARD;
+  let decoded = engine.decode(s)?;
+
+  Ok(decoded)
+}
+
+pub(crate) fn decode_to_string(s: &str) -> anyhow::Result<String> {
+  let decoded = decode_to_vec(s)?;
+  let decoded = String::from_utf8(decoded)?;
+
+  Ok(decoded)
+}

crates/gpapi/src/utils/crypto.rs

@@ -0,0 +1,108 @@
+use chacha20poly1305::{
+  aead::{Aead, OsRng},
+  AeadCore, ChaCha20Poly1305, Key, KeyInit, Nonce,
+};
+use serde::{de::DeserializeOwned, Serialize};
+
+pub fn generate_key() -> Key {
+  ChaCha20Poly1305::generate_key(&mut OsRng)
+}
+
+pub fn encrypt<T>(key: &Key, value: &T) -> anyhow::Result<Vec<u8>>
+where
+  T: Serialize,
+{
+  let cipher = ChaCha20Poly1305::new(key);
+  let nonce = ChaCha20Poly1305::generate_nonce(&mut OsRng);
+
+  let data = serde_json::to_vec(value)?;
+  let cipher_text = cipher.encrypt(&nonce, data.as_ref())?;
+
+  let mut encrypted = Vec::new();
+  encrypted.extend_from_slice(&nonce);
+  encrypted.extend_from_slice(&cipher_text);
+
+  Ok(encrypted)
+}
+
+pub fn decrypt<T>(key: &Key, encrypted: Vec<u8>) -> anyhow::Result<T>
+where
+  T: DeserializeOwned,
+{
+  let cipher = ChaCha20Poly1305::new(key);
+
+  let nonce = Nonce::from_slice(&encrypted[..12]);
+  let cipher_text = &encrypted[12..];
+
+  let plaintext = cipher.decrypt(nonce, cipher_text)?;
+
+  let value = serde_json::from_slice(&plaintext)?;
+
+  Ok(value)
+}
+
+pub struct Crypto {
+  key: Vec<u8>,
+}
+
+impl Crypto {
+  pub fn new(key: Vec<u8>) -> Self {
+    Self { key }
+  }
+
+  pub fn encrypt<T: Serialize>(&self, plain: T) -> anyhow::Result<Vec<u8>> {
+    let key: &[u8] = &self.key;
+    let encrypted_data = encrypt(key.into(), &plain)?;
+
+    Ok(encrypted_data)
+  }
+
+  pub fn decrypt<T: DeserializeOwned>(&self, encrypted: Vec<u8>) -> anyhow::Result<T> {
+    let key: &[u8] = &self.key;
+    decrypt(key.into(), encrypted)
+  }
+
+  pub fn encrypt_to<T: Serialize>(&self, path: &std::path::Path, plain: T) -> anyhow::Result<()> {
+    let encrypted_data = self.encrypt(plain)?;
+    std::fs::write(path, encrypted_data)?;
+
+    Ok(())
+  }
+
+  pub fn decrypt_from<T: DeserializeOwned>(&self, path: &std::path::Path) -> anyhow::Result<T> {
+    let encrypted_data = std::fs::read(path)?;
+    self.decrypt(encrypted_data)
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use serde::Deserialize;
+
+  use super::*;
+
+  #[derive(Serialize, Deserialize)]
+  struct User {
+    name: String,
+    age: u8,
+  }
+
+  #[test]
+  fn it_works() -> anyhow::Result<()> {
+    let key = generate_key();
+
+    let user = User {
+      name: "test".to_string(),
+      age: 18,
+    };
+
+    let encrypted = encrypt(&key, &user)?;
+
+    let decrypted_user = decrypt::<User>(&key, encrypted)?;
+
+    assert_eq!(user.name, decrypted_user.name);
+    assert_eq!(user.age, decrypted_user.age);
+
+    Ok(())
+  }
+}

crates/gpapi/src/utils/endpoint.rs

@@ -0,0 +1,20 @@
+use tokio::fs;
+
+use crate::GP_SERVICE_LOCK_FILE;
+
+async fn read_port() -> anyhow::Result<String> {
+  let port = fs::read_to_string(GP_SERVICE_LOCK_FILE).await?;
+  Ok(port.trim().to_string())
+}
+
+pub async fn http_endpoint() -> anyhow::Result<String> {
+  let port = read_port().await?;
+
+  Ok(format!("http://127.0.0.1:{}", port))
+}
+
+pub async fn ws_endpoint() -> anyhow::Result<String> {
+  let port = read_port().await?;
+
+  Ok(format!("ws://127.0.0.1:{}/ws", port))
+}

crates/gpapi/src/utils/env_file.rs

@@ -0,0 +1,37 @@
+use std::collections::HashMap;
+use std::env;
+use std::io::Write;
+use std::path::Path;
+
+use tempfile::NamedTempFile;
+
+pub fn persist_env_vars(extra: Option<HashMap<String, String>>) -> anyhow::Result<NamedTempFile> {
+  let mut env_file = NamedTempFile::new()?;
+  let content = env::vars()
+    .map(|(key, value)| format!("{}={}", key, value))
+    .chain(
+      extra
+        .unwrap_or_default()
+        .into_iter()
+        .map(|(key, value)| format!("{}={}", key, value)),
+    )
+    .collect::<Vec<String>>()
+    .join("\n");
+
+  writeln!(env_file, "{}", content)?;
+
+  Ok(env_file)
+}
+
+pub fn load_env_vars<T: AsRef<Path>>(env_file: T) -> anyhow::Result<HashMap<String, String>> {
+  let content = std::fs::read_to_string(env_file)?;
+  let mut env_vars: HashMap<String, String> = HashMap::new();
+
+  for line in content.lines() {
+    if let Some((key, value)) = line.split_once('=') {
+      env_vars.insert(key.to_string(), value.to_string());
+    }
+  }
+
+  Ok(env_vars)
+}

crates/gpapi/src/utils/lock_file.rs

@@ -0,0 +1,39 @@
+use std::path::PathBuf;
+
+pub struct LockFile {
+  path: PathBuf,
+}
+
+impl LockFile {
+  pub fn new<P: Into<PathBuf>>(path: P) -> Self {
+    Self { path: path.into() }
+  }
+
+  pub fn exists(&self) -> bool {
+    self.path.exists()
+  }
+
+  pub fn lock(&self, content: impl AsRef<[u8]>) -> anyhow::Result<()> {
+    std::fs::write(&self.path, content)?;
+    Ok(())
+  }
+
+  pub fn unlock(&self) -> anyhow::Result<()> {
+    std::fs::remove_file(&self.path)?;
+    Ok(())
+  }
+
+  pub async fn check_health(&self) -> bool {
+    match std::fs::read_to_string(&self.path) {
+      Ok(content) => {
+        let url = format!("http://127.0.0.1:{}/health", content.trim());
+
+        match reqwest::get(&url).await {
+          Ok(resp) => resp.status().is_success(),
+          Err(_) => false,
+        }
+      }
+      Err(_) => false,
+    }
+  }
+}

crates/gpapi/src/utils/mod.rs

@@ -0,0 +1,40 @@
+use reqwest::Url;
+
+pub(crate) mod xml;
+
+pub mod base64;
+pub mod crypto;
+pub mod endpoint;
+pub mod env_file;
+pub mod lock_file;
+pub mod openssl;
+pub mod redact;
+#[cfg(feature = "tauri")]
+pub mod window;
+
+mod shutdown_signal;
+
+pub use shutdown_signal::shutdown_signal;
+
+/// Normalize the server URL to the format `https://<host>:<port>`
+pub fn normalize_server(server: &str) -> anyhow::Result<String> {
+  let server = if server.starts_with("https://") || server.starts_with("http://") {
+    server.to_string()
+  } else {
+    format!("https://{}", server)
+  };
+
+  let normalized_url = Url::parse(&server)?;
+  let scheme = normalized_url.scheme();
+  let host = normalized_url
+    .host_str()
+    .ok_or(anyhow::anyhow!("Invalid server URL: missing host"))?;
+
+  let port: String = normalized_url
+    .port()
+    .map_or("".into(), |port| format!(":{}", port));
+
+  let normalized_url = format!("{}://{}{}", scheme, host, port);
+
+  Ok(normalized_url)
+}

crates/gpapi/src/utils/openssl.rs

@@ -0,0 +1,37 @@
+use std::path::Path;
+
+use tempfile::NamedTempFile;
+
+pub fn openssl_conf() -> String {
+  let option = "UnsafeLegacyServerConnect";
+
+  format!(
+    "openssl_conf = openssl_init
+
+[openssl_init]
+ssl_conf = ssl_sect
+
+[ssl_sect]
+system_default = system_default_sect
+
+[system_default_sect]
+Options = {}",
+    option
+  )
+}
+
+pub fn fix_openssl<P: AsRef<Path>>(path: P) -> anyhow::Result<()> {
+  let content = openssl_conf();
+  std::fs::write(path, content)?;
+  Ok(())
+}
+
+pub fn fix_openssl_env() -> anyhow::Result<NamedTempFile> {
+  let openssl_conf = NamedTempFile::new()?;
+  let openssl_conf_path = openssl_conf.path();
+
+  fix_openssl(openssl_conf_path)?;
+  std::env::set_var("OPENSSL_CONF", openssl_conf_path);
+
+  Ok(openssl_conf)
+}

crates/gpapi/src/utils/redact.rs

@@ -0,0 +1,227 @@
+use std::sync::RwLock;
+
+use redact_engine::{Pattern, Redaction as RedactEngine};
+use regex::Regex;
+use url::{form_urlencoded, Url};
+
+pub struct Redaction {
+  redact_engine: RwLock<Option<RedactEngine>>,
+}
+
+impl Default for Redaction {
+  fn default() -> Self {
+    Self::new()
+  }
+}
+
+impl Redaction {
+  pub fn new() -> Self {
+    let redact_engine = RedactEngine::custom("[**********]").add_pattern(Pattern {
+      test: Regex::new("(((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4})").unwrap(),
+      group: 1,
+    });
+
+    Self {
+      redact_engine: RwLock::new(Some(redact_engine)),
+    }
+  }
+
+  pub fn add_value(&self, text: &str) -> anyhow::Result<()> {
+    let mut redact_engine = self
+      .redact_engine
+      .write()
+      .map_err(|_| anyhow::anyhow!("Failed to acquire write lock on redact engine"))?;
+
+    *redact_engine = Some(
+      redact_engine
+        .take()
+        .ok_or_else(|| anyhow::anyhow!("Failed to take redact engine"))?
+        .add_value(text)?,
+    );
+
+    Ok(())
+  }
+
+  pub fn add_values(&self, texts: &[&str]) -> anyhow::Result<()> {
+    let mut redact_engine = self
+      .redact_engine
+      .write()
+      .map_err(|_| anyhow::anyhow!("Failed to acquire write lock on redact engine"))?;
+
+    *redact_engine = Some(
+      redact_engine
+        .take()
+        .ok_or_else(|| anyhow::anyhow!("Failed to take redact engine"))?
+        .add_values(texts.to_vec())?,
+    );
+
+    Ok(())
+  }
+
+  pub fn redact_str(&self, text: &str) -> String {
+    self
+      .redact_engine
+      .read()
+      .expect("Failed to acquire read lock on redact engine")
+      .as_ref()
+      .expect("Failed to get redact engine")
+      .redact_str(text)
+  }
+}
+
+/// Redact a value by replacing all but the first and last character with asterisks,
+/// The length of the value to be redacted must be at least 3 characters.
+/// e.g. "foo" -> "f**********o"
+pub fn redact_value(text: &str) -> String {
+  if text.len() < 3 {
+    return text.to_string();
+  }
+
+  let mut redacted = String::new();
+  redacted.push_str(&text[0..1]);
+  redacted.push_str(&"*".repeat(10));
+  redacted.push_str(&text[text.len() - 1..]);
+
+  redacted
+}
+
+pub fn redact_uri(uri: &str) -> String {
+  let Ok(mut url) = Url::parse(uri) else {
+    return uri.to_string();
+  };
+
+  // Could be a data: URI
+  if url.cannot_be_a_base() {
+    if url.scheme() == "about" {
+      return uri.to_string();
+    }
+
+    if url.path().len() > 15 {
+      return format!(
+        "{}:{}{}",
+        url.scheme(),
+        &url.path()[0..10],
+        redact_value(&url.path()[10..])
+      );
+    }
+
+    return format!("{}:{}", url.scheme(), redact_value(url.path()));
+  }
+
+  let host = url.host_str().unwrap_or_default();
+  if url.set_host(Some(&redact_value(host))).is_err() {
+    let redacted_query = redact_query(url.query())
+      .as_deref()
+      .map(|query| format!("?{}", query))
+      .unwrap_or_default();
+
+    return format!(
+      "{}://[**********]{}{}",
+      url.scheme(),
+      url.path(),
+      redacted_query
+    );
+  }
+
+  let redacted_query = redact_query(url.query());
+  url.set_query(redacted_query.as_deref());
+  url.to_string()
+}
+
+fn redact_query(query: Option<&str>) -> Option<String> {
+  let query = query?;
+
+  let query_pairs = form_urlencoded::parse(query.as_bytes());
+  let mut redacted_pairs = query_pairs.map(|(key, value)| (key, redact_value(&value)));
+
+  let query = form_urlencoded::Serializer::new(String::new())
+    .extend_pairs(redacted_pairs.by_ref())
+    .finish();
+
+  Some(query)
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn it_should_not_redact_value() {
+    let text = "fo";
+
+    assert_eq!(redact_value(text), "fo");
+  }
+
+  #[test]
+  fn it_should_redact_value() {
+    let text = "foo";
+
+    assert_eq!(redact_value(text), "f**********o");
+  }
+
+  #[test]
+  fn it_should_redact_dynamic_value() {
+    let redaction = Redaction::new();
+
+    redaction.add_value("foo").unwrap();
+
+    assert_eq!(
+      redaction.redact_str("hello, foo, bar"),
+      "hello, [**********], bar"
+    );
+  }
+
+  #[test]
+  fn it_should_redact_dynamic_values() {
+    let redaction = Redaction::new();
+
+    redaction.add_values(&["foo", "bar"]).unwrap();
+
+    assert_eq!(
+      redaction.redact_str("hello, foo, bar"),
+      "hello, [**********], [**********]"
+    );
+  }
+
+  #[test]
+  fn it_should_redact_uri() {
+    let uri = "https://foo.bar";
+    assert_eq!(redact_uri(uri), "https://f**********r/");
+
+    let uri = "https://foo.bar/";
+    assert_eq!(redact_uri(uri), "https://f**********r/");
+
+    let uri = "https://foo.bar/baz";
+    assert_eq!(redact_uri(uri), "https://f**********r/baz");
+
+    let uri = "https://foo.bar/baz?qux=quux";
+    assert_eq!(redact_uri(uri), "https://f**********r/baz?qux=q**********x");
+  }
+
+  #[test]
+  fn it_should_redact_data_uri() {
+    let uri = "data:text/plain;a";
+    assert_eq!(redact_uri(uri), "data:t**********a");
+
+    let uri = "data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==";
+    assert_eq!(redact_uri(uri), "data:text/plain;**********=");
+
+    let uri = "about:blank";
+    assert_eq!(redact_uri(uri), "about:blank");
+  }
+
+  #[test]
+  fn it_should_redact_ipv6() {
+    let uri = "https://[2001:db8::1]:8080";
+    assert_eq!(redact_uri(uri), "https://[**********]/");
+
+    let uri = "https://[2001:db8::1]:8080/";
+    assert_eq!(redact_uri(uri), "https://[**********]/");
+
+    let uri = "https://[2001:db8::1]:8080/baz";
+    assert_eq!(redact_uri(uri), "https://[**********]/baz");
+
+    let uri = "https://[2001:db8::1]:8080/baz?qux=quux";
+    assert_eq!(redact_uri(uri), "https://[**********]/baz?qux=q**********x");
+  }
+}

crates/gpapi/src/utils/shutdown_signal.rs

@@ -0,0 +1,22 @@
+use tokio::signal;
+
+pub async fn shutdown_signal() {
+  let ctrl_c = async {
+    signal::ctrl_c()
+      .await
+      .expect("failed to install Ctrl+C handler");
+  };
+
+  #[cfg(unix)]
+  let terminate = async {
+    signal::unix::signal(signal::unix::SignalKind::terminate())
+      .expect("failed to install signal handler")
+      .recv()
+      .await;
+  };
+
+  tokio::select! {
+      _ = ctrl_c => {},
+      _ = terminate => {},
+  }
+}

crates/gpapi/src/utils/window.rs

@@ -0,0 +1,89 @@
+use std::{process::ExitStatus, time::Duration};
+
+use anyhow::bail;
+use log::{info, warn};
+use tauri::{window::MenuHandle, Window};
+use tokio::process::Command;
+
+pub trait WindowExt {
+  fn raise(&self) -> anyhow::Result<()>;
+}
+
+impl WindowExt for Window {
+  fn raise(&self) -> anyhow::Result<()> {
+    raise_window(self)
+  }
+}
+
+pub fn raise_window(win: &Window) -> anyhow::Result<()> {
+  let is_wayland = std::env::var("XDG_SESSION_TYPE").unwrap_or_default() == "wayland";
+
+  if is_wayland {
+    win.hide()?;
+    win.show()?;
+  } else {
+    if !win.is_visible()? {
+      win.show()?;
+    }
+    let title = win.title()?;
+    tokio::spawn(async move {
+      if let Err(err) = wmctrl_raise_window(&title).await {
+        warn!("Failed to raise window: {}", err);
+      }
+    });
+  }
+
+  // Calling window.show() on Windows will cause the menu to be shown.
+  hide_menu(win.menu_handle());
+
+  Ok(())
+}
+
+async fn wmctrl_raise_window(title: &str) -> anyhow::Result<()> {
+  let mut counter = 0;
+
+  loop {
+    if let Ok(exit_status) = wmctrl_try_raise_window(title).await {
+      if exit_status.success() {
+        info!("Window raised after {} attempts", counter + 1);
+        return Ok(());
+      }
+    }
+
+    if counter >= 10 {
+      bail!("Failed to raise window: {}", title)
+    }
+
+    counter += 1;
+    tokio::time::sleep(Duration::from_millis(100)).await;
+  }
+}
+
+async fn wmctrl_try_raise_window(title: &str) -> anyhow::Result<ExitStatus> {
+  let exit_status = Command::new("wmctrl")
+    .arg("-F")
+    .arg("-a")
+    .arg(title)
+    .spawn()?
+    .wait()
+    .await?;
+
+  Ok(exit_status)
+}
+
+fn hide_menu(menu_handle: MenuHandle) {
+  tokio::spawn(async move {
+    loop {
+      let menu_visible = menu_handle.is_visible().unwrap_or(false);
+
+      if !menu_visible {
+        break;
+      }
+
+      if menu_visible {
+        let _ = menu_handle.hide();
+        tokio::time::sleep(Duration::from_millis(10)).await;
+      }
+    }
+  });
+}

crates/gpapi/src/utils/xml.rs

@@ -0,0 +1,6 @@
+use roxmltree::Document;
+
+pub(crate) fn get_child_text(doc: &Document, name: &str) -> Option<String> {
+  let node = doc.descendants().find(|n| n.has_tag_name(name))?;
+  node.text().map(|s| s.to_string())
+}

crates/gpapi/tests/files/gateway_login.xml

@@ -2,13 +2,13 @@
 <jnlp>
     <application-desc>
         <argument>(null)</argument>
-        <argument>44d9988f3a3b5a247d359b1d39229add</argument>
+        <argument>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</argument>
-        <argument>1cb389d44ec35e98665211761b65a049ef7ba77e</argument>
+        <argument>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</argument>
-        <argument>GP-Gateway-N</argument>
+        <argument>XXX-GP-Gateway-N</argument>
         <argument>user</argument>
         <argument>AD_Authentication</argument>
         <argument>vsys1</argument>
-        <argument>vpn.example.com</argument>
+        <argument>corp.example.com</argument>
         <argument>(null)</argument>
         <argument></argument>
         <argument></argument>
@@ -17,8 +17,8 @@
         <argument>-1</argument>
         <argument>4100</argument>
         <argument></argument>
-        <argument>xxxxxxxxxxxxxxxx</argument>
+        <argument>xxxxxx</argument>
-        <argument>xxxxxxxxxxxxxxxx</argument>
+        <argument>aaaaaa</argument>
         <argument></argument>
         <argument>4</argument>
         <argument>unknown</argument>

crates/gpapi/tests/files/prelogin_saml.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<prelogin-response>
+    <status>Success</status>
+    <ccusername></ccusername>
+    <autosubmit>false</autosubmit>
+    <msg></msg>
+    <newmsg></newmsg>
+    <authentication-message>Enter login credentials</authentication-message>
+    <username-label>Username</username-label>
+    <password-label>Password</password-label>
+    <panos-version>1</panos-version>
+    <saml-default-browser>yes</saml-default-browser>
+
+    <cas-auth></cas-auth>
+    <saml-auth-status>0</saml-auth-status>
+    <saml-auth-method>REDIRECT</saml-auth-method>
+    <saml-request-timeout>600</saml-request-timeout>
+    <saml-request-id>0</saml-request-id>
+    <saml-request>U0FNTFJlcXVlc3Q9eHh4</saml-request>
+    <auth-api>no</auth-api>
+    <region>CN</region>
+</prelogin-response>

crates/gpapi/tests/files/prelogin_standard.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<prelogin-response>
+    <status>Success</status>
+    <ccusername></ccusername>
+    <autosubmit>false</autosubmit>
+    <msg></msg>
+    <newmsg></newmsg>
+    <authentication-message>Enter login credentials</authentication-message>
+    <username-label>Username</username-label>
+    <password-label>Password</password-label>
+    <panos-version>1</panos-version>
+    <saml-default-browser>yes</saml-default-browser>
+    <auth-api>no</auth-api>
+    <region>US</region>
+</prelogin-response>

crates/openconnect/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "openconnect"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+links = "openconnect"
+
+[dependencies]
+log.workspace = true
+is_executable.workspace = true
+
+[build-dependencies]
+cc = "1"

crates/openconnect/build.rs

@@ -0,0 +1,12 @@
+fn main() {
+  // Link to the native openconnect library
+  println!("cargo:rustc-link-lib=openconnect");
+  println!("cargo:rerun-if-changed=src/ffi/vpn.c");
+  println!("cargo:rerun-if-changed=src/ffi/vpn.h");
+
+  // Compile the vpn.c file
+  cc::Build::new()
+    .file("src/ffi/vpn.c")
+    .include("src/ffi")
+    .compile("vpn");
+}

crates/openconnect/src/ffi/mod.rs

@@ -0,0 +1,71 @@
+use crate::Vpn;
+use log::{debug, info, trace, warn};
+use std::ffi::{c_char, c_int, c_void};
+
+#[repr(C)]
+#[derive(Debug)]
+pub(crate) struct ConnectOptions {
+  pub user_data: *mut c_void,
+
+  pub server: *const c_char,
+  pub cookie: *const c_char,
+  pub user_agent: *const c_char,
+
+  pub script: *const c_char,
+  pub os: *const c_char,
+  pub certificate: *const c_char,
+  pub servercert: *const c_char,
+}
+
+#[link(name = "vpn")]
+extern "C" {
+  #[link_name = "vpn_connect"]
+  fn vpn_connect(
+    options: *const ConnectOptions,
+    callback: extern "C" fn(i32, *mut c_void),
+  ) -> c_int;
+
+  #[link_name = "vpn_disconnect"]
+  fn vpn_disconnect();
+}
+
+pub(crate) fn connect(options: &ConnectOptions) -> i32 {
+  unsafe { vpn_connect(options, on_vpn_connected) }
+}
+
+pub(crate) fn disconnect() {
+  unsafe { vpn_disconnect() }
+}
+
+#[no_mangle]
+extern "C" fn on_vpn_connected(pipe_fd: i32, vpn: *mut c_void) {
+  let vpn = unsafe { &*(vpn as *const Vpn) };
+  vpn.on_connected(pipe_fd);
+}
+
+// Logger used in the C code.
+// level: 0 = error, 1 = info, 2 = debug, 3 = trace
+// map the error level log in openconnect to the warning level
+#[no_mangle]
+extern "C" fn vpn_log(level: i32, message: *const c_char) {
+  let message = unsafe { std::ffi::CStr::from_ptr(message) };
+  let message = message.to_str().unwrap_or("Invalid log message");
+  // Strip the trailing newline
+  let message = message.trim_end_matches('\n');
+
+  if level == 0 {
+    warn!("{}", message);
+  } else if level == 1 {
+    info!("{}", message);
+  } else if level == 2 {
+    debug!("{}", message);
+  } else if level == 3 {
+    trace!("{}", message);
+  } else {
+    warn!(
+      "Unknown log level: {}, enable DEBUG log level to see more details",
+      level
+    );
+    debug!("{}", message);
+  }
+}

crates/openconnect/src/ffi/vpn.c

@@ -10,7 +10,8 @@
 void *g_user_data;
 
 static int g_cmd_pipe_fd;
-const char *g_vpnc_script;
+static const char *g_vpnc_script;
+static vpn_connected_callback on_vpn_connected;
 
 /* Validate the peer certificate */
 static int validate_peer_cert(__attribute__((unused)) void *_vpninfo, const char *reason)
@@ -40,18 +41,26 @@ static void print_progress(__attribute__((unused)) void *_vpninfo, int level, co
 
 static void setup_tun_handler(void *_vpninfo)
 {
-    openconnect_setup_tun_device(_vpninfo, g_vpnc_script, NULL);
+    int ret = openconnect_setup_tun_device(_vpninfo, g_vpnc_script, NULL);
+    if (!ret) {
         on_vpn_connected(g_cmd_pipe_fd, g_user_data);
+    }
 }
 
 /* Initialize VPN connection */
-int vpn_connect(const vpn_options *options)
+int vpn_connect(const vpn_options *options, vpn_connected_callback callback)
 {
+    INFO("openconnect version: %s", openconnect_get_version());
     struct openconnect_info *vpninfo;
     struct utsname utsbuf;
 
     g_user_data = options->user_data;
     g_vpnc_script = options->script;
+    on_vpn_connected = callback;
+
+    INFO("User agent: %s", options->user_agent);
+    INFO("VPNC script: %s", options->script);
+    INFO("OS: %s", options->os);
 
     vpninfo = openconnect_vpninfo_new(options->user_agent, validate_peer_cert, NULL, NULL, print_progress, NULL);
 
@@ -61,12 +70,16 @@ int vpn_connect(const vpn_options *options)
         return 1;
     }
 
-    openconnect_set_loglevel(vpninfo, 1);
+    openconnect_set_loglevel(vpninfo, PRG_TRACE);
     openconnect_init_ssl();
     openconnect_set_protocol(vpninfo, "gp");
     openconnect_set_hostname(vpninfo, options->server);
     openconnect_set_cookie(vpninfo, options->cookie);
 
+    if (options->os) {
+        openconnect_set_reported_os(vpninfo, options->os);
+    }
+
     if (options->certificate)
     {
         INFO("Setting client certificate: %s", options->certificate);

crates/openconnect/src/ffi/vpn.h

@@ -3,22 +3,24 @@
 #include <stdarg.h>
 #include <openconnect.h>
 
+typedef void (*vpn_connected_callback)(int cmd_pipe_fd, void *user_data);
+
 typedef struct vpn_options
 {
+    void *user_data;
     const char *server;
     const char *cookie;
     const char *user_agent;
-    void *user_data;
 
     const char *script;
+    const char *os;
     const char *certificate;
     const char *servercert;
 } vpn_options;
 
-int vpn_connect(const vpn_options *options);
+int vpn_connect(const vpn_options *options, vpn_connected_callback callback);
 void vpn_disconnect();
 
-extern void on_vpn_connected(int cmd_pipe_fd, void *user_data);
 extern void vpn_log(int level, const char *msg);
 
 static char *format_message(const char *format, va_list args)

crates/openconnect/src/lib.rs

@@ -0,0 +1,5 @@
+mod ffi;
+mod vpn;
+mod vpnc_script;
+
+pub use vpn::*;

crates/openconnect/src/vpn.rs

@@ -0,0 +1,131 @@
+use std::{
+  ffi::{c_char, CString},
+  sync::{Arc, RwLock},
+};
+
+use log::info;
+
+use crate::{ffi, vpnc_script::find_default_vpnc_script};
+
+type OnConnectedCallback = Arc<RwLock<Option<Box<dyn FnOnce() + 'static + Send + Sync>>>>;
+
+pub struct Vpn {
+  server: CString,
+  cookie: CString,
+  user_agent: CString,
+  script: CString,
+  os: CString,
+  certificate: Option<CString>,
+  servercert: Option<CString>,
+
+  callback: OnConnectedCallback,
+}
+
+impl Vpn {
+  pub fn builder(server: &str, cookie: &str) -> VpnBuilder {
+    VpnBuilder::new(server, cookie)
+  }
+
+  pub fn connect(&self, on_connected: impl FnOnce() + 'static + Send + Sync) -> i32 {
+    self
+      .callback
+      .write()
+      .unwrap()
+      .replace(Box::new(on_connected));
+    let options = self.build_connect_options();
+
+    ffi::connect(&options)
+  }
+
+  pub(crate) fn on_connected(&self, pipe_fd: i32) {
+    info!("Connected to VPN, pipe_fd: {}", pipe_fd);
+
+    if let Some(callback) = self.callback.write().unwrap().take() {
+      callback();
+    }
+  }
+
+  pub fn disconnect(&self) {
+    ffi::disconnect();
+  }
+
+  fn build_connect_options(&self) -> ffi::ConnectOptions {
+    ffi::ConnectOptions {
+      user_data: self as *const _ as *mut _,
+
+      server: self.server.as_ptr(),
+      cookie: self.cookie.as_ptr(),
+      user_agent: self.user_agent.as_ptr(),
+      script: self.script.as_ptr(),
+      os: self.os.as_ptr(),
+      certificate: Self::option_to_ptr(&self.certificate),
+      servercert: Self::option_to_ptr(&self.servercert),
+    }
+  }
+
+  fn option_to_ptr(option: &Option<CString>) -> *const c_char {
+    match option {
+      Some(value) => value.as_ptr(),
+      None => std::ptr::null(),
+    }
+  }
+}
+
+pub struct VpnBuilder {
+  server: String,
+  cookie: String,
+  user_agent: Option<String>,
+  script: Option<String>,
+  os: Option<String>,
+}
+
+impl VpnBuilder {
+  fn new(server: &str, cookie: &str) -> Self {
+    Self {
+      server: server.to_string(),
+      cookie: cookie.to_string(),
+      user_agent: None,
+      script: None,
+      os: None,
+    }
+  }
+
+  pub fn user_agent<T: Into<Option<String>>>(mut self, user_agent: T) -> Self {
+    self.user_agent = user_agent.into();
+    self
+  }
+
+  pub fn script<T: Into<Option<String>>>(mut self, script: T) -> Self {
+    self.script = script.into();
+    self
+  }
+
+  pub fn os<T: Into<Option<String>>>(mut self, os: T) -> Self {
+    self.os = os.into();
+    self
+  }
+
+  pub fn build(self) -> Vpn {
+    let user_agent = self.user_agent.unwrap_or_default();
+    let script = self
+      .script
+      .or_else(find_default_vpnc_script)
+      .unwrap_or_default();
+    let os = self.os.unwrap_or("linux".to_string());
+
+    Vpn {
+      server: Self::to_cstring(&self.server),
+      cookie: Self::to_cstring(&self.cookie),
+      user_agent: Self::to_cstring(&user_agent),
+      script: Self::to_cstring(&script),
+      os: Self::to_cstring(&os),
+      certificate: None,
+      servercert: None,
+      callback: Default::default(),
+    }
+  }
+
+  fn to_cstring(value: &str) -> CString {
+    CString::new(value.to_string()).expect("Failed to convert to CString")
+  }
+}

crates/openconnect/src/vpnc_script.rs

@@ -0,0 +1,23 @@
+use is_executable::IsExecutable;
+use std::path::Path;
+
+const VPNC_SCRIPT_LOCATIONS: [&str; 5] = [
+  "/usr/local/share/vpnc-scripts/vpnc-script",
+  "/usr/local/sbin/vpnc-script",
+  "/usr/share/vpnc-scripts/vpnc-script",
+  "/usr/sbin/vpnc-script",
+  "/etc/vpnc/vpnc-script",
+];
+
+pub(crate) fn find_default_vpnc_script() -> Option<String> {
+  for location in VPNC_SCRIPT_LOCATIONS.iter() {
+    let path = Path::new(location);
+    if path.is_executable() {
+      return Some(location.to_string());
+    }
+  }
+
+  log::warn!("vpnc-script not found");
+
+  None
+}

gpclient/.gitignore

@@ -1 +0,0 @@
-/target

gpclient/Cargo.toml

@@ -1,10 +0,0 @@
-[package]
-name = "gpclient"
-version = "0.1.0"
-edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-gpcommon = { path = "../gpcommon" }
-tokio = { version = "1.0", features = ["full"] }

gpclient/src/main.rs

@@ -1,25 +0,0 @@
-use gpcommon::{Client, SOCKET_PATH};
-use tokio::{io::AsyncReadExt, net::UnixStream, sync::mpsc};
-
-#[tokio::main]
-async fn main() {
-    // let mut stream = UnixStream::connect(SOCKET_PATH).await.unwrap();
-
-    // let mut buf = [0u8; 34];
-    // let _ = stream.read(&mut buf).await.unwrap();
-
-    // // The first two bytes are the port number, the rest is the AES key
-    // let http_port = u16::from_be_bytes([buf[0], buf[1]]);
-    // let aes_key = &buf[2..];
-
-    // println!("http_port: {http_port}");
-    // println!("aes_key: {aes_key:?}");
-    let (output_tx, mut output_rx) = mpsc::channel::<String>(32);
-    let client = Client::default();
-
-    tokio::select! {
-        _ = client.run() => {
-            println!("Client finished");
-        }
-    }
-}

gpcommon/.gitignore

@@ -1,2 +0,0 @@
-/target
-/Cargo.lock

gpcommon/Cargo.toml

@@ -1,27 +0,0 @@
-[package]
-name = "gpcommon"
-version = "0.1.0"
-edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-tokio = { version = "1.14", features = ["full"] }
-tokio-util = "0.7"
-thiserror = "1.0"
-serde = { version = "1.0", features = ["derive"] }
-bytes = "1.0"
-serde_json = "1.0"
-async-trait = "0.1"
-ring = "0.16"
-data-encoding = "2.3"
-log = "0.4"
-is_executable = "1.0"
-configparser = "3.0"
-shlex = "1.0"
-anyhow = "1.0"
-tempfile = "3.8"
-lexopt = "0.3.0"
-
-[build-dependencies]
-cc = "1.0"

gpcommon/build.rs

@@ -1,12 +0,0 @@
-fn main() {
-    // Link to the native openconnect library
-    println!("cargo:rustc-link-lib=openconnect");
-    println!("cargo:rerun-if-changed=src/vpn/vpn.c");
-    println!("cargo:rerun-if-changed=src/vpn/vpn.h");
-
-    // Compile the vpn.c file
-    cc::Build::new()
-        .file("src/vpn/vpn.c")
-        .include("src/vpn")
-        .compile("vpn");
-}

gpcommon/src/client.rs

@@ -1,286 +0,0 @@
-use crate::cmd::{Connect, Disconnect, GetStatus};
-use crate::reader::Reader;
-use crate::request::CommandPayload;
-use crate::response::ResponseData;
-use crate::writer::Writer;
-use crate::RequestPool;
-use crate::Response;
-use crate::SOCKET_PATH;
-use crate::{Request, VpnStatus};
-use log::{debug, info, warn};
-use serde::{Deserialize, Serialize};
-use std::fmt::Display;
-use std::sync::Arc;
-use tokio::io::{self, ReadHalf, WriteHalf};
-use tokio::net::UnixStream;
-use tokio::sync::{mpsc, Mutex, RwLock};
-use tokio_util::sync::CancellationToken;
-
-#[derive(Debug)]
-enum ServiceEvent {
-    Online,
-    Response(Response),
-    Offline,
-}
-
-impl From<Response> for ServiceEvent {
-    fn from(response: Response) -> Self {
-        Self::Response(response)
-    }
-}
-
-#[derive(Debug)]
-pub enum ClientStatus {
-    Vpn(VpnStatus),
-    Service(bool),
-}
-
-#[derive(Debug)]
-pub struct Client {
-    // pool of requests that are waiting for responses
-    request_pool: Arc<RequestPool>,
-    // tx for sending requests to the channel
-    request_tx: mpsc::Sender<Request>,
-    // rx for receiving requests from the channel
-    request_rx: Arc<Mutex<mpsc::Receiver<Request>>>,
-    // tx for sending responses to the channel
-    service_event_tx: mpsc::Sender<ServiceEvent>,
-    // rx for receiving responses from the channel
-    service_event_rx: Arc<Mutex<mpsc::Receiver<ServiceEvent>>>,
-    is_online: Arc<RwLock<bool>>,
-}
-
-#[derive(Debug, Serialize, Deserialize)]
-pub struct ServerApiError {
-    pub message: String,
-}
-
-impl Display for ServerApiError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{message}", message = self.message)
-    }
-}
-
-impl From<String> for ServerApiError {
-    fn from(message: String) -> Self {
-        Self { message }
-    }
-}
-
-impl From<&str> for ServerApiError {
-    fn from(message: &str) -> Self {
-        Self {
-            message: message.to_string(),
-        }
-    }
-}
-
-impl Default for Client {
-    fn default() -> Self {
-        let (request_tx, request_rx) = mpsc::channel::<Request>(32);
-        let (service_event_tx, server_event_rx) = mpsc::channel::<ServiceEvent>(32);
-
-        Self {
-            request_pool: Default::default(),
-            request_tx,
-            request_rx: Arc::new(Mutex::new(request_rx)),
-            service_event_tx,
-            service_event_rx: Arc::new(Mutex::new(server_event_rx)),
-            is_online: Default::default(),
-        }
-    }
-}
-
-impl Client {
-    pub async fn is_online(&self) -> bool {
-        *self.is_online.read().await
-    }
-
-    pub fn subscribe_status(&self, callback: impl Fn(ClientStatus) + Send + Sync + 'static) {
-        let service_event_rx = self.service_event_rx.clone();
-
-        tokio::spawn(async move {
-            loop {
-                let mut server_event_rx = service_event_rx.lock().await;
-                if let Some(server_event) = server_event_rx.recv().await {
-                    match server_event {
-                        ServiceEvent::Online => {
-                            callback(ClientStatus::Service(true));
-                        }
-                        ServiceEvent::Offline => {
-                            callback(ClientStatus::Service(false));
-                        }
-                        ServiceEvent::Response(response) => {
-                            if let ResponseData::Status(vpn_status) = response.data() {
-                                callback(ClientStatus::Vpn(vpn_status));
-                            }
-                        }
-                    }
-                }
-            }
-        });
-    }
-
-    pub async fn run(&self) {
-        info!("Connecting to the background service...");
-
-        // TODO exit the loop properly
-        loop {
-            match self.connect_to_server().await {
-                Ok(_) => {
-                    debug!("Disconnected from server, reconnecting...");
-                }
-                Err(err) => {
-                    debug!("Error connecting to server, retrying, error: {:?}", err)
-                }
-            }
-
-            // wait for a second before trying to reconnect
-            tokio::time::sleep(std::time::Duration::from_secs(1)).await;
-        }
-    }
-
-    async fn connect_to_server(&self) -> Result<(), Box<dyn std::error::Error>> {
-        let stream = UnixStream::connect(SOCKET_PATH).await?;
-        let (read_stream, write_stream) = io::split(stream);
-        let cancel_token = CancellationToken::new();
-
-        let read_handle = tokio::spawn(handle_read(
-            read_stream,
-            self.request_pool.clone(),
-            self.service_event_tx.clone(),
-            cancel_token.clone(),
-        ));
-
-        let write_handle = tokio::spawn(handle_write(
-            write_stream,
-            self.request_rx.clone(),
-            cancel_token,
-        ));
-
-        *self.is_online.write().await = true;
-        info!("Connected to the background service");
-        if let Err(err) = self.service_event_tx.send(ServiceEvent::Online).await {
-            warn!("Error sending online event to the channel: {}", err);
-        }
-
-        let _ = tokio::join!(read_handle, write_handle);
-        *self.is_online.write().await = false;
-
-        // TODO connection was lost, cleanup the request pool
-
-        Ok(())
-    }
-
-    async fn send_command<T: TryFrom<ResponseData>>(
-        &self,
-        payload: CommandPayload,
-    ) -> Result<T, ServerApiError> {
-        if !*self.is_online.read().await {
-            return Err("Background service is not running".into());
-        }
-
-        let (request, response_rx) = self.request_pool.create_request(payload).await;
-
-        if let Err(err) = self.request_tx.send(request).await {
-            return Err(format!("Error sending request to the channel: {}", err).into());
-        }
-
-        response_rx
-            .await
-            .map_err(|_| "Error receiving response from the channel".into())
-            .and_then(|response| {
-                if response.success() {
-                    response
-                        .data()
-                        .try_into()
-                        .map_err(|_| "Error parsing response data".into())
-                } else {
-                    Err(response.message().into())
-                }
-            })
-    }
-
-    pub async fn connect(
-        &self,
-        server: String,
-        cookie: String,
-        user_agent: String,
-    ) -> Result<(), ServerApiError> {
-        self.send_command(Connect::new(server, cookie, user_agent).into())
-            .await
-    }
-
-    pub async fn disconnect(&self) -> Result<(), ServerApiError> {
-        self.send_command(Disconnect.into()).await
-    }
-
-    pub async fn status(&self) -> Result<VpnStatus, ServerApiError> {
-        self.send_command(GetStatus.into()).await
-    }
-}
-
-async fn handle_read(
-    read_stream: ReadHalf<UnixStream>,
-    request_pool: Arc<RequestPool>,
-    service_event_tx: mpsc::Sender<ServiceEvent>,
-    cancel_token: CancellationToken,
-) {
-    let mut reader: Reader = read_stream.into();
-
-    loop {
-        match reader.read_multiple::<Response>().await {
-            Ok(responses) => {
-                for response in responses {
-                    match response.request_id() {
-                        Some(id) => request_pool.complete_request(id, response).await,
-                        None => {
-                            if let Err(err) = service_event_tx.send(response.into()).await {
-                                warn!("Error sending response to output channel: {}", err);
-                            }
-                        }
-                    }
-                }
-            }
-            Err(err) if err.kind() == io::ErrorKind::ConnectionAborted => {
-                warn!("Disconnected from the background service");
-                if let Err(err) = service_event_tx.send(ServiceEvent::Offline).await {
-                    warn!(
-                        "Error sending server disconnected event to channel: {}",
-                        err
-                    );
-                }
-                cancel_token.cancel();
-                break;
-            }
-            Err(err) => {
-                warn!("Error reading from server: {}", err);
-            }
-        }
-    }
-}
-
-async fn handle_write(
-    write_stream: WriteHalf<UnixStream>,
-    request_rx: Arc<Mutex<mpsc::Receiver<Request>>>,
-    cancel_token: CancellationToken,
-) {
-    let mut writer: Writer = write_stream.into();
-    loop {
-        let mut request_rx = request_rx.lock().await;
-        tokio::select! {
-            Some(request) = request_rx.recv() => {
-                if let Err(err) = writer.write(&request).await {
-                    warn!("Error writing to server: {}", err);
-                }
-            }
-            _ = cancel_token.cancelled() => {
-                info!("The read loop has been cancelled, exiting the write loop");
-                break;
-            }
-            else => {
-                warn!("Error reading command from channel");
-            }
-        }
-    }
-}

gpcommon/src/cmd/connect.rs

@@ -1,39 +0,0 @@
-use super::{Command, CommandContext, CommandError};
-use crate::{ResponseData, VpnStatus};
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-pub struct Connect {
-    server: String,
-    cookie: String,
-    user_agent: String,
-}
-
-impl Connect {
-    pub fn new(server: String, cookie: String, user_agent: String) -> Self {
-        Self {
-            server,
-            cookie,
-            user_agent,
-        }
-    }
-}
-
-#[async_trait]
-impl Command for Connect {
-    async fn handle(&self, context: CommandContext) -> Result<ResponseData, CommandError> {
-        let vpn = context.server_context.vpn();
-        let status = vpn.status().await;
-
-        if status != VpnStatus::Disconnected {
-            return Err(format!("VPN is already in state: {:?}", status).into());
-        }
-
-        if let Err(err) = vpn.connect(&self.server, &self.cookie, &self.user_agent).await {
-            return Err(err.to_string().into());
-        }
-
-        Ok(ResponseData::Empty)
-    }
-}

gpcommon/src/cmd/disconnect.rs

@@ -1,15 +0,0 @@
-use super::{Command, CommandContext, CommandError};
-use crate::ResponseData;
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-pub struct Disconnect;
-
-#[async_trait]
-impl Command for Disconnect {
-    async fn handle(&self, context: CommandContext) -> Result<ResponseData, CommandError> {
-        context.server_context.vpn().disconnect().await;
-        Ok(ResponseData::Empty)
-    }
-}

gpcommon/src/cmd/mod.rs

@@ -1,54 +0,0 @@
-use crate::{response::ResponseData, server::ServerContext};
-use async_trait::async_trait;
-use core::fmt::Debug;
-use std::{
-    fmt::{self, Display},
-    sync::Arc,
-};
-
-mod connect;
-mod disconnect;
-mod status;
-
-pub use connect::Connect;
-pub use disconnect::Disconnect;
-pub use status::GetStatus;
-
-#[derive(Debug)]
-pub(crate) struct CommandContext {
-    server_context: Arc<ServerContext>,
-}
-
-impl From<Arc<ServerContext>> for CommandContext {
-    fn from(server_context: Arc<ServerContext>) -> Self {
-        Self { server_context }
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct CommandError {
-    message: String,
-}
-
-impl From<String> for CommandError {
-    fn from(message: String) -> Self {
-        Self { message }
-    }
-}
-
-impl Display for CommandError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "CommandError {:#?}", self.message)
-    }
-}
-
-#[async_trait]
-pub(crate) trait Command: Send + Sync {
-    async fn handle(&self, context: CommandContext) -> Result<ResponseData, CommandError>;
-}
-
-impl Debug for dyn Command {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "Command")
-    }
-}

gpcommon/src/cmd/status.rs

@@ -1,16 +0,0 @@
-use super::{Command, CommandContext, CommandError};
-use crate::ResponseData;
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-pub struct GetStatus;
-
-#[async_trait]
-impl Command for GetStatus {
-    async fn handle(&self, context: CommandContext) -> Result<ResponseData, CommandError> {
-        let status = context.server_context.vpn().status().await;
-
-        Ok(ResponseData::Status(status))
-    }
-}

gpcommon/src/connection.rs

@@ -1,179 +0,0 @@
-use crate::request::Request;
-use crate::server::ServerContext;
-use crate::Reader;
-use crate::Response;
-use crate::ResponseData;
-use crate::VpnStatus;
-use crate::Writer;
-use log::{debug, info, warn};
-use std::sync::Arc;
-use tokio::io::{self, ReadHalf, WriteHalf};
-use tokio::net::UnixStream;
-use tokio::sync::{mpsc, watch};
-use tokio_util::sync::CancellationToken;
-
-async fn handle_read(
-    read_stream: ReadHalf<UnixStream>,
-    server_context: Arc<ServerContext>,
-    response_tx: mpsc::Sender<Response>,
-    peer_pid: Option<i32>,
-    cancel_token: CancellationToken,
-) {
-    let mut reader: Reader = read_stream.into();
-    let mut authenticated: Option<bool> = None;
-
-    loop {
-        match reader.read_multiple::<Request>().await {
-            Ok(requests) => {
-                if authenticated.is_none() {
-                    authenticated = Some(authenticate(peer_pid));
-                }
-                if !authenticated.unwrap_or(false) {
-                    warn!("Client not authenticated, closing connection");
-                    cancel_token.cancel();
-                    break;
-                }
-
-                for request in requests {
-                    debug!("Received client request: {:?}", request);
-
-                    let command = request.command();
-                    let context = server_context.clone().into();
-
-                    let mut response = match command.handle(context).await {
-                        Ok(data) => Response::from(data),
-                        Err(err) => Response::from(err.to_string()),
-                    };
-                    response.set_request_id(request.id());
-
-                    let _ = response_tx.send(response).await;
-                }
-            }
-
-            Err(err) if err.kind() == io::ErrorKind::ConnectionAborted => {
-                info!("Client disconnected");
-                cancel_token.cancel();
-                break;
-            }
-
-            Err(err) => {
-                warn!("Error receiving request: {:?}", err);
-            }
-        }
-    }
-}
-
-async fn handle_write(
-    write_stream: WriteHalf<UnixStream>,
-    mut response_rx: mpsc::Receiver<Response>,
-    cancel_token: CancellationToken,
-) {
-    let mut writer: Writer = write_stream.into();
-
-    loop {
-        tokio::select! {
-            Some(response) = response_rx.recv() => {
-                debug!("Sending response: {:?}", response);
-                if let Err(err) = writer.write(&response).await {
-                    warn!("Error sending response: {:?}", err);
-                }
-            }
-            _ = cancel_token.cancelled() => {
-                info!("Exiting the write loop");
-                break;
-            }
-            else => {
-                warn!("Error receiving response from channel");
-            }
-        }
-    }
-}
-
-async fn handle_status_change(
-    mut status_rx: watch::Receiver<VpnStatus>,
-    response_tx: mpsc::Sender<Response>,
-    cancel_token: CancellationToken,
-) {
-    // Send the initial status
-    send_status(&status_rx, &response_tx).await;
-    debug!("Waiting for status change");
-    let start_time = std::time::Instant::now();
-
-    loop {
-        tokio::select! {
-            _ = status_rx.changed() => {
-                debug!("Status changed: {:?}", start_time.elapsed());
-                send_status(&status_rx, &response_tx).await;
-            }
-            _ = cancel_token.cancelled() => {
-                info!("Exiting the status loop");
-                break;
-            }
-            else => {
-                warn!("Error receiving status from channel");
-            }
-        }
-    }
-}
-
-async fn send_status(status_rx: &watch::Receiver<VpnStatus>, response_tx: &mpsc::Sender<Response>) {
-    let status = *status_rx.borrow();
-    if let Err(err) = response_tx
-        .send(Response::from(ResponseData::Status(status)))
-        .await
-    {
-        warn!("Error sending status: {:?}", err);
-    }
-}
-
-pub(crate) async fn handle_connection(socket: UnixStream, context: Arc<ServerContext>) {
-    let peer_pid = peer_pid(&socket);
-    let (read_stream, write_stream) = io::split(socket);
-    let (response_tx, response_rx) = mpsc::channel::<Response>(32);
-    let cancel_token = CancellationToken::new();
-    let status_rx = context.vpn().status_rx().await;
-
-    // Read requests from the client
-    let read_handle = tokio::spawn(handle_read(
-        read_stream,
-        context.clone(),
-        response_tx.clone(),
-        peer_pid,
-        cancel_token.clone(),
-    ));
-
-    // Write responses to the client
-    let write_handle = tokio::spawn(handle_write(
-        write_stream,
-        response_rx,
-        cancel_token.clone(),
-    ));
-
-    // Watch for status changes
-    let status_handle = tokio::spawn(handle_status_change(
-        status_rx,
-        response_tx.clone(),
-        cancel_token,
-    ));
-
-    let _ = tokio::join!(read_handle, write_handle, status_handle);
-
-    debug!("Client connection closed");
-}
-
-fn peer_pid(socket: &UnixStream) -> Option<i32> {
-    match socket.peer_cred() {
-        Ok(ucred) => ucred.pid(),
-        Err(_) => None,
-    }
-}
-
-// TODO - Implement authentication
-fn authenticate(peer_pid: Option<i32>) -> bool {
-    if let Some(pid) = peer_pid {
-        info!("Peer PID: {}", pid);
-        true
-    } else {
-        false
-    }
-}

gpcommon/src/lib.rs

@@ -1,51 +0,0 @@
-use data_encoding::HEXUPPER;
-use ring::digest::{Context, SHA256};
-use std::{
-    fs::File,
-    io::{BufReader, Read},
-    path::Path,
-};
-
-pub const SOCKET_PATH: &str = "/tmp/gpservice.sock";
-
-mod client;
-mod cmd;
-mod connection;
-mod reader;
-mod request;
-mod response;
-pub mod server;
-mod vpn;
-mod writer;
-
-pub(crate) use request::Request;
-pub(crate) use request::RequestPool;
-
-pub use response::Response;
-pub use response::ResponseData;
-pub use response::TryFromResponseDataError;
-
-pub(crate) use reader::Reader;
-pub(crate) use writer::Writer;
-
-pub use client::Client;
-pub use client::ServerApiError;
-pub use client::ClientStatus;
-pub use vpn::VpnStatus;
-
-pub fn sha256_digest<P: AsRef<Path>>(file_path: P) -> Result<String, std::io::Error> {
-    let input = File::open(file_path)?;
-    let mut reader = BufReader::new(input);
-
-    let mut context = Context::new(&SHA256);
-    let mut buffer = [0; 1024];
-
-    loop {
-        let count = reader.read(&mut buffer)?;
-        if count == 0 {
-            break;
-        }
-        context.update(&buffer[..count]);
-    }
-    Ok(HEXUPPER.encode(context.finish().as_ref()))
-}

gpcommon/src/reader.rs

@@ -1,43 +0,0 @@
-use serde::Deserialize;
-use tokio::io::{self, AsyncReadExt, ReadHalf};
-use tokio::net::UnixStream;
-
-pub(crate) struct Reader {
-    stream: ReadHalf<UnixStream>,
-}
-
-impl From<ReadHalf<UnixStream>> for Reader {
-    fn from(stream: ReadHalf<UnixStream>) -> Self {
-        Self { stream }
-    }
-}
-
-impl Reader {
-    pub async fn read_multiple<T: for<'a> Deserialize<'a>>(&mut self) -> Result<Vec<T>, io::Error> {
-        let mut buffer = [0; 2048];
-
-        match self.stream.read(&mut buffer).await {
-            Ok(0) => Err(io::Error::new(
-                io::ErrorKind::ConnectionAborted,
-                "Peer disconnected",
-            )),
-            Ok(bytes_read) => {
-                let response_str = String::from_utf8_lossy(&buffer[..bytes_read]);
-                let responses: Vec<&str> = response_str.split("\n\n").collect();
-                let responses = responses
-                    .iter()
-                    .filter_map(|r| {
-                        if !r.is_empty() {
-                            serde_json::from_str(r).ok()
-                        } else {
-                            None
-                        }
-                    })
-                    .collect::<Vec<T>>();
-
-                Ok(responses)
-            }
-            Err(err) => Err(err),
-        }
-    }
-}