OLD | NEW |
(Empty) | |
| 1 #!/usr/bin/python |
| 2 # -*- coding: utf-8 -*- |
| 3 """Tests for the MacOS preprocess plug-ins.""" |
| 4 |
| 5 import unittest |
| 6 |
| 7 from dfvfs.helpers import fake_file_system_builder |
| 8 from dfvfs.path import fake_path_spec |
| 9 |
| 10 from plaso.preprocessors import macos |
| 11 |
| 12 from tests import test_lib as shared_test_lib |
| 13 from tests.preprocessors import test_lib |
| 14 |
| 15 |
| 16 class MacOSHostnameArtifactMappingTest(test_lib.ArtifactMappingTestCase): |
| 17 """Tests for the MacOS hostname artifact mapping.""" |
| 18 |
| 19 # Note that is only part of the normal preferences.plist file data. |
| 20 _FILE_DATA = ( |
| 21 b'<?xml version="1.0" encoding="UTF-8"?>\n' |
| 22 b'<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' |
| 23 b'"http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n' |
| 24 b'<plist version="1.0">\n' |
| 25 b'<dict>\n' |
| 26 b'\t<key>System</key>\n' |
| 27 b'\t<dict>\n' |
| 28 b'\t\t<key>Network</key>\n' |
| 29 b'\t\t<dict>\n' |
| 30 b'\t\t\t<key>HostNames</key>\n' |
| 31 b'\t\t\t<dict>\n' |
| 32 b'\t\t\t\t<key>LocalHostName</key>\n' |
| 33 b'\t\t\t\t<string>Plaso\'s Mac mini</string>\n' |
| 34 b'\t\t\t</dict>\n' |
| 35 b'\t\t</dict>\n' |
| 36 b'\t\t<key>System</key>\n' |
| 37 b'\t\t<dict>\n' |
| 38 b'\t\t\t<key>ComputerName</key>\n' |
| 39 b'\t\t\t<string>Plaso\'s Mac mini</string>\n' |
| 40 b'\t\t\t<key>ComputerNameEncoding</key>\n' |
| 41 b'\t\t\t<integer>0</integer>\n' |
| 42 b'\t\t</dict>\n' |
| 43 b'\t</dict>\n' |
| 44 b'</dict>\n' |
| 45 b'</plist>\n') |
| 46 |
| 47 def testParsePlistKeyValue(self): |
| 48 """Tests the _ParsePlistKeyValue function.""" |
| 49 file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
| 50 file_system_builder.AddFile( |
| 51 u'/Library/Preferences/SystemConfiguration/preferences.plist', |
| 52 self._FILE_DATA) |
| 53 |
| 54 mount_point = fake_path_spec.FakePathSpec(location=u'/') |
| 55 |
| 56 artifact_mapping = macos.MacOSHostnameArtifactMapping() |
| 57 knowledge_base = self._RunMappingOnFileSystem( |
| 58 file_system_builder.file_system, mount_point, artifact_mapping) |
| 59 |
| 60 self.assertEqual(knowledge_base.hostname, u'Plaso\'s Mac mini') |
| 61 |
| 62 |
| 63 class MacOSKeyboardLayoutArtifactMappingTest(test_lib.ArtifactMappingTestCase): |
| 64 """Tests for the MacOS keyboard layout artifact mapping.""" |
| 65 |
| 66 @shared_test_lib.skipUnlessHasTestFile([u'com.apple.HIToolbox.plist']) |
| 67 def testParsePlistKeyValue(self): |
| 68 """Tests the _ParsePlistKeyValue function.""" |
| 69 file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
| 70 test_file_path = self._GetTestFilePath([u'com.apple.HIToolbox.plist']) |
| 71 file_system_builder.AddFileReadData( |
| 72 u'/Library/Preferences/com.apple.HIToolbox.plist', test_file_path) |
| 73 |
| 74 mount_point = fake_path_spec.FakePathSpec(location=u'/') |
| 75 |
| 76 artifact_mapping = macos.MacOSKeyboardLayoutArtifactMapping() |
| 77 knowledge_base = self._RunMappingOnFileSystem( |
| 78 file_system_builder.file_system, mount_point, artifact_mapping) |
| 79 |
| 80 keyboard_layout = knowledge_base.GetValue('keyboard_layout') |
| 81 self.assertEqual(keyboard_layout, u'US') |
| 82 |
| 83 |
| 84 class MacOSSystemVersionArtifactMappingTest(test_lib.ArtifactMappingTestCase): |
| 85 """Tests for the MacOS system version information artifact mapping.""" |
| 86 |
| 87 _FILE_DATA = ( |
| 88 b'<?xml version="1.0" encoding="UTF-8"?>\n' |
| 89 b'<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ' |
| 90 b'"http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n' |
| 91 b'<plist version="1.0">\n' |
| 92 b'<dict>\n' |
| 93 b'\t<key>ProductBuildVersion</key>\n' |
| 94 b'\t<string>13C64</string>\n' |
| 95 b'\t<key>ProductCopyright</key>\n' |
| 96 b'\t<string>1983-2014 Apple Inc.</string>\n' |
| 97 b'\t<key>ProductName</key>\n' |
| 98 b'\t<string>Mac OS X</string>\n' |
| 99 b'\t<key>ProductUserVisibleVersion</key>\n' |
| 100 b'\t<string>10.9.2</string>\n' |
| 101 b'\t<key>ProductVersion</key>\n' |
| 102 b'\t<string>10.9.2</string>\n' |
| 103 b'</dict>\n' |
| 104 b'</plist>\n') |
| 105 |
| 106 def testParsePlistKeyValue(self): |
| 107 """Tests the _ParsePlistKeyValue function.""" |
| 108 file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
| 109 file_system_builder.AddFile( |
| 110 u'/System/Library/CoreServices/SystemVersion.plist', |
| 111 self._FILE_DATA) |
| 112 |
| 113 mount_point = fake_path_spec.FakePathSpec(location=u'/') |
| 114 |
| 115 artifact_mapping = macos.MacOSSystemVersionArtifactMapping() |
| 116 knowledge_base = self._RunMappingOnFileSystem( |
| 117 file_system_builder.file_system, mount_point, artifact_mapping) |
| 118 |
| 119 build = knowledge_base.GetValue(u'operating_system_version') |
| 120 self.assertEqual(build, u'10.9.2') |
| 121 |
| 122 |
| 123 class MacOSTimeZoneArtifactMappingTest(test_lib.ArtifactMappingTestCase): |
| 124 """Tests for the MacOS time zone artifact mapping.""" |
| 125 |
| 126 def testParseFileEntry(self): |
| 127 """Tests the _ParseFileEntry function.""" |
| 128 file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
| 129 file_system_builder.AddSymbolicLink( |
| 130 u'/private/etc/localtime', u'/usr/share/zoneinfo/Europe/Amsterdam') |
| 131 |
| 132 mount_point = fake_path_spec.FakePathSpec(location=u'/') |
| 133 |
| 134 artifact_mapping = macos.MacOSTimeZoneArtifactMapping() |
| 135 knowledge_base = self._RunMappingOnFileSystem( |
| 136 file_system_builder.file_system, mount_point, artifact_mapping) |
| 137 |
| 138 self.assertEqual(knowledge_base.timezone.zone, u'Europe/Amsterdam') |
| 139 |
| 140 |
| 141 class MacOSUserAccountsArtifactMappingTest(test_lib.ArtifactMappingTestCase): |
| 142 """Tests for the MacOS user accounts artifact mapping.""" |
| 143 |
| 144 # pylint: disable=protected-access |
| 145 |
| 146 @shared_test_lib.skipUnlessHasTestFile([u'nobody.plist']) |
| 147 def testRun(self): |
| 148 """Tests the Run function.""" |
| 149 file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
| 150 test_file_path = self._GetTestFilePath([u'nobody.plist']) |
| 151 file_system_builder.AddFileReadData( |
| 152 u'/private/var/db/dslocal/nodes/Default/users/nobody.plist', |
| 153 test_file_path) |
| 154 |
| 155 mount_point = fake_path_spec.FakePathSpec(location=u'/') |
| 156 |
| 157 artifact_mapping = macos.MacOSUserAccountsArtifactMapping() |
| 158 knowledge_base = self._RunMappingOnFileSystem( |
| 159 file_system_builder.file_system, mount_point, artifact_mapping) |
| 160 |
| 161 users = sorted( |
| 162 knowledge_base.user_accounts, |
| 163 key=lambda user_account: user_account.identifier) |
| 164 self.assertEqual(len(users), 1) |
| 165 |
| 166 user_account = users[0] |
| 167 |
| 168 self.assertEqual(user_account.identifier, u'-2') |
| 169 self.assertEqual(user_account.full_name, u'Unprivileged User') |
| 170 self.assertEqual(user_account.user_directory, u'/var/empty') |
| 171 self.assertEqual(user_account.username, u'nobody') |
| 172 |
| 173 |
| 174 if __name__ == '__main__': |
| 175 unittest.main() |
OLD | NEW |