Imported Upstream version 1.38
[platform/upstream/connman.git] / plugins / vpn.c
index 9aa8f1d..5668c00 100644 (file)
@@ -2,7 +2,7 @@
  *
  *  Connection Manager
  *
- *  Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *  Copyright (C) 2012-2013  Intel Corporation. All rights reserved.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2 as
 #include <connman/dbus.h>
 #include <connman/provider.h>
 #include <connman/ipaddress.h>
+#include <connman/notifier.h>
 #include <connman/vpn-dbus.h>
 #include <connman/inet.h>
+#include <gweb/gresolv.h>
 
 #define DBUS_TIMEOUT 10000
 
 static DBusConnection *connection;
 
 static GHashTable *vpn_connections = NULL;
-static gboolean starting_vpnd = TRUE;
 static guint watch;
 static guint added_watch;
 static guint removed_watch;
@@ -59,24 +60,40 @@ struct vpn_route {
        char *gateway;
 };
 
+struct config_create_data {
+       connection_ready_cb callback;
+       DBusMessage *message;
+       char *path;
+};
+
 struct connection_data {
        char *path;
+       char *ident;
        struct connman_provider *provider;
        int index;
        DBusPendingCall *call;
+       DBusPendingCall *disconnect_call;
+       bool connect_pending;
+       struct config_create_data *cb_data;
+       char *service_ident;
 
        char *state;
        char *type;
        char *name;
        char *host;
+       char **host_ip;
        char *domain;
        char **nameservers;
+       bool immutable;
 
        GHashTable *server_routes;
        GHashTable *user_routes;
        GHashTable *setting_strings;
 
        struct connman_ipaddress *ip;
+
+       GResolv *resolv;
+       guint resolv_id;
 };
 
 static int set_string(struct connman_provider *provider,
@@ -85,22 +102,22 @@ static int set_string(struct connman_provider *provider,
        struct connection_data *data;
 
        data = connman_provider_get_data(provider);
-       if (data == NULL)
+       if (!data)
                return -EINVAL;
 
        DBG("data %p provider %p key %s value %s", data, provider, key, value);
 
-       if (g_str_equal(key, "Type") == TRUE) {
+       if (g_str_equal(key, "Type")) {
                g_free(data->type);
                data->type = g_strdup(value);
-       } else if (g_str_equal(key, "Name") == TRUE) {
+       } else if (g_str_equal(key, "Name")) {
                g_free(data->name);
                data->name = g_strdup(value);
-       } else if (g_str_equal(key, "Host") == TRUE) {
+       } else if (g_str_equal(key, "Host")) {
                g_free(data->host);
                data->host = g_strdup(value);
-       } else if (g_str_equal(key, "VPN.Domain") == TRUE ||
-                               g_str_equal(key, "Domain") == TRUE) {
+       } else if (g_str_equal(key, "VPN.Domain") ||
+                               g_str_equal(key, "Domain")) {
                g_free(data->domain);
                data->domain = g_strdup(value);
        } else
@@ -115,18 +132,24 @@ static const char *get_string(struct connman_provider *provider,
        struct connection_data *data;
 
        data = connman_provider_get_data(provider);
-       if (data == NULL)
+       if (!data)
                return NULL;
 
        DBG("data %p provider %p key %s", data, provider, key);
 
-       if (g_str_equal(key, "Type") == TRUE)
+       if (g_str_equal(key, "Type"))
                return data->type;
-       else if (g_str_equal(key, "Name") == TRUE)
+       else if (g_str_equal(key, "Name"))
                return data->name;
-       else if (g_str_equal(key, "Host") == TRUE)
+       else if (g_str_equal(key, "Host"))
                return data->host;
-       else if (g_str_equal(key, "VPN.Domain") == TRUE)
+       else if (g_str_equal(key, "HostIP")) {
+               if (!data->host_ip ||
+                               !data->host_ip[0])
+                       return data->host;
+               else
+                       return data->host_ip[0];
+       } else if (g_str_equal(key, "VPN.Domain"))
                return data->domain;
 
        return g_hash_table_lookup(data->setting_strings, key);
@@ -140,49 +163,154 @@ static char *get_ident(const char *path)
                return NULL;
 
        pos = strrchr(path, '/');
-       if (pos == NULL)
+       if (!pos)
                return NULL;
 
        return pos + 1;
 }
 
+static void cancel_host_resolv(struct connection_data *data)
+{
+       if (data->resolv_id != 0)
+               g_resolv_cancel_lookup(data->resolv, data->resolv_id);
+
+       data->resolv_id = 0;
+
+       g_resolv_unref(data->resolv);
+       data->resolv = NULL;
+}
+
+static gboolean remove_resolv(gpointer user_data)
+{
+       struct connection_data *data = user_data;
+
+       cancel_host_resolv(data);
+
+       return FALSE;
+}
+
+static void resolv_result(GResolvResultStatus status,
+                                       char **results, gpointer user_data)
+{
+       struct connection_data *data = user_data;
+
+       DBG("status %d", status);
+
+       if (status == G_RESOLV_RESULT_STATUS_SUCCESS && results &&
+                                               g_strv_length(results) > 0) {
+               g_strfreev(data->host_ip);
+               data->host_ip = g_strdupv(results);
+       }
+
+       /*
+        * We cannot unref the resolver here as resolv struct is manipulated
+        * by gresolv.c after we return from this callback.
+        */
+       g_idle_add(remove_resolv, data);
+
+       data->resolv_id = 0;
+}
+
+static void resolv_host_addr(struct connection_data *data)
+{
+       if (!data->host)
+               return;
+
+       if (connman_inet_check_ipaddress(data->host) > 0)
+               return;
+
+       if (data->host_ip)
+               return;
+
+       data->resolv = g_resolv_new(0);
+       if (!data->resolv) {
+               DBG("Cannot resolv %s", data->host);
+               return;
+       }
+
+       DBG("Trying to resolv %s", data->host);
+
+       data->resolv_id = g_resolv_lookup_hostname(data->resolv, data->host,
+                                               resolv_result, data);
+}
+
+static void free_config_cb_data(struct config_create_data *cb_data)
+{
+       if (!cb_data)
+               return;
+
+       g_free(cb_data->path);
+       cb_data->path = NULL;
+
+       if (cb_data->message) {
+               dbus_message_unref(cb_data->message);
+               cb_data->message = NULL;
+       }
+
+       cb_data->callback = NULL;
+
+       g_free(cb_data);
+}
+
+static bool provider_is_connected(struct connection_data *data)
+{
+       return data && (g_str_equal(data->state, "ready") ||
+                       g_str_equal(data->state, "configuration"));
+}
+
 static void set_provider_state(struct connection_data *data)
 {
-       if (g_str_equal(data->state, "ready") == TRUE)
-               connman_provider_set_state(data->provider,
-                                       CONNMAN_PROVIDER_STATE_READY);
-       else if (g_str_equal(data->state, "configuration") == TRUE)
-               connman_provider_set_state(data->provider,
-                                       CONNMAN_PROVIDER_STATE_CONNECT);
-       else if (g_str_equal(data->state, "idle") == TRUE)
-               connman_provider_set_state(data->provider,
-                                       CONNMAN_PROVIDER_STATE_IDLE);
-       else if (g_str_equal(data->state, "disconnect") == TRUE)
-               connman_provider_set_state(data->provider,
-                                       CONNMAN_PROVIDER_STATE_DISCONNECT);
-       else if (g_str_equal(data->state, "failure") == TRUE)
-               connman_provider_set_state(data->provider,
-                                       CONNMAN_PROVIDER_STATE_FAILURE);
-       else
-               connman_provider_set_state(data->provider,
-                                       CONNMAN_PROVIDER_STATE_UNKNOWN);
+       enum connman_provider_state state = CONNMAN_PROVIDER_STATE_UNKNOWN;
+       int err = 0;
+
+       DBG("provider %p new state %s", data->provider, data->state);
+
+       if (!provider_is_connected(data)) {
+               g_free(data->service_ident);
+               data->service_ident = NULL;
+       }
+
+       if (g_str_equal(data->state, "ready")) {
+               state = CONNMAN_PROVIDER_STATE_READY;
+               goto set;
+       } else if (g_str_equal(data->state, "configuration")) {
+               state = CONNMAN_PROVIDER_STATE_CONNECT;
+       } else if (g_str_equal(data->state, "idle")) {
+               state = CONNMAN_PROVIDER_STATE_IDLE;
+       } else if (g_str_equal(data->state, "disconnect")) {
+               err = ECONNREFUSED;
+               state = CONNMAN_PROVIDER_STATE_DISCONNECT;
+               goto set;
+       } else if (g_str_equal(data->state, "failure")) {
+               err = ECONNREFUSED;
+               state = CONNMAN_PROVIDER_STATE_FAILURE;
+               goto set;
+       }
+
+       connman_provider_set_state(data->provider, state);
+       return;
+
+set:
+       if (data->cb_data)
+               data->cb_data->callback(data->cb_data->message,
+                                       err, data->ident);
+
+       connman_provider_set_state(data->provider, state);
+
+       free_config_cb_data(data->cb_data);
+       data->cb_data = NULL;
 }
 
 static int create_provider(struct connection_data *data, void *user_data)
 {
        struct connman_provider_driver *driver = user_data;
-       char *ident;
-       int err = 0;
+       int err;
 
        DBG("%s", data->path);
 
-       ident = g_strdup(get_ident(data->path));
-
-       data->provider = connman_provider_get(ident);
-       if (data->provider == NULL) {
-               err = -ENOMEM;
-               goto out;
-       }
+       data->provider = connman_provider_get(data->ident);
+       if (!data->provider)
+               return -ENOMEM;
 
        DBG("provider %p name %s", data->provider, data->name);
 
@@ -191,10 +319,11 @@ static int create_provider(struct connection_data *data, void *user_data)
 
        err = connman_provider_create_service(data->provider);
        if (err == 0) {
-               if (g_str_equal(data->state, "ready") == TRUE) {
+               connman_provider_set_immutable(data->provider, data->immutable);
+               if (g_str_equal(data->state, "ready")) {
                        connman_provider_set_index(data->provider,
                                                        data->index);
-                       if (data->ip != NULL)
+                       if (data->ip)
                                connman_provider_set_ipaddress(data->provider,
                                                                data->ip);
                }
@@ -202,9 +331,7 @@ static int create_provider(struct connection_data *data, void *user_data)
                set_provider_state(data);
        }
 
-out:
-       g_free(ident);
-       return err;
+       return 0;
 }
 
 static void destroy_route(gpointer user_data)
@@ -222,12 +349,13 @@ static struct connection_data *create_connection_data(const char *path)
        struct connection_data *data;
 
        data = g_try_new0(struct connection_data, 1);
-       if (data == NULL)
+       if (!data)
                return NULL;
 
        DBG("path %s", path);
 
        data->path = g_strdup(path);
+       data->ident = g_strdup(get_ident(path));
        data->index = -1;
 
        data->setting_strings = g_hash_table_new_full(g_str_hash,
@@ -263,19 +391,19 @@ static int extract_ip(DBusMessageIter *array, int family,
                dbus_message_iter_next(&entry);
                dbus_message_iter_recurse(&entry, &value);
 
-               if (g_str_equal(key, "Address") == TRUE) {
+               if (g_str_equal(key, "Address")) {
                        dbus_message_iter_get_basic(&value, &address);
                        DBG("address %s", address);
-               } else if (g_str_equal(key, "Netmask") == TRUE) {
+               } else if (g_str_equal(key, "Netmask")) {
                        dbus_message_iter_get_basic(&value, &netmask);
                        DBG("netmask %s", netmask);
-               } else if (g_str_equal(key, "PrefixLength") == TRUE) {
+               } else if (g_str_equal(key, "PrefixLength")) {
                        dbus_message_iter_get_basic(&value, &netmask);
                        DBG("prefix length %s", netmask);
-               } else if (g_str_equal(key, "Peer") == TRUE) {
+               } else if (g_str_equal(key, "Peer")) {
                        dbus_message_iter_get_basic(&value, &peer);
                        DBG("peer %s", peer);
-               } else if (g_str_equal(key, "Gateway") == TRUE) {
+               } else if (g_str_equal(key, "Gateway")) {
                        dbus_message_iter_get_basic(&value, &gateway);
                        DBG("gateway %s", gateway);
                }
@@ -283,8 +411,9 @@ static int extract_ip(DBusMessageIter *array, int family,
                dbus_message_iter_next(&dict);
        }
 
+       connman_ipaddress_free(data->ip);
        data->ip = connman_ipaddress_alloc(family);
-       if (data->ip == NULL)
+       if (!data->ip)
                return -ENOMEM;
 
        switch (family) {
@@ -321,13 +450,13 @@ static int extract_nameservers(DBusMessageIter *array,
                dbus_message_iter_get_basic(&entry, &nameserver);
 
                nameservers = g_try_renew(char *, nameservers, i + 2);
-               if (nameservers == NULL)
+               if (!nameservers)
                        return -ENOMEM;
 
                DBG("[%d] %s", i, nameserver);
 
                nameservers[i] = g_strdup(nameserver);
-               if (nameservers[i] == NULL)
+               if (!nameservers[i])
                        return -ENOMEM;
 
                nameservers[++i] = NULL;
@@ -341,28 +470,68 @@ static int extract_nameservers(DBusMessageIter *array,
        return 0;
 }
 
+static int errorstr2val(const char *error) {
+       if (g_strcmp0(error, CONNMAN_ERROR_INTERFACE ".InProgress") == 0)
+               return -EINPROGRESS;
+
+       if (g_strcmp0(error, CONNMAN_ERROR_INTERFACE ".AlreadyConnected") == 0)
+               return -EISCONN;
+
+       if (g_strcmp0(error, CONNMAN_ERROR_INTERFACE ".OperationCanceled") == 0)
+               return -ECANCELED;
+
+       return -ECONNREFUSED;
+}
+
 static void connect_reply(DBusPendingCall *call, void *user_data)
 {
        DBusMessage *reply;
        DBusError error;
+       struct connection_data *data = user_data;
+       struct config_create_data *cb_data = data->cb_data;
 
-       if (dbus_pending_call_get_completed(call) == FALSE)
+       if (!dbus_pending_call_get_completed(call))
                return;
 
-       DBG("user_data %p", user_data);
+       if (call != data->call) {
+               connman_error("invalid call %p to VPN connect_reply data %p "
+                                       " call %p ", call, data, data->call);
+               dbus_pending_call_unref(call);
+               return;
+       }
+
+       DBG("user_data %p path %s", user_data, cb_data ? cb_data->path : NULL);
 
        reply = dbus_pending_call_steal_reply(call);
+       if (!reply)
+               goto out;
 
        dbus_error_init(&error);
 
-       if (dbus_set_error_from_message(&error, reply) == TRUE) {
-               if (dbus_error_has_name(&error, CONNMAN_ERROR_INTERFACE
-                                               ".InProgress") == FALSE) {
+       if (dbus_set_error_from_message(&error, reply)) {
+               int err = errorstr2val(error.name);
+
+               /*
+                * ECANCELED means that user has canceled authentication
+                * dialog. That's not really an error, it's part of a normal
+                * workflow. We also take it as a request to turn autoconnect
+                * off, in case if it was on.
+                */
+               if (err == -ECANCELED) {
+                       DBG("%s connect canceled", data->path);
+                       connman_provider_set_autoconnect(data->provider, false);
+               } else if (err != -EINPROGRESS) {
                        connman_error("Connect reply: %s (%s)", error.message,
                                                                error.name);
-                       dbus_error_free(&error);
-                       goto done;
+                       DBG("data %p cb_data %p", data, cb_data);
+
+                       if (cb_data) {
+                               cb_data->callback(cb_data->message, err, NULL);
+                               free_config_cb_data(cb_data);
+                               data->cb_data = NULL;
+                       }
                }
+
                dbus_error_free(&error);
        }
 
@@ -372,39 +541,91 @@ static void connect_reply(DBusPendingCall *call, void *user_data)
         * state.
         */
 
-done:
        dbus_message_unref(reply);
 
-       dbus_pending_call_unref(call);
+out:
+       dbus_pending_call_unref(data->call);
+
+       data->call = NULL;
+       data->connect_pending = false;
 }
 
-static int connect_provider(struct connection_data *data, void *user_data)
+static int connect_provider(struct connection_data *data, void *user_data,
+                       const char *dbus_sender)
 {
        DBusPendingCall *call;
        DBusMessage *message;
+       struct config_create_data *cb_data = user_data;
+       struct connman_service *transport = connman_service_get_default();
 
-       DBG("data %p", data);
+       DBG("data %p user %p path %s sender %s", data, cb_data, data->path,
+                                                               dbus_sender);
+
+       if (!transport) {
+               DBG("no default service, refusing to connect");
+               return -EINVAL;
+       }
+
+       if (data->connect_pending && data->call) {
+               connman_info("connect already pending");
+               return -EALREADY;
+       }
 
+       /* We need to pass original dbus sender to connman-vpnd,
+        * use a Connect2 method for that if the original dbus sender is set.
+        * Connect method requires no parameter, Connect2 requires dbus sender
+        * name to be set.
+        */
        message = dbus_message_new_method_call(VPN_SERVICE, data->path,
                                        VPN_CONNECTION_INTERFACE,
-                                       VPN_CONNECT);
-       if (message == NULL)
+                                       dbus_sender && *dbus_sender ?
+                                               VPN_CONNECT2 : VPN_CONNECT);
+       if (!message)
                return -ENOMEM;
 
-       if (dbus_connection_send_with_reply(connection, message,
-                                       &call, DBUS_TIMEOUT) == FALSE) {
+       if (dbus_sender && *dbus_sender)
+               dbus_message_append_args(message, DBUS_TYPE_STRING,
+                                       &dbus_sender, NULL);
+       else
+               dbus_sender = "";
+
+       if (!dbus_connection_send_with_reply(connection, message,
+                                               &call, DBUS_TIMEOUT)) {
                connman_error("Unable to call %s.%s()",
-                       VPN_CONNECTION_INTERFACE, VPN_CONNECT);
+                       VPN_CONNECTION_INTERFACE, dbus_sender && *dbus_sender ?
+                                               VPN_CONNECT2 : VPN_CONNECT);
                dbus_message_unref(message);
                return -EINVAL;
        }
 
-       if (call == NULL) {
+       if (!call) {
                dbus_message_unref(message);
                return -EINVAL;
        }
 
-       dbus_pending_call_set_notify(call, connect_reply, NULL, NULL);
+       if (data->call) {
+               dbus_pending_call_cancel(data->call);
+               dbus_pending_call_unref(data->call);
+       }
+
+       data->call = call;
+       data->connect_pending = true;
+
+       if (cb_data) {
+               g_free(cb_data->path);
+               cb_data->path = g_strdup(data->path);
+       }
+
+       /*
+        * This is the service which (most likely) will be used
+        * as a transport for VPN connection.
+        */
+       g_free(data->service_ident);
+       data->service_ident =
+               g_strdup(connman_service_get_identifier(transport));
+       DBG("transport %s", data->service_ident);
+
+       dbus_pending_call_set_notify(call, connect_reply, data, NULL);
 
        dbus_message_unref(message);
 
@@ -416,14 +637,25 @@ static void add_connection(const char *path, DBusMessageIter *properties,
 {
        struct connection_data *data;
        int err;
+       char *ident = get_ident(path);
+       bool found = false;
 
-       data = g_hash_table_lookup(vpn_connections, path);
-       if (data != NULL)
-               return;
+       data = g_hash_table_lookup(vpn_connections, ident);
+       if (data) {
+               /*
+                * We might have a dummy connection struct here that
+                * was created by configuration_create_reply() so in
+                * that case just continue.
+                */
+               if (!data->connect_pending)
+                       return;
 
-       data = create_connection_data(path);
-       if (data == NULL)
-               return;
+               found = true;
+       } else {
+               data = create_connection_data(path);
+               if (!data)
+                       return;
+       }
 
        DBG("data %p path %s", data, path);
 
@@ -439,30 +671,40 @@ static void add_connection(const char *path, DBusMessageIter *properties,
                dbus_message_iter_next(&entry);
                dbus_message_iter_recurse(&entry, &value);
 
-               if (g_str_equal(key, "State") == TRUE) {
+               if (g_str_equal(key, "State")) {
                        dbus_message_iter_get_basic(&value, &str);
                        DBG("state %s -> %s", data->state, str);
                        data->state = g_strdup(str);
-               } else if (g_str_equal(key, "IPv4") == TRUE) {
+               } else if (g_str_equal(key, "IPv4")) {
                        extract_ip(&value, AF_INET, data);
-               } else if (g_str_equal(key, "IPv6") == TRUE) {
+               } else if (g_str_equal(key, "IPv6")) {
                        extract_ip(&value, AF_INET6, data);
-               } else if (g_str_equal(key, "Name") == TRUE) {
+               } else if (g_str_equal(key, "Name")) {
                        dbus_message_iter_get_basic(&value, &str);
                        data->name = g_strdup(str);
-               } else if (g_str_equal(key, "Type") == TRUE) {
+               } else if (g_str_equal(key, "Type")) {
                        dbus_message_iter_get_basic(&value, &str);
                        data->type = g_strdup(str);
-               } else if (g_str_equal(key, "Host") == TRUE) {
+               } else if (g_str_equal(key, "Immutable")) {
+                       dbus_bool_t immutable;
+
+                       dbus_message_iter_get_basic(&value, &immutable);
+                       data->immutable = immutable;
+               } else if (g_str_equal(key, "Host")) {
                        dbus_message_iter_get_basic(&value, &str);
                        data->host = g_strdup(str);
-               } else if (g_str_equal(key, "Domain") == TRUE) {
+               } else if (g_str_equal(key, "Domain")) {
                        dbus_message_iter_get_basic(&value, &str);
+                       g_free(data->domain);
                        data->domain = g_strdup(str);
-               } else if (g_str_equal(key, "Nameservers") == TRUE) {
+               } else if (g_str_equal(key, "Nameservers")) {
                        extract_nameservers(&value, data);
-               } else if (g_str_equal(key, "Index") == TRUE) {
+               } else if (g_str_equal(key, "Index")) {
                        dbus_message_iter_get_basic(&value, &data->index);
+               } else if (g_str_equal(key, "ServerRoutes")) {
+                       /* Ignored */
+               } else if (g_str_equal(key, "UserRoutes")) {
+                       /* Ignored */
                } else {
                        if (dbus_message_iter_get_arg_type(&value) ==
                                                        DBUS_TYPE_STRING) {
@@ -477,17 +719,39 @@ static void add_connection(const char *path, DBusMessageIter *properties,
                dbus_message_iter_next(properties);
        }
 
-       g_hash_table_insert(vpn_connections, g_strdup(path), data);
+       if (!found)
+               g_hash_table_insert(vpn_connections, g_strdup(data->ident),
+                                                                       data);
 
        err = create_provider(data, user_data);
        if (err < 0)
                goto out;
 
+       resolv_host_addr(data);
+
+       if (data->nameservers)
+               connman_provider_set_nameservers(data->provider,
+                                               data->nameservers);
+
+       if (data->domain)
+               connman_provider_set_domain(data->provider,
+                                               data->domain);
+
+       if (data->connect_pending) {
+               const char *dbus_sender = NULL;
+
+               if (data->cb_data && data->cb_data->message) {
+                       dbus_sender =
+                               dbus_message_get_sender(data->cb_data->message);
+               }
+               connect_provider(data, data->cb_data, dbus_sender);
+       }
+
        return;
 
 out:
-       DBG("removing %s", path);
-       g_hash_table_remove(vpn_connections, path);
+       DBG("removing %s", data->ident);
+       g_hash_table_remove(vpn_connections, data->ident);
 }
 
 static void get_connections_reply(DBusPendingCall *call, void *user_data)
@@ -505,26 +769,29 @@ static void get_connections_reply(DBusPendingCall *call, void *user_data)
                DBUS_DICT_ENTRY_END_CHAR_AS_STRING
                DBUS_STRUCT_END_CHAR_AS_STRING;
 
+       if (!dbus_pending_call_get_completed(call))
+               return;
+
        DBG("");
 
        reply = dbus_pending_call_steal_reply(call);
 
-       if (dbus_message_has_signature(reply, signature) == FALSE) {
-               connman_error("vpnd signature \"%s\" does not match "
-                                                       "expected \"%s\"",
-                       dbus_message_get_signature(reply), signature);
-               goto done;
-       }
-
        dbus_error_init(&error);
 
-       if (dbus_set_error_from_message(&error, reply) == TRUE) {
+       if (dbus_set_error_from_message(&error, reply)) {
                connman_error("%s", error.message);
                dbus_error_free(&error);
                goto done;
        }
 
-       if (dbus_message_iter_init(reply, &array) == FALSE)
+       if (!dbus_message_has_signature(reply, signature)) {
+               connman_error("vpnd signature \"%s\" does not match "
+                                                       "expected \"%s\"",
+                       dbus_message_get_signature(reply), signature);
+               goto done;
+       }
+
+       if (!dbus_message_iter_init(reply, &array))
                goto done;
 
        dbus_message_iter_recurse(&array, &dict);
@@ -560,18 +827,18 @@ static int get_connections(void *user_data)
        message = dbus_message_new_method_call(VPN_SERVICE, "/",
                                        VPN_MANAGER_INTERFACE,
                                        GET_CONNECTIONS);
-       if (message == NULL)
+       if (!message)
                return -ENOMEM;
 
-       if (dbus_connection_send_with_reply(connection, message,
-                                       &call, DBUS_TIMEOUT) == FALSE) {
+       if (!dbus_connection_send_with_reply(connection, message,
+                                               &call, DBUS_TIMEOUT)) {
                connman_error("Unable to call %s.%s()", VPN_MANAGER_INTERFACE,
                                                        GET_CONNECTIONS);
                dbus_message_unref(message);
                return -EINVAL;
        }
 
-       if (call == NULL) {
+       if (!call) {
                dbus_message_unref(message);
                return -EINVAL;
        }
@@ -594,19 +861,22 @@ static void remove_connection_reply(DBusPendingCall *call, void *user_data)
        DBusMessage *reply;
        DBusError error;
 
+       if (!dbus_pending_call_get_completed(call))
+               return;
+
        DBG("");
 
        reply = dbus_pending_call_steal_reply(call);
 
        dbus_error_init(&error);
 
-       if (dbus_set_error_from_message(&error, reply) == TRUE) {
+       if (dbus_set_error_from_message(&error, reply)) {
                /*
                 * If the returned error is NotFound, it means that we
                 * have actually removed the provider in vpnd already.
                 */
-               if (dbus_error_has_name(&error, CONNMAN_ERROR_INTERFACE
-                                               ".NotFound") == FALSE)
+               if (!dbus_error_has_name(&error,
+                               CONNMAN_ERROR_INTERFACE".NotFound"))
                        connman_error("%s", error.message);
 
                dbus_error_free(&error);
@@ -627,6 +897,14 @@ static int provider_remove(struct connman_provider *provider)
 
        DBG("provider %p data %p", provider, data);
 
+       if (!data) {
+               /*
+                * This means the provider is already removed,
+                * just ignore the dbus in this case.
+                */
+               return -EALREADY;
+       }
+
        /*
         * When provider.c:provider_remove() calls this function,
         * it will remove the provider itself after the call.
@@ -638,21 +916,21 @@ static int provider_remove(struct connman_provider *provider)
        message = dbus_message_new_method_call(VPN_SERVICE, "/",
                                        VPN_MANAGER_INTERFACE,
                                        VPN_REMOVE);
-       if (message == NULL)
+       if (!message)
                return -ENOMEM;
 
        dbus_message_append_args(message, DBUS_TYPE_OBJECT_PATH, &data->path,
                                NULL);
 
-       if (dbus_connection_send_with_reply(connection, message,
-                                       &call, DBUS_TIMEOUT) == FALSE) {
+       if (!dbus_connection_send_with_reply(connection, message,
+                                               &call, DBUS_TIMEOUT)) {
                connman_error("Unable to call %s.%s()", VPN_MANAGER_INTERFACE,
                                                        VPN_REMOVE);
                dbus_message_unref(message);
                return -EINVAL;
        }
 
-       if (call == NULL) {
+       if (!call) {
                dbus_message_unref(message);
                return -EINVAL;
        }
@@ -665,30 +943,31 @@ static int provider_remove(struct connman_provider *provider)
        return 0;
 }
 
-static int provider_connect(struct connman_provider *provider)
+static int provider_connect(struct connman_provider *provider,
+                                       const char *dbus_sender)
 {
        struct connection_data *data;
 
        data = connman_provider_get_data(provider);
-       if (data == NULL)
+       if (!data)
                return -EINVAL;
 
-       return connect_provider(data, NULL);
-
+       return connect_provider(data, NULL, dbus_sender);
 }
 
 static void disconnect_reply(DBusPendingCall *call, void *user_data)
 {
+       struct connection_data *data = user_data;
        DBusMessage *reply;
        DBusError error;
 
-       DBG("");
+       DBG("user %p", user_data);
 
        reply = dbus_pending_call_steal_reply(call);
 
        dbus_error_init(&error);
 
-       if (dbus_set_error_from_message(&error, reply) == TRUE) {
+       if (dbus_set_error_from_message(&error, reply)) {
                connman_error("%s", error.message);
                dbus_error_free(&error);
                goto done;
@@ -696,67 +975,73 @@ static void disconnect_reply(DBusPendingCall *call, void *user_data)
 
 done:
        dbus_message_unref(reply);
-
        dbus_pending_call_unref(call);
+       data->disconnect_call = NULL;
 }
 
 static int disconnect_provider(struct connection_data *data)
 {
-       DBusPendingCall *call;
+       bool sent;
        DBusMessage *message;
 
        DBG("data %p path %s", data, data->path);
 
+       if (data->disconnect_call) {
+               DBG("already disconnecting");
+               return -EINVAL;
+       }
+
        message = dbus_message_new_method_call(VPN_SERVICE, data->path,
                                        VPN_CONNECTION_INTERFACE,
                                        VPN_DISCONNECT);
-       if (message == NULL)
+       if (!message)
                return -ENOMEM;
 
-       if (dbus_connection_send_with_reply(connection, message,
-                                       &call, DBUS_TIMEOUT) == FALSE) {
+       sent = dbus_connection_send_with_reply(connection, message,
+                                       &data->disconnect_call, DBUS_TIMEOUT);
+       dbus_message_unref(message);
+
+       if (!sent || !data->disconnect_call) {
                connman_error("Unable to call %s.%s()",
                        VPN_CONNECTION_INTERFACE, VPN_DISCONNECT);
-               dbus_message_unref(message);
-               return -EINVAL;
-       }
-
-       if (call == NULL) {
-               dbus_message_unref(message);
                return -EINVAL;
        }
 
-       dbus_pending_call_set_notify(call, disconnect_reply, NULL, NULL);
+       dbus_pending_call_set_notify(data->disconnect_call, disconnect_reply,
+                                                               data, NULL);
 
-       dbus_message_unref(message);
+       g_free(data->service_ident);
+       data->service_ident = NULL;
 
        connman_provider_set_state(data->provider,
                                        CONNMAN_PROVIDER_STATE_DISCONNECT);
-       /*
-        * We return 0 here instead of -EINPROGRESS because
-        * __connman_service_disconnect() needs to return something
-        * to gdbus so that gdbus will not call Disconnect() more
-        * than once. This way we do not need to pass the dbus reply
-        * message around the code.
-        */
-       return 0;
+       return -EINPROGRESS;
 }
 
 static int provider_disconnect(struct connman_provider *provider)
 {
+       int err = 0;
+
        struct connection_data *data;
 
        DBG("provider %p", provider);
 
        data = connman_provider_get_data(provider);
-       if (data == NULL)
+       if (!data)
                return -EINVAL;
 
-       if (g_str_equal(data->state, "ready") == TRUE ||
-                       g_str_equal(data->state, "configuration") == TRUE)
-               return disconnect_provider(data);
+       if (provider_is_connected(data))
+               err = disconnect_provider(data);
 
-       return 0;
+       if (data->call) {
+               dbus_pending_call_cancel(data->call);
+               dbus_pending_call_unref(data->call);
+               data->call = NULL;
+       }
+
+       data->connect_pending = false;
+
+       return err;
 }
 
 static void configuration_create_reply(DBusPendingCall *call, void *user_data)
@@ -766,27 +1051,33 @@ static void configuration_create_reply(DBusPendingCall *call, void *user_data)
        DBusMessageIter iter;
        const char *signature = DBUS_TYPE_OBJECT_PATH_AS_STRING;
        const char *path;
+       char *ident;
+       struct connection_data *data;
+       struct config_create_data *cb_data = user_data;
 
-       DBG("user %p", user_data);
+       if (!dbus_pending_call_get_completed(call))
+               return;
 
-       reply = dbus_pending_call_steal_reply(call);
+       DBG("user %p", cb_data);
 
-       if (dbus_message_has_signature(reply, signature) == FALSE) {
-               connman_error("vpn configuration signature \"%s\" does not "
-                                               "match expected \"%s\"",
-                       dbus_message_get_signature(reply), signature);
-               goto done;
-       }
+       reply = dbus_pending_call_steal_reply(call);
 
        dbus_error_init(&error);
 
-       if (dbus_set_error_from_message(&error, reply) == TRUE) {
+       if (dbus_set_error_from_message(&error, reply)) {
                connman_error("dbus error: %s", error.message);
                dbus_error_free(&error);
                goto done;
        }
 
-       if (dbus_message_iter_init(reply, &iter) == FALSE)
+       if (!dbus_message_has_signature(reply, signature)) {
+               connman_error("vpn configuration signature \"%s\" does not "
+                                               "match expected \"%s\"",
+                       dbus_message_get_signature(reply), signature);
+               goto done;
+       }
+
+       if (!dbus_message_iter_init(reply, &iter))
                goto done;
 
        dbus_message_iter_get_basic(&iter, &path);
@@ -794,7 +1085,31 @@ static void configuration_create_reply(DBusPendingCall *call, void *user_data)
        /*
         * Then try to connect the VPN as expected by ConnectProvider API
         */
-       // XXX:
+       ident = get_ident(path);
+
+       data = g_hash_table_lookup(vpn_connections, ident);
+       if (!data) {
+               /*
+                * Someone removed the data. We cannot really continue.
+                */
+               DBG("Pending data not found for %s, cannot continue!", ident);
+       } else {
+               data->call = NULL;
+               data->connect_pending = true;
+
+               if (!data->cb_data)
+                       data->cb_data = cb_data;
+               else
+                       DBG("Connection callback data already in use!");
+
+               /*
+                * Connection is created in add_connections() after
+                * we have received the ConnectionAdded signal.
+                */
+
+               DBG("cb %p msg %p", data->cb_data,
+                       data->cb_data ? data->cb_data->message : NULL);
+       }
 
 done:
        dbus_message_unref(reply);
@@ -824,37 +1139,37 @@ static struct vpn_route *parse_user_route(const char *user_route)
        int family = PF_UNSPEC;
        char **elems = g_strsplit(user_route, "/", 0);
 
-       if (elems == NULL)
+       if (!elems)
                return NULL;
 
        network = elems[0];
-       if (network == NULL || *network == '\0') {
+       if (!network || *network == '\0') {
                DBG("no network/netmask set");
                goto out;
        }
 
        netmask = elems[1];
-       if (netmask != NULL && *netmask == '\0') {
+       if (netmask && *netmask == '\0') {
                DBG("no netmask set");
                goto out;
        }
 
-       if (g_strrstr(network, ":") != NULL)
+       if (g_strrstr(network, ":"))
                family = AF_INET6;
-       else if (g_strrstr(network, ".") != NULL) {
+       else if (g_strrstr(network, ".")) {
                family = AF_INET;
 
-               if (g_strrstr(netmask, ".") == NULL) {
+               if (!g_strrstr(netmask, ".")) {
                        /* We have netmask length */
                        in_addr_t addr;
                        struct in_addr netmask_in;
                        unsigned char prefix_len = 32;
 
-                       if (netmask != NULL) {
+                       if (netmask) {
                                char *ptr;
                                long int value = strtol(netmask, &ptr, 10);
                                if (ptr != netmask && *ptr == '\0' &&
-                                                               value <= 32)
+                                               value && value <= 32)
                                        prefix_len = value;
                        }
 
@@ -867,7 +1182,7 @@ static struct vpn_route *parse_user_route(const char *user_route)
        }
 
        route = g_try_new(struct vpn_route, 1);
-       if (route == NULL)
+       if (!route)
                goto out;
 
        route->network = g_strdup(network);
@@ -894,7 +1209,7 @@ static GSList *get_user_networks(DBusMessageIter *array)
                dbus_message_iter_get_basic(&entry, &val);
 
                route = parse_user_route(val);
-               if (route != NULL)
+               if (route)
                        list = g_slist_prepend(list, route);
 
                dbus_message_iter_next(&entry);
@@ -911,7 +1226,7 @@ static void append_route(DBusMessageIter *iter, void *user_data)
 
        connman_dbus_dict_open(iter, &item);
 
-       if (route == NULL)
+       if (!route)
                goto empty_dict;
 
        if (route->family == AF_INET)
@@ -923,15 +1238,15 @@ static void append_route(DBusMessageIter *iter, void *user_data)
                connman_dbus_dict_append_basic(&item, "ProtocolFamily",
                                        DBUS_TYPE_INT32, &family);
 
-       if (route->network != NULL)
+       if (route->network)
                connman_dbus_dict_append_basic(&item, "Network",
                                        DBUS_TYPE_STRING, &route->network);
 
-       if (route->netmask != NULL)
+       if (route->netmask)
                connman_dbus_dict_append_basic(&item, "Netmask",
                                        DBUS_TYPE_STRING, &route->netmask);
 
-       if (route->gateway != NULL)
+       if (route->gateway)
                connman_dbus_dict_append_basic(&item, "Gateway",
                                        DBUS_TYPE_STRING, &route->gateway);
 
@@ -945,7 +1260,7 @@ static void append_routes(DBusMessageIter *iter, void *user_data)
 
        DBG("routes %p", routes);
 
-       for (list = routes; list != NULL; list = g_slist_next(list)) {
+       for (list = routes; list; list = g_slist_next(list)) {
                DBusMessageIter dict;
                struct vpn_route *route = list->data;
 
@@ -956,9 +1271,9 @@ static void append_routes(DBusMessageIter *iter, void *user_data)
        }
 }
 
-static int create_configuration(DBusMessage *msg)
+static int create_configuration(DBusMessage *msg, connection_ready_cb callback)
 {
-       DBusMessage *new_msg;
+       DBusMessage *new_msg = NULL;
        DBusPendingCall *call;
        DBusMessageIter iter, array, new_iter, new_dict;
        const char *type = NULL, *name = NULL;
@@ -967,6 +1282,7 @@ static int create_configuration(DBusMessage *msg)
        int err = 0;
        dbus_bool_t result;
        struct connection_data *data;
+       struct config_create_data *user_data = NULL;
        GSList *networks = NULL;
 
        /*
@@ -1000,24 +1316,23 @@ static int create_configuration(DBusMessage *msg)
                case DBUS_TYPE_STRING:
                        dbus_message_iter_get_basic(&value, &item_value);
 
-                       if (g_str_equal(key, "Type") == TRUE) {
+                       if (g_str_equal(key, "Type"))
                                type = (const char *)item_value;
-                       } else if (g_str_equal(key, "Name") == TRUE) {
+                       else if (g_str_equal(key, "Name"))
                                name = (const char *)item_value;
-                       } else if (g_str_equal(key, "Host") == TRUE) {
+                       else if (g_str_equal(key, "Host"))
                                host = (const char *)item_value;
-                       } else if (g_str_equal(key, "VPN.Domain") == TRUE) {
+                       else if (g_str_equal(key, "VPN.Domain"))
                                domain = (const char *)item_value;
-                       }
 
                        DBG("%s %s", key, (char *)item_value);
 
-                       if (item_value != NULL)
+                       if (item_value)
                                connman_dbus_dict_append_basic(&new_dict, key,
                                                value_type, &item_value);
                        break;
                case DBUS_TYPE_ARRAY:
-                       if (g_str_equal(key, "Networks") == TRUE) {
+                       if (g_str_equal(key, "Networks")) {
                                networks = get_user_networks(&value);
                                connman_dbus_dict_append_array(&new_dict,
                                                        "UserRoutes",
@@ -1036,12 +1351,12 @@ static int create_configuration(DBusMessage *msg)
        DBG("VPN type %s name %s host %s domain %s networks %p",
                type, name, host, domain, networks);
 
-       if (host == NULL || domain == NULL) {
+       if (!host || !domain) {
                err = -EINVAL;
                goto done;
        }
 
-       if (type == NULL || name == NULL) {
+       if (!type || !name) {
                err = -EOPNOTSUPP;
                goto done;
        }
@@ -1052,15 +1367,19 @@ static int create_configuration(DBusMessage *msg)
        DBG("ident %s", ident);
 
        data = g_hash_table_lookup(vpn_connections, ident);
-       if (data != NULL) {
-               if (data->call != NULL) {
-                       connman_error("Dbus call already pending");
+       if (data) {
+               if (data->call || data->cb_data) {
+                       DBG("create configuration call already pending");
                        err = -EINPROGRESS;
                        goto done;
                }
        } else {
-               data = create_connection_data(ident);
-               if (data == NULL) {
+               char *path = g_strdup_printf("%s/connection/%s", VPN_PATH,
+                                                               ident);
+               data = create_connection_data(path);
+               g_free(path);
+
+               if (!data) {
                        err = -ENOMEM;
                        goto done;
                }
@@ -1080,30 +1399,68 @@ static int create_configuration(DBusMessage *msg)
        dbus_message_set_sender(new_msg, me);
        dbus_message_set_member(new_msg, "Create");
 
+       user_data = g_try_new0(struct config_create_data, 1);
+       if (!user_data) {
+               err = -ENOMEM;
+               goto done;
+       }
+
+       user_data->callback = callback;
+       user_data->message = dbus_message_ref(msg);
+       user_data->path = NULL;
+
+       DBG("cb %p msg %p", user_data, msg);
+
        result = dbus_connection_send_with_reply(connection, new_msg,
                                                &call, DBUS_TIMEOUT);
-       if (result == FALSE || call == NULL) {
+       if (!result || !call) {
                err = -EIO;
                goto done;
        }
 
        dbus_pending_call_set_notify(call, configuration_create_reply,
-                                                               NULL, NULL);
+                                                       user_data, NULL);
        data->call = call;
 
 done:
-       dbus_message_unref(new_msg);
+       if (new_msg)
+               dbus_message_unref(new_msg);
 
-       if (networks != NULL)
+       if (networks)
                g_slist_free_full(networks, destroy_route);
 
-
        g_free(me);
        return err;
 }
 
+static bool check_host(char **hosts, char *host)
+{
+       int i;
+
+       if (!hosts)
+               return false;
+
+       for (i = 0; hosts[i]; i++) {
+               if (g_strcmp0(hosts[i], host) == 0)
+                       return true;
+       }
+
+       return false;
+}
+
 static void set_route(struct connection_data *data, struct vpn_route *route)
 {
+       /*
+        * If the VPN administrator/user has given a route to
+        * VPN server, then we must discard that because the
+        * server cannot be contacted via VPN tunnel.
+        */
+       if (check_host(data->host_ip, route->network)) {
+               DBG("Discarding VPN route to %s via %s at index %d",
+                       route->network, route->gateway, data->index);
+               return;
+       }
+
        if (route->family == AF_INET6) {
                unsigned char prefix_len = atoi(route->netmask);
 
@@ -1128,14 +1485,14 @@ static int set_routes(struct connman_provider *provider,
        DBG("provider %p", provider);
 
        data = connman_provider_get_data(provider);
-       if (data == NULL)
+       if (!data)
                return -EINVAL;
 
        if (type == CONNMAN_PROVIDER_ROUTE_ALL ||
                                        type == CONNMAN_PROVIDER_ROUTE_USER) {
                g_hash_table_iter_init(&iter, data->user_routes);
 
-               while (g_hash_table_iter_next(&iter, &key, &value) == TRUE)
+               while (g_hash_table_iter_next(&iter, &key, &value))
                        set_route(data, value);
        }
 
@@ -1143,32 +1500,32 @@ static int set_routes(struct connman_provider *provider,
                                type == CONNMAN_PROVIDER_ROUTE_SERVER) {
                g_hash_table_iter_init(&iter, data->server_routes);
 
-               while (g_hash_table_iter_next(&iter, &key, &value) == TRUE)
+               while (g_hash_table_iter_next(&iter, &key, &value))
                        set_route(data, value);
        }
 
        return 0;
 }
 
-static connman_bool_t check_routes(struct connman_provider *provider)
+static bool check_routes(struct connman_provider *provider)
 {
        struct connection_data *data;
 
        DBG("provider %p", provider);
 
        data = connman_provider_get_data(provider);
-       if (data == NULL)
-               return FALSE;
+       if (!data)
+               return false;
 
-       if (data->user_routes != NULL &&
+       if (data->user_routes &&
                        g_hash_table_size(data->user_routes) > 0)
-               return TRUE;
+               return true;
 
-       if (data->server_routes != NULL &&
+       if (data->server_routes &&
                        g_hash_table_size(data->server_routes) > 0)
-               return TRUE;
+               return true;
 
-       return FALSE;
+       return false;
 }
 
 static struct connman_provider_driver provider_driver = {
@@ -1189,15 +1546,11 @@ static void destroy_provider(struct connection_data *data)
 {
        DBG("data %p", data);
 
-       if (g_str_equal(data->state, "ready") == TRUE ||
-                       g_str_equal(data->state, "configuration") == TRUE)
+       if (provider_is_connected(data))
                connman_provider_disconnect(data->provider);
 
-       if (data->call != NULL)
-               dbus_pending_call_cancel(data->call);
-
-       connman_provider_put(data->provider);
-
+       connman_provider_set_data(data->provider, NULL);
+       connman_provider_remove(data->provider);
        data->provider = NULL;
 }
 
@@ -1207,14 +1560,27 @@ static void connection_destroy(gpointer hash_data)
 
        DBG("data %p", data);
 
-       if (data->provider != NULL)
+       if (data->provider)
                destroy_provider(data);
 
+       if (data->call) {
+               dbus_pending_call_cancel(data->call);
+               dbus_pending_call_unref(data->call);
+       }
+
+       if (data->disconnect_call) {
+               dbus_pending_call_cancel(data->disconnect_call);
+               dbus_pending_call_unref(data->disconnect_call);
+       }
+
+       g_free(data->service_ident);
        g_free(data->path);
+       g_free(data->ident);
        g_free(data->state);
        g_free(data->type);
        g_free(data->name);
        g_free(data->host);
+       g_strfreev(data->host_ip);
        g_free(data->domain);
        g_hash_table_destroy(data->server_routes);
        g_hash_table_destroy(data->user_routes);
@@ -1222,6 +1588,8 @@ static void connection_destroy(gpointer hash_data)
        g_hash_table_destroy(data->setting_strings);
        connman_ipaddress_free(data->ip);
 
+       cancel_host_resolv(data);
+
        g_free(data);
 }
 
@@ -1229,29 +1597,21 @@ static void vpnd_created(DBusConnection *conn, void *user_data)
 {
        DBG("connection %p", conn);
 
-       if (starting_vpnd == TRUE) {
-               vpn_connections = g_hash_table_new_full(g_str_hash,
-                                               g_str_equal,
-                                               g_free, connection_destroy);
-               get_connections(user_data);
-               starting_vpnd = FALSE;
-       }
+       get_connections(user_data);
 }
 
 static void vpnd_removed(DBusConnection *conn, void *user_data)
 {
        DBG("connection %p", conn);
 
-       g_hash_table_destroy(vpn_connections);
-       vpn_connections = NULL;
-       starting_vpnd = TRUE;
+       g_hash_table_remove_all(vpn_connections);
 }
 
 static void remove_connection(DBusConnection *conn, const char *path)
 {
        DBG("path %s", path);
 
-       g_hash_table_remove(vpn_connections, path);
+       g_hash_table_remove(vpn_connections, get_ident(path));
 }
 
 static gboolean connection_removed(DBusConnection *conn, DBusMessage *message,
@@ -1259,8 +1619,9 @@ static gboolean connection_removed(DBusConnection *conn, DBusMessage *message,
 {
        const char *path;
        const char *signature = DBUS_TYPE_OBJECT_PATH_AS_STRING;
+       struct connection_data *data;
 
-       if (dbus_message_has_signature(message, signature) == FALSE) {
+       if (!dbus_message_has_signature(message, signature)) {
                connman_error("vpn removed signature \"%s\" does not match "
                                                        "expected \"%s\"",
                        dbus_message_get_signature(message), signature);
@@ -1269,7 +1630,11 @@ static gboolean connection_removed(DBusConnection *conn, DBusMessage *message,
 
        dbus_message_get_args(message, NULL, DBUS_TYPE_OBJECT_PATH, &path,
                                DBUS_TYPE_INVALID);
-       remove_connection(conn, path);
+
+       data = g_hash_table_lookup(vpn_connections, get_ident(path));
+       if (data)
+               remove_connection(conn, path);
+
        return TRUE;
 }
 
@@ -1285,7 +1650,7 @@ static gboolean connection_added(DBusConnection *conn, DBusMessage *message,
                DBUS_TYPE_VARIANT_AS_STRING
                DBUS_DICT_ENTRY_END_CHAR_AS_STRING;
 
-       if (dbus_message_has_signature(message, signature) == FALSE) {
+       if (!dbus_message_has_signature(message, signature)) {
                connman_error("vpn ConnectionAdded signature \"%s\" does not "
                                                "match expected \"%s\"",
                        dbus_message_get_signature(message), signature);
@@ -1294,7 +1659,7 @@ static gboolean connection_added(DBusConnection *conn, DBusMessage *message,
 
        DBG("");
 
-       if (dbus_message_iter_init(message, &iter) == FALSE)
+       if (!dbus_message_iter_init(message, &iter))
                return TRUE;
 
        dbus_message_iter_get_basic(&iter, &path);
@@ -1316,9 +1681,9 @@ static int save_route(GHashTable *routes, int family, const char *network,
        DBG("family %d network %s netmask %s", family, network, netmask);
 
        route = g_hash_table_lookup(routes, key);
-       if (route == NULL) {
+       if (!route) {
                route = g_try_new0(struct vpn_route, 1);
-               if (route == NULL) {
+               if (!route) {
                        connman_error("out of memory");
                        return -ENOMEM;
                }
@@ -1357,7 +1722,7 @@ static int read_route_dict(GHashTable *routes, DBusMessageIter *dicts)
                dbus_message_iter_next(&entry);
                dbus_message_iter_recurse(&entry, &value);
 
-               if (g_str_equal(key, "ProtocolFamily") == TRUE) {
+               if (g_str_equal(key, "ProtocolFamily")) {
                        int pf;
                        dbus_message_iter_get_basic(&value, &pf);
                        switch (pf) {
@@ -1369,13 +1734,13 @@ static int read_route_dict(GHashTable *routes, DBusMessageIter *dicts)
                                break;
                        }
                        DBG("family %d", family);
-               } else if (g_str_equal(key, "Netmask") == TRUE) {
+               } else if (g_str_equal(key, "Netmask")) {
                        dbus_message_iter_get_basic(&value, &netmask);
                        DBG("netmask %s", netmask);
-               } else if (g_str_equal(key, "Network") == TRUE) {
+               } else if (g_str_equal(key, "Network")) {
                        dbus_message_iter_get_basic(&value, &network);
                        DBG("host %s", network);
-               } else if (g_str_equal(key, "Gateway") == TRUE) {
+               } else if (g_str_equal(key, "Gateway")) {
                        dbus_message_iter_get_basic(&value, &gateway);
                        DBG("gateway %s", gateway);
                }
@@ -1383,7 +1748,7 @@ static int read_route_dict(GHashTable *routes, DBusMessageIter *dicts)
                dbus_message_iter_next(&dict);
        }
 
-       if (netmask == NULL || network == NULL || gateway == NULL) {
+       if (!netmask || !network || !gateway) {
                DBG("Value missing.");
                return -EINVAL;
        }
@@ -1435,25 +1800,25 @@ static gboolean property_changed(DBusConnection *conn,
        const char *path = dbus_message_get_path(message);
        struct connection_data *data = NULL;
        DBusMessageIter iter, value;
-       connman_bool_t ip_set = FALSE;
+       bool ip_set = false;
        int err;
        char *str;
        const char *key;
        const char *signature = DBUS_TYPE_STRING_AS_STRING
                DBUS_TYPE_VARIANT_AS_STRING;
 
-       if (dbus_message_has_signature(message, signature) == FALSE) {
+       if (!dbus_message_has_signature(message, signature)) {
                connman_error("vpn property signature \"%s\" does not match "
                                                        "expected \"%s\"",
                        dbus_message_get_signature(message), signature);
                return TRUE;
        }
 
-       data = g_hash_table_lookup(vpn_connections, path);
-       if (data == NULL)
+       data = g_hash_table_lookup(vpn_connections, get_ident(path));
+       if (!data)
                return TRUE;
 
-       if (dbus_message_iter_init(message, &iter) == FALSE)
+       if (!dbus_message_iter_init(message, &iter))
                return TRUE;
 
        dbus_message_iter_get_basic(&iter, &key);
@@ -1463,28 +1828,28 @@ static gboolean property_changed(DBusConnection *conn,
 
        DBG("key %s", key);
 
-       if (g_str_equal(key, "State") == TRUE) {
+       if (g_str_equal(key, "State")) {
                dbus_message_iter_get_basic(&value, &str);
 
                DBG("%s %s -> %s", data->path, data->state, str);
 
-               if (g_str_equal(data->state, str) == TRUE)
+               if (g_str_equal(data->state, str))
                        return TRUE;
 
                g_free(data->state);
                data->state = g_strdup(str);
 
                set_provider_state(data);
-       } else if (g_str_equal(key, "Index") == TRUE) {
+       } else if (g_str_equal(key, "Index")) {
                dbus_message_iter_get_basic(&value, &data->index);
                connman_provider_set_index(data->provider, data->index);
-       } else if (g_str_equal(key, "IPv4") == TRUE) {
+       } else if (g_str_equal(key, "IPv4")) {
                err = extract_ip(&value, AF_INET, data);
-               ip_set = TRUE;
-       } else if (g_str_equal(key, "IPv6") == TRUE) {
+               ip_set = true;
+       } else if (g_str_equal(key, "IPv6")) {
                err = extract_ip(&value, AF_INET6, data);
-               ip_set = TRUE;
-       } else if (g_str_equal(key, "ServerRoutes") == TRUE) {
+               ip_set = true;
+       } else if (g_str_equal(key, "ServerRoutes")) {
                err = routes_changed(&value, data->server_routes);
                /*
                 * Note that the vpnd will delay the route sending a bit
@@ -1496,16 +1861,24 @@ static gboolean property_changed(DBusConnection *conn,
                if (err == 0)
                        set_routes(data->provider,
                                                CONNMAN_PROVIDER_ROUTE_SERVER);
-       } else if (g_str_equal(key, "UserRoutes") == TRUE) {
+       } else if (g_str_equal(key, "UserRoutes")) {
                err = routes_changed(&value, data->user_routes);
                if (err == 0)
                        set_routes(data->provider,
                                                CONNMAN_PROVIDER_ROUTE_USER);
-       } else if (g_str_equal(key, "Nameservers") == TRUE) {
-               extract_nameservers(&value, data);
+       } else if (g_str_equal(key, "Nameservers")) {
+               if (extract_nameservers(&value, data) == 0 &&
+                                               data->nameservers)
+                       connman_provider_set_nameservers(data->provider,
+                                                       data->nameservers);
+       } else if (g_str_equal(key, "Domain")) {
+               dbus_message_iter_get_basic(&value, &str);
+               g_free(data->domain);
+               data->domain = g_strdup(str);
+               connman_provider_set_domain(data->provider, data->domain);
        }
 
-       if (ip_set == TRUE && err == 0) {
+       if (ip_set && err == 0) {
                err = connman_provider_set_ipaddress(data->provider, data->ip);
                if (err < 0)
                        DBG("setting provider IP address failed (%s/%d)",
@@ -1515,12 +1888,127 @@ static gboolean property_changed(DBusConnection *conn,
        return TRUE;
 }
 
+static int vpn_find_online_transport_cb(struct connman_service *service,
+                                                       void *user_data)
+{
+       if (connman_service_get_type(service) != CONNMAN_SERVICE_TYPE_VPN) {
+               switch (connman_service_get_state(service)) {
+               case CONNMAN_SERVICE_STATE_ONLINE:
+                       *((struct connman_service**)user_data) = service;
+                       return 1;
+               default:
+                       break;
+               }
+       }
+
+       return 0;
+}
+
+static struct connman_service *vpn_find_online_transport()
+{
+       struct connman_service *service = NULL;
+
+       connman_service_iterate_services(vpn_find_online_transport_cb,
+                                                               &service);
+       return service;
+}
+
+static bool vpn_is_valid_transport(struct connman_service *transport)
+{
+       if (transport) {
+               struct connman_service *online;
+
+               switch (connman_service_get_state(transport)) {
+               case CONNMAN_SERVICE_STATE_READY:
+                       online = vpn_find_online_transport();
+
+                       /* Stay connected if there are no online services */
+                       if (!online)
+                               return true;
+
+                       DBG("%s is ready, %s is online, disconnecting",
+                               connman_service_get_identifier(transport),
+                               connman_service_get_identifier(online));
+                       break;
+
+               case CONNMAN_SERVICE_STATE_ONLINE:
+                       online = vpn_find_online_transport();
+
+                       /* Check if our transport is still the default */
+                       if (online == transport)
+                               return true;
+
+                       DBG("%s is replaced by %s as default, disconnecting",
+                               connman_service_get_identifier(transport),
+                               connman_service_get_identifier(online));
+                       break;
+
+               default:
+                       break;
+               }
+       } else {
+               DBG("transport gone");
+       }
+
+       return false;
+}
+
+static void vpn_disconnect_check_provider(struct connection_data *data)
+{
+       if (provider_is_connected(data)) {
+               /* With NULL service ident NULL is returned immediately */
+               struct connman_service *service =
+                       connman_service_lookup_from_identifier
+                                               (data->service_ident);
+
+               if (!vpn_is_valid_transport(service)) {
+                       connman_provider_disconnect(data->provider);
+               }
+       }
+}
+
+static void vpn_disconnect_check()
+{
+       GHashTableIter iter;
+       gpointer value;
+
+       DBG("");
+       g_hash_table_iter_init(&iter, vpn_connections);
+       while (g_hash_table_iter_next(&iter, NULL, &value))
+               vpn_disconnect_check_provider(value);
+}
+
+static void vpn_service_add(struct connman_service *service, const char *name)
+{
+       vpn_disconnect_check();
+}
+
+static void vpn_service_list_changed(struct connman_service *service)
+{
+       vpn_disconnect_check();
+}
+
+static void vpn_service_state_changed(struct connman_service *service,
+                                       enum connman_service_state state)
+{
+       vpn_disconnect_check();
+}
+
+static const struct connman_notifier vpn_notifier = {
+       .name                   = "vpn",
+       .priority               = CONNMAN_NOTIFIER_PRIORITY_DEFAULT,
+       .default_changed        = vpn_service_list_changed,
+       .service_add            = vpn_service_add,
+       .service_remove         = vpn_service_list_changed,
+       .service_state_changed  = vpn_service_state_changed
+};
+
 static int vpn_init(void)
 {
        int err;
 
        connection = connman_dbus_get_connection();
-       if (connection == NULL)
+       if (!connection)
                return -EIO;
 
        watch = g_dbus_add_service_watch(connection, VPN_SERVICE,
@@ -1547,9 +2035,15 @@ static int vpn_init(void)
        }
 
        err = connman_provider_driver_register(&provider_driver);
-       if (err == 0)
+       if (err == 0) {
+               vpn_connections = g_hash_table_new_full(g_str_hash,
+                                               g_str_equal,
+                                               g_free, connection_destroy);
+
                vpnd_created(connection, &provider_driver);
+       }
 
+       connman_notifier_register(&vpn_notifier);
        return err;
 
 remove:
@@ -1570,9 +2064,11 @@ static void vpn_exit(void)
        g_dbus_remove_watch(connection, removed_watch);
        g_dbus_remove_watch(connection, property_watch);
 
+       connman_notifier_unregister(&vpn_notifier);
        connman_provider_driver_unregister(&provider_driver);
 
-       g_hash_table_destroy(vpn_connections);
+       if (vpn_connections)
+               g_hash_table_destroy(vpn_connections);
 
        dbus_connection_unref(connection);
 }