1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <gtest/gtest.h>
16 #include <stdio.h>
17
18 #include "annotations.h"
19 #include "src/statsd_config.pb.h"
20 #include "matchers/matcher_util.h"
21 #include "stats_event.h"
22 #include "stats_log_util.h"
23 #include "stats_util.h"
24 #include "statsd_test_util.h"
25
26 using namespace android::os::statsd;
27 using std::unordered_map;
28 using std::vector;
29
30 const int32_t TAG_ID = 123;
31 const int32_t TAG_ID_2 = 28; // hardcoded tag of atom with uid field
32 const int FIELD_ID_1 = 1;
33 const int FIELD_ID_2 = 2;
34 const int FIELD_ID_3 = 2;
35
36 const int ATTRIBUTION_UID_FIELD_ID = 1;
37 const int ATTRIBUTION_TAG_FIELD_ID = 2;
38
39
40 #ifdef __ANDROID__
41
42 namespace {
43
makeIntLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const int32_t value)44 void makeIntLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
45 const int32_t value) {
46 AStatsEvent* statsEvent = AStatsEvent_obtain();
47 AStatsEvent_setAtomId(statsEvent, atomId);
48 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
49 AStatsEvent_writeInt32(statsEvent, value);
50
51 parseStatsEventToLogEvent(statsEvent, logEvent);
52 }
53
makeFloatLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const float floatValue)54 void makeFloatLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
55 const float floatValue) {
56 AStatsEvent* statsEvent = AStatsEvent_obtain();
57 AStatsEvent_setAtomId(statsEvent, atomId);
58 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
59 AStatsEvent_writeFloat(statsEvent, floatValue);
60
61 parseStatsEventToLogEvent(statsEvent, logEvent);
62 }
63
makeStringLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const string & name)64 void makeStringLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
65 const string& name) {
66 AStatsEvent* statsEvent = AStatsEvent_obtain();
67 AStatsEvent_setAtomId(statsEvent, atomId);
68 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
69 AStatsEvent_writeString(statsEvent, name.c_str());
70
71 parseStatsEventToLogEvent(statsEvent, logEvent);
72 }
73
makeIntWithBoolAnnotationLogEvent(LogEvent * logEvent,const int32_t atomId,const int32_t field,const uint8_t annotationId,const bool annotationValue)74 void makeIntWithBoolAnnotationLogEvent(LogEvent* logEvent, const int32_t atomId,
75 const int32_t field, const uint8_t annotationId,
76 const bool annotationValue) {
77 AStatsEvent* statsEvent = AStatsEvent_obtain();
78 AStatsEvent_setAtomId(statsEvent, atomId);
79 AStatsEvent_writeInt32(statsEvent, field);
80 AStatsEvent_addBoolAnnotation(statsEvent, annotationId, annotationValue);
81
82 parseStatsEventToLogEvent(statsEvent, logEvent);
83 }
84
makeAttributionLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const vector<int> & attributionUids,const vector<string> & attributionTags,const string & name)85 void makeAttributionLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
86 const vector<int>& attributionUids,
87 const vector<string>& attributionTags, const string& name) {
88 AStatsEvent* statsEvent = AStatsEvent_obtain();
89 AStatsEvent_setAtomId(statsEvent, atomId);
90 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
91
92 writeAttribution(statsEvent, attributionUids, attributionTags);
93 AStatsEvent_writeString(statsEvent, name.c_str());
94
95 parseStatsEventToLogEvent(statsEvent, logEvent);
96 }
97
makeBoolLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const bool bool1,const bool bool2)98 void makeBoolLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
99 const bool bool1, const bool bool2) {
100 AStatsEvent* statsEvent = AStatsEvent_obtain();
101 AStatsEvent_setAtomId(statsEvent, atomId);
102 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
103
104 AStatsEvent_writeBool(statsEvent, bool1);
105 AStatsEvent_writeBool(statsEvent, bool2);
106
107 parseStatsEventToLogEvent(statsEvent, logEvent);
108 }
109
makeRepeatedIntLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<int> & intArray)110 void makeRepeatedIntLogEvent(LogEvent* logEvent, const int32_t atomId,
111 const vector<int>& intArray) {
112 AStatsEvent* statsEvent = AStatsEvent_obtain();
113 AStatsEvent_setAtomId(statsEvent, atomId);
114 AStatsEvent_writeInt32Array(statsEvent, intArray.data(), intArray.size());
115 parseStatsEventToLogEvent(statsEvent, logEvent);
116 }
117
makeRepeatedUidLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<int> & intArray)118 void makeRepeatedUidLogEvent(LogEvent* logEvent, const int32_t atomId,
119 const vector<int>& intArray) {
120 AStatsEvent* statsEvent = AStatsEvent_obtain();
121 AStatsEvent_setAtomId(statsEvent, atomId);
122 AStatsEvent_writeInt32Array(statsEvent, intArray.data(), intArray.size());
123 AStatsEvent_addBoolAnnotation(statsEvent, ANNOTATION_ID_IS_UID, true);
124 parseStatsEventToLogEvent(statsEvent, logEvent);
125 }
126
makeRepeatedStringLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<string> & stringArray)127 void makeRepeatedStringLogEvent(LogEvent* logEvent, const int32_t atomId,
128 const vector<string>& stringArray) {
129 vector<const char*> cStringArray(stringArray.size());
130 for (int i = 0; i < cStringArray.size(); i++) {
131 cStringArray[i] = stringArray[i].c_str();
132 }
133
134 AStatsEvent* statsEvent = AStatsEvent_obtain();
135 AStatsEvent_setAtomId(statsEvent, atomId);
136 AStatsEvent_writeStringArray(statsEvent, cStringArray.data(), stringArray.size());
137 parseStatsEventToLogEvent(statsEvent, logEvent);
138 }
139
140 } // anonymous namespace
141
TEST(AtomMatcherTest,TestSimpleMatcher)142 TEST(AtomMatcherTest, TestSimpleMatcher) {
143 sp<UidMap> uidMap = new UidMap();
144
145 // Set up the matcher
146 AtomMatcher matcher;
147 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
148 simpleMatcher->set_atom_id(TAG_ID);
149
150 LogEvent event(/*uid=*/0, /*pid=*/0);
151 makeIntLogEvent(&event, TAG_ID, 0, 11);
152
153 // Test
154 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
155
156 // Wrong tag id.
157 simpleMatcher->set_atom_id(TAG_ID + 1);
158 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
159 }
160
TEST(AtomMatcherTest,TestAttributionMatcher)161 TEST(AtomMatcherTest, TestAttributionMatcher) {
162 sp<UidMap> uidMap = new UidMap();
163 std::vector<int> attributionUids = {1111, 2222, 3333};
164 std::vector<string> attributionTags = {"location1", "location2", "location3"};
165
166 // Set up the log event.
167 LogEvent event(/*uid=*/0, /*pid=*/0);
168 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
169
170 // Set up the matcher
171 AtomMatcher matcher;
172 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
173 simpleMatcher->set_atom_id(TAG_ID);
174
175 // Match first node.
176 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
177 attributionMatcher->set_field(FIELD_ID_1);
178 attributionMatcher->set_position(Position::FIRST);
179 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
180 ATTRIBUTION_TAG_FIELD_ID);
181 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
182 "tag");
183
184 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
185 fieldMatcher->set_field(FIELD_ID_2);
186 fieldMatcher->set_eq_string("some value");
187
188 // Tag not matched.
189 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
190 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
191 "location3");
192 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
193 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
194 "location1");
195 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
196
197 // Match last node.
198 attributionMatcher->set_position(Position::LAST);
199 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
200 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
201 "location3");
202 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
203
204 // Match any node.
205 attributionMatcher->set_position(Position::ANY);
206 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
207 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
208 "location1");
209 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
210 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
211 "location2");
212 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
213 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
214 "location3");
215 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
216 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
217 "location4");
218 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
219
220 // Attribution match but primitive field not match.
221 attributionMatcher->set_position(Position::ANY);
222 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
223 "location2");
224 fieldMatcher->set_eq_string("wrong value");
225 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
226
227 fieldMatcher->set_eq_string("some value");
228
229 // Uid match.
230 attributionMatcher->set_position(Position::ANY);
231 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
232 ATTRIBUTION_UID_FIELD_ID);
233 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
234 "pkg0");
235 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
236
237 uidMap->updateMap(
238 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
239 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
240 android::String16("v1"), android::String16("v2")},
241 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
242 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
243 {android::String16(""), android::String16(""), android::String16(""),
244 android::String16(""), android::String16("")},
245 /* certificateHash */ {{}, {}, {}, {}, {}});
246
247 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
248 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
249 "pkg3");
250 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
251 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
252 "pkg2");
253 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
254 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
255 "pkg1");
256 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
257 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
258 "pkg0");
259 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
260
261 attributionMatcher->set_position(Position::FIRST);
262 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
263 "pkg0");
264 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
265 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
266 "pkg3");
267 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
268 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
269 "pkg2");
270 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
271 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
272 "pkg1");
273 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
274
275 attributionMatcher->set_position(Position::LAST);
276 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
277 "pkg0");
278 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
279 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
280 "pkg3");
281 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
282 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
283 "pkg2");
284 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
285 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
286 "pkg1");
287 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
288
289 // Uid + tag.
290 attributionMatcher->set_position(Position::ANY);
291 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
292 ATTRIBUTION_TAG_FIELD_ID);
293 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
294 "pkg0");
295 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
296 "location1");
297 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
298 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
299 "pkg1");
300 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
301 "location1");
302 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
303 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
304 "pkg1");
305 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
306 "location2");
307 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
308 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
309 "pkg2");
310 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
311 "location3");
312 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
313 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
314 "pkg3");
315 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
316 "location3");
317 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
318 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
319 "pkg3");
320 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
321 "location1");
322 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
323
324 attributionMatcher->set_position(Position::FIRST);
325 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
326 "pkg0");
327 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
328 "location1");
329 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
330 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
331 "pkg1");
332 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
333 "location1");
334 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
335 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
336 "pkg1");
337 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
338 "location2");
339 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
340 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
341 "pkg2");
342 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
343 "location3");
344 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
345 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
346 "pkg3");
347 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
348 "location3");
349 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
350 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
351 "pkg3");
352 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
353 "location1");
354 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
355
356 attributionMatcher->set_position(Position::LAST);
357 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
358 "pkg0");
359 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
360 "location1");
361 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
362 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
363 "pkg1");
364 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
365 "location1");
366 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
367 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
368 "pkg1");
369 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
370 "location2");
371 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
372 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
373 "pkg2");
374 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
375 "location3");
376 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
377 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
378 "pkg3");
379 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
380 "location3");
381 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
382 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
383 "pkg3");
384 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
385 "location1");
386 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
387 }
388
TEST(AtomMatcherTest,TestUidFieldMatcher)389 TEST(AtomMatcherTest, TestUidFieldMatcher) {
390 sp<UidMap> uidMap = new UidMap();
391 uidMap->updateMap(
392 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
393 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
394 android::String16("v1"), android::String16("v2")},
395 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
396 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
397 {android::String16(""), android::String16(""), android::String16(""),
398 android::String16(""), android::String16("")},
399 /* certificateHash */ {{}, {}, {}, {}, {}});
400
401 // Set up matcher
402 AtomMatcher matcher;
403 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
404 simpleMatcher->set_atom_id(TAG_ID);
405 simpleMatcher->add_field_value_matcher()->set_field(1);
406 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("pkg0");
407
408 // Make event without is_uid annotation.
409 LogEvent event1(/*uid=*/0, /*pid=*/0);
410 makeIntLogEvent(&event1, TAG_ID, 0, 1111);
411 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
412
413 // Make event with is_uid annotation.
414 LogEvent event2(/*uid=*/0, /*pid=*/0);
415 makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID_2, 1111, ANNOTATION_ID_IS_UID, true);
416
417 // Event has is_uid annotation, so mapping from uid to package name occurs.
418 simpleMatcher->set_atom_id(TAG_ID_2);
419 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
420
421 // Event has is_uid annotation, but uid maps to different package name.
422 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string(
423 "pkg2"); // package names are normalized
424 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
425 }
426
TEST(AtomMatcherTest,TestRepeatedUidFieldMatcher)427 TEST(AtomMatcherTest, TestRepeatedUidFieldMatcher) {
428 sp<UidMap> uidMap = new UidMap();
429 uidMap->updateMap(
430 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
431 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
432 android::String16("v1"), android::String16("v2")},
433 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
434 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
435 {android::String16(""), android::String16(""), android::String16(""),
436 android::String16(""), android::String16("")},
437 /* certificateHash */ {{}, {}, {}, {}, {}});
438
439 // Set up matcher.
440 AtomMatcher matcher;
441 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
442 simpleMatcher->set_atom_id(TAG_ID);
443 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
444 fieldValueMatcher->set_field(FIELD_ID_1);
445
446 // No is_uid annotation, no mapping from uid to package name.
447 vector<int> intArray = {1111, 3333, 2222};
448 LogEvent event1(/*uid=*/0, /*pid=*/0);
449 makeRepeatedIntLogEvent(&event1, TAG_ID, intArray);
450
451 fieldValueMatcher->set_position(Position::FIRST);
452 fieldValueMatcher->set_eq_string("pkg0");
453 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
454
455 fieldValueMatcher->set_position(Position::LAST);
456 fieldValueMatcher->set_eq_string("pkg1");
457 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
458
459 fieldValueMatcher->set_position(Position::ANY);
460 fieldValueMatcher->set_eq_string("pkg2");
461 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
462
463 // is_uid annotation, mapping from uid to package name.
464 LogEvent event2(/*uid=*/0, /*pid=*/0);
465 makeRepeatedUidLogEvent(&event2, TAG_ID, intArray);
466
467 fieldValueMatcher->set_position(Position::FIRST);
468 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
469 fieldValueMatcher->set_eq_string("pkg0");
470 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
471
472 fieldValueMatcher->set_position(Position::LAST);
473 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
474 fieldValueMatcher->set_eq_string("pkg1");
475 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
476
477 fieldValueMatcher->set_position(Position::ANY);
478 fieldValueMatcher->set_eq_string("pkg");
479 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
480 fieldValueMatcher->set_eq_string("pkg2"); // package names are normalized
481 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
482 }
483
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_SingleString)484 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_SingleString) {
485 sp<UidMap> uidMap = new UidMap();
486
487 // Set up the matcher
488 AtomMatcher matcher;
489 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
490 simpleMatcher->set_atom_id(TAG_ID);
491
492 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
493 fieldValueMatcher->set_field(FIELD_ID_1);
494 StringListMatcher* neqStringList = fieldValueMatcher->mutable_neq_any_string();
495 neqStringList->add_str_value("some value");
496 neqStringList->add_str_value("another value");
497
498 // First string matched.
499 LogEvent event1(/*uid=*/0, /*pid=*/0);
500 makeStringLogEvent(&event1, TAG_ID, 0, "some value");
501 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
502
503 // Second string matched.
504 LogEvent event2(/*uid=*/0, /*pid=*/0);
505 makeStringLogEvent(&event2, TAG_ID, 0, "another value");
506 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
507
508 // No strings matched.
509 LogEvent event3(/*uid=*/0, /*pid=*/0);
510 makeStringLogEvent(&event3, TAG_ID, 0, "foo");
511 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
512 }
513
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_AttributionUids)514 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_AttributionUids) {
515 sp<UidMap> uidMap = new UidMap();
516 uidMap->updateMap(
517 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
518 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
519 android::String16("v1"), android::String16("v2")},
520 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
521 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
522 {android::String16(""), android::String16(""), android::String16(""),
523 android::String16(""), android::String16("")},
524 /* certificateHash */ {{}, {}, {}, {}, {}});
525
526 std::vector<int> attributionUids = {1111, 2222, 3333, 1066};
527 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
528
529 // Set up the event
530 LogEvent event(/*uid=*/0, /*pid=*/0);
531 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
532
533 // Set up the matcher
534 AtomMatcher matcher;
535 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
536 simpleMatcher->set_atom_id(TAG_ID);
537
538 // Match first node.
539 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
540 attributionMatcher->set_field(FIELD_ID_1);
541 attributionMatcher->set_position(Position::FIRST);
542 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
543 ATTRIBUTION_UID_FIELD_ID);
544 auto neqStringList = attributionMatcher->mutable_matches_tuple()
545 ->mutable_field_value_matcher(0)
546 ->mutable_neq_any_string();
547 neqStringList->add_str_value("pkg2");
548 neqStringList->add_str_value("pkg3");
549
550 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
551 fieldMatcher->set_field(FIELD_ID_2);
552 fieldMatcher->set_eq_string("some value");
553
554 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
555
556 neqStringList->Clear();
557 neqStringList->add_str_value("pkg1");
558 neqStringList->add_str_value("pkg3");
559 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
560
561 attributionMatcher->set_position(Position::ANY);
562 neqStringList->Clear();
563 neqStringList->add_str_value("maps.com");
564 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
565
566 neqStringList->Clear();
567 neqStringList->add_str_value("PkG3");
568 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
569
570 attributionMatcher->set_position(Position::LAST);
571 neqStringList->Clear();
572 neqStringList->add_str_value("AID_STATSD");
573 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
574 }
575
TEST(AtomMatcherTest,TestEqAnyStringMatcher)576 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
577 sp<UidMap> uidMap = new UidMap();
578 uidMap->updateMap(
579 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
580 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
581 android::String16("v1"), android::String16("v2")},
582 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
583 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
584 {android::String16(""), android::String16(""), android::String16(""),
585 android::String16(""), android::String16("")},
586 /* certificateHash */ {{}, {}, {}, {}, {}});
587
588 std::vector<int> attributionUids = {1067, 2222, 3333, 1066};
589 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
590
591 // Set up the event
592 LogEvent event(/*uid=*/0, /*pid=*/0);
593 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
594
595 // Set up the matcher
596 AtomMatcher matcher;
597 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
598 simpleMatcher->set_atom_id(TAG_ID);
599
600 // Match first node.
601 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
602 attributionMatcher->set_field(FIELD_ID_1);
603 attributionMatcher->set_position(Position::FIRST);
604 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
605 ATTRIBUTION_UID_FIELD_ID);
606 auto eqStringList = attributionMatcher->mutable_matches_tuple()
607 ->mutable_field_value_matcher(0)
608 ->mutable_eq_any_string();
609 eqStringList->add_str_value("AID_ROOT");
610 eqStringList->add_str_value("AID_INCIDENTD");
611
612 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
613 fieldMatcher->set_field(FIELD_ID_2);
614 fieldMatcher->set_eq_string("some value");
615
616 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
617
618 attributionMatcher->set_position(Position::ANY);
619 eqStringList->Clear();
620 eqStringList->add_str_value("AID_STATSD");
621 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
622
623 eqStringList->Clear();
624 eqStringList->add_str_value("pkg1");
625 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
626
627 auto normalStringField = fieldMatcher->mutable_eq_any_string();
628 normalStringField->add_str_value("some value123");
629 normalStringField->add_str_value("some value");
630 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
631
632 normalStringField->Clear();
633 normalStringField->add_str_value("AID_STATSD");
634 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
635
636 eqStringList->Clear();
637 eqStringList->add_str_value("maps.com");
638 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
639 }
640
TEST(AtomMatcherTest,TestBoolMatcher)641 TEST(AtomMatcherTest, TestBoolMatcher) {
642 sp<UidMap> uidMap = new UidMap();
643 // Set up the matcher
644 AtomMatcher matcher;
645 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
646 simpleMatcher->set_atom_id(TAG_ID);
647 auto keyValue1 = simpleMatcher->add_field_value_matcher();
648 keyValue1->set_field(FIELD_ID_1);
649 auto keyValue2 = simpleMatcher->add_field_value_matcher();
650 keyValue2->set_field(FIELD_ID_2);
651
652 // Set up the event
653 LogEvent event(/*uid=*/0, /*pid=*/0);
654 makeBoolLogEvent(&event, TAG_ID, 0, true, false);
655
656 // Test
657 keyValue1->set_eq_bool(true);
658 keyValue2->set_eq_bool(false);
659 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
660
661 keyValue1->set_eq_bool(false);
662 keyValue2->set_eq_bool(false);
663 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
664
665 keyValue1->set_eq_bool(false);
666 keyValue2->set_eq_bool(true);
667 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
668
669 keyValue1->set_eq_bool(true);
670 keyValue2->set_eq_bool(true);
671 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
672 }
673
TEST(AtomMatcherTest,TestStringMatcher)674 TEST(AtomMatcherTest, TestStringMatcher) {
675 sp<UidMap> uidMap = new UidMap();
676 // Set up the matcher
677 AtomMatcher matcher;
678 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
679 simpleMatcher->set_atom_id(TAG_ID);
680 auto keyValue = simpleMatcher->add_field_value_matcher();
681 keyValue->set_field(FIELD_ID_1);
682 keyValue->set_eq_string("some value");
683
684 // Set up the event
685 LogEvent event(/*uid=*/0, /*pid=*/0);
686 makeStringLogEvent(&event, TAG_ID, 0, "some value");
687
688 // Test
689 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
690 }
691
TEST(AtomMatcherTest,TestIntMatcher_EmptyRepeatedField)692 TEST(AtomMatcherTest, TestIntMatcher_EmptyRepeatedField) {
693 sp<UidMap> uidMap = new UidMap();
694
695 // Set up the log event.
696 LogEvent event(/*uid=*/0, /*pid=*/0);
697 makeRepeatedIntLogEvent(&event, TAG_ID, {});
698
699 // Set up the matcher.
700 AtomMatcher matcher;
701 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
702 simpleMatcher->set_atom_id(TAG_ID);
703 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
704 fieldValueMatcher->set_field(FIELD_ID_1);
705
706 // Match first int.
707 fieldValueMatcher->set_position(Position::FIRST);
708 fieldValueMatcher->set_eq_int(9);
709 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
710
711 // Match last int.
712 fieldValueMatcher->set_position(Position::LAST);
713 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
714
715 // Match any int.
716 fieldValueMatcher->set_position(Position::ANY);
717 fieldValueMatcher->set_eq_int(13);
718 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
719 }
720
TEST(AtomMatcherTest,TestIntMatcher_RepeatedIntField)721 TEST(AtomMatcherTest, TestIntMatcher_RepeatedIntField) {
722 sp<UidMap> uidMap = new UidMap();
723
724 // Set up the log event.
725 LogEvent event(/*uid=*/0, /*pid=*/0);
726 vector<int> intArray = {21, 9};
727 makeRepeatedIntLogEvent(&event, TAG_ID, intArray);
728
729 // Set up the matcher.
730 AtomMatcher matcher;
731 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
732 simpleMatcher->set_atom_id(TAG_ID);
733
734 // Match first int.
735 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
736 fieldValueMatcher->set_field(FIELD_ID_1);
737 fieldValueMatcher->set_position(Position::FIRST);
738 fieldValueMatcher->set_eq_int(9);
739 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
740
741 fieldValueMatcher->set_eq_int(21);
742 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
743
744 // Match last int.
745 fieldValueMatcher->set_position(Position::LAST);
746 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
747
748 fieldValueMatcher->set_eq_int(9);
749 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
750
751 // Match any int.
752 fieldValueMatcher->set_position(Position::ANY);
753 fieldValueMatcher->set_eq_int(13);
754 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
755
756 fieldValueMatcher->set_eq_int(21);
757 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
758
759 fieldValueMatcher->set_eq_int(9);
760 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
761 }
762
TEST(AtomMatcherTest,TestLtIntMatcher_RepeatedIntField)763 TEST(AtomMatcherTest, TestLtIntMatcher_RepeatedIntField) {
764 sp<UidMap> uidMap = new UidMap();
765
766 // Set up the log event.
767 LogEvent event(/*uid=*/0, /*pid=*/0);
768 vector<int> intArray = {21, 9};
769 makeRepeatedIntLogEvent(&event, TAG_ID, intArray);
770
771 // Set up the matcher.
772 AtomMatcher matcher;
773 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
774 simpleMatcher->set_atom_id(TAG_ID);
775
776 // Match first int.
777 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
778 fieldValueMatcher->set_field(FIELD_ID_1);
779 fieldValueMatcher->set_position(Position::FIRST);
780 fieldValueMatcher->set_lt_int(9);
781 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
782
783 fieldValueMatcher->set_lt_int(21);
784 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
785
786 fieldValueMatcher->set_lt_int(23);
787 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
788
789 // Match last int.
790 fieldValueMatcher->set_position(Position::LAST);
791 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
792
793 fieldValueMatcher->set_lt_int(9);
794 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
795
796 fieldValueMatcher->set_lt_int(8);
797 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
798
799 // Match any int.
800 fieldValueMatcher->set_position(Position::ANY);
801 fieldValueMatcher->set_lt_int(21);
802 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
803
804 fieldValueMatcher->set_lt_int(8);
805 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
806
807 fieldValueMatcher->set_lt_int(23);
808 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
809 }
810
TEST(AtomMatcherTest,TestStringMatcher_RepeatedStringField)811 TEST(AtomMatcherTest, TestStringMatcher_RepeatedStringField) {
812 sp<UidMap> uidMap = new UidMap();
813
814 // Set up the log event.
815 LogEvent event(/*uid=*/0, /*pid=*/0);
816 vector<string> strArray = {"str1", "str2", "str3"};
817 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
818
819 // Set up the matcher.
820 AtomMatcher matcher;
821 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
822 simpleMatcher->set_atom_id(TAG_ID);
823
824 // Match first int.
825 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
826 fieldValueMatcher->set_field(FIELD_ID_1);
827 fieldValueMatcher->set_position(Position::FIRST);
828 fieldValueMatcher->set_eq_string("str2");
829 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
830
831 fieldValueMatcher->set_eq_string("str1");
832 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
833
834 // Match last int.
835 fieldValueMatcher->set_position(Position::LAST);
836 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
837
838 fieldValueMatcher->set_eq_string("str3");
839 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
840
841 // Match any int.
842 fieldValueMatcher->set_position(Position::ANY);
843 fieldValueMatcher->set_eq_string("str4");
844 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
845
846 fieldValueMatcher->set_eq_string("str1");
847 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
848
849 fieldValueMatcher->set_eq_string("str2");
850 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
851
852 fieldValueMatcher->set_eq_string("str3");
853 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
854 }
855
TEST(AtomMatcherTest,TestEqAnyStringMatcher_RepeatedStringField)856 TEST(AtomMatcherTest, TestEqAnyStringMatcher_RepeatedStringField) {
857 sp<UidMap> uidMap = new UidMap();
858
859 // Set up the log event.
860 LogEvent event(/*uid=*/0, /*pid=*/0);
861 vector<string> strArray = {"str1", "str2", "str3"};
862 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
863
864 // Set up the matcher.
865 AtomMatcher matcher;
866 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
867 simpleMatcher->set_atom_id(TAG_ID);
868
869 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
870 fieldValueMatcher->set_field(FIELD_ID_1);
871 StringListMatcher* eqStringList = fieldValueMatcher->mutable_eq_any_string();
872
873 fieldValueMatcher->set_position(Position::FIRST);
874 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
875 fieldValueMatcher->set_position(Position::LAST);
876 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
877 fieldValueMatcher->set_position(Position::ANY);
878 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
879
880 eqStringList->add_str_value("str4");
881 fieldValueMatcher->set_position(Position::FIRST);
882 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
883 fieldValueMatcher->set_position(Position::LAST);
884 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
885 fieldValueMatcher->set_position(Position::ANY);
886 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
887
888 eqStringList->add_str_value("str2");
889 fieldValueMatcher->set_position(Position::FIRST);
890 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
891 fieldValueMatcher->set_position(Position::LAST);
892 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
893 fieldValueMatcher->set_position(Position::ANY);
894 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
895
896 eqStringList->add_str_value("str3");
897 fieldValueMatcher->set_position(Position::FIRST);
898 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
899 fieldValueMatcher->set_position(Position::LAST);
900 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
901 fieldValueMatcher->set_position(Position::ANY);
902 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
903
904 eqStringList->add_str_value("str1");
905 fieldValueMatcher->set_position(Position::FIRST);
906 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
907 fieldValueMatcher->set_position(Position::LAST);
908 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
909 fieldValueMatcher->set_position(Position::ANY);
910 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
911 }
912
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_RepeatedStringField)913 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_RepeatedStringField) {
914 sp<UidMap> uidMap = new UidMap();
915
916 // Set up the log event.
917 LogEvent event(/*uid=*/0, /*pid=*/0);
918 vector<string> strArray = {"str1", "str2", "str3"};
919 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
920
921 // Set up the matcher.
922 AtomMatcher matcher;
923 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
924 simpleMatcher->set_atom_id(TAG_ID);
925
926 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
927 fieldValueMatcher->set_field(FIELD_ID_1);
928 StringListMatcher* neqStringList = fieldValueMatcher->mutable_neq_any_string();
929
930 fieldValueMatcher->set_position(Position::FIRST);
931 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
932 fieldValueMatcher->set_position(Position::LAST);
933 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
934 fieldValueMatcher->set_position(Position::ANY);
935 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
936
937 neqStringList->add_str_value("str4");
938 fieldValueMatcher->set_position(Position::FIRST);
939 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
940 fieldValueMatcher->set_position(Position::LAST);
941 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
942 fieldValueMatcher->set_position(Position::ANY);
943 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
944
945 neqStringList->add_str_value("str2");
946 fieldValueMatcher->set_position(Position::FIRST);
947 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
948 fieldValueMatcher->set_position(Position::LAST);
949 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
950 fieldValueMatcher->set_position(Position::ANY);
951 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
952
953 neqStringList->add_str_value("str3");
954 fieldValueMatcher->set_position(Position::FIRST);
955 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
956 fieldValueMatcher->set_position(Position::LAST);
957 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
958 fieldValueMatcher->set_position(Position::ANY);
959 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
960
961 neqStringList->add_str_value("str1");
962 fieldValueMatcher->set_position(Position::FIRST);
963 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
964 fieldValueMatcher->set_position(Position::LAST);
965 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
966 fieldValueMatcher->set_position(Position::ANY);
967 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
968 }
969
TEST(AtomMatcherTest,TestMultiFieldsMatcher)970 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
971 sp<UidMap> uidMap = new UidMap();
972 // Set up the matcher
973 AtomMatcher matcher;
974 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
975 simpleMatcher->set_atom_id(TAG_ID);
976 auto keyValue1 = simpleMatcher->add_field_value_matcher();
977 keyValue1->set_field(FIELD_ID_1);
978 auto keyValue2 = simpleMatcher->add_field_value_matcher();
979 keyValue2->set_field(FIELD_ID_2);
980
981 // Set up the event
982 LogEvent event(/*uid=*/0, /*pid=*/0);
983 CreateTwoValueLogEvent(&event, TAG_ID, 0, 2, 3);
984
985 // Test
986 keyValue1->set_eq_int(2);
987 keyValue2->set_eq_int(3);
988 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
989
990 keyValue1->set_eq_int(2);
991 keyValue2->set_eq_int(4);
992 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
993
994 keyValue1->set_eq_int(4);
995 keyValue2->set_eq_int(3);
996 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
997 }
998
TEST(AtomMatcherTest,TestIntComparisonMatcher)999 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
1000 sp<UidMap> uidMap = new UidMap();
1001 // Set up the matcher
1002 AtomMatcher matcher;
1003 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1004
1005 simpleMatcher->set_atom_id(TAG_ID);
1006 auto keyValue = simpleMatcher->add_field_value_matcher();
1007 keyValue->set_field(FIELD_ID_1);
1008
1009 // Set up the event
1010 LogEvent event(/*uid=*/0, /*pid=*/0);
1011 makeIntLogEvent(&event, TAG_ID, 0, 11);
1012
1013 // Test
1014
1015 // eq_int
1016 keyValue->set_eq_int(10);
1017 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1018 keyValue->set_eq_int(11);
1019 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1020 keyValue->set_eq_int(12);
1021 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1022
1023 // lt_int
1024 keyValue->set_lt_int(10);
1025 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1026 keyValue->set_lt_int(11);
1027 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1028 keyValue->set_lt_int(12);
1029 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1030
1031 // lte_int
1032 keyValue->set_lte_int(10);
1033 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1034 keyValue->set_lte_int(11);
1035 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1036 keyValue->set_lte_int(12);
1037 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1038
1039 // gt_int
1040 keyValue->set_gt_int(10);
1041 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1042 keyValue->set_gt_int(11);
1043 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1044 keyValue->set_gt_int(12);
1045 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1046
1047 // gte_int
1048 keyValue->set_gte_int(10);
1049 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1050 keyValue->set_gte_int(11);
1051 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1052 keyValue->set_gte_int(12);
1053 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1054 }
1055
TEST(AtomMatcherTest,TestFloatComparisonMatcher)1056 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
1057 sp<UidMap> uidMap = new UidMap();
1058 // Set up the matcher
1059 AtomMatcher matcher;
1060 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1061 simpleMatcher->set_atom_id(TAG_ID);
1062
1063 auto keyValue = simpleMatcher->add_field_value_matcher();
1064 keyValue->set_field(FIELD_ID_1);
1065
1066 LogEvent event1(/*uid=*/0, /*pid=*/0);
1067 makeFloatLogEvent(&event1, TAG_ID, 0, 10.1f);
1068 keyValue->set_lt_float(10.0);
1069 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
1070
1071 LogEvent event2(/*uid=*/0, /*pid=*/0);
1072 makeFloatLogEvent(&event2, TAG_ID, 0, 9.9f);
1073 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
1074
1075 LogEvent event3(/*uid=*/0, /*pid=*/0);
1076 makeFloatLogEvent(&event3, TAG_ID, 0, 10.1f);
1077 keyValue->set_gt_float(10.0);
1078 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
1079
1080 LogEvent event4(/*uid=*/0, /*pid=*/0);
1081 makeFloatLogEvent(&event4, TAG_ID, 0, 9.9f);
1082 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
1083 }
1084
1085 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)1086 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
1087 simpleMatcher->set_atom_id(tag);
1088 auto keyValue = simpleMatcher->add_field_value_matcher();
1089 keyValue->set_field(key);
1090 keyValue->set_eq_int(val);
1091 }
1092
TEST(AtomMatcherTest,TestAndMatcher)1093 TEST(AtomMatcherTest, TestAndMatcher) {
1094 // Set up the matcher
1095 LogicalOperation operation = LogicalOperation::AND;
1096
1097 vector<int> children;
1098 children.push_back(0);
1099 children.push_back(1);
1100 children.push_back(2);
1101
1102 vector<MatchingState> matcherResults;
1103 matcherResults.push_back(MatchingState::kMatched);
1104 matcherResults.push_back(MatchingState::kNotMatched);
1105 matcherResults.push_back(MatchingState::kMatched);
1106
1107 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1108
1109 matcherResults.clear();
1110 matcherResults.push_back(MatchingState::kMatched);
1111 matcherResults.push_back(MatchingState::kMatched);
1112 matcherResults.push_back(MatchingState::kMatched);
1113
1114 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1115 }
1116
TEST(AtomMatcherTest,TestOrMatcher)1117 TEST(AtomMatcherTest, TestOrMatcher) {
1118 // Set up the matcher
1119 LogicalOperation operation = LogicalOperation::OR;
1120
1121 vector<int> children;
1122 children.push_back(0);
1123 children.push_back(1);
1124 children.push_back(2);
1125
1126 vector<MatchingState> matcherResults;
1127 matcherResults.push_back(MatchingState::kMatched);
1128 matcherResults.push_back(MatchingState::kNotMatched);
1129 matcherResults.push_back(MatchingState::kMatched);
1130
1131 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1132
1133 matcherResults.clear();
1134 matcherResults.push_back(MatchingState::kNotMatched);
1135 matcherResults.push_back(MatchingState::kNotMatched);
1136 matcherResults.push_back(MatchingState::kNotMatched);
1137
1138 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1139 }
1140
TEST(AtomMatcherTest,TestNotMatcher)1141 TEST(AtomMatcherTest, TestNotMatcher) {
1142 // Set up the matcher
1143 LogicalOperation operation = LogicalOperation::NOT;
1144
1145 vector<int> children;
1146 children.push_back(0);
1147
1148 vector<MatchingState> matcherResults;
1149 matcherResults.push_back(MatchingState::kMatched);
1150
1151 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1152
1153 matcherResults.clear();
1154 matcherResults.push_back(MatchingState::kNotMatched);
1155 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1156 }
1157
TEST(AtomMatcherTest,TestNandMatcher)1158 TEST(AtomMatcherTest, TestNandMatcher) {
1159 // Set up the matcher
1160 LogicalOperation operation = LogicalOperation::NAND;
1161
1162 vector<int> children;
1163 children.push_back(0);
1164 children.push_back(1);
1165
1166 vector<MatchingState> matcherResults;
1167 matcherResults.push_back(MatchingState::kMatched);
1168 matcherResults.push_back(MatchingState::kNotMatched);
1169
1170 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1171
1172 matcherResults.clear();
1173 matcherResults.push_back(MatchingState::kNotMatched);
1174 matcherResults.push_back(MatchingState::kNotMatched);
1175 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1176
1177 matcherResults.clear();
1178 matcherResults.push_back(MatchingState::kMatched);
1179 matcherResults.push_back(MatchingState::kMatched);
1180 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1181 }
1182
TEST(AtomMatcherTest,TestNorMatcher)1183 TEST(AtomMatcherTest, TestNorMatcher) {
1184 // Set up the matcher
1185 LogicalOperation operation = LogicalOperation::NOR;
1186
1187 vector<int> children;
1188 children.push_back(0);
1189 children.push_back(1);
1190
1191 vector<MatchingState> matcherResults;
1192 matcherResults.push_back(MatchingState::kMatched);
1193 matcherResults.push_back(MatchingState::kNotMatched);
1194
1195 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1196
1197 matcherResults.clear();
1198 matcherResults.push_back(MatchingState::kNotMatched);
1199 matcherResults.push_back(MatchingState::kNotMatched);
1200 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1201
1202 matcherResults.clear();
1203 matcherResults.push_back(MatchingState::kMatched);
1204 matcherResults.push_back(MatchingState::kMatched);
1205 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1206 }
1207 #else
1208 GTEST_LOG_(INFO) << "This test does nothing.\n";
1209 #endif
1210