Handle prohibited technologies in device policy ONC

chromeos/network/shill_property_handler.cc

Index: chromeos/network/shill_property_handler.cc
diff --git a/chromeos/network/shill_property_handler.cc b/chromeos/network/shill_property_handler.cc
index 02b620d38e6e2895d65b0cccbf3752c4a1bbd5ca..545ebf326141ee5bba67fc479fb227d0ee52ce6a 100644
--- a/chromeos/network/shill_property_handler.cc
+++ b/chromeos/network/shill_property_handler.cc
@@ -9,6 +9,7 @@
 #include "base/bind.h"
 #include "base/format_macros.h"
 #include "base/stl_util.h"
+#include "base/strings/string_util.h"
 #include "base/values.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/shill_device_client.h"
@@ -16,6 +17,9 @@
 #include "chromeos/dbus/shill_manager_client.h"
 #include "chromeos/dbus/shill_profile_client.h"
 #include "chromeos/dbus/shill_service_client.h"
+#include "chromeos/network/managed_network_configuration_handler.h"
+#include "chromeos/network/network_handler.h"
+#include "chromeos/network/network_handler_callbacks.h"
 #include "chromeos/network/network_state.h"
 #include "components/device_event_log/device_event_log.h"
 #include "dbus/object_path.h"
@@ -104,8 +108,7 @@ class ShillPropertyObserver : public ShillPropertyChangedObserver {
 
 ShillPropertyHandler::ShillPropertyHandler(Listener* listener)
     : listener_(listener),
-      shill_manager_(DBusThreadManager::Get()->GetShillManagerClient()) {
-}
+      shill_manager_(DBusThreadManager::Get()->GetShillManagerClient()) {}
 
 ShillPropertyHandler::~ShillPropertyHandler() {
   // Delete network service observers.
@@ -115,11 +118,15 @@ ShillPropertyHandler::~ShillPropertyHandler() {
                                        observed_devices_.end());
   CHECK(shill_manager_ == DBusThreadManager::Get()->GetShillManagerClient());
   shill_manager_->RemovePropertyChangedObserver(this);
+  if (LoginState::IsInitialized())
+    LoginState::Get()->RemoveObserver(this);
 }
 
 void ShillPropertyHandler::Init() {
   UpdateManagerProperties();
   shill_manager_->AddPropertyChangedObserver(this);
+  if (LoginState::IsInitialized())
+    LoginState::Get()->AddObserver(this);
 }
 
 void ShillPropertyHandler::UpdateManagerProperties() {
@@ -153,6 +160,15 @@ void ShillPropertyHandler::SetTechnologyEnabled(
     bool enabled,
     const network_handler::ErrorCallback& error_callback) {
   if (enabled) {
+    if (in_user_session_ &&
+        prohibited_technologies_.find(technology) !=
+            prohibited_technologies_.end()) {
+      chromeos::network_handler::RunErrorCallback(
+          error_callback, "", "prohibited_technologies",
+          "Ignored: Attempt to enable prohibited network technology " +
+              technology);
+      return;
+    }
     enabling_technologies_.insert(technology);
     shill_manager_->EnableTechnology(
         technology, base::Bind(&base::DoNothing),
@@ -169,6 +185,64 @@ void ShillPropertyHandler::SetTechnologyEnabled(
   }
 }
 
+void ShillPropertyHandler::SetProhibitedTechnologies(
+    const std::vector<std::string>& prohibited_technologies,
+    const network_handler::ErrorCallback& error_callback) {
+  // Remove technologies from the other lists.
+  for (const auto& technology : prohibited_technologies)
+    prohibited_technologies_.insert(technology);
+  for (auto iter_prohibited_technology = prohibited_technologies_.begin();
+       iter_prohibited_technology != prohibited_technologies_.end();) {
+    if (std::find(prohibited_technologies.begin(),
+                  prohibited_technologies.end(),
+                  *iter_prohibited_technology) == prohibited_technologies.end())
+      iter_prohibited_technology =
+          prohibited_technologies_.erase(iter_prohibited_technology);
+    else
+      iter_prohibited_technology++;
+  }
+  SetProhibitedTechnologiesEnforced(in_user_session_ && user_policy_applied_);
+}
+
+void ShillPropertyHandler::SetProhibitedTechnologiesEnforced(bool enforced) {
+  std::vector<std::string> prohibited_technologies;
+  if (enforced) {
+    prohibited_technologies.assign(prohibited_technologies_.begin(),
+                                   prohibited_technologies_.end());
+
+    for (const auto& technology : prohibited_technologies_) {
+      enabling_technologies_.erase(technology);
+      enabled_technologies_.erase(technology);
+      shill_manager_->DisableTechnology(
+          technology, base::Bind(&base::DoNothing),
+          base::Bind(&network_handler::ShillErrorCallbackFunction,
+                     "DisableTechnology Failed", technology,
+                     network_handler::ErrorCallback()));
+    }
+  }
+
+  // Send updated prohibited technology list to shill.
+  const std::string prohibited_list =
+      base::JoinString(prohibited_technologies, ",");
+  base::StringValue value(prohibited_list);
+  shill_manager_->SetProperty(
+      "ProhibitedTechnologies", value, base::Bind(&base::DoNothing),
+      base::Bind(&network_handler::ShillErrorCallbackFunction,
+                 "SetTechnologiesProhibited Failed", prohibited_list,
+                 network_handler::ErrorCallback()));
+}
+
+void ShillPropertyHandler::LoggedInStateChanged() {
+  bool is_logged_in = LoginState::Get()->IsUserLoggedIn();
+  in_user_session_ = is_logged_in;
+  SetProhibitedTechnologiesEnforced(in_user_session_ && user_policy_applied_);
+}
+
+void ShillPropertyHandler::UserPolicyApplied() {
+  user_policy_applied_ = true;
+  SetProhibitedTechnologiesEnforced(in_user_session_ && user_policy_applied_);
+}
+
 void ShillPropertyHandler::SetCheckPortalList(
     const std::string& check_portal_list) {
   base::StringValue value(check_portal_list);