chromeos/network/managed_network_configuration_handler_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/managed_network_configuration_handler_impl.h"
   6
   7 #include <vector>
   8
   9 #include "base/bind.h"
  10 #include "base/guid.h"
  11 #include "base/location.h"
  12 #include "base/logging.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "base/message_loop/message_loop.h"
  15 #include "base/stl_util.h"
  16 #include "base/values.h"
  17 #include "chromeos/dbus/shill_manager_client.h"
  18 #include "chromeos/dbus/shill_profile_client.h"
  19 #include "chromeos/dbus/shill_service_client.h"
  20 #include "chromeos/network/device_state.h"
  21 #include "chromeos/network/network_configuration_handler.h"
  22 #include "chromeos/network/network_device_handler.h"
  23 #include "chromeos/network/network_event_log.h"
  24 #include "chromeos/network/network_policy_observer.h"
  25 #include "chromeos/network/network_profile.h"
  26 #include "chromeos/network/network_profile_handler.h"
  27 #include "chromeos/network/network_state.h"
  28 #include "chromeos/network/network_state_handler.h"
  29 #include "chromeos/network/network_ui_data.h"
  30 #include "chromeos/network/network_util.h"
  31 #include "chromeos/network/onc/onc_merger.h"
  32 #include "chromeos/network/onc/onc_signature.h"
  33 #include "chromeos/network/onc/onc_translator.h"
  34 #include "chromeos/network/onc/onc_utils.h"
  35 #include "chromeos/network/onc/onc_validator.h"
  36 #include "chromeos/network/policy_util.h"
  37 #include "chromeos/network/shill_property_util.h"
  38 #include "components/onc/onc_constants.h"
  39 #include "third_party/cros_system_api/dbus/service_constants.h"
  40
  41 namespace chromeos {
  42
  43 namespace {
  44
  45 using GuidToPolicyMap = ManagedNetworkConfigurationHandler::GuidToPolicyMap;
  46
  47 // These are error strings used for error callbacks. None of these error
  48 // messages are user-facing: they should only appear in logs.
  49 const char kInvalidUserSettings[] = "InvalidUserSettings";
  50 const char kNetworkAlreadyConfigured[] = "NetworkAlreadyConfigured";
  51 const char kPoliciesNotInitialized[] = "PoliciesNotInitialized";
  52 const char kProfileNotInitialized[] = "ProfileNotInitialized";
  53 const char kUnconfiguredNetwork[] = "UnconfiguredNetwork";
  54 const char kUnknownNetwork[] = "UnknownNetwork";
  55
  56 std::string ToDebugString(::onc::ONCSource source,
  57                           const std::string& userhash) {
  58   return source == ::onc::ONC_SOURCE_USER_POLICY ?
  59       ("user policy of " + userhash) : "device policy";
  60 }
  61
  62 void InvokeErrorCallback(const std::string& service_path,
  63                          const network_handler::ErrorCallback& error_callback,
  64                          const std::string& error_name) {
  65   std::string error_msg = "ManagedConfig Error: " + error_name;
  66   NET_LOG_ERROR(error_msg, service_path);
  67   network_handler::RunErrorCallback(
  68       error_callback, service_path, error_name, error_msg);
  69 }
  70
  71 void LogErrorWithDict(const tracked_objects::Location& from_where,
  72                       const std::string& error_name,
  73                       scoped_ptr<base::DictionaryValue> error_data) {
  74   device_event_log::AddEntry(from_where.file_name(), from_where.line_number(),
  75                              device_event_log::LOG_TYPE_NETWORK,
  76                              device_event_log::LOG_LEVEL_ERROR, error_name);
  77 }
  78
  79 const base::DictionaryValue* GetByGUID(const GuidToPolicyMap& policies,
  80                                        const std::string& guid) {
  81   GuidToPolicyMap::const_iterator it = policies.find(guid);
  82   if (it == policies.end())
  83     return NULL;
  84   return it->second;
  85 }
  86
  87 }  // namespace
  88
  89 struct ManagedNetworkConfigurationHandlerImpl::Policies {
  90   ~Policies();
  91
  92   GuidToPolicyMap per_network_config;
  93   base::DictionaryValue global_network_config;
  94 };
  95
  96 ManagedNetworkConfigurationHandlerImpl::Policies::~Policies() {
  97   STLDeleteValues(&per_network_config);
  98 }
  99
 100 void ManagedNetworkConfigurationHandlerImpl::AddObserver(
 101     NetworkPolicyObserver* observer) {
 102   observers_.AddObserver(observer);
 103 }
 104
 105 void ManagedNetworkConfigurationHandlerImpl::RemoveObserver(
 106     NetworkPolicyObserver* observer) {
 107   observers_.RemoveObserver(observer);
 108 }
 109
 110 // GetManagedProperties
 111
 112 void ManagedNetworkConfigurationHandlerImpl::GetManagedProperties(
 113     const std::string& userhash,
 114     const std::string& service_path,
 115     const network_handler::DictionaryResultCallback& callback,
 116     const network_handler::ErrorCallback& error_callback) {
 117   if (!GetPoliciesForUser(userhash) || !GetPoliciesForUser(std::string())) {
 118     InvokeErrorCallback(service_path, error_callback, kPoliciesNotInitialized);
 119     return;
 120   }
 121   NET_LOG_USER("GetManagedProperties", service_path);
 122   network_configuration_handler_->GetShillProperties(
 123       service_path,
 124       base::Bind(
 125           &ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback,
 126           weak_ptr_factory_.GetWeakPtr(),
 127           base::Bind(
 128               &ManagedNetworkConfigurationHandlerImpl::SendManagedProperties,
 129               weak_ptr_factory_.GetWeakPtr(), userhash, callback,
 130               error_callback)),
 131       error_callback);
 132 }
 133
 134 void ManagedNetworkConfigurationHandlerImpl::SendManagedProperties(
 135     const std::string& userhash,
 136     const network_handler::DictionaryResultCallback& callback,
 137     const network_handler::ErrorCallback& error_callback,
 138     const std::string& service_path,
 139     scoped_ptr<base::DictionaryValue> shill_properties) {
 140   std::string profile_path;
 141   shill_properties->GetStringWithoutPathExpansion(shill::kProfileProperty,
 142                                                   &profile_path);
 143   const NetworkProfile* profile =
 144       network_profile_handler_->GetProfileForPath(profile_path);
 145   if (!profile)
 146     NET_LOG_ERROR("No profile for service: " + profile_path, service_path);
 147
 148   scoped_ptr<NetworkUIData> ui_data =
 149       shill_property_util::GetUIDataFromProperties(*shill_properties);
 150
 151   const base::DictionaryValue* user_settings = NULL;
 152
 153   if (ui_data && profile) {
 154     user_settings = ui_data->user_settings();
 155   } else if (profile) {
 156     NET_LOG_ERROR("Service contains empty or invalid UIData", service_path);
 157     // TODO(pneubeck): add a conversion of user configured entries of old
 158     // ChromeOS versions. We will have to use a heuristic to determine which
 159     // properties _might_ be user configured.
 160   }
 161
 162   std::string guid;
 163   shill_properties->GetStringWithoutPathExpansion(shill::kGuidProperty, &guid);
 164
 165   ::onc::ONCSource onc_source;
 166   FindPolicyByGUID(userhash, guid, &onc_source);
 167   const NetworkState* network_state =
 168       network_state_handler_->GetNetworkState(service_path);
 169   scoped_ptr<base::DictionaryValue> active_settings(
 170       onc::TranslateShillServiceToONCPart(*shill_properties, onc_source,
 171                                           &onc::kNetworkWithStateSignature,
 172                                           network_state));
 173
 174   const base::DictionaryValue* network_policy = NULL;
 175   const base::DictionaryValue* global_policy = NULL;
 176   if (profile) {
 177     const Policies* policies = GetPoliciesForProfile(*profile);
 178     if (!policies) {
 179       InvokeErrorCallback(
 180           service_path, error_callback, kPoliciesNotInitialized);
 181       return;
 182     }
 183     if (!guid.empty())
 184       network_policy = GetByGUID(policies->per_network_config, guid);
 185     global_policy = &policies->global_network_config;
 186   }
 187
 188   scoped_ptr<base::DictionaryValue> augmented_properties(
 189       policy_util::CreateManagedONC(global_policy,
 190                                     network_policy,
 191                                     user_settings,
 192                                     active_settings.get(),
 193                                     profile));
 194   callback.Run(service_path, *augmented_properties);
 195 }
 196
 197 // GetProperties
 198
 199 void ManagedNetworkConfigurationHandlerImpl::GetProperties(
 200     const std::string& service_path,
 201     const network_handler::DictionaryResultCallback& callback,
 202     const network_handler::ErrorCallback& error_callback) {
 203   NET_LOG_USER("GetProperties", service_path);
 204   network_configuration_handler_->GetShillProperties(
 205       service_path,
 206       base::Bind(
 207           &ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback,
 208           weak_ptr_factory_.GetWeakPtr(),
 209           base::Bind(&ManagedNetworkConfigurationHandlerImpl::SendProperties,
 210                      weak_ptr_factory_.GetWeakPtr(), callback, error_callback)),
 211       error_callback);
 212 }
 213
 214 void ManagedNetworkConfigurationHandlerImpl::SendProperties(
 215     const network_handler::DictionaryResultCallback& callback,
 216     const network_handler::ErrorCallback& error_callback,
 217     const std::string& service_path,
 218     scoped_ptr<base::DictionaryValue> shill_properties) {
 219   const NetworkState* network_state =
 220       network_state_handler_->GetNetworkState(service_path);
 221   scoped_ptr<base::DictionaryValue> onc_network(
 222       onc::TranslateShillServiceToONCPart(
 223           *shill_properties, ::onc::ONC_SOURCE_UNKNOWN,
 224           &onc::kNetworkWithStateSignature, network_state));
 225   callback.Run(service_path, *onc_network);
 226 }
 227
 228 // SetProperties
 229
 230 void ManagedNetworkConfigurationHandlerImpl::SetProperties(
 231     const std::string& service_path,
 232     const base::DictionaryValue& user_settings,
 233     const base::Closure& callback,
 234     const network_handler::ErrorCallback& error_callback) {
 235   const NetworkState* state =
 236       network_state_handler_->GetNetworkStateFromServicePath(
 237           service_path, true /* configured_only */);
 238   if (!state) {
 239     InvokeErrorCallback(service_path, error_callback, kUnknownNetwork);
 240     return;
 241   }
 242
 243   std::string guid = state->guid();
 244   DCHECK(!guid.empty());
 245
 246   const std::string& profile_path = state->profile_path();
 247   const NetworkProfile *profile =
 248       network_profile_handler_->GetProfileForPath(profile_path);
 249   if (!profile) {
 250     // TODO(pneubeck): create an initial configuration in this case. As for
 251     // CreateConfiguration, user settings from older ChromeOS versions have to
 252     // be determined here.
 253     InvokeErrorCallback(service_path, error_callback, kUnconfiguredNetwork);
 254     return;
 255   }
 256
 257   VLOG(2) << "SetProperties: Found GUID " << guid << " and profile "
 258           << profile->ToDebugString();
 259
 260   const Policies* policies = GetPoliciesForProfile(*profile);
 261   if (!policies) {
 262     InvokeErrorCallback(service_path, error_callback, kPoliciesNotInitialized);
 263     return;
 264   }
 265
 266   // We need to ensure that required configuration properties (e.g. Type) are
 267   // included for ONC validation and translation to Shill properties.
 268   scoped_ptr<base::DictionaryValue> user_settings_copy(
 269       user_settings.DeepCopy());
 270   user_settings_copy->SetStringWithoutPathExpansion(
 271       ::onc::network_config::kType,
 272       network_util::TranslateShillTypeToONC(state->type()));
 273   user_settings_copy->MergeDictionary(&user_settings);
 274
 275   // Validate the ONC dictionary. We are liberal and ignore unknown field
 276   // names. User settings are only partial ONC, thus we ignore missing fields.
 277   onc::Validator validator(false,  // Ignore unknown fields.
 278                            false,  // Ignore invalid recommended field names.
 279                            false,  // Ignore missing fields.
 280                            false);  // This ONC does not come from policy.
 281
 282   onc::Validator::Result validation_result;
 283   scoped_ptr<base::DictionaryValue> validated_user_settings =
 284       validator.ValidateAndRepairObject(
 285           &onc::kNetworkConfigurationSignature,
 286           *user_settings_copy,
 287           &validation_result);
 288   if (validation_result == onc::Validator::INVALID) {
 289     InvokeErrorCallback(service_path, error_callback, kInvalidUserSettings);
 290     return;
 291   }
 292   if (validation_result == onc::Validator::VALID_WITH_WARNINGS)
 293     LOG(WARNING) << "Validation of ONC user settings produced warnings.";
 294
 295   // Fill in HexSSID field from contents of SSID field if not set already.
 296   if (user_settings_copy) {
 297     onc::FillInHexSSIDFieldsInOncObject(onc::kNetworkConfigurationSignature,
 298                                         validated_user_settings.get());
 299   }
 300
 301   const base::DictionaryValue* network_policy =
 302       GetByGUID(policies->per_network_config, guid);
 303   VLOG(2) << "This configuration is " << (network_policy ? "" : "not ")
 304           << "managed.";
 305
 306   scoped_ptr<base::DictionaryValue> shill_dictionary(
 307       policy_util::CreateShillConfiguration(*profile,
 308                                             guid,
 309                                             &policies->global_network_config,
 310                                             network_policy,
 311                                             validated_user_settings.get()));
 312
 313   // 'Carrier' needs to be handled specially if set.
 314   base::DictionaryValue* cellular = nullptr;
 315   if (validated_user_settings->GetDictionaryWithoutPathExpansion(
 316           ::onc::network_config::kCellular, &cellular)) {
 317     std::string carrier;
 318     if (cellular->GetStringWithoutPathExpansion(::onc::cellular::kCarrier,
 319                                                 &carrier)) {
 320       network_device_handler_->SetCarrier(
 321           state->device_path(), carrier,
 322           base::Bind(
 323               &ManagedNetworkConfigurationHandlerImpl::SetShillProperties,
 324               weak_ptr_factory_.GetWeakPtr(), service_path,
 325               base::Passed(&shill_dictionary), callback, error_callback),
 326           error_callback);
 327       return;
 328     }
 329   }
 330
 331   SetShillProperties(service_path, shill_dictionary.Pass(), callback,
 332                      error_callback);
 333 }
 334
 335 void ManagedNetworkConfigurationHandlerImpl::SetShillProperties(
 336     const std::string& service_path,
 337     scoped_ptr<base::DictionaryValue> shill_dictionary,
 338     const base::Closure& callback,
 339     const network_handler::ErrorCallback& error_callback) {
 340   network_configuration_handler_->SetShillProperties(
 341       service_path, *shill_dictionary,
 342       NetworkConfigurationObserver::SOURCE_USER_ACTION, callback,
 343       error_callback);
 344 }
 345
 346 void ManagedNetworkConfigurationHandlerImpl::CreateConfiguration(
 347     const std::string& userhash,
 348     const base::DictionaryValue& properties,
 349     const network_handler::StringResultCallback& callback,
 350     const network_handler::ErrorCallback& error_callback) const {
 351   const Policies* policies = GetPoliciesForUser(userhash);
 352   if (!policies) {
 353     InvokeErrorCallback("", error_callback, kPoliciesNotInitialized);
 354     return;
 355   }
 356
 357   if (policy_util::FindMatchingPolicy(policies->per_network_config,
 358                                       properties)) {
 359     InvokeErrorCallback("", error_callback, kNetworkAlreadyConfigured);
 360     return;
 361   }
 362
 363   const NetworkProfile* profile =
 364       network_profile_handler_->GetProfileForUserhash(userhash);
 365   if (!profile) {
 366     InvokeErrorCallback("", error_callback, kProfileNotInitialized);
 367     return;
 368   }
 369
 370   // TODO(pneubeck): In case of WiFi, check that no other configuration for the
 371   // same {SSID, mode, security} exists. We don't support such multiple
 372   // configurations, yet.
 373
 374   // Generate a new GUID for this configuration. Ignore the maybe provided GUID
 375   // in |properties| as it is not our own and from an untrusted source.
 376   std::string guid = base::GenerateGUID();
 377   scoped_ptr<base::DictionaryValue> shill_dictionary(
 378       policy_util::CreateShillConfiguration(*profile,
 379                                             guid,
 380                                             NULL,  // no global policy
 381                                             NULL,  // no network policy
 382                                             &properties));
 383
 384   network_configuration_handler_->CreateShillConfiguration(
 385       *shill_dictionary, NetworkConfigurationObserver::SOURCE_USER_ACTION,
 386       callback, error_callback);
 387 }
 388
 389 void ManagedNetworkConfigurationHandlerImpl::RemoveConfiguration(
 390     const std::string& service_path,
 391     const base::Closure& callback,
 392     const network_handler::ErrorCallback& error_callback) const {
 393   network_configuration_handler_->RemoveConfiguration(
 394       service_path, NetworkConfigurationObserver::SOURCE_USER_ACTION, callback,
 395       error_callback);
 396 }
 397
 398 void ManagedNetworkConfigurationHandlerImpl::SetPolicy(
 399     ::onc::ONCSource onc_source,
 400     const std::string& userhash,
 401     const base::ListValue& network_configs_onc,
 402     const base::DictionaryValue& global_network_config) {
 403   VLOG(1) << "Setting policies from " << ToDebugString(onc_source, userhash)
 404           << ".";
 405
 406   // |userhash| must be empty for device policies.
 407   DCHECK(onc_source != ::onc::ONC_SOURCE_DEVICE_POLICY ||
 408          userhash.empty());
 409   Policies* policies = NULL;
 410   if (ContainsKey(policies_by_user_, userhash)) {
 411     policies = policies_by_user_[userhash].get();
 412   } else {
 413     policies = new Policies;
 414     policies_by_user_[userhash] = make_linked_ptr(policies);
 415   }
 416
 417   policies->global_network_config.MergeDictionary(&global_network_config);
 418
 419   GuidToPolicyMap old_per_network_config;
 420   policies->per_network_config.swap(old_per_network_config);
 421
 422   // This stores all GUIDs of policies that have changed or are new.
 423   std::set<std::string> modified_policies;
 424
 425   for (base::ListValue::const_iterator it = network_configs_onc.begin();
 426        it != network_configs_onc.end(); ++it) {
 427     const base::DictionaryValue* network = NULL;
 428     (*it)->GetAsDictionary(&network);
 429     DCHECK(network);
 430
 431     std::string guid;
 432     network->GetStringWithoutPathExpansion(::onc::network_config::kGUID, &guid);
 433     DCHECK(!guid.empty());
 434
 435     if (policies->per_network_config.count(guid) > 0) {
 436       NET_LOG_ERROR("ONC from " + ToDebugString(onc_source, userhash) +
 437                     " contains several entries for the same GUID ", guid);
 438       delete policies->per_network_config[guid];
 439     }
 440     const base::DictionaryValue* new_entry = network->DeepCopy();
 441     policies->per_network_config[guid] = new_entry;
 442
 443     const base::DictionaryValue* old_entry = old_per_network_config[guid];
 444     if (!old_entry || !old_entry->Equals(new_entry))
 445       modified_policies.insert(guid);
 446   }
 447
 448   STLDeleteValues(&old_per_network_config);
 449   ApplyOrQueuePolicies(userhash, &modified_policies);
 450   FOR_EACH_OBSERVER(NetworkPolicyObserver, observers_,
 451                     PoliciesChanged(userhash));
 452 }
 453
 454 bool ManagedNetworkConfigurationHandlerImpl::IsAnyPolicyApplicationRunning()
 455     const {
 456   return !policy_applicators_.empty() || !queued_modified_policies_.empty();
 457 }
 458
 459 bool ManagedNetworkConfigurationHandlerImpl::ApplyOrQueuePolicies(
 460     const std::string& userhash,
 461     std::set<std::string>* modified_policies) {
 462   DCHECK(modified_policies);
 463
 464   const NetworkProfile* profile =
 465       network_profile_handler_->GetProfileForUserhash(userhash);
 466   if (!profile) {
 467     VLOG(1) << "The relevant Shill profile isn't initialized yet, postponing "
 468             << "policy application.";
 469     // OnProfileAdded will apply all policies for this userhash.
 470     return false;
 471   }
 472
 473   if (ContainsKey(policy_applicators_, userhash)) {
 474     // A previous policy application is still running. Queue the modified
 475     // policies.
 476     // Note, even if |modified_policies| is empty, this means that a policy
 477     // application will be queued.
 478     queued_modified_policies_[userhash].insert(modified_policies->begin(),
 479                                                modified_policies->end());
 480     VLOG(1) << "Previous PolicyApplicator still running. Postponing policy "
 481                "application.";
 482     return false;
 483   }
 484
 485   const Policies* policies = policies_by_user_[userhash].get();
 486   DCHECK(policies);
 487
 488   PolicyApplicator* applicator =
 489       new PolicyApplicator(*profile,
 490                            policies->per_network_config,
 491                            policies->global_network_config,
 492                            this,
 493                            modified_policies);
 494   policy_applicators_[userhash] = make_linked_ptr(applicator);
 495   applicator->Run();
 496   return true;
 497 }
 498
 499 void ManagedNetworkConfigurationHandlerImpl::OnProfileAdded(
 500     const NetworkProfile& profile) {
 501   VLOG(1) << "Adding profile " << profile.ToDebugString() << "'.";
 502
 503   const Policies* policies = GetPoliciesForProfile(profile);
 504   if (!policies) {
 505     VLOG(1) << "The relevant policy is not initialized, "
 506             << "postponing policy application.";
 507     // See SetPolicy.
 508     return;
 509   }
 510
 511   std::set<std::string> policy_guids;
 512   for (GuidToPolicyMap::const_iterator it =
 513            policies->per_network_config.begin();
 514        it != policies->per_network_config.end(); ++it) {
 515     policy_guids.insert(it->first);
 516   }
 517
 518   const bool started_policy_application =
 519       ApplyOrQueuePolicies(profile.userhash, &policy_guids);
 520   DCHECK(started_policy_application);
 521 }
 522
 523 void ManagedNetworkConfigurationHandlerImpl::OnProfileRemoved(
 524     const NetworkProfile& profile) {
 525   // Nothing to do in this case.
 526 }
 527
 528 void ManagedNetworkConfigurationHandlerImpl::CreateConfigurationFromPolicy(
 529     const base::DictionaryValue& shill_properties) {
 530   network_configuration_handler_->CreateShillConfiguration(
 531       shill_properties, NetworkConfigurationObserver::SOURCE_POLICY,
 532       base::Bind(
 533           &ManagedNetworkConfigurationHandlerImpl::OnPolicyAppliedToNetwork,
 534           weak_ptr_factory_.GetWeakPtr()),
 535       base::Bind(&LogErrorWithDict, FROM_HERE));
 536 }
 537
 538 void ManagedNetworkConfigurationHandlerImpl::
 539     UpdateExistingConfigurationWithPropertiesFromPolicy(
 540         const base::DictionaryValue& existing_properties,
 541         const base::DictionaryValue& new_properties) {
 542   base::DictionaryValue shill_properties;
 543
 544   std::string profile;
 545   existing_properties.GetStringWithoutPathExpansion(shill::kProfileProperty,
 546                                                     &profile);
 547   if (profile.empty()) {
 548     NET_LOG_ERROR("Missing profile property",
 549                   shill_property_util::GetNetworkIdFromProperties(
 550                       existing_properties));
 551     return;
 552   }
 553   shill_properties.SetStringWithoutPathExpansion(shill::kProfileProperty,
 554                                                  profile);
 555
 556   if (!shill_property_util::CopyIdentifyingProperties(
 557           existing_properties,
 558           true /* properties were read from Shill */,
 559           &shill_properties)) {
 560     NET_LOG_ERROR("Missing identifying properties",
 561                   shill_property_util::GetNetworkIdFromProperties(
 562                       existing_properties));
 563   }
 564
 565   shill_properties.MergeDictionary(&new_properties);
 566
 567   network_configuration_handler_->CreateShillConfiguration(
 568       shill_properties, NetworkConfigurationObserver::SOURCE_POLICY,
 569       base::Bind(
 570           &ManagedNetworkConfigurationHandlerImpl::OnPolicyAppliedToNetwork,
 571           weak_ptr_factory_.GetWeakPtr()),
 572       base::Bind(&LogErrorWithDict, FROM_HERE));
 573 }
 574
 575 void ManagedNetworkConfigurationHandlerImpl::OnPoliciesApplied(
 576     const NetworkProfile& profile) {
 577   const std::string& userhash = profile.userhash;
 578   VLOG(1) << "Policy application for user '" << userhash << "' finished.";
 579
 580   base::MessageLoop::current()->DeleteSoon(
 581       FROM_HERE, policy_applicators_[userhash].release());
 582   policy_applicators_.erase(userhash);
 583
 584   if (ContainsKey(queued_modified_policies_, userhash)) {
 585     std::set<std::string> modified_policies;
 586     queued_modified_policies_[userhash].swap(modified_policies);
 587     // Remove |userhash| from the queue.
 588     queued_modified_policies_.erase(userhash);
 589     ApplyOrQueuePolicies(userhash, &modified_policies);
 590   } else {
 591     FOR_EACH_OBSERVER(
 592         NetworkPolicyObserver, observers_, PoliciesApplied(userhash));
 593   }
 594 }
 595
 596 const base::DictionaryValue*
 597 ManagedNetworkConfigurationHandlerImpl::FindPolicyByGUID(
 598     const std::string userhash,
 599     const std::string& guid,
 600     ::onc::ONCSource* onc_source) const {
 601   *onc_source = ::onc::ONC_SOURCE_NONE;
 602
 603   if (!userhash.empty()) {
 604     const Policies* user_policies = GetPoliciesForUser(userhash);
 605     if (user_policies) {
 606       const base::DictionaryValue* policy =
 607           GetByGUID(user_policies->per_network_config, guid);
 608       if (policy) {
 609         *onc_source = ::onc::ONC_SOURCE_USER_POLICY;
 610         return policy;
 611       }
 612     }
 613   }
 614
 615   const Policies* device_policies = GetPoliciesForUser(std::string());
 616   if (device_policies) {
 617     const base::DictionaryValue* policy =
 618         GetByGUID(device_policies->per_network_config, guid);
 619     if (policy) {
 620       *onc_source = ::onc::ONC_SOURCE_DEVICE_POLICY;
 621       return policy;
 622     }
 623   }
 624
 625   return NULL;
 626 }
 627
 628 const GuidToPolicyMap*
 629 ManagedNetworkConfigurationHandlerImpl::GetNetworkConfigsFromPolicy(
 630     const std::string& userhash) const {
 631   const Policies* policies = GetPoliciesForUser(userhash);
 632   if (!policies)
 633     return NULL;
 634
 635   return &policies->per_network_config;
 636 }
 637
 638 const base::DictionaryValue*
 639 ManagedNetworkConfigurationHandlerImpl::GetGlobalConfigFromPolicy(
 640     const std::string& userhash) const {
 641   const Policies* policies = GetPoliciesForUser(userhash);
 642   if (!policies)
 643     return NULL;
 644
 645   return &policies->global_network_config;
 646 }
 647
 648 const base::DictionaryValue*
 649 ManagedNetworkConfigurationHandlerImpl::FindPolicyByGuidAndProfile(
 650     const std::string& guid,
 651     const std::string& profile_path) const {
 652   const NetworkProfile* profile =
 653       network_profile_handler_->GetProfileForPath(profile_path);
 654   if (!profile) {
 655     NET_LOG_ERROR("Profile path unknown:" + profile_path, guid);
 656     return NULL;
 657   }
 658
 659   const Policies* policies = GetPoliciesForProfile(*profile);
 660   if (!policies)
 661     return NULL;
 662
 663   return GetByGUID(policies->per_network_config, guid);
 664 }
 665
 666 const ManagedNetworkConfigurationHandlerImpl::Policies*
 667 ManagedNetworkConfigurationHandlerImpl::GetPoliciesForUser(
 668     const std::string& userhash) const {
 669   UserToPoliciesMap::const_iterator it = policies_by_user_.find(userhash);
 670   if (it == policies_by_user_.end())
 671     return NULL;
 672   return it->second.get();
 673 }
 674
 675 const ManagedNetworkConfigurationHandlerImpl::Policies*
 676 ManagedNetworkConfigurationHandlerImpl::GetPoliciesForProfile(
 677     const NetworkProfile& profile) const {
 678   DCHECK(profile.type() != NetworkProfile::TYPE_SHARED ||
 679          profile.userhash.empty());
 680   return GetPoliciesForUser(profile.userhash);
 681 }
 682
 683 ManagedNetworkConfigurationHandlerImpl::ManagedNetworkConfigurationHandlerImpl()
 684     : network_state_handler_(NULL),
 685       network_profile_handler_(NULL),
 686       network_configuration_handler_(NULL),
 687       network_device_handler_(NULL),
 688       weak_ptr_factory_(this) {
 689   CHECK(base::MessageLoop::current());
 690 }
 691
 692 ManagedNetworkConfigurationHandlerImpl::
 693     ~ManagedNetworkConfigurationHandlerImpl() {
 694   if (network_profile_handler_)
 695     network_profile_handler_->RemoveObserver(this);
 696 }
 697
 698 void ManagedNetworkConfigurationHandlerImpl::Init(
 699     NetworkStateHandler* network_state_handler,
 700     NetworkProfileHandler* network_profile_handler,
 701     NetworkConfigurationHandler* network_configuration_handler,
 702     NetworkDeviceHandler* network_device_handler) {
 703   network_state_handler_ = network_state_handler;
 704   network_profile_handler_ = network_profile_handler;
 705   network_configuration_handler_ = network_configuration_handler;
 706   network_device_handler_ = network_device_handler;
 707   network_profile_handler_->AddObserver(this);
 708 }
 709
 710 void ManagedNetworkConfigurationHandlerImpl::OnPolicyAppliedToNetwork(
 711     const std::string& service_path) {
 712   if (service_path.empty())
 713     return;
 714   FOR_EACH_OBSERVER(
 715       NetworkPolicyObserver, observers_, PolicyAppliedToNetwork(service_path));
 716 }
 717
 718 // Get{Managed}Properties helpers
 719
 720 void ManagedNetworkConfigurationHandlerImpl::GetDeviceStateProperties(
 721     const std::string& service_path,
 722     base::DictionaryValue* properties) {
 723   std::string connection_state;
 724   properties->GetStringWithoutPathExpansion(
 725       shill::kStateProperty, &connection_state);
 726   if (!NetworkState::StateIsConnected(connection_state))
 727     return;
 728
 729   // Get the IPConfig properties from the device and store them in "IPConfigs"
 730   // (plural) in the properties dictionary. (Note: Shill only provides a single
 731   // "IPConfig" property for a network service, but a consumer of this API may
 732   // want information about all ipv4 and ipv6 IPConfig properties.
 733   std::string device;
 734   properties->GetStringWithoutPathExpansion(shill::kDeviceProperty, &device);
 735   const DeviceState* device_state =
 736       network_state_handler_->GetDeviceState(device);
 737   if (!device_state) {
 738     NET_LOG_ERROR("GetDeviceProperties: no device: " + device, service_path);
 739     return;
 740   }
 741
 742   // Get the hardware MAC address from the DeviceState.
 743   if (!device_state->mac_address().empty()) {
 744     properties->SetStringWithoutPathExpansion(
 745         shill::kAddressProperty, device_state->mac_address());
 746   }
 747
 748   // Convert IPConfig dictionary to a ListValue.
 749   base::ListValue* ip_configs = new base::ListValue;
 750   for (base::DictionaryValue::Iterator iter(device_state->ip_configs());
 751        !iter.IsAtEnd(); iter.Advance()) {
 752     ip_configs->Append(iter.value().DeepCopy());
 753   }
 754   properties->SetWithoutPathExpansion(shill::kIPConfigsProperty, ip_configs);
 755 }
 756
 757 void ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback(
 758     GetDevicePropertiesCallback send_callback,
 759     const std::string& service_path,
 760     const base::DictionaryValue& shill_properties) {
 761   scoped_ptr<base::DictionaryValue> shill_properties_copy(
 762       shill_properties.DeepCopy());
 763
 764   std::string guid;
 765   shill_properties.GetStringWithoutPathExpansion(shill::kGuidProperty, &guid);
 766   if (guid.empty()) {
 767     // Unmanaged networks are assigned a GUID in NetworkState. Provide this
 768     // value in the ONC dictionary.
 769     const NetworkState* state =
 770         network_state_handler_->GetNetworkState(service_path);
 771     if (state && !state->guid().empty()) {
 772       guid = state->guid();
 773       shill_properties_copy->SetStringWithoutPathExpansion(shill::kGuidProperty,
 774                                                            guid);
 775     } else {
 776       LOG(ERROR) << "Network has no GUID specified: " << service_path;
 777     }
 778   }
 779
 780   std::string type;
 781   shill_properties_copy->GetStringWithoutPathExpansion(shill::kTypeProperty,
 782                                                        &type);
 783   // Add associated DeviceState properties for non-VPN networks.
 784   if (type != shill::kTypeVPN)
 785     GetDeviceStateProperties(service_path, shill_properties_copy.get());
 786
 787   // Only request additional Device properties for Cellular networks with a
 788   // valid device.
 789   std::string device_path;
 790   if (!network_device_handler_ ||
 791       type != shill::kTypeCellular ||
 792       !shill_properties_copy->GetStringWithoutPathExpansion(
 793           shill::kDeviceProperty, &device_path) ||
 794       device_path.empty()) {
 795     send_callback.Run(service_path, shill_properties_copy.Pass());
 796     return;
 797   }
 798
 799   // Request the device properties. On success or failure pass (a possibly
 800   // modified) |shill_properties| to |send_callback|.
 801   scoped_ptr<base::DictionaryValue> shill_properties_copy_error_copy(
 802       shill_properties_copy->DeepCopy());
 803   network_device_handler_->GetDeviceProperties(
 804       device_path,
 805       base::Bind(&ManagedNetworkConfigurationHandlerImpl::
 806                      GetDevicePropertiesSuccess,
 807                  weak_ptr_factory_.GetWeakPtr(),
 808                  service_path,
 809                  base::Passed(&shill_properties_copy),
 810                  send_callback),
 811       base::Bind(&ManagedNetworkConfigurationHandlerImpl::
 812                      GetDevicePropertiesFailure,
 813                  weak_ptr_factory_.GetWeakPtr(),
 814                  service_path,
 815                  base::Passed(&shill_properties_copy_error_copy),
 816                  send_callback));
 817 }
 818
 819 void ManagedNetworkConfigurationHandlerImpl::GetDevicePropertiesSuccess(
 820     const std::string& service_path,
 821     scoped_ptr<base::DictionaryValue> network_properties,
 822     GetDevicePropertiesCallback send_callback,
 823     const std::string& device_path,
 824     const base::DictionaryValue& device_properties) {
 825   // Create a "Device" dictionary in |network_properties|.
 826   network_properties->SetWithoutPathExpansion(
 827       shill::kDeviceProperty, device_properties.DeepCopy());
 828   send_callback.Run(service_path, network_properties.Pass());
 829 }
 830
 831 void ManagedNetworkConfigurationHandlerImpl::GetDevicePropertiesFailure(
 832     const std::string& service_path,
 833     scoped_ptr<base::DictionaryValue> network_properties,
 834     GetDevicePropertiesCallback send_callback,
 835     const std::string& error_name,
 836     scoped_ptr<base::DictionaryValue> error_data) {
 837   NET_LOG_ERROR("Error getting device properties", service_path);
 838   send_callback.Run(service_path, network_properties.Pass());
 839 }
 840
 841
 842 }  // namespace chromeos