Add Fortinet hostcheck support

docs/configuration/endpoint/openconnect.md

@@ -58,6 +58,10 @@
       }
     ]
   },
+  "fortinet_host_check": {
+    "hostcheck": "",
+    "check_virtual_desktop": ""
+  },
   "no_udp": false,
   "dtls_local_port": 0,
   "compression_disabled": false,
@@ -342,6 +346,30 @@ TNCC machine certificate path in PEM format.
 
 Conflict with `tncc.certificates.certificate`.
 
+### fortinet_host_check
+
+Fortinet hostcheck result override.
+
+Hostcheck is disabled by default. It is enabled only when `fortinet_host_check.hostcheck` is non-empty. No operating system, security product, or network interface information is collected automatically.
+
+When enabled and a successful Fortinet login response requests hostcheck, both configured values are submitted to the server before the VPN session is used. The values are sent unchanged as `application/x-www-form-urlencoded` fields.
+
+Some Fortinet servers only request hostcheck from recognized FortiClient user agents. Configure `user_agent` when required by the server policy.
+
+### fortinet_host_check.hostcheck
+
+Fortinet hostcheck result string.
+
+The conventional format is `<security-status>,<os-version>`, for example `0100,10.0.19042`. `security-status` contains four `0` or `1` characters representing, in order, third-party firewall, third-party antivirus, FortiClient firewall, and FortiClient antivirus.
+
+An empty value disables Fortinet hostcheck, even if `fortinet_host_check.check_virtual_desktop` is configured.
+
+### fortinet_host_check.check_virtual_desktop
+
+Fortinet virtual desktop check result string.
+
+FortiClient conventionally sends colon-separated MAC addresses joined by `|`, for example `74:78:27:4d:81:93|84:1b:77:3a:95:84`. An empty value is submitted as an empty field when hostcheck is enabled.
+
 ### no_udp
 
 Disable the DTLS or ESP secondary data channel and use the TLS data channel only.

docs/configuration/endpoint/openconnect.zh.md

@@ -58,6 +58,10 @@
       }
     ]
   },
+  "fortinet_host_check": {
+    "hostcheck": "",
+    "check_virtual_desktop": ""
+  },
   "no_udp": false,
   "dtls_local_port": 0,
   "compression_disabled": false,
@@ -342,6 +346,30 @@ PEM 格式的 TNCC 机器证书路径。
 
 与 `tncc.certificates.certificate` 冲突。
 
+### fortinet_host_check
+
+Fortinet hostcheck 结果覆盖选项。
+
+默认禁用 hostcheck。仅当 `fortinet_host_check.hostcheck` 非空时启用。不会自动收集操作系统、安全产品或网络接口信息。
+
+启用后，如果成功的 Fortinet 登录响应要求 hostcheck，将在使用 VPN 会话前向服务器提交两个配置值。这些值不经修改，作为 `application/x-www-form-urlencoded` 字段发送。
+
+部分 Fortinet 服务器只会要求可识别的 FortiClient User-Agent 执行 hostcheck。服务器策略有要求时请配置 `user_agent`。
+
+### fortinet_host_check.hostcheck
+
+Fortinet hostcheck 结果字符串。
+
+通常格式为 `<security-status>,<os-version>`，例如 `0100,10.0.19042`。`security-status` 包含四个 `0` 或 `1` 字符，依次表示第三方防火墙、第三方杀毒软件、FortiClient 防火墙和 FortiClient 杀毒软件。
+
+空值会禁用 Fortinet hostcheck，即使配置了 `fortinet_host_check.check_virtual_desktop`。
+
+### fortinet_host_check.check_virtual_desktop
+
+Fortinet virtual desktop 检查结果字符串。
+
+FortiClient 通常发送以冒号分隔的 MAC 地址，多个地址使用 `|` 连接，例如 `74:78:27:4d:81:93|84:1b:77:3a:95:84`。启用 hostcheck 时，空值会作为空字段提交。
+
 ### no_udp
 
 禁用 DTLS 或 ESP 辅助数据通道，仅使用 TLS 数据通道。