1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <gtest/gtest.h>
16 #include <log/log_event_list.h>
17 #include <log/log_read.h>
18 #include <log/logprint.h>
19 #include <stdio.h>
20
21 #include "annotations.h"
22 #include "frameworks/base/cmds/statsd/src/statsd_config.pb.h"
23 #include "matchers/matcher_util.h"
24 #include "stats_event.h"
25 #include "stats_log_util.h"
26 #include "stats_util.h"
27 #include "statsd_test_util.h"
28
29 using namespace android::os::statsd;
30 using std::unordered_map;
31 using std::vector;
32
33 const int32_t TAG_ID = 123;
34 const int32_t TAG_ID_2 = 28; // hardcoded tag of atom with uid field
35 const int FIELD_ID_1 = 1;
36 const int FIELD_ID_2 = 2;
37 const int FIELD_ID_3 = 2;
38
39 const int ATTRIBUTION_UID_FIELD_ID = 1;
40 const int ATTRIBUTION_TAG_FIELD_ID = 2;
41
42
43 #ifdef __ANDROID__
44
45 namespace {
46
makeIntLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const int32_t value)47 void makeIntLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
48 const int32_t value) {
49 AStatsEvent* statsEvent = AStatsEvent_obtain();
50 AStatsEvent_setAtomId(statsEvent, atomId);
51 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
52 AStatsEvent_writeInt32(statsEvent, value);
53
54 parseStatsEventToLogEvent(statsEvent, logEvent);
55 }
56
makeFloatLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const float floatValue)57 void makeFloatLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
58 const float floatValue) {
59 AStatsEvent* statsEvent = AStatsEvent_obtain();
60 AStatsEvent_setAtomId(statsEvent, atomId);
61 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
62 AStatsEvent_writeFloat(statsEvent, floatValue);
63
64 parseStatsEventToLogEvent(statsEvent, logEvent);
65 }
66
makeStringLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const string & name)67 void makeStringLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
68 const string& name) {
69 AStatsEvent* statsEvent = AStatsEvent_obtain();
70 AStatsEvent_setAtomId(statsEvent, atomId);
71 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
72 AStatsEvent_writeString(statsEvent, name.c_str());
73
74 parseStatsEventToLogEvent(statsEvent, logEvent);
75 }
76
makeIntWithBoolAnnotationLogEvent(LogEvent * logEvent,const int32_t atomId,const int32_t field,const uint8_t annotationId,const bool annotationValue)77 void makeIntWithBoolAnnotationLogEvent(LogEvent* logEvent, const int32_t atomId,
78 const int32_t field, const uint8_t annotationId,
79 const bool annotationValue) {
80 AStatsEvent* statsEvent = AStatsEvent_obtain();
81 AStatsEvent_setAtomId(statsEvent, atomId);
82 AStatsEvent_writeInt32(statsEvent, field);
83 AStatsEvent_addBoolAnnotation(statsEvent, annotationId, annotationValue);
84
85 parseStatsEventToLogEvent(statsEvent, logEvent);
86 }
87
makeAttributionLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const vector<int> & attributionUids,const vector<string> & attributionTags,const string & name)88 void makeAttributionLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
89 const vector<int>& attributionUids,
90 const vector<string>& attributionTags, const string& name) {
91 AStatsEvent* statsEvent = AStatsEvent_obtain();
92 AStatsEvent_setAtomId(statsEvent, atomId);
93 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
94
95 writeAttribution(statsEvent, attributionUids, attributionTags);
96 AStatsEvent_writeString(statsEvent, name.c_str());
97
98 parseStatsEventToLogEvent(statsEvent, logEvent);
99 }
100
makeBoolLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const bool bool1,const bool bool2)101 void makeBoolLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
102 const bool bool1, const bool bool2) {
103 AStatsEvent* statsEvent = AStatsEvent_obtain();
104 AStatsEvent_setAtomId(statsEvent, atomId);
105 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
106
107 AStatsEvent_writeBool(statsEvent, bool1);
108 AStatsEvent_writeBool(statsEvent, bool2);
109
110 parseStatsEventToLogEvent(statsEvent, logEvent);
111 }
112
113 } // anonymous namespace
114
TEST(AtomMatcherTest,TestSimpleMatcher)115 TEST(AtomMatcherTest, TestSimpleMatcher) {
116 UidMap uidMap;
117
118 // Set up the matcher
119 AtomMatcher matcher;
120 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
121 simpleMatcher->set_atom_id(TAG_ID);
122
123 LogEvent event(/*uid=*/0, /*pid=*/0);
124 makeIntLogEvent(&event, TAG_ID, 0, 11);
125
126 // Test
127 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
128
129 // Wrong tag id.
130 simpleMatcher->set_atom_id(TAG_ID + 1);
131 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
132 }
133
TEST(AtomMatcherTest,TestAttributionMatcher)134 TEST(AtomMatcherTest, TestAttributionMatcher) {
135 UidMap uidMap;
136 std::vector<int> attributionUids = {1111, 2222, 3333};
137 std::vector<string> attributionTags = {"location1", "location2", "location3"};
138
139 // Set up the log event.
140 LogEvent event(/*uid=*/0, /*pid=*/0);
141 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
142
143 // Set up the matcher
144 AtomMatcher matcher;
145 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
146 simpleMatcher->set_atom_id(TAG_ID);
147
148 // Match first node.
149 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
150 attributionMatcher->set_field(FIELD_ID_1);
151 attributionMatcher->set_position(Position::FIRST);
152 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
153 ATTRIBUTION_TAG_FIELD_ID);
154 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
155 "tag");
156
157 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
158 fieldMatcher->set_field(FIELD_ID_2);
159 fieldMatcher->set_eq_string("some value");
160
161 // Tag not matched.
162 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
163 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
164 "location3");
165 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
166 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
167 "location1");
168 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
169
170 // Match last node.
171 attributionMatcher->set_position(Position::LAST);
172 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
173 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
174 "location3");
175 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
176
177 // Match any node.
178 attributionMatcher->set_position(Position::ANY);
179 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
180 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
181 "location1");
182 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
183 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
184 "location2");
185 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
186 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
187 "location3");
188 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
189 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
190 "location4");
191 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
192
193 // Attribution match but primitive field not match.
194 attributionMatcher->set_position(Position::ANY);
195 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
196 "location2");
197 fieldMatcher->set_eq_string("wrong value");
198 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
199
200 fieldMatcher->set_eq_string("some value");
201
202 // Uid match.
203 attributionMatcher->set_position(Position::ANY);
204 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
205 ATTRIBUTION_UID_FIELD_ID);
206 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
207 "pkg0");
208 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
209
210 uidMap.updateMap(
211 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
212 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
213 android::String16("v1"), android::String16("v2")},
214 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
215 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
216 {android::String16(""), android::String16(""), android::String16(""),
217 android::String16(""), android::String16("")});
218
219 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
220 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
221 "pkg3");
222 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
223 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
224 "pkg2");
225 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
226 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
227 "pkg1");
228 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
229 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
230 "pkg0");
231 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
232
233 attributionMatcher->set_position(Position::FIRST);
234 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
235 "pkg0");
236 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
237 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
238 "pkg3");
239 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
240 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
241 "pkg2");
242 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
243 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
244 "pkg1");
245 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
246
247 attributionMatcher->set_position(Position::LAST);
248 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
249 "pkg0");
250 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
251 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
252 "pkg3");
253 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
254 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
255 "pkg2");
256 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
257 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
258 "pkg1");
259 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
260
261 // Uid + tag.
262 attributionMatcher->set_position(Position::ANY);
263 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
264 ATTRIBUTION_TAG_FIELD_ID);
265 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
266 "pkg0");
267 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
268 "location1");
269 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
270 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
271 "pkg1");
272 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
273 "location1");
274 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
275 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
276 "pkg1");
277 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
278 "location2");
279 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
280 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
281 "pkg2");
282 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
283 "location3");
284 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
285 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
286 "pkg3");
287 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
288 "location3");
289 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
290 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
291 "pkg3");
292 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
293 "location1");
294 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
295
296 attributionMatcher->set_position(Position::FIRST);
297 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
298 "pkg0");
299 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
300 "location1");
301 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
302 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
303 "pkg1");
304 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
305 "location1");
306 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
307 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
308 "pkg1");
309 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
310 "location2");
311 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
312 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
313 "pkg2");
314 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
315 "location3");
316 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
317 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
318 "pkg3");
319 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
320 "location3");
321 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
322 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
323 "pkg3");
324 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
325 "location1");
326 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
327
328 attributionMatcher->set_position(Position::LAST);
329 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
330 "pkg0");
331 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
332 "location1");
333 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
334 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
335 "pkg1");
336 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
337 "location1");
338 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
339 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
340 "pkg1");
341 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
342 "location2");
343 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
344 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
345 "pkg2");
346 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
347 "location3");
348 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
349 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
350 "pkg3");
351 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
352 "location3");
353 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
354 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
355 "pkg3");
356 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
357 "location1");
358 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
359 }
360
TEST(AtomMatcherTest,TestUidFieldMatcher)361 TEST(AtomMatcherTest, TestUidFieldMatcher) {
362 UidMap uidMap;
363 uidMap.updateMap(
364 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
365 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
366 android::String16("v1"), android::String16("v2")},
367 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
368 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
369 {android::String16(""), android::String16(""), android::String16(""),
370 android::String16(""), android::String16("")});
371
372 // Set up matcher
373 AtomMatcher matcher;
374 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
375 simpleMatcher->set_atom_id(TAG_ID);
376 simpleMatcher->add_field_value_matcher()->set_field(1);
377 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("pkg0");
378
379 // Make event without is_uid annotation.
380 LogEvent event1(/*uid=*/0, /*pid=*/0);
381 makeIntLogEvent(&event1, TAG_ID, 0, 1111);
382 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
383
384 // Make event with is_uid annotation.
385 LogEvent event2(/*uid=*/0, /*pid=*/0);
386 makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID_2, 1111, ANNOTATION_ID_IS_UID, true);
387
388 // Event has is_uid annotation, so mapping from uid to package name occurs.
389 simpleMatcher->set_atom_id(TAG_ID_2);
390 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
391
392 // Event has is_uid annotation, but uid maps to different package name.
393 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("Pkg2");
394 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
395 }
396
TEST(AtomMatcherTest,TestNeqAnyStringMatcher)397 TEST(AtomMatcherTest, TestNeqAnyStringMatcher) {
398 UidMap uidMap;
399 uidMap.updateMap(
400 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
401 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
402 android::String16("v1"), android::String16("v2")},
403 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
404 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
405 {android::String16(""), android::String16(""), android::String16(""),
406 android::String16(""), android::String16("")});
407
408 std::vector<int> attributionUids = {1111, 2222, 3333, 1066};
409 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
410
411 // Set up the event
412 LogEvent event(/*uid=*/0, /*pid=*/0);
413 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
414
415 // Set up the matcher
416 AtomMatcher matcher;
417 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
418 simpleMatcher->set_atom_id(TAG_ID);
419
420 // Match first node.
421 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
422 attributionMatcher->set_field(FIELD_ID_1);
423 attributionMatcher->set_position(Position::FIRST);
424 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
425 ATTRIBUTION_UID_FIELD_ID);
426 auto neqStringList = attributionMatcher->mutable_matches_tuple()
427 ->mutable_field_value_matcher(0)
428 ->mutable_neq_any_string();
429 neqStringList->add_str_value("pkg2");
430 neqStringList->add_str_value("pkg3");
431
432 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
433 fieldMatcher->set_field(FIELD_ID_2);
434 fieldMatcher->set_eq_string("some value");
435
436 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
437
438 neqStringList->Clear();
439 neqStringList->add_str_value("pkg1");
440 neqStringList->add_str_value("pkg3");
441 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
442
443 attributionMatcher->set_position(Position::ANY);
444 neqStringList->Clear();
445 neqStringList->add_str_value("maps.com");
446 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
447
448 neqStringList->Clear();
449 neqStringList->add_str_value("PkG3");
450 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
451
452 attributionMatcher->set_position(Position::LAST);
453 neqStringList->Clear();
454 neqStringList->add_str_value("AID_STATSD");
455 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
456 }
457
TEST(AtomMatcherTest,TestEqAnyStringMatcher)458 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
459 UidMap uidMap;
460 uidMap.updateMap(
461 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
462 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
463 android::String16("v1"), android::String16("v2")},
464 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
465 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
466 {android::String16(""), android::String16(""), android::String16(""),
467 android::String16(""), android::String16("")});
468
469 std::vector<int> attributionUids = {1067, 2222, 3333, 1066};
470 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
471
472 // Set up the event
473 LogEvent event(/*uid=*/0, /*pid=*/0);
474 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
475
476 // Set up the matcher
477 AtomMatcher matcher;
478 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
479 simpleMatcher->set_atom_id(TAG_ID);
480
481 // Match first node.
482 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
483 attributionMatcher->set_field(FIELD_ID_1);
484 attributionMatcher->set_position(Position::FIRST);
485 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
486 ATTRIBUTION_UID_FIELD_ID);
487 auto eqStringList = attributionMatcher->mutable_matches_tuple()
488 ->mutable_field_value_matcher(0)
489 ->mutable_eq_any_string();
490 eqStringList->add_str_value("AID_ROOT");
491 eqStringList->add_str_value("AID_INCIDENTD");
492
493 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
494 fieldMatcher->set_field(FIELD_ID_2);
495 fieldMatcher->set_eq_string("some value");
496
497 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
498
499 attributionMatcher->set_position(Position::ANY);
500 eqStringList->Clear();
501 eqStringList->add_str_value("AID_STATSD");
502 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
503
504 eqStringList->Clear();
505 eqStringList->add_str_value("pkg1");
506 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
507
508 auto normalStringField = fieldMatcher->mutable_eq_any_string();
509 normalStringField->add_str_value("some value123");
510 normalStringField->add_str_value("some value");
511 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
512
513 normalStringField->Clear();
514 normalStringField->add_str_value("AID_STATSD");
515 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
516
517 eqStringList->Clear();
518 eqStringList->add_str_value("maps.com");
519 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
520 }
521
TEST(AtomMatcherTest,TestBoolMatcher)522 TEST(AtomMatcherTest, TestBoolMatcher) {
523 UidMap uidMap;
524 // Set up the matcher
525 AtomMatcher matcher;
526 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
527 simpleMatcher->set_atom_id(TAG_ID);
528 auto keyValue1 = simpleMatcher->add_field_value_matcher();
529 keyValue1->set_field(FIELD_ID_1);
530 auto keyValue2 = simpleMatcher->add_field_value_matcher();
531 keyValue2->set_field(FIELD_ID_2);
532
533 // Set up the event
534 LogEvent event(/*uid=*/0, /*pid=*/0);
535 makeBoolLogEvent(&event, TAG_ID, 0, true, false);
536
537 // Test
538 keyValue1->set_eq_bool(true);
539 keyValue2->set_eq_bool(false);
540 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
541
542 keyValue1->set_eq_bool(false);
543 keyValue2->set_eq_bool(false);
544 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
545
546 keyValue1->set_eq_bool(false);
547 keyValue2->set_eq_bool(true);
548 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
549
550 keyValue1->set_eq_bool(true);
551 keyValue2->set_eq_bool(true);
552 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
553 }
554
TEST(AtomMatcherTest,TestStringMatcher)555 TEST(AtomMatcherTest, TestStringMatcher) {
556 UidMap uidMap;
557 // Set up the matcher
558 AtomMatcher matcher;
559 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
560 simpleMatcher->set_atom_id(TAG_ID);
561 auto keyValue = simpleMatcher->add_field_value_matcher();
562 keyValue->set_field(FIELD_ID_1);
563 keyValue->set_eq_string("some value");
564
565 // Set up the event
566 LogEvent event(/*uid=*/0, /*pid=*/0);
567 makeStringLogEvent(&event, TAG_ID, 0, "some value");
568
569 // Test
570 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
571 }
572
TEST(AtomMatcherTest,TestMultiFieldsMatcher)573 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
574 UidMap uidMap;
575 // Set up the matcher
576 AtomMatcher matcher;
577 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
578 simpleMatcher->set_atom_id(TAG_ID);
579 auto keyValue1 = simpleMatcher->add_field_value_matcher();
580 keyValue1->set_field(FIELD_ID_1);
581 auto keyValue2 = simpleMatcher->add_field_value_matcher();
582 keyValue2->set_field(FIELD_ID_2);
583
584 // Set up the event
585 LogEvent event(/*uid=*/0, /*pid=*/0);
586 CreateTwoValueLogEvent(&event, TAG_ID, 0, 2, 3);
587
588 // Test
589 keyValue1->set_eq_int(2);
590 keyValue2->set_eq_int(3);
591 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
592
593 keyValue1->set_eq_int(2);
594 keyValue2->set_eq_int(4);
595 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
596
597 keyValue1->set_eq_int(4);
598 keyValue2->set_eq_int(3);
599 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
600 }
601
TEST(AtomMatcherTest,TestIntComparisonMatcher)602 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
603 UidMap uidMap;
604 // Set up the matcher
605 AtomMatcher matcher;
606 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
607
608 simpleMatcher->set_atom_id(TAG_ID);
609 auto keyValue = simpleMatcher->add_field_value_matcher();
610 keyValue->set_field(FIELD_ID_1);
611
612 // Set up the event
613 LogEvent event(/*uid=*/0, /*pid=*/0);
614 makeIntLogEvent(&event, TAG_ID, 0, 11);
615
616 // Test
617
618 // eq_int
619 keyValue->set_eq_int(10);
620 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
621 keyValue->set_eq_int(11);
622 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
623 keyValue->set_eq_int(12);
624 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
625
626 // lt_int
627 keyValue->set_lt_int(10);
628 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
629 keyValue->set_lt_int(11);
630 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
631 keyValue->set_lt_int(12);
632 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
633
634 // lte_int
635 keyValue->set_lte_int(10);
636 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
637 keyValue->set_lte_int(11);
638 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
639 keyValue->set_lte_int(12);
640 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
641
642 // gt_int
643 keyValue->set_gt_int(10);
644 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
645 keyValue->set_gt_int(11);
646 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
647 keyValue->set_gt_int(12);
648 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
649
650 // gte_int
651 keyValue->set_gte_int(10);
652 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
653 keyValue->set_gte_int(11);
654 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
655 keyValue->set_gte_int(12);
656 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
657 }
658
TEST(AtomMatcherTest,TestFloatComparisonMatcher)659 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
660 UidMap uidMap;
661 // Set up the matcher
662 AtomMatcher matcher;
663 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
664 simpleMatcher->set_atom_id(TAG_ID);
665
666 auto keyValue = simpleMatcher->add_field_value_matcher();
667 keyValue->set_field(FIELD_ID_1);
668
669 LogEvent event1(/*uid=*/0, /*pid=*/0);
670 makeFloatLogEvent(&event1, TAG_ID, 0, 10.1f);
671 keyValue->set_lt_float(10.0);
672 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
673
674 LogEvent event2(/*uid=*/0, /*pid=*/0);
675 makeFloatLogEvent(&event2, TAG_ID, 0, 9.9f);
676 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
677
678 LogEvent event3(/*uid=*/0, /*pid=*/0);
679 makeFloatLogEvent(&event3, TAG_ID, 0, 10.1f);
680 keyValue->set_gt_float(10.0);
681 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
682
683 LogEvent event4(/*uid=*/0, /*pid=*/0);
684 makeFloatLogEvent(&event4, TAG_ID, 0, 9.9f);
685 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
686 }
687
688 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)689 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
690 simpleMatcher->set_atom_id(tag);
691 auto keyValue = simpleMatcher->add_field_value_matcher();
692 keyValue->set_field(key);
693 keyValue->set_eq_int(val);
694 }
695
TEST(AtomMatcherTest,TestAndMatcher)696 TEST(AtomMatcherTest, TestAndMatcher) {
697 // Set up the matcher
698 LogicalOperation operation = LogicalOperation::AND;
699
700 vector<int> children;
701 children.push_back(0);
702 children.push_back(1);
703 children.push_back(2);
704
705 vector<MatchingState> matcherResults;
706 matcherResults.push_back(MatchingState::kMatched);
707 matcherResults.push_back(MatchingState::kNotMatched);
708 matcherResults.push_back(MatchingState::kMatched);
709
710 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
711
712 matcherResults.clear();
713 matcherResults.push_back(MatchingState::kMatched);
714 matcherResults.push_back(MatchingState::kMatched);
715 matcherResults.push_back(MatchingState::kMatched);
716
717 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
718 }
719
TEST(AtomMatcherTest,TestOrMatcher)720 TEST(AtomMatcherTest, TestOrMatcher) {
721 // Set up the matcher
722 LogicalOperation operation = LogicalOperation::OR;
723
724 vector<int> children;
725 children.push_back(0);
726 children.push_back(1);
727 children.push_back(2);
728
729 vector<MatchingState> matcherResults;
730 matcherResults.push_back(MatchingState::kMatched);
731 matcherResults.push_back(MatchingState::kNotMatched);
732 matcherResults.push_back(MatchingState::kMatched);
733
734 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
735
736 matcherResults.clear();
737 matcherResults.push_back(MatchingState::kNotMatched);
738 matcherResults.push_back(MatchingState::kNotMatched);
739 matcherResults.push_back(MatchingState::kNotMatched);
740
741 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
742 }
743
TEST(AtomMatcherTest,TestNotMatcher)744 TEST(AtomMatcherTest, TestNotMatcher) {
745 // Set up the matcher
746 LogicalOperation operation = LogicalOperation::NOT;
747
748 vector<int> children;
749 children.push_back(0);
750
751 vector<MatchingState> matcherResults;
752 matcherResults.push_back(MatchingState::kMatched);
753
754 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
755
756 matcherResults.clear();
757 matcherResults.push_back(MatchingState::kNotMatched);
758 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
759 }
760
TEST(AtomMatcherTest,TestNandMatcher)761 TEST(AtomMatcherTest, TestNandMatcher) {
762 // Set up the matcher
763 LogicalOperation operation = LogicalOperation::NAND;
764
765 vector<int> children;
766 children.push_back(0);
767 children.push_back(1);
768
769 vector<MatchingState> matcherResults;
770 matcherResults.push_back(MatchingState::kMatched);
771 matcherResults.push_back(MatchingState::kNotMatched);
772
773 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
774
775 matcherResults.clear();
776 matcherResults.push_back(MatchingState::kNotMatched);
777 matcherResults.push_back(MatchingState::kNotMatched);
778 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
779
780 matcherResults.clear();
781 matcherResults.push_back(MatchingState::kMatched);
782 matcherResults.push_back(MatchingState::kMatched);
783 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
784 }
785
TEST(AtomMatcherTest,TestNorMatcher)786 TEST(AtomMatcherTest, TestNorMatcher) {
787 // Set up the matcher
788 LogicalOperation operation = LogicalOperation::NOR;
789
790 vector<int> children;
791 children.push_back(0);
792 children.push_back(1);
793
794 vector<MatchingState> matcherResults;
795 matcherResults.push_back(MatchingState::kMatched);
796 matcherResults.push_back(MatchingState::kNotMatched);
797
798 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
799
800 matcherResults.clear();
801 matcherResults.push_back(MatchingState::kNotMatched);
802 matcherResults.push_back(MatchingState::kNotMatched);
803 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
804
805 matcherResults.clear();
806 matcherResults.push_back(MatchingState::kMatched);
807 matcherResults.push_back(MatchingState::kMatched);
808 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
809 }
810 #else
811 GTEST_LOG_(INFO) << "This test does nothing.\n";
812 #endif
813