1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //      http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include <gtest/gtest.h>
16 #include <stdio.h>
17 
18 #include "annotations.h"
19 #include "src/statsd_config.pb.h"
20 #include "matchers/matcher_util.h"
21 #include "stats_event.h"
22 #include "stats_log_util.h"
23 #include "stats_util.h"
24 #include "statsd_test_util.h"
25 
26 using namespace android::os::statsd;
27 using std::unordered_map;
28 using std::vector;
29 
30 const int32_t TAG_ID = 123;
31 const int32_t TAG_ID_2 = 28;  // hardcoded tag of atom with uid field
32 const int FIELD_ID_1 = 1;
33 const int FIELD_ID_2 = 2;
34 const int FIELD_ID_3 = 2;
35 
36 const int ATTRIBUTION_UID_FIELD_ID = 1;
37 const int ATTRIBUTION_TAG_FIELD_ID = 2;
38 
39 
40 #ifdef __ANDROID__
41 
42 namespace {
43 
makeIntLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const int32_t value)44 void makeIntLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
45                      const int32_t value) {
46     AStatsEvent* statsEvent = AStatsEvent_obtain();
47     AStatsEvent_setAtomId(statsEvent, atomId);
48     AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
49     AStatsEvent_writeInt32(statsEvent, value);
50 
51     parseStatsEventToLogEvent(statsEvent, logEvent);
52 }
53 
makeFloatLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const float floatValue)54 void makeFloatLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
55                        const float floatValue) {
56     AStatsEvent* statsEvent = AStatsEvent_obtain();
57     AStatsEvent_setAtomId(statsEvent, atomId);
58     AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
59     AStatsEvent_writeFloat(statsEvent, floatValue);
60 
61     parseStatsEventToLogEvent(statsEvent, logEvent);
62 }
63 
makeStringLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const string & name)64 void makeStringLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
65                         const string& name) {
66     AStatsEvent* statsEvent = AStatsEvent_obtain();
67     AStatsEvent_setAtomId(statsEvent, atomId);
68     AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
69     AStatsEvent_writeString(statsEvent, name.c_str());
70 
71     parseStatsEventToLogEvent(statsEvent, logEvent);
72 }
73 
makeIntWithBoolAnnotationLogEvent(LogEvent * logEvent,const int32_t atomId,const int32_t field,const uint8_t annotationId,const bool annotationValue)74 void makeIntWithBoolAnnotationLogEvent(LogEvent* logEvent, const int32_t atomId,
75                                        const int32_t field, const uint8_t annotationId,
76                                        const bool annotationValue) {
77     AStatsEvent* statsEvent = AStatsEvent_obtain();
78     AStatsEvent_setAtomId(statsEvent, atomId);
79     AStatsEvent_writeInt32(statsEvent, field);
80     AStatsEvent_addBoolAnnotation(statsEvent, annotationId, annotationValue);
81 
82     parseStatsEventToLogEvent(statsEvent, logEvent);
83 }
84 
makeAttributionLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const vector<int> & attributionUids,const vector<string> & attributionTags,const string & name)85 void makeAttributionLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
86                              const vector<int>& attributionUids,
87                              const vector<string>& attributionTags, const string& name) {
88     AStatsEvent* statsEvent = AStatsEvent_obtain();
89     AStatsEvent_setAtomId(statsEvent, atomId);
90     AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
91 
92     writeAttribution(statsEvent, attributionUids, attributionTags);
93     AStatsEvent_writeString(statsEvent, name.c_str());
94 
95     parseStatsEventToLogEvent(statsEvent, logEvent);
96 }
97 
makeBoolLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const bool bool1,const bool bool2)98 void makeBoolLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
99                       const bool bool1, const bool bool2) {
100     AStatsEvent* statsEvent = AStatsEvent_obtain();
101     AStatsEvent_setAtomId(statsEvent, atomId);
102     AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
103 
104     AStatsEvent_writeBool(statsEvent, bool1);
105     AStatsEvent_writeBool(statsEvent, bool2);
106 
107     parseStatsEventToLogEvent(statsEvent, logEvent);
108 }
109 
110 }  // anonymous namespace
111 
TEST(AtomMatcherTest,TestSimpleMatcher)112 TEST(AtomMatcherTest, TestSimpleMatcher) {
113     sp<UidMap> uidMap = new UidMap();
114 
115     // Set up the matcher
116     AtomMatcher matcher;
117     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
118     simpleMatcher->set_atom_id(TAG_ID);
119 
120     LogEvent event(/*uid=*/0, /*pid=*/0);
121     makeIntLogEvent(&event, TAG_ID, 0, 11);
122 
123     // Test
124     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
125 
126     // Wrong tag id.
127     simpleMatcher->set_atom_id(TAG_ID + 1);
128     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
129 }
130 
TEST(AtomMatcherTest,TestAttributionMatcher)131 TEST(AtomMatcherTest, TestAttributionMatcher) {
132     sp<UidMap> uidMap = new UidMap();
133     std::vector<int> attributionUids = {1111, 2222, 3333};
134     std::vector<string> attributionTags = {"location1", "location2", "location3"};
135 
136     // Set up the log event.
137     LogEvent event(/*uid=*/0, /*pid=*/0);
138     makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
139 
140     // Set up the matcher
141     AtomMatcher matcher;
142     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
143     simpleMatcher->set_atom_id(TAG_ID);
144 
145     // Match first node.
146     auto attributionMatcher = simpleMatcher->add_field_value_matcher();
147     attributionMatcher->set_field(FIELD_ID_1);
148     attributionMatcher->set_position(Position::FIRST);
149     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
150             ATTRIBUTION_TAG_FIELD_ID);
151     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
152             "tag");
153 
154     auto fieldMatcher = simpleMatcher->add_field_value_matcher();
155     fieldMatcher->set_field(FIELD_ID_2);
156     fieldMatcher->set_eq_string("some value");
157 
158     // Tag not matched.
159     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
160     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
161             "location3");
162     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
163     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
164             "location1");
165     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
166 
167     // Match last node.
168     attributionMatcher->set_position(Position::LAST);
169     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
170     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
171             "location3");
172     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
173 
174     // Match any node.
175     attributionMatcher->set_position(Position::ANY);
176     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
177     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
178             "location1");
179     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
180     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
181             "location2");
182     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
183     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
184             "location3");
185     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
186     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
187             "location4");
188     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
189 
190     // Attribution match but primitive field not match.
191     attributionMatcher->set_position(Position::ANY);
192     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
193             "location2");
194     fieldMatcher->set_eq_string("wrong value");
195     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
196 
197     fieldMatcher->set_eq_string("some value");
198 
199     // Uid match.
200     attributionMatcher->set_position(Position::ANY);
201     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
202             ATTRIBUTION_UID_FIELD_ID);
203     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
204             "pkg0");
205     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
206 
207     uidMap->updateMap(
208             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
209             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
210              android::String16("v1"), android::String16("v2")},
211             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
212              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
213             {android::String16(""), android::String16(""), android::String16(""),
214              android::String16(""), android::String16("")});
215 
216     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
217     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
218             "pkg3");
219     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
220     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
221             "pkg2");
222     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
223     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
224             "pkg1");
225     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
226     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
227             "pkg0");
228     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
229 
230     attributionMatcher->set_position(Position::FIRST);
231     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
232             "pkg0");
233     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
234     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
235             "pkg3");
236     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
237     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
238             "pkg2");
239     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
240     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
241             "pkg1");
242     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
243 
244     attributionMatcher->set_position(Position::LAST);
245     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
246             "pkg0");
247     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
248     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
249             "pkg3");
250     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
251     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
252             "pkg2");
253     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
254     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
255             "pkg1");
256     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
257 
258     // Uid + tag.
259     attributionMatcher->set_position(Position::ANY);
260     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
261             ATTRIBUTION_TAG_FIELD_ID);
262     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
263             "pkg0");
264     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
265             "location1");
266     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
267     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
268             "pkg1");
269     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
270             "location1");
271     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
272     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
273             "pkg1");
274     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
275             "location2");
276     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
277     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
278             "pkg2");
279     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
280             "location3");
281     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
282     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
283             "pkg3");
284     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
285             "location3");
286     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
287     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
288             "pkg3");
289     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
290             "location1");
291     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
292 
293     attributionMatcher->set_position(Position::FIRST);
294     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
295             "pkg0");
296     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
297             "location1");
298     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
299     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
300             "pkg1");
301     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
302             "location1");
303     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
304     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
305             "pkg1");
306     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
307             "location2");
308     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
309     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
310             "pkg2");
311     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
312             "location3");
313     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
314     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
315             "pkg3");
316     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
317             "location3");
318     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
319     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
320             "pkg3");
321     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
322             "location1");
323     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
324 
325     attributionMatcher->set_position(Position::LAST);
326     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
327             "pkg0");
328     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
329             "location1");
330     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
331     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
332             "pkg1");
333     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
334             "location1");
335     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
336     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
337             "pkg1");
338     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
339             "location2");
340     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
341     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
342             "pkg2");
343     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
344             "location3");
345     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
346     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
347             "pkg3");
348     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
349             "location3");
350     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
351     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
352             "pkg3");
353     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
354             "location1");
355     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
356 }
357 
TEST(AtomMatcherTest,TestUidFieldMatcher)358 TEST(AtomMatcherTest, TestUidFieldMatcher) {
359     sp<UidMap> uidMap = new UidMap();
360     uidMap->updateMap(
361             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
362             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
363              android::String16("v1"), android::String16("v2")},
364             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
365              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
366             {android::String16(""), android::String16(""), android::String16(""),
367              android::String16(""), android::String16("")});
368 
369     // Set up matcher
370     AtomMatcher matcher;
371     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
372     simpleMatcher->set_atom_id(TAG_ID);
373     simpleMatcher->add_field_value_matcher()->set_field(1);
374     simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("pkg0");
375 
376     // Make event without is_uid annotation.
377     LogEvent event1(/*uid=*/0, /*pid=*/0);
378     makeIntLogEvent(&event1, TAG_ID, 0, 1111);
379     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
380 
381     // Make event with is_uid annotation.
382     LogEvent event2(/*uid=*/0, /*pid=*/0);
383     makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID_2, 1111, ANNOTATION_ID_IS_UID, true);
384 
385     // Event has is_uid annotation, so mapping from uid to package name occurs.
386     simpleMatcher->set_atom_id(TAG_ID_2);
387     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
388 
389     // Event has is_uid annotation, but uid maps to different package name.
390     simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("Pkg2");
391     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2));
392 }
393 
TEST(AtomMatcherTest,TestNeqAnyStringMatcher)394 TEST(AtomMatcherTest, TestNeqAnyStringMatcher) {
395     sp<UidMap> uidMap = new UidMap();
396     uidMap->updateMap(
397             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
398             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
399              android::String16("v1"), android::String16("v2")},
400             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
401              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
402             {android::String16(""), android::String16(""), android::String16(""),
403              android::String16(""), android::String16("")});
404 
405     std::vector<int> attributionUids = {1111, 2222, 3333, 1066};
406     std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
407 
408     // Set up the event
409     LogEvent event(/*uid=*/0, /*pid=*/0);
410     makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
411 
412     // Set up the matcher
413     AtomMatcher matcher;
414     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
415     simpleMatcher->set_atom_id(TAG_ID);
416 
417     // Match first node.
418     auto attributionMatcher = simpleMatcher->add_field_value_matcher();
419     attributionMatcher->set_field(FIELD_ID_1);
420     attributionMatcher->set_position(Position::FIRST);
421     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
422             ATTRIBUTION_UID_FIELD_ID);
423     auto neqStringList = attributionMatcher->mutable_matches_tuple()
424                                  ->mutable_field_value_matcher(0)
425                                  ->mutable_neq_any_string();
426     neqStringList->add_str_value("pkg2");
427     neqStringList->add_str_value("pkg3");
428 
429     auto fieldMatcher = simpleMatcher->add_field_value_matcher();
430     fieldMatcher->set_field(FIELD_ID_2);
431     fieldMatcher->set_eq_string("some value");
432 
433     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
434 
435     neqStringList->Clear();
436     neqStringList->add_str_value("pkg1");
437     neqStringList->add_str_value("pkg3");
438     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
439 
440     attributionMatcher->set_position(Position::ANY);
441     neqStringList->Clear();
442     neqStringList->add_str_value("maps.com");
443     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
444 
445     neqStringList->Clear();
446     neqStringList->add_str_value("PkG3");
447     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
448 
449     attributionMatcher->set_position(Position::LAST);
450     neqStringList->Clear();
451     neqStringList->add_str_value("AID_STATSD");
452     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
453 }
454 
TEST(AtomMatcherTest,TestEqAnyStringMatcher)455 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
456     sp<UidMap> uidMap = new UidMap();
457     uidMap->updateMap(
458             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
459             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
460              android::String16("v1"), android::String16("v2")},
461             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
462              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
463             {android::String16(""), android::String16(""), android::String16(""),
464              android::String16(""), android::String16("")});
465 
466     std::vector<int> attributionUids = {1067, 2222, 3333, 1066};
467     std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
468 
469     // Set up the event
470     LogEvent event(/*uid=*/0, /*pid=*/0);
471     makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
472 
473     // Set up the matcher
474     AtomMatcher matcher;
475     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
476     simpleMatcher->set_atom_id(TAG_ID);
477 
478     // Match first node.
479     auto attributionMatcher = simpleMatcher->add_field_value_matcher();
480     attributionMatcher->set_field(FIELD_ID_1);
481     attributionMatcher->set_position(Position::FIRST);
482     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
483             ATTRIBUTION_UID_FIELD_ID);
484     auto eqStringList = attributionMatcher->mutable_matches_tuple()
485                                 ->mutable_field_value_matcher(0)
486                                 ->mutable_eq_any_string();
487     eqStringList->add_str_value("AID_ROOT");
488     eqStringList->add_str_value("AID_INCIDENTD");
489 
490     auto fieldMatcher = simpleMatcher->add_field_value_matcher();
491     fieldMatcher->set_field(FIELD_ID_2);
492     fieldMatcher->set_eq_string("some value");
493 
494     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
495 
496     attributionMatcher->set_position(Position::ANY);
497     eqStringList->Clear();
498     eqStringList->add_str_value("AID_STATSD");
499     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
500 
501     eqStringList->Clear();
502     eqStringList->add_str_value("pkg1");
503     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
504 
505     auto normalStringField = fieldMatcher->mutable_eq_any_string();
506     normalStringField->add_str_value("some value123");
507     normalStringField->add_str_value("some value");
508     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
509 
510     normalStringField->Clear();
511     normalStringField->add_str_value("AID_STATSD");
512     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
513 
514     eqStringList->Clear();
515     eqStringList->add_str_value("maps.com");
516     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
517 }
518 
TEST(AtomMatcherTest,TestBoolMatcher)519 TEST(AtomMatcherTest, TestBoolMatcher) {
520     sp<UidMap> uidMap = new UidMap();
521     // Set up the matcher
522     AtomMatcher matcher;
523     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
524     simpleMatcher->set_atom_id(TAG_ID);
525     auto keyValue1 = simpleMatcher->add_field_value_matcher();
526     keyValue1->set_field(FIELD_ID_1);
527     auto keyValue2 = simpleMatcher->add_field_value_matcher();
528     keyValue2->set_field(FIELD_ID_2);
529 
530     // Set up the event
531     LogEvent event(/*uid=*/0, /*pid=*/0);
532     makeBoolLogEvent(&event, TAG_ID, 0, true, false);
533 
534     // Test
535     keyValue1->set_eq_bool(true);
536     keyValue2->set_eq_bool(false);
537     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
538 
539     keyValue1->set_eq_bool(false);
540     keyValue2->set_eq_bool(false);
541     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
542 
543     keyValue1->set_eq_bool(false);
544     keyValue2->set_eq_bool(true);
545     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
546 
547     keyValue1->set_eq_bool(true);
548     keyValue2->set_eq_bool(true);
549     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
550 }
551 
TEST(AtomMatcherTest,TestStringMatcher)552 TEST(AtomMatcherTest, TestStringMatcher) {
553     sp<UidMap> uidMap = new UidMap();
554     // Set up the matcher
555     AtomMatcher matcher;
556     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
557     simpleMatcher->set_atom_id(TAG_ID);
558     auto keyValue = simpleMatcher->add_field_value_matcher();
559     keyValue->set_field(FIELD_ID_1);
560     keyValue->set_eq_string("some value");
561 
562     // Set up the event
563     LogEvent event(/*uid=*/0, /*pid=*/0);
564     makeStringLogEvent(&event, TAG_ID, 0, "some value");
565 
566     // Test
567     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
568 }
569 
TEST(AtomMatcherTest,TestMultiFieldsMatcher)570 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
571     sp<UidMap> uidMap = new UidMap();
572     // Set up the matcher
573     AtomMatcher matcher;
574     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
575     simpleMatcher->set_atom_id(TAG_ID);
576     auto keyValue1 = simpleMatcher->add_field_value_matcher();
577     keyValue1->set_field(FIELD_ID_1);
578     auto keyValue2 = simpleMatcher->add_field_value_matcher();
579     keyValue2->set_field(FIELD_ID_2);
580 
581     // Set up the event
582     LogEvent event(/*uid=*/0, /*pid=*/0);
583     CreateTwoValueLogEvent(&event, TAG_ID, 0, 2, 3);
584 
585     // Test
586     keyValue1->set_eq_int(2);
587     keyValue2->set_eq_int(3);
588     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
589 
590     keyValue1->set_eq_int(2);
591     keyValue2->set_eq_int(4);
592     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
593 
594     keyValue1->set_eq_int(4);
595     keyValue2->set_eq_int(3);
596     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
597 }
598 
TEST(AtomMatcherTest,TestIntComparisonMatcher)599 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
600     sp<UidMap> uidMap = new UidMap();
601     // Set up the matcher
602     AtomMatcher matcher;
603     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
604 
605     simpleMatcher->set_atom_id(TAG_ID);
606     auto keyValue = simpleMatcher->add_field_value_matcher();
607     keyValue->set_field(FIELD_ID_1);
608 
609     // Set up the event
610     LogEvent event(/*uid=*/0, /*pid=*/0);
611     makeIntLogEvent(&event, TAG_ID, 0, 11);
612 
613     // Test
614 
615     // eq_int
616     keyValue->set_eq_int(10);
617     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
618     keyValue->set_eq_int(11);
619     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
620     keyValue->set_eq_int(12);
621     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
622 
623     // lt_int
624     keyValue->set_lt_int(10);
625     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
626     keyValue->set_lt_int(11);
627     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
628     keyValue->set_lt_int(12);
629     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
630 
631     // lte_int
632     keyValue->set_lte_int(10);
633     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
634     keyValue->set_lte_int(11);
635     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
636     keyValue->set_lte_int(12);
637     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
638 
639     // gt_int
640     keyValue->set_gt_int(10);
641     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
642     keyValue->set_gt_int(11);
643     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
644     keyValue->set_gt_int(12);
645     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
646 
647     // gte_int
648     keyValue->set_gte_int(10);
649     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
650     keyValue->set_gte_int(11);
651     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
652     keyValue->set_gte_int(12);
653     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
654 }
655 
TEST(AtomMatcherTest,TestFloatComparisonMatcher)656 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
657     sp<UidMap> uidMap = new UidMap();
658     // Set up the matcher
659     AtomMatcher matcher;
660     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
661     simpleMatcher->set_atom_id(TAG_ID);
662 
663     auto keyValue = simpleMatcher->add_field_value_matcher();
664     keyValue->set_field(FIELD_ID_1);
665 
666     LogEvent event1(/*uid=*/0, /*pid=*/0);
667     makeFloatLogEvent(&event1, TAG_ID, 0, 10.1f);
668     keyValue->set_lt_float(10.0);
669     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
670 
671     LogEvent event2(/*uid=*/0, /*pid=*/0);
672     makeFloatLogEvent(&event2, TAG_ID, 0, 9.9f);
673     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
674 
675     LogEvent event3(/*uid=*/0, /*pid=*/0);
676     makeFloatLogEvent(&event3, TAG_ID, 0, 10.1f);
677     keyValue->set_gt_float(10.0);
678     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
679 
680     LogEvent event4(/*uid=*/0, /*pid=*/0);
681     makeFloatLogEvent(&event4, TAG_ID, 0, 9.9f);
682     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
683 }
684 
685 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)686 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
687     simpleMatcher->set_atom_id(tag);
688     auto keyValue = simpleMatcher->add_field_value_matcher();
689     keyValue->set_field(key);
690     keyValue->set_eq_int(val);
691 }
692 
TEST(AtomMatcherTest,TestAndMatcher)693 TEST(AtomMatcherTest, TestAndMatcher) {
694     // Set up the matcher
695     LogicalOperation operation = LogicalOperation::AND;
696 
697     vector<int> children;
698     children.push_back(0);
699     children.push_back(1);
700     children.push_back(2);
701 
702     vector<MatchingState> matcherResults;
703     matcherResults.push_back(MatchingState::kMatched);
704     matcherResults.push_back(MatchingState::kNotMatched);
705     matcherResults.push_back(MatchingState::kMatched);
706 
707     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
708 
709     matcherResults.clear();
710     matcherResults.push_back(MatchingState::kMatched);
711     matcherResults.push_back(MatchingState::kMatched);
712     matcherResults.push_back(MatchingState::kMatched);
713 
714     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
715 }
716 
TEST(AtomMatcherTest,TestOrMatcher)717 TEST(AtomMatcherTest, TestOrMatcher) {
718     // Set up the matcher
719     LogicalOperation operation = LogicalOperation::OR;
720 
721     vector<int> children;
722     children.push_back(0);
723     children.push_back(1);
724     children.push_back(2);
725 
726     vector<MatchingState> matcherResults;
727     matcherResults.push_back(MatchingState::kMatched);
728     matcherResults.push_back(MatchingState::kNotMatched);
729     matcherResults.push_back(MatchingState::kMatched);
730 
731     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
732 
733     matcherResults.clear();
734     matcherResults.push_back(MatchingState::kNotMatched);
735     matcherResults.push_back(MatchingState::kNotMatched);
736     matcherResults.push_back(MatchingState::kNotMatched);
737 
738     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
739 }
740 
TEST(AtomMatcherTest,TestNotMatcher)741 TEST(AtomMatcherTest, TestNotMatcher) {
742     // Set up the matcher
743     LogicalOperation operation = LogicalOperation::NOT;
744 
745     vector<int> children;
746     children.push_back(0);
747 
748     vector<MatchingState> matcherResults;
749     matcherResults.push_back(MatchingState::kMatched);
750 
751     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
752 
753     matcherResults.clear();
754     matcherResults.push_back(MatchingState::kNotMatched);
755     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
756 }
757 
TEST(AtomMatcherTest,TestNandMatcher)758 TEST(AtomMatcherTest, TestNandMatcher) {
759     // Set up the matcher
760     LogicalOperation operation = LogicalOperation::NAND;
761 
762     vector<int> children;
763     children.push_back(0);
764     children.push_back(1);
765 
766     vector<MatchingState> matcherResults;
767     matcherResults.push_back(MatchingState::kMatched);
768     matcherResults.push_back(MatchingState::kNotMatched);
769 
770     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
771 
772     matcherResults.clear();
773     matcherResults.push_back(MatchingState::kNotMatched);
774     matcherResults.push_back(MatchingState::kNotMatched);
775     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
776 
777     matcherResults.clear();
778     matcherResults.push_back(MatchingState::kMatched);
779     matcherResults.push_back(MatchingState::kMatched);
780     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
781 }
782 
TEST(AtomMatcherTest,TestNorMatcher)783 TEST(AtomMatcherTest, TestNorMatcher) {
784     // Set up the matcher
785     LogicalOperation operation = LogicalOperation::NOR;
786 
787     vector<int> children;
788     children.push_back(0);
789     children.push_back(1);
790 
791     vector<MatchingState> matcherResults;
792     matcherResults.push_back(MatchingState::kMatched);
793     matcherResults.push_back(MatchingState::kNotMatched);
794 
795     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
796 
797     matcherResults.clear();
798     matcherResults.push_back(MatchingState::kNotMatched);
799     matcherResults.push_back(MatchingState::kNotMatched);
800     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
801 
802     matcherResults.clear();
803     matcherResults.push_back(MatchingState::kMatched);
804     matcherResults.push_back(MatchingState::kMatched);
805     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
806 }
807 #else
808 GTEST_LOG_(INFO) << "This test does nothing.\n";
809 #endif
810