1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <gtest/gtest.h>
16 #include <stdio.h>
17
18 #include "matchers/matcher_util.h"
19 #include "src/statsd_config.pb.h"
20 #include "stats_annotations.h"
21 #include "stats_event.h"
22 #include "stats_log_util.h"
23 #include "stats_util.h"
24 #include "statsd_test_util.h"
25
26 using namespace android::os::statsd;
27 using std::unordered_map;
28 using std::vector;
29
30 const int32_t TAG_ID = 123;
31 const int32_t TAG_ID_2 = 28; // hardcoded tag of atom with uid field
32 const int FIELD_ID_1 = 1;
33 const int FIELD_ID_2 = 2;
34 const int FIELD_ID_3 = 2;
35
36 const int ATTRIBUTION_UID_FIELD_ID = 1;
37 const int ATTRIBUTION_TAG_FIELD_ID = 2;
38
39
40 #ifdef __ANDROID__
41
42 namespace {
43
makeIntLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const int32_t value)44 void makeIntLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
45 const int32_t value) {
46 AStatsEvent* statsEvent = AStatsEvent_obtain();
47 AStatsEvent_setAtomId(statsEvent, atomId);
48 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
49 AStatsEvent_writeInt32(statsEvent, value);
50
51 parseStatsEventToLogEvent(statsEvent, logEvent);
52 }
53
makeFloatLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const float floatValue)54 void makeFloatLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
55 const float floatValue) {
56 AStatsEvent* statsEvent = AStatsEvent_obtain();
57 AStatsEvent_setAtomId(statsEvent, atomId);
58 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
59 AStatsEvent_writeFloat(statsEvent, floatValue);
60
61 parseStatsEventToLogEvent(statsEvent, logEvent);
62 }
63
makeStringLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const string & name)64 void makeStringLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
65 const string& name) {
66 AStatsEvent* statsEvent = AStatsEvent_obtain();
67 AStatsEvent_setAtomId(statsEvent, atomId);
68 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
69 AStatsEvent_writeString(statsEvent, name.c_str());
70
71 parseStatsEventToLogEvent(statsEvent, logEvent);
72 }
73
makeIntWithBoolAnnotationLogEvent(LogEvent * logEvent,const int32_t atomId,const int32_t field,const uint8_t annotationId,const bool annotationValue)74 void makeIntWithBoolAnnotationLogEvent(LogEvent* logEvent, const int32_t atomId,
75 const int32_t field, const uint8_t annotationId,
76 const bool annotationValue) {
77 AStatsEvent* statsEvent = AStatsEvent_obtain();
78 AStatsEvent_setAtomId(statsEvent, atomId);
79 AStatsEvent_writeInt32(statsEvent, field);
80 AStatsEvent_addBoolAnnotation(statsEvent, annotationId, annotationValue);
81
82 parseStatsEventToLogEvent(statsEvent, logEvent);
83 }
84
makeAttributionLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const vector<int> & attributionUids,const vector<string> & attributionTags,const string & name)85 void makeAttributionLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
86 const vector<int>& attributionUids,
87 const vector<string>& attributionTags, const string& name) {
88 AStatsEvent* statsEvent = AStatsEvent_obtain();
89 AStatsEvent_setAtomId(statsEvent, atomId);
90 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
91
92 writeAttribution(statsEvent, attributionUids, attributionTags);
93 AStatsEvent_writeString(statsEvent, name.c_str());
94
95 parseStatsEventToLogEvent(statsEvent, logEvent);
96 }
97
makeBoolLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const bool bool1,const bool bool2)98 void makeBoolLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
99 const bool bool1, const bool bool2) {
100 AStatsEvent* statsEvent = AStatsEvent_obtain();
101 AStatsEvent_setAtomId(statsEvent, atomId);
102 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
103
104 AStatsEvent_writeBool(statsEvent, bool1);
105 AStatsEvent_writeBool(statsEvent, bool2);
106
107 parseStatsEventToLogEvent(statsEvent, logEvent);
108 }
109
makeRepeatedIntLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<int> & intArray)110 void makeRepeatedIntLogEvent(LogEvent* logEvent, const int32_t atomId,
111 const vector<int>& intArray) {
112 AStatsEvent* statsEvent = AStatsEvent_obtain();
113 AStatsEvent_setAtomId(statsEvent, atomId);
114 AStatsEvent_writeInt32Array(statsEvent, intArray.data(), intArray.size());
115 parseStatsEventToLogEvent(statsEvent, logEvent);
116 }
117
makeRepeatedUidLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<int> & intArray)118 void makeRepeatedUidLogEvent(LogEvent* logEvent, const int32_t atomId,
119 const vector<int>& intArray) {
120 AStatsEvent* statsEvent = AStatsEvent_obtain();
121 AStatsEvent_setAtomId(statsEvent, atomId);
122 AStatsEvent_writeInt32Array(statsEvent, intArray.data(), intArray.size());
123 AStatsEvent_addBoolAnnotation(statsEvent, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
124 parseStatsEventToLogEvent(statsEvent, logEvent);
125 }
126
makeRepeatedStringLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<string> & stringArray)127 void makeRepeatedStringLogEvent(LogEvent* logEvent, const int32_t atomId,
128 const vector<string>& stringArray) {
129 vector<const char*> cStringArray(stringArray.size());
130 for (int i = 0; i < cStringArray.size(); i++) {
131 cStringArray[i] = stringArray[i].c_str();
132 }
133
134 AStatsEvent* statsEvent = AStatsEvent_obtain();
135 AStatsEvent_setAtomId(statsEvent, atomId);
136 AStatsEvent_writeStringArray(statsEvent, cStringArray.data(), stringArray.size());
137 parseStatsEventToLogEvent(statsEvent, logEvent);
138 }
139
140 } // anonymous namespace
141
TEST(AtomMatcherTest,TestSimpleMatcher)142 TEST(AtomMatcherTest, TestSimpleMatcher) {
143 sp<UidMap> uidMap = new UidMap();
144
145 // Set up the matcher
146 AtomMatcher matcher;
147 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
148 simpleMatcher->set_atom_id(TAG_ID);
149
150 LogEvent event(/*uid=*/0, /*pid=*/0);
151 makeIntLogEvent(&event, TAG_ID, 0, 11);
152
153 // Test
154 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
155
156 // Wrong tag id.
157 simpleMatcher->set_atom_id(TAG_ID + 1);
158 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
159 }
160
TEST(AtomMatcherTest,TestAttributionMatcher)161 TEST(AtomMatcherTest, TestAttributionMatcher) {
162 sp<UidMap> uidMap = new UidMap();
163 std::vector<int> attributionUids = {1111, 2222, 3333};
164 std::vector<string> attributionTags = {"location1", "location2", "location3"};
165
166 // Set up the log event.
167 LogEvent event(/*uid=*/0, /*pid=*/0);
168 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
169
170 // Set up the matcher
171 AtomMatcher matcher;
172 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
173 simpleMatcher->set_atom_id(TAG_ID);
174
175 // Match first node.
176 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
177 attributionMatcher->set_field(FIELD_ID_1);
178 attributionMatcher->set_position(Position::FIRST);
179 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
180 ATTRIBUTION_TAG_FIELD_ID);
181 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
182 "tag");
183
184 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
185 fieldMatcher->set_field(FIELD_ID_2);
186 fieldMatcher->set_eq_string("some value");
187
188 // Tag not matched.
189 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
190 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
191 "location3");
192 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
193 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
194 "location1");
195 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
196
197 // Match last node.
198 attributionMatcher->set_position(Position::LAST);
199 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
200 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
201 "location3");
202 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
203
204 // Match any node.
205 attributionMatcher->set_position(Position::ANY);
206 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
207 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
208 "location1");
209 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
210 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
211 "location2");
212 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
213 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
214 "location3");
215 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
216 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
217 "location4");
218 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
219
220 // Attribution match but primitive field not match.
221 attributionMatcher->set_position(Position::ANY);
222 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
223 "location2");
224 fieldMatcher->set_eq_string("wrong value");
225 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
226
227 fieldMatcher->set_eq_string("some value");
228
229 // Uid match.
230 attributionMatcher->set_position(Position::ANY);
231 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
232 ATTRIBUTION_UID_FIELD_ID);
233 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
234 "pkg0");
235 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
236
237 uidMap->updateMap(
238 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
239 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
240 android::String16("v1"), android::String16("v2")},
241 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
242 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
243 {android::String16(""), android::String16(""), android::String16(""),
244 android::String16(""), android::String16("")},
245 /* certificateHash */ {{}, {}, {}, {}, {}});
246
247 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
248 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
249 "pkg3");
250 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
251 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
252 "pkg2");
253 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
254 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
255 "pkg1");
256 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
257 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
258 "pkg0");
259 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
260
261 attributionMatcher->set_position(Position::FIRST);
262 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
263 "pkg0");
264 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
265 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
266 "pkg3");
267 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
268 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
269 "pkg2");
270 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
271 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
272 "pkg1");
273 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
274
275 attributionMatcher->set_position(Position::LAST);
276 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
277 "pkg0");
278 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
279 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
280 "pkg3");
281 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
282 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
283 "pkg2");
284 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
285 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
286 "pkg1");
287 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
288
289 // Uid + tag.
290 attributionMatcher->set_position(Position::ANY);
291 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
292 ATTRIBUTION_TAG_FIELD_ID);
293 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
294 "pkg0");
295 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
296 "location1");
297 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
298 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
299 "pkg1");
300 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
301 "location1");
302 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
303 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
304 "pkg1");
305 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
306 "location2");
307 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
308 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
309 "pkg2");
310 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
311 "location3");
312 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
313 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
314 "pkg3");
315 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
316 "location3");
317 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
318 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
319 "pkg3");
320 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
321 "location1");
322 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
323
324 attributionMatcher->set_position(Position::FIRST);
325 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
326 "pkg0");
327 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
328 "location1");
329 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
330 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
331 "pkg1");
332 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
333 "location1");
334 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
335 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
336 "pkg1");
337 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
338 "location2");
339 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
340 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
341 "pkg2");
342 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
343 "location3");
344 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
345 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
346 "pkg3");
347 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
348 "location3");
349 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
350 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
351 "pkg3");
352 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
353 "location1");
354 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
355
356 attributionMatcher->set_position(Position::LAST);
357 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
358 "pkg0");
359 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
360 "location1");
361 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
362 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
363 "pkg1");
364 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
365 "location1");
366 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
367 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
368 "pkg1");
369 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
370 "location2");
371 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
372 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
373 "pkg2");
374 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
375 "location3");
376 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
377 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
378 "pkg3");
379 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
380 "location3");
381 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
382 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
383 "pkg3");
384 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
385 "location1");
386 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
387 }
388
TEST(AtomMatcherTest,TestUidFieldMatcher)389 TEST(AtomMatcherTest, TestUidFieldMatcher) {
390 sp<UidMap> uidMap = new UidMap();
391 uidMap->updateMap(
392 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
393 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
394 android::String16("v1"), android::String16("v2")},
395 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
396 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
397 {android::String16(""), android::String16(""), android::String16(""),
398 android::String16(""), android::String16("")},
399 /* certificateHash */ {{}, {}, {}, {}, {}});
400
401 // Set up matcher
402 AtomMatcher matcher;
403 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
404 simpleMatcher->set_atom_id(TAG_ID);
405 simpleMatcher->add_field_value_matcher()->set_field(1);
406 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("pkg0");
407
408 // Make event without is_uid annotation.
409 LogEvent event1(/*uid=*/0, /*pid=*/0);
410 makeIntLogEvent(&event1, TAG_ID, 0, 1111);
411 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
412
413 // Make event with is_uid annotation.
414 LogEvent event2(/*uid=*/0, /*pid=*/0);
415 makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID_2, 1111, ASTATSLOG_ANNOTATION_ID_IS_UID,
416 true);
417
418 // Event has is_uid annotation, so mapping from uid to package name occurs.
419 simpleMatcher->set_atom_id(TAG_ID_2);
420 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
421
422 // Event has is_uid annotation, but uid maps to different package name.
423 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string(
424 "pkg2"); // package names are normalized
425 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
426 }
427
TEST(AtomMatcherTest,TestRepeatedUidFieldMatcher)428 TEST(AtomMatcherTest, TestRepeatedUidFieldMatcher) {
429 sp<UidMap> uidMap = new UidMap();
430 uidMap->updateMap(
431 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
432 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
433 android::String16("v1"), android::String16("v2")},
434 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
435 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
436 {android::String16(""), android::String16(""), android::String16(""),
437 android::String16(""), android::String16("")},
438 /* certificateHash */ {{}, {}, {}, {}, {}});
439
440 // Set up matcher.
441 AtomMatcher matcher;
442 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
443 simpleMatcher->set_atom_id(TAG_ID);
444 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
445 fieldValueMatcher->set_field(FIELD_ID_1);
446
447 // No is_uid annotation, no mapping from uid to package name.
448 vector<int> intArray = {1111, 3333, 2222};
449 LogEvent event1(/*uid=*/0, /*pid=*/0);
450 makeRepeatedIntLogEvent(&event1, TAG_ID, intArray);
451
452 fieldValueMatcher->set_position(Position::FIRST);
453 fieldValueMatcher->set_eq_string("pkg0");
454 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
455
456 fieldValueMatcher->set_position(Position::LAST);
457 fieldValueMatcher->set_eq_string("pkg1");
458 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
459
460 fieldValueMatcher->set_position(Position::ANY);
461 fieldValueMatcher->set_eq_string("pkg2");
462 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
463
464 // is_uid annotation, mapping from uid to package name.
465 LogEvent event2(/*uid=*/0, /*pid=*/0);
466 makeRepeatedUidLogEvent(&event2, TAG_ID, intArray);
467
468 fieldValueMatcher->set_position(Position::FIRST);
469 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
470 fieldValueMatcher->set_eq_string("pkg0");
471 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
472
473 fieldValueMatcher->set_position(Position::LAST);
474 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
475 fieldValueMatcher->set_eq_string("pkg1");
476 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
477
478 fieldValueMatcher->set_position(Position::ANY);
479 fieldValueMatcher->set_eq_string("pkg");
480 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
481 fieldValueMatcher->set_eq_string("pkg2"); // package names are normalized
482 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
483 }
484
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_SingleString)485 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_SingleString) {
486 sp<UidMap> uidMap = new UidMap();
487
488 // Set up the matcher
489 AtomMatcher matcher;
490 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
491 simpleMatcher->set_atom_id(TAG_ID);
492
493 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
494 fieldValueMatcher->set_field(FIELD_ID_1);
495 StringListMatcher* neqStringList = fieldValueMatcher->mutable_neq_any_string();
496 neqStringList->add_str_value("some value");
497 neqStringList->add_str_value("another value");
498
499 // First string matched.
500 LogEvent event1(/*uid=*/0, /*pid=*/0);
501 makeStringLogEvent(&event1, TAG_ID, 0, "some value");
502 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
503
504 // Second string matched.
505 LogEvent event2(/*uid=*/0, /*pid=*/0);
506 makeStringLogEvent(&event2, TAG_ID, 0, "another value");
507 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
508
509 // No strings matched.
510 LogEvent event3(/*uid=*/0, /*pid=*/0);
511 makeStringLogEvent(&event3, TAG_ID, 0, "foo");
512 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
513 }
514
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_AttributionUids)515 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_AttributionUids) {
516 sp<UidMap> uidMap = new UidMap();
517 uidMap->updateMap(
518 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
519 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
520 android::String16("v1"), android::String16("v2")},
521 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
522 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
523 {android::String16(""), android::String16(""), android::String16(""),
524 android::String16(""), android::String16("")},
525 /* certificateHash */ {{}, {}, {}, {}, {}});
526
527 std::vector<int> attributionUids = {1111, 2222, 3333, 1066};
528 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
529
530 // Set up the event
531 LogEvent event(/*uid=*/0, /*pid=*/0);
532 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
533
534 // Set up the matcher
535 AtomMatcher matcher;
536 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
537 simpleMatcher->set_atom_id(TAG_ID);
538
539 // Match first node.
540 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
541 attributionMatcher->set_field(FIELD_ID_1);
542 attributionMatcher->set_position(Position::FIRST);
543 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
544 ATTRIBUTION_UID_FIELD_ID);
545 auto neqStringList = attributionMatcher->mutable_matches_tuple()
546 ->mutable_field_value_matcher(0)
547 ->mutable_neq_any_string();
548 neqStringList->add_str_value("pkg2");
549 neqStringList->add_str_value("pkg3");
550
551 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
552 fieldMatcher->set_field(FIELD_ID_2);
553 fieldMatcher->set_eq_string("some value");
554
555 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
556
557 neqStringList->Clear();
558 neqStringList->add_str_value("pkg1");
559 neqStringList->add_str_value("pkg3");
560 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
561
562 attributionMatcher->set_position(Position::ANY);
563 neqStringList->Clear();
564 neqStringList->add_str_value("maps.com");
565 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
566
567 neqStringList->Clear();
568 neqStringList->add_str_value("PkG3");
569 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
570
571 attributionMatcher->set_position(Position::LAST);
572 neqStringList->Clear();
573 neqStringList->add_str_value("AID_STATSD");
574 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
575 }
576
TEST(AtomMatcherTest,TestEqAnyStringMatcher)577 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
578 sp<UidMap> uidMap = new UidMap();
579 uidMap->updateMap(
580 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
581 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
582 android::String16("v1"), android::String16("v2")},
583 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
584 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
585 {android::String16(""), android::String16(""), android::String16(""),
586 android::String16(""), android::String16("")},
587 /* certificateHash */ {{}, {}, {}, {}, {}});
588
589 std::vector<int> attributionUids = {1067, 2222, 3333, 1066};
590 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
591
592 // Set up the event
593 LogEvent event(/*uid=*/0, /*pid=*/0);
594 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
595
596 // Set up the matcher
597 AtomMatcher matcher;
598 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
599 simpleMatcher->set_atom_id(TAG_ID);
600
601 // Match first node.
602 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
603 attributionMatcher->set_field(FIELD_ID_1);
604 attributionMatcher->set_position(Position::FIRST);
605 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
606 ATTRIBUTION_UID_FIELD_ID);
607 auto eqStringList = attributionMatcher->mutable_matches_tuple()
608 ->mutable_field_value_matcher(0)
609 ->mutable_eq_any_string();
610 eqStringList->add_str_value("AID_ROOT");
611 eqStringList->add_str_value("AID_INCIDENTD");
612
613 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
614 fieldMatcher->set_field(FIELD_ID_2);
615 fieldMatcher->set_eq_string("some value");
616
617 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
618
619 attributionMatcher->set_position(Position::ANY);
620 eqStringList->Clear();
621 eqStringList->add_str_value("AID_STATSD");
622 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
623
624 eqStringList->Clear();
625 eqStringList->add_str_value("pkg1");
626 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
627
628 auto normalStringField = fieldMatcher->mutable_eq_any_string();
629 normalStringField->add_str_value("some value123");
630 normalStringField->add_str_value("some value");
631 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
632
633 normalStringField->Clear();
634 normalStringField->add_str_value("AID_STATSD");
635 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
636
637 eqStringList->Clear();
638 eqStringList->add_str_value("maps.com");
639 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
640 }
641
TEST(AtomMatcherTest,TestBoolMatcher)642 TEST(AtomMatcherTest, TestBoolMatcher) {
643 sp<UidMap> uidMap = new UidMap();
644 // Set up the matcher
645 AtomMatcher matcher;
646 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
647 simpleMatcher->set_atom_id(TAG_ID);
648 auto keyValue1 = simpleMatcher->add_field_value_matcher();
649 keyValue1->set_field(FIELD_ID_1);
650 auto keyValue2 = simpleMatcher->add_field_value_matcher();
651 keyValue2->set_field(FIELD_ID_2);
652
653 // Set up the event
654 LogEvent event(/*uid=*/0, /*pid=*/0);
655 makeBoolLogEvent(&event, TAG_ID, 0, true, false);
656
657 // Test
658 keyValue1->set_eq_bool(true);
659 keyValue2->set_eq_bool(false);
660 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
661
662 keyValue1->set_eq_bool(false);
663 keyValue2->set_eq_bool(false);
664 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
665
666 keyValue1->set_eq_bool(false);
667 keyValue2->set_eq_bool(true);
668 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
669
670 keyValue1->set_eq_bool(true);
671 keyValue2->set_eq_bool(true);
672 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
673 }
674
TEST(AtomMatcherTest,TestStringMatcher)675 TEST(AtomMatcherTest, TestStringMatcher) {
676 sp<UidMap> uidMap = new UidMap();
677 // Set up the matcher
678 AtomMatcher matcher;
679 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
680 simpleMatcher->set_atom_id(TAG_ID);
681 auto keyValue = simpleMatcher->add_field_value_matcher();
682 keyValue->set_field(FIELD_ID_1);
683 keyValue->set_eq_string("some value");
684
685 // Set up the event
686 LogEvent event(/*uid=*/0, /*pid=*/0);
687 makeStringLogEvent(&event, TAG_ID, 0, "some value");
688
689 // Test
690 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
691 }
692
TEST(AtomMatcherTest,TestIntMatcher_EmptyRepeatedField)693 TEST(AtomMatcherTest, TestIntMatcher_EmptyRepeatedField) {
694 sp<UidMap> uidMap = new UidMap();
695
696 // Set up the log event.
697 LogEvent event(/*uid=*/0, /*pid=*/0);
698 makeRepeatedIntLogEvent(&event, TAG_ID, {});
699
700 // Set up the matcher.
701 AtomMatcher matcher;
702 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
703 simpleMatcher->set_atom_id(TAG_ID);
704 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
705 fieldValueMatcher->set_field(FIELD_ID_1);
706
707 // Match first int.
708 fieldValueMatcher->set_position(Position::FIRST);
709 fieldValueMatcher->set_eq_int(9);
710 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
711
712 // Match last int.
713 fieldValueMatcher->set_position(Position::LAST);
714 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
715
716 // Match any int.
717 fieldValueMatcher->set_position(Position::ANY);
718 fieldValueMatcher->set_eq_int(13);
719 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
720 }
721
TEST(AtomMatcherTest,TestIntMatcher_RepeatedIntField)722 TEST(AtomMatcherTest, TestIntMatcher_RepeatedIntField) {
723 sp<UidMap> uidMap = new UidMap();
724
725 // Set up the log event.
726 LogEvent event(/*uid=*/0, /*pid=*/0);
727 vector<int> intArray = {21, 9};
728 makeRepeatedIntLogEvent(&event, TAG_ID, intArray);
729
730 // Set up the matcher.
731 AtomMatcher matcher;
732 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
733 simpleMatcher->set_atom_id(TAG_ID);
734
735 // Match first int.
736 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
737 fieldValueMatcher->set_field(FIELD_ID_1);
738 fieldValueMatcher->set_position(Position::FIRST);
739 fieldValueMatcher->set_eq_int(9);
740 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
741
742 fieldValueMatcher->set_eq_int(21);
743 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
744
745 // Match last int.
746 fieldValueMatcher->set_position(Position::LAST);
747 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
748
749 fieldValueMatcher->set_eq_int(9);
750 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
751
752 // Match any int.
753 fieldValueMatcher->set_position(Position::ANY);
754 fieldValueMatcher->set_eq_int(13);
755 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
756
757 fieldValueMatcher->set_eq_int(21);
758 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
759
760 fieldValueMatcher->set_eq_int(9);
761 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
762 }
763
TEST(AtomMatcherTest,TestLtIntMatcher_RepeatedIntField)764 TEST(AtomMatcherTest, TestLtIntMatcher_RepeatedIntField) {
765 sp<UidMap> uidMap = new UidMap();
766
767 // Set up the log event.
768 LogEvent event(/*uid=*/0, /*pid=*/0);
769 vector<int> intArray = {21, 9};
770 makeRepeatedIntLogEvent(&event, TAG_ID, intArray);
771
772 // Set up the matcher.
773 AtomMatcher matcher;
774 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
775 simpleMatcher->set_atom_id(TAG_ID);
776
777 // Match first int.
778 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
779 fieldValueMatcher->set_field(FIELD_ID_1);
780 fieldValueMatcher->set_position(Position::FIRST);
781 fieldValueMatcher->set_lt_int(9);
782 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
783
784 fieldValueMatcher->set_lt_int(21);
785 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
786
787 fieldValueMatcher->set_lt_int(23);
788 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
789
790 // Match last int.
791 fieldValueMatcher->set_position(Position::LAST);
792 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
793
794 fieldValueMatcher->set_lt_int(9);
795 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
796
797 fieldValueMatcher->set_lt_int(8);
798 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
799
800 // Match any int.
801 fieldValueMatcher->set_position(Position::ANY);
802 fieldValueMatcher->set_lt_int(21);
803 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
804
805 fieldValueMatcher->set_lt_int(8);
806 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
807
808 fieldValueMatcher->set_lt_int(23);
809 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
810 }
811
TEST(AtomMatcherTest,TestStringMatcher_RepeatedStringField)812 TEST(AtomMatcherTest, TestStringMatcher_RepeatedStringField) {
813 sp<UidMap> uidMap = new UidMap();
814
815 // Set up the log event.
816 LogEvent event(/*uid=*/0, /*pid=*/0);
817 vector<string> strArray = {"str1", "str2", "str3"};
818 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
819
820 // Set up the matcher.
821 AtomMatcher matcher;
822 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
823 simpleMatcher->set_atom_id(TAG_ID);
824
825 // Match first int.
826 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
827 fieldValueMatcher->set_field(FIELD_ID_1);
828 fieldValueMatcher->set_position(Position::FIRST);
829 fieldValueMatcher->set_eq_string("str2");
830 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
831
832 fieldValueMatcher->set_eq_string("str1");
833 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
834
835 // Match last int.
836 fieldValueMatcher->set_position(Position::LAST);
837 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
838
839 fieldValueMatcher->set_eq_string("str3");
840 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
841
842 // Match any int.
843 fieldValueMatcher->set_position(Position::ANY);
844 fieldValueMatcher->set_eq_string("str4");
845 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
846
847 fieldValueMatcher->set_eq_string("str1");
848 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
849
850 fieldValueMatcher->set_eq_string("str2");
851 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
852
853 fieldValueMatcher->set_eq_string("str3");
854 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
855 }
856
TEST(AtomMatcherTest,TestEqAnyStringMatcher_RepeatedStringField)857 TEST(AtomMatcherTest, TestEqAnyStringMatcher_RepeatedStringField) {
858 sp<UidMap> uidMap = new UidMap();
859
860 // Set up the log event.
861 LogEvent event(/*uid=*/0, /*pid=*/0);
862 vector<string> strArray = {"str1", "str2", "str3"};
863 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
864
865 // Set up the matcher.
866 AtomMatcher matcher;
867 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
868 simpleMatcher->set_atom_id(TAG_ID);
869
870 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
871 fieldValueMatcher->set_field(FIELD_ID_1);
872 StringListMatcher* eqStringList = fieldValueMatcher->mutable_eq_any_string();
873
874 fieldValueMatcher->set_position(Position::FIRST);
875 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
876 fieldValueMatcher->set_position(Position::LAST);
877 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
878 fieldValueMatcher->set_position(Position::ANY);
879 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
880
881 eqStringList->add_str_value("str4");
882 fieldValueMatcher->set_position(Position::FIRST);
883 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
884 fieldValueMatcher->set_position(Position::LAST);
885 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
886 fieldValueMatcher->set_position(Position::ANY);
887 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
888
889 eqStringList->add_str_value("str2");
890 fieldValueMatcher->set_position(Position::FIRST);
891 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
892 fieldValueMatcher->set_position(Position::LAST);
893 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
894 fieldValueMatcher->set_position(Position::ANY);
895 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
896
897 eqStringList->add_str_value("str3");
898 fieldValueMatcher->set_position(Position::FIRST);
899 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
900 fieldValueMatcher->set_position(Position::LAST);
901 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
902 fieldValueMatcher->set_position(Position::ANY);
903 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
904
905 eqStringList->add_str_value("str1");
906 fieldValueMatcher->set_position(Position::FIRST);
907 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
908 fieldValueMatcher->set_position(Position::LAST);
909 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
910 fieldValueMatcher->set_position(Position::ANY);
911 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
912 }
913
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_RepeatedStringField)914 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_RepeatedStringField) {
915 sp<UidMap> uidMap = new UidMap();
916
917 // Set up the log event.
918 LogEvent event(/*uid=*/0, /*pid=*/0);
919 vector<string> strArray = {"str1", "str2", "str3"};
920 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
921
922 // Set up the matcher.
923 AtomMatcher matcher;
924 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
925 simpleMatcher->set_atom_id(TAG_ID);
926
927 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
928 fieldValueMatcher->set_field(FIELD_ID_1);
929 StringListMatcher* neqStringList = fieldValueMatcher->mutable_neq_any_string();
930
931 fieldValueMatcher->set_position(Position::FIRST);
932 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
933 fieldValueMatcher->set_position(Position::LAST);
934 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
935 fieldValueMatcher->set_position(Position::ANY);
936 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
937
938 neqStringList->add_str_value("str4");
939 fieldValueMatcher->set_position(Position::FIRST);
940 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
941 fieldValueMatcher->set_position(Position::LAST);
942 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
943 fieldValueMatcher->set_position(Position::ANY);
944 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
945
946 neqStringList->add_str_value("str2");
947 fieldValueMatcher->set_position(Position::FIRST);
948 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
949 fieldValueMatcher->set_position(Position::LAST);
950 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
951 fieldValueMatcher->set_position(Position::ANY);
952 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
953
954 neqStringList->add_str_value("str3");
955 fieldValueMatcher->set_position(Position::FIRST);
956 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
957 fieldValueMatcher->set_position(Position::LAST);
958 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
959 fieldValueMatcher->set_position(Position::ANY);
960 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
961
962 neqStringList->add_str_value("str1");
963 fieldValueMatcher->set_position(Position::FIRST);
964 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
965 fieldValueMatcher->set_position(Position::LAST);
966 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
967 fieldValueMatcher->set_position(Position::ANY);
968 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
969 }
970
TEST(AtomMatcherTest,TestMultiFieldsMatcher)971 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
972 sp<UidMap> uidMap = new UidMap();
973 // Set up the matcher
974 AtomMatcher matcher;
975 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
976 simpleMatcher->set_atom_id(TAG_ID);
977 auto keyValue1 = simpleMatcher->add_field_value_matcher();
978 keyValue1->set_field(FIELD_ID_1);
979 auto keyValue2 = simpleMatcher->add_field_value_matcher();
980 keyValue2->set_field(FIELD_ID_2);
981
982 // Set up the event
983 LogEvent event(/*uid=*/0, /*pid=*/0);
984 CreateTwoValueLogEvent(&event, TAG_ID, 0, 2, 3);
985
986 // Test
987 keyValue1->set_eq_int(2);
988 keyValue2->set_eq_int(3);
989 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
990
991 keyValue1->set_eq_int(2);
992 keyValue2->set_eq_int(4);
993 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
994
995 keyValue1->set_eq_int(4);
996 keyValue2->set_eq_int(3);
997 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
998 }
999
TEST(AtomMatcherTest,TestIntComparisonMatcher)1000 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
1001 sp<UidMap> uidMap = new UidMap();
1002 // Set up the matcher
1003 AtomMatcher matcher;
1004 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1005
1006 simpleMatcher->set_atom_id(TAG_ID);
1007 auto keyValue = simpleMatcher->add_field_value_matcher();
1008 keyValue->set_field(FIELD_ID_1);
1009
1010 // Set up the event
1011 LogEvent event(/*uid=*/0, /*pid=*/0);
1012 makeIntLogEvent(&event, TAG_ID, 0, 11);
1013
1014 // Test
1015
1016 // eq_int
1017 keyValue->set_eq_int(10);
1018 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1019 keyValue->set_eq_int(11);
1020 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1021 keyValue->set_eq_int(12);
1022 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1023
1024 // lt_int
1025 keyValue->set_lt_int(10);
1026 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1027 keyValue->set_lt_int(11);
1028 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1029 keyValue->set_lt_int(12);
1030 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1031
1032 // lte_int
1033 keyValue->set_lte_int(10);
1034 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1035 keyValue->set_lte_int(11);
1036 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1037 keyValue->set_lte_int(12);
1038 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1039
1040 // gt_int
1041 keyValue->set_gt_int(10);
1042 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1043 keyValue->set_gt_int(11);
1044 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1045 keyValue->set_gt_int(12);
1046 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1047
1048 // gte_int
1049 keyValue->set_gte_int(10);
1050 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1051 keyValue->set_gte_int(11);
1052 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1053 keyValue->set_gte_int(12);
1054 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1055 }
1056
TEST(AtomMatcherTest,TestFloatComparisonMatcher)1057 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
1058 sp<UidMap> uidMap = new UidMap();
1059 // Set up the matcher
1060 AtomMatcher matcher;
1061 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1062 simpleMatcher->set_atom_id(TAG_ID);
1063
1064 auto keyValue = simpleMatcher->add_field_value_matcher();
1065 keyValue->set_field(FIELD_ID_1);
1066
1067 LogEvent event1(/*uid=*/0, /*pid=*/0);
1068 makeFloatLogEvent(&event1, TAG_ID, 0, 10.1f);
1069 keyValue->set_lt_float(10.0);
1070 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
1071
1072 LogEvent event2(/*uid=*/0, /*pid=*/0);
1073 makeFloatLogEvent(&event2, TAG_ID, 0, 9.9f);
1074 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
1075
1076 LogEvent event3(/*uid=*/0, /*pid=*/0);
1077 makeFloatLogEvent(&event3, TAG_ID, 0, 10.1f);
1078 keyValue->set_gt_float(10.0);
1079 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
1080
1081 LogEvent event4(/*uid=*/0, /*pid=*/0);
1082 makeFloatLogEvent(&event4, TAG_ID, 0, 9.9f);
1083 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
1084 }
1085
1086 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)1087 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
1088 simpleMatcher->set_atom_id(tag);
1089 auto keyValue = simpleMatcher->add_field_value_matcher();
1090 keyValue->set_field(key);
1091 keyValue->set_eq_int(val);
1092 }
1093
TEST(AtomMatcherTest,TestAndMatcher)1094 TEST(AtomMatcherTest, TestAndMatcher) {
1095 // Set up the matcher
1096 LogicalOperation operation = LogicalOperation::AND;
1097
1098 vector<int> children;
1099 children.push_back(0);
1100 children.push_back(1);
1101 children.push_back(2);
1102
1103 vector<MatchingState> matcherResults;
1104 matcherResults.push_back(MatchingState::kMatched);
1105 matcherResults.push_back(MatchingState::kNotMatched);
1106 matcherResults.push_back(MatchingState::kMatched);
1107
1108 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1109
1110 matcherResults.clear();
1111 matcherResults.push_back(MatchingState::kMatched);
1112 matcherResults.push_back(MatchingState::kMatched);
1113 matcherResults.push_back(MatchingState::kMatched);
1114
1115 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1116 }
1117
TEST(AtomMatcherTest,TestOrMatcher)1118 TEST(AtomMatcherTest, TestOrMatcher) {
1119 // Set up the matcher
1120 LogicalOperation operation = LogicalOperation::OR;
1121
1122 vector<int> children;
1123 children.push_back(0);
1124 children.push_back(1);
1125 children.push_back(2);
1126
1127 vector<MatchingState> matcherResults;
1128 matcherResults.push_back(MatchingState::kMatched);
1129 matcherResults.push_back(MatchingState::kNotMatched);
1130 matcherResults.push_back(MatchingState::kMatched);
1131
1132 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1133
1134 matcherResults.clear();
1135 matcherResults.push_back(MatchingState::kNotMatched);
1136 matcherResults.push_back(MatchingState::kNotMatched);
1137 matcherResults.push_back(MatchingState::kNotMatched);
1138
1139 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1140 }
1141
TEST(AtomMatcherTest,TestNotMatcher)1142 TEST(AtomMatcherTest, TestNotMatcher) {
1143 // Set up the matcher
1144 LogicalOperation operation = LogicalOperation::NOT;
1145
1146 vector<int> children;
1147 children.push_back(0);
1148
1149 vector<MatchingState> matcherResults;
1150 matcherResults.push_back(MatchingState::kMatched);
1151
1152 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1153
1154 matcherResults.clear();
1155 matcherResults.push_back(MatchingState::kNotMatched);
1156 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1157 }
1158
TEST(AtomMatcherTest,TestNandMatcher)1159 TEST(AtomMatcherTest, TestNandMatcher) {
1160 // Set up the matcher
1161 LogicalOperation operation = LogicalOperation::NAND;
1162
1163 vector<int> children;
1164 children.push_back(0);
1165 children.push_back(1);
1166
1167 vector<MatchingState> matcherResults;
1168 matcherResults.push_back(MatchingState::kMatched);
1169 matcherResults.push_back(MatchingState::kNotMatched);
1170
1171 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1172
1173 matcherResults.clear();
1174 matcherResults.push_back(MatchingState::kNotMatched);
1175 matcherResults.push_back(MatchingState::kNotMatched);
1176 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1177
1178 matcherResults.clear();
1179 matcherResults.push_back(MatchingState::kMatched);
1180 matcherResults.push_back(MatchingState::kMatched);
1181 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1182 }
1183
TEST(AtomMatcherTest,TestNorMatcher)1184 TEST(AtomMatcherTest, TestNorMatcher) {
1185 // Set up the matcher
1186 LogicalOperation operation = LogicalOperation::NOR;
1187
1188 vector<int> children;
1189 children.push_back(0);
1190 children.push_back(1);
1191
1192 vector<MatchingState> matcherResults;
1193 matcherResults.push_back(MatchingState::kMatched);
1194 matcherResults.push_back(MatchingState::kNotMatched);
1195
1196 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1197
1198 matcherResults.clear();
1199 matcherResults.push_back(MatchingState::kNotMatched);
1200 matcherResults.push_back(MatchingState::kNotMatched);
1201 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1202
1203 matcherResults.clear();
1204 matcherResults.push_back(MatchingState::kMatched);
1205 matcherResults.push_back(MatchingState::kMatched);
1206 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1207 }
1208
TEST(AtomMatcherTest,TestUidFieldMatcherWithWildcardString)1209 TEST(AtomMatcherTest, TestUidFieldMatcherWithWildcardString) {
1210 sp<UidMap> uidMap = new UidMap();
1211 uidMap->updateMap(
1212 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
1213 {android::String16("v1"), android::String16("v1"), android::String16("v2"),
1214 android::String16("v1"), android::String16("v2")},
1215 {android::String16("package0"), android::String16("pkg1"), android::String16("pkg1"),
1216 android::String16("package2"), android::String16("package3")} /* package name list */,
1217 {android::String16(""), android::String16(""), android::String16(""),
1218 android::String16(""), android::String16("")},
1219 /* certificateHash */ {{}, {}, {}, {}, {}});
1220
1221 // Set up matcher
1222 AtomMatcher matcher;
1223 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1224 simpleMatcher->set_atom_id(TAG_ID);
1225 simpleMatcher->add_field_value_matcher()->set_field(1);
1226 simpleMatcher->mutable_field_value_matcher(0)->set_eq_wildcard_string("pkg*");
1227
1228 // Event without is_uid annotation.
1229 LogEvent event1(/*uid=*/0, /*pid=*/0);
1230 makeIntLogEvent(&event1, TAG_ID, 0, 1111);
1231 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
1232
1233 // Event where mapping from uid to package name occurs.
1234 LogEvent event2(/*uid=*/0, /*pid=*/0);
1235 makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID, 1111, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1236 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
1237
1238 // Event where uid maps to package names that don't fit wildcard pattern.
1239 LogEvent event3(/*uid=*/0, /*pid=*/0);
1240 makeIntWithBoolAnnotationLogEvent(&event3, TAG_ID, 3333, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1241 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event3));
1242
1243 // Update matcher to match one AID
1244 simpleMatcher->mutable_field_value_matcher(0)->set_eq_wildcard_string(
1245 "AID_SYSTEM"); // uid 1000
1246
1247 // Event where mapping from uid to aid doesn't fit wildcard pattern.
1248 LogEvent event4(/*uid=*/0, /*pid=*/0);
1249 makeIntWithBoolAnnotationLogEvent(&event4, TAG_ID, 1005, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1250 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
1251
1252 // Event where mapping from uid to aid does fit wildcard pattern.
1253 LogEvent event5(/*uid=*/0, /*pid=*/0);
1254 makeIntWithBoolAnnotationLogEvent(&event5, TAG_ID, 1000, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1255 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event5));
1256
1257 // Update matcher to match multiple AIDs
1258 simpleMatcher->mutable_field_value_matcher(0)->set_eq_wildcard_string("AID_SDCARD_*");
1259
1260 // Event where mapping from uid to aid doesn't fit wildcard pattern.
1261 LogEvent event6(/*uid=*/0, /*pid=*/0);
1262 makeIntWithBoolAnnotationLogEvent(&event6, TAG_ID, 1036, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1263 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event6));
1264
1265 // Event where mapping from uid to aid does fit wildcard pattern.
1266 LogEvent event7(/*uid=*/0, /*pid=*/0);
1267 makeIntWithBoolAnnotationLogEvent(&event7, TAG_ID, 1034, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1268 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event7));
1269
1270 LogEvent event8(/*uid=*/0, /*pid=*/0);
1271 makeIntWithBoolAnnotationLogEvent(&event8, TAG_ID, 1035, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1272 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event8));
1273 }
1274
TEST(AtomMatcherTest,TestWildcardStringMatcher)1275 TEST(AtomMatcherTest, TestWildcardStringMatcher) {
1276 sp<UidMap> uidMap = new UidMap();
1277 // Set up the matcher
1278 AtomMatcher matcher;
1279 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1280 simpleMatcher->set_atom_id(TAG_ID);
1281 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
1282 fieldValueMatcher->set_field(FIELD_ID_1);
1283 // Matches any string that begins with "test.string:test_" and ends with number between 0 and 9
1284 // inclusive
1285 fieldValueMatcher->set_eq_wildcard_string("test.string:test_[0-9]");
1286
1287 LogEvent event1(/*uid=*/0, /*pid=*/0);
1288 makeStringLogEvent(&event1, TAG_ID, 0, "test.string:test_0");
1289 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event1));
1290
1291 LogEvent event2(/*uid=*/0, /*pid=*/0);
1292 makeStringLogEvent(&event2, TAG_ID, 0, "test.string:test_19");
1293 EXPECT_FALSE(
1294 matchesSimple(uidMap, *simpleMatcher, event2)); // extra character at end of string
1295
1296 LogEvent event3(/*uid=*/0, /*pid=*/0);
1297 makeStringLogEvent(&event3, TAG_ID, 0, "extra.test.string:test_1");
1298 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher,
1299 event3)); // extra characters at beginning of string
1300
1301 LogEvent event4(/*uid=*/0, /*pid=*/0);
1302 makeStringLogEvent(&event4, TAG_ID, 0, "test.string:test_");
1303 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher,
1304 event4)); // missing character from 0-9 at end of string
1305
1306 LogEvent event5(/*uid=*/0, /*pid=*/0);
1307 makeStringLogEvent(&event5, TAG_ID, 0, "est.string:test_1");
1308 EXPECT_FALSE(
1309 matchesSimple(uidMap, *simpleMatcher, event5)); // missing 't' at beginning of string
1310
1311 LogEvent event6(/*uid=*/0, /*pid=*/0);
1312 makeStringLogEvent(&event6, TAG_ID, 0, "test.string:test_1extra");
1313 EXPECT_FALSE(
1314 matchesSimple(uidMap, *simpleMatcher, event6)); // extra characters at end of string
1315
1316 // Matches any string that contains "test.string:test_" + any extra characters before or after
1317 fieldValueMatcher->set_eq_wildcard_string("*test.string:test_*");
1318
1319 LogEvent event7(/*uid=*/0, /*pid=*/0);
1320 makeStringLogEvent(&event7, TAG_ID, 0, "test.string:test_");
1321 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event7));
1322
1323 LogEvent event8(/*uid=*/0, /*pid=*/0);
1324 makeStringLogEvent(&event8, TAG_ID, 0, "extra.test.string:test_");
1325 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event8));
1326
1327 LogEvent event9(/*uid=*/0, /*pid=*/0);
1328 makeStringLogEvent(&event9, TAG_ID, 0, "test.string:test_extra");
1329 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event9));
1330
1331 LogEvent event10(/*uid=*/0, /*pid=*/0);
1332 makeStringLogEvent(&event10, TAG_ID, 0, "est.string:test_");
1333 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event10));
1334
1335 LogEvent event11(/*uid=*/0, /*pid=*/0);
1336 makeStringLogEvent(&event11, TAG_ID, 0, "test.string:test");
1337 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event11));
1338 }
1339
TEST(AtomMatcherTest,TestEqAnyWildcardStringMatcher)1340 TEST(AtomMatcherTest, TestEqAnyWildcardStringMatcher) {
1341 sp<UidMap> uidMap = new UidMap();
1342
1343 // Set up the matcher
1344 AtomMatcher matcher;
1345 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1346 simpleMatcher->set_atom_id(TAG_ID);
1347
1348 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
1349 fieldValueMatcher->set_field(FIELD_ID_1);
1350 StringListMatcher* eqWildcardStrList = fieldValueMatcher->mutable_eq_any_wildcard_string();
1351 eqWildcardStrList->add_str_value("first_string_*");
1352 eqWildcardStrList->add_str_value("second_string_*");
1353
1354 // First wildcard pattern matched.
1355 LogEvent event1(/*uid=*/0, /*pid=*/0);
1356 makeStringLogEvent(&event1, TAG_ID, 0, "first_string_1");
1357 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event1));
1358
1359 // Second wildcard pattern matched.
1360 LogEvent event2(/*uid=*/0, /*pid=*/0);
1361 makeStringLogEvent(&event2, TAG_ID, 0, "second_string_1");
1362 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
1363
1364 // No wildcard patterns matched.
1365 LogEvent event3(/*uid=*/0, /*pid=*/0);
1366 makeStringLogEvent(&event3, TAG_ID, 0, "third_string_1");
1367 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event3));
1368 }
1369
TEST(AtomMatcherTest,TestNeqAnyWildcardStringMatcher)1370 TEST(AtomMatcherTest, TestNeqAnyWildcardStringMatcher) {
1371 sp<UidMap> uidMap = new UidMap();
1372
1373 // Set up the log event.
1374 std::vector<int> attributionUids = {1111, 2222, 3333};
1375 std::vector<string> attributionTags = {"location_1", "location_2", "location"};
1376 LogEvent event(/*uid=*/0, /*pid=*/0);
1377 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
1378
1379 // Set up the matcher. Match first tag.
1380 AtomMatcher matcher;
1381 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1382 simpleMatcher->set_atom_id(TAG_ID);
1383 FieldValueMatcher* attributionMatcher = simpleMatcher->add_field_value_matcher();
1384 attributionMatcher->set_field(FIELD_ID_1);
1385 attributionMatcher->set_position(Position::FIRST);
1386 FieldValueMatcher* attributionTagMatcher =
1387 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher();
1388 attributionTagMatcher->set_field(ATTRIBUTION_TAG_FIELD_ID);
1389 StringListMatcher* neqWildcardStrList =
1390 attributionTagMatcher->mutable_neq_any_wildcard_string();
1391
1392 // First tag is not matched. neq string list {"tag"}
1393 neqWildcardStrList->add_str_value("tag");
1394 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1395
1396 // First tag is matched. neq string list {"tag", "location_*"}
1397 neqWildcardStrList->add_str_value("location_*");
1398 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1399
1400 // Match last tag.
1401 attributionMatcher->set_position(Position::LAST);
1402
1403 // Last tag is not matched. neq string list {"tag", "location_*"}
1404 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1405
1406 // Last tag is matched. neq string list {"tag", "location_*", "location*"}
1407 neqWildcardStrList->add_str_value("location*");
1408 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1409
1410 // Match any tag.
1411 attributionMatcher->set_position(Position::ANY);
1412
1413 // All tags are matched. neq string list {"tag", "location_*", "location*"}
1414 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1415
1416 // Set up another log event.
1417 std::vector<string> attributionTags2 = {"location_1", "location", "string"};
1418 LogEvent event2(/*uid=*/0, /*pid=*/0);
1419 makeAttributionLogEvent(&event2, TAG_ID, 0, attributionUids, attributionTags2, "some value");
1420
1421 // Tag "string" is not matched. neq string list {"tag", "location_*", "location*"}
1422 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
1423 }
1424
TEST(AtomMatcherTest,TestEqAnyIntMatcher)1425 TEST(AtomMatcherTest, TestEqAnyIntMatcher) {
1426 sp<UidMap> uidMap = new UidMap();
1427
1428 // Set up the matcher
1429 AtomMatcher matcher;
1430 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1431 simpleMatcher->set_atom_id(TAG_ID);
1432
1433 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
1434 fieldValueMatcher->set_field(FIELD_ID_1);
1435 IntListMatcher* eqIntList = fieldValueMatcher->mutable_eq_any_int();
1436 eqIntList->add_int_value(3);
1437 eqIntList->add_int_value(5);
1438
1439 // First int matched.
1440 LogEvent event1(/*uid=*/0, /*pid=*/0);
1441 makeIntLogEvent(&event1, TAG_ID, 0, 3);
1442 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event1));
1443
1444 // Second int matched.
1445 LogEvent event2(/*uid=*/0, /*pid=*/0);
1446 makeIntLogEvent(&event2, TAG_ID, 0, 5);
1447 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
1448
1449 // No ints matched.
1450 LogEvent event3(/*uid=*/0, /*pid=*/0);
1451 makeIntLogEvent(&event3, TAG_ID, 0, 4);
1452 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event3));
1453 }
1454
TEST(AtomMatcherTest,TestNeqAnyIntMatcher)1455 TEST(AtomMatcherTest, TestNeqAnyIntMatcher) {
1456 sp<UidMap> uidMap = new UidMap();
1457
1458 // Set up the log event.
1459 std::vector<int> attributionUids = {1111, 2222, 3333};
1460 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1461 LogEvent event(/*uid=*/0, /*pid=*/0);
1462 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
1463
1464 // Set up the matcher. Match first uid.
1465 AtomMatcher matcher;
1466 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1467 simpleMatcher->set_atom_id(TAG_ID);
1468 FieldValueMatcher* attributionMatcher = simpleMatcher->add_field_value_matcher();
1469 attributionMatcher->set_field(FIELD_ID_1);
1470 attributionMatcher->set_position(Position::FIRST);
1471 FieldValueMatcher* attributionUidMatcher =
1472 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher();
1473 attributionUidMatcher->set_field(ATTRIBUTION_UID_FIELD_ID);
1474 IntListMatcher* neqIntList = attributionUidMatcher->mutable_neq_any_int();
1475
1476 // First uid is not matched. neq int list {4444}
1477 neqIntList->add_int_value(4444);
1478 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1479
1480 // First uid is matched. neq int list {4444, 1111}
1481 neqIntList->add_int_value(1111);
1482 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1483
1484 // Match last uid.
1485 attributionMatcher->set_position(Position::LAST);
1486
1487 // Last uid is not matched. neq int list {4444, 1111}
1488 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1489
1490 // Last uid is matched. neq int list {4444, 1111, 3333}
1491 neqIntList->add_int_value(3333);
1492 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1493
1494 // Match any uid.
1495 attributionMatcher->set_position(Position::ANY);
1496
1497 // Uid 2222 is not matched. neq int list {4444, 1111, 3333}
1498 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
1499
1500 // All uids are matched. neq int list {4444, 1111, 3333, 2222}
1501 neqIntList->add_int_value(2222);
1502 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
1503 }
1504
1505 #else
1506 GTEST_LOG_(INFO) << "This test does nothing.\n";
1507 #endif
1508