"""Plist parser plugin for MacOS Airport plist files."""
from plaso.containers import events
from plaso.parsers import plist
from plaso.parsers.plist_plugins import interface
[docs]
class MacOSAirportEventData(events.EventData):
"""MacOS airport event data.
Attributes:
last_connected_time (dfdatetime.DateTimeValues): last date and time MacOS
Airport connected to the Wi-Fi network.
security_type (str): Wi-Fi security type.
ssid (str): Wi-Fi SSID.
"""
DATA_TYPE = "macos:airport:entry"
[docs]
def __init__(self):
"""Initializes event data."""
super().__init__(data_type=self.DATA_TYPE)
self.last_connected_time = None
self.security_type = None
self.ssid = None
[docs]
class MacOSAirportPlistPlugin(interface.PlistPlugin):
"""Plist parser plugin for Airport plist files."""
NAME = "airport"
DATA_FORMAT = "Airport plist file"
PLIST_PATH_FILTERS = frozenset(
[interface.PlistPathFilter("com.apple.airport.preferences.plist")]
)
PLIST_KEYS = frozenset(["RememberedNetworks"])
# pylint: disable=arguments-differ
def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs):
"""Extracts relevant Airport entries.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS.
"""
for plist_key in match.get("RememberedNetworks", []):
event_data = MacOSAirportEventData()
event_data.last_connected_time = self._GetDateTimeValueFromPlistKey(
plist_key, "LastConnected"
)
event_data.security_type = plist_key.get("SecurityType")
event_data.ssid = plist_key.get("SSIDString")
parser_mediator.ProduceEventData(event_data)
plist.PlistParser.RegisterPlugin(MacOSAirportPlistPlugin)