vpn: New vpn daemon that handles vpn connections and clients

7 files changed, 2425 insertions, 0 deletions

diff --git a/vpn/plugins/l2tp.c b/vpn/plugins/l2tp.c
new file mode 100644
index 00000000..5a11e529
--- /dev/null
+++ b/vpn/plugins/l2tp.c
@@ -0,0 +1,533 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2010  BMW Car IT GmbH. All rights reserved.
+ *  Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include <stdio.h>
+#include <net/if.h>
+
+#include <dbus/dbus.h>
+#include <glib.h>
+
+#define CONNMAN_API_SUBJECT_TO_CHANGE
+#include <connman/plugin.h>
+#include <connman/provider.h>
+#include <connman/log.h>
+#include <connman/task.h>
+#include <connman/dbus.h>
+#include <connman/inet.h>
+
+#include "vpn.h"
+
+#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
+
+enum {
+	OPT_STRING = 1,
+	OPT_BOOL = 2,
+};
+
+enum {
+	OPT_ALL = 1,
+	OPT_L2G = 2,
+	OPT_L2	= 3,
+	OPT_PPPD = 4,
+};
+
+struct {
+	const char *cm_opt;
+	const char *pppd_opt;
+	int sub;
+	const char *vpn_default;
+	int type;
+} pppd_options[] = {
+	{ "L2TP.User", "name", OPT_ALL, NULL, OPT_STRING },
+	{ "L2TP.BPS", "bps", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.LengthBit", "length bit", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.Challenge", "challenge", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.DefaultRoute", "defaultroute", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.FlowBit", "flow bit", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.TunnelRWS", "tunnel rws", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.Exclusive", "exclusive", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.Autodial", "autodial", OPT_L2, "yes", OPT_STRING },
+	{ "L2TP.Redial", "redial", OPT_L2, "yes", OPT_STRING },
+	{ "L2TP.RedialTimeout", "redial timeout", OPT_L2, "10", OPT_STRING },
+	{ "L2TP.MaxRedials", "max redials", OPT_L2, NULL, OPT_STRING },
+	{ "L2TP.RequirePAP", "require pap", OPT_L2, "no", OPT_STRING },
+	{ "L2TP.RequireCHAP", "require chap", OPT_L2, "yes", OPT_STRING },
+	{ "L2TP.ReqAuth", "require authentication", OPT_L2, "no", OPT_STRING },
+	{ "L2TP.AccessControl", "access control", OPT_L2G, "yes", OPT_STRING },
+	{ "L2TP.AuthFile", "auth file", OPT_L2G, NULL, OPT_STRING },
+	{ "L2TP.ForceUserSpace", "force userspace", OPT_L2G, NULL, OPT_STRING },
+	{ "L2TP.ListenAddr", "listen-addr", OPT_L2G, NULL, OPT_STRING },
+	{ "L2TP.Rand Source", "rand source", OPT_L2G, NULL, OPT_STRING },
+	{ "L2TP.IPsecSaref", "ipsec saref", OPT_L2G, NULL, OPT_STRING },
+	{ "L2TP.Port", "port", OPT_L2G, NULL, OPT_STRING },
+	{ "L2TP.EchoFailure", "lcp-echo-failure", OPT_PPPD, "0", OPT_STRING },
+	{ "L2TP.EchoInterval", "lcp-echo-interval", OPT_PPPD, "0", OPT_STRING },
+	{ "L2TP.Debug", "debug", OPT_PPPD, NULL, OPT_STRING },
+	{ "L2TP.RefuseEAP", "refuse-eap", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.RefusePAP", "refuse-pap", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.RefuseCHAP", "refuse-chap", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.RefuseMSCHAP", "refuse-mschap", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.RefuseMSCHAP2", "refuse-mschapv2", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.NoBSDComp", "nobsdcomp", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.NoPcomp", "nopcomp", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.UseAccomp", "accomp", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.NoDeflate", "nodeflatey", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.ReqMPPE", "require-mppe", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.ReqMPPE40", "require-mppe-40", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.ReqMPPE128", "require-mppe-128", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.ReqMPPEStateful", "mppe-stateful", OPT_PPPD, NULL, OPT_BOOL },
+	{ "L2TP.NoVJ", "no-vj-comp", OPT_PPPD, NULL, OPT_BOOL },
+};
+
+static DBusConnection *connection;
+
+static DBusMessage *l2tp_get_sec(struct connman_task *task,
+			DBusMessage *msg, void *user_data)
+{
+	const char *user, *passwd;
+	struct vpn_provider *provider = user_data;
+
+	if (dbus_message_get_no_reply(msg) == FALSE) {
+		DBusMessage *reply;
+
+		user = vpn_provider_get_string(provider, "L2TP.User");
+		passwd = vpn_provider_get_string(provider, "L2TP.Password");
+
+		if (user == NULL || strlen(user) == 0 ||
+				passwd == NULL || strlen(passwd) == 0)
+			return NULL;
+
+		reply = dbus_message_new_method_return(msg);
+		if (reply == NULL)
+			return NULL;
+
+		dbus_message_append_args(reply, DBUS_TYPE_STRING, &user,
+						DBUS_TYPE_STRING, &passwd,
+						DBUS_TYPE_INVALID);
+
+		return reply;
+	}
+
+	return NULL;
+}
+
+static int l2tp_notify(DBusMessage *msg, struct vpn_provider *provider)
+{
+	DBusMessageIter iter, dict;
+	const char *reason, *key, *value;
+	char *addressv4 = NULL, *netmask = NULL, *gateway = NULL;
+	char *ifname = NULL, *nameservers = NULL;
+	struct connman_ipaddress *ipaddress = NULL;
+
+	dbus_message_iter_init(msg, &iter);
+
+	dbus_message_iter_get_basic(&iter, &reason);
+	dbus_message_iter_next(&iter);
+
+	if (!provider) {
+		connman_error("No provider found");
+		return VPN_STATE_FAILURE;
+	}
+
+	if (strcmp(reason, "auth failed") == 0)
+		return VPN_STATE_AUTH_FAILURE;
+
+	if (strcmp(reason, "connect"))
+		return VPN_STATE_DISCONNECT;
+
+	dbus_message_iter_recurse(&iter, &dict);
+
+	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
+		DBusMessageIter entry;
+
+		dbus_message_iter_recurse(&dict, &entry);
+		dbus_message_iter_get_basic(&entry, &key);
+		dbus_message_iter_next(&entry);
+		dbus_message_iter_get_basic(&entry, &value);
+
+		DBG("%s = %s", key, value);
+
+		if (!strcmp(key, "INTERNAL_IP4_ADDRESS")) {
+			vpn_provider_set_string(provider, "Address", value);
+			addressv4 = g_strdup(value);
+		}
+
+		if (!strcmp(key, "INTERNAL_IP4_NETMASK")) {
+			vpn_provider_set_string(provider, "Netmask", value);
+			netmask = g_strdup(value);
+		}
+
+		if (!strcmp(key, "INTERNAL_IP4_DNS")) {
+			vpn_provider_set_string(provider, "DNS", value);
+			nameservers = g_strdup(value);
+		}
+
+		if (!strcmp(key, "INTERNAL_IFNAME"))
+			ifname = g_strdup(value);
+
+		dbus_message_iter_next(&dict);
+	}
+
+	if (vpn_set_ifname(provider, ifname) < 0) {
+		g_free(ifname);
+		g_free(addressv4);
+		g_free(netmask);
+		g_free(nameservers);
+		return VPN_STATE_FAILURE;
+	}
+
+	if (addressv4 != NULL)
+		ipaddress = connman_ipaddress_alloc(AF_INET);
+
+	g_free(ifname);
+
+	if (ipaddress == NULL) {
+		connman_error("No IP address for provider");
+		g_free(addressv4);
+		g_free(netmask);
+		g_free(nameservers);
+		return VPN_STATE_FAILURE;
+	}
+
+	value = vpn_provider_get_string(provider, "HostIP");
+	if (value != NULL) {
+		vpn_provider_set_string(provider, "Gateway", value);
+		gateway = g_strdup(value);
+	}
+
+	if (addressv4 != NULL)
+		connman_ipaddress_set_ipv4(ipaddress, addressv4, netmask,
+					gateway);
+
+	vpn_provider_set_ipaddress(provider, ipaddress);
+	vpn_provider_set_nameservers(provider, nameservers);
+
+	g_free(addressv4);
+	g_free(netmask);
+	g_free(gateway);
+	g_free(nameservers);
+	connman_ipaddress_free(ipaddress);
+
+	return VPN_STATE_CONNECT;
+}
+
+static int l2tp_save(struct vpn_provider *provider, GKeyFile *keyfile)
+{
+	const char *option;
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(pppd_options); i++) {
+		if (strncmp(pppd_options[i].cm_opt, "L2TP.", 5) == 0) {
+			option = vpn_provider_get_string(provider,
+							pppd_options[i].cm_opt);
+			if (option == NULL)
+				continue;
+
+			g_key_file_set_string(keyfile,
+					vpn_provider_get_save_group(provider),
+					pppd_options[i].cm_opt, option);
+		}
+	}
+	return 0;
+}
+
+static ssize_t full_write(int fd, const void *buf, size_t len)
+{
+	ssize_t byte_write;
+
+	while (len) {
+		byte_write = write(fd, buf, len);
+		if (byte_write < 0) {
+			connman_error("failed to write config to l2tp: %s\n",
+					strerror(errno));
+			return byte_write;
+		}
+		len -= byte_write;
+		buf += byte_write;
+	}
+
+	return 0;
+}
+
+static ssize_t l2tp_write_bool_option(int fd,
+					const char *key, const char *value)
+{
+	gchar *buf;
+	ssize_t ret = 0;
+
+	if (key != NULL && value != NULL) {
+		if (strcasecmp(value, "yes") == 0 ||
+				strcasecmp(value, "true") == 0 ||
+				strcmp(value, "1") == 0) {
+			buf = g_strdup_printf("%s\n", key);
+			ret = full_write(fd, buf, strlen(buf));
+
+			g_free(buf);
+		}
+	}
+
+	return ret;
+}
+
+static int l2tp_write_option(int fd, const char *key, const char *value)
+{
+	gchar *buf;
+	ssize_t ret = 0;
+
+	if (key != NULL) {
+		if (value != NULL)
+			buf = g_strdup_printf("%s %s\n", key, value);
+		else
+			buf = g_strdup_printf("%s\n", key);
+
+		ret = full_write(fd, buf, strlen(buf));
+
+		g_free(buf);
+	}
+
+	return ret;
+}
+
+static int l2tp_write_section(int fd, const char *key, const char *value)
+{
+	gchar *buf;
+	ssize_t ret = 0;
+
+	if (key != NULL && value != NULL) {
+		buf = g_strdup_printf("%s = %s\n", key, value);
+		ret = full_write(fd, buf, strlen(buf));
+
+		g_free(buf);
+	}
+
+	return ret;
+}
+
+static int write_pppd_option(struct vpn_provider *provider, int fd)
+{
+	int i;
+	const char *opt_s;
+
+	l2tp_write_option(fd, "nodetach", NULL);
+	l2tp_write_option(fd, "lock", NULL);
+	l2tp_write_option(fd, "usepeerdns", NULL);
+	l2tp_write_option(fd, "noipdefault", NULL);
+	l2tp_write_option(fd, "noauth", NULL);
+	l2tp_write_option(fd, "nodefaultroute", NULL);
+	l2tp_write_option(fd, "ipparam", "l2tp_plugin");
+
+	for (i = 0; i < (int)ARRAY_SIZE(pppd_options); i++) {
+		if (pppd_options[i].sub != OPT_ALL &&
+			pppd_options[i].sub != OPT_PPPD)
+			continue;
+
+		opt_s = vpn_provider_get_string(provider,
+					pppd_options[i].cm_opt);
+		if (!opt_s)
+			opt_s = pppd_options[i].vpn_default;
+
+		if (!opt_s)
+			continue;
+
+		if (pppd_options[i].type == OPT_STRING)
+			l2tp_write_option(fd,
+				pppd_options[i].pppd_opt, opt_s);
+		else if (pppd_options[i].type == OPT_BOOL)
+			l2tp_write_bool_option(fd,
+				pppd_options[i].pppd_opt, opt_s);
+	}
+
+	l2tp_write_option(fd, "plugin",
+				SCRIPTDIR "/libppp-plugin.so");
+
+	return 0;
+}
+
+
+static int l2tp_write_fields(struct vpn_provider *provider,
+						int fd, int sub)
+{
+	int i;
+	const char *opt_s;
+
+	for (i = 0; i < (int)ARRAY_SIZE(pppd_options); i++) {
+		if (pppd_options[i].sub != sub)
+			continue;
+
+		opt_s = vpn_provider_get_string(provider,
+					pppd_options[i].cm_opt);
+		if (!opt_s)
+			opt_s = pppd_options[i].vpn_default;
+
+		if (!opt_s)
+			continue;
+
+		if (pppd_options[i].type == OPT_STRING)
+			l2tp_write_section(fd,
+				pppd_options[i].pppd_opt, opt_s);
+		else if (pppd_options[i].type == OPT_BOOL)
+			l2tp_write_bool_option(fd,
+				pppd_options[i].pppd_opt, opt_s);
+	}
+
+	return 0;
+}
+
+static int l2tp_write_config(struct vpn_provider *provider,
+					const char *pppd_name, int fd)
+{
+	const char *option;
+
+	l2tp_write_option(fd, "[global]", NULL);
+	l2tp_write_fields(provider, fd, OPT_L2G);
+
+	l2tp_write_option(fd, "[lac l2tp]", NULL);
+
+	option = vpn_provider_get_string(provider, "Host");
+	l2tp_write_option(fd, "lns =", option);
+
+	l2tp_write_fields(provider, fd, OPT_ALL);
+	l2tp_write_fields(provider, fd, OPT_L2);
+
+	l2tp_write_option(fd, "pppoptfile =", pppd_name);
+
+	return 0;
+}
+
+static void l2tp_died(struct connman_task *task, int exit_code, void *user_data)
+{
+	char *conf_file;
+
+	vpn_died(task, exit_code, user_data);
+
+	conf_file = g_strdup_printf("/var/run/connman/connman-xl2tpd.conf");
+	unlink(conf_file);
+	g_free(conf_file);
+
+	conf_file = g_strdup_printf("/var/run/connman/connman-ppp-option.conf");
+	unlink(conf_file);
+	g_free(conf_file);
+}
+
+static int l2tp_connect(struct vpn_provider *provider,
+		struct connman_task *task, const char *if_name)
+{
+	const char *host;
+	char *l2tp_name, *pppd_name;
+	int l2tp_fd, pppd_fd;
+	int err;
+
+	if (connman_task_set_notify(task, "getsec",
+					l2tp_get_sec, provider))
+		return -ENOMEM;
+
+	host = vpn_provider_get_string(provider, "Host");
+	if (host == NULL) {
+		connman_error("Host not set; cannot enable VPN");
+		return -EINVAL;
+	}
+
+	l2tp_name = g_strdup_printf("/var/run/connman/connman-xl2tpd.conf");
+
+	l2tp_fd = open(l2tp_name, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
+	if (l2tp_fd < 0) {
+		g_free(l2tp_name);
+		connman_error("Error writing l2tp config");
+		return -EIO;
+	}
+
+	pppd_name = g_strdup_printf("/var/run/connman/connman-ppp-option.conf");
+
+	pppd_fd = open(pppd_name, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
+	if (pppd_fd < 0) {
+		connman_error("Error writing pppd config");
+		g_free(l2tp_name);
+		g_free(pppd_name);
+		close(l2tp_fd);
+		return -EIO;
+	}
+
+	l2tp_write_config(provider, pppd_name, l2tp_fd);
+
+	write_pppd_option(provider, pppd_fd);
+
+	connman_task_add_argument(task, "-D", NULL);
+	connman_task_add_argument(task, "-c", l2tp_name);
+
+	g_free(l2tp_name);
+	g_free(pppd_name);
+
+	err = connman_task_run(task, l2tp_died, provider,
+				NULL, NULL, NULL);
+	if (err < 0) {
+		connman_error("l2tp failed to start");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int l2tp_error_code(int exit_code)
+{
+	switch (exit_code) {
+	case 1:
+		return CONNMAN_PROVIDER_ERROR_CONNECT_FAILED;
+	default:
+		return CONNMAN_PROVIDER_ERROR_UNKNOWN;
+	}
+}
+
+static struct vpn_driver vpn_driver = {
+	.flags		= VPN_FLAG_NO_TUN,
+	.notify		= l2tp_notify,
+	.connect	= l2tp_connect,
+	.error_code	= l2tp_error_code,
+	.save		= l2tp_save,
+};
+
+static int l2tp_init(void)
+{
+	connection = connman_dbus_get_connection();
+
+	return vpn_register("l2tp", &vpn_driver, L2TP);
+}
+
+static void l2tp_exit(void)
+{
+	vpn_unregister("l2tp");
+
+	dbus_connection_unref(connection);
+}
+
+CONNMAN_PLUGIN_DEFINE(l2tp, "l2tp plugin", VERSION,
+	CONNMAN_PLUGIN_PRIORITY_DEFAULT, l2tp_init, l2tp_exit)
diff --git a/vpn/plugins/openconnect.c b/vpn/plugins/openconnect.c
new file mode 100644
index 00000000..0f54108c
--- /dev/null
+++ b/vpn/plugins/openconnect.c
@@ -0,0 +1,282 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2007-2012  Intel Corporation. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <net/if.h>
+
+#include <glib.h>
+
+#define CONNMAN_API_SUBJECT_TO_CHANGE
+#include <connman/plugin.h>
+#include <connman/log.h>
+#include <connman/task.h>
+#include <connman/ipconfig.h>
+
+#include "../vpn-provider.h"
+
+#include "vpn.h"
+
+static int oc_notify(DBusMessage *msg, struct vpn_provider *provider)
+{
+	DBusMessageIter iter, dict;
+	const char *reason, *key, *value;
+	const char *domain = NULL;
+	char *addressv4 = NULL, *addressv6 = NULL;
+	char *netmask = NULL, *gateway = NULL;
+	unsigned char prefix_len = 0;
+	struct connman_ipaddress *ipaddress;
+
+	dbus_message_iter_init(msg, &iter);
+
+	dbus_message_iter_get_basic(&iter, &reason);
+	dbus_message_iter_next(&iter);
+
+	if (!provider) {
+		connman_error("No provider found");
+		return VPN_STATE_FAILURE;
+	}
+
+	if (strcmp(reason, "connect"))
+		return VPN_STATE_DISCONNECT;
+
+	domain = vpn_provider_get_string(provider, "VPN.Domain");
+
+	dbus_message_iter_recurse(&iter, &dict);
+
+	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
+		DBusMessageIter entry;
+
+		dbus_message_iter_recurse(&dict, &entry);
+		dbus_message_iter_get_basic(&entry, &key);
+		dbus_message_iter_next(&entry);
+		dbus_message_iter_get_basic(&entry, &value);
+
+		if (strcmp(key, "CISCO_CSTP_OPTIONS"))
+			DBG("%s = %s", key, value);
+
+		if (!strcmp(key, "VPNGATEWAY"))
+			gateway = g_strdup(value);
+
+		if (!strcmp(key, "INTERNAL_IP4_ADDRESS"))
+			addressv4 = g_strdup(value);
+
+		if (!strcmp(key, "INTERNAL_IP6_ADDRESS")) {
+			addressv6 = g_strdup(value);
+			prefix_len = 128;
+		}
+
+		if (!strcmp(key, "INTERNAL_IP4_NETMASK"))
+			netmask = g_strdup(value);
+
+		if (!strcmp(key, "INTERNAL_IP6_NETMASK")) {
+			char *sep;
+
+			/* The netmask contains the address and the prefix */
+			sep = strchr(value, '/');
+			if (sep != NULL) {
+				unsigned char ip_len = sep - value;
+
+				addressv6 = g_strndup(value, ip_len);
+				prefix_len = (unsigned char)
+						strtol(sep + 1, NULL, 10);
+			}
+		}
+
+		if (!strcmp(key, "INTERNAL_IP4_DNS") ||
+				!strcmp(key, "INTERNAL_IP6_DNS"))
+			vpn_provider_set_nameservers(provider, value);
+
+		if (!strcmp(key, "CISCO_PROXY_PAC"))
+			vpn_provider_set_pac(provider, value);
+
+		if (domain == NULL && !strcmp(key, "CISCO_DEF_DOMAIN"))
+			domain = value;
+
+		if (g_str_has_prefix(key, "CISCO_SPLIT_INC") == TRUE ||
+			g_str_has_prefix(key, "CISCO_IPV6_SPLIT_INC") == TRUE)
+			vpn_provider_append_route(provider, key, value);
+
+		dbus_message_iter_next(&dict);
+	}
+
+	DBG("%p %p", addressv4, addressv6);
+
+	if (addressv4 != NULL)
+		ipaddress = connman_ipaddress_alloc(AF_INET);
+	else if (addressv6 != NULL)
+		ipaddress = connman_ipaddress_alloc(AF_INET6);
+	else
+		ipaddress = NULL;
+
+	if (ipaddress == NULL) {
+		g_free(addressv4);
+		g_free(addressv6);
+		g_free(netmask);
+		g_free(gateway);
+
+		return VPN_STATE_FAILURE;
+	}
+
+	if (addressv4 != NULL)
+		connman_ipaddress_set_ipv4(ipaddress, addressv4,
+						netmask, gateway);
+	else
+		connman_ipaddress_set_ipv6(ipaddress, addressv6,
+						prefix_len, gateway);
+	vpn_provider_set_ipaddress(provider, ipaddress);
+	vpn_provider_set_domain(provider, domain);
+
+	g_free(addressv4);
+	g_free(addressv6);
+	g_free(netmask);
+	g_free(gateway);
+	connman_ipaddress_free(ipaddress);
+
+	return VPN_STATE_CONNECT;
+}
+
+static int oc_connect(struct vpn_provider *provider,
+			struct connman_task *task, const char *if_name)
+{
+	const char *vpnhost, *vpncookie, *cafile, *certsha1, *mtu;
+	int fd, err;
+
+	vpnhost = vpn_provider_get_string(provider, "Host");
+	if (!vpnhost) {
+		connman_error("Host not set; cannot enable VPN");
+		return -EINVAL;
+	}
+
+	vpncookie = vpn_provider_get_string(provider, "OpenConnect.Cookie");
+	if (!vpncookie) {
+		connman_error("OpenConnect.Cookie not set; cannot enable VPN");
+		return -EINVAL;
+	}
+
+	certsha1 = vpn_provider_get_string(provider,
+						"OpenConnect.ServerCert");
+	if (certsha1)
+		connman_task_add_argument(task, "--servercert",
+							(char *)certsha1);
+
+	cafile = vpn_provider_get_string(provider, "OpenConnect.CACert");
+	mtu = vpn_provider_get_string(provider, "VPN.MTU");
+
+	if (cafile)
+		connman_task_add_argument(task, "--cafile",
+							(char *)cafile);
+	if (mtu)
+		connman_task_add_argument(task, "--mtu", (char *)mtu);
+
+	connman_task_add_argument(task, "--syslog", NULL);
+	connman_task_add_argument(task, "--cookie-on-stdin", NULL);
+
+	connman_task_add_argument(task, "--script",
+				  SCRIPTDIR "/openconnect-script");
+
+	connman_task_add_argument(task, "--interface", if_name);
+
+	connman_task_add_argument(task, (char *)vpnhost, NULL);
+
+	err = connman_task_run(task, vpn_died, provider,
+			       &fd, NULL, NULL);
+	if (err < 0) {
+		connman_error("openconnect failed to start");
+		return -EIO;
+	}
+
+	if (write(fd, vpncookie, strlen(vpncookie)) !=
+			(ssize_t)strlen(vpncookie) ||
+			write(fd, "\n", 1) != 1) {
+		connman_error("openconnect failed to take cookie on stdin");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int oc_save(struct vpn_provider *provider, GKeyFile *keyfile)
+{
+	const char *setting;
+
+	setting = vpn_provider_get_string(provider,
+					"OpenConnect.ServerCert");
+	if (setting != NULL)
+		g_key_file_set_string(keyfile,
+				vpn_provider_get_save_group(provider),
+				"OpenConnect.ServerCert", setting);
+
+	setting = vpn_provider_get_string(provider,
+					"OpenConnect.CACert");
+	if (setting != NULL)
+		g_key_file_set_string(keyfile,
+				vpn_provider_get_save_group(provider),
+				"OpenConnect.CACert", setting);
+
+	setting = vpn_provider_get_string(provider,
+					"VPN.MTU");
+	if (setting != NULL)
+		g_key_file_set_string(keyfile,
+				vpn_provider_get_save_group(provider),
+				"VPN.MTU", setting);
+
+	return 0;
+}
+
+static int oc_error_code(int exit_code)
+{
+
+	switch (exit_code) {
+	case 1:
+		return VPN_PROVIDER_ERROR_CONNECT_FAILED;
+	case 2:
+		return VPN_PROVIDER_ERROR_LOGIN_FAILED;
+	default:
+		return VPN_PROVIDER_ERROR_UNKNOWN;
+	}
+}
+
+static struct vpn_driver vpn_driver = {
+	.notify         = oc_notify,
+	.connect	= oc_connect,
+	.error_code	= oc_error_code,
+	.save		= oc_save,
+};
+
+static int openconnect_init(void)
+{
+	return vpn_register("openconnect", &vpn_driver, OPENCONNECT);
+}
+
+static void openconnect_exit(void)
+{
+	vpn_unregister("openconnect");
+}
+
+CONNMAN_PLUGIN_DEFINE(openconnect, "OpenConnect VPN plugin", VERSION,
+	CONNMAN_PLUGIN_PRIORITY_DEFAULT, openconnect_init, openconnect_exit)
diff --git a/vpn/plugins/openvpn.c b/vpn/plugins/openvpn.c
new file mode 100644
index 00000000..dd654156
--- /dev/null
+++ b/vpn/plugins/openvpn.c
@@ -0,0 +1,328 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2010  BMW Car IT GmbH. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <net/if.h>
+
+#include <glib.h>
+
+#define CONNMAN_API_SUBJECT_TO_CHANGE
+#include <connman/plugin.h>
+#include <connman/log.h>
+#include <connman/task.h>
+#include <connman/dbus.h>
+#include <connman/ipconfig.h>
+
+#include "../vpn-provider.h"
+
+#include "vpn.h"
+
+#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
+
+static DBusConnection *connection;
+
+struct {
+	const char *cm_opt;
+	const char *ov_opt;
+	char       has_value;
+} ov_options[] = {
+	{ "Host", "--remote", 1 },
+	{ "OpenVPN.CACert", "--ca", 1 },
+	{ "OpenVPN.Cert", "--cert", 1 },
+	{ "OpenVPN.Key", "--key", 1 },
+	{ "OpenVPN.MTU", "--mtu", 1 },
+	{ "OpenVPN.NSCertType", "--ns-cert-type", 1 },
+	{ "OpenVPN.Proto", "--proto", 1 },
+	{ "OpenVPN.Port", "--port", 1 },
+	{ "OpenVPN.AuthUserPass", "--auth-user-pass", 1 },
+	{ "OpenVPN.AskPass", "--askpass", 1 },
+	{ "OpenVPN.AuthNoCache", "--auth-nocache", 0 },
+	{ "OpenVPN.TLSRemote", "--tls-remote", 1 },
+	{ "OpenVPN.TLSAuth", NULL, 1 },
+	{ "OpenVPN.TLSAuthDir", NULL, 1 },
+	{ "OpenVPN.Cipher", "--cipher", 1 },
+	{ "OpenVPN.Auth", "--auth", 1 },
+	{ "OpenVPN.CompLZO", "--comp-lzo", 0 },
+	{ "OpenVPN.RemoteCertTls", "--remote-cert-tls", 1 },
+};
+
+static void ov_append_dns_entries(const char *key, const char *value,
+					char **dns_entries)
+{
+	gchar **options;
+
+	if (g_str_has_prefix(key, "foreign_option_") == FALSE)
+		return;
+
+	options = g_strsplit(value, " ", 3);
+	if (options[0] != NULL &&
+		!strcmp(options[0], "dhcp-option") &&
+			options[1] != NULL &&
+			!strcmp(options[1], "DNS") &&
+				options[2] != NULL) {
+
+		if (*dns_entries != NULL) {
+			char *tmp;
+
+			tmp = g_strjoin(" ", *dns_entries,
+						options[2], NULL);
+			g_free(*dns_entries);
+			*dns_entries = tmp;
+		} else {
+			*dns_entries = g_strdup(options[2]);
+		}
+	}
+
+	g_strfreev(options);
+}
+
+static int ov_notify(DBusMessage *msg, struct vpn_provider *provider)
+{
+	DBusMessageIter iter, dict;
+	const char *reason, *key, *value;
+	char *nameservers = NULL;
+	char *address = NULL, *gateway = NULL, *peer = NULL;
+	struct connman_ipaddress *ipaddress;
+
+	dbus_message_iter_init(msg, &iter);
+
+	dbus_message_iter_get_basic(&iter, &reason);
+	dbus_message_iter_next(&iter);
+
+	if (!provider) {
+		connman_error("No provider found");
+		return VPN_STATE_FAILURE;
+	}
+
+	if (strcmp(reason, "up"))
+		return VPN_STATE_DISCONNECT;
+
+	dbus_message_iter_recurse(&iter, &dict);
+
+	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
+		DBusMessageIter entry;
+
+		dbus_message_iter_recurse(&dict, &entry);
+		dbus_message_iter_get_basic(&entry, &key);
+		dbus_message_iter_next(&entry);
+		dbus_message_iter_get_basic(&entry, &value);
+
+		DBG("%s = %s", key, value);
+
+		if (!strcmp(key, "trusted_ip")) {
+			vpn_provider_set_string(provider, "Gateway", value);
+			gateway = g_strdup(value);
+		}
+
+		if (!strcmp(key, "ifconfig_local")) {
+			vpn_provider_set_string(provider, "Address", value);
+			address = g_strdup(value);
+		}
+
+		if (!strcmp(key, "ifconfig_remote")) {
+			vpn_provider_set_string(provider, "Peer", value);
+			peer = g_strdup(value);
+		}
+
+		if (g_str_has_prefix(key, "route_") == TRUE)
+			vpn_provider_append_route(provider, key, value);
+
+		ov_append_dns_entries(key, value, &nameservers);
+
+		dbus_message_iter_next(&dict);
+	}
+
+	ipaddress = connman_ipaddress_alloc(AF_INET);
+	if (ipaddress == NULL) {
+		g_free(nameservers);
+		g_free(address);
+		g_free(gateway);
+		g_free(peer);
+
+		return VPN_STATE_FAILURE;
+	}
+
+	connman_ipaddress_set_ipv4(ipaddress, address, NULL, gateway);
+	connman_ipaddress_set_peer(ipaddress, peer);
+	vpn_provider_set_ipaddress(provider, ipaddress);
+
+	vpn_provider_set_nameservers(provider, nameservers);
+
+	g_free(nameservers);
+	g_free(address);
+	g_free(gateway);
+	g_free(peer);
+	connman_ipaddress_free(ipaddress);
+
+	return VPN_STATE_CONNECT;
+}
+
+static int ov_save(struct vpn_provider *provider, GKeyFile *keyfile)
+{
+	const char *option;
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
+		if (strncmp(ov_options[i].cm_opt, "OpenVPN.", 8) == 0) {
+			option = vpn_provider_get_string(provider,
+							ov_options[i].cm_opt);
+			if (option == NULL)
+				continue;
+
+			g_key_file_set_string(keyfile,
+					vpn_provider_get_save_group(provider),
+					ov_options[i].cm_opt, option);
+		}
+	}
+	return 0;
+}
+
+static int task_append_config_data(struct vpn_provider *provider,
+					struct connman_task *task)
+{
+	const char *option;
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
+		if (ov_options[i].ov_opt == NULL)
+			continue;
+
+		option = vpn_provider_get_string(provider,
+					ov_options[i].cm_opt);
+		if (option == NULL)
+			continue;
+
+		if (connman_task_add_argument(task,
+				ov_options[i].ov_opt,
+				ov_options[i].has_value ? option : NULL) < 0) {
+			return -EIO;
+		}
+	}
+
+	return 0;
+}
+
+static int ov_connect(struct vpn_provider *provider,
+		struct connman_task *task, const char *if_name)
+{
+	const char *option;
+	int err, fd;
+
+	option = vpn_provider_get_string(provider, "Host");
+	if (option == NULL) {
+		connman_error("Host not set; cannot enable VPN");
+		return -EINVAL;
+	}
+
+	task_append_config_data(provider, task);
+
+	option = vpn_provider_get_string(provider, "OpenVPN.TLSAuth");
+	if (option != NULL) {
+		connman_task_add_argument(task, "--tls-auth", option);
+		option = vpn_provider_get_string(provider,
+				"OpenVPN.TLSAuthDir");
+		if (option != NULL)
+			connman_task_add_argument(task, option, NULL);
+	}
+
+	connman_task_add_argument(task, "--syslog", NULL);
+
+	connman_task_add_argument(task, "--script-security", "2");
+
+	connman_task_add_argument(task, "--up",
+					SCRIPTDIR "/openvpn-script");
+	connman_task_add_argument(task, "--up-restart", NULL);
+
+	connman_task_add_argument(task, "--setenv", NULL);
+	connman_task_add_argument(task, "CONNMAN_BUSNAME",
+					dbus_bus_get_unique_name(connection));
+
+	connman_task_add_argument(task, "--setenv", NULL);
+	connman_task_add_argument(task, "CONNMAN_INTERFACE",
+					CONNMAN_TASK_INTERFACE);
+
+	connman_task_add_argument(task, "--setenv", NULL);
+	connman_task_add_argument(task, "CONNMAN_PATH",
+					connman_task_get_path(task));
+
+	connman_task_add_argument(task, "--dev", if_name);
+	connman_task_add_argument(task, "--dev-type", "tun");
+
+	connman_task_add_argument(task, "--tls-client", NULL);
+	connman_task_add_argument(task, "--nobind", NULL);
+	connman_task_add_argument(task, "--persist-key", NULL);
+	connman_task_add_argument(task, "--persist-tun", NULL);
+
+	connman_task_add_argument(task, "--route-noexec", NULL);
+	connman_task_add_argument(task, "--ifconfig-noexec", NULL);
+
+	/*
+	 * Disable client restarts because we can't handle this at the
+	 * moment. The problem is that when OpenVPN decides to switch
+	 * from CONNECTED state to RECONNECTING and then to RESOLVE,
+	 * it is not possible to do a DNS lookup. The DNS server is
+	 * not accessable through the tunnel anymore and so we end up
+	 * trying to resolve the OpenVPN servers address.
+	 */
+	connman_task_add_argument(task, "--ping-restart", "0");
+
+	connman_task_add_argument(task, "--client", NULL);
+
+	fd = fileno(stderr);
+	err = connman_task_run(task, vpn_died, provider,
+			NULL, &fd, &fd);
+	if (err < 0) {
+		connman_error("openvpn failed to start");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static struct vpn_driver vpn_driver = {
+	.notify	= ov_notify,
+	.connect	= ov_connect,
+	.save		= ov_save,
+};
+
+static int openvpn_init(void)
+{
+	connection = connman_dbus_get_connection();
+
+	return vpn_register("openvpn", &vpn_driver, OPENVPN);
+}
+
+static void openvpn_exit(void)
+{
+	vpn_unregister("openvpn");
+
+	dbus_connection_unref(connection);
+}
+
+CONNMAN_PLUGIN_DEFINE(openvpn, "OpenVPN plugin", VERSION,
+	CONNMAN_PLUGIN_PRIORITY_DEFAULT, openvpn_init, openvpn_exit)
diff --git a/vpn/plugins/pptp.c b/vpn/plugins/pptp.c
new file mode 100644
index 00000000..f737c316
--- /dev/null
+++ b/vpn/plugins/pptp.c
@@ -0,0 +1,339 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2010  BMW Car IT GmbH. All rights reserved.
+ *  Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <net/if.h>
+
+#include <dbus/dbus.h>
+#include <glib.h>
+
+#define CONNMAN_API_SUBJECT_TO_CHANGE
+#include <connman/plugin.h>
+#include <connman/provider.h>
+#include <connman/log.h>
+#include <connman/task.h>
+#include <connman/dbus.h>
+#include <connman/inet.h>
+
+#include "vpn.h"
+
+#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
+
+enum {
+	OPT_STRING = 1,
+	OPT_BOOL = 2,
+};
+
+struct {
+	const char *cm_opt;
+	const char *pptp_opt;
+	const char *vpnc_default;
+	int type;
+} pptp_options[] = {
+	{ "PPTP.User", "user", NULL, OPT_STRING },
+	{ "PPTP.EchoFailure", "lcp-echo-failure", "0", OPT_STRING },
+	{ "PPTP.EchoInterval", "lcp-echo-interval", "0", OPT_STRING },
+	{ "PPTP.Debug", "debug", NULL, OPT_STRING },
+	{ "PPTP.RefuseEAP", "refuse-eap", NULL, OPT_BOOL },
+	{ "PPTP.RefusePAP", "refuse-pap", NULL, OPT_BOOL },
+	{ "PPTP.RefuseCHAP", "refuse-chap", NULL, OPT_BOOL },
+	{ "PPTP.RefuseMSCHAP", "refuse-mschap", NULL, OPT_BOOL },
+	{ "PPTP.RefuseMSCHAP2", "refuse-mschapv2", NULL, OPT_BOOL },
+	{ "PPTP.NoBSDComp", "nobsdcomp", NULL, OPT_BOOL },
+	{ "PPTP.NoDeflate", "nodeflate", NULL, OPT_BOOL },
+	{ "PPTP.RequirMPPE", "require-mppe", NULL, OPT_BOOL },
+	{ "PPTP.RequirMPPE40", "require-mppe-40", NULL, OPT_BOOL },
+	{ "PPTP.RequirMPPE128", "require-mppe-128", NULL, OPT_BOOL },
+	{ "PPTP.RequirMPPEStateful", "mppe-stateful", NULL, OPT_BOOL },
+	{ "PPTP.NoVJ", "no-vj-comp", NULL, OPT_BOOL },
+};
+
+static DBusConnection *connection;
+
+static DBusMessage *pptp_get_sec(struct connman_task *task,
+				DBusMessage *msg, void *user_data)
+{
+	const char *user, *passwd;
+	struct vpn_provider *provider = user_data;
+	DBusMessage *reply;
+
+	if (dbus_message_get_no_reply(msg) == TRUE)
+		return NULL;
+
+	user = vpn_provider_get_string(provider, "PPTP.User");
+	passwd = vpn_provider_get_string(provider, "PPTP.Password");
+	if (user == NULL || strlen(user) == 0 ||
+				passwd == NULL || strlen(passwd) == 0)
+		return NULL;
+
+	reply = dbus_message_new_method_return(msg);
+	if (reply == NULL)
+		return NULL;
+
+	dbus_message_append_args(reply, DBUS_TYPE_STRING, &user,
+				DBUS_TYPE_STRING, &passwd,
+				DBUS_TYPE_INVALID);
+	return reply;
+}
+
+static int pptp_notify(DBusMessage *msg, struct vpn_provider *provider)
+{
+	DBusMessageIter iter, dict;
+	const char *reason, *key, *value;
+	char *addressv4 = NULL, *netmask = NULL, *gateway = NULL;
+	char *ifname = NULL, *nameservers = NULL;
+	struct connman_ipaddress *ipaddress = NULL;
+
+	dbus_message_iter_init(msg, &iter);
+
+	dbus_message_iter_get_basic(&iter, &reason);
+	dbus_message_iter_next(&iter);
+
+	if (provider == NULL) {
+		connman_error("No provider found");
+		return VPN_STATE_FAILURE;
+	}
+
+	if (strcmp(reason, "auth failed") == 0)
+		return VPN_STATE_AUTH_FAILURE;
+
+	if (strcmp(reason, "connect"))
+		return VPN_STATE_DISCONNECT;
+
+	dbus_message_iter_recurse(&iter, &dict);
+
+	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
+		DBusMessageIter entry;
+
+		dbus_message_iter_recurse(&dict, &entry);
+		dbus_message_iter_get_basic(&entry, &key);
+		dbus_message_iter_next(&entry);
+		dbus_message_iter_get_basic(&entry, &value);
+
+		DBG("%s = %s", key, value);
+
+		if (!strcmp(key, "INTERNAL_IP4_ADDRESS")) {
+			vpn_provider_set_string(provider, "Address", value);
+			addressv4 = g_strdup(value);
+		}
+
+		if (!strcmp(key, "INTERNAL_IP4_NETMASK")) {
+			vpn_provider_set_string(provider, "Netmask", value);
+			netmask = g_strdup(value);
+		}
+
+		if (!strcmp(key, "INTERNAL_IP4_DNS")) {
+			vpn_provider_set_string(provider, "DNS", value);
+			nameservers = g_strdup(value);
+		}
+
+		if (!strcmp(key, "INTERNAL_IFNAME"))
+			ifname = g_strdup(value);
+
+		dbus_message_iter_next(&dict);
+	}
+
+	if (vpn_set_ifname(provider, ifname) < 0) {
+		g_free(ifname);
+		g_free(addressv4);
+		g_free(netmask);
+		g_free(nameservers);
+		return VPN_STATE_FAILURE;
+	}
+
+	if (addressv4 != NULL)
+		ipaddress = connman_ipaddress_alloc(AF_INET);
+
+	g_free(ifname);
+
+	if (ipaddress == NULL) {
+		connman_error("No IP address for provider");
+		g_free(addressv4);
+		g_free(netmask);
+		g_free(nameservers);
+		return VPN_STATE_FAILURE;
+	}
+
+	value = vpn_provider_get_string(provider, "HostIP");
+	if (value != NULL) {
+		vpn_provider_set_string(provider, "Gateway", value);
+		gateway = g_strdup(value);
+	}
+
+	if (addressv4 != NULL)
+		connman_ipaddress_set_ipv4(ipaddress, addressv4, netmask,
+					gateway);
+
+	vpn_provider_set_ipaddress(provider, ipaddress);
+	vpn_provider_set_nameservers(provider, nameservers);
+
+	g_free(addressv4);
+	g_free(netmask);
+	g_free(gateway);
+	g_free(nameservers);
+	connman_ipaddress_free(ipaddress);
+
+	return VPN_STATE_CONNECT;
+}
+
+static int pptp_save(struct vpn_provider *provider, GKeyFile *keyfile)
+{
+	const char *option;
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(pptp_options); i++) {
+		if (strncmp(pptp_options[i].cm_opt, "PPTP.", 5) == 0) {
+			option = vpn_provider_get_string(provider,
+							pptp_options[i].cm_opt);
+			if (option == NULL)
+				continue;
+
+			g_key_file_set_string(keyfile,
+					vpn_provider_get_save_group(provider),
+					pptp_options[i].cm_opt, option);
+		}
+	}
+	return 0;
+}
+
+static void pptp_write_bool_option(struct connman_task *task,
+				const char *key, const char *value)
+{
+	if (key != NULL && value != NULL) {
+		if (strcasecmp(value, "yes") == 0 ||
+				strcasecmp(value, "true") == 0 ||
+				strcmp(value, "1") == 0)
+			connman_task_add_argument(task, key, NULL);
+	}
+}
+
+static int pptp_connect(struct vpn_provider *provider,
+		struct connman_task *task, const char *if_name)
+{
+	const char *opt_s, *host;
+	char *str;
+	int err, i;
+
+	if (connman_task_set_notify(task, "getsec",
+					pptp_get_sec, provider))
+		return -ENOMEM;
+
+	host = vpn_provider_get_string(provider, "Host");
+	if (host == NULL) {
+		connman_error("Host not set; cannot enable VPN");
+		return -EINVAL;
+	}
+
+	str = g_strdup_printf("%s %s --nolaunchpppd --loglevel 2",
+				PPTP, host);
+	if (str == NULL) {
+		connman_error("can not allocate memory");
+		return -ENOMEM;
+	}
+
+	connman_task_add_argument(task, "pty", str);
+	g_free(str);
+
+	connman_task_add_argument(task, "nodetach", NULL);
+	connman_task_add_argument(task, "lock", NULL);
+	connman_task_add_argument(task, "usepeerdns", NULL);
+	connman_task_add_argument(task, "noipdefault", NULL);
+	connman_task_add_argument(task, "noauth", NULL);
+	connman_task_add_argument(task, "nodefaultroute", NULL);
+	connman_task_add_argument(task, "ipparam", "pptp_plugin");
+
+	for (i = 0; i < (int)ARRAY_SIZE(pptp_options); i++) {
+		opt_s = vpn_provider_get_string(provider,
+					pptp_options[i].cm_opt);
+		if (opt_s == NULL)
+			opt_s = pptp_options[i].vpnc_default;
+
+		if (opt_s == NULL)
+			continue;
+
+		if (pptp_options[i].type == OPT_STRING)
+			connman_task_add_argument(task,
+					pptp_options[i].pptp_opt, opt_s);
+		else if (pptp_options[i].type == OPT_BOOL)
+			pptp_write_bool_option(task,
+					pptp_options[i].pptp_opt, opt_s);
+	}
+
+	connman_task_add_argument(task, "plugin",
+				SCRIPTDIR "/libppp-plugin.so");
+
+	err = connman_task_run(task, vpn_died, provider,
+				NULL, NULL, NULL);
+	if (err < 0) {
+		connman_error("pptp failed to start");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int pptp_error_code(int exit_code)
+{
+
+	switch (exit_code) {
+	case 1:
+		return CONNMAN_PROVIDER_ERROR_CONNECT_FAILED;
+	case 2:
+		return CONNMAN_PROVIDER_ERROR_LOGIN_FAILED;
+	case 16:
+		return CONNMAN_PROVIDER_ERROR_AUTH_FAILED;
+	default:
+		return CONNMAN_PROVIDER_ERROR_UNKNOWN;
+	}
+}
+
+static struct vpn_driver vpn_driver = {
+	.flags		= VPN_FLAG_NO_TUN,
+	.notify		= pptp_notify,
+	.connect	= pptp_connect,
+	.error_code     = pptp_error_code,
+	.save		= pptp_save,
+};
+
+static int pptp_init(void)
+{
+	connection = connman_dbus_get_connection();
+
+	return vpn_register("pptp", &vpn_driver, PPPD);
+}
+
+static void pptp_exit(void)
+{
+	vpn_unregister("pptp");
+
+	dbus_connection_unref(connection);
+}
+
+CONNMAN_PLUGIN_DEFINE(pptp, "pptp plugin", VERSION,
+	CONNMAN_PLUGIN_PRIORITY_DEFAULT, pptp_init, pptp_exit)
diff --git a/vpn/plugins/vpn.c b/vpn/plugins/vpn.c
new file mode 100644
index 00000000..2a0fdaf7
--- /dev/null
+++ b/vpn/plugins/vpn.c
@@ -0,0 +1,535 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2007-2012  Intel Corporation. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <stdio.h>
+#include <errno.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <linux/if_tun.h>
+#include <net/if.h>
+
+#include <dbus/dbus.h>
+
+#include <glib/gprintf.h>
+
+#include <connman/log.h>
+#include <connman/rtnl.h>
+#include <connman/task.h>
+#include <connman/inet.h>
+
+#include "../vpn-rtnl.h"
+#include "../vpn-provider.h"
+
+#include "vpn.h"
+
+struct vpn_data {
+	struct vpn_provider *provider;
+	char *if_name;
+	unsigned flags;
+	unsigned int watch;
+	unsigned int state;
+	struct connman_task *task;
+};
+
+struct vpn_driver_data {
+	const char *name;
+	const char *program;
+	struct vpn_driver *vpn_driver;
+	struct vpn_provider_driver provider_driver;
+};
+
+GHashTable *driver_hash = NULL;
+
+static int stop_vpn(struct vpn_provider *provider)
+{
+	struct vpn_data *data = vpn_provider_get_data(provider);
+	struct vpn_driver_data *vpn_driver_data;
+	const char *name;
+	struct ifreq ifr;
+	int fd, err;
+
+	if (data == NULL)
+		return -EINVAL;
+
+	name = vpn_provider_get_driver_name(provider);
+	if (name == NULL)
+		return -EINVAL;
+
+	vpn_driver_data = g_hash_table_lookup(driver_hash, name);
+
+	if (vpn_driver_data != NULL && vpn_driver_data->vpn_driver != NULL &&
+			vpn_driver_data->vpn_driver->flags == VPN_FLAG_NO_TUN)
+		return 0;
+
+	memset(&ifr, 0, sizeof(ifr));
+	ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
+	sprintf(ifr.ifr_name, "%s", data->if_name);
+
+	fd = open("/dev/net/tun", O_RDWR | O_CLOEXEC);
+	if (fd < 0) {
+		err = -errno;
+		connman_error("Failed to open /dev/net/tun to device %s: %s",
+			      data->if_name, strerror(errno));
+		return err;
+	}
+
+	if (ioctl(fd, TUNSETIFF, (void *)&ifr)) {
+		err = -errno;
+		connman_error("Failed to TUNSETIFF for device %s to it: %s",
+			      data->if_name, strerror(errno));
+		close(fd);
+		return err;
+	}
+
+	if (ioctl(fd, TUNSETPERSIST, 0)) {
+		err = -errno;
+		connman_error("Failed to set tun device %s nonpersistent: %s",
+			      data->if_name, strerror(errno));
+		close(fd);
+		return err;
+	}
+	close(fd);
+	DBG("Killed tun device %s", data->if_name);
+	return 0;
+}
+
+void vpn_died(struct connman_task *task, int exit_code, void *user_data)
+{
+	struct vpn_provider *provider = user_data;
+	struct vpn_data *data = vpn_provider_get_data(provider);
+	int state = VPN_STATE_FAILURE;
+	enum vpn_provider_error ret;
+
+	DBG("provider %p data %p", provider, data);
+
+	if (data == NULL)
+		goto vpn_exit;
+
+	state = data->state;
+
+	stop_vpn(provider);
+	vpn_provider_set_data(provider, NULL);
+
+	if (data->watch != 0) {
+		vpn_provider_unref(provider);
+		vpn_rtnl_remove_watch(data->watch);
+		data->watch = 0;
+	}
+
+vpn_exit:
+	if (state != VPN_STATE_READY && state != VPN_STATE_DISCONNECT) {
+		const char *name;
+		struct vpn_driver_data *vpn_data = NULL;
+
+		name = vpn_provider_get_driver_name(provider);
+		if (name != NULL)
+			vpn_data = g_hash_table_lookup(driver_hash, name);
+
+		if (vpn_data != NULL &&
+				vpn_data->vpn_driver->error_code != NULL)
+			ret = vpn_data->vpn_driver->error_code(exit_code);
+		else
+			ret = VPN_PROVIDER_ERROR_UNKNOWN;
+
+		vpn_provider_indicate_error(provider, ret);
+	} else
+		vpn_provider_set_state(provider, VPN_PROVIDER_STATE_IDLE);
+
+	vpn_provider_set_index(provider, -1);
+
+	if (data != NULL) {
+		vpn_provider_unref(data->provider);
+		g_free(data->if_name);
+		g_free(data);
+	}
+
+	connman_task_destroy(task);
+}
+
+int vpn_set_ifname(struct vpn_provider *provider, const char *ifname)
+{
+	struct vpn_data *data = vpn_provider_get_data(provider);
+	int index;
+
+	if (ifname == NULL || data == NULL)
+		return  -EIO;
+
+	index = connman_inet_ifindex(ifname);
+	if (index < 0)
+		return  -EIO;
+
+	if (data->if_name != NULL)
+		g_free(data->if_name);
+
+	data->if_name = (char *)g_strdup(ifname);
+	vpn_provider_set_index(provider, index);
+
+	return 0;
+}
+
+static void vpn_newlink(unsigned flags, unsigned change, void *user_data)
+{
+	struct vpn_provider *provider = user_data;
+	struct vpn_data *data = vpn_provider_get_data(provider);
+
+	if ((data->flags & IFF_UP) != (flags & IFF_UP)) {
+		if (flags & IFF_UP) {
+			data->state = VPN_STATE_READY;
+			vpn_provider_set_state(provider,
+					VPN_PROVIDER_STATE_READY);
+		}
+	}
+	data->flags = flags;
+}
+
+static DBusMessage *vpn_notify(struct connman_task *task,
+			DBusMessage *msg, void *user_data)
+{
+	struct vpn_provider *provider = user_data;
+	struct vpn_data *data;
+	struct vpn_driver_data *vpn_driver_data;
+	const char *name;
+	int state, index;
+
+	data = vpn_provider_get_data(provider);
+
+	name = vpn_provider_get_driver_name(provider);
+	if (name == NULL)
+		return NULL;
+
+	vpn_driver_data = g_hash_table_lookup(driver_hash, name);
+	if (vpn_driver_data == NULL)
+		return NULL;
+
+	state = vpn_driver_data->vpn_driver->notify(msg, provider);
+	switch (state) {
+	case VPN_STATE_CONNECT:
+	case VPN_STATE_READY:
+		index = vpn_provider_get_index(provider);
+		vpn_provider_ref(provider);
+		data->watch = vpn_rtnl_add_newlink_watch(index,
+						     vpn_newlink, provider);
+		connman_inet_ifup(index);
+		break;
+
+	case VPN_STATE_UNKNOWN:
+	case VPN_STATE_IDLE:
+	case VPN_STATE_DISCONNECT:
+	case VPN_STATE_FAILURE:
+		vpn_provider_set_state(provider,
+					VPN_PROVIDER_STATE_DISCONNECT);
+		break;
+
+	case VPN_STATE_AUTH_FAILURE:
+		vpn_provider_indicate_error(provider,
+					VPN_PROVIDER_ERROR_AUTH_FAILED);
+		break;
+	}
+
+	return NULL;
+}
+
+static int vpn_create_tun(struct vpn_provider *provider)
+{
+	struct vpn_data *data = vpn_provider_get_data(provider);
+	struct ifreq ifr;
+	int i, fd, index;
+	int ret = 0;
+
+	if (data == NULL)
+		return -EISCONN;
+
+	fd = open("/dev/net/tun", O_RDWR | O_CLOEXEC);
+	if (fd < 0) {
+		i = -errno;
+		connman_error("Failed to open /dev/net/tun: %s",
+			      strerror(errno));
+		ret = i;
+		goto exist_err;
+	}
+
+	memset(&ifr, 0, sizeof(ifr));
+	ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
+
+	for (i = 0; i < 256; i++) {
+		sprintf(ifr.ifr_name, "vpn%d", i);
+
+		if (!ioctl(fd, TUNSETIFF, (void *)&ifr))
+			break;
+	}
+
+	if (i == 256) {
+		connman_error("Failed to find available tun device");
+		close(fd);
+		ret = -ENODEV;
+		goto exist_err;
+	}
+
+	data->if_name = (char *)g_strdup(ifr.ifr_name);
+	if (data->if_name == NULL) {
+		connman_error("Failed to allocate memory");
+		close(fd);
+		ret = -ENOMEM;
+		goto exist_err;
+	}
+
+	if (ioctl(fd, TUNSETPERSIST, 1)) {
+		i = -errno;
+		connman_error("Failed to set tun persistent: %s",
+			      strerror(errno));
+		close(fd);
+		ret = i;
+		goto exist_err;
+	}
+
+	close(fd);
+
+	index = connman_inet_ifindex(data->if_name);
+	if (index < 0) {
+		connman_error("Failed to get tun ifindex");
+		stop_vpn(provider);
+		ret = -EIO;
+		goto exist_err;
+	}
+	vpn_provider_set_index(provider, index);
+
+	return 0;
+
+exist_err:
+	return ret;
+}
+
+static int vpn_connect(struct vpn_provider *provider)
+{
+	struct vpn_data *data = vpn_provider_get_data(provider);
+	struct vpn_driver_data *vpn_driver_data;
+	const char *name;
+	int ret = 0;
+
+	if (data != NULL)
+		return -EISCONN;
+
+	data = g_try_new0(struct vpn_data, 1);
+	if (data == NULL)
+		return -ENOMEM;
+
+	data->provider = vpn_provider_ref(provider);
+	data->watch = 0;
+	data->flags = 0;
+	data->task = NULL;
+	data->state = VPN_STATE_IDLE;
+
+	vpn_provider_set_data(provider, data);
+
+	name = vpn_provider_get_driver_name(provider);
+	if (name == NULL)
+		return -EINVAL;
+
+	vpn_driver_data = g_hash_table_lookup(driver_hash, name);
+
+	if (vpn_driver_data == NULL || vpn_driver_data->vpn_driver == NULL) {
+		ret = -EINVAL;
+		goto exist_err;
+	}
+
+	if (vpn_driver_data->vpn_driver->flags != VPN_FLAG_NO_TUN) {
+		ret = vpn_create_tun(provider);
+		if (ret < 0)
+			goto exist_err;
+	}
+
+	data->task = connman_task_create(vpn_driver_data->program);
+
+	if (data->task == NULL) {
+		ret = -ENOMEM;
+		stop_vpn(provider);
+		goto exist_err;
+	}
+
+	if (connman_task_set_notify(data->task, "notify",
+					vpn_notify, provider)) {
+		ret = -ENOMEM;
+		stop_vpn(provider);
+		connman_task_destroy(data->task);
+		data->task = NULL;
+		goto exist_err;
+	}
+
+	ret = vpn_driver_data->vpn_driver->connect(provider, data->task,
+							data->if_name);
+	if (ret < 0) {
+		stop_vpn(provider);
+		connman_task_destroy(data->task);
+		data->task = NULL;
+		goto exist_err;
+	}
+
+	DBG("%s started with dev %s",
+		vpn_driver_data->provider_driver.name, data->if_name);
+
+	data->state = VPN_STATE_CONNECT;
+
+	return -EINPROGRESS;
+
+exist_err:
+	vpn_provider_set_index(provider, -1);
+	vpn_provider_set_data(provider, NULL);
+	vpn_provider_unref(data->provider);
+	g_free(data->if_name);
+	g_free(data);
+
+	return ret;
+}
+
+static int vpn_probe(struct vpn_provider *provider)
+{
+	return 0;
+}
+
+static int vpn_disconnect(struct vpn_provider *provider)
+{
+	struct vpn_data *data = vpn_provider_get_data(provider);
+	struct vpn_driver_data *vpn_driver_data;
+	const char *name;
+
+	DBG("disconnect provider %p:", provider);
+
+	if (data == NULL)
+		return 0;
+
+	name = vpn_provider_get_driver_name(provider);
+	if (name == NULL)
+		return 0;
+
+	vpn_driver_data = g_hash_table_lookup(driver_hash, name);
+	if (vpn_driver_data->vpn_driver->disconnect)
+		vpn_driver_data->vpn_driver->disconnect();
+
+	if (data->watch != 0) {
+		vpn_provider_unref(provider);
+		vpn_rtnl_remove_watch(data->watch);
+		data->watch = 0;
+	}
+
+	data->state = VPN_STATE_DISCONNECT;
+	connman_task_stop(data->task);
+
+	return 0;
+}
+
+static int vpn_remove(struct vpn_provider *provider)
+{
+	struct vpn_data *data;
+
+	data = vpn_provider_get_data(provider);
+	if (data == NULL)
+		return 0;
+
+	if (data->watch != 0) {
+		vpn_provider_unref(provider);
+		vpn_rtnl_remove_watch(data->watch);
+		data->watch = 0;
+	}
+
+	connman_task_stop(data->task);
+
+	g_usleep(G_USEC_PER_SEC);
+	stop_vpn(provider);
+	return 0;
+}
+
+static int vpn_save(struct vpn_provider *provider, GKeyFile *keyfile)
+{
+	struct vpn_driver_data *vpn_driver_data;
+	const char *name;
+
+	name = vpn_provider_get_driver_name(provider);
+	vpn_driver_data = g_hash_table_lookup(driver_hash, name);
+	if (vpn_driver_data != NULL &&
+			vpn_driver_data->vpn_driver->save != NULL)
+		return vpn_driver_data->vpn_driver->save(provider, keyfile);
+
+	return 0;
+}
+
+int vpn_register(const char *name, struct vpn_driver *vpn_driver,
+			const char *program)
+{
+	struct vpn_driver_data *data;
+
+	data = g_try_new0(struct vpn_driver_data, 1);
+	if (data == NULL)
+		return -ENOMEM;
+
+	data->name = name;
+	data->program = program;
+
+	data->vpn_driver = vpn_driver;
+
+	data->provider_driver.name = name;
+	data->provider_driver.disconnect = vpn_disconnect;
+	data->provider_driver.connect = vpn_connect;
+	data->provider_driver.probe = vpn_probe;
+	data->provider_driver.remove = vpn_remove;
+	data->provider_driver.save = vpn_save;
+
+	if (driver_hash == NULL)
+		driver_hash = g_hash_table_new_full(g_str_hash,
+							g_str_equal,
+							NULL, g_free);
+
+	if (driver_hash == NULL) {
+		connman_error("driver_hash not initialized for %s", name);
+		g_free(data);
+		return -ENOMEM;
+	}
+
+	g_hash_table_replace(driver_hash, (char *)name, data);
+
+	vpn_provider_driver_register(&data->provider_driver);
+
+	return 0;
+}
+
+void vpn_unregister(const char *name)
+{
+	struct vpn_driver_data *data;
+
+	data = g_hash_table_lookup(driver_hash, name);
+	if (data == NULL)
+		return;
+
+	vpn_provider_driver_unregister(&data->provider_driver);
+
+	g_hash_table_remove(driver_hash, name);
+
+	if (g_hash_table_size(driver_hash) == 0)
+		g_hash_table_destroy(driver_hash);
+}
diff --git a/vpn/plugins/vpn.h b/vpn/plugins/vpn.h
new file mode 100644
index 00000000..6693cdba
--- /dev/null
+++ b/vpn/plugins/vpn.h
@@ -0,0 +1,63 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2010  BMW Car IT GmbH. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef __CONNMAN_VPND_VPN_H
+#define __CONNMAN_VPND_VPN_H
+
+#include "../vpn-provider.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define VPN_FLAG_NO_TUN	1
+
+enum vpn_state {
+	VPN_STATE_UNKNOWN       = 0,
+	VPN_STATE_IDLE          = 1,
+	VPN_STATE_CONNECT       = 2,
+	VPN_STATE_READY         = 3,
+	VPN_STATE_DISCONNECT    = 4,
+	VPN_STATE_FAILURE       = 5,
+	VPN_STATE_AUTH_FAILURE  = 6,
+};
+
+struct vpn_driver {
+	int flags;
+	int (*notify) (DBusMessage *msg, struct vpn_provider *provider);
+	int (*connect) (struct vpn_provider *provider,
+			struct connman_task *task, const char *if_name);
+	void (*disconnect) (void);
+	int (*error_code) (int exit_code);
+	int (*save) (struct vpn_provider *provider, GKeyFile *keyfile);
+};
+
+int vpn_register(const char *name, struct vpn_driver *driver,
+			const char *program);
+void vpn_unregister(const char *provider_name);
+void vpn_died(struct connman_task *task, int exit_code, void *user_data);
+int vpn_set_ifname(struct vpn_provider *provider, const char *ifname);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __CONNMAN_VPND_VPN_H */
diff --git a/vpn/plugins/vpnc.c b/vpn/plugins/vpnc.c
new file mode 100644
index 00000000..9fd1dec8
--- /dev/null
+++ b/vpn/plugins/vpnc.c
@@ -0,0 +1,345 @@
+/*
+ *
+ *  ConnMan VPN daemon
+ *
+ *  Copyright (C) 2010  BMW Car IT GmbH. All rights reserved.
+ *  Copyright (C) 2010  Intel Corporation. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <net/if.h>
+
+#include <glib.h>
+
+#define CONNMAN_API_SUBJECT_TO_CHANGE
+#include <connman/plugin.h>
+#include <connman/log.h>
+#include <connman/task.h>
+#include <connman/ipconfig.h>
+#include <connman/dbus.h>
+
+#include "../vpn-provider.h"
+
+#include "vpn.h"
+
+#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
+
+static DBusConnection *connection;
+
+enum {
+	OPT_STRING = 1,
+	OPT_BOOLEAN = 2,
+};
+
+struct {
+	const char *cm_opt;
+	const char *vpnc_opt;
+	const char *vpnc_default;
+	int type;
+	connman_bool_t cm_save;
+} vpnc_options[] = {
+	{ "Host", "IPSec gateway", NULL, OPT_STRING, TRUE },
+	{ "VPNC.IPSec.ID", "IPSec ID", NULL, OPT_STRING, TRUE },
+	{ "VPNC.IPSec.Secret", "IPSec secret", NULL, OPT_STRING, FALSE },
+	{ "VPNC.Xauth.Username", "Xauth username", NULL, OPT_STRING, FALSE },
+	{ "VPNC.Xauth.Password", "Xauth password", NULL, OPT_STRING, FALSE },
+	{ "VPNC.IKE.Authmode", "IKE Authmode", NULL, OPT_STRING, TRUE },
+	{ "VPNC.IKE.DHGroup", "IKE DH Group", NULL, OPT_STRING, TRUE },
+	{ "VPNC.PFS", "Perfect Forward Secrecy", NULL, OPT_STRING, TRUE },
+	{ "VPNC.Domain", "Domain", NULL, OPT_STRING, TRUE },
+	{ "VPNC.Vendor", "Vendor", NULL, OPT_STRING, TRUE },
+	{ "VPNC.LocalPort", "Local Port", "0", OPT_STRING, TRUE, },
+	{ "VPNC.CiscoPort", "Cisco UDP Encapsulation Port", "0", OPT_STRING,
+									TRUE },
+	{ "VPNC.AppVersion", "Application Version", NULL, OPT_STRING, TRUE },
+	{ "VPNC.NATTMode", "NAT Traversal Mode", "cisco-udp", OPT_STRING,
+									TRUE },
+	{ "VPNC.DPDTimeout", "DPD idle timeout (our side)", NULL, OPT_STRING,
+									TRUE },
+	{ "VPNC.SingleDES", "Enable Single DES", NULL, OPT_BOOLEAN, TRUE },
+	{ "VPNC.NoEncryption", "Enable no encryption", NULL, OPT_BOOLEAN,
+									TRUE },
+};
+
+static int vc_notify(DBusMessage *msg, struct vpn_provider *provider)
+{
+	DBusMessageIter iter, dict;
+	char *address = NULL, *netmask = NULL, *gateway = NULL;
+	struct connman_ipaddress *ipaddress;
+	const char *reason, *key, *value;
+
+	dbus_message_iter_init(msg, &iter);
+
+	dbus_message_iter_get_basic(&iter, &reason);
+	dbus_message_iter_next(&iter);
+
+	if (!provider) {
+		connman_error("No provider found");
+		return VPN_STATE_FAILURE;
+	}
+
+	if (strcmp(reason, "connect"))
+		return VPN_STATE_DISCONNECT;
+
+	dbus_message_iter_recurse(&iter, &dict);
+
+	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
+		DBusMessageIter entry;
+
+		dbus_message_iter_recurse(&dict, &entry);
+		dbus_message_iter_get_basic(&entry, &key);
+		dbus_message_iter_next(&entry);
+		dbus_message_iter_get_basic(&entry, &value);
+
+		DBG("%s = %s", key, value);
+
+		if (!strcmp(key, "VPNGATEWAY"))
+			gateway = g_strdup(value);
+
+		if (!strcmp(key, "INTERNAL_IP4_ADDRESS"))
+			address = g_strdup(value);
+
+		if (!strcmp(key, "INTERNAL_IP4_NETMASK"))
+			netmask = g_strdup(value);
+
+		if (!strcmp(key, "INTERNAL_IP4_DNS"))
+			vpn_provider_set_nameservers(provider, value);
+
+		if (!strcmp(key, "CISCO_DEF_DOMAIN"))
+			vpn_provider_set_domain(provider, value);
+
+		if (g_str_has_prefix(key, "CISCO_SPLIT_INC") == TRUE ||
+			g_str_has_prefix(key, "CISCO_IPV6_SPLIT_INC") == TRUE)
+			vpn_provider_append_route(provider, key, value);
+
+		dbus_message_iter_next(&dict);
+	}
+
+
+	ipaddress = connman_ipaddress_alloc(AF_INET);
+	if (ipaddress == NULL) {
+		g_free(address);
+		g_free(netmask);
+		g_free(gateway);
+
+		return VPN_STATE_FAILURE;
+	}
+
+	connman_ipaddress_set_ipv4(ipaddress, address, netmask, gateway);
+	vpn_provider_set_ipaddress(provider, ipaddress);
+
+	g_free(address);
+	g_free(netmask);
+	g_free(gateway);
+	connman_ipaddress_free(ipaddress);
+
+	return VPN_STATE_CONNECT;
+}
+
+static ssize_t full_write(int fd, const void *buf, size_t len)
+{
+	ssize_t byte_write;
+
+	while (len) {
+		byte_write = write(fd, buf, len);
+		if (byte_write < 0) {
+			connman_error("failed to write config to vpnc: %s\n",
+					strerror(errno));
+			return byte_write;
+		}
+		len -= byte_write;
+		buf += byte_write;
+	}
+
+	return 0;
+}
+
+static ssize_t write_option(int fd, const char *key, const char *value)
+{
+	gchar *buf;
+	ssize_t ret = 0;
+
+	if (key != NULL && value != NULL) {
+		buf = g_strdup_printf("%s %s\n", key, value);
+		ret = full_write(fd, buf, strlen(buf));
+
+		g_free(buf);
+	}
+
+	return ret;
+}
+
+static ssize_t write_bool_option(int fd, const char *key, const char *value)
+{
+	gchar *buf;
+	ssize_t ret = 0;
+
+	if (key != NULL && value != NULL) {
+		if (strcasecmp(value, "yes") == 0 ||
+				strcasecmp(value, "true") == 0 ||
+				strcmp(value, "1") == 0) {
+			buf = g_strdup_printf("%s\n", key);
+			ret = full_write(fd, buf, strlen(buf));
+
+			g_free(buf);
+		}
+	}
+
+	return ret;
+}
+
+static int vc_write_config_data(struct vpn_provider *provider, int fd)
+{
+	const char *opt_s;
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(vpnc_options); i++) {
+		opt_s = vpn_provider_get_string(provider,
+					vpnc_options[i].cm_opt);
+		if (opt_s == FALSE)
+			opt_s = vpnc_options[i].vpnc_default;
+
+		if (opt_s == FALSE)
+			continue;
+
+		if (vpnc_options[i].type == OPT_STRING) {
+			if (write_option(fd,
+					vpnc_options[i].vpnc_opt, opt_s) < 0)
+				return -EIO;
+		} else if (vpnc_options[i].type == OPT_BOOLEAN) {
+			if (write_bool_option(fd,
+					vpnc_options[i].vpnc_opt, opt_s) < 0)
+				return -EIO;
+		}
+
+	}
+
+	return 0;
+}
+
+static int vc_save(struct vpn_provider *provider, GKeyFile *keyfile)
+{
+	const char *option;
+	int i;
+
+	for (i = 0; i < (int)ARRAY_SIZE(vpnc_options); i++) {
+		if (strncmp(vpnc_options[i].cm_opt, "VPNC.", 5) == 0) {
+
+			if (vpnc_options[i].cm_save == FALSE)
+				continue;
+
+			option = vpn_provider_get_string(provider,
+							vpnc_options[i].cm_opt);
+			if (option == NULL)
+				continue;
+
+			g_key_file_set_string(keyfile,
+					vpn_provider_get_save_group(provider),
+					vpnc_options[i].cm_opt, option);
+		}
+	}
+	return 0;
+}
+
+static int vc_connect(struct vpn_provider *provider,
+		struct connman_task *task, const char *if_name)
+{
+	const char *option;
+	int err, fd;
+
+	option = vpn_provider_get_string(provider, "Host");
+	if (option == NULL) {
+		connman_error("Host not set; cannot enable VPN");
+		return -EINVAL;
+	}
+	option = vpn_provider_get_string(provider, "VPNC.IPSec.ID");
+	if (option == NULL) {
+		connman_error("Group not set; cannot enable VPN");
+		return -EINVAL;
+	}
+
+	connman_task_add_argument(task, "--non-inter", NULL);
+	connman_task_add_argument(task, "--no-detach", NULL);
+
+	connman_task_add_argument(task, "--ifname", if_name);
+	connman_task_add_argument(task, "--ifmode", "tun");
+
+	connman_task_add_argument(task, "--script",
+				SCRIPTDIR "/openconnect-script");
+
+	option = vpn_provider_get_string(provider, "VPNC.Debug");
+	if (option != NULL)
+		connman_task_add_argument(task, "--debug", option);
+
+	connman_task_add_argument(task, "-", NULL);
+
+	err = connman_task_run(task, vpn_died, provider,
+				&fd, NULL, NULL);
+	if (err < 0) {
+		connman_error("vpnc failed to start");
+		return -EIO;
+	}
+
+	err = vc_write_config_data(provider, fd);
+
+	close(fd);
+
+	return err;
+}
+
+static int vc_error_code(int exit_code)
+{
+	switch (exit_code) {
+	case 1:
+		return VPN_PROVIDER_ERROR_CONNECT_FAILED;
+	case 2:
+		return VPN_PROVIDER_ERROR_LOGIN_FAILED;
+	default:
+		return VPN_PROVIDER_ERROR_UNKNOWN;
+	}
+}
+
+static struct vpn_driver vpn_driver = {
+	.notify		= vc_notify,
+	.connect	= vc_connect,
+	.error_code	= vc_error_code,
+	.save		= vc_save,
+};
+
+static int vpnc_init(void)
+{
+	connection = connman_dbus_get_connection();
+
+	return vpn_register("vpnc", &vpn_driver, VPNC);
+}
+
+static void vpnc_exit(void)
+{
+	vpn_unregister("vpnc");
+
+	dbus_connection_unref(connection);
+}
+
+CONNMAN_PLUGIN_DEFINE(vpnc, "vpnc plugin", VERSION,
+	CONNMAN_PLUGIN_PRIORITY_DEFAULT, vpnc_init, vpnc_exit)