Convert chromeos::onc::Translate* arguments to new-style base::Value

This only changes the argument types, not the return type, which will
be updated in a follow-up change.

Bug: 646113
Change-Id: Idea5cc9bddf13143720aaba17cf43e36b5bf8e7d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2291294
Commit-Queue: Anand K Mistry <amistry@chromium.org>
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#787639}

chromeos/network/onc/onc_translator.h

@@ -12,6 +12,7 @@
 
 namespace base {
 class DictionaryValue;
+class Value;
 }
 
 namespace chromeos {
@@ -22,21 +23,21 @@ namespace onc {
 
 struct OncValueSignature;
 
-// Translates a hierarchical ONC dictionary |onc_object| to a flat Shill
-// dictionary. The |signature| declares the type of |onc_object| and must point
-// to one of the signature objects in "onc_signature.h". The resulting Shill
-// dictionary is returned.
+// Translates a hierarchical ONC dictionary |onc_object| (a Value of type
+// DICTIONARY) to a flat Shill dictionary. The |signature| declares the type of
+// |onc_object| and must point to one of the signature objects in
+// "onc_signature.h". The resulting Shill dictionary is returned.
 //
 // This function is used to translate network settings from ONC to Shill's
 // format before sending them to Shill.
 COMPONENT_EXPORT(CHROMEOS_NETWORK)
 std::unique_ptr<base::DictionaryValue> TranslateONCObjectToShill(
     const OncValueSignature* signature,
-    const base::DictionaryValue& onc_object);
+    const base::Value& onc_object);
 
-// Translates a |shill_dictionary| to an ONC object according to the given
-// |onc_signature|. |onc_signature| must point to a signature object in
-// "onc_signature.h". The resulting ONC object is returned.
+// Translates a |shill_dictionary| (a Value of type DICTIONARY) to an ONC object
+// according to the given |onc_signature|. |onc_signature| must point to a
+// signature object in "onc_signature.h". The resulting ONC object is returned.
 //
 // This function is used to translate network settings coming from Shill to ONC
 // before sending them to the UI. The result doesn't have to be valid ONC, but
@@ -48,7 +49,7 @@ std::unique_ptr<base::DictionaryValue> TranslateONCObjectToShill(
 // be set.
 COMPONENT_EXPORT(CHROMEOS_NETWORK)
 std::unique_ptr<base::DictionaryValue> TranslateShillServiceToONCPart(
-    const base::DictionaryValue& shill_dictionary,
+    const base::Value& shill_dictionary,
     ::onc::ONCSource onc_source,
     const OncValueSignature* onc_signature,
     const NetworkState* network_state);

chromeos/network/onc/onc_translator_onc_to_shill.cc

@@ -48,21 +48,27 @@ base::Value ConvertVpnValueToString(const base::Value& value) {
   return base::Value(str);
 }
 
+// Returns the string value of |key| from |dict| if found, or the empty string
+// otherwise.
+std::string FindStringKeyOrEmpty(const base::Value* dict,
+                                 base::StringPiece key) {
+  const std::string* value = dict->FindStringKey(key);
+  return value ? *value : std::string();
+}
+
 // Sets any client cert properties when ClientCertType is PKCS11Id.
 void SetClientCertProperties(client_cert::ConfigType config_type,
-                             const base::DictionaryValue* onc_object,
-                             base::DictionaryValue* shill_dictionary) {
-  std::string cert_type;
-  onc_object->GetStringWithoutPathExpansion(::onc::client_cert::kClientCertType,
-                                            &cert_type);
+                             const base::Value* onc_object,
+                             base::Value* shill_dictionary) {
+  const std::string cert_type =
+      FindStringKeyOrEmpty(onc_object, ::onc::client_cert::kClientCertType);
   if (cert_type != ::onc::client_cert::kPKCS11Id) {
     client_cert::SetEmptyShillProperties(config_type, shill_dictionary);
     return;
   }
 
-  std::string pkcs11_id;
-  onc_object->GetStringWithoutPathExpansion(
-      ::onc::client_cert::kClientCertPKCS11Id, &pkcs11_id);
+  const std::string pkcs11_id =
+      FindStringKeyOrEmpty(onc_object, ::onc::client_cert::kClientCertPKCS11Id);
   if (pkcs11_id.empty()) {
     // If the cert type is PKCS11 but the pkcs11 id is empty, set empty
     // properties to indicate 'no certificate'.
@@ -85,8 +91,8 @@ void SetClientCertProperties(client_cert::ConfigType config_type,
 class LocalTranslator {
  public:
   LocalTranslator(const OncValueSignature& onc_signature,
-                  const base::DictionaryValue& onc_object,
-                  base::DictionaryValue* shill_dictionary)
+                  const base::Value& onc_object,
+                  base::Value* shill_dictionary)
       : onc_signature_(&onc_signature),
         onc_object_(&onc_object),
         shill_dictionary_(shill_dictionary) {
@@ -131,8 +137,8 @@ class LocalTranslator {
 
   const OncValueSignature* onc_signature_;
   const FieldTranslationEntry* field_translation_table_;
-  const base::DictionaryValue* onc_object_;
-  base::DictionaryValue* shill_dictionary_;
+  const base::Value* onc_object_;
+  base::Value* shill_dictionary_;
 
   DISALLOW_COPY_AND_ASSIGN(LocalTranslator);
 };
@@ -161,12 +167,11 @@ void LocalTranslator::TranslateFields() {
 }
 
 void LocalTranslator::TranslateEthernet() {
-  std::string authentication;
-  onc_object_->GetStringWithoutPathExpansion(::onc::ethernet::kAuthentication,
-                                             &authentication);
+  const std::string* authentication =
+      onc_object_->FindStringKey(::onc::ethernet::kAuthentication);
 
   const char* shill_type = shill::kTypeEthernet;
-  if (authentication == ::onc::ethernet::k8021X)
+  if (authentication && *authentication == ::onc::ethernet::k8021X)
     shill_type = shill::kTypeEthernetEap;
   shill_dictionary_->SetKey(shill::kTypeProperty, base::Value(shill_type));
 
@@ -179,9 +184,8 @@ void LocalTranslator::TranslateOpenVPN() {
   CopyFieldFromONCToShill(::onc::vpn::kSaveCredentials,
                           shill::kSaveCredentialsProperty);
 
-  std::string user_auth_type;
-  onc_object_->GetStringWithoutPathExpansion(
-      ::onc::openvpn::kUserAuthenticationType, &user_auth_type);
+  std::string user_auth_type = FindStringKeyOrEmpty(
+      onc_object_, ::onc::openvpn::kUserAuthenticationType);
   // The default behavior (if user_auth_type is empty) is to use both password
   // and OTP in a static challenge and only the password otherwise. As long as
   // Shill doe not know about the exact user authentication type, this is
@@ -202,11 +206,14 @@ void LocalTranslator::TranslateOpenVPN() {
   // Shill supports only one RemoteCertKU but ONC specifies a list, so copy only
   // the first entry if the lists exists. Otherwise copy an empty string to
   // reset any previous configuration.
-  const base::ListValue* cert_kus = nullptr;
+  const base::Value* cert_kus =
+      onc_object_->FindListKey(::onc::openvpn::kRemoteCertKU);
   std::string cert_ku;
-  if (onc_object_->GetListWithoutPathExpansion(::onc::openvpn::kRemoteCertKU,
-                                               &cert_kus)) {
-    cert_kus->GetString(0, &cert_ku);
+  if (cert_kus) {
+    const auto cert_kus_list = cert_kus->GetList();
+    if (!cert_kus_list.empty() && cert_kus_list[0].is_string()) {
+      cert_ku = cert_kus_list[0].GetString();
+    }
   }
   shill_dictionary_->SetKey(shill::kOpenVPNRemoteCertKUProperty,
                             base::Value(cert_ku));
@@ -224,17 +231,16 @@ void LocalTranslator::TranslateOpenVPN() {
 
   // Modified CopyFieldsAccordingToSignature to handle RemoteCertKU and
   // ServerCAPEMs and handle all other fields as strings.
-  for (base::DictionaryValue::Iterator it(*onc_object_); !it.IsAtEnd();
-       it.Advance()) {
-    std::string key = it.key();
+  for (const auto& it : onc_object_->DictItems()) {
+    std::string key = it.first;
     base::Value translated;
     if (key == ::onc::openvpn::kRemoteCertKU ||
         key == ::onc::openvpn::kServerCAPEMs ||
         key == ::onc::openvpn::kExtraHosts) {
-      translated = it.value().Clone();
+      translated = it.second.Clone();
     } else {
       // Shill wants all Provider/VPN fields to be strings.
-      translated = ConvertVpnValueToString(it.value());
+      translated = ConvertVpnValueToString(it.second);
     }
     if (!translated.is_none())
       AddValueAccordingToSignature(key, translated);
@@ -272,24 +278,23 @@ void LocalTranslator::TranslateL2TP() {
 }
 
 void LocalTranslator::TranslateVPN() {
-  std::string onc_type;
-  if (onc_object_->GetStringWithoutPathExpansion(::onc::vpn::kType,
-                                                 &onc_type)) {
-    TranslateWithTableAndSet(onc_type, kVPNTypeTable,
+  const std::string* onc_type = onc_object_->FindStringKey(::onc::vpn::kType);
+  if (onc_type) {
+    TranslateWithTableAndSet(*onc_type, kVPNTypeTable,
                              shill::kProviderTypeProperty);
   }
-  if (onc_type == ::onc::vpn::kThirdPartyVpn) {
+  if (onc_type && *onc_type == ::onc::vpn::kThirdPartyVpn) {
     // For third-party VPNs, |shill::kProviderHostProperty| is used to store the
     // provider's extension ID.
-    const base::DictionaryValue* onc_third_party_vpn = nullptr;
-    onc_object_->GetDictionaryWithoutPathExpansion(::onc::vpn::kThirdPartyVpn,
-                                                   &onc_third_party_vpn);
-    std::string onc_extension_id;
-    if (onc_third_party_vpn &&
-        onc_third_party_vpn->GetStringWithoutPathExpansion(
-            ::onc::third_party_vpn::kExtensionID, &onc_extension_id)) {
+    const base::Value* onc_third_party_vpn =
+        onc_object_->FindDictKey(::onc::vpn::kThirdPartyVpn);
+    if (onc_third_party_vpn) {
+      const std::string* onc_extension_id = onc_third_party_vpn->FindStringKey(
+          ::onc::third_party_vpn::kExtensionID);
+      if (onc_extension_id) {
         shill_dictionary_->SetKey(shill::kProviderHostProperty,
-                                base::Value(onc_extension_id));
+                                  base::Value(*onc_extension_id));
+      }
     }
   } else {
     CopyFieldFromONCToShill(::onc::vpn::kHost, shill::kProviderHostProperty);
@@ -299,12 +304,12 @@ void LocalTranslator::TranslateVPN() {
 }
 
 void LocalTranslator::TranslateWiFi() {
-  std::string security;
-  if (onc_object_->GetStringWithoutPathExpansion(::onc::wifi::kSecurity,
-                                                 &security)) {
-    TranslateWithTableAndSet(security, kWiFiSecurityTable,
+  const std::string* security =
+      onc_object_->FindStringKey(::onc::wifi::kSecurity);
+  if (security) {
+    TranslateWithTableAndSet(*security, kWiFiSecurityTable,
                              shill::kSecurityClassProperty);
-    if (security == ::onc::wifi::kWEP_8021X) {
+    if (*security == ::onc::wifi::kWEP_8021X) {
       shill_dictionary_->SetKey(shill::kEapKeyMgmtProperty,
                                 base::Value(shill::kKeyManagementIEEE8021X));
     }
@@ -314,29 +319,30 @@ void LocalTranslator::TranslateWiFi() {
   shill_dictionary_->SetKey(shill::kModeProperty,
                             base::Value(shill::kModeManaged));
 
-  bool allow_gateway_arp_polling;
-  if (onc_object_->GetBooleanWithoutPathExpansion(
-          ::onc::wifi::kAllowGatewayARPPolling, &allow_gateway_arp_polling)) {
+  base::Optional<bool> allow_gateway_arp_polling =
+      onc_object_->FindBoolKey(::onc::wifi::kAllowGatewayARPPolling);
+  if (allow_gateway_arp_polling) {
     shill_dictionary_->SetKey(shill::kLinkMonitorDisableProperty,
-                              base::Value(!allow_gateway_arp_polling));
+                              base::Value(!*allow_gateway_arp_polling));
   }
 
   CopyFieldsAccordingToSignature();
 }
 
 void LocalTranslator::TranslateEAP() {
-  std::string outer;
-  onc_object_->GetStringWithoutPathExpansion(::onc::eap::kOuter, &outer);
+  const std::string outer =
+      FindStringKeyOrEmpty(onc_object_, ::onc::eap::kOuter);
   if (!outer.empty())
     TranslateWithTableAndSet(outer, kEAPOuterTable, shill::kEapMethodProperty);
 
   // Translate the inner protocol only for outer tunneling protocols.
   if (outer == ::onc::eap::kPEAP || outer == ::onc::eap::kEAP_TTLS) {
+    std::string inner = FindStringKeyOrEmpty(onc_object_, ::onc::eap::kInner);
     // In ONC the Inner protocol defaults to "Automatic".
-    std::string inner = ::onc::eap::kAutomatic;
+    if (inner.empty())
+      inner = ::onc::eap::kAutomatic;
     // ONC's Inner == "Automatic" translates to omitting the Phase2 property in
     // Shill.
-    onc_object_->GetStringWithoutPathExpansion(::onc::eap::kInner, &inner);
     if (inner != ::onc::eap::kAutomatic) {
       const StringTranslationEntry* table = outer == ::onc::eap::kPEAP
                                                 ? kEAP_PEAP_InnerTable
@@ -360,9 +366,9 @@ void LocalTranslator::TranslateEAP() {
 
   // Set shill::kEapSubjectAlternativeNameMatchProperty to the serialized form
   // of the subject alternative name match list of dictionaries.
-  const base::ListValue* subject_alternative_name_match;
-  if (onc_object_->GetList(::onc::eap::kSubjectAlternativeNameMatch,
-                           &subject_alternative_name_match)) {
+  const base::Value* subject_alternative_name_match =
+      onc_object_->FindListKey(::onc::eap::kSubjectAlternativeNameMatch);
+  if (subject_alternative_name_match) {
     base::Value serialized_dicts(base::Value::Type::LIST);
     std::string serialized_dict;
     JSONStringValueSerializer serializer(&serialized_dict);
@@ -399,10 +405,8 @@ void LocalTranslator::TranslateStaticIPConfig() {
 }
 
 void LocalTranslator::TranslateNetworkConfiguration() {
-  std::string type;
-  onc_object_->GetStringWithoutPathExpansion(::onc::network_config::kType,
-                                             &type);
-
+  const std::string type =
+      FindStringKeyOrEmpty(onc_object_, ::onc::network_config::kType);
   if (type == ::onc::network_type::kWimaxDeprecated) {
     NET_LOG(ERROR) << "WiMAX ONC configuration is no longer supported.";
     return;
@@ -416,24 +420,22 @@ void LocalTranslator::TranslateNetworkConfiguration() {
   if (type == ::onc::network_type::kVPN)
     CopyFieldFromONCToShill(::onc::network_config::kName, shill::kNameProperty);
 
-  std::string ip_address_config_type, name_servers_config_type;
-  onc_object_->GetStringWithoutPathExpansion(
-      ::onc::network_config::kIPAddressConfigType, &ip_address_config_type);
-  onc_object_->GetStringWithoutPathExpansion(
-      ::onc::network_config::kNameServersConfigType, &name_servers_config_type);
+  const std::string ip_address_config_type = FindStringKeyOrEmpty(
+      onc_object_, ::onc::network_config::kIPAddressConfigType);
+  const std::string name_servers_config_type = FindStringKeyOrEmpty(
+      onc_object_, ::onc::network_config::kNameServersConfigType);
   if ((ip_address_config_type == ::onc::network_config::kIPConfigTypeDHCP) ||
       (name_servers_config_type == ::onc::network_config::kIPConfigTypeDHCP)) {
     // If either type is set to DHCP, provide an empty dictionary to ensure
     // that any unset properties are cleared. Note: if either type is specified,
     // the other type defaults to DHCP if not specified.
-    shill_dictionary_->SetWithoutPathExpansion(
-        shill::kStaticIPConfigProperty,
-        std::make_unique<base::DictionaryValue>());
+    shill_dictionary_->SetKey(shill::kStaticIPConfigProperty,
+                              base::Value(base::Value::Type::DICTIONARY));
   }
 
-  const base::DictionaryValue* proxy_settings = nullptr;
-  if (onc_object_->GetDictionaryWithoutPathExpansion(
-          ::onc::network_config::kProxySettings, &proxy_settings)) {
+  const base::Value* proxy_settings =
+      onc_object_->FindDictKey(::onc::network_config::kProxySettings);
+  if (proxy_settings) {
     base::Value proxy_config =
         ConvertOncProxySettingsToProxyConfig(*proxy_settings);
     std::string proxy_config_str;
@@ -446,17 +448,16 @@ void LocalTranslator::TranslateNetworkConfiguration() {
 }
 
 void LocalTranslator::CopyFieldsAccordingToSignature() {
-  for (base::DictionaryValue::Iterator it(*onc_object_); !it.IsAtEnd();
-       it.Advance()) {
-    AddValueAccordingToSignature(it.key(), it.value());
+  for (const auto& it : onc_object_->DictItems()) {
+    AddValueAccordingToSignature(it.first, it.second);
   }
 }
 
 void LocalTranslator::CopyFieldFromONCToShill(
     const std::string& onc_field_name,
     const std::string& shill_property_name) {
-  const base::Value* value = NULL;
-  if (!onc_object_->GetWithoutPathExpansion(onc_field_name, &value))
+  const base::Value* value = onc_object_->FindKey(onc_field_name);
+  if (!value)
     return;
 
   const OncFieldSignature* field_signature =
@@ -510,7 +511,7 @@ void LocalTranslator::TranslateWithTableAndSet(
 // applies the local translation using LocalTranslator::TranslateFields. The
 // results are written to |shill_dictionary|.
 void TranslateONCHierarchy(const OncValueSignature& signature,
-                           const base::DictionaryValue& onc_object,
+                           const base::Value& onc_object,
                            base::Value* shill_dictionary) {
   const std::vector<std::string> path =
       GetPathToNestedShillDictionary(signature);
@@ -524,25 +525,21 @@ void TranslateONCHierarchy(const OncValueSignature& signature,
 
   // Translates fields of |onc_object| and writes them to
   // |target_shill_dictionary_| nested in |shill_dictionary|.
-  LocalTranslator translator(
-      signature, onc_object,
-      static_cast<base::DictionaryValue*>(target_shill_dictionary));
+  LocalTranslator translator(signature, onc_object, target_shill_dictionary);
   translator.TranslateFields();
 
   // Recurse into nested objects.
-  for (base::DictionaryValue::Iterator it(onc_object); !it.IsAtEnd();
-       it.Advance()) {
-    const base::DictionaryValue* inner_object = NULL;
-    if (!it.value().GetAsDictionary(&inner_object))
+  for (const auto& it : onc_object.DictItems()) {
+    if (!it.second.is_dict())
       continue;
 
     const OncFieldSignature* field_signature =
-        GetFieldSignature(signature, it.key());
+        GetFieldSignature(signature, it.first);
     if (!field_signature) {
-      NET_LOG(ERROR) << "Unexpected or deprecated ONC key: " << it.key();
+      NET_LOG(ERROR) << "Unexpected or deprecated ONC key: " << it.first;
       continue;
     }
-    TranslateONCHierarchy(*field_signature->value_signature, *inner_object,
+    TranslateONCHierarchy(*field_signature->value_signature, it.second,
                           shill_dictionary);
   }
 }
@@ -551,7 +548,7 @@ void TranslateONCHierarchy(const OncValueSignature& signature,
 
 std::unique_ptr<base::DictionaryValue> TranslateONCObjectToShill(
     const OncValueSignature* onc_signature,
-    const base::DictionaryValue& onc_object) {
+    const base::Value& onc_object) {
   CHECK(onc_signature != NULL);
   std::unique_ptr<base::DictionaryValue> shill_dictionary(
       new base::DictionaryValue);

chromeos/network/onc/onc_translator_shill_to_onc.cc

@@ -44,28 +44,34 @@ base::Value ConvertVpnStringToValue(const std::string& str,
   return std::move(*value);
 }
 
+// Returns the string value of |key| from |dict| if found, or the empty string
+// otherwise.
+std::string FindStringKeyOrEmpty(const base::Value* dict,
+                                 base::StringPiece key) {
+  const std::string* value = dict->FindStringKey(key);
+  return value ? *value : std::string();
+}
+
 // If the network is configured with an installed certificate, a PKCS11 id will
 // be set which is provided for the UI to display certificate information.
 // Returns true if the PKCS11 id is available and set.
-bool SetPKCS11Id(const base::DictionaryValue* shill_dictionary,
+bool SetPKCS11Id(const base::Value* shill_dictionary,
                  const char* cert_id_property,
                  const char* cert_slot_property,
-                 base::DictionaryValue* onc_object) {
-  std::string shill_cert_id;
-  if (!shill_dictionary->GetStringWithoutPathExpansion(cert_id_property,
-                                                       &shill_cert_id) ||
-      shill_cert_id.empty()) {
+                 base::Value* onc_object) {
+  const std::string* shill_cert_id =
+      shill_dictionary->FindStringKey(cert_id_property);
+  if (!shill_cert_id || shill_cert_id->empty()) {
     return false;
   }
 
-  std::string shill_slot;
+  const std::string* shill_slot =
+      shill_dictionary->FindStringKey(cert_slot_property);
   std::string pkcs11_id;
-  if (shill_dictionary->GetStringWithoutPathExpansion(cert_slot_property,
-                                                      &shill_slot) &&
-      !shill_slot.empty()) {
-    pkcs11_id = shill_slot + ":" + shill_cert_id;
+  if (shill_slot && !shill_slot->empty()) {
+    pkcs11_id = *shill_slot + ":" + *shill_cert_id;
   } else {
-    pkcs11_id = shill_cert_id;
+    pkcs11_id = *shill_cert_id;
   }
 
   onc_object->SetKey(::onc::client_cert::kClientCertType,
@@ -81,7 +87,7 @@ bool SetPKCS11Id(const base::DictionaryValue* shill_dictionary,
 // are translated.
 class ShillToONCTranslator {
  public:
-  ShillToONCTranslator(const base::DictionaryValue& shill_dictionary,
+  ShillToONCTranslator(const base::Value& shill_dictionary,
                        ::onc::ONCSource onc_source,
                        const OncValueSignature& onc_signature,
                        const NetworkState* network_state)
@@ -92,7 +98,7 @@ class ShillToONCTranslator {
     field_translation_table_ = GetFieldTranslationTable(onc_signature);
   }
 
-  ShillToONCTranslator(const base::DictionaryValue& shill_dictionary,
+  ShillToONCTranslator(const base::Value& shill_dictionary,
                        ::onc::ONCSource onc_source,
                        const OncValueSignature& onc_signature,
                        const FieldTranslationEntry* field_translation_table,
@@ -128,7 +134,7 @@ class ShillToONCTranslator {
   // associated to |onc_field_name| and adds it to |onc_object_| at
   // |onc_field_name|.
   void TranslateAndAddNestedObject(const std::string& onc_field_name,
-                                   const base::DictionaryValue& dictionary);
+                                   const base::Value& dictionary);
 
   // Creates an ONC object from |shill_dictionary_| according to the signature
   // associated to |onc_field_name| and adds it to |onc_object_| at
@@ -146,7 +152,7 @@ class ShillToONCTranslator {
   // if the resulting list contains no entries, the result will not be added to
   // |onc_object_|.
   void TranslateAndAddListOfObjects(const std::string& onc_field_name,
-                                    const base::ListValue& list);
+                                    const base::Value& list);
 
   // Applies function CopyProperty to each field of |value_signature| and its
   // base signatures.
@@ -173,11 +179,11 @@ class ShillToONCTranslator {
   // for debugging.
   std::string GetName();
 
-  const base::DictionaryValue* shill_dictionary_;
+  const base::Value* shill_dictionary_;
   ::onc::ONCSource onc_source_;
   const OncValueSignature* onc_signature_;
   const FieldTranslationEntry* field_translation_table_;
-  std::unique_ptr<base::DictionaryValue> onc_object_;
+  std::unique_ptr<base::Value> onc_object_;
   const NetworkState* network_state_;
 
   DISALLOW_COPY_AND_ASSIGN(ShillToONCTranslator);
@@ -185,7 +191,7 @@ class ShillToONCTranslator {
 
 std::unique_ptr<base::DictionaryValue>
 ShillToONCTranslator::CreateTranslatedONCObject() {
-  onc_object_.reset(new base::DictionaryValue);
+  onc_object_.reset(new base::Value(base::Value::Type::DICTIONARY));
   if (onc_signature_ == &kNetworkWithStateSignature) {
     TranslateNetworkWithState();
   } else if (onc_signature_ == &kEthernetSignature) {
@@ -218,35 +224,33 @@ ShillToONCTranslator::CreateTranslatedONCObject() {
   } else {
     CopyPropertiesAccordingToSignature();
   }
-  return std::move(onc_object_);
+  return base::DictionaryValue::From(std::move(onc_object_));
 }
 
 void ShillToONCTranslator::TranslateEthernet() {
-  std::string shill_network_type;
-  shill_dictionary_->GetStringWithoutPathExpansion(shill::kTypeProperty,
-                                                   &shill_network_type);
+  const std::string* shill_network_type =
+      shill_dictionary_->FindStringKey(shill::kTypeProperty);
   const char* onc_auth = ::onc::ethernet::kAuthenticationNone;
-  if (shill_network_type == shill::kTypeEthernetEap)
+  if (shill_network_type && *shill_network_type == shill::kTypeEthernetEap)
     onc_auth = ::onc::ethernet::k8021X;
   onc_object_->SetKey(::onc::ethernet::kAuthentication, base::Value(onc_auth));
 
-  if (shill_network_type == shill::kTypeEthernetEap)
+  if (shill_network_type && *shill_network_type == shill::kTypeEthernetEap)
     TranslateAndAddNestedObject(::onc::ethernet::kEAP);
 }
 
 void ShillToONCTranslator::TranslateOpenVPN() {
-  if (shill_dictionary_->HasKey(shill::kOpenVPNVerifyX509NameProperty))
+  if (shill_dictionary_->FindKey(shill::kOpenVPNVerifyX509NameProperty))
     TranslateAndAddNestedObject(::onc::openvpn::kVerifyX509);
 
   // Shill supports only one RemoteCertKU but ONC requires a list. If existing,
   // wraps the value into a list.
-  std::string certKU;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(
-          shill::kOpenVPNRemoteCertKUProperty, &certKU)) {
-    std::unique_ptr<base::ListValue> certKUs(new base::ListValue);
-    certKUs->AppendString(certKU);
-    onc_object_->SetWithoutPathExpansion(::onc::openvpn::kRemoteCertKU,
-                                         std::move(certKUs));
+  const std::string* certKU =
+      shill_dictionary_->FindStringKey(shill::kOpenVPNRemoteCertKUProperty);
+  if (certKU) {
+    base::Value certKUs(base::Value::Type::LIST);
+    certKUs.Append(base::Value(*certKU));
+    onc_object_->SetKey(::onc::openvpn::kRemoteCertKU, std::move(certKUs));
   }
 
   SetPKCS11Id(shill_dictionary_, shill::kOpenVPNClientCertIdProperty, "",
@@ -266,12 +270,14 @@ void ShillToONCTranslator::TranslateOpenVPN() {
     }
 
     std::string shill_property_name;
-    const base::Value* shill_value = NULL;
     if (!field_translation_table_ ||
         !GetShillPropertyName(field_signature->onc_field_name,
-                              field_translation_table_, &shill_property_name) ||
-        !shill_dictionary_->GetWithoutPathExpansion(shill_property_name,
-                                                    &shill_value)) {
+                              field_translation_table_, &shill_property_name)) {
+      continue;
+    }
+    const base::Value* shill_value =
+        shill_dictionary_->FindKey(shill_property_name);
+    if (!shill_value) {
       continue;
     }
 
@@ -301,7 +307,7 @@ void ShillToONCTranslator::TranslateOpenVPN() {
 
 void ShillToONCTranslator::TranslateIPsec() {
   CopyPropertiesAccordingToSignature();
-  if (shill_dictionary_->HasKey(shill::kL2tpIpsecXauthUserProperty))
+  if (shill_dictionary_->FindKey(shill::kL2tpIpsecXauthUserProperty))
     TranslateAndAddNestedObject(::onc::ipsec::kXAUTH);
 
   std::string authentication_type;
@@ -333,11 +339,11 @@ void ShillToONCTranslator::TranslateThirdPartyVPN() {
 
   // For third-party VPNs, |shill::kProviderHostProperty| is used to store the
   // provider's extension ID.
-  std::string shill_extension_id;
-  shill_dictionary_->GetStringWithoutPathExpansion(shill::kHostProperty,
-                                                   &shill_extension_id);
-  onc_object_->SetKey(::onc::third_party_vpn::kExtensionID,
-                      base::Value(shill_extension_id));
+  const std::string* shill_extension_id =
+      shill_dictionary_->FindStringKey(shill::kHostProperty);
+  onc_object_->SetKey(
+      ::onc::third_party_vpn::kExtensionID,
+      base::Value(shill_extension_id ? *shill_extension_id : std::string()));
 }
 
 void ShillToONCTranslator::TranslateVPN() {
@@ -345,24 +351,23 @@ void ShillToONCTranslator::TranslateVPN() {
 
   // Parse Shill Provider dictionary. Note, this may not exist, e.g. if we are
   // just translating network state in network_util::TranslateNetworkStateToONC.
-  const base::DictionaryValue* provider = NULL;
-  if (!shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kProviderProperty, &provider)) {
+  const base::Value* provider =
+      shill_dictionary_->FindDictKey(shill::kProviderProperty);
+  if (!provider) {
     return;
   }
-  std::string shill_provider_type, onc_provider_type;
-  provider->GetStringWithoutPathExpansion(shill::kTypeProperty,
-                                          &shill_provider_type);
+  std::string shill_provider_type =
+      FindStringKeyOrEmpty(provider, shill::kTypeProperty);
+  std::string onc_provider_type;
   if (!TranslateStringToONC(kVPNTypeTable, shill_provider_type,
                             &onc_provider_type)) {
     return;
   }
   onc_object_->SetKey(::onc::vpn::kType, base::Value(onc_provider_type));
-  std::string shill_provider_host;
-  if (onc_provider_type != ::onc::vpn::kThirdPartyVpn &&
-      provider->GetStringWithoutPathExpansion(shill::kHostProperty,
-                                              &shill_provider_host)) {
-    onc_object_->SetKey(::onc::vpn::kHost, base::Value(shill_provider_host));
+  const std::string* shill_provider_host =
+      provider->FindStringKey(shill::kHostProperty);
+  if (onc_provider_type != ::onc::vpn::kThirdPartyVpn && shill_provider_host) {
+    onc_object_->SetKey(::onc::vpn::kHost, base::Value(*shill_provider_host));
   }
 
   // Translate the nested dictionary.
@@ -376,25 +381,22 @@ void ShillToONCTranslator::TranslateVPN() {
     provider_type_dictionary = onc_provider_type;
   }
 
-  bool save_credentials;
+  base::Optional<bool> save_credentials =
+      shill_dictionary_->FindBoolKey(shill::kSaveCredentialsProperty);
   if (onc_provider_type != ::onc::vpn::kThirdPartyVpn &&
-      onc_provider_type != ::onc::vpn::kArcVpn &&
-      shill_dictionary_->GetBooleanWithoutPathExpansion(
-          shill::kSaveCredentialsProperty, &save_credentials)) {
+      onc_provider_type != ::onc::vpn::kArcVpn && save_credentials) {
     SetNestedOncValue(provider_type_dictionary, ::onc::vpn::kSaveCredentials,
-                      base::Value(save_credentials));
+                      base::Value(*save_credentials));
   }
 }
 
 void ShillToONCTranslator::TranslateWiFiWithState() {
-  std::string shill_security;
-  std::string shill_key_mgmt;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(
-          shill::kSecurityClassProperty, &shill_security) &&
-      shill_security == shill::kSecurityWep &&
-      shill_dictionary_->GetStringWithoutPathExpansion(
-          shill::kEapKeyMgmtProperty, &shill_key_mgmt) &&
-      shill_key_mgmt == shill::kKeyManagementIEEE8021X) {
+  const std::string* shill_security =
+      shill_dictionary_->FindStringKey(shill::kSecurityClassProperty);
+  const std::string* shill_key_mgmt =
+      shill_dictionary_->FindStringKey(shill::kEapKeyMgmtProperty);
+  if (shill_security && *shill_security == shill::kSecurityWep &&
+      shill_key_mgmt && *shill_key_mgmt == shill::kKeyManagementIEEE8021X) {
     onc_object_->SetKey(::onc::wifi::kSecurity,
                         base::Value(::onc::wifi::kWEP_8021X));
   } else {
@@ -408,11 +410,11 @@ void ShillToONCTranslator::TranslateWiFiWithState() {
   if (!unknown_encoding && !ssid.empty())
     onc_object_->SetKey(::onc::wifi::kSSID, base::Value(ssid));
 
-  bool link_monitor_disable;
-  if (shill_dictionary_->GetBooleanWithoutPathExpansion(
-          shill::kLinkMonitorDisableProperty, &link_monitor_disable)) {
+  base::Optional<bool> link_monitor_disable =
+      shill_dictionary_->FindBoolKey(shill::kLinkMonitorDisableProperty);
+  if (link_monitor_disable) {
     onc_object_->SetKey(::onc::wifi::kAllowGatewayARPPolling,
-                        base::Value(!link_monitor_disable));
+                        base::Value(!*link_monitor_disable));
   }
 
   CopyPropertiesAccordingToSignature();
@@ -427,29 +429,29 @@ void ShillToONCTranslator::TranslateCellularWithState() {
   TranslateWithTableAndSet(shill::kNetworkTechnologyProperty,
                            kNetworkTechnologyTable,
                            ::onc::cellular::kNetworkTechnology);
-  const base::DictionaryValue* dictionary = NULL;
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kServingOperatorProperty, &dictionary)) {
+  const base::Value* dictionary =
+      shill_dictionary_->FindDictKey(shill::kServingOperatorProperty);
+  if (dictionary) {
     TranslateAndAddNestedObject(::onc::cellular::kServingOperator, *dictionary);
   }
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kCellularApnProperty, &dictionary)) {
+  dictionary = shill_dictionary_->FindDictKey(shill::kCellularApnProperty);
+  if (dictionary) {
     TranslateAndAddNestedObject(::onc::cellular::kAPN, *dictionary);
   }
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kCellularLastGoodApnProperty, &dictionary)) {
+  dictionary =
+      shill_dictionary_->FindDictKey(shill::kCellularLastGoodApnProperty);
+  if (dictionary) {
     TranslateAndAddNestedObject(::onc::cellular::kLastGoodAPN, *dictionary);
   }
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kPaymentPortalProperty, &dictionary)) {
+  dictionary = shill_dictionary_->FindDictKey(shill::kPaymentPortalProperty);
+  if (dictionary) {
     TranslateAndAddNestedObject(::onc::cellular::kPaymentPortal, *dictionary);
   }
 
-  const base::DictionaryValue* device_dictionary = NULL;
+  const base::Value* device_dictionary =
+      shill_dictionary_->FindDictKey(shill::kDeviceProperty);
   bool requires_roaming = false;
   bool scanning = false;
-  shill_dictionary_->GetDictionaryWithoutPathExpansion(shill::kDeviceProperty,
-                                                       &device_dictionary);
   if (device_dictionary) {
     // Merge the Device dictionary with this one (Cellular) using the
     // CellularDevice signature.
@@ -476,10 +478,11 @@ void ShillToONCTranslator::TranslateCellularWithState() {
     }
 
     // Get requires_roaming and scanning from the Device dictionary.
-    device_dictionary->GetBooleanWithoutPathExpansion(
-        shill::kProviderRequiresRoamingProperty, &requires_roaming);
-    device_dictionary->GetBooleanWithoutPathExpansion(shill::kScanningProperty,
-                                                      &scanning);
+    requires_roaming =
+        device_dictionary->FindBoolKey(shill::kProviderRequiresRoamingProperty)
+            .value_or(false);
+    scanning = device_dictionary->FindBoolKey(shill::kScanningProperty)
+                   .value_or(false);
   }
   if (requires_roaming) {
     onc_object_->SetKey(::onc::cellular::kRoamingState,
@@ -493,26 +496,26 @@ void ShillToONCTranslator::TranslateCellularWithState() {
 
 void ShillToONCTranslator::TranslateCellularDevice() {
   CopyPropertiesAccordingToSignature();
-  const base::DictionaryValue* shill_sim_lock_status = NULL;
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kSIMLockStatusProperty, &shill_sim_lock_status)) {
+  const base::Value* shill_sim_lock_status =
+      shill_dictionary_->FindDictKey(shill::kSIMLockStatusProperty);
+  if (shill_sim_lock_status) {
     TranslateAndAddNestedObject(::onc::cellular::kSIMLockStatus,
                                 *shill_sim_lock_status);
   }
-  const base::DictionaryValue* shill_home_provider = NULL;
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kHomeProviderProperty, &shill_home_provider)) {
+  const base::Value* shill_home_provider =
+      shill_dictionary_->FindDictKey(shill::kHomeProviderProperty);
+  if (shill_home_provider) {
     TranslateAndAddNestedObject(::onc::cellular::kHomeProvider,
                                 *shill_home_provider);
   }
-  const base::ListValue* shill_apns = NULL;
-  if (shill_dictionary_->GetListWithoutPathExpansion(
-          shill::kCellularApnListProperty, &shill_apns)) {
+  const base::Value* shill_apns =
+      shill_dictionary_->FindListKey(shill::kCellularApnListProperty);
+  if (shill_apns) {
     TranslateAndAddListOfObjects(::onc::cellular::kAPNList, *shill_apns);
   }
-  const base::ListValue* shill_found_networks = NULL;
-  if (shill_dictionary_->GetListWithoutPathExpansion(
-          shill::kFoundNetworksProperty, &shill_found_networks)) {
+  const base::Value* shill_found_networks =
+      shill_dictionary_->FindListKey(shill::kFoundNetworksProperty);
+  if (shill_found_networks) {
     TranslateAndAddListOfObjects(::onc::cellular::kFoundNetworks,
                                  *shill_found_networks);
   }
@@ -521,9 +524,8 @@ void ShillToONCTranslator::TranslateCellularDevice() {
 void ShillToONCTranslator::TranslateNetworkWithState() {
   CopyPropertiesAccordingToSignature();
 
-  std::string shill_network_type;
-  shill_dictionary_->GetStringWithoutPathExpansion(shill::kTypeProperty,
-                                                   &shill_network_type);
+  std::string shill_network_type =
+      FindStringKeyOrEmpty(shill_dictionary_, shill::kTypeProperty);
   std::string onc_network_type = ::onc::network_type::kEthernet;
   if (shill_network_type != shill::kTypeEthernet &&
       shill_network_type != shill::kTypeEthernetEap) {
@@ -539,18 +541,18 @@ void ShillToONCTranslator::TranslateNetworkWithState() {
 
   // Since Name is a read only field in Shill unless it's a VPN, it is copied
   // here, but not when going the other direction (if it's not a VPN).
-  std::string name;
-  shill_dictionary_->GetStringWithoutPathExpansion(shill::kNameProperty, &name);
+  std::string name =
+      FindStringKeyOrEmpty(shill_dictionary_, shill::kNameProperty);
   onc_object_->SetKey(::onc::network_config::kName, base::Value(name));
 
   // Limit ONC state to "NotConnected", "Connected", or "Connecting".
-  std::string state;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(shill::kStateProperty,
-                                                       &state)) {
+  const std::string* state =
+      shill_dictionary_->FindStringKey(shill::kStateProperty);
+  if (state) {
     std::string onc_state = ::onc::connection_state::kNotConnected;
-    if (NetworkState::StateIsConnected(state)) {
+    if (NetworkState::StateIsConnected(*state)) {
       onc_state = ::onc::connection_state::kConnected;
-    } else if (NetworkState::StateIsConnecting(state)) {
+    } else if (NetworkState::StateIsConnecting(*state)) {
       onc_state = ::onc::connection_state::kConnecting;
     }
     onc_object_->SetKey(::onc::network_config::kConnectionState,
@@ -570,18 +572,17 @@ void ShillToONCTranslator::TranslateNetworkWithState() {
     }
   }
 
-  std::string profile_path;
-  if (onc_source_ != ::onc::ONC_SOURCE_UNKNOWN &&
-      shill_dictionary_->GetStringWithoutPathExpansion(shill::kProfileProperty,
-                                                       &profile_path)) {
+  const std::string* profile_path =
+      shill_dictionary_->FindStringKey(shill::kProfileProperty);
+  if (onc_source_ != ::onc::ONC_SOURCE_UNKNOWN && profile_path) {
     std::string source;
     if (onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY)
       source = ::onc::network_config::kSourceDevicePolicy;
     else if (onc_source_ == ::onc::ONC_SOURCE_USER_POLICY)
       source = ::onc::network_config::kSourceUserPolicy;
-    else if (profile_path == NetworkProfileHandler::GetSharedProfilePath())
+    else if (*profile_path == NetworkProfileHandler::GetSharedProfilePath())
       source = ::onc::network_config::kSourceDevice;
-    else if (!profile_path.empty())
+    else if (!profile_path->empty())
       source = ::onc::network_config::kSourceUser;
     else
       source = ::onc::network_config::kSourceNone;
@@ -591,63 +592,61 @@ void ShillToONCTranslator::TranslateNetworkWithState() {
   // Use a human-readable aa:bb format for any hardware MAC address. Note:
   // this property is provided by the caller but is not part of the Shill
   // Service properties (it is copied from the Device properties).
-  std::string address;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(shill::kAddressProperty,
-                                                       &address)) {
+  const std::string* address =
+      shill_dictionary_->FindStringKey(shill::kAddressProperty);
+  if (address) {
     onc_object_->SetKey(
         ::onc::network_config::kMacAddress,
-        base::Value(network_util::FormattedMacAddress(address)));
+        base::Value(network_util::FormattedMacAddress(*address)));
   }
 
   // Shill's Service has an IPConfig property (note the singular), not an
   // IPConfigs property. However, we require the caller of the translation to
   // patch the Shill dictionary before passing it to the translator.
-  const base::ListValue* shill_ipconfigs = NULL;
-  if (shill_dictionary_->GetListWithoutPathExpansion(shill::kIPConfigsProperty,
-                                                     &shill_ipconfigs)) {
+  const base::Value* shill_ipconfigs =
+      shill_dictionary_->FindListKey(shill::kIPConfigsProperty);
+  if (shill_ipconfigs) {
     TranslateAndAddListOfObjects(::onc::network_config::kIPConfigs,
                                  *shill_ipconfigs);
   }
 
-  const base::DictionaryValue* saved_ipconfig = nullptr;
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kSavedIPConfigProperty, &saved_ipconfig)) {
+  const base::Value* saved_ipconfig =
+      shill_dictionary_->FindDictKey(shill::kSavedIPConfigProperty);
+  if (saved_ipconfig) {
     TranslateAndAddNestedObject(::onc::network_config::kSavedIPConfig,
                                 *saved_ipconfig);
   }
 
   // Translate the StaticIPConfig object and set the IP config types.
-  const base::DictionaryValue* static_ipconfig = nullptr;
-  if (shill_dictionary_->GetDictionaryWithoutPathExpansion(
-          shill::kStaticIPConfigProperty, &static_ipconfig)) {
-    std::string ip_address;
-    if (static_ipconfig->GetStringWithoutPathExpansion(shill::kAddressProperty,
-                                                       &ip_address) &&
-        !ip_address.empty()) {
+  const base::Value* static_ipconfig =
+      shill_dictionary_->FindDictKey(shill::kStaticIPConfigProperty);
+  if (static_ipconfig) {
+    const std::string* ip_address =
+        static_ipconfig->FindStringKey(shill::kAddressProperty);
+    if (ip_address && !ip_address->empty()) {
       onc_object_->SetKey(
           ::onc::network_config::kIPAddressConfigType,
           base::Value(::onc::network_config::kIPConfigTypeStatic));
     }
-    const base::ListValue* name_servers = nullptr;
-    if (static_ipconfig->GetListWithoutPathExpansion(
-            shill::kNameServersProperty, &name_servers) &&
-        !name_servers->empty()) {
+    const base::Value* name_servers =
+        static_ipconfig->FindListKey(shill::kNameServersProperty);
+    if (name_servers && !name_servers->GetList().empty()) {
       onc_object_->SetKey(
           ::onc::network_config::kNameServersConfigType,
           base::Value(::onc::network_config::kIPConfigTypeStatic));
     }
-    if (!ip_address.empty() || (name_servers && !name_servers->empty())) {
+    if ((ip_address && !ip_address->empty()) ||
+        (name_servers && !name_servers->GetList().empty())) {
       TranslateAndAddNestedObject(::onc::network_config::kStaticIPConfig,
                                   *static_ipconfig);
     }
   }
 
-  std::string proxy_config_str;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(
-          shill::kProxyConfigProperty, &proxy_config_str) &&
-      !proxy_config_str.empty()) {
+  const std::string* proxy_config_str =
+      shill_dictionary_->FindStringKey(shill::kProxyConfigProperty);
+  if (proxy_config_str && !proxy_config_str->empty()) {
     std::unique_ptr<base::Value> proxy_config_value(
-        ReadDictionaryFromJson(proxy_config_str));
+        ReadDictionaryFromJson(*proxy_config_str));
     if (proxy_config_value) {
       base::Value proxy_settings =
           ConvertProxyConfigToOncProxySettings(*proxy_config_value);
@@ -661,9 +660,8 @@ void ShillToONCTranslator::TranslateNetworkWithState() {
 
 void ShillToONCTranslator::TranslateIPConfig() {
   CopyPropertiesAccordingToSignature();
-  std::string shill_ip_method;
-  shill_dictionary_->GetStringWithoutPathExpansion(shill::kMethodProperty,
-                                                   &shill_ip_method);
+  std::string shill_ip_method =
+      FindStringKeyOrEmpty(shill_dictionary_, shill::kMethodProperty);
   std::string type;
   if (shill_ip_method == shill::kTypeIPv4 ||
       shill_ip_method == shill::kTypeDHCP) {
@@ -683,7 +681,7 @@ void ShillToONCTranslator::TranslateSavedOrStaticIPConfig() {
 
   // Static and Saved IPConfig in Shill are always of type IPv4. Set this type
   // in ONC, but not if the object would be empty except the type.
-  if (!onc_object_->empty()) {
+  if (!onc_object_->DictEmpty()) {
     onc_object_->SetKey(::onc::ipconfig::kType,
                         base::Value(::onc::ipconfig::kIPv4));
   }
@@ -701,37 +699,35 @@ void ShillToONCTranslator::TranslateEap() {
   CopyPropertiesAccordingToSignature();
 
   // Translate EAP Outer and Inner values if EAP.EAP exists and is not empty.
-  std::string shill_eap_method;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(
-          shill::kEapMethodProperty, &shill_eap_method) &&
-      !shill_eap_method.empty()) {
+  const std::string* shill_eap_method =
+      shill_dictionary_->FindStringKey(shill::kEapMethodProperty);
+  if (shill_eap_method && !shill_eap_method->empty()) {
     TranslateWithTableAndSet(shill::kEapMethodProperty, kEAPOuterTable,
                              ::onc::eap::kOuter);
-    std::string shill_phase2_auth;
-    if (shill_dictionary_->GetStringWithoutPathExpansion(
-            shill::kEapPhase2AuthProperty, &shill_phase2_auth) &&
-        !shill_phase2_auth.empty()) {
+    const std::string* shill_phase2_auth =
+        shill_dictionary_->FindStringKey(shill::kEapPhase2AuthProperty);
+    if (shill_phase2_auth && !shill_phase2_auth->empty()) {
       TranslateWithTableAndSet(shill::kEapPhase2AuthProperty,
                                kEAP_TTLS_InnerTable, ::onc::eap::kInner);
     }
   }
 
-  std::string shill_cert_id;
-  if (shill_dictionary_->GetStringWithoutPathExpansion(
-          shill::kEapCertIdProperty, &shill_cert_id)) {
+  const std::string* shill_cert_id =
+      shill_dictionary_->FindStringKey(shill::kEapCertIdProperty);
+  if (shill_cert_id) {
     onc_object_->SetKey(::onc::client_cert::kClientCertType,
                         base::Value(::onc::client_cert::kPKCS11Id));
     // Note: shill::kEapCertIdProperty is already in the format slot:key_id.
     // Note: shill::kEapKeyIdProperty has the same value as
     //       shill::kEapCertIdProperty and is ignored.
     onc_object_->SetKey(::onc::client_cert::kClientCertPKCS11Id,
-                        base::Value(shill_cert_id));
+                        base::Value(*shill_cert_id));
   }
 
-  bool use_login_password = false;
-  if (shill_dictionary_->GetBooleanWithoutPathExpansion(
-          shill::kEapUseLoginPasswordProperty, &use_login_password) &&
-      use_login_password) {
+  bool use_login_password =
+      shill_dictionary_->FindBoolKey(shill::kEapUseLoginPasswordProperty)
+          .value_or(false);
+  if (use_login_password) {
     onc_object_->SetKey(
         ::onc::eap::kPassword,
         base::Value(::onc::substitutes::kPasswordPlaceholderVerbatim));
@@ -745,7 +741,7 @@ void ShillToONCTranslator::TranslateAndAddNestedObject(
 
 void ShillToONCTranslator::TranslateAndAddNestedObject(
     const std::string& onc_field_name,
-    const base::DictionaryValue& dictionary) {
+    const base::Value& dictionary) {
   const OncFieldSignature* field_signature =
       GetFieldSignature(*onc_signature_, onc_field_name);
   if (!field_signature) {
@@ -759,8 +755,7 @@ void ShillToONCTranslator::TranslateAndAddNestedObject(
       nested_translator.CreateTranslatedONCObject();
   if (nested_object->empty())
     return;
-  onc_object_->SetWithoutPathExpansion(onc_field_name,
-                                       std::move(nested_object));
+  onc_object_->SetKey(onc_field_name, std::move(*nested_object));
 }
 
 void ShillToONCTranslator::SetNestedOncValue(
@@ -772,7 +767,7 @@ void ShillToONCTranslator::SetNestedOncValue(
 
 void ShillToONCTranslator::TranslateAndAddListOfObjects(
     const std::string& onc_field_name,
-    const base::ListValue& list) {
+    const base::Value& list) {
   const OncFieldSignature* field_signature =
       GetFieldSignature(*onc_signature_, onc_field_name);
   if (field_signature->value_signature->onc_type != base::Value::Type::LIST) {
@@ -782,14 +777,12 @@ void ShillToONCTranslator::TranslateAndAddListOfObjects(
     return;
   }
   DCHECK(field_signature->value_signature->onc_array_entry_signature);
-  std::unique_ptr<base::ListValue> result(new base::ListValue());
-  for (base::ListValue::const_iterator it = list.begin(); it != list.end();
-       ++it) {
-    const base::DictionaryValue* shill_value = NULL;
-    if (!it->GetAsDictionary(&shill_value))
+  base::Value result(base::Value::Type::LIST);
+  for (const auto& it : list.GetList()) {
+    if (!it.is_dict())
       continue;
     ShillToONCTranslator nested_translator(
-        *shill_value, onc_source_,
+        it, onc_source_,
         *field_signature->value_signature->onc_array_entry_signature,
         network_state_);
     std::unique_ptr<base::DictionaryValue> nested_object =
@@ -797,12 +790,12 @@ void ShillToONCTranslator::TranslateAndAddListOfObjects(
     // If the nested object couldn't be parsed, simply omit it.
     if (nested_object->empty())
       continue;
-    result->Append(std::move(nested_object));
+    result.Append(std::move(*nested_object));
   }
   // If there are no entries in the list, there is no need to expose this field.
-  if (result->empty())
+  if (result.GetList().empty())
     return;
-  onc_object_->SetWithoutPathExpansion(onc_field_name, std::move(result));
+  onc_object_->SetKey(onc_field_name, std::move(result));
 }
 
 void ShillToONCTranslator::CopyPropertiesAccordingToSignature() {
@@ -824,12 +817,14 @@ void ShillToONCTranslator::CopyPropertiesAccordingToSignature(
 void ShillToONCTranslator::CopyProperty(
     const OncFieldSignature* field_signature) {
   std::string shill_property_name;
-  const base::Value* shill_value = NULL;
   if (!field_translation_table_ ||
       !GetShillPropertyName(field_signature->onc_field_name,
-                            field_translation_table_, &shill_property_name) ||
-      !shill_dictionary_->GetWithoutPathExpansion(shill_property_name,
-                                                  &shill_value)) {
+                            field_translation_table_, &shill_property_name)) {
+    return;
+  }
+  const base::Value* shill_value =
+      shill_dictionary_->FindKey(shill_property_name);
+  if (!shill_value) {
     return;
   }
 
@@ -851,33 +846,32 @@ void ShillToONCTranslator::TranslateWithTableAndSet(
     const std::string& shill_property_name,
     const StringTranslationEntry table[],
     const std::string& onc_field_name) {
-  std::string shill_value;
-  if (!shill_dictionary_->GetStringWithoutPathExpansion(shill_property_name,
-                                                        &shill_value) ||
-      shill_value.empty()) {
+  const std::string* shill_value =
+      shill_dictionary_->FindStringKey(shill_property_name);
+  if (!shill_value || shill_value->empty()) {
     return;
   }
   std::string onc_value;
-  if (TranslateStringToONC(table, shill_value, &onc_value)) {
+  if (TranslateStringToONC(table, *shill_value, &onc_value)) {
     onc_object_->SetKey(onc_field_name, base::Value(onc_value));
     return;
   }
   NET_LOG(ERROR) << "Shill property '" << shill_property_name << "' with value "
-                 << shill_value
+                 << *shill_value
                  << " couldn't be translated to ONC: " << GetName();
 }
 
 std::string ShillToONCTranslator::GetName() {
   DCHECK(shill_dictionary_);
-  std::string name;
-  shill_dictionary_->GetStringWithoutPathExpansion(shill::kNameProperty, &name);
-  return name;
+  const std::string* name =
+      shill_dictionary_->FindStringKey(shill::kNameProperty);
+  return name ? *name : std::string();
 }
 
 }  // namespace
 
 std::unique_ptr<base::DictionaryValue> TranslateShillServiceToONCPart(
-    const base::DictionaryValue& shill_dictionary,
+    const base::Value& shill_dictionary,
     ::onc::ONCSource onc_source,
     const OncValueSignature* onc_signature,
     const NetworkState* network_state) {