chromeos/network/managed_network_configuration_handler_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/managed_network_configuration_handler_impl.h"
   6
   7 #include <vector>
   8
   9 #include "base/bind.h"
  10 #include "base/guid.h"
  11 #include "base/location.h"
  12 #include "base/logging.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "base/message_loop/message_loop.h"
  15 #include "base/stl_util.h"
  16 #include "base/values.h"
  17 #include "chromeos/dbus/shill_manager_client.h"
  18 #include "chromeos/dbus/shill_profile_client.h"
  19 #include "chromeos/dbus/shill_service_client.h"
  20 #include "chromeos/network/device_state.h"
  21 #include "chromeos/network/network_configuration_handler.h"
  22 #include "chromeos/network/network_device_handler.h"
  23 #include "chromeos/network/network_event_log.h"
  24 #include "chromeos/network/network_policy_observer.h"
  25 #include "chromeos/network/network_profile.h"
  26 #include "chromeos/network/network_profile_handler.h"
  27 #include "chromeos/network/network_state.h"
  28 #include "chromeos/network/network_state_handler.h"
  29 #include "chromeos/network/network_ui_data.h"
  30 #include "chromeos/network/network_util.h"
  31 #include "chromeos/network/onc/onc_merger.h"
  32 #include "chromeos/network/onc/onc_signature.h"
  33 #include "chromeos/network/onc/onc_translator.h"
  34 #include "chromeos/network/onc/onc_utils.h"
  35 #include "chromeos/network/onc/onc_validator.h"
  36 #include "chromeos/network/policy_util.h"
  37 #include "chromeos/network/shill_property_util.h"
  38 #include "components/onc/onc_constants.h"
  39 #include "third_party/cros_system_api/dbus/service_constants.h"
  40
  41 namespace chromeos {
  42
  43 namespace {
  44
  45 using GuidToPolicyMap = ManagedNetworkConfigurationHandler::GuidToPolicyMap;
  46
  47 // These are error strings used for error callbacks. None of these error
  48 // messages are user-facing: they should only appear in logs.
  49 const char kInvalidUserSettings[] = "InvalidUserSettings";
  50 const char kNetworkAlreadyConfigured[] = "NetworkAlreadyConfigured";
  51 const char kPoliciesNotInitialized[] = "PoliciesNotInitialized";
  52 const char kProfileNotInitialized[] = "ProfileNotInitialized";
  53 const char kUnconfiguredNetwork[] = "UnconfiguredNetwork";
  54 const char kUnknownNetwork[] = "UnknownNetwork";
  55
  56 std::string ToDebugString(::onc::ONCSource source,
  57                           const std::string& userhash) {
  58   return source == ::onc::ONC_SOURCE_USER_POLICY ?
  59       ("user policy of " + userhash) : "device policy";
  60 }
  61
  62 void InvokeErrorCallback(const std::string& service_path,
  63                          const network_handler::ErrorCallback& error_callback,
  64                          const std::string& error_name) {
  65   std::string error_msg = "ManagedConfig Error: " + error_name;
  66   NET_LOG_ERROR(error_msg, service_path);
  67   network_handler::RunErrorCallback(
  68       error_callback, service_path, error_name, error_msg);
  69 }
  70
  71 void LogErrorWithDict(const tracked_objects::Location& from_where,
  72                       const std::string& error_name,
  73                       scoped_ptr<base::DictionaryValue> error_data) {
  74   device_event_log::AddEntry(from_where.file_name(), from_where.line_number(),
  75                              device_event_log::LOG_TYPE_NETWORK,
  76                              device_event_log::LOG_LEVEL_ERROR, error_name);
  77 }
  78
  79 const base::DictionaryValue* GetByGUID(const GuidToPolicyMap& policies,
  80                                        const std::string& guid) {
  81   GuidToPolicyMap::const_iterator it = policies.find(guid);
  82   if (it == policies.end())
  83     return NULL;
  84   return it->second;
  85 }
  86
  87 }  // namespace
  88
  89 struct ManagedNetworkConfigurationHandlerImpl::Policies {
  90   ~Policies();
  91
  92   GuidToPolicyMap per_network_config;
  93   base::DictionaryValue global_network_config;
  94 };
  95
  96 ManagedNetworkConfigurationHandlerImpl::Policies::~Policies() {
  97   STLDeleteValues(&per_network_config);
  98 }
  99
 100 void ManagedNetworkConfigurationHandlerImpl::AddObserver(
 101     NetworkPolicyObserver* observer) {
 102   observers_.AddObserver(observer);
 103 }
 104
 105 void ManagedNetworkConfigurationHandlerImpl::RemoveObserver(
 106     NetworkPolicyObserver* observer) {
 107   observers_.RemoveObserver(observer);
 108 }
 109
 110 // GetManagedProperties
 111
 112 void ManagedNetworkConfigurationHandlerImpl::GetManagedProperties(
 113     const std::string& userhash,
 114     const std::string& service_path,
 115     const network_handler::DictionaryResultCallback& callback,
 116     const network_handler::ErrorCallback& error_callback) {
 117   if (!GetPoliciesForUser(userhash) || !GetPoliciesForUser(std::string())) {
 118     InvokeErrorCallback(service_path, error_callback, kPoliciesNotInitialized);
 119     return;
 120   }
 121   NET_LOG_USER("GetManagedProperties", service_path);
 122   network_configuration_handler_->GetShillProperties(
 123       service_path,
 124       base::Bind(
 125           &ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback,
 126           weak_ptr_factory_.GetWeakPtr(),
 127           base::Bind(
 128               &ManagedNetworkConfigurationHandlerImpl::SendManagedProperties,
 129               weak_ptr_factory_.GetWeakPtr(), userhash, callback,
 130               error_callback)),
 131       error_callback);
 132 }
 133
 134 void ManagedNetworkConfigurationHandlerImpl::SendManagedProperties(
 135     const std::string& userhash,
 136     const network_handler::DictionaryResultCallback& callback,
 137     const network_handler::ErrorCallback& error_callback,
 138     const std::string& service_path,
 139     scoped_ptr<base::DictionaryValue> shill_properties) {
 140   std::string profile_path;
 141   shill_properties->GetStringWithoutPathExpansion(shill::kProfileProperty,
 142                                                   &profile_path);
 143   const NetworkProfile* profile =
 144       network_profile_handler_->GetProfileForPath(profile_path);
 145   if (!profile)
 146     NET_LOG_ERROR("No profile for service: " + profile_path, service_path);
 147
 148   scoped_ptr<NetworkUIData> ui_data =
 149       shill_property_util::GetUIDataFromProperties(*shill_properties);
 150
 151   const base::DictionaryValue* user_settings = NULL;
 152
 153   if (ui_data && profile) {
 154     user_settings = ui_data->user_settings();
 155   } else if (profile) {
 156     NET_LOG_ERROR("Service contains empty or invalid UIData", service_path);
 157     // TODO(pneubeck): add a conversion of user configured entries of old
 158     // ChromeOS versions. We will have to use a heuristic to determine which
 159     // properties _might_ be user configured.
 160   }
 161
 162   std::string guid;
 163   shill_properties->GetStringWithoutPathExpansion(shill::kGuidProperty, &guid);
 164
 165   ::onc::ONCSource onc_source;
 166   FindPolicyByGUID(userhash, guid, &onc_source);
 167   scoped_ptr<base::DictionaryValue> active_settings(
 168       onc::TranslateShillServiceToONCPart(
 169           *shill_properties, onc_source, &onc::kNetworkWithStateSignature));
 170
 171   const base::DictionaryValue* network_policy = NULL;
 172   const base::DictionaryValue* global_policy = NULL;
 173   if (profile) {
 174     const Policies* policies = GetPoliciesForProfile(*profile);
 175     if (!policies) {
 176       InvokeErrorCallback(
 177           service_path, error_callback, kPoliciesNotInitialized);
 178       return;
 179     }
 180     if (!guid.empty())
 181       network_policy = GetByGUID(policies->per_network_config, guid);
 182     global_policy = &policies->global_network_config;
 183   }
 184
 185   scoped_ptr<base::DictionaryValue> augmented_properties(
 186       policy_util::CreateManagedONC(global_policy,
 187                                     network_policy,
 188                                     user_settings,
 189                                     active_settings.get(),
 190                                     profile));
 191   callback.Run(service_path, *augmented_properties);
 192 }
 193
 194 // GetProperties
 195
 196 void ManagedNetworkConfigurationHandlerImpl::GetProperties(
 197     const std::string& service_path,
 198     const network_handler::DictionaryResultCallback& callback,
 199     const network_handler::ErrorCallback& error_callback) {
 200   NET_LOG_USER("GetProperties", service_path);
 201   network_configuration_handler_->GetShillProperties(
 202       service_path,
 203       base::Bind(
 204           &ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback,
 205           weak_ptr_factory_.GetWeakPtr(),
 206           base::Bind(&ManagedNetworkConfigurationHandlerImpl::SendProperties,
 207                      weak_ptr_factory_.GetWeakPtr(), callback, error_callback)),
 208       error_callback);
 209 }
 210
 211 void ManagedNetworkConfigurationHandlerImpl::SendProperties(
 212     const network_handler::DictionaryResultCallback& callback,
 213     const network_handler::ErrorCallback& error_callback,
 214     const std::string& service_path,
 215     scoped_ptr<base::DictionaryValue> shill_properties) {
 216   scoped_ptr<base::DictionaryValue> onc_network(
 217       onc::TranslateShillServiceToONCPart(
 218           *shill_properties, ::onc::ONC_SOURCE_UNKNOWN,
 219           &onc::kNetworkWithStateSignature));
 220   callback.Run(service_path, *onc_network);
 221 }
 222
 223 // SetProperties
 224
 225 void ManagedNetworkConfigurationHandlerImpl::SetProperties(
 226     const std::string& service_path,
 227     const base::DictionaryValue& user_settings,
 228     const base::Closure& callback,
 229     const network_handler::ErrorCallback& error_callback) {
 230   const NetworkState* state =
 231       network_state_handler_->GetNetworkStateFromServicePath(
 232           service_path, true /* configured_only */);
 233   if (!state) {
 234     InvokeErrorCallback(service_path, error_callback, kUnknownNetwork);
 235     return;
 236   }
 237
 238   std::string guid = state->guid();
 239   DCHECK(!guid.empty());
 240
 241   const std::string& profile_path = state->profile_path();
 242   const NetworkProfile *profile =
 243       network_profile_handler_->GetProfileForPath(profile_path);
 244   if (!profile) {
 245     // TODO(pneubeck): create an initial configuration in this case. As for
 246     // CreateConfiguration, user settings from older ChromeOS versions have to
 247     // be determined here.
 248     InvokeErrorCallback(service_path, error_callback, kUnconfiguredNetwork);
 249     return;
 250   }
 251
 252   VLOG(2) << "SetProperties: Found GUID " << guid << " and profile "
 253           << profile->ToDebugString();
 254
 255   const Policies* policies = GetPoliciesForProfile(*profile);
 256   if (!policies) {
 257     InvokeErrorCallback(service_path, error_callback, kPoliciesNotInitialized);
 258     return;
 259   }
 260
 261   // We need to ensure that required configuration properties (e.g. Type) are
 262   // included for ONC validation and translation to Shill properties.
 263   scoped_ptr<base::DictionaryValue> user_settings_copy(
 264       user_settings.DeepCopy());
 265   user_settings_copy->SetStringWithoutPathExpansion(
 266       ::onc::network_config::kType,
 267       network_util::TranslateShillTypeToONC(state->type()));
 268   user_settings_copy->MergeDictionary(&user_settings);
 269
 270   // Validate the ONC dictionary. We are liberal and ignore unknown field
 271   // names. User settings are only partial ONC, thus we ignore missing fields.
 272   onc::Validator validator(false,  // Ignore unknown fields.
 273                            false,  // Ignore invalid recommended field names.
 274                            false,  // Ignore missing fields.
 275                            false);  // This ONC does not come from policy.
 276
 277   onc::Validator::Result validation_result;
 278   scoped_ptr<base::DictionaryValue> validated_user_settings =
 279       validator.ValidateAndRepairObject(
 280           &onc::kNetworkConfigurationSignature,
 281           *user_settings_copy,
 282           &validation_result);
 283   if (validation_result == onc::Validator::INVALID) {
 284     InvokeErrorCallback(service_path, error_callback, kInvalidUserSettings);
 285     return;
 286   }
 287   if (validation_result == onc::Validator::VALID_WITH_WARNINGS)
 288     LOG(WARNING) << "Validation of ONC user settings produced warnings.";
 289
 290   // Fill in HexSSID field from contents of SSID field if not set already.
 291   if (user_settings_copy) {
 292     onc::FillInHexSSIDFieldsInOncObject(onc::kNetworkConfigurationSignature,
 293                                         validated_user_settings.get());
 294   }
 295
 296   const base::DictionaryValue* network_policy =
 297       GetByGUID(policies->per_network_config, guid);
 298   VLOG(2) << "This configuration is " << (network_policy ? "" : "not ")
 299           << "managed.";
 300
 301   scoped_ptr<base::DictionaryValue> shill_dictionary(
 302       policy_util::CreateShillConfiguration(*profile,
 303                                             guid,
 304                                             &policies->global_network_config,
 305                                             network_policy,
 306                                             validated_user_settings.get()));
 307
 308   // 'Carrier' needs to be handled specially if set.
 309   base::DictionaryValue* cellular = nullptr;
 310   if (validated_user_settings->GetDictionaryWithoutPathExpansion(
 311           ::onc::network_config::kCellular, &cellular)) {
 312     std::string carrier;
 313     if (cellular->GetStringWithoutPathExpansion(::onc::cellular::kCarrier,
 314                                                 &carrier)) {
 315       network_device_handler_->SetCarrier(
 316           state->device_path(), carrier,
 317           base::Bind(
 318               &ManagedNetworkConfigurationHandlerImpl::SetShillProperties,
 319               weak_ptr_factory_.GetWeakPtr(), service_path,
 320               base::Passed(&shill_dictionary), callback, error_callback),
 321           error_callback);
 322       return;
 323     }
 324   }
 325
 326   SetShillProperties(service_path, shill_dictionary.Pass(), callback,
 327                      error_callback);
 328 }
 329
 330 void ManagedNetworkConfigurationHandlerImpl::SetShillProperties(
 331     const std::string& service_path,
 332     scoped_ptr<base::DictionaryValue> shill_dictionary,
 333     const base::Closure& callback,
 334     const network_handler::ErrorCallback& error_callback) {
 335   network_configuration_handler_->SetShillProperties(
 336       service_path, *shill_dictionary,
 337       NetworkConfigurationObserver::SOURCE_USER_ACTION, callback,
 338       error_callback);
 339 }
 340
 341 void ManagedNetworkConfigurationHandlerImpl::CreateConfiguration(
 342     const std::string& userhash,
 343     const base::DictionaryValue& properties,
 344     const network_handler::StringResultCallback& callback,
 345     const network_handler::ErrorCallback& error_callback) const {
 346   const Policies* policies = GetPoliciesForUser(userhash);
 347   if (!policies) {
 348     InvokeErrorCallback("", error_callback, kPoliciesNotInitialized);
 349     return;
 350   }
 351
 352   if (policy_util::FindMatchingPolicy(policies->per_network_config,
 353                                       properties)) {
 354     InvokeErrorCallback("", error_callback, kNetworkAlreadyConfigured);
 355     return;
 356   }
 357
 358   const NetworkProfile* profile =
 359       network_profile_handler_->GetProfileForUserhash(userhash);
 360   if (!profile) {
 361     InvokeErrorCallback("", error_callback, kProfileNotInitialized);
 362     return;
 363   }
 364
 365   // TODO(pneubeck): In case of WiFi, check that no other configuration for the
 366   // same {SSID, mode, security} exists. We don't support such multiple
 367   // configurations, yet.
 368
 369   // Generate a new GUID for this configuration. Ignore the maybe provided GUID
 370   // in |properties| as it is not our own and from an untrusted source.
 371   std::string guid = base::GenerateGUID();
 372   scoped_ptr<base::DictionaryValue> shill_dictionary(
 373       policy_util::CreateShillConfiguration(*profile,
 374                                             guid,
 375                                             NULL,  // no global policy
 376                                             NULL,  // no network policy
 377                                             &properties));
 378
 379   network_configuration_handler_->CreateShillConfiguration(
 380       *shill_dictionary, NetworkConfigurationObserver::SOURCE_USER_ACTION,
 381       callback, error_callback);
 382 }
 383
 384 void ManagedNetworkConfigurationHandlerImpl::RemoveConfiguration(
 385     const std::string& service_path,
 386     const base::Closure& callback,
 387     const network_handler::ErrorCallback& error_callback) const {
 388   network_configuration_handler_->RemoveConfiguration(
 389       service_path, NetworkConfigurationObserver::SOURCE_USER_ACTION, callback,
 390       error_callback);
 391 }
 392
 393 void ManagedNetworkConfigurationHandlerImpl::SetPolicy(
 394     ::onc::ONCSource onc_source,
 395     const std::string& userhash,
 396     const base::ListValue& network_configs_onc,
 397     const base::DictionaryValue& global_network_config) {
 398   VLOG(1) << "Setting policies from " << ToDebugString(onc_source, userhash)
 399           << ".";
 400
 401   // |userhash| must be empty for device policies.
 402   DCHECK(onc_source != ::onc::ONC_SOURCE_DEVICE_POLICY ||
 403          userhash.empty());
 404   Policies* policies = NULL;
 405   if (ContainsKey(policies_by_user_, userhash)) {
 406     policies = policies_by_user_[userhash].get();
 407   } else {
 408     policies = new Policies;
 409     policies_by_user_[userhash] = make_linked_ptr(policies);
 410   }
 411
 412   policies->global_network_config.MergeDictionary(&global_network_config);
 413
 414   GuidToPolicyMap old_per_network_config;
 415   policies->per_network_config.swap(old_per_network_config);
 416
 417   // This stores all GUIDs of policies that have changed or are new.
 418   std::set<std::string> modified_policies;
 419
 420   for (base::ListValue::const_iterator it = network_configs_onc.begin();
 421        it != network_configs_onc.end(); ++it) {
 422     const base::DictionaryValue* network = NULL;
 423     (*it)->GetAsDictionary(&network);
 424     DCHECK(network);
 425
 426     std::string guid;
 427     network->GetStringWithoutPathExpansion(::onc::network_config::kGUID, &guid);
 428     DCHECK(!guid.empty());
 429
 430     if (policies->per_network_config.count(guid) > 0) {
 431       NET_LOG_ERROR("ONC from " + ToDebugString(onc_source, userhash) +
 432                     " contains several entries for the same GUID ", guid);
 433       delete policies->per_network_config[guid];
 434     }
 435     const base::DictionaryValue* new_entry = network->DeepCopy();
 436     policies->per_network_config[guid] = new_entry;
 437
 438     const base::DictionaryValue* old_entry = old_per_network_config[guid];
 439     if (!old_entry || !old_entry->Equals(new_entry))
 440       modified_policies.insert(guid);
 441   }
 442
 443   STLDeleteValues(&old_per_network_config);
 444   ApplyOrQueuePolicies(userhash, &modified_policies);
 445   FOR_EACH_OBSERVER(NetworkPolicyObserver, observers_,
 446                     PoliciesChanged(userhash));
 447 }
 448
 449 bool ManagedNetworkConfigurationHandlerImpl::IsAnyPolicyApplicationRunning()
 450     const {
 451   return !policy_applicators_.empty() || !queued_modified_policies_.empty();
 452 }
 453
 454 bool ManagedNetworkConfigurationHandlerImpl::ApplyOrQueuePolicies(
 455     const std::string& userhash,
 456     std::set<std::string>* modified_policies) {
 457   DCHECK(modified_policies);
 458
 459   const NetworkProfile* profile =
 460       network_profile_handler_->GetProfileForUserhash(userhash);
 461   if (!profile) {
 462     VLOG(1) << "The relevant Shill profile isn't initialized yet, postponing "
 463             << "policy application.";
 464     // OnProfileAdded will apply all policies for this userhash.
 465     return false;
 466   }
 467
 468   if (ContainsKey(policy_applicators_, userhash)) {
 469     // A previous policy application is still running. Queue the modified
 470     // policies.
 471     // Note, even if |modified_policies| is empty, this means that a policy
 472     // application will be queued.
 473     queued_modified_policies_[userhash].insert(modified_policies->begin(),
 474                                                modified_policies->end());
 475     VLOG(1) << "Previous PolicyApplicator still running. Postponing policy "
 476                "application.";
 477     return false;
 478   }
 479
 480   const Policies* policies = policies_by_user_[userhash].get();
 481   DCHECK(policies);
 482
 483   PolicyApplicator* applicator =
 484       new PolicyApplicator(*profile,
 485                            policies->per_network_config,
 486                            policies->global_network_config,
 487                            this,
 488                            modified_policies);
 489   policy_applicators_[userhash] = make_linked_ptr(applicator);
 490   applicator->Run();
 491   return true;
 492 }
 493
 494 void ManagedNetworkConfigurationHandlerImpl::OnProfileAdded(
 495     const NetworkProfile& profile) {
 496   VLOG(1) << "Adding profile " << profile.ToDebugString() << "'.";
 497
 498   const Policies* policies = GetPoliciesForProfile(profile);
 499   if (!policies) {
 500     VLOG(1) << "The relevant policy is not initialized, "
 501             << "postponing policy application.";
 502     // See SetPolicy.
 503     return;
 504   }
 505
 506   std::set<std::string> policy_guids;
 507   for (GuidToPolicyMap::const_iterator it =
 508            policies->per_network_config.begin();
 509        it != policies->per_network_config.end(); ++it) {
 510     policy_guids.insert(it->first);
 511   }
 512
 513   const bool started_policy_application =
 514       ApplyOrQueuePolicies(profile.userhash, &policy_guids);
 515   DCHECK(started_policy_application);
 516 }
 517
 518 void ManagedNetworkConfigurationHandlerImpl::OnProfileRemoved(
 519     const NetworkProfile& profile) {
 520   // Nothing to do in this case.
 521 }
 522
 523 void ManagedNetworkConfigurationHandlerImpl::CreateConfigurationFromPolicy(
 524     const base::DictionaryValue& shill_properties) {
 525   network_configuration_handler_->CreateShillConfiguration(
 526       shill_properties, NetworkConfigurationObserver::SOURCE_POLICY,
 527       base::Bind(
 528           &ManagedNetworkConfigurationHandlerImpl::OnPolicyAppliedToNetwork,
 529           weak_ptr_factory_.GetWeakPtr()),
 530       base::Bind(&LogErrorWithDict, FROM_HERE));
 531 }
 532
 533 void ManagedNetworkConfigurationHandlerImpl::
 534     UpdateExistingConfigurationWithPropertiesFromPolicy(
 535         const base::DictionaryValue& existing_properties,
 536         const base::DictionaryValue& new_properties) {
 537   base::DictionaryValue shill_properties;
 538
 539   std::string profile;
 540   existing_properties.GetStringWithoutPathExpansion(shill::kProfileProperty,
 541                                                     &profile);
 542   if (profile.empty()) {
 543     NET_LOG_ERROR("Missing profile property",
 544                   shill_property_util::GetNetworkIdFromProperties(
 545                       existing_properties));
 546     return;
 547   }
 548   shill_properties.SetStringWithoutPathExpansion(shill::kProfileProperty,
 549                                                  profile);
 550
 551   if (!shill_property_util::CopyIdentifyingProperties(
 552           existing_properties,
 553           true /* properties were read from Shill */,
 554           &shill_properties)) {
 555     NET_LOG_ERROR("Missing identifying properties",
 556                   shill_property_util::GetNetworkIdFromProperties(
 557                       existing_properties));
 558   }
 559
 560   shill_properties.MergeDictionary(&new_properties);
 561
 562   network_configuration_handler_->CreateShillConfiguration(
 563       shill_properties, NetworkConfigurationObserver::SOURCE_POLICY,
 564       base::Bind(
 565           &ManagedNetworkConfigurationHandlerImpl::OnPolicyAppliedToNetwork,
 566           weak_ptr_factory_.GetWeakPtr()),
 567       base::Bind(&LogErrorWithDict, FROM_HERE));
 568 }
 569
 570 void ManagedNetworkConfigurationHandlerImpl::OnPoliciesApplied(
 571     const NetworkProfile& profile) {
 572   const std::string& userhash = profile.userhash;
 573   VLOG(1) << "Policy application for user '" << userhash << "' finished.";
 574
 575   base::MessageLoop::current()->DeleteSoon(
 576       FROM_HERE, policy_applicators_[userhash].release());
 577   policy_applicators_.erase(userhash);
 578
 579   if (ContainsKey(queued_modified_policies_, userhash)) {
 580     std::set<std::string> modified_policies;
 581     queued_modified_policies_[userhash].swap(modified_policies);
 582     // Remove |userhash| from the queue.
 583     queued_modified_policies_.erase(userhash);
 584     ApplyOrQueuePolicies(userhash, &modified_policies);
 585   } else {
 586     FOR_EACH_OBSERVER(
 587         NetworkPolicyObserver, observers_, PoliciesApplied(userhash));
 588   }
 589 }
 590
 591 const base::DictionaryValue*
 592 ManagedNetworkConfigurationHandlerImpl::FindPolicyByGUID(
 593     const std::string userhash,
 594     const std::string& guid,
 595     ::onc::ONCSource* onc_source) const {
 596   *onc_source = ::onc::ONC_SOURCE_NONE;
 597
 598   if (!userhash.empty()) {
 599     const Policies* user_policies = GetPoliciesForUser(userhash);
 600     if (user_policies) {
 601       const base::DictionaryValue* policy =
 602           GetByGUID(user_policies->per_network_config, guid);
 603       if (policy) {
 604         *onc_source = ::onc::ONC_SOURCE_USER_POLICY;
 605         return policy;
 606       }
 607     }
 608   }
 609
 610   const Policies* device_policies = GetPoliciesForUser(std::string());
 611   if (device_policies) {
 612     const base::DictionaryValue* policy =
 613         GetByGUID(device_policies->per_network_config, guid);
 614     if (policy) {
 615       *onc_source = ::onc::ONC_SOURCE_DEVICE_POLICY;
 616       return policy;
 617     }
 618   }
 619
 620   return NULL;
 621 }
 622
 623 const GuidToPolicyMap*
 624 ManagedNetworkConfigurationHandlerImpl::GetNetworkConfigsFromPolicy(
 625     const std::string& userhash) const {
 626   const Policies* policies = GetPoliciesForUser(userhash);
 627   if (!policies)
 628     return NULL;
 629
 630   return &policies->per_network_config;
 631 }
 632
 633 const base::DictionaryValue*
 634 ManagedNetworkConfigurationHandlerImpl::GetGlobalConfigFromPolicy(
 635     const std::string& userhash) const {
 636   const Policies* policies = GetPoliciesForUser(userhash);
 637   if (!policies)
 638     return NULL;
 639
 640   return &policies->global_network_config;
 641 }
 642
 643 const base::DictionaryValue*
 644 ManagedNetworkConfigurationHandlerImpl::FindPolicyByGuidAndProfile(
 645     const std::string& guid,
 646     const std::string& profile_path) const {
 647   const NetworkProfile* profile =
 648       network_profile_handler_->GetProfileForPath(profile_path);
 649   if (!profile) {
 650     NET_LOG_ERROR("Profile path unknown:" + profile_path, guid);
 651     return NULL;
 652   }
 653
 654   const Policies* policies = GetPoliciesForProfile(*profile);
 655   if (!policies)
 656     return NULL;
 657
 658   return GetByGUID(policies->per_network_config, guid);
 659 }
 660
 661 const ManagedNetworkConfigurationHandlerImpl::Policies*
 662 ManagedNetworkConfigurationHandlerImpl::GetPoliciesForUser(
 663     const std::string& userhash) const {
 664   UserToPoliciesMap::const_iterator it = policies_by_user_.find(userhash);
 665   if (it == policies_by_user_.end())
 666     return NULL;
 667   return it->second.get();
 668 }
 669
 670 const ManagedNetworkConfigurationHandlerImpl::Policies*
 671 ManagedNetworkConfigurationHandlerImpl::GetPoliciesForProfile(
 672     const NetworkProfile& profile) const {
 673   DCHECK(profile.type() != NetworkProfile::TYPE_SHARED ||
 674          profile.userhash.empty());
 675   return GetPoliciesForUser(profile.userhash);
 676 }
 677
 678 ManagedNetworkConfigurationHandlerImpl::ManagedNetworkConfigurationHandlerImpl()
 679     : network_state_handler_(NULL),
 680       network_profile_handler_(NULL),
 681       network_configuration_handler_(NULL),
 682       network_device_handler_(NULL),
 683       weak_ptr_factory_(this) {
 684   CHECK(base::MessageLoop::current());
 685 }
 686
 687 ManagedNetworkConfigurationHandlerImpl::
 688     ~ManagedNetworkConfigurationHandlerImpl() {
 689   if (network_profile_handler_)
 690     network_profile_handler_->RemoveObserver(this);
 691 }
 692
 693 void ManagedNetworkConfigurationHandlerImpl::Init(
 694     NetworkStateHandler* network_state_handler,
 695     NetworkProfileHandler* network_profile_handler,
 696     NetworkConfigurationHandler* network_configuration_handler,
 697     NetworkDeviceHandler* network_device_handler) {
 698   network_state_handler_ = network_state_handler;
 699   network_profile_handler_ = network_profile_handler;
 700   network_configuration_handler_ = network_configuration_handler;
 701   network_device_handler_ = network_device_handler;
 702   network_profile_handler_->AddObserver(this);
 703 }
 704
 705 void ManagedNetworkConfigurationHandlerImpl::OnPolicyAppliedToNetwork(
 706     const std::string& service_path) {
 707   if (service_path.empty())
 708     return;
 709   FOR_EACH_OBSERVER(
 710       NetworkPolicyObserver, observers_, PolicyAppliedToNetwork(service_path));
 711 }
 712
 713 // Get{Managed}Properties helpers
 714
 715 void ManagedNetworkConfigurationHandlerImpl::GetDeviceStateProperties(
 716     const std::string& service_path,
 717     base::DictionaryValue* properties) {
 718   std::string connection_state;
 719   properties->GetStringWithoutPathExpansion(
 720       shill::kStateProperty, &connection_state);
 721   if (!NetworkState::StateIsConnected(connection_state))
 722     return;
 723
 724   // Get the IPConfig properties from the device and store them in "IPConfigs"
 725   // (plural) in the properties dictionary. (Note: Shill only provides a single
 726   // "IPConfig" property for a network service, but a consumer of this API may
 727   // want information about all ipv4 and ipv6 IPConfig properties.
 728   std::string device;
 729   properties->GetStringWithoutPathExpansion(shill::kDeviceProperty, &device);
 730   const DeviceState* device_state =
 731       network_state_handler_->GetDeviceState(device);
 732   if (!device_state) {
 733     NET_LOG_ERROR("GetDeviceProperties: no device: " + device, service_path);
 734     return;
 735   }
 736
 737   // Get the hardware MAC address from the DeviceState.
 738   if (!device_state->mac_address().empty()) {
 739     properties->SetStringWithoutPathExpansion(
 740         shill::kAddressProperty, device_state->mac_address());
 741   }
 742
 743   // Convert IPConfig dictionary to a ListValue.
 744   base::ListValue* ip_configs = new base::ListValue;
 745   for (base::DictionaryValue::Iterator iter(device_state->ip_configs());
 746        !iter.IsAtEnd(); iter.Advance()) {
 747     ip_configs->Append(iter.value().DeepCopy());
 748   }
 749   properties->SetWithoutPathExpansion(shill::kIPConfigsProperty, ip_configs);
 750 }
 751
 752 void ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback(
 753     GetDevicePropertiesCallback send_callback,
 754     const std::string& service_path,
 755     const base::DictionaryValue& shill_properties) {
 756   scoped_ptr<base::DictionaryValue> shill_properties_copy(
 757       shill_properties.DeepCopy());
 758
 759   std::string guid;
 760   shill_properties.GetStringWithoutPathExpansion(shill::kGuidProperty, &guid);
 761   if (guid.empty()) {
 762     // Unmanaged networks are assigned a GUID in NetworkState. Provide this
 763     // value in the ONC dictionary.
 764     const NetworkState* state =
 765         network_state_handler_->GetNetworkState(service_path);
 766     if (state && !state->guid().empty()) {
 767       guid = state->guid();
 768       shill_properties_copy->SetStringWithoutPathExpansion(shill::kGuidProperty,
 769                                                            guid);
 770     } else {
 771       LOG(ERROR) << "Network has no GUID specified: " << service_path;
 772     }
 773   }
 774
 775   std::string type;
 776   shill_properties_copy->GetStringWithoutPathExpansion(shill::kTypeProperty,
 777                                                        &type);
 778   // Add associated DeviceState properties for non-VPN networks.
 779   if (type != shill::kTypeVPN)
 780     GetDeviceStateProperties(service_path, shill_properties_copy.get());
 781
 782   // Only request additional Device properties for Cellular networks with a
 783   // valid device.
 784   std::string device_path;
 785   if (!network_device_handler_ ||
 786       type != shill::kTypeCellular ||
 787       !shill_properties_copy->GetStringWithoutPathExpansion(
 788           shill::kDeviceProperty, &device_path) ||
 789       device_path.empty()) {
 790     send_callback.Run(service_path, shill_properties_copy.Pass());
 791     return;
 792   }
 793
 794   // Request the device properties. On success or failure pass (a possibly
 795   // modified) |shill_properties| to |send_callback|.
 796   scoped_ptr<base::DictionaryValue> shill_properties_copy_error_copy(
 797       shill_properties_copy->DeepCopy());
 798   network_device_handler_->GetDeviceProperties(
 799       device_path,
 800       base::Bind(&ManagedNetworkConfigurationHandlerImpl::
 801                      GetDevicePropertiesSuccess,
 802                  weak_ptr_factory_.GetWeakPtr(),
 803                  service_path,
 804                  base::Passed(&shill_properties_copy),
 805                  send_callback),
 806       base::Bind(&ManagedNetworkConfigurationHandlerImpl::
 807                      GetDevicePropertiesFailure,
 808                  weak_ptr_factory_.GetWeakPtr(),
 809                  service_path,
 810                  base::Passed(&shill_properties_copy_error_copy),
 811                  send_callback));
 812 }
 813
 814 void ManagedNetworkConfigurationHandlerImpl::GetDevicePropertiesSuccess(
 815     const std::string& service_path,
 816     scoped_ptr<base::DictionaryValue> network_properties,
 817     GetDevicePropertiesCallback send_callback,
 818     const std::string& device_path,
 819     const base::DictionaryValue& device_properties) {
 820   // Create a "Device" dictionary in |network_properties|.
 821   network_properties->SetWithoutPathExpansion(
 822       shill::kDeviceProperty, device_properties.DeepCopy());
 823   send_callback.Run(service_path, network_properties.Pass());
 824 }
 825
 826 void ManagedNetworkConfigurationHandlerImpl::GetDevicePropertiesFailure(
 827     const std::string& service_path,
 828     scoped_ptr<base::DictionaryValue> network_properties,
 829     GetDevicePropertiesCallback send_callback,
 830     const std::string& error_name,
 831     scoped_ptr<base::DictionaryValue> error_data) {
 832   NET_LOG_ERROR("Error getting device properties", service_path);
 833   send_callback.Run(service_path, network_properties.Pass());
 834 }
 835
 836
 837 }  // namespace chromeos