Source code for plaso.parsers.plist_plugins.airport

# -*- coding: utf-8 -*-
"""Plist parser plugin for MacOS Airport plist files."""

from plaso.containers import events
from plaso.parsers import plist
from plaso.parsers.plist_plugins import interface

[docs] class MacOSAirportEventData(events.EventData): """MacOS airport event data. Attributes: last_connected_time (dfdatetime.DateTimeValues): last date and time MacOS Airport connected to the Wi-Fi network. security_type (str): Wi-Fi security type. ssid (str): Wi-Fi SSID. """ DATA_TYPE = 'macos:airport:entry'
[docs] def __init__(self): """Initializes event data.""" super(MacOSAirportEventData, self).__init__(data_type=self.DATA_TYPE) self.last_connected_time = None self.security_type = None self.ssid = None
[docs] class MacOSAirportPlistPlugin(interface.PlistPlugin): """Plist parser plugin for Airport plist files.""" NAME = 'airport' DATA_FORMAT = 'Airport plist file' PLIST_PATH_FILTERS = frozenset([ interface.PlistPathFilter('')]) PLIST_KEYS = frozenset(['RememberedNetworks']) # pylint: disable=arguments-differ def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs): """Extracts relevant Airport entries. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS. """ for plist_key in match.get('RememberedNetworks', []): event_data = MacOSAirportEventData() event_data.last_connected_time = self._GetDateTimeValueFromPlistKey( plist_key, 'LastConnected') event_data.security_type = plist_key.get('SecurityType', None) event_data.ssid = plist_key.get('SSIDString', None) parser_mediator.ProduceEventData(event_data)