vpn/plugins/openvpn.c - nest-guard/1.0/connman - Git at Google

 /*
  *
  *  ConnMan VPN daemon
  *
  *  Copyright (C) 2010-2014  BMW Car IT GmbH.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.
  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */

 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif

 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <unistd.h>
 #include <stdio.h>
 #include <net/if.h>

 #include <glib.h>

 #define CONNMAN_API_SUBJECT_TO_CHANGE
 #include <connman/plugin.h>
 #include <connman/log.h>
 #include <connman/task.h>
 #include <connman/dbus.h>
 #include <connman/ipconfig.h>

 #include "../vpn-provider.h"

 #include "vpn.h"

 #define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))

 static DBusConnection *connection;

 struct {
 	const char *cm_opt;
 	const char *ov_opt;
 	char       has_value;
 } ov_options[] = {
 	{ "Host", "--remote", 1 },
 	{ "OpenVPN.CACert", "--ca", 1 },
 	{ "OpenVPN.Cert", "--cert", 1 },
 	{ "OpenVPN.Key", "--key", 1 },
 	{ "OpenVPN.MTU", "--mtu", 1 },
 	{ "OpenVPN.NSCertType", "--ns-cert-type", 1 },
 	{ "OpenVPN.Proto", "--proto", 1 },
 	{ "OpenVPN.Port", "--port", 1 },
 	{ "OpenVPN.AuthUserPass", "--auth-user-pass", 1 },
 	{ "OpenVPN.AskPass", "--askpass", 1 },
 	{ "OpenVPN.AuthNoCache", "--auth-nocache", 0 },
 	{ "OpenVPN.TLSRemote", "--tls-remote", 1 },
 	{ "OpenVPN.TLSAuth", NULL, 1 },
 	{ "OpenVPN.TLSAuthDir", NULL, 1 },
 	{ "OpenVPN.Cipher", "--cipher", 1 },
 	{ "OpenVPN.Auth", "--auth", 1 },
 	{ "OpenVPN.CompLZO", "--comp-lzo", 0 },
 	{ "OpenVPN.RemoteCertTls", "--remote-cert-tls", 1 },
 	{ "OpenVPN.ConfigFile", "--config", 1 },
 };

 struct nameserver_entry {
 	int id;
 	char *nameserver;
 };

 static struct nameserver_entry *ov_append_dns_entries(const char *key,
 						const char *value)
 {
 	struct nameserver_entry *entry = NULL;
 	gchar **options;

 	if (!g_str_has_prefix(key, "foreign_option_"))
 		return NULL;

 	options = g_strsplit(value, " ", 3);
 	if (options[0] &&
 		!strcmp(options[0], "dhcp-option") &&
 			options[1] &&
 			!strcmp(options[1], "DNS") &&
 				options[2]) {

 		entry = g_try_new(struct nameserver_entry, 1);
 		if (!entry)
 			return NULL;

 		entry->nameserver = g_strdup(options[2]);
 		entry->id = atoi(key + 15); /* foreign_option_XXX */
 	}

 	g_strfreev(options);

 	return entry;
 }

 static char *ov_get_domain_name(const char *key, const char *value)
 {
 	gchar **options;
 	char *domain = NULL;

 	if (!g_str_has_prefix(key, "foreign_option_"))
 		return NULL;

 	options = g_strsplit(value, " ", 3);
 	if (options[0] &&
 		!strcmp(options[0], "dhcp-option") &&
 			options[1] &&
 			!strcmp(options[1], "DOMAIN") &&
 				options[2]) {

 		domain = g_strdup(options[2]);
 	}

 	g_strfreev(options);

 	return domain;
 }

 static gint cmp_ns(gconstpointer a, gconstpointer b)
 {
 	struct nameserver_entry *entry_a = (struct nameserver_entry *)a;
 	struct nameserver_entry *entry_b = (struct nameserver_entry *)b;

 	if (entry_a->id < entry_b->id)
 		return -1;

 	if (entry_a->id > entry_b->id)
 		return 1;

 	return 0;
 }

 static void free_ns_entry(gpointer data)
 {
 	struct nameserver_entry *entry = data;

 	g_free(entry->nameserver);
 	g_free(entry);
 }

 static int ov_notify(DBusMessage *msg, struct vpn_provider *provider)
 {
 	DBusMessageIter iter, dict;
 	const char *reason, *key, *value;
 	char *address = NULL, *gateway = NULL, *peer = NULL;
 	struct connman_ipaddress *ipaddress;
 	GSList *nameserver_list = NULL;

 	dbus_message_iter_init(msg, &iter);

 	dbus_message_iter_get_basic(&iter, &reason);
 	dbus_message_iter_next(&iter);

 	if (!provider) {
 		connman_error("No provider found");
 		return VPN_STATE_FAILURE;
 	}

 	if (strcmp(reason, "up"))
 		return VPN_STATE_DISCONNECT;

 	dbus_message_iter_recurse(&iter, &dict);

 	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
 		struct nameserver_entry *ns_entry = NULL;
 		DBusMessageIter entry;

 		dbus_message_iter_recurse(&dict, &entry);
 		dbus_message_iter_get_basic(&entry, &key);
 		dbus_message_iter_next(&entry);
 		dbus_message_iter_get_basic(&entry, &value);

 		DBG("%s = %s", key, value);

 		if (!strcmp(key, "trusted_ip"))
 			gateway = g_strdup(value);

 		if (!strcmp(key, "ifconfig_local"))
 			address = g_strdup(value);

 		if (!strcmp(key, "ifconfig_remote"))
 			peer = g_strdup(value);

 		if (g_str_has_prefix(key, "route_"))
 			vpn_provider_append_route(provider, key, value);

 		if ((ns_entry = ov_append_dns_entries(key, value)))
 			nameserver_list = g_slist_prepend(nameserver_list,
 							ns_entry);
 		else {
 			char *domain = ov_get_domain_name(key, value);
 			if (domain) {
 				vpn_provider_set_domain(provider, domain);
 				g_free(domain);
 			}
 		}

 		dbus_message_iter_next(&dict);
 	}

 	ipaddress = connman_ipaddress_alloc(AF_INET);
 	if (!ipaddress) {
 		g_slist_free_full(nameserver_list, free_ns_entry);
 		g_free(address);
 		g_free(gateway);
 		g_free(peer);

 		return VPN_STATE_FAILURE;
 	}

 	connman_ipaddress_set_ipv4(ipaddress, address, NULL, gateway);
 	connman_ipaddress_set_peer(ipaddress, peer);
 	vpn_provider_set_ipaddress(provider, ipaddress);

 	if (nameserver_list) {
 		char *nameservers = NULL;
 		GSList *tmp;

 		nameserver_list = g_slist_sort(nameserver_list, cmp_ns);
 		for (tmp = nameserver_list; tmp;
 						tmp = g_slist_next(tmp)) {
 			struct nameserver_entry *ns = tmp->data;

 			if (!nameservers) {
 				nameservers = g_strdup(ns->nameserver);
 			} else {
 				char *str;
 				str = g_strjoin(" ", nameservers,
 						ns->nameserver, NULL);
 				g_free(nameservers);
 				nameservers = str;
 			}
 		}

 		g_slist_free_full(nameserver_list, free_ns_entry);

 		vpn_provider_set_nameservers(provider, nameservers);

 		g_free(nameservers);
 	}

 	g_free(address);
 	g_free(gateway);
 	g_free(peer);
 	connman_ipaddress_free(ipaddress);

 	return VPN_STATE_CONNECT;
 }

 static int ov_save(struct vpn_provider *provider, GKeyFile *keyfile)
 {
 	const char *option;
 	int i;

 	for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
 		if (strncmp(ov_options[i].cm_opt, "OpenVPN.", 8) == 0) {
 			option = vpn_provider_get_string(provider,
 							ov_options[i].cm_opt);
 			if (!option)
 				continue;

 			g_key_file_set_string(keyfile,
 					vpn_provider_get_save_group(provider),
 					ov_options[i].cm_opt, option);
 		}
 	}
 	return 0;
 }

 static int task_append_config_data(struct vpn_provider *provider,
 					struct connman_task *task)
 {
 	const char *option;
 	int i;

 	for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
 		if (!ov_options[i].ov_opt)
 			continue;

 		option = vpn_provider_get_string(provider,
 					ov_options[i].cm_opt);
 		if (!option)
 			continue;

 		if (connman_task_add_argument(task,
 				ov_options[i].ov_opt,
 				ov_options[i].has_value ? option : NULL) < 0) {
 			return -EIO;
 		}
 	}

 	return 0;
 }

 static int ov_connect(struct vpn_provider *provider,
 			struct connman_task *task, const char *if_name,
 			vpn_provider_connect_cb_t cb, const char *dbus_sender,
 			void *user_data)
 {
 	const char *option;
 	int err = 0, fd;

 	option = vpn_provider_get_string(provider, "Host");
 	if (!option) {
 		connman_error("Host not set; cannot enable VPN");
 		return -EINVAL;
 	}

 	task_append_config_data(provider, task);

 	option = vpn_provider_get_string(provider, "OpenVPN.ConfigFile");
 	if (!option) {
 		/*
 		 * Set some default options if user has no config file.
 		 */
 		option = vpn_provider_get_string(provider, "OpenVPN.TLSAuth");
 		if (option) {
 			connman_task_add_argument(task, "--tls-auth", option);
 			option = vpn_provider_get_string(provider,
 							"OpenVPN.TLSAuthDir");
 			if (option)
 				connman_task_add_argument(task, option, NULL);
 		}

 		connman_task_add_argument(task, "--nobind", NULL);
 		connman_task_add_argument(task, "--persist-key", NULL);
 		connman_task_add_argument(task, "--client", NULL);
 	}

 	connman_task_add_argument(task, "--syslog", NULL);

 	connman_task_add_argument(task, "--script-security", "2");

 	connman_task_add_argument(task, "--up",
 					SCRIPTDIR "/openvpn-script");
 	connman_task_add_argument(task, "--up-restart", NULL);

 	connman_task_add_argument(task, "--setenv", NULL);
 	connman_task_add_argument(task, "CONNMAN_BUSNAME",
 					dbus_bus_get_unique_name(connection));

 	connman_task_add_argument(task, "--setenv", NULL);
 	connman_task_add_argument(task, "CONNMAN_INTERFACE",
 					CONNMAN_TASK_INTERFACE);

 	connman_task_add_argument(task, "--setenv", NULL);
 	connman_task_add_argument(task, "CONNMAN_PATH",
 					connman_task_get_path(task));

 	connman_task_add_argument(task, "--dev", if_name);
 	connman_task_add_argument(task, "--dev-type", "tun");

 	connman_task_add_argument(task, "--persist-tun", NULL);

 	connman_task_add_argument(task, "--route-noexec", NULL);
 	connman_task_add_argument(task, "--ifconfig-noexec", NULL);

 	/*
 	 * Disable client restarts because we can't handle this at the
 	 * moment. The problem is that when OpenVPN decides to switch
 	 * from CONNECTED state to RECONNECTING and then to RESOLVE,
 	 * it is not possible to do a DNS lookup. The DNS server is
 	 * not accessable through the tunnel anymore and so we end up
 	 * trying to resolve the OpenVPN servers address.
 	 */
 	connman_task_add_argument(task, "--ping-restart", "0");

 	fd = fileno(stderr);
 	err = connman_task_run(task, vpn_died, provider,
 			NULL, &fd, &fd);
 	if (err < 0) {
 		connman_error("openvpn failed to start");
 		err = -EIO;
 		goto done;
 	}

 done:
 	if (cb)
 		cb(provider, user_data, err);

 	return err;
 }

 static struct vpn_driver vpn_driver = {
 	.notify	= ov_notify,
 	.connect	= ov_connect,
 	.save		= ov_save,
 };

 static int openvpn_init(void)
 {
 	connection = connman_dbus_get_connection();

 	return vpn_register("openvpn", &vpn_driver, OPENVPN);
 }

 static void openvpn_exit(void)
 {
 	vpn_unregister("openvpn");

 	dbus_connection_unref(connection);
 }

 CONNMAN_PLUGIN_DEFINE(openvpn, "OpenVPN plugin", VERSION,
 	CONNMAN_PLUGIN_PRIORITY_DEFAULT, openvpn_init, openvpn_exit)
	/*
	*
	* ConnMan VPN daemon
	*
	* Copyright (C) 2010-2014 BMW Car IT GmbH.
	*
	* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License version 2 as
	* published by the Free Software Foundation.
	*
	* This program is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, write to the Free Software
	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	*
	*/

	#ifdef HAVE_CONFIG_H
	#include <config.h>
	#endif

	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <stdio.h>
	#include <net/if.h>

	#include <glib.h>

	#define CONNMAN_API_SUBJECT_TO_CHANGE
	#include <connman/plugin.h>
	#include <connman/log.h>
	#include <connman/task.h>
	#include <connman/dbus.h>
	#include <connman/ipconfig.h>

	#include "../vpn-provider.h"

	#include "vpn.h"

	#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))

	static DBusConnection *connection;

	struct {
	const char *cm_opt;
	const char *ov_opt;
	char has_value;
	} ov_options[] = {
	{ "Host", "--remote", 1 },
	{ "OpenVPN.CACert", "--ca", 1 },
	{ "OpenVPN.Cert", "--cert", 1 },
	{ "OpenVPN.Key", "--key", 1 },
	{ "OpenVPN.MTU", "--mtu", 1 },
	{ "OpenVPN.NSCertType", "--ns-cert-type", 1 },
	{ "OpenVPN.Proto", "--proto", 1 },
	{ "OpenVPN.Port", "--port", 1 },
	{ "OpenVPN.AuthUserPass", "--auth-user-pass", 1 },
	{ "OpenVPN.AskPass", "--askpass", 1 },
	{ "OpenVPN.AuthNoCache", "--auth-nocache", 0 },
	{ "OpenVPN.TLSRemote", "--tls-remote", 1 },
	{ "OpenVPN.TLSAuth", NULL, 1 },
	{ "OpenVPN.TLSAuthDir", NULL, 1 },
	{ "OpenVPN.Cipher", "--cipher", 1 },
	{ "OpenVPN.Auth", "--auth", 1 },
	{ "OpenVPN.CompLZO", "--comp-lzo", 0 },
	{ "OpenVPN.RemoteCertTls", "--remote-cert-tls", 1 },
	{ "OpenVPN.ConfigFile", "--config", 1 },
	};

	struct nameserver_entry {
	int id;
	char *nameserver;
	};

	static struct nameserver_entry ov_append_dns_entries(const char key,
	const char *value)
	{
	struct nameserver_entry *entry = NULL;
	gchar **options;

	if (!g_str_has_prefix(key, "foreign_option_"))
	return NULL;

	options = g_strsplit(value, " ", 3);
	if (options[0] &&
	!strcmp(options[0], "dhcp-option") &&
	options[1] &&
	!strcmp(options[1], "DNS") &&
	options[2]) {

	entry = g_try_new(struct nameserver_entry, 1);
	if (!entry)
	return NULL;

	entry->nameserver = g_strdup(options[2]);
	entry->id = atoi(key + 15); /* foreign_option_XXX */
	}

	g_strfreev(options);

	return entry;
	}

	static char ov_get_domain_name(const char key, const char *value)
	{
	gchar **options;
	char *domain = NULL;

	if (!g_str_has_prefix(key, "foreign_option_"))
	return NULL;

	options = g_strsplit(value, " ", 3);
	if (options[0] &&
	!strcmp(options[0], "dhcp-option") &&
	options[1] &&
	!strcmp(options[1], "DOMAIN") &&
	options[2]) {

	domain = g_strdup(options[2]);
	}

	g_strfreev(options);

	return domain;
	}

	static gint cmp_ns(gconstpointer a, gconstpointer b)
	{
	struct nameserver_entry entry_a = (struct nameserver_entry )a;
	struct nameserver_entry entry_b = (struct nameserver_entry )b;

	if (entry_a->id < entry_b->id)
	return -1;

	if (entry_a->id > entry_b->id)
	return 1;

	return 0;
	}

	static void free_ns_entry(gpointer data)
	{
	struct nameserver_entry *entry = data;

	g_free(entry->nameserver);
	g_free(entry);
	}

	static int ov_notify(DBusMessage msg, struct vpn_provider provider)
	{
	DBusMessageIter iter, dict;
	const char reason, key, *value;
	char address = NULL, gateway = NULL, *peer = NULL;
	struct connman_ipaddress *ipaddress;
	GSList *nameserver_list = NULL;

	dbus_message_iter_init(msg, &iter);

	dbus_message_iter_get_basic(&iter, &reason);
	dbus_message_iter_next(&iter);

	if (!provider) {
	connman_error("No provider found");
	return VPN_STATE_FAILURE;
	}

	if (strcmp(reason, "up"))
	return VPN_STATE_DISCONNECT;

	dbus_message_iter_recurse(&iter, &dict);

	while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
	struct nameserver_entry *ns_entry = NULL;
	DBusMessageIter entry;

	dbus_message_iter_recurse(&dict, &entry);
	dbus_message_iter_get_basic(&entry, &key);
	dbus_message_iter_next(&entry);
	dbus_message_iter_get_basic(&entry, &value);

	DBG("%s = %s", key, value);

	if (!strcmp(key, "trusted_ip"))
	gateway = g_strdup(value);

	if (!strcmp(key, "ifconfig_local"))
	address = g_strdup(value);

	if (!strcmp(key, "ifconfig_remote"))
	peer = g_strdup(value);

	if (g_str_has_prefix(key, "route_"))
	vpn_provider_append_route(provider, key, value);

	if ((ns_entry = ov_append_dns_entries(key, value)))
	nameserver_list = g_slist_prepend(nameserver_list,
	ns_entry);
	else {
	char *domain = ov_get_domain_name(key, value);
	if (domain) {
	vpn_provider_set_domain(provider, domain);
	g_free(domain);
	}
	}

	dbus_message_iter_next(&dict);
	}

	ipaddress = connman_ipaddress_alloc(AF_INET);
	if (!ipaddress) {
	g_slist_free_full(nameserver_list, free_ns_entry);
	g_free(address);
	g_free(gateway);
	g_free(peer);

	return VPN_STATE_FAILURE;
	}

	connman_ipaddress_set_ipv4(ipaddress, address, NULL, gateway);
	connman_ipaddress_set_peer(ipaddress, peer);
	vpn_provider_set_ipaddress(provider, ipaddress);

	if (nameserver_list) {
	char *nameservers = NULL;
	GSList *tmp;

	nameserver_list = g_slist_sort(nameserver_list, cmp_ns);
	for (tmp = nameserver_list; tmp;
	tmp = g_slist_next(tmp)) {
	struct nameserver_entry *ns = tmp->data;

	if (!nameservers) {
	nameservers = g_strdup(ns->nameserver);
	} else {
	char *str;
	str = g_strjoin(" ", nameservers,
	ns->nameserver, NULL);
	g_free(nameservers);
	nameservers = str;
	}
	}

	g_slist_free_full(nameserver_list, free_ns_entry);

	vpn_provider_set_nameservers(provider, nameservers);

	g_free(nameservers);
	}

	g_free(address);
	g_free(gateway);
	g_free(peer);
	connman_ipaddress_free(ipaddress);

	return VPN_STATE_CONNECT;
	}

	static int ov_save(struct vpn_provider provider, GKeyFile keyfile)
	{
	const char *option;
	int i;

	for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
	if (strncmp(ov_options[i].cm_opt, "OpenVPN.", 8) == 0) {
	option = vpn_provider_get_string(provider,
	ov_options[i].cm_opt);
	if (!option)
	continue;

	g_key_file_set_string(keyfile,
	vpn_provider_get_save_group(provider),
	ov_options[i].cm_opt, option);
	}
	}
	return 0;
	}

	static int task_append_config_data(struct vpn_provider *provider,
	struct connman_task *task)
	{
	const char *option;
	int i;

	for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
	if (!ov_options[i].ov_opt)
	continue;

	option = vpn_provider_get_string(provider,
	ov_options[i].cm_opt);
	if (!option)
	continue;

	if (connman_task_add_argument(task,
	ov_options[i].ov_opt,
	ov_options[i].has_value ? option : NULL) < 0) {
	return -EIO;
	}
	}

	return 0;
	}

	static int ov_connect(struct vpn_provider *provider,
	struct connman_task task, const char if_name,
	vpn_provider_connect_cb_t cb, const char *dbus_sender,
	void *user_data)
	{
	const char *option;
	int err = 0, fd;

	option = vpn_provider_get_string(provider, "Host");
	if (!option) {
	connman_error("Host not set; cannot enable VPN");
	return -EINVAL;
	}

	task_append_config_data(provider, task);

	option = vpn_provider_get_string(provider, "OpenVPN.ConfigFile");
	if (!option) {
	/*
	* Set some default options if user has no config file.
	*/
	option = vpn_provider_get_string(provider, "OpenVPN.TLSAuth");
	if (option) {
	connman_task_add_argument(task, "--tls-auth", option);
	option = vpn_provider_get_string(provider,
	"OpenVPN.TLSAuthDir");
	if (option)
	connman_task_add_argument(task, option, NULL);
	}

	connman_task_add_argument(task, "--nobind", NULL);
	connman_task_add_argument(task, "--persist-key", NULL);
	connman_task_add_argument(task, "--client", NULL);
	}

	connman_task_add_argument(task, "--syslog", NULL);

	connman_task_add_argument(task, "--script-security", "2");

	connman_task_add_argument(task, "--up",
	SCRIPTDIR "/openvpn-script");
	connman_task_add_argument(task, "--up-restart", NULL);

	connman_task_add_argument(task, "--setenv", NULL);
	connman_task_add_argument(task, "CONNMAN_BUSNAME",
	dbus_bus_get_unique_name(connection));

	connman_task_add_argument(task, "--setenv", NULL);
	connman_task_add_argument(task, "CONNMAN_INTERFACE",
	CONNMAN_TASK_INTERFACE);

	connman_task_add_argument(task, "--setenv", NULL);
	connman_task_add_argument(task, "CONNMAN_PATH",
	connman_task_get_path(task));

	connman_task_add_argument(task, "--dev", if_name);
	connman_task_add_argument(task, "--dev-type", "tun");

	connman_task_add_argument(task, "--persist-tun", NULL);

	connman_task_add_argument(task, "--route-noexec", NULL);
	connman_task_add_argument(task, "--ifconfig-noexec", NULL);

	/*
	* Disable client restarts because we can't handle this at the
	* moment. The problem is that when OpenVPN decides to switch
	* from CONNECTED state to RECONNECTING and then to RESOLVE,
	* it is not possible to do a DNS lookup. The DNS server is
	* not accessable through the tunnel anymore and so we end up
	* trying to resolve the OpenVPN servers address.
	*/
	connman_task_add_argument(task, "--ping-restart", "0");

	fd = fileno(stderr);
	err = connman_task_run(task, vpn_died, provider,
	NULL, &fd, &fd);
	if (err < 0) {
	connman_error("openvpn failed to start");
	err = -EIO;
	goto done;
	}

	done:
	if (cb)
	cb(provider, user_data, err);

	return err;
	}

	static struct vpn_driver vpn_driver = {
	.notify = ov_notify,
	.connect = ov_connect,
	.save = ov_save,
	};

	static int openvpn_init(void)
	{
	connection = connman_dbus_get_connection();

	return vpn_register("openvpn", &vpn_driver, OPENVPN);
	}

	static void openvpn_exit(void)
	{
	vpn_unregister("openvpn");

	dbus_connection_unref(connection);
	}

	CONNMAN_PLUGIN_DEFINE(openvpn, "OpenVPN plugin", VERSION,
	CONNMAN_PLUGIN_PRIORITY_DEFAULT, openvpn_init, openvpn_exit)