1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "frameworks/base/cmds/statsd/src/statsd_config.pb.h"
16 #include "matchers/matcher_util.h"
17 #include "stats_log_util.h"
18 #include "stats_util.h"
19
20 #include <gtest/gtest.h>
21 #include <log/log_event_list.h>
22 #include <log/log_read.h>
23 #include <log/logprint.h>
24
25 #include <stdio.h>
26
27 using namespace android::os::statsd;
28 using std::unordered_map;
29 using std::vector;
30
31 const int32_t TAG_ID = 123;
32 const int FIELD_ID_1 = 1;
33 const int FIELD_ID_2 = 2;
34 const int FIELD_ID_3 = 2;
35
36 const int ATTRIBUTION_UID_FIELD_ID = 1;
37 const int ATTRIBUTION_TAG_FIELD_ID = 2;
38
39
40 #ifdef __ANDROID__
TEST(AtomMatcherTest,TestSimpleMatcher)41 TEST(AtomMatcherTest, TestSimpleMatcher) {
42 UidMap uidMap;
43
44 // Set up the matcher
45 AtomMatcher matcher;
46 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
47 simpleMatcher->set_atom_id(TAG_ID);
48
49 LogEvent event(TAG_ID, 0);
50 EXPECT_TRUE(event.write(11));
51 event.init();
52
53 // Test
54 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
55
56 // Wrong tag id.
57 simpleMatcher->set_atom_id(TAG_ID + 1);
58 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
59 }
60
TEST(AtomMatcherTest,TestAttributionMatcher)61 TEST(AtomMatcherTest, TestAttributionMatcher) {
62 UidMap uidMap;
63 AttributionNodeInternal attribution_node1;
64 attribution_node1.set_uid(1111);
65 attribution_node1.set_tag("location1");
66
67 AttributionNodeInternal attribution_node2;
68 attribution_node2.set_uid(2222);
69 attribution_node2.set_tag("location2");
70
71 AttributionNodeInternal attribution_node3;
72 attribution_node3.set_uid(3333);
73 attribution_node3.set_tag("location3");
74 std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2,
75 attribution_node3};
76
77 // Set up the event
78 LogEvent event(TAG_ID, 0);
79 event.write(attribution_nodes);
80 event.write("some value");
81 // Convert to a LogEvent
82 event.init();
83
84 // Set up the matcher
85 AtomMatcher matcher;
86 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
87 simpleMatcher->set_atom_id(TAG_ID);
88
89 // Match first node.
90 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
91 attributionMatcher->set_field(FIELD_ID_1);
92 attributionMatcher->set_position(Position::FIRST);
93 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
94 ATTRIBUTION_TAG_FIELD_ID);
95 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string("tag");
96
97 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
98 fieldMatcher->set_field(FIELD_ID_2);
99 fieldMatcher->set_eq_string("some value");
100
101 // Tag not matched.
102 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
103 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
104 ->set_eq_string("location3");
105 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
106 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
107 ->set_eq_string("location1");
108 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
109
110 // Match last node.
111 attributionMatcher->set_position(Position::LAST);
112 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
113 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
114 ->set_eq_string("location3");
115 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
116
117 // Match any node.
118 attributionMatcher->set_position(Position::ANY);
119 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
120 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
121 ->set_eq_string("location1");
122 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
123 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
124 ->set_eq_string("location2");
125 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
126 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
127 ->set_eq_string("location3");
128 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
129 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
130 ->set_eq_string("location4");
131 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
132
133 // Attribution match but primitive field not match.
134 attributionMatcher->set_position(Position::ANY);
135 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
136 ->set_eq_string("location2");
137 fieldMatcher->set_eq_string("wrong value");
138 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
139
140 fieldMatcher->set_eq_string("some value");
141
142 // Uid match.
143 attributionMatcher->set_position(Position::ANY);
144 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
145 ATTRIBUTION_UID_FIELD_ID);
146 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string("pkg0");
147 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
148
149 uidMap.updateMap(
150 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
151 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
152 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */);
153
154 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
155 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
156 ->set_eq_string("pkg3");
157 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
158 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
159 ->set_eq_string("pkg2");
160 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
161 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
162 ->set_eq_string("pkg1");
163 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
164 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
165 ->set_eq_string("pkg0");
166 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
167
168 attributionMatcher->set_position(Position::FIRST);
169 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
170 ->set_eq_string("pkg0");
171 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
172 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
173 ->set_eq_string("pkg3");
174 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
175 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
176 ->set_eq_string("pkg2");
177 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
178 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
179 ->set_eq_string("pkg1");
180 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
181
182 attributionMatcher->set_position(Position::LAST);
183 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
184 ->set_eq_string("pkg0");
185 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
186 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
187 ->set_eq_string("pkg3");
188 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
189 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
190 ->set_eq_string("pkg2");
191 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
192 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
193 ->set_eq_string("pkg1");
194 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
195
196 // Uid + tag.
197 attributionMatcher->set_position(Position::ANY);
198 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
199 ATTRIBUTION_TAG_FIELD_ID);
200 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
201 ->set_eq_string("pkg0");
202 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
203 ->set_eq_string("location1");
204 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
205 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
206 ->set_eq_string("pkg1");
207 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
208 ->set_eq_string("location1");
209 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
210 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
211 ->set_eq_string("pkg1");
212 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
213 ->set_eq_string("location2");
214 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
215 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
216 ->set_eq_string("pkg2");
217 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
218 ->set_eq_string("location3");
219 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
220 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
221 ->set_eq_string("pkg3");
222 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
223 ->set_eq_string("location3");
224 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
225 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
226 ->set_eq_string("pkg3");
227 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
228 ->set_eq_string("location1");
229 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
230
231 attributionMatcher->set_position(Position::FIRST);
232 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
233 ->set_eq_string("pkg0");
234 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
235 ->set_eq_string("location1");
236 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
237 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
238 ->set_eq_string("pkg1");
239 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
240 ->set_eq_string("location1");
241 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
242 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
243 ->set_eq_string("pkg1");
244 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
245 ->set_eq_string("location2");
246 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
247 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
248 ->set_eq_string("pkg2");
249 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
250 ->set_eq_string("location3");
251 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
252 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
253 ->set_eq_string("pkg3");
254 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
255 ->set_eq_string("location3");
256 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
257 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
258 ->set_eq_string("pkg3");
259 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
260 ->set_eq_string("location1");
261 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
262
263 attributionMatcher->set_position(Position::LAST);
264 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
265 ->set_eq_string("pkg0");
266 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
267 ->set_eq_string("location1");
268 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
269 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
270 ->set_eq_string("pkg1");
271 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
272 ->set_eq_string("location1");
273 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
274 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
275 ->set_eq_string("pkg1");
276 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
277 ->set_eq_string("location2");
278 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
279 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
280 ->set_eq_string("pkg2");
281 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
282 ->set_eq_string("location3");
283 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
284 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
285 ->set_eq_string("pkg3");
286 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
287 ->set_eq_string("location3");
288 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
289 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
290 ->set_eq_string("pkg3");
291 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
292 ->set_eq_string("location1");
293 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
294 }
295
TEST(AtomMatcherTest,TestNeqAnyStringMatcher)296 TEST(AtomMatcherTest, TestNeqAnyStringMatcher) {
297 UidMap uidMap;
298 uidMap.updateMap(
299 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
300 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
301 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */);
302
303 AttributionNodeInternal attribution_node1;
304 attribution_node1.set_uid(1111);
305 attribution_node1.set_tag("location1");
306
307 AttributionNodeInternal attribution_node2;
308 attribution_node2.set_uid(2222);
309 attribution_node2.set_tag("location2");
310
311 AttributionNodeInternal attribution_node3;
312 attribution_node3.set_uid(3333);
313 attribution_node3.set_tag("location3");
314
315 AttributionNodeInternal attribution_node4;
316 attribution_node4.set_uid(1066);
317 attribution_node4.set_tag("location3");
318 std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2,
319 attribution_node3, attribution_node4};
320
321 // Set up the event
322 LogEvent event(TAG_ID, 0);
323 event.write(attribution_nodes);
324 event.write("some value");
325 // Convert to a LogEvent
326 event.init();
327
328 // Set up the matcher
329 AtomMatcher matcher;
330 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
331 simpleMatcher->set_atom_id(TAG_ID);
332
333 // Match first node.
334 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
335 attributionMatcher->set_field(FIELD_ID_1);
336 attributionMatcher->set_position(Position::FIRST);
337 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
338 ATTRIBUTION_UID_FIELD_ID);
339 auto neqStringList = attributionMatcher->mutable_matches_tuple()
340 ->mutable_field_value_matcher(0)
341 ->mutable_neq_any_string();
342 neqStringList->add_str_value("pkg2");
343 neqStringList->add_str_value("pkg3");
344
345 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
346 fieldMatcher->set_field(FIELD_ID_2);
347 fieldMatcher->set_eq_string("some value");
348
349 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
350
351 neqStringList->Clear();
352 neqStringList->add_str_value("pkg1");
353 neqStringList->add_str_value("pkg3");
354 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
355
356 attributionMatcher->set_position(Position::ANY);
357 neqStringList->Clear();
358 neqStringList->add_str_value("maps.com");
359 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
360
361 neqStringList->Clear();
362 neqStringList->add_str_value("PkG3");
363 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
364
365 attributionMatcher->set_position(Position::LAST);
366 neqStringList->Clear();
367 neqStringList->add_str_value("AID_STATSD");
368 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
369 }
370
TEST(AtomMatcherTest,TestEqAnyStringMatcher)371 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
372 UidMap uidMap;
373 uidMap.updateMap(
374 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
375 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
376 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */);
377
378 AttributionNodeInternal attribution_node1;
379 attribution_node1.set_uid(1067);
380 attribution_node1.set_tag("location1");
381
382 AttributionNodeInternal attribution_node2;
383 attribution_node2.set_uid(2222);
384 attribution_node2.set_tag("location2");
385
386 AttributionNodeInternal attribution_node3;
387 attribution_node3.set_uid(3333);
388 attribution_node3.set_tag("location3");
389
390 AttributionNodeInternal attribution_node4;
391 attribution_node4.set_uid(1066);
392 attribution_node4.set_tag("location3");
393 std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2,
394 attribution_node3, attribution_node4};
395
396 // Set up the event
397 LogEvent event(TAG_ID, 0);
398 event.write(attribution_nodes);
399 event.write("some value");
400 // Convert to a LogEvent
401 event.init();
402
403 // Set up the matcher
404 AtomMatcher matcher;
405 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
406 simpleMatcher->set_atom_id(TAG_ID);
407
408 // Match first node.
409 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
410 attributionMatcher->set_field(FIELD_ID_1);
411 attributionMatcher->set_position(Position::FIRST);
412 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
413 ATTRIBUTION_UID_FIELD_ID);
414 auto eqStringList = attributionMatcher->mutable_matches_tuple()
415 ->mutable_field_value_matcher(0)
416 ->mutable_eq_any_string();
417 eqStringList->add_str_value("AID_ROOT");
418 eqStringList->add_str_value("AID_INCIDENTD");
419
420 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
421 fieldMatcher->set_field(FIELD_ID_2);
422 fieldMatcher->set_eq_string("some value");
423
424 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
425
426 attributionMatcher->set_position(Position::ANY);
427 eqStringList->Clear();
428 eqStringList->add_str_value("AID_STATSD");
429 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
430
431 eqStringList->Clear();
432 eqStringList->add_str_value("pkg1");
433 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
434
435 auto normalStringField = fieldMatcher->mutable_eq_any_string();
436 normalStringField->add_str_value("some value123");
437 normalStringField->add_str_value("some value");
438 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
439
440 normalStringField->Clear();
441 normalStringField->add_str_value("AID_STATSD");
442 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
443
444 eqStringList->Clear();
445 eqStringList->add_str_value("maps.com");
446 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
447 }
448
TEST(AtomMatcherTest,TestBoolMatcher)449 TEST(AtomMatcherTest, TestBoolMatcher) {
450 UidMap uidMap;
451 // Set up the matcher
452 AtomMatcher matcher;
453 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
454 simpleMatcher->set_atom_id(TAG_ID);
455 auto keyValue1 = simpleMatcher->add_field_value_matcher();
456 keyValue1->set_field(FIELD_ID_1);
457 auto keyValue2 = simpleMatcher->add_field_value_matcher();
458 keyValue2->set_field(FIELD_ID_2);
459
460 // Set up the event
461 LogEvent event(TAG_ID, 0);
462 EXPECT_TRUE(event.write(true));
463 EXPECT_TRUE(event.write(false));
464 // Convert to a LogEvent
465 event.init();
466
467 // Test
468 keyValue1->set_eq_bool(true);
469 keyValue2->set_eq_bool(false);
470 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
471
472 keyValue1->set_eq_bool(false);
473 keyValue2->set_eq_bool(false);
474 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
475
476 keyValue1->set_eq_bool(false);
477 keyValue2->set_eq_bool(true);
478 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
479
480 keyValue1->set_eq_bool(true);
481 keyValue2->set_eq_bool(true);
482 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
483 }
484
TEST(AtomMatcherTest,TestStringMatcher)485 TEST(AtomMatcherTest, TestStringMatcher) {
486 UidMap uidMap;
487 // Set up the matcher
488 AtomMatcher matcher;
489 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
490 simpleMatcher->set_atom_id(TAG_ID);
491 auto keyValue = simpleMatcher->add_field_value_matcher();
492 keyValue->set_field(FIELD_ID_1);
493 keyValue->set_eq_string("some value");
494
495 // Set up the event
496 LogEvent event(TAG_ID, 0);
497 event.write("some value");
498 // Convert to a LogEvent
499 event.init();
500
501 // Test
502 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
503 }
504
TEST(AtomMatcherTest,TestMultiFieldsMatcher)505 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
506 UidMap uidMap;
507 // Set up the matcher
508 AtomMatcher matcher;
509 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
510 simpleMatcher->set_atom_id(TAG_ID);
511 auto keyValue1 = simpleMatcher->add_field_value_matcher();
512 keyValue1->set_field(FIELD_ID_1);
513 auto keyValue2 = simpleMatcher->add_field_value_matcher();
514 keyValue2->set_field(FIELD_ID_2);
515
516 // Set up the event
517 LogEvent event(TAG_ID, 0);
518 event.write(2);
519 event.write(3);
520
521 // Convert to a LogEvent
522 event.init();
523
524 // Test
525 keyValue1->set_eq_int(2);
526 keyValue2->set_eq_int(3);
527 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
528
529 keyValue1->set_eq_int(2);
530 keyValue2->set_eq_int(4);
531 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
532
533 keyValue1->set_eq_int(4);
534 keyValue2->set_eq_int(3);
535 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
536 }
537
TEST(AtomMatcherTest,TestIntComparisonMatcher)538 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
539 UidMap uidMap;
540 // Set up the matcher
541 AtomMatcher matcher;
542 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
543
544 simpleMatcher->set_atom_id(TAG_ID);
545 auto keyValue = simpleMatcher->add_field_value_matcher();
546 keyValue->set_field(FIELD_ID_1);
547
548 // Set up the event
549 LogEvent event(TAG_ID, 0);
550 event.write(11);
551 event.init();
552
553 // Test
554
555 // eq_int
556 keyValue->set_eq_int(10);
557 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
558 keyValue->set_eq_int(11);
559 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
560 keyValue->set_eq_int(12);
561 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
562
563 // lt_int
564 keyValue->set_lt_int(10);
565 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
566 keyValue->set_lt_int(11);
567 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
568 keyValue->set_lt_int(12);
569 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
570
571 // lte_int
572 keyValue->set_lte_int(10);
573 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
574 keyValue->set_lte_int(11);
575 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
576 keyValue->set_lte_int(12);
577 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
578
579 // gt_int
580 keyValue->set_gt_int(10);
581 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
582 keyValue->set_gt_int(11);
583 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
584 keyValue->set_gt_int(12);
585 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
586
587 // gte_int
588 keyValue->set_gte_int(10);
589 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
590 keyValue->set_gte_int(11);
591 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
592 keyValue->set_gte_int(12);
593 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
594 }
595
TEST(AtomMatcherTest,TestFloatComparisonMatcher)596 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
597 UidMap uidMap;
598 // Set up the matcher
599 AtomMatcher matcher;
600 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
601 simpleMatcher->set_atom_id(TAG_ID);
602
603 auto keyValue = simpleMatcher->add_field_value_matcher();
604 keyValue->set_field(FIELD_ID_1);
605
606 LogEvent event1(TAG_ID, 0);
607 keyValue->set_lt_float(10.0);
608 event1.write(10.1f);
609 event1.init();
610 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
611
612 LogEvent event2(TAG_ID, 0);
613 event2.write(9.9f);
614 event2.init();
615 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
616
617 LogEvent event3(TAG_ID, 0);
618 event3.write(10.1f);
619 event3.init();
620 keyValue->set_gt_float(10.0);
621 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
622
623 LogEvent event4(TAG_ID, 0);
624 event4.write(9.9f);
625 event4.init();
626 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
627 }
628
629 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)630 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
631 simpleMatcher->set_atom_id(tag);
632 auto keyValue = simpleMatcher->add_field_value_matcher();
633 keyValue->set_field(key);
634 keyValue->set_eq_int(val);
635 }
636
TEST(AtomMatcherTest,TestAndMatcher)637 TEST(AtomMatcherTest, TestAndMatcher) {
638 // Set up the matcher
639 LogicalOperation operation = LogicalOperation::AND;
640
641 vector<int> children;
642 children.push_back(0);
643 children.push_back(1);
644 children.push_back(2);
645
646 vector<MatchingState> matcherResults;
647 matcherResults.push_back(MatchingState::kMatched);
648 matcherResults.push_back(MatchingState::kNotMatched);
649 matcherResults.push_back(MatchingState::kMatched);
650
651 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
652
653 matcherResults.clear();
654 matcherResults.push_back(MatchingState::kMatched);
655 matcherResults.push_back(MatchingState::kMatched);
656 matcherResults.push_back(MatchingState::kMatched);
657
658 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
659 }
660
TEST(AtomMatcherTest,TestOrMatcher)661 TEST(AtomMatcherTest, TestOrMatcher) {
662 // Set up the matcher
663 LogicalOperation operation = LogicalOperation::OR;
664
665 vector<int> children;
666 children.push_back(0);
667 children.push_back(1);
668 children.push_back(2);
669
670 vector<MatchingState> matcherResults;
671 matcherResults.push_back(MatchingState::kMatched);
672 matcherResults.push_back(MatchingState::kNotMatched);
673 matcherResults.push_back(MatchingState::kMatched);
674
675 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
676
677 matcherResults.clear();
678 matcherResults.push_back(MatchingState::kNotMatched);
679 matcherResults.push_back(MatchingState::kNotMatched);
680 matcherResults.push_back(MatchingState::kNotMatched);
681
682 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
683 }
684
TEST(AtomMatcherTest,TestNotMatcher)685 TEST(AtomMatcherTest, TestNotMatcher) {
686 // Set up the matcher
687 LogicalOperation operation = LogicalOperation::NOT;
688
689 vector<int> children;
690 children.push_back(0);
691
692 vector<MatchingState> matcherResults;
693 matcherResults.push_back(MatchingState::kMatched);
694
695 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
696
697 matcherResults.clear();
698 matcherResults.push_back(MatchingState::kNotMatched);
699 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
700 }
701
TEST(AtomMatcherTest,TestNandMatcher)702 TEST(AtomMatcherTest, TestNandMatcher) {
703 // Set up the matcher
704 LogicalOperation operation = LogicalOperation::NAND;
705
706 vector<int> children;
707 children.push_back(0);
708 children.push_back(1);
709
710 vector<MatchingState> matcherResults;
711 matcherResults.push_back(MatchingState::kMatched);
712 matcherResults.push_back(MatchingState::kNotMatched);
713
714 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
715
716 matcherResults.clear();
717 matcherResults.push_back(MatchingState::kNotMatched);
718 matcherResults.push_back(MatchingState::kNotMatched);
719 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
720
721 matcherResults.clear();
722 matcherResults.push_back(MatchingState::kMatched);
723 matcherResults.push_back(MatchingState::kMatched);
724 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
725 }
726
TEST(AtomMatcherTest,TestNorMatcher)727 TEST(AtomMatcherTest, TestNorMatcher) {
728 // Set up the matcher
729 LogicalOperation operation = LogicalOperation::NOR;
730
731 vector<int> children;
732 children.push_back(0);
733 children.push_back(1);
734
735 vector<MatchingState> matcherResults;
736 matcherResults.push_back(MatchingState::kMatched);
737 matcherResults.push_back(MatchingState::kNotMatched);
738
739 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
740
741 matcherResults.clear();
742 matcherResults.push_back(MatchingState::kNotMatched);
743 matcherResults.push_back(MatchingState::kNotMatched);
744 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
745
746 matcherResults.clear();
747 matcherResults.push_back(MatchingState::kMatched);
748 matcherResults.push_back(MatchingState::kMatched);
749 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
750 }
751 #else
752 GTEST_LOG_(INFO) << "This test does nothing.\n";
753 #endif
754