Fix wifi_status to correctly gather network_name on MacOS 14+ (osquery#8530)

Author: sgress454

osquery/tables/networking/darwin/wifi_status.mm

@@ -12,20 +12,56 @@
 
 #include <osquery/core/system.h>
 #include <osquery/core/tables.h>
+#include <osquery/logger/logger.h>
 #include <osquery/tables/networking/darwin/wifi_utils.h>
+#include <osquery/utils/darwin/system_profiler.h>
 
 namespace osquery {
 namespace tables {
 
 QueryData genWifiStatus(QueryContext& context) {
   QueryData results;
   @autoreleasepool {
-    std::string interfaceName = "en0";
+    // Get the list of Wifi interfaces on the system.
     NSArray<CWInterface*>* interfaces =
         [[CWWiFiClient sharedWiFiClient] interfaces];
     if (interfaces == nil || [interfaces count] == 0) {
       return results;
     }
+
+    // Var to hold a map of interface names to network names.
+    NSMutableDictionary* wifiNetworks = [NSMutableDictionary dictionary];
+
+    // To get the network name we need to use the system profiler.
+    // Since this is a performance hit, only do it if we need to.
+    if (context.isColumnUsed("network_name")) {
+      // Get Airport data from system profiler, in order to get the current
+      // network name for systems that don't return it via CWWiFiClient.
+      NSDictionary* __autoreleasing result;
+      Status status = getSystemProfilerReport("SPAirPortDataType", result);
+      if (!status.ok()) {
+        LOG(ERROR) << "failed to get SPAirPortDataType config: "
+                   << status.getMessage();
+        result = [NSDictionary dictionary];
+      }
+
+      for (NSDictionary* item in [result objectForKey:@"_items"]) {
+        // Get the item's airport intefaces, which will usually include at least
+        // a wifi card and an Apple Wireless Direct Link (AWDL) interface.
+        NSArray* airportInterfaces =
+            [item objectForKey:@"spairport_airport_interfaces"];
+        // Get the wifi interface (the one starting with "en").
+        NSDictionary* wifiInterface = [[airportInterfaces
+            filteredArrayUsingPredicate:
+                [NSPredicate predicateWithFormat:@"_name BEGINSWITH %@", @"en"]]
+            lastObject];
+        // Add the network name to the map, indexed by interface name.
+        wifiNetworks[[wifiInterface objectForKey:@"_name"]] = [[wifiInterface
+            objectForKey:@"spairport_current_network_information"]
+            objectForKey:@"_name"];
+      }
+    }
+
     for (CWInterface* interface in interfaces) {
       Row r;
       r["interface"] = std::string([[interface interfaceName] UTF8String]);
@@ -34,10 +70,14 @@ QueryData genWifiStatus(QueryContext& context) {
       if (strptr != nil) {
         r["bssid"] = std::string([strptr UTF8String]);
       }
-      strptr = [interface ssid];
-      if (strptr != nil) {
-        r["network_name"] = std::string([strptr UTF8String]);
+
+      NSString* networkName =
+          [wifiNetworks objectForKey:[interface interfaceName]];
+      if (networkName == nil) {
+        networkName = @"";
       }
+      r["network_name"] = std::string([networkName UTF8String]);
+
       NSString* country_code = [interface countryCode];
       if (country_code != nil) {
         r["country_code"] = std::string([country_code UTF8String]);