Split out policy code from net/tools/testserver.

This moves the policy-specific code to chrome/browser/policy/cloud/test
and adds LocalPolicyTestServer which simplifies policy test server use
in unit tests.

BUG=chromium:119403
TEST=unit tests
TBR=ben@chromium.org


Review URL: https://chromiumcodereview.appspot.com/12235003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@183159 0039d316-1c4b-4281-b951-d872f2087c98

14 files changed, 260 insertions, 129 deletions

diff --git a/chrome/browser/policy/cloud_policy_browsertest.cc b/chrome/browser/policy/cloud_policy_browsertest.cc
index aff58f8..4e0acda 100644
--- a/chrome/browser/policy/cloud_policy_browsertest.cc
+++ b/chrome/browser/policy/cloud_policy_browsertest.cc
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/base_paths.h"
 #include "base/command_line.h"
+#include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/memory/scoped_ptr.h"
@@ -20,6 +20,7 @@
 #include "chrome/browser/policy/policy_service.h"
 #include "chrome/browser/policy/proto/chrome_settings.pb.h"
 #include "chrome/browser/policy/proto/cloud_policy.pb.h"
+#include "chrome/browser/policy/test/local_policy_test_server.h"
 #include "chrome/browser/policy/test_utils.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
@@ -31,7 +32,6 @@
 #include "content/public/browser/notification_source.h"
 #include "content/public/test/test_utils.h"
 #include "googleurl/src/gurl.h"
-#include "net/test/test_server.h"
 #include "policy/policy_constants.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -169,20 +169,13 @@ class CloudPolicyTest : public InProcessBrowserTest {
   virtual ~CloudPolicyTest() {}
 
   virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
-    // The TestServer wants the docroot as a path relative to the source dir.
-    base::FilePath source;
-    ASSERT_TRUE(PathService::Get(base::DIR_SOURCE_ROOT, &source));
-    ASSERT_TRUE(temp_dir_.CreateUniqueTempDirUnderPath(source));
+    ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
     ASSERT_NO_FATAL_FAILURE(SetServerPolicy(GetEmptyPolicy()));
 
-    test_server_.reset(
-        new net::TestServer(
-            net::TestServer::TYPE_HTTP,
-            net::TestServer::kLocalhost,
-            testserver_relative_docroot()));
+    test_server_.reset(new LocalPolicyTestServer(policy_file_path()));
     ASSERT_TRUE(test_server_->Start());
 
-    std::string url = test_server_->GetURL("device_management").spec();
+    std::string url = test_server_->GetServiceURL().spec();
 
     CommandLine* command_line = CommandLine::ForCurrentProcess();
     command_line->AppendSwitchASCII(switches::kDeviceManagementUrl, url);
@@ -249,36 +242,29 @@ class CloudPolicyTest : public InProcessBrowserTest {
     policy_manager->core()->client()->RemoveObserver(&observer);
   }
 
-  base::FilePath testserver_relative_docroot() {
-    return temp_dir_.path().BaseName().AppendASCII("testserver");
-  }
-
-  base::FilePath testserver_device_management_file() {
-    return temp_dir_.path().AppendASCII("testserver")
-                           .AppendASCII("device_management");
-  }
-
 #if defined(OS_CHROMEOS)
   base::FilePath user_policy_key_dir() {
     return temp_dir_.path().AppendASCII("user_policy");
   }
 
   base::FilePath user_policy_key_file() {
-      return user_policy_key_dir().AppendASCII(kSanitizedUsername)
-                                  .AppendASCII("policy.pub");
+    return user_policy_key_dir().AppendASCII(kSanitizedUsername)
+                                .AppendASCII("policy.pub");
   }
 #endif
 
   void SetServerPolicy(const std::string& policy) {
-    ASSERT_TRUE(file_util::CreateDirectory(
-        testserver_device_management_file().DirName()));
-    int result = file_util::WriteFile(
-        testserver_device_management_file(), policy.data(), policy.size());
+    int result = file_util::WriteFile(policy_file_path(), policy.data(),
+                                      policy.size());
     ASSERT_EQ(static_cast<int>(policy.size()), result);
   }
 
+  base::FilePath policy_file_path() const {
+    return temp_dir_.path().AppendASCII("policy.json");
+  }
+
   base::ScopedTempDir temp_dir_;
-  scoped_ptr<net::TestServer> test_server_;
+  scoped_ptr<LocalPolicyTestServer> test_server_;
 
 #if defined(OS_CHROMEOS)
   std::string session_manager_user_policy_;
diff --git a/chrome/browser/policy/device_management_service_browsertest.cc b/chrome/browser/policy/device_management_service_browsertest.cc
index f927c29..8d0b018 100644
--- a/chrome/browser/policy/device_management_service_browsertest.cc
+++ b/chrome/browser/policy/device_management_service_browsertest.cc
@@ -9,11 +9,12 @@
 #include "base/stl_util.h"
 #include "chrome/browser/policy/cloud_policy_constants.h"
 #include "chrome/browser/policy/device_management_service.h"
+#include "chrome/browser/policy/test/local_policy_test_server.h"
 #include "chrome/browser/policy/test_request_interceptor.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "net/base/upload_bytes_element_reader.h"
 #include "net/base/upload_data_stream.h"
-#include "net/test/test_server.h"
+#include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_test_job.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -95,7 +96,7 @@ class DeviceManagementServiceIntegrationTest
 
   std::string InitTestServer() {
     StartTestServer();
-    return test_server_->GetURL("device_management").spec();
+    return test_server_->GetServiceURL().spec();
   }
 
  protected:
@@ -137,10 +138,7 @@ class DeviceManagementServiceIntegrationTest
 
   void StartTestServer() {
     test_server_.reset(
-        new net::TestServer(
-            net::TestServer::TYPE_HTTP,
-            net::TestServer::kLocalhost,
-            base::FilePath(FILE_PATH_LITERAL("chrome/test/data/policy"))));
+        new LocalPolicyTestServer("device_management_service_browsertest"));
     ASSERT_TRUE(test_server_->Start());
   }
 
@@ -151,7 +149,7 @@ class DeviceManagementServiceIntegrationTest
 
   std::string token_;
   scoped_ptr<DeviceManagementService> service_;
-  scoped_ptr<net::TestServer> test_server_;
+  scoped_ptr<LocalPolicyTestServer> test_server_;
   scoped_ptr<TestRequestInterceptor> interceptor_;
 };
 
diff --git a/chrome/browser/policy/policy_browsertest.cc b/chrome/browser/policy/policy_browsertest.cc
index 141ec76..6406679 100644
--- a/chrome/browser/policy/policy_browsertest.cc
+++ b/chrome/browser/policy/policy_browsertest.cc
@@ -1467,7 +1467,7 @@ IN_PROC_BROWSER_TEST_F(PolicyTest, URLBlacklist) {
     "http://aaa.com/empty.html",
     "http://bbb.com/empty.html",
     "http://sub.bbb.com/empty.html",
-    "http://bbb.com/policy/device_management",
+    "http://bbb.com/policy/blank.html",
   };
   BrowserThread::PostTaskAndReply(
       BrowserThread::IO, FROM_HERE,
diff --git a/net/tools/testserver/asn1der.py b/chrome/browser/policy/test/asn1der.py
index 9e70893..9e70893 100644
--- a/net/tools/testserver/asn1der.py
+++ b/chrome/browser/policy/test/asn1der.py
diff --git a/chrome/browser/policy/test/local_policy_test_server.cc b/chrome/browser/policy/test/local_policy_test_server.cc
new file mode 100644
index 0000000..1052cb2
--- /dev/null
+++ b/chrome/browser/policy/test/local_policy_test_server.cc
@@ -0,0 +1,92 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/test/local_policy_test_server.h"
+
+#include "base/path_service.h"
+#include "base/stringprintf.h"
+#include "base/values.h"
+#include "chrome/common/chrome_paths.h"
+#include "net/test/base_test_server.h"
+#include "net/test/python_utils.h"
+
+namespace policy {
+
+LocalPolicyTestServer::LocalPolicyTestServer(const base::FilePath& config_file)
+    : net::LocalTestServer(net::BaseTestServer::TYPE_HTTP,
+                           net::BaseTestServer::kLocalhost,
+                           base::FilePath()),
+      config_file_(config_file) {}
+
+LocalPolicyTestServer::LocalPolicyTestServer(const std::string& test_name)
+    : net::LocalTestServer(net::BaseTestServer::TYPE_HTTP,
+                           net::BaseTestServer::kLocalhost,
+                           base::FilePath()) {
+  // Read configuration from a file in chrome/test/data/policy.
+  base::FilePath source_root;
+  CHECK(PathService::Get(chrome::DIR_TEST_DATA, &source_root));
+  config_file_ = source_root
+      .AppendASCII("policy")
+      .AppendASCII(base::StringPrintf("policy_%s.json", test_name.c_str()));
+}
+
+LocalPolicyTestServer::~LocalPolicyTestServer() {}
+
+GURL LocalPolicyTestServer::GetServiceURL() const {
+  return GetURL("device_management");
+}
+
+bool LocalPolicyTestServer::SetPythonPath() const {
+  if (!net::LocalTestServer::SetPythonPath())
+    return false;
+
+  // Add the net/tools/testserver directory to the path.
+  base::FilePath net_testserver_path;
+  if (!LocalTestServer::GetTestServerPath(&net_testserver_path)) {
+    LOG(ERROR) << "Failed to get net testserver path.";
+    return false;
+  }
+  AppendToPythonPath(net_testserver_path.DirName());
+
+  // Add the generated python protocol buffer bindings.
+  base::FilePath pyproto_dir;
+  if (!GetPyProtoPath(&pyproto_dir)) {
+    LOG(ERROR) << "Cannot find pyproto dir for generated code.";
+    return false;
+  }
+
+  AppendToPythonPath(pyproto_dir
+                     .AppendASCII("chrome")
+                     .AppendASCII("browser")
+                     .AppendASCII("policy")
+                     .AppendASCII("proto"));
+  return true;
+}
+
+bool LocalPolicyTestServer::GetTestServerPath(
+    base::FilePath* testserver_path) const {
+  base::FilePath source_root;
+  if (!PathService::Get(base::DIR_SOURCE_ROOT, &source_root)) {
+    LOG(ERROR) << "Failed to get DIR_SOURCE_ROOT";
+    return false;
+  }
+  *testserver_path = source_root
+      .AppendASCII("chrome")
+      .AppendASCII("browser")
+      .AppendASCII("policy")
+      .AppendASCII("test")
+      .AppendASCII("policy_testserver.py");
+  return true;
+}
+
+bool LocalPolicyTestServer::GenerateAdditionalArguments(
+    base::DictionaryValue* arguments) const {
+  if (!net::LocalTestServer::GenerateAdditionalArguments(arguments))
+    return false;
+
+  arguments->SetString("config-file", config_file_.AsUTF8Unsafe());
+  return true;
+}
+
+}  // namespace policy;
diff --git a/chrome/browser/policy/test/local_policy_test_server.h b/chrome/browser/policy/test/local_policy_test_server.h
new file mode 100644
index 0000000..10a9e29
--- /dev/null
+++ b/chrome/browser/policy/test/local_policy_test_server.h
@@ -0,0 +1,49 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_TEST_LOCAL_POLICY_TEST_SERVER_H_
+#define CHROME_BROWSER_POLICY_TEST_LOCAL_POLICY_TEST_SERVER_H_
+
+#include <string>
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "base/file_path.h"
+#include "googleurl/src/gurl.h"
+#include "net/test/local_test_server.h"
+
+namespace policy {
+
+// Runs a python implementation of the cloud policy server on the local machine.
+class LocalPolicyTestServer : public net::LocalTestServer {
+ public:
+  // Initializes a test server configured by the configuration file
+  // |config_file|.
+  explicit LocalPolicyTestServer(const base::FilePath& config_file);
+
+  // Initializes the test server with the configuration read from
+  // chrome/test/data/policy/policy_|test_name|.json.
+  explicit LocalPolicyTestServer(const std::string& test_name);
+
+  virtual ~LocalPolicyTestServer();
+
+  // Gets the service URL.
+  GURL GetServiceURL() const;
+
+  // net::LocalTestServer:
+  virtual bool SetPythonPath() const OVERRIDE;
+  virtual bool GetTestServerPath(
+      base::FilePath* testserver_path) const OVERRIDE;
+  virtual bool GenerateAdditionalArguments(
+      base::DictionaryValue* arguments) const OVERRIDE;
+
+ private:
+  base::FilePath config_file_;
+
+  DISALLOW_COPY_AND_ASSIGN(LocalPolicyTestServer);
+};
+
+}  // namespace
+
+#endif  // CHROME_BROWSER_POLICY_TEST_LOCAL_POLICY_TEST_SERVER_H_
diff --git a/net/tools/testserver/device_management.py b/chrome/browser/policy/test/policy_testserver.py
index 93d5b00..b662f2a 100644
--- a/net/tools/testserver/device_management.py
+++ b/chrome/browser/policy/test/policy_testserver.py
@@ -51,6 +51,7 @@ Example:
 
 """
 
+import BaseHTTPServer
 import cgi
 import hashlib
 import logging
@@ -73,6 +74,8 @@ except ImportError:
     json = None
 
 import asn1der
+import testserver_base
+
 import device_management_backend_pb2 as dm
 import cloud_policy_pb2 as cp
 import chrome_device_policy_pb2 as dp
@@ -91,7 +94,8 @@ BAD_MACHINE_IDS = [ '123490EN400015' ];
 # for the register request.
 KIOSK_MACHINE_IDS = [ 'KIOSK' ];
 
-class RequestHandler(object):
+
+class PolicyRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
   """Decodes and handles device management requests from clients.
 
   The handler implements all the request parsing and protobuf message decoding
@@ -99,20 +103,16 @@ class RequestHandler(object):
   unregister clients.
   """
 
-  def __init__(self, server, path, headers, request):
+  def __init__(self, request, client_address, server):
     """Initialize the handler.
 
     Args:
-      server: The TestServer object to use for (un)registering clients.
-      path: A string containing the request path and query parameters.
-      headers: A rfc822.Message-like object containing HTTP headers.
       request: The request data received from the client as a string.
+      client_address: The client address.
+      server: The TestServer object to use for (un)registering clients.
     """
-    self._server = server
-    self._path = path
-    self._headers = headers
-    self._request = request
-    self._params = None
+    BaseHTTPServer.BaseHTTPRequestHandler.__init__(self, request,
+                                                   client_address, server)
 
   def GetUniqueParam(self, name):
     """Extracts a unique query parameter from the request.
@@ -123,14 +123,22 @@ class RequestHandler(object):
       The parameter value or None if the parameter doesn't exist or is not
       unique.
     """
-    if not self._params:
-      self._params = cgi.parse_qs(self._path[self._path.find('?') + 1:])
+    if not hasattr(self, '_params'):
+      self._params = cgi.parse_qs(self.path[self.path.find('?') + 1:])
 
     param_list = self._params.get(name, [])
     if len(param_list) == 1:
       return param_list[0]
     return None;
 
+  def do_POST(self):
+    http_response, raw_reply = self.HandleRequest();
+    self.send_response(http_response)
+    if (http_response == 200):
+      self.send_header('Content-Type', 'application/x-protobuffer')
+    self.end_headers()
+    self.wfile.write(raw_reply)
+
   def HandleRequest(self):
     """Handles a request.
 
@@ -141,10 +149,11 @@ class RequestHandler(object):
       A tuple of HTTP status code and response data to send to the client.
     """
     rmsg = dm.DeviceManagementRequest()
-    rmsg.ParseFromString(self._request)
+    length = int(self.headers.getheader('content-length'))
+    rmsg.ParseFromString(self.rfile.read(length))
 
     logging.debug('gaia auth token -> ' +
-                  self._headers.getheader('Authorization', ''))
+                  self.headers.getheader('Authorization', ''))
     logging.debug('oauth token -> ' + str(self.GetUniqueParam('oauth_token')))
     logging.debug('deviceid -> ' + str(self.GetUniqueParam('deviceid')))
     self.DumpMessage('Request', rmsg)
@@ -180,7 +189,7 @@ class RequestHandler(object):
       return oauth_token
 
     match = re.match('GoogleLogin auth=(\\w+)',
-                     self._headers.getheader('Authorization', ''))
+                     self.headers.getheader('Authorization', ''))
     if match:
       return match.group(1)
 
@@ -203,7 +212,7 @@ class RequestHandler(object):
     if not auth:
       return (403, 'No authorization')
 
-    policy = self._server.GetPolicies()
+    policy = self.server.GetPolicies()
     if ('*' not in policy['managed_users'] and
         auth not in policy['managed_users']):
       return (403, 'Unmanaged')
@@ -212,7 +221,7 @@ class RequestHandler(object):
     if not device_id:
       return (400, 'Missing device identifier')
 
-    token_info = self._server.RegisterDevice(device_id,
+    token_info = self.server.RegisterDevice(device_id,
                                              msg.machine_id,
                                              msg.type)
 
@@ -245,7 +254,7 @@ class RequestHandler(object):
       return response
 
     # Unregister the device.
-    self._server.UnregisterDevice(token['device_token']);
+    self.server.UnregisterDevice(token['device_token']);
 
     # Prepare and send the response.
     response = dm.DeviceManagementResponse()
@@ -436,12 +445,12 @@ class RequestHandler(object):
       return error
 
     if msg.machine_id:
-      self._server.UpdateMachineId(token_info['device_token'], msg.machine_id)
+      self.server.UpdateMachineId(token_info['device_token'], msg.machine_id)
 
     # Response is only given if the scope is specified in the config file.
     # Normally 'google/chromeos/device', 'google/chromeos/user' and
     # 'google/chromeos/publicaccount' should be accepted.
-    policy = self._server.GetPolicies()
+    policy = self.server.GetPolicies()
     policy_value = ''
     policy_key = msg.policy_type
     if msg.settings_entity_id:
@@ -460,13 +469,13 @@ class RequestHandler(object):
     signing_key = None
     req_key = None
     current_key_index = policy.get('current_key_index', 0)
-    nkeys = len(self._server.keys)
+    nkeys = len(self.server.keys)
     if (msg.signature_type == dm.PolicyFetchRequest.SHA1_RSA and
         current_key_index in range(nkeys)):
-      signing_key = self._server.keys[current_key_index]
+      signing_key = self.server.keys[current_key_index]
       if msg.public_key_version in range(1, nkeys + 1):
         # requested key exists, use for signing and rotate.
-        req_key = self._server.keys[msg.public_key_version - 1]['private_key']
+        req_key = self.server.keys[msg.public_key_version - 1]['private_key']
 
     # Fill the policy data protobuf.
     policy_data = dm.PolicyData()
@@ -524,13 +533,13 @@ class RequestHandler(object):
     dmtoken = None
     request_device_id = self.GetUniqueParam('deviceid')
     match = re.match('GoogleDMToken token=(\\w+)',
-                     self._headers.getheader('Authorization', ''))
+                     self.headers.getheader('Authorization', ''))
     if match:
       dmtoken = match.group(1)
     if not dmtoken:
       error = 401
     else:
-      token_info = self._server.LookupToken(dmtoken)
+      token_info = self.server.LookupToken(dmtoken)
       if (not token_info or
           not request_device_id or
           token_info['device_id'] != request_device_id):
@@ -546,16 +555,22 @@ class RequestHandler(object):
     """Helper for logging an ASCII dump of a protobuf message."""
     logging.debug('%s\n%s' % (label, str(msg)))
 
-class TestServer(object):
+
+class PolicyTestServer(testserver_base.ClientRestrictingServerMixIn,
+                       testserver_base.BrokenPipeHandlerMixIn,
+                       testserver_base.StoppableHTTPServer):
   """Handles requests and keeps global service state."""
 
-  def __init__(self, policy_path, private_key_paths):
+  def __init__(self, server_address, policy_path, private_key_paths):
     """Initializes the server.
 
     Args:
+      server_address: Server host and port.
       policy_path: Names the file to read JSON-formatted policy from.
       private_key_paths: List of paths to read private keys from.
     """
+    testserver_base.StoppableHTTPServer.__init__(self, server_address,
+                                                 PolicyRequestHandler)
     self._registered_tokens = {}
     self.policy_path = policy_path
 
@@ -604,19 +619,6 @@ class TestServer(object):
         print 'Failed to load policy from %s' % self.policy_path
     return policy
 
-  def HandleRequest(self, path, headers, request):
-    """Handles a request.
-
-    Args:
-      path: The request path and query parameters received from the client.
-      headers: A rfc822.Message-like object containing HTTP headers.
-      request: The request data received from the client as a string.
-    Returns:
-      A pair of HTTP status code and response data to send to the client.
-    """
-    handler = RequestHandler(self, path, headers, request)
-    return handler.HandleRequest()
-
   def RegisterDevice(self, device_id, machine_id, type):
     """Registers a device or user and generates a DM token for it.
 
@@ -684,3 +686,53 @@ class TestServer(object):
     """
     if dmtoken in self._registered_tokens.keys():
       del self._registered_tokens[dmtoken]
+
+
+class PolicyServerRunner(testserver_base.TestServerRunner):
+
+  def __init__(self):
+    super(PolicyServerRunner, self).__init__()
+
+  def create_server(self, server_data):
+    config_file = (
+        self.options.config_file or
+        os.path.join(self.options.data_dir or '', 'device_management'))
+    server = PolicyTestServer((self.options.host, self.options.port),
+                              config_file, self.options.policy_keys)
+    server_data['port'] = server.server_port
+    return server
+
+  def add_options(self):
+    testserver_base.TestServerRunner.add_options(self)
+    self.option_parser.add_option('--policy-key', action='append',
+                                  dest='policy_keys',
+                                  help='Specify a path to a PEM-encoded '
+                                  'private key to use for policy signing. May '
+                                  'be specified multiple times in order to '
+                                  'load multipe keys into the server. If the '
+                                  'server has multiple keys, it will rotate '
+                                  'through them in at each request in a '
+                                  'round-robin fashion. The server will '
+                                  'generate a random key if none is specified '
+                                  'on the command line.')
+    self.option_parser.add_option('--log-level', dest='log_level',
+                                  default='WARN',
+                                  help='Log level threshold to use.')
+    self.option_parser.add_option('--config-file', dest='config_file',
+                                  help='Specify a configuration file to use '
+                                  'instead of the default '
+                                  '<data_dir>/device_management')
+
+  def run_server(self):
+    logger = logging.getLogger()
+    logger.setLevel(getattr(logging, str(self.options.log_level).upper()))
+    if (self.options.log_to_console):
+      logger.addHandler(logging.StreamHandler())
+    if (self.options.log_file):
+      logger.addHandler(logging.FileHandler(self.options.log_file))
+
+    testserver_base.TestServerRunner.run_server(self);
+
+
+if __name__ == '__main__':
+  sys.exit(PolicyServerRunner().main())
diff --git a/chrome/browser_tests.isolate b/chrome/browser_tests.isolate
index adf74a7..0ba8ac0 100644
--- a/chrome/browser_tests.isolate
+++ b/chrome/browser_tests.isolate
@@ -158,8 +158,6 @@
     }, {
       'variables': {
         'isolate_dependency_tracked': [
-          '../net/tools/testserver/asn1der.py',
-          '../net/tools/testserver/device_management.py',
           '../third_party/WebKit/Tools/Scripts/new-run-webkit-websocketserver',
           '../third_party/safe_browsing/testing/external_test_pb2.py',
           '../third_party/safe_browsing/testing/safebrowsing_test_server.py',
@@ -201,6 +199,8 @@
           '<(PRODUCT_DIR)/test_case.html',
           '<(PRODUCT_DIR)/test_case.html.mock-http-headers',
           '<(PRODUCT_DIR)/test_page.css',
+          'browser/policy/test/asn1der.py',
+          'browser/policy/test/policy_testserver.py',
           'browser/safe_browsing/safe_browsing_testserver.py',
           'common/extensions/docs/examples/apps/calculator/app/controller.js',
           'common/extensions/docs/examples/apps/calculator/app/view.js',
diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index 8a23acd..5125a07 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi
@@ -151,6 +151,8 @@
         'browser/policy/mock_configuration_policy_provider.h',
         'browser/policy/policy_builder.cc',
         'browser/policy/policy_builder.h',
+        'browser/policy/test/local_policy_test_server.cc',
+        'browser/policy/test/local_policy_test_server.h',
         'browser/prefs/pref_service_mock_builder.cc',
         'browser/prefs/pref_service_mock_builder.h',
         'browser/search_engines/template_url_service_test_util.cc',
diff --git a/chrome/test/data/policy/blank.html b/chrome/test/data/policy/blank.html
new file mode 100644
index 0000000..17fc9a9
--- /dev/null
+++ b/chrome/test/data/policy/blank.html
@@ -0,0 +1,3 @@
+<!-- A blank html file for testing. -->
+<html>
+</html>
diff --git a/chrome/test/data/policy/device_management b/chrome/test/data/policy/policy_device_management_service_browsertest.json
index a64ce58..a64ce58 100644
--- a/chrome/test/data/policy/device_management
+++ b/chrome/test/data/policy/policy_device_management_service_browsertest.json
diff --git a/net/test/local_test_server.cc b/net/test/local_test_server.cc
index e2d334f..5741561 100644
--- a/net/test/local_test_server.cc
+++ b/net/test/local_test_server.cc
@@ -189,13 +189,6 @@ bool LocalTestServer::SetPythonPath() const {
   }
   AppendToPythonPath(pyproto_dir);
 
-  // TODO(cloud_policy): Move this out of net/, since net/ should not have to
-  // depend on chrome/. See http://crbug.com/119403.
-  AppendToPythonPath(pyproto_dir.AppendASCII("chrome")
-                                .AppendASCII("browser")
-                                .AppendASCII("policy")
-                                .AppendASCII("proto"));
-
   return true;
 }
 
diff --git a/net/tools/testserver/OWNERS b/net/tools/testserver/OWNERS
index e9e43d6..78ad9aa 100644
--- a/net/tools/testserver/OWNERS
+++ b/net/tools/testserver/OWNERS
@@ -1,8 +1,3 @@
 # net/ OWNERS can also review testserver changes
 # General reviewer.
 phajdan.jr@chromium.org
-
-# For changes to device_management.py.
-joaodasilva@chromium.org
-mnissler@chromium.org
-pastarmovj@chromium.org
diff --git a/net/tools/testserver/testserver.py b/net/tools/testserver/testserver.py
index 0fe9bd7..54d8b19 100755
--- a/net/tools/testserver/testserver.py
+++ b/net/tools/testserver/testserver.py
@@ -272,7 +272,6 @@ class TestPageHandler(testserver_base.BasePageHandler):
     post_handlers = [
       self.EchoTitleHandler,
       self.EchoHandler,
-      self.DeviceManagementHandler,
       self.PostOnlyFileHandler] + get_handlers
     put_handlers = [
       self.EchoTitleHandler,
@@ -1601,31 +1600,6 @@ class TestPageHandler(testserver_base.BasePageHandler):
     self.wfile.write(contents)
     return True
 
-  def DeviceManagementHandler(self):
-    """Delegates to the device management service used for cloud policy."""
-
-    if not self._ShouldHandleRequest("/device_management"):
-      return False
-
-    raw_request = self.ReadRequestBody()
-
-    if not self.server._device_management_handler:
-      import device_management
-      policy_path = os.path.join(self.server.data_dir, 'device_management')
-      self.server._device_management_handler = (
-          device_management.TestServer(policy_path, self.server.policy_keys))
-
-    http_response, raw_reply = (
-        self.server._device_management_handler.HandleRequest(self.path,
-                                                             self.headers,
-                                                             raw_request))
-    self.send_response(http_response)
-    if (http_response == 200):
-      self.send_header('Content-Type', 'application/x-protobuffer')
-    self.end_headers()
-    self.wfile.write(raw_reply)
-    return True
-
   # called by the redirect handling function when there is no parameter
   def sendRedirectHelp(self, redirect_name):
     self.send_response(200)
@@ -1901,8 +1875,6 @@ class ServerRunner(testserver_base.TestServerRunner):
       server.data_dir = self.__make_data_dir()
       server.file_root_url = self.options.file_root_url
       server_data['port'] = server.server_port
-      server._device_management_handler = None
-      server.policy_keys = self.options.policy_keys
     elif self.options.server_type == SERVER_WEBSOCKET:
       # Launch pywebsocket via WebSocketServer.
       logger = logging.getLogger()
@@ -2055,17 +2027,6 @@ class ServerRunner(testserver_base.TestServerRunner):
                                   'multiple algorithms should be enabled.');
     self.option_parser.add_option('--file-root-url', default='/files/',
                                   help='Specify a root URL for files served.')
-    self.option_parser.add_option('--policy-key', action='append',
-                                  dest='policy_keys',
-                                  help='Specify a path to a PEM-encoded '
-                                  'private key to use for policy signing. May '
-                                  'be specified multiple times in order to '
-                                  'load multipe keys into the server. If the '
-                                  'server has multiple keys, it will rotate '
-                                  'through them in at each request a '
-                                  'round-robin fashion. The server will '
-                                  'generate a random key if none is specified '
-                                  'on the command line.')
 
 
 if __name__ == '__main__':