Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix last_connected column in wifi_networks on Catalina #6669

Merged
merged 8 commits into from
Oct 21, 2020
Merged

Fix last_connected column in wifi_networks on Catalina #6669

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5c74ea4
Fix last_connected column in wifi_networks on Catalina
mike-myers-tob Sep 24, 2020
682104a
Clang-format
mike-myers-tob Sep 24, 2020
20fc47d
Eliminate duplication of data
mike-myers-tob Oct 21, 2020
f6516b7
Clang-format
mike-myers-tob Oct 21, 2020
1699b30
Consistent variable naming
mike-myers-tob Oct 21, 2020
0fa4032
Properly check for failed results in test
mike-myers-tob Oct 21, 2020
d91b98f
Initialize properly in the test
mike-myers-tob Oct 21, 2020
492640f
Clang format the header include order
mike-myers-tob Oct 21, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 40 additions & 6 deletions osquery/tables/networking/darwin/wifi.mm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,25 +25,52 @@
"/Library/Preferences/SystemConfiguration/"
"com.apple.airport.preferences.plist";

const std::map<std::string, std::string> kKnownWifiNetworkKeys = {
// In 10.14 and prior, there was an "auto_login" key.
const std::map<std::string, std::string> kKnownWifiNetworkKeysPreCatalina = {
{"auto_login", "AutoLogin"}, {"last_connected", "LastConnected"}};

const std::map<std::string, std::string> kKnownWifiNetworkKeysCommon = {
{"ssid", "SSID"},
{"network_name", "SSIDString"},
{"security_type", "SecurityType"},
{"roaming_profile", "RoamingProfileType"},
{"auto_login", "AutoLogin"},
{"last_connected", "LastConnected"},
{"captive_portal", "Captive"},
{"roaming", "SPRoaming"},
{"passpoint", "Passpoint"},
{"possibly_hidden", "PossiblyHiddenNetwork"},
{"disabled", "Disabled"},
{"temporarily_disabled", "TemporarilyDisabled"}};

// Check if we are running on OS X 10.9, where the key in plist is different
// The name of the "last_connected" key changed in 10.15.
const std::map<std::string, std::string> kKnownWifiNetworkKeysPostCatalina = {
{"last_connected", "LastAutoJoinAt"}};

// Adjust the keys to read, based on the version of macOS
Status getKnownWifiNetworkKeys(std::map<std::string, std::string>& keys) {
auto qd = SQL::selectAllFrom("os_version");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like this approach but I see it used in several other places so we can follow up and fix this later.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a table with one row in this case, but I can see it has been a performance problem in other cases in the past?

if (qd.size() != 1) {
return Status(-1, "Couldn't determine macOS version");
}

// Begin with macOS-version-specific keys:
keys = (qd.front().at("major") < "11" && qd.front().at("minor") < "15")
? kKnownWifiNetworkKeysPreCatalina
: kKnownWifiNetworkKeysPostCatalina;

// Then include the common keys (not unique to any particular macOS version):
// C++17 equivalent: keys.merge(kKnownWifiNetworkKeysCommon);
keys.insert(kKnownWifiNetworkKeysCommon.begin(),
kKnownWifiNetworkKeysCommon.end());

return Status(0, "ok");
}

// Check if we are running on macOS 10.9, where the top-level key in the plist
// was different
Status getKnownNetworksKey(std::string& key) {
auto qd = SQL::selectAllFrom("os_version");
if (qd.size() != 1) {
return Status(-1, "Couldn't determine OS X version");
return Status(-1, "Couldn't determine macOS version");
}

key = (qd.front().at("major") == "10" && qd.front().at("minor") == "9")
Expand Down Expand Up @@ -75,8 +102,15 @@ void parseNetworks(const CFDictionaryRef& network, QueryData& results) {
return;
}

std::map<std::string, std::string> keys;
auto status = getKnownWifiNetworkKeys(keys);
if (!status.ok()) {
VLOG(1) << status.getMessage();
return;
}

Row r;
for (const auto& kv : kKnownWifiNetworkKeys) {
for (const auto& kv : keys) {
auto key = CFStringCreateWithCString(
kCFAllocatorDefault, kv.second.c_str(), kCFStringEncodingUTF8);
CFTypeRef value = nullptr;
Expand Down
25 changes: 18 additions & 7 deletions osquery/tables/networking/tests/darwin/wifi_tests.mm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,24 @@
#include <CoreFoundation/CoreFoundation.h>
#include <Foundation/Foundation.h>
#include <gtest/gtest.h>

#include <osquery/config/tests/test_utils.h>
#include <osquery/core/sql/query_data.h>
#include <osquery/core/system.h>
#include <osquery/registry/registry_factory.h>

namespace osquery {
namespace tables {

void parseNetworks(const CFDictionaryRef& network, QueryData& results);

class WifiNetworksTest : public testing::Test {};
class WifiNetworksTest : public testing::Test {
protected:
void SetUp() {
platformSetup();
registryAndPluginInit();
}
};

TEST_F(WifiNetworksTest, test_parse_wifi_networks) {
std::string path = (getTestConfigDirectory() / "test_airport.plist").string();
Expand All @@ -27,22 +36,23 @@
[NSDictionary dictionaryWithContentsOfFile:@(path.c_str())];
ASSERT_GE((long)CFDictionaryGetCount(plist), 1);
std::string key = "KnownNetworks";
auto cfkey = CFStringCreateWithCString(kCFAllocatorDefault, key.c_str(),
kCFStringEncodingUTF8);
auto cfkey = CFStringCreateWithCString(
kCFAllocatorDefault, key.c_str(), kCFStringEncodingUTF8);
auto networks = (CFDictionaryRef)CFDictionaryGetValue(plist, cfkey);

CFRelease(cfkey);

QueryData results;
auto count = CFDictionaryGetCount(networks);
ASSERT_EQ((long)count, 2);
std::vector<const void *> keys(count);
std::vector<const void *> values(count);
std::vector<const void*> keys(count);
std::vector<const void*> values(count);
CFDictionaryGetKeysAndValues(networks, keys.data(), values.data());

for (CFIndex i = 0; i < count; i++) {
parseNetworks((CFDictionaryRef)values[i], results);
}
ASSERT_GT(results.size(), 0);

Row expected1 = {
{"ssid", "2890d228 3487"},
Expand Down Expand Up @@ -89,8 +99,8 @@
[NSDictionary dictionaryWithContentsOfFile:@(path.c_str())];
ASSERT_GE((long)CFDictionaryGetCount(plist), 1);
std::string key = "RememberedNetworks";
auto cfkey = CFStringCreateWithCString(kCFAllocatorDefault, key.c_str(),
kCFStringEncodingUTF8);
auto cfkey = CFStringCreateWithCString(
kCFAllocatorDefault, key.c_str(), kCFStringEncodingUTF8);
auto networks = (CFArrayRef)CFDictionaryGetValue(plist, cfkey);

CFRelease(cfkey);
Expand All @@ -104,6 +114,7 @@
(CFDictionaryRef)CFArrayGetValueAtIndex((CFArrayRef)networks, i),
results);
}
ASSERT_GT(results.size(), 0);

Row expected1 = {
{"ssid", "2890d228 3487"},
Expand Down