1 /*
2  * Copyright 2020 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "hal/snoop_logger.h"
18 
19 #include <bluetooth/log.h>
20 #include <gmock/gmock.h>
21 #include <gtest/gtest.h>
22 #include <netinet/in.h>
23 #include <sys/socket.h>
24 
25 #include <future>
26 #include <unordered_map>
27 
28 #include "hal/snoop_logger_common.h"
29 #include "hal/syscall_wrapper_impl.h"
30 #include "os/fake_timer/fake_timerfd.h"
31 #include "os/system_properties.h"
32 #include "os/utils.h"
33 
34 // TODO(b/369381361) Enfore -Wmissing-prototypes
35 #pragma GCC diagnostic ignored "-Wmissing-prototypes"
36 
37 namespace testing {
38 
39 using bluetooth::hal::SnoopLoggerCommon;
40 using bluetooth::hal::SnoopLoggerSocket;
41 using bluetooth::hal::SnoopLoggerSocketInterface;
42 using bluetooth::hal::SnoopLoggerSocketThread;
43 using bluetooth::hal::SyscallWrapperImpl;
44 using bluetooth::os::fake_timer::fake_timerfd_advance;
45 using bluetooth::os::fake_timer::fake_timerfd_reset;
46 using namespace bluetooth;
47 
48 namespace {
49 std::vector<uint8_t> kInformationRequest = {
50         0xfe, 0x2e, 0x0a, 0x00, 0x06, 0x00, 0x01, 0x00, 0x0a, 0x02, 0x02, 0x00, 0x02, 0x00,
51 };
52 
53 std::vector<uint8_t> kSdpConnectionRequest = {0x08, 0x20, 0x0c, 0x00, 0x08, 0x00, 0x01, 0x00,
54                                               0x02, 0x0c, 0x04, 0x00, 0x01, 0x00, 0x44, 0x00};
55 
56 std::vector<uint8_t> kAvdtpSuspend = {0x02, 0x02, 0x00, 0x07, 0x00, 0x03,
57                                       0x00, 0x8d, 0x00, 0x90, 0x09, 0x04};
58 
59 std::vector<uint8_t> kHfpAtNrec0 = {0x02, 0x02, 0x20, 0x13, 0x00, 0x0f, 0x00, 0x41,
60                                     0x00, 0x09, 0xff, 0x15, 0x01, 0x41, 0x54, 0x2b,
61                                     0x4e, 0x52, 0x45, 0x43, 0x3d, 0x30, 0x0d, 0x5c};
62 
63 std::vector<uint8_t> kQualcommConnectionRequest = {0xdc, 0x2e, 0x54, 0x00, 0x50, 0x00, 0xff,
64                                                    0x00, 0x00, 0x0a, 0x0f, 0x09, 0x01, 0x00,
65                                                    0x5c, 0x93, 0x01, 0x00, 0x42, 0x00};
66 
67 std::vector<uint8_t> kA2dpMediaPacket = {
68         0x0b, 0x20, 0x3a, 0x00, 0x36, 0x00, 0x40, 0xa0, 0x80, 0xe0, 0x07, 0x7f, 0x00,
69         0x1e, 0x08, 0x00, 0x00, 0x00, 0x00, 0x02, 0x47, 0xfc, 0x00, 0x00, 0xb0, 0x90,
70         0x80, 0x03, 0x00, 0x20, 0x21, 0x11, 0x45, 0x00, 0x14, 0x50, 0x01, 0x46, 0xf0,
71         0x81, 0x0a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a,
72         0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5e,
73 };
74 
75 std::vector<bluetooth::hal::HciPacket> kTestData = {
76         {0x02, 0x20, 0x11, 0x00, 0x0d, 0x00, 0x41, 0x00, 0x9d, 0xef, 0x35,
77          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
78         {0x02, 0x00, 0x12, 0x00, 0x0e, 0x00, 0x40, 0x00, 0x9f, 0xff, 0x3f,
79          0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
80         {0x02, 0x20, 0x11, 0x00, 0x0d, 0x00, 0x41, 0x00, 0x9d, 0xef, 0x85,
81          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
82         {0x02, 0x00, 0x12, 0x00, 0x0e, 0x00, 0x40, 0x00, 0x9f, 0xff, 0x1f,
83          0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
84         {0x02, 0x20, 0x11, 0x00, 0x0d, 0x00, 0x41, 0x00, 0x9d, 0xef, 0x99,
85          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
86         {0x02, 0x00, 0x13, 0x00, 0x0f, 0x00, 0x40, 0x00, 0x9f, 0xff, 0xc6, 0x01,
87          0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
88         {0x02, 0x20, 0x11, 0x00, 0x0d, 0x00, 0x41, 0x00, 0x9d, 0xef, 0x99,
89          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
90         {0x02, 0x00, 0x12, 0x00, 0x0e, 0x00, 0x40, 0x00, 0x9f, 0xff, 0x1f,
91          0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
92         {0x02, 0x20, 0x12, 0x00, 0x0e, 0x00, 0x41, 0x00, 0x9d, 0xff, 0x01,
93          0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
94         {0x02, 0x00, 0x12, 0x00, 0x0e, 0x00, 0x40, 0x00, 0x9f, 0xff, 0x8f,
95          0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
96         {0x02, 0x20, 0x11, 0x00, 0x0d, 0x00, 0x41, 0x00, 0x9d, 0xef, 0x89,
97          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
98         {0x02, 0x00, 0x12, 0x00, 0x0e, 0x00, 0x40, 0x00, 0x9f, 0xff, 0x1f,
99          0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
100         {0x02, 0x20, 0x11, 0x00, 0x0d, 0x00, 0x41, 0x00, 0x9d, 0xef, 0x43,
101          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
102         {0x02, 0x00, 0x12, 0x00, 0x0e, 0x00, 0x40, 0x00, 0x9f, 0xff, 0x11,
103          0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
104 
105 }  // namespace
106 
107 using bluetooth::TestModuleRegistry;
108 using bluetooth::hal::SnoopLogger;
109 using namespace std::chrono_literals;
110 
111 // Expose protected constructor for test
112 class TestSnoopLoggerModule : public SnoopLogger {
113 public:
TestSnoopLoggerModule(std::string snoop_log_path,std::string snooz_log_path,size_t max_packets_per_file,const std::string & btsnoop_mode,bool qualcomm_debug_log_enabled,bool snoop_log_persists)114   TestSnoopLoggerModule(std::string snoop_log_path, std::string snooz_log_path,
115                         size_t max_packets_per_file, const std::string& btsnoop_mode,
116                         bool qualcomm_debug_log_enabled, bool snoop_log_persists)
117       : SnoopLogger(std::move(snoop_log_path), std::move(snooz_log_path), max_packets_per_file,
118                     SnoopLogger::GetMaxPacketsPerBuffer(), btsnoop_mode, qualcomm_debug_log_enabled,
119                     20ms, 5ms, snoop_log_persists) {}
120 
ToString() const121   std::string ToString() const override { return std::string("TestSnoopLoggerModule"); }
122 
GetSocketThread()123   SnoopLoggerSocketThread* GetSocketThread() { return snoop_logger_socket_thread_.get(); }
124 
GetL2capHeaderSize()125   static uint32_t GetL2capHeaderSize() { return L2CAP_HEADER_SIZE; }
126 
GetMaxFilteredSize()127   static size_t GetMaxFilteredSize() { return MAX_HCI_ACL_LEN - PACKET_TYPE_LENGTH; }
128 };
129 
130 class SnoopLoggerModuleTest : public Test {
131 public:
132   TestModuleRegistry* test_registry;
133 
134 protected:
SetUp()135   void SetUp() override {
136     const testing::TestInfo* const test_info =
137             testing::UnitTest::GetInstance()->current_test_info();
138 
139     log::debug("Setup for test {} in test suite {}.", test_info->name(),
140                test_info->test_suite_name());
141     const std::filesystem::path temp_dir_ = std::filesystem::temp_directory_path();
142 
143     temp_snoop_log_ = temp_dir_ / (std::string(test_info->name()) + "_btsnoop_hci.log");
144     temp_snoop_log_last_ = temp_dir_ / (std::string(test_info->name()) + "_btsnoop_hci.log.last");
145     temp_snooz_log_ = temp_dir_ / (std::string(test_info->name()) + "_btsnooz_hci.log");
146     temp_snooz_log_last_ = temp_dir_ / (std::string(test_info->name()) + "_btsnooz_hci.log.last");
147     temp_snoop_log_filtered =
148             temp_dir_ / (std::string(test_info->name()) + "_btsnoop_hci.log.filtered");
149     temp_snoop_log_filtered_last =
150             temp_dir_ / (std::string(test_info->name()) + "_btsnoop_hci.log.filtered.last");
151 
152     DeleteSnoopLogFiles();
153     ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
154     ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
155     ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_filtered));
156     ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_filtered_last));
157     ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
158     ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_last_));
159 
160     test_registry = new TestModuleRegistry();
161   }
162 
TearDown()163   void TearDown() override {
164     DeleteSnoopLogFiles();
165     fake_timerfd_reset();
166     test_registry->StopAll();
167     delete test_registry;
168 
169     const testing::TestInfo* const test_info =
170             testing::UnitTest::GetInstance()->current_test_info();
171     log::debug("TearDown for test {} in test suite {}.", test_info->name(),
172                test_info->test_suite_name());
173   }
174 
175   std::filesystem::path temp_snoop_log_;
176   std::filesystem::path temp_snoop_log_last_;
177   std::filesystem::path temp_snooz_log_;
178   std::filesystem::path temp_snooz_log_last_;
179   std::filesystem::path temp_snoop_log_filtered;
180   std::filesystem::path temp_snoop_log_filtered_last;
181 
182 private:
DeleteSnoopLogFiles()183   void DeleteSnoopLogFiles() {
184     if (std::filesystem::exists(temp_snoop_log_)) {
185       ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_));
186     }
187     if (std::filesystem::exists(temp_snoop_log_last_)) {
188       ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_last_));
189     }
190     if (std::filesystem::exists(temp_snoop_log_filtered)) {
191       ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
192     }
193     if (std::filesystem::exists(temp_snoop_log_filtered_last)) {
194       ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered_last));
195     }
196     if (std::filesystem::exists(temp_snooz_log_)) {
197       ASSERT_TRUE(std::filesystem::remove(temp_snooz_log_));
198     }
199     if (std::filesystem::exists(temp_snooz_log_last_)) {
200       ASSERT_TRUE(std::filesystem::remove(temp_snooz_log_last_));
201     }
202   }
203 };
204 
TEST_F(SnoopLoggerModuleTest,empty_snoop_log_test)205 TEST_F(SnoopLoggerModuleTest, empty_snoop_log_test) {
206   // Actual test
207   auto* snoop_logger =
208           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
209                                     SnoopLogger::kBtSnoopLogModeFull, false, false);
210   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
211   test_registry->StopAll();
212 
213   // Verify states after test
214   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_));
215   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
216   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_), sizeof(SnoopLoggerCommon::FileHeaderType));
217 }
218 
TEST_F(SnoopLoggerModuleTest,disable_snoop_log_test)219 TEST_F(SnoopLoggerModuleTest, disable_snoop_log_test) {
220   // Actual test
221   auto* snoop_logger =
222           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
223                                     SnoopLogger::kBtSnoopLogModeDisabled, false, false);
224   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
225   test_registry->StopAll();
226 
227   // Verify states after test
228   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
229   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
230   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
231 }
232 
TEST_F(SnoopLoggerModuleTest,capture_one_packet_test)233 TEST_F(SnoopLoggerModuleTest, capture_one_packet_test) {
234   // Actual test
235   auto* snoop_logger =
236           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
237                                     SnoopLogger::kBtSnoopLogModeFull, false, false);
238   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
239 
240   snoop_logger->Capture(kInformationRequest, SnoopLogger::Direction::OUTGOING,
241                         SnoopLogger::PacketType::CMD);
242 
243   test_registry->StopAll();
244 
245   // Verify states after test
246   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_));
247   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
248   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_),
249             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
250                     kInformationRequest.size());
251 }
252 
TEST_F(SnoopLoggerModuleTest,capture_hci_cmd_btsnooz_test)253 TEST_F(SnoopLoggerModuleTest, capture_hci_cmd_btsnooz_test) {
254   // Actual test
255   auto* snoop_logger =
256           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
257                                     SnoopLogger::kBtSnoopLogModeDisabled, false, false);
258   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
259 
260   snoop_logger->Capture(kInformationRequest, SnoopLogger::Direction::OUTGOING,
261                         SnoopLogger::PacketType::CMD);
262   snoop_logger->DumpSnoozLogToFile();
263 
264   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
265   ASSERT_EQ(std::filesystem::file_size(temp_snooz_log_),
266             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
267                     kInformationRequest.size());
268 
269   test_registry->StopAll();
270 
271   // Verify states after test
272   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
273   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
274   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
275 }
276 
TEST_F(SnoopLoggerModuleTest,capture_l2cap_signal_packet_btsnooz_test)277 TEST_F(SnoopLoggerModuleTest, capture_l2cap_signal_packet_btsnooz_test) {
278   // Actual test
279   auto* snoop_logger =
280           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
281                                     SnoopLogger::kBtSnoopLogModeDisabled, false, false);
282   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
283 
284   snoop_logger->Capture(kSdpConnectionRequest, SnoopLogger::Direction::OUTGOING,
285                         SnoopLogger::PacketType::ACL);
286   snoop_logger->DumpSnoozLogToFile();
287 
288   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
289   ASSERT_EQ(std::filesystem::file_size(temp_snooz_log_),
290             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
291                     kSdpConnectionRequest.size());
292 
293   test_registry->StopAll();
294 
295   // Verify states after test
296   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
297   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
298   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
299 }
300 
TEST_F(SnoopLoggerModuleTest,capture_l2cap_short_data_packet_btsnooz_test)301 TEST_F(SnoopLoggerModuleTest, capture_l2cap_short_data_packet_btsnooz_test) {
302   // Actual test
303   auto* snoop_logger =
304           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
305                                     SnoopLogger::kBtSnoopLogModeDisabled, false, false);
306   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
307 
308   snoop_logger->Capture(kAvdtpSuspend, SnoopLogger::Direction::OUTGOING,
309                         SnoopLogger::PacketType::ACL);
310   snoop_logger->DumpSnoozLogToFile();
311 
312   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
313   ASSERT_EQ(std::filesystem::file_size(temp_snooz_log_),
314             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
315                     kAvdtpSuspend.size());
316 
317   test_registry->StopAll();
318 
319   // Verify states after test
320   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
321   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
322   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
323 }
324 
TEST_F(SnoopLoggerModuleTest,capture_l2cap_long_data_packet_btsnooz_test)325 TEST_F(SnoopLoggerModuleTest, capture_l2cap_long_data_packet_btsnooz_test) {
326   // Actual test
327   auto* snoop_logger =
328           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
329                                     SnoopLogger::kBtSnoopLogModeDisabled, false, false);
330   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
331 
332   snoop_logger->Capture(kHfpAtNrec0, SnoopLogger::Direction::OUTGOING,
333                         SnoopLogger::PacketType::ACL);
334   snoop_logger->DumpSnoozLogToFile();
335 
336   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
337   ASSERT_EQ(std::filesystem::file_size(temp_snooz_log_),
338             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) + 14);
339 
340   test_registry->StopAll();
341 
342   // Verify states after test
343   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
344   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
345   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
346 }
347 
TEST_F(SnoopLoggerModuleTest,snoop_log_persists)348 TEST_F(SnoopLoggerModuleTest, snoop_log_persists) {
349   // Actual test
350   auto* snoop_logger =
351           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
352                                     SnoopLogger::kBtSnoopLogModeDisabled, false, true);
353   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
354 
355   snoop_logger->Capture(kHfpAtNrec0, SnoopLogger::Direction::OUTGOING,
356                         SnoopLogger::PacketType::ACL);
357   snoop_logger->DumpSnoozLogToFile();
358 
359   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
360   ASSERT_EQ(std::filesystem::file_size(temp_snooz_log_),
361             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) + 14);
362 
363   test_registry->StopAll();
364   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
365 }
366 
sync_handler(bluetooth::os::Handler * handler)367 void sync_handler(bluetooth::os::Handler* handler) {
368   std::promise<void> promise;
369   auto future = promise.get_future();
370   handler->Post(bluetooth::common::BindOnce(&std::promise<void>::set_value,
371                                             bluetooth::common::Unretained(&promise)));
372   auto future_status = future.wait_for(std::chrono::seconds(1));
373   ASSERT_EQ(future_status, std::future_status::ready);
374 }
375 
TEST_F(SnoopLoggerModuleTest,delete_old_snooz_log_files)376 TEST_F(SnoopLoggerModuleTest, delete_old_snooz_log_files) {
377   // Actual test
378   auto* snoop_logger =
379           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
380                                     SnoopLogger::kBtSnoopLogModeDisabled, false, false);
381   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
382 
383   std::filesystem::create_directories(temp_snooz_log_);
384 
385   auto* handler = test_registry->GetTestModuleHandler(&SnoopLogger::Factory);
386   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
387   handler->Post(bluetooth::common::BindOnce(fake_timerfd_advance, 10));
388   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
389   handler->Post(bluetooth::common::BindOnce(fake_timerfd_advance, 15));
390   sync_handler(handler);
391   handler->Post(bluetooth::common::BindOnce(
392           [](std::filesystem::path path) { ASSERT_FALSE(std::filesystem::exists(path)); },
393           temp_snooz_log_));
394   sync_handler(handler);
395 
396   test_registry->StopAll();
397   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
398 }
399 
TEST_F(SnoopLoggerModuleTest,rotate_file_at_new_session_test)400 TEST_F(SnoopLoggerModuleTest, rotate_file_at_new_session_test) {
401   // Start once
402   {
403     auto* snoop_logger =
404             new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
405                                       SnoopLogger::kBtSnoopLogModeFull, false, false);
406     test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
407     snoop_logger->Capture(kInformationRequest, SnoopLogger::Direction::OUTGOING,
408                           SnoopLogger::PacketType::CMD);
409     test_registry->StopAll();
410   }
411 
412   // Verify states after test
413   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_));
414   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
415   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_),
416             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
417                     kInformationRequest.size());
418 
419   // Start again
420   {
421     auto* snoop_logger =
422             new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
423                                       SnoopLogger::kBtSnoopLogModeFull, false, false);
424     test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
425     snoop_logger->Capture(kInformationRequest, SnoopLogger::Direction::OUTGOING,
426                           SnoopLogger::PacketType::CMD);
427     snoop_logger->Capture(kInformationRequest, SnoopLogger::Direction::OUTGOING,
428                           SnoopLogger::PacketType::CMD);
429     test_registry->StopAll();
430   }
431 
432   // Verify states after test
433   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_));
434   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_last_));
435   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_),
436             sizeof(SnoopLoggerCommon::FileHeaderType) +
437                     (sizeof(SnoopLogger::PacketHeaderType) + kInformationRequest.size()) * 2);
438   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_last_),
439             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
440                     kInformationRequest.size());
441 }
442 
TEST_F(SnoopLoggerModuleTest,rotate_file_after_full_test)443 TEST_F(SnoopLoggerModuleTest, rotate_file_after_full_test) {
444   // Actual test
445   auto* snoop_logger =
446           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
447                                     SnoopLogger::kBtSnoopLogModeFull, false, false);
448   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
449 
450   for (int i = 0; i < 11; i++) {
451     snoop_logger->Capture(kInformationRequest, SnoopLogger::Direction::OUTGOING,
452                           SnoopLogger::PacketType::CMD);
453   }
454 
455   test_registry->StopAll();
456 
457   // Verify states after test
458   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_));
459   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_last_));
460   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_),
461             sizeof(SnoopLoggerCommon::FileHeaderType) +
462                     (sizeof(SnoopLogger::PacketHeaderType) + kInformationRequest.size()) * 1);
463   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_last_),
464             sizeof(SnoopLoggerCommon::FileHeaderType) +
465                     (sizeof(SnoopLogger::PacketHeaderType) + kInformationRequest.size()) * 10);
466 }
467 
TEST_F(SnoopLoggerModuleTest,qualcomm_debug_log_test)468 TEST_F(SnoopLoggerModuleTest, qualcomm_debug_log_test) {
469   auto* snoop_logger =
470           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
471                                     SnoopLogger::kBtSnoopLogModeDisabled, true, false);
472   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
473   snoop_logger->Capture(kQualcommConnectionRequest, SnoopLogger::Direction::OUTGOING,
474                         SnoopLogger::PacketType::ACL);
475   snoop_logger->DumpSnoozLogToFile();
476 
477   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
478   ASSERT_EQ(std::filesystem::file_size(temp_snooz_log_),
479             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
480                     kQualcommConnectionRequest.size());
481 
482   test_registry->StopAll();
483 
484   // Verify states after test
485   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
486   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
487   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
488 }
489 
TEST_F(SnoopLoggerModuleTest,qualcomm_debug_log_regression_test)490 TEST_F(SnoopLoggerModuleTest, qualcomm_debug_log_regression_test) {
491   {
492     auto* snoop_logger =
493             new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
494                                       SnoopLogger::kBtSnoopLogModeDisabled, true, false);
495     test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
496     snoop_logger->Capture(kHfpAtNrec0, SnoopLogger::Direction::OUTGOING,
497                           SnoopLogger::PacketType::ACL);
498     snoop_logger->DumpSnoozLogToFile();
499 
500     ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
501     ASSERT_EQ(
502             std::filesystem::file_size(temp_snooz_log_),
503             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) + 14);
504     test_registry->StopAll();
505   }
506 
507   // Verify states after test
508   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
509   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
510   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
511 
512   {
513     auto* snoop_logger =
514             new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
515                                       SnoopLogger::kBtSnoopLogModeDisabled, false, false);
516     test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
517     snoop_logger->Capture(kQualcommConnectionRequest, SnoopLogger::Direction::OUTGOING,
518                           SnoopLogger::PacketType::ACL);
519     snoop_logger->DumpSnoozLogToFile();
520 
521     ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
522     ASSERT_EQ(
523             std::filesystem::file_size(temp_snooz_log_),
524             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) + 14);
525     test_registry->StopAll();
526   }
527 
528   // Verify states after test
529   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_));
530   ASSERT_FALSE(std::filesystem::exists(temp_snoop_log_last_));
531   ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
532 }
533 
TEST_F(SnoopLoggerModuleTest,filter_tracker_test)534 TEST_F(SnoopLoggerModuleTest, filter_tracker_test) {
535   std::unordered_map<uint16_t, bluetooth::hal::FilterTracker> filter_list;
536   uint16_t handle = 1;
537   uint16_t local_cid = 0x40;
538   uint16_t remote_cid = 0x41;
539   uint8_t dlci = 0x02;
540 
541   filter_list[handle].AddL2capCid(local_cid, remote_cid);
542   ASSERT_TRUE(filter_list[handle].IsAcceptlistedL2cap(true, local_cid));
543   ASSERT_TRUE(filter_list[handle].IsAcceptlistedL2cap(false, remote_cid));
544 
545   filter_list[handle].RemoveL2capCid(local_cid, remote_cid);
546   ASSERT_FALSE(filter_list[handle].IsAcceptlistedL2cap(true, local_cid));
547   ASSERT_FALSE(filter_list[handle].IsAcceptlistedL2cap(false, remote_cid));
548 
549   filter_list[handle].AddRfcommDlci(dlci);
550   ASSERT_TRUE(filter_list[handle].IsAcceptlistedDlci(dlci));
551 
552   filter_list[handle].SetRfcommCid(local_cid, remote_cid);
553   ASSERT_TRUE(filter_list[handle].IsRfcommChannel(true, local_cid));
554   ASSERT_TRUE(filter_list[handle].IsRfcommChannel(false, remote_cid));
555 
556   filter_list[handle].RemoveL2capCid(local_cid, remote_cid);
557   ASSERT_FALSE(filter_list[handle].IsAcceptlistedL2cap(true, local_cid));
558   ASSERT_FALSE(filter_list[handle].IsAcceptlistedL2cap(false, remote_cid));
559   ASSERT_FALSE(filter_list[handle].IsAcceptlistedDlci(dlci));
560 }
561 
TEST_F(SnoopLoggerModuleTest,a2dp_packets_filtered_test)562 TEST_F(SnoopLoggerModuleTest, a2dp_packets_filtered_test) {
563   // Actual test
564   uint16_t conn_handle = 0x000b;
565   uint16_t local_cid = 0x0001;
566   uint16_t remote_cid = 0xa040;
567 
568   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileA2dpProperty,
569                                                "true"));
570   auto filter_a2dp_property =
571           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileA2dpProperty);
572   ASSERT_TRUE(filter_a2dp_property && filter_a2dp_property.value() == "true");
573 
574   auto* snoop_logger =
575           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
576                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
577 
578   TestModuleRegistry test_registry;
579   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
580 
581   // Simulate A2dp Media channel setup
582   snoop_logger->AddA2dpMediaChannel(conn_handle, local_cid, remote_cid);
583 
584   snoop_logger->Capture(kA2dpMediaPacket, SnoopLogger::Direction::OUTGOING,
585                         SnoopLogger::PacketType::ACL);
586 
587   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
588 
589   test_registry.StopAll();
590 
591   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileA2dpProperty,
592                                                "false"));
593 
594   // Verify states after test
595   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
596   // Should filter packet
597   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
598             sizeof(SnoopLoggerCommon::FileHeaderType));
599   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
600 }
601 
TEST_F(SnoopLoggerModuleTest,a2dp_packets_filtered_negative_test)602 TEST_F(SnoopLoggerModuleTest, a2dp_packets_filtered_negative_test) {
603   // Actual test
604   uint16_t conn_handle = 0x000b;
605   uint16_t local_cid = 0x0001;
606   uint16_t remote_cid = 0xa040;
607 
608   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileA2dpProperty,
609                                                "true"));
610   auto filter_a2dp_property =
611           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileA2dpProperty);
612   ASSERT_TRUE(filter_a2dp_property && filter_a2dp_property.value() == "true");
613 
614   auto* snoop_logger =
615           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
616                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
617 
618   TestModuleRegistry test_registry;
619   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
620 
621   // Simulate A2dp Media channel setup
622   snoop_logger->AddA2dpMediaChannel(conn_handle, local_cid, remote_cid);
623   snoop_logger->RemoveA2dpMediaChannel(conn_handle, local_cid);
624 
625   snoop_logger->Capture(kA2dpMediaPacket, SnoopLogger::Direction::OUTGOING,
626                         SnoopLogger::PacketType::ACL);
627 
628   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
629 
630   test_registry.StopAll();
631 
632   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileA2dpProperty,
633                                                "false"));
634 
635   // Verify states after test
636   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
637   // Should not filter
638   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
639             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
640                     kA2dpMediaPacket.size());
641   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
642 }
643 
TEST_F(SnoopLoggerModuleTest,headers_filtered_test)644 TEST_F(SnoopLoggerModuleTest, headers_filtered_test) {
645   ASSERT_TRUE(
646           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterHeadersProperty, "true"));
647   auto filter_headers_property =
648           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterHeadersProperty);
649   ASSERT_TRUE(filter_headers_property && filter_headers_property.value() == "true");
650 
651   auto* snoop_logger =
652           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
653                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
654 
655   TestModuleRegistry test_registry;
656   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
657 
658   std::vector<uint8_t> kAclPacket = {
659           0x0b, 0x20, 0x18, 0x00, 0x14, 0x00, 0x44, 0x00, 0x1b, 0x2f, 0x21, 0x41, 0x54, 0x2b,
660           0x43, 0x4d, 0x45, 0x52, 0x3d, 0x33, 0x2c, 0x30, 0x2c, 0x30, 0x2c, 0x31, 0x0d, 0x8f,
661   };
662 
663   snoop_logger->Capture(kAclPacket, SnoopLogger::Direction::INCOMING, SnoopLogger::PacketType::ACL);
664 
665   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
666 
667   test_registry.StopAll();
668 
669   ASSERT_TRUE(
670           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterHeadersProperty, "false"));
671 
672   // Verify states after test
673   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
674   log::info("const size: {}", (int)(sizeof(SnoopLoggerCommon::FileHeaderType) +
675                                     sizeof(SnoopLogger::PacketHeaderType)));
676 
677   // Packet should be filtered
678   const size_t file_size = (size_t)std::filesystem::file_size(temp_snoop_log_filtered);
679   const size_t expected_file_size = sizeof(SnoopLoggerCommon::FileHeaderType) +
680                                     sizeof(SnoopLogger::PacketHeaderType) +
681                                     TestSnoopLoggerModule::GetMaxFilteredSize();
682   ASSERT_EQ(file_size, expected_file_size);
683   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
684 }
685 
TEST_F(SnoopLoggerModuleTest,rfcomm_channel_filtered_sabme_ua_test)686 TEST_F(SnoopLoggerModuleTest, rfcomm_channel_filtered_sabme_ua_test) {
687   // Actual test
688   uint16_t conn_handle = 0x000b;
689   uint16_t local_cid = 0x0044;
690   uint16_t remote_cid = 0x3040;
691 
692   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
693                                                "true"));
694   auto filter_rfcomm_property =
695           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty);
696   ASSERT_TRUE(filter_rfcomm_property);
697   ASSERT_EQ("true", filter_rfcomm_property.value());
698 
699   auto* snoop_logger =
700           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
701                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
702 
703   TestModuleRegistry test_registry;
704   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
705 
706   // Simulate Rfcomm channel
707   snoop_logger->AddRfcommL2capChannel(conn_handle, local_cid, remote_cid);
708   std::vector<uint8_t> kRfcommSabme = {
709           0x0b, 0x20, 0x18, 0x00, 0x14, 0x00, 0x44, 0x00, 0x1b, 0x2f, 0x21, 0x41, 0x54, 0x2b,
710           0x43, 0x4d, 0x45, 0x52, 0x3d, 0x33, 0x2c, 0x30, 0x2c, 0x30, 0x2c, 0x31, 0x0d, 0x8f,
711   };
712   std::vector<uint8_t> kRfcommUa = {
713           0x0b, 0x20, 0x18, 0x00, 0x14, 0x00, 0x44, 0x00, 0x1b, 0x63, 0x21, 0x41, 0x54, 0x2b,
714           0x43, 0x4d, 0x45, 0x52, 0x3d, 0x33, 0x2c, 0x30, 0x2c, 0x30, 0x2c, 0x31, 0x0d, 0x8f,
715   };
716 
717   snoop_logger->Capture(kRfcommSabme, SnoopLogger::Direction::INCOMING,
718                         SnoopLogger::PacketType::ACL);
719   snoop_logger->Capture(kRfcommUa, SnoopLogger::Direction::INCOMING, SnoopLogger::PacketType::ACL);
720   snoop_logger->ClearL2capAcceptlist(conn_handle, local_cid, remote_cid);
721   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
722 
723   test_registry.StopAll();
724 
725   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
726                                                "false"));
727 
728   // Verify states after test
729   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
730 
731   // Packets should not be filtered because because they are SAMBE and UA events.
732   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
733             sizeof(SnoopLoggerCommon::FileHeaderType) + 2 * sizeof(SnoopLogger::PacketHeaderType) +
734                     kRfcommSabme.size() + kRfcommUa.size());
735   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
736 }
737 
TEST_F(SnoopLoggerModuleTest,rfcomm_channel_filtered_acceptlisted_dlci_test)738 TEST_F(SnoopLoggerModuleTest, rfcomm_channel_filtered_acceptlisted_dlci_test) {
739   // Actual test
740   uint16_t conn_handle = 0x000b;
741   uint16_t local_cid = 0x0041;
742   uint16_t remote_cid = 0x3040;
743   uint8_t dlci = 0x04;
744   uint8_t dlci_byte = dlci << 2;
745 
746   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
747                                                "true"));
748   auto filter_rfcomm_property =
749           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty);
750   ASSERT_TRUE(filter_rfcomm_property);
751   ASSERT_EQ("true", filter_rfcomm_property.value());
752 
753   auto* snoop_logger =
754           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
755                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
756 
757   TestModuleRegistry test_registry;
758   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
759 
760   // Simulate Rfcomm channel
761   snoop_logger->AddRfcommL2capChannel(conn_handle, local_cid, remote_cid);
762   snoop_logger->AcceptlistRfcommDlci(conn_handle, local_cid, dlci);
763 
764   std::vector<uint8_t> kRfcommDlci = {
765           0x0b, 0x20, 0x12, 0x00, 0x0e, 0x00, 0x41, 0x00, dlci_byte, 0xef, 0x15,
766           0x83, 0x11, 0x06, 0xf0, 0x07, 0x00, 0x9d, 0x02, 0x00,      0x07, 0x70,
767   };
768 
769   snoop_logger->Capture(kRfcommDlci, SnoopLogger::Direction::INCOMING,
770                         SnoopLogger::PacketType::ACL);
771   snoop_logger->ClearL2capAcceptlist(conn_handle, local_cid, remote_cid);
772   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
773 
774   test_registry.StopAll();
775 
776   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
777                                                "false"));
778 
779   // Verify states after test
780   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
781 
782   // Packet should not be filtered because DLCI acceptlisted
783   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
784             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
785                     kRfcommDlci.size());
786   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
787 }
788 
TEST_F(SnoopLoggerModuleTest,rfcomm_channel_filtered_not_acceptlisted_dlci_test)789 TEST_F(SnoopLoggerModuleTest, rfcomm_channel_filtered_not_acceptlisted_dlci_test) {
790   // Actual test
791   uint16_t conn_handle = 0x000b;
792   uint16_t local_cid = 0x0041;
793   uint16_t remote_cid = 0x3040;
794   uint8_t dlci = 0x04;
795   uint8_t dlci_byte = dlci << 2;
796 
797   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
798                                                "true"));
799   auto filter_rfcomm_property =
800           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty);
801   ASSERT_TRUE(filter_rfcomm_property);
802   ASSERT_EQ("true", filter_rfcomm_property.value());
803 
804   auto* snoop_logger =
805           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
806                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
807 
808   TestModuleRegistry test_registry;
809   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
810 
811   // Simulate Rfcomm channel
812   snoop_logger->AddRfcommL2capChannel(conn_handle, local_cid, remote_cid);
813 
814   std::vector<uint8_t> kRfcommDlci = {
815           0x0b, 0x20, 0x12, 0x00, 0x0e, 0x00, 0x41, 0x00, dlci_byte, 0xef, 0x15,
816           0x83, 0x11, 0x06, 0xf0, 0x07, 0x00, 0x9d, 0x02, 0x00,      0x07, 0x70,
817   };
818 
819   snoop_logger->Capture(kRfcommDlci, SnoopLogger::Direction::INCOMING,
820                         SnoopLogger::PacketType::ACL);
821   snoop_logger->ClearL2capAcceptlist(conn_handle, local_cid, remote_cid);
822 
823   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
824 
825   test_registry.StopAll();
826 
827   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
828                                                "false"));
829 
830   // Verify states after test
831   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
832 
833   // Packet should be filtered because DLCI not acceptlisted
834   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
835             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
836                     TestSnoopLoggerModule::GetL2capHeaderSize());
837   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
838 }
839 
TEST_F(SnoopLoggerModuleTest,rfcomm_channel_filtered_not_acceptlisted_l2cap_channel_test)840 TEST_F(SnoopLoggerModuleTest, rfcomm_channel_filtered_not_acceptlisted_l2cap_channel_test) {
841   // Actual test
842   uint16_t conn_handle = 0x000b;
843   uint16_t local_cid = 0x0041;
844   uint16_t remote_cid = 0x3040;
845 
846   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
847                                                "true"));
848   auto filter_rfcomm_property =
849           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty);
850   ASSERT_TRUE(filter_rfcomm_property);
851   ASSERT_EQ("true", filter_rfcomm_property.value());
852 
853   auto* snoop_logger =
854           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
855                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
856 
857   TestModuleRegistry test_registry;
858   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
859 
860   std::vector<uint8_t> kRfcommL2capChannel = {
861           0x0b, 0x20, 0x12, 0x00, 0x0e, 0x00, 0x41, 0x00, 0x00, 0xef, 0x15,
862           0x83, 0x11, 0x06, 0xf0, 0x07, 0x00, 0x9d, 0x02, 0x00, 0x07, 0x70,
863   };
864 
865   snoop_logger->Capture(kRfcommL2capChannel, SnoopLogger::Direction::INCOMING,
866                         SnoopLogger::PacketType::ACL);
867   snoop_logger->ClearL2capAcceptlist(conn_handle, local_cid, remote_cid);
868 
869   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
870 
871   test_registry.StopAll();
872 
873   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
874                                                "false"));
875 
876   // Verify states after test
877   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
878 
879   // Packet should be filtered because L2CAP channel not acceptlisted
880   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
881             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
882                     TestSnoopLoggerModule::GetL2capHeaderSize());
883   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
884 }
885 
TEST_F(SnoopLoggerModuleTest,rfcomm_channel_filtered_acceptlisted_l2cap_channel_test)886 TEST_F(SnoopLoggerModuleTest, rfcomm_channel_filtered_acceptlisted_l2cap_channel_test) {
887   // Actual test
888   uint16_t conn_handle = 0x000b;
889   uint16_t local_cid = 0x0041;
890   uint16_t remote_cid = 0x3040;
891 
892   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
893                                                "true"));
894   auto filter_rfcomm_property =
895           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty);
896   ASSERT_TRUE(filter_rfcomm_property);
897   ASSERT_EQ("true", filter_rfcomm_property.value());
898 
899   auto* snoop_logger =
900           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
901                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
902 
903   TestModuleRegistry test_registry;
904   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
905 
906   snoop_logger->AcceptlistL2capChannel(conn_handle, local_cid, remote_cid);
907 
908   std::vector<uint8_t> kRfcommL2capChannel = {
909           0x0b, 0x20, 0x12, 0x00, 0x0e, 0x00, 0x41, 0x00, 0x00, 0xef, 0x15,
910           0x83, 0x11, 0x06, 0xf0, 0x07, 0x00, 0x9d, 0x02, 0x00, 0x07, 0x70,
911   };
912 
913   snoop_logger->Capture(kRfcommL2capChannel, SnoopLogger::Direction::INCOMING,
914                         SnoopLogger::PacketType::ACL);
915   snoop_logger->ClearL2capAcceptlist(conn_handle, local_cid, remote_cid);
916 
917   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
918 
919   test_registry.StopAll();
920 
921   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileRfcommProperty,
922                                                "false"));
923 
924   // Verify states after test
925   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
926 
927   // Packet should not be filtered because L2CAP channel acceptlisted
928   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
929             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
930                     kRfcommL2capChannel.size());
931   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
932 }
933 
TEST_F(SnoopLoggerModuleTest,profiles_filtered_hfp_hf_test)934 TEST_F(SnoopLoggerModuleTest, profiles_filtered_hfp_hf_test) {
935   // Actual test
936   uint16_t conn_handle = 0x000b;
937   uint16_t local_cid = 0x0043;
938   uint16_t remote_cid = 0x3040;
939   uint8_t dlci = 0x06;
940   uint16_t psm = 0x0003;
941   uint16_t profile_uuid_hfp_hf = 0x111f;
942   bool flow = true;
943 
944   const std::string clcc_pattern = "\x0d\x0a+CLCC:";
945   const uint16_t HEADER_SIZE = 12;
946 
947   // Set pbap and map filtering modes
948   ASSERT_TRUE(
949           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
950                                            SnoopLogger::kBtSnoopLogFilterProfileModeMagic));
951   auto filterPbapModeProperty =
952           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty);
953   ASSERT_TRUE(filterPbapModeProperty &&
954               (filterPbapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeMagic) !=
955                std::string::npos));
956   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
957                                                SnoopLogger::kBtSnoopLogFilterProfileModeMagic));
958   auto filterMapModeProperty =
959           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty);
960   ASSERT_TRUE(filterMapModeProperty &&
961               (filterMapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeMagic) !=
962                std::string::npos));
963 
964   auto* snoop_logger =
965           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
966                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
967 
968   TestModuleRegistry test_registry;
969   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
970 
971   snoop_logger->SetL2capChannelOpen(conn_handle, local_cid, remote_cid, psm, false);
972   snoop_logger->SetRfcommPortOpen(conn_handle, local_cid, dlci, profile_uuid_hfp_hf, flow);
973 
974   std::vector<uint8_t> kPhoneNumber = {
975           0x0b, 0x00, 0x30, 0x00, 0x2c, 0x00, 0x40, 0x30, 0x19, 0xff, 0x4f, 0x01, 0x0d,
976           0x0a, 0x2b, 0x43, 0x4c, 0x43, 0x43, 0x3a, 0x20, 0x31, 0x2c, 0x31, 0x2c, 0x34,
977           0x2c, 0x30, 0x2c, 0x30, 0x2c, 0x22, 0x2b, 0x39, 0x39, 0x31, 0x32, 0x33, 0x34,
978           0x35, 0x36, 0x37, 0x38, 0x39, 0x22, 0x2c, 0x31, 0x34, 0x35, 0x0d, 0x0a, 0x49,
979   };
980 
981   snoop_logger->Capture(kPhoneNumber, SnoopLogger::Direction::OUTGOING,
982                         SnoopLogger::PacketType::ACL);
983   snoop_logger->SetL2capChannelClose(conn_handle, local_cid, remote_cid);
984   snoop_logger->SetRfcommPortClose(conn_handle, local_cid, dlci, profile_uuid_hfp_hf);
985 
986   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
987 
988   test_registry.StopAll();
989 
990   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
991                                                SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
992   ASSERT_TRUE(
993           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
994                                            SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
995 
996   // Verify states after test
997   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
998 
999   // Packet should be filtered
1000   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
1001             sizeof(SnoopLoggerCommon::FileHeaderType) + sizeof(SnoopLogger::PacketHeaderType) +
1002                     HEADER_SIZE + strlen(clcc_pattern.c_str()));
1003   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
1004 }
1005 
TEST_F(SnoopLoggerModuleTest,profiles_filtered_pbap_magic_test)1006 TEST_F(SnoopLoggerModuleTest, profiles_filtered_pbap_magic_test) {
1007   // Actual test
1008   constexpr uint16_t PROFILE_PSM_PBAP = 0x1025;
1009   constexpr uint16_t PROFILE_UUID_PBAP = 0x112f;
1010   uint16_t conn_handle = 0x0002;
1011   uint16_t local_cid = 0x0041;
1012   uint16_t remote_cid = 0x0040;
1013   uint8_t dlci = 0x27;
1014   uint16_t psm = PROFILE_PSM_PBAP;
1015   uint16_t profile_uuid_pbap = PROFILE_UUID_PBAP;
1016   bool flow = true;
1017   const std::string magic_string = "PROHIBITED";
1018   const uint16_t HEADER_SIZE = 8;
1019 
1020   // Set pbap and map filtering modes
1021   ASSERT_TRUE(
1022           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1023                                            SnoopLogger::kBtSnoopLogFilterProfileModeMagic));
1024   auto filterPbapModeProperty =
1025           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty);
1026   ASSERT_TRUE(filterPbapModeProperty &&
1027               (filterPbapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeMagic) !=
1028                std::string::npos));
1029   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1030                                                SnoopLogger::kBtSnoopLogFilterProfileModeMagic));
1031   auto filterMapModeProperty =
1032           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty);
1033   ASSERT_TRUE(filterMapModeProperty &&
1034               (filterMapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeMagic) !=
1035                std::string::npos));
1036 
1037   auto* snoop_logger =
1038           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 15,
1039                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
1040 
1041   TestModuleRegistry test_registry;
1042   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1043 
1044   snoop_logger->SetL2capChannelOpen(conn_handle, local_cid, remote_cid, psm, false);
1045   snoop_logger->SetRfcommPortOpen(conn_handle, local_cid, dlci, profile_uuid_pbap, flow);
1046 
1047   for (int i = 0; i < (int)kTestData.size(); i++) {
1048     snoop_logger->Capture(kTestData[i], (SnoopLogger::Direction)(i % 2),
1049                           SnoopLogger::PacketType::ACL);
1050   }
1051 
1052   snoop_logger->SetL2capChannelClose(conn_handle, local_cid, remote_cid);
1053   snoop_logger->SetRfcommPortClose(conn_handle, local_cid, dlci, profile_uuid_pbap);
1054 
1055   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
1056 
1057   test_registry.StopAll();
1058 
1059   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1060                                                SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1061   ASSERT_TRUE(
1062           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1063                                            SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1064 
1065   // Verify states after test
1066   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
1067 
1068   // Packets should be filtered
1069   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
1070             sizeof(SnoopLoggerCommon::FileHeaderType) +
1071                     (int)kTestData.size() * (sizeof(SnoopLogger::PacketHeaderType) + HEADER_SIZE +
1072                                              strlen(magic_string.c_str())));
1073 
1074   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
1075 }
1076 
TEST_F(SnoopLoggerModuleTest,profiles_filtered_pbap_header_test)1077 TEST_F(SnoopLoggerModuleTest, profiles_filtered_pbap_header_test) {
1078   // Actual test
1079   constexpr uint16_t PROFILE_PSM_PBAP = 0x1025;
1080   constexpr uint16_t PROFILE_UUID_PBAP = 0x112f;
1081   uint16_t conn_handle = 0x0002;
1082   uint16_t local_cid = 0x0041;
1083   uint16_t remote_cid = 0x0040;
1084   uint8_t dlci = 0x27;
1085   uint16_t psm = PROFILE_PSM_PBAP;
1086   uint16_t profile_uuid_pbap = PROFILE_UUID_PBAP;
1087   bool flow = true;
1088   const uint16_t HEADER_SIZE = 8;
1089 
1090   // Set pbap and map filtering modes
1091   ASSERT_TRUE(
1092           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1093                                            SnoopLogger::kBtSnoopLogFilterProfileModeHeader));
1094   auto filterPbapModeProperty =
1095           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty);
1096   ASSERT_TRUE(filterPbapModeProperty &&
1097               (filterPbapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeHeader) !=
1098                std::string::npos));
1099   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1100                                                SnoopLogger::kBtSnoopLogFilterProfileModeHeader));
1101   auto filterMapModeProperty =
1102           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty);
1103   ASSERT_TRUE(filterMapModeProperty &&
1104               (filterMapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeHeader) !=
1105                std::string::npos));
1106 
1107   auto* snoop_logger =
1108           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 15,
1109                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
1110 
1111   TestModuleRegistry test_registry;
1112   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1113 
1114   snoop_logger->SetL2capChannelOpen(conn_handle, local_cid, remote_cid, psm, false);
1115   snoop_logger->SetRfcommPortOpen(conn_handle, local_cid, dlci, profile_uuid_pbap, flow);
1116 
1117   for (int i = 0; i < (int)kTestData.size(); i++) {
1118     snoop_logger->Capture(kTestData[i], (SnoopLogger::Direction)(i % 2),
1119                           SnoopLogger::PacketType::ACL);
1120   }
1121 
1122   snoop_logger->SetL2capChannelClose(conn_handle, local_cid, remote_cid);
1123   snoop_logger->SetRfcommPortClose(conn_handle, local_cid, dlci, profile_uuid_pbap);
1124 
1125   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
1126 
1127   test_registry.StopAll();
1128 
1129   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1130                                                SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1131   ASSERT_TRUE(
1132           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1133                                            SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1134 
1135   // Verify states after test
1136   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
1137 
1138   // Packets should be filtered
1139   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
1140             sizeof(SnoopLoggerCommon::FileHeaderType) +
1141                     (int)kTestData.size() * (sizeof(SnoopLogger::PacketHeaderType) + HEADER_SIZE));
1142 
1143   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
1144 }
1145 
TEST_F(SnoopLoggerModuleTest,profiles_filtered_pbap_fullfilter_test)1146 TEST_F(SnoopLoggerModuleTest, profiles_filtered_pbap_fullfilter_test) {
1147   // Actual test
1148   constexpr uint16_t PROFILE_PSM_PBAP = 0x1025;
1149   constexpr uint16_t PROFILE_UUID_PBAP = 0x112f;
1150   uint16_t conn_handle = 0x0002;
1151   uint16_t local_cid = 0x0041;
1152   uint16_t remote_cid = 0x0040;
1153   uint8_t dlci = 0x27;
1154   uint16_t psm = PROFILE_PSM_PBAP;
1155   uint16_t profile_uuid_pbap = PROFILE_UUID_PBAP;
1156   bool flow = true;
1157 
1158   // Set pbap and map filtering modes
1159   ASSERT_TRUE(
1160           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1161                                            SnoopLogger::kBtSnoopLogFilterProfileModeFullfillter));
1162   auto filterPbapModeProperty =
1163           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty);
1164   ASSERT_TRUE(filterPbapModeProperty &&
1165               (filterPbapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeFullfillter) !=
1166                std::string::npos));
1167   ASSERT_TRUE(
1168           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1169                                            SnoopLogger::kBtSnoopLogFilterProfileModeFullfillter));
1170   auto filterMapModeProperty =
1171           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty);
1172   ASSERT_TRUE(filterMapModeProperty &&
1173               (filterMapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeFullfillter) !=
1174                std::string::npos));
1175 
1176   auto* snoop_logger =
1177           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 15,
1178                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
1179 
1180   TestModuleRegistry test_registry;
1181   test_registry.InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1182 
1183   snoop_logger->SetL2capChannelOpen(conn_handle, local_cid, remote_cid, psm, false);
1184   snoop_logger->SetRfcommPortOpen(conn_handle, local_cid, dlci, profile_uuid_pbap, flow);
1185 
1186   for (int i = 0; i < (int)kTestData.size(); i++) {
1187     snoop_logger->Capture(kTestData[i], (SnoopLogger::Direction)(i % 2),
1188                           SnoopLogger::PacketType::ACL);
1189   }
1190 
1191   snoop_logger->SetL2capChannelClose(conn_handle, local_cid, remote_cid);
1192   snoop_logger->SetRfcommPortClose(conn_handle, local_cid, dlci, profile_uuid_pbap);
1193 
1194   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
1195 
1196   test_registry.StopAll();
1197 
1198   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1199                                                SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1200   ASSERT_TRUE(
1201           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1202                                            SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1203 
1204   // Verify states after test
1205   ASSERT_TRUE(std::filesystem::exists(temp_snoop_log_filtered));
1206 
1207   // Packets should be filtered
1208   ASSERT_EQ(std::filesystem::file_size(temp_snoop_log_filtered),
1209             sizeof(SnoopLoggerCommon::FileHeaderType));
1210 
1211   ASSERT_TRUE(std::filesystem::remove(temp_snoop_log_filtered));
1212 }
1213 
1214 static constexpr int INVALID_FD = -1;
1215 
TEST_F(SnoopLoggerModuleTest,socket_disabled_connect_fail_test)1216 TEST_F(SnoopLoggerModuleTest, socket_disabled_connect_fail_test) {
1217   auto* snoop_logger =
1218           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
1219                                     SnoopLogger::kBtSnoopLogModeDisabled, true, false);
1220   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1221 
1222   // // Create a TCP socket file descriptor
1223   int socket_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP);
1224   ASSERT_TRUE(socket_fd != INVALID_FD);
1225 
1226   struct sockaddr_in addr;
1227   addr.sin_family = AF_INET;
1228   addr.sin_addr.s_addr = htonl(SnoopLoggerSocket::DEFAULT_LOCALHOST_);
1229   addr.sin_port = htons(SnoopLoggerSocket::DEFAULT_LISTEN_PORT_);
1230 
1231   int ret;
1232 
1233   // Connect to snoop logger socket
1234   RUN_NO_INTR(ret = connect(socket_fd, (struct sockaddr*)&addr, sizeof(addr)));
1235   ASSERT_NE(0, ret);
1236 
1237   test_registry->StopAll();
1238   close(socket_fd);
1239 }
1240 
TEST_F(SnoopLoggerModuleTest,default_socket_enabled_capture_recv_test)1241 TEST_F(SnoopLoggerModuleTest, default_socket_enabled_capture_recv_test) {
1242   int ret;
1243   auto* snoop_logger = new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(),
1244                                                  10, SnoopLogger::kBtSnoopLogModeFull, true, false);
1245   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1246 
1247   // // Create a TCP socket file descriptor
1248   int socket_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP);
1249   ASSERT_TRUE(socket_fd != INVALID_FD);
1250 
1251   struct sockaddr_in addr;
1252   addr.sin_family = AF_INET;
1253   addr.sin_addr.s_addr = htonl(SnoopLoggerSocket::DEFAULT_LOCALHOST_);
1254   addr.sin_port = htons(SnoopLoggerSocket::DEFAULT_LISTEN_PORT_);
1255 
1256   // Connect to snoop logger socket
1257   RUN_NO_INTR(ret = connect(socket_fd, (struct sockaddr*)&addr, sizeof(addr)));
1258   ASSERT_EQ(0, ret);
1259 
1260   char recv_buf1[sizeof(SnoopLoggerCommon::FileHeaderType)];
1261   char recv_buf2[sizeof(SnoopLogger::PacketHeaderType)];
1262   char recv_buf3[99];
1263   int bytes_read = -1;
1264 
1265   auto a = std::async(std::launch::async, [&] {
1266     recv(socket_fd, recv_buf1, sizeof(recv_buf1), 0);
1267     recv(socket_fd, recv_buf2, sizeof(recv_buf2), 0);
1268     return recv(socket_fd, recv_buf3, sizeof(recv_buf3), 0);
1269   });
1270 
1271   snoop_logger->GetSocketThread()->GetSocket()->WaitForClientSocketConnected();
1272 
1273   snoop_logger->Capture(kHfpAtNrec0, SnoopLogger::Direction::OUTGOING,
1274                         SnoopLogger::PacketType::ACL);
1275 
1276   a.wait();
1277   bytes_read = a.get();
1278 
1279   ASSERT_EQ(0, std::memcmp(recv_buf1, &SnoopLoggerCommon::kBtSnoopFileHeader, sizeof(recv_buf1)));
1280   ASSERT_EQ(bytes_read, static_cast<int>(kHfpAtNrec0.size()));
1281   ASSERT_EQ(0, std::memcmp(recv_buf3, kHfpAtNrec0.data(), kHfpAtNrec0.size()));
1282 
1283   test_registry->StopAll();
1284   close(socket_fd);
1285 }
1286 
TEST_F(SnoopLoggerModuleTest,custom_socket_register_enabled_capture_recv_test)1287 TEST_F(SnoopLoggerModuleTest, custom_socket_register_enabled_capture_recv_test) {
1288   auto* snoop_logger = new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(),
1289                                                  10, SnoopLogger::kBtSnoopLogModeFull, true, false);
1290   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1291 
1292   int new_port = 8873;
1293   SyscallWrapperImpl syscall_if;
1294   auto sls = std::make_unique<SnoopLoggerSocket>(&syscall_if, SnoopLoggerSocket::DEFAULT_LOCALHOST_,
1295                                                  new_port);
1296   SnoopLoggerSocketThread slsThread(std::move(sls));
1297   auto thread_start_future = slsThread.Start();
1298   thread_start_future.wait();
1299   ASSERT_TRUE(thread_start_future.get());
1300 
1301   snoop_logger->RegisterSocket(&slsThread);
1302 
1303   // // Create a TCP socket file descriptor
1304   int socket_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP);
1305   ASSERT_TRUE(socket_fd != INVALID_FD);
1306 
1307   struct sockaddr_in addr;
1308   addr.sin_family = AF_INET;
1309   addr.sin_addr.s_addr = htonl(SnoopLoggerSocket::DEFAULT_LOCALHOST_);
1310   addr.sin_port = htons(new_port);
1311 
1312   int ret = 0;
1313   // Connect to snoop logger socket
1314   RUN_NO_INTR(ret = connect(socket_fd, (struct sockaddr*)&addr, sizeof(addr)));
1315   ASSERT_EQ(0, ret);
1316 
1317   char recv_buf1[sizeof(SnoopLoggerCommon::FileHeaderType)];
1318   char recv_buf2[sizeof(SnoopLogger::PacketHeaderType)];
1319   char recv_buf3[99];
1320   int bytes_read = -1;
1321 
1322   auto a = std::async(std::launch::async, [socket_fd, &recv_buf1, &recv_buf2, &recv_buf3] {
1323     recv(socket_fd, recv_buf1, sizeof(recv_buf1), 0);
1324     recv(socket_fd, recv_buf2, sizeof(recv_buf2), 0);
1325     return recv(socket_fd, recv_buf3, sizeof(recv_buf3), 0);
1326   });
1327 
1328   slsThread.GetSocket()->WaitForClientSocketConnected();
1329 
1330   snoop_logger->Capture(kHfpAtNrec0, SnoopLogger::Direction::OUTGOING,
1331                         SnoopLogger::PacketType::ACL);
1332 
1333   a.wait();
1334   bytes_read = a.get();
1335 
1336   ASSERT_EQ(0, std::memcmp(recv_buf1, &SnoopLoggerCommon::kBtSnoopFileHeader, sizeof(recv_buf1)));
1337   ASSERT_EQ(bytes_read, static_cast<int>(kHfpAtNrec0.size()));
1338   ASSERT_EQ(0, std::memcmp(recv_buf3, kHfpAtNrec0.data(), kHfpAtNrec0.size()));
1339 
1340   test_registry->StopAll();
1341   close(socket_fd);
1342 }
1343 
TEST_F(SnoopLoggerModuleTest,custom_socket_interface_register_logging_disabled_test)1344 TEST_F(SnoopLoggerModuleTest, custom_socket_interface_register_logging_disabled_test) {
1345   auto* snoop_logger =
1346           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
1347                                     SnoopLogger::kBtSnoopLogModeDisabled, true, false);
1348   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1349 
1350   class SnoopLoggerSocketMock : public SnoopLoggerSocketInterface {
1351   public:
1352     bool write_called;
1353     SnoopLoggerSocketMock() { write_called = false; }
1354     virtual void Write(const void* /* data */, size_t /* length */) { write_called = true; }
1355   };
1356 
1357   SnoopLoggerSocketMock mock;
1358 
1359   snoop_logger->RegisterSocket(&mock);
1360   snoop_logger->Capture(kQualcommConnectionRequest, SnoopLogger::Direction::OUTGOING,
1361                         SnoopLogger::PacketType::ACL);
1362 
1363   ASSERT_FALSE(mock.write_called);
1364 
1365   test_registry->StopAll();
1366 }
1367 
TEST_F(SnoopLoggerModuleTest,custom_socket_interface_register_logging_enabled_test)1368 TEST_F(SnoopLoggerModuleTest, custom_socket_interface_register_logging_enabled_test) {
1369   auto* snoop_logger = new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(),
1370                                                  10, SnoopLogger::kBtSnoopLogModeFull, true, false);
1371   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1372 
1373   class SnoopLoggerSocketMock : public SnoopLoggerSocketInterface {
1374   public:
1375     bool write_called;
1376     SnoopLoggerSocketMock() { write_called = false; }
1377     virtual void Write(const void* /* data */, size_t /* length */) { write_called = true; }
1378   };
1379 
1380   SnoopLoggerSocketMock mock;
1381 
1382   snoop_logger->RegisterSocket(&mock);
1383   snoop_logger->Capture(kQualcommConnectionRequest, SnoopLogger::Direction::OUTGOING,
1384                         SnoopLogger::PacketType::ACL);
1385 
1386   ASSERT_TRUE(mock.write_called);
1387 
1388   test_registry->StopAll();
1389 }
1390 
TEST_F(SnoopLoggerModuleTest,custom_socket_profiles_filtered_hfp_hf_test)1391 TEST_F(SnoopLoggerModuleTest, custom_socket_profiles_filtered_hfp_hf_test) {
1392   uint16_t conn_handle = 0x000b;
1393   uint16_t local_cid = 0x0043;
1394   uint16_t remote_cid = 0x3040;
1395   uint8_t dlci = 0x06;
1396   uint16_t psm = 0x0003;
1397   uint16_t profile_uuid_hfp_hf = 0x111f;
1398   bool flow = true;
1399   const std::string clcc_pattern = "\x0d\x0a+CLCC:";
1400   const uint16_t HEADER_SIZE = 12;
1401   size_t expected_data_size = HEADER_SIZE + strlen(clcc_pattern.c_str());
1402   std::vector<uint8_t> kPhoneNumber = {
1403           0x0b, 0x00, 0x30, 0x00, 0x2c, 0x00, 0x40, 0x30, 0x19, 0xff, 0x4f, 0x01, 0x0d,
1404           0x0a, 0x2b, 0x43, 0x4c, 0x43, 0x43, 0x3a, 0x20, 0x31, 0x2c, 0x31, 0x2c, 0x34,
1405           0x2c, 0x30, 0x2c, 0x30, 0x2c, 0x22, 0x2b, 0x39, 0x39, 0x31, 0x32, 0x33, 0x34,
1406           0x35, 0x36, 0x37, 0x38, 0x39, 0x22, 0x2c, 0x31, 0x34, 0x35, 0x0d, 0x0a, 0x49,
1407   };
1408 
1409   std::vector<uint8_t> kExpectedPhoneNumber = {
1410           0x0b, 0x00, 0x30, 0x00, 0x0c, 0x00, 0x40, 0x30, 0x19, 0xff, 0x4f, 0x01, 0x0d,
1411           0x0a, 0x2b, 0x43, 0x4c, 0x43, 0x43, 0x3a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1412           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1413           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1414   };
1415 
1416   // Set pbap and map filtering modes
1417   ASSERT_TRUE(
1418           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1419                                            SnoopLogger::kBtSnoopLogFilterProfileModeMagic));
1420   auto filterPbapModeProperty =
1421           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty);
1422   ASSERT_TRUE(filterPbapModeProperty &&
1423               (filterPbapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeMagic) !=
1424                std::string::npos));
1425   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1426                                                SnoopLogger::kBtSnoopLogFilterProfileModeMagic));
1427   auto filterMapModeProperty =
1428           bluetooth::os::GetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty);
1429   ASSERT_TRUE(filterMapModeProperty &&
1430               (filterMapModeProperty->find(SnoopLogger::kBtSnoopLogFilterProfileModeMagic) !=
1431                std::string::npos));
1432 
1433   auto* snoop_logger =
1434           new TestSnoopLoggerModule(temp_snoop_log_.string(), temp_snooz_log_.string(), 10,
1435                                     SnoopLogger::kBtSnoopLogModeFiltered, false, false);
1436 
1437   test_registry->InjectTestModule(&SnoopLogger::Factory, snoop_logger);
1438 
1439   int new_port = 8873;
1440   SyscallWrapperImpl syscall_if;
1441   auto sls = std::make_unique<SnoopLoggerSocket>(&syscall_if, SnoopLoggerSocket::DEFAULT_LOCALHOST_,
1442                                                  new_port);
1443   SnoopLoggerSocketThread slsThread(std::move(sls));
1444   auto thread_start_future = slsThread.Start();
1445   thread_start_future.wait();
1446   ASSERT_TRUE(thread_start_future.get());
1447 
1448   snoop_logger->RegisterSocket(&slsThread);
1449 
1450   snoop_logger->SetL2capChannelOpen(conn_handle, local_cid, remote_cid, psm, false);
1451   snoop_logger->SetRfcommPortOpen(conn_handle, local_cid, dlci, profile_uuid_hfp_hf, flow);
1452 
1453   // // Create a TCP socket file descriptor
1454   int socket_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP);
1455   ASSERT_TRUE(socket_fd != INVALID_FD);
1456 
1457   struct sockaddr_in addr;
1458   addr.sin_family = AF_INET;
1459   addr.sin_addr.s_addr = htonl(SnoopLoggerSocket::DEFAULT_LOCALHOST_);
1460   addr.sin_port = htons(new_port);
1461 
1462   int ret = 0;
1463   // Connect to snoop logger socket
1464   RUN_NO_INTR(ret = connect(socket_fd, (struct sockaddr*)&addr, sizeof(addr)));
1465   ASSERT_EQ(0, ret);
1466 
1467   char recv_buf1[sizeof(SnoopLoggerCommon::FileHeaderType)];
1468   char recv_buf2[sizeof(SnoopLogger::PacketHeaderType)];
1469   char recv_buf3[kPhoneNumber.size()];
1470   int bytes_read = -1;
1471 
1472   auto a = std::async(std::launch::async, [socket_fd, &recv_buf1, &recv_buf2, &recv_buf3] {
1473     recv(socket_fd, recv_buf1, sizeof(recv_buf1), 0);
1474     recv(socket_fd, recv_buf2, sizeof(recv_buf2), 0);
1475     return recv(socket_fd, recv_buf3, sizeof(recv_buf3), 0);
1476   });
1477 
1478   slsThread.GetSocket()->WaitForClientSocketConnected();
1479 
1480   snoop_logger->Capture(kPhoneNumber, SnoopLogger::Direction::OUTGOING,
1481                         SnoopLogger::PacketType::ACL);
1482   snoop_logger->SetL2capChannelClose(conn_handle, local_cid, remote_cid);
1483   snoop_logger->SetRfcommPortClose(conn_handle, local_cid, dlci, profile_uuid_hfp_hf);
1484 
1485   a.wait();
1486   bytes_read = a.get();
1487 
1488   ASSERT_EQ(0, std::memcmp(recv_buf1, &SnoopLoggerCommon::kBtSnoopFileHeader, sizeof(recv_buf1)));
1489   ASSERT_EQ(bytes_read, static_cast<int>(expected_data_size));
1490   ASSERT_EQ(0, std::memcmp(recv_buf3, kExpectedPhoneNumber.data(), expected_data_size));
1491 
1492   ASSERT_TRUE(bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfileMapModeProperty,
1493                                                SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1494   ASSERT_TRUE(
1495           bluetooth::os::SetSystemProperty(SnoopLogger::kBtSnoopLogFilterProfilePbapModeProperty,
1496                                            SnoopLogger::kBtSnoopLogFilterProfileModeDisabled));
1497 
1498   test_registry->StopAll();
1499   close(socket_fd);
1500 }
1501 }  // namespace testing
1502