1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <gtest/gtest.h>
16 #include <stdio.h>
17
18 #include "matchers/matcher_util.h"
19 #include "src/statsd_config.pb.h"
20 #include "stats_annotations.h"
21 #include "stats_event.h"
22 #include "stats_log_util.h"
23 #include "stats_util.h"
24 #include "statsd_test_util.h"
25
26 using namespace android::os::statsd;
27 using std::shared_ptr;
28 using std::unordered_map;
29 using std::vector;
30
31 const int32_t TAG_ID = 123;
32 const int32_t TAG_ID_2 = 28; // hardcoded tag of atom with uid field
33 const int FIELD_ID_1 = 1;
34 const int FIELD_ID_2 = 2;
35 const int FIELD_ID_3 = 3;
36
37 const int ATTRIBUTION_UID_FIELD_ID = 1;
38 const int ATTRIBUTION_TAG_FIELD_ID = 2;
39
40
41 #ifdef __ANDROID__
42
43 namespace {
44
makeIntLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const int32_t value)45 void makeIntLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
46 const int32_t value) {
47 AStatsEvent* statsEvent = AStatsEvent_obtain();
48 AStatsEvent_setAtomId(statsEvent, atomId);
49 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
50 AStatsEvent_writeInt32(statsEvent, value);
51
52 parseStatsEventToLogEvent(statsEvent, logEvent);
53 }
54
makeFloatLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const float floatValue)55 void makeFloatLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
56 const float floatValue) {
57 AStatsEvent* statsEvent = AStatsEvent_obtain();
58 AStatsEvent_setAtomId(statsEvent, atomId);
59 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
60 AStatsEvent_writeFloat(statsEvent, floatValue);
61
62 parseStatsEventToLogEvent(statsEvent, logEvent);
63 }
64
makeStringLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const string & name)65 void makeStringLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
66 const string& name) {
67 AStatsEvent* statsEvent = AStatsEvent_obtain();
68 AStatsEvent_setAtomId(statsEvent, atomId);
69 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
70 AStatsEvent_writeString(statsEvent, name.c_str());
71
72 parseStatsEventToLogEvent(statsEvent, logEvent);
73 }
74
makeIntWithBoolAnnotationLogEvent(LogEvent * logEvent,const int32_t atomId,const int32_t field,const uint8_t annotationId,const bool annotationValue)75 void makeIntWithBoolAnnotationLogEvent(LogEvent* logEvent, const int32_t atomId,
76 const int32_t field, const uint8_t annotationId,
77 const bool annotationValue) {
78 AStatsEvent* statsEvent = AStatsEvent_obtain();
79 AStatsEvent_setAtomId(statsEvent, atomId);
80 AStatsEvent_writeInt32(statsEvent, field);
81 AStatsEvent_addBoolAnnotation(statsEvent, annotationId, annotationValue);
82
83 parseStatsEventToLogEvent(statsEvent, logEvent);
84 }
85
makeAttributionLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const vector<int> & attributionUids,const vector<string> & attributionTags,const string & name)86 void makeAttributionLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
87 const vector<int>& attributionUids,
88 const vector<string>& attributionTags, const string& name) {
89 AStatsEvent* statsEvent = AStatsEvent_obtain();
90 AStatsEvent_setAtomId(statsEvent, atomId);
91 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
92
93 writeAttribution(statsEvent, attributionUids, attributionTags);
94 AStatsEvent_writeString(statsEvent, name.c_str());
95
96 parseStatsEventToLogEvent(statsEvent, logEvent);
97 }
98
makeBoolLogEvent(LogEvent * logEvent,const int32_t atomId,const int64_t timestamp,const bool bool1,const bool bool2)99 void makeBoolLogEvent(LogEvent* logEvent, const int32_t atomId, const int64_t timestamp,
100 const bool bool1, const bool bool2) {
101 AStatsEvent* statsEvent = AStatsEvent_obtain();
102 AStatsEvent_setAtomId(statsEvent, atomId);
103 AStatsEvent_overwriteTimestamp(statsEvent, timestamp);
104
105 AStatsEvent_writeBool(statsEvent, bool1);
106 AStatsEvent_writeBool(statsEvent, bool2);
107
108 parseStatsEventToLogEvent(statsEvent, logEvent);
109 }
110
makeRepeatedIntLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<int> & intArray)111 void makeRepeatedIntLogEvent(LogEvent* logEvent, const int32_t atomId, const vector<int>& intArray)
112 __INTRODUCED_IN(__ANDROID_API_T__) {
113 AStatsEvent* statsEvent = AStatsEvent_obtain();
114 AStatsEvent_setAtomId(statsEvent, atomId);
115 AStatsEvent_writeInt32Array(statsEvent, intArray.data(), intArray.size());
116 parseStatsEventToLogEvent(statsEvent, logEvent);
117 }
118
makeRepeatedUidLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<int> & intArray)119 void makeRepeatedUidLogEvent(LogEvent* logEvent, const int32_t atomId, const vector<int>& intArray)
120 __INTRODUCED_IN(__ANDROID_API_T__) {
121 AStatsEvent* statsEvent = AStatsEvent_obtain();
122 AStatsEvent_setAtomId(statsEvent, atomId);
123 AStatsEvent_writeInt32Array(statsEvent, intArray.data(), intArray.size());
124 AStatsEvent_addBoolAnnotation(statsEvent, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
125 parseStatsEventToLogEvent(statsEvent, logEvent);
126 }
127
makeRepeatedStringLogEvent(LogEvent * logEvent,const int32_t atomId,const vector<string> & stringArray)128 void makeRepeatedStringLogEvent(LogEvent* logEvent, const int32_t atomId,
129 const vector<string>& stringArray)
130 __INTRODUCED_IN(__ANDROID_API_T__) {
131 vector<const char*> cStringArray(stringArray.size());
132 for (int i = 0; i < cStringArray.size(); i++) {
133 cStringArray[i] = stringArray[i].c_str();
134 }
135
136 AStatsEvent* statsEvent = AStatsEvent_obtain();
137 AStatsEvent_setAtomId(statsEvent, atomId);
138 AStatsEvent_writeStringArray(statsEvent, cStringArray.data(), stringArray.size());
139 parseStatsEventToLogEvent(statsEvent, logEvent);
140 }
141
142 } // anonymous namespace
143
TEST(AtomMatcherTest,TestSimpleMatcher)144 TEST(AtomMatcherTest, TestSimpleMatcher) {
145 sp<UidMap> uidMap = new UidMap();
146
147 // Set up the matcher
148 AtomMatcher matcher;
149 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
150 simpleMatcher->set_atom_id(TAG_ID);
151
152 LogEvent event(/*uid=*/0, /*pid=*/0);
153 makeIntLogEvent(&event, TAG_ID, 0, 11);
154
155 // Test
156 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
157
158 // Wrong tag id.
159 simpleMatcher->set_atom_id(TAG_ID + 1);
160 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
161 }
162
TEST(AtomMatcherTest,TestAttributionMatcher)163 TEST(AtomMatcherTest, TestAttributionMatcher) {
164 sp<UidMap> uidMap = new UidMap();
165 std::vector<int> attributionUids = {1111, 2222, 3333};
166 std::vector<string> attributionTags = {"location1", "location2", "location3"};
167
168 // Set up the log event.
169 LogEvent event(/*uid=*/0, /*pid=*/0);
170 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
171
172 // Set up the matcher
173 AtomMatcher matcher;
174 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
175 simpleMatcher->set_atom_id(TAG_ID);
176
177 // Match first node.
178 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
179 attributionMatcher->set_field(FIELD_ID_1);
180 attributionMatcher->set_position(Position::FIRST);
181 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
182 ATTRIBUTION_TAG_FIELD_ID);
183 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
184 "tag");
185
186 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
187 fieldMatcher->set_field(FIELD_ID_2);
188 fieldMatcher->set_eq_string("some value");
189
190 // Tag not matched.
191 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
192 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
193 "location3");
194 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
195 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
196 "location1");
197 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
198
199 // Match last node.
200 attributionMatcher->set_position(Position::LAST);
201 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
202 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
203 "location3");
204 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
205
206 // Match any node.
207 attributionMatcher->set_position(Position::ANY);
208 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
209 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
210 "location1");
211 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
212 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
213 "location2");
214 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
215 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
216 "location3");
217 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
218 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
219 "location4");
220 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
221
222 // Attribution match but primitive field not match.
223 attributionMatcher->set_position(Position::ANY);
224 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
225 "location2");
226 fieldMatcher->set_eq_string("wrong value");
227 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
228
229 fieldMatcher->set_eq_string("some value");
230
231 // Uid match.
232 attributionMatcher->set_position(Position::ANY);
233 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
234 ATTRIBUTION_UID_FIELD_ID);
235 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
236 "pkg0");
237 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
238
239 UidData uidData;
240 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg0");
241 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg1");
242 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 2222, /*version*/ 2, "v2", "pkg1");
243 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 1, "v1", "Pkg2");
244 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 2, "v2", "PkG3");
245
246 uidMap->updateMap(1, uidData);
247
248 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
249 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
250 "PkG3");
251 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
252 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
253 "Pkg2");
254 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
255 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
256 "pkg1");
257 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
258 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
259 "pkg0");
260 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
261
262 attributionMatcher->set_position(Position::FIRST);
263 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
264 "pkg0");
265 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
266 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
267 "PkG3");
268 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
269 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
270 "Pkg2");
271 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
272 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
273 "pkg1");
274 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
275
276 attributionMatcher->set_position(Position::LAST);
277 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
278 "pkg0");
279 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
280 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
281 "PkG3");
282 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
283 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
284 "Pkg2");
285 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
286 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
287 "pkg1");
288 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
289
290 // Uid + tag.
291 attributionMatcher->set_position(Position::ANY);
292 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
293 ATTRIBUTION_TAG_FIELD_ID);
294 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
295 "pkg0");
296 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
297 "location1");
298 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
299 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
300 "pkg1");
301 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
302 "location1");
303 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
304 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
305 "pkg1");
306 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
307 "location2");
308 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
309 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
310 "Pkg2");
311 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
312 "location3");
313 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
314 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
315 "PkG3");
316 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
317 "location3");
318 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
319 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
320 "PkG3");
321 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
322 "location1");
323 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
324
325 attributionMatcher->set_position(Position::FIRST);
326 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
327 "pkg0");
328 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
329 "location1");
330 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
331 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
332 "pkg1");
333 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
334 "location1");
335 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
336 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
337 "pkg1");
338 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
339 "location2");
340 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
341 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
342 "Pkg2");
343 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
344 "location3");
345 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
346 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
347 "PkG3");
348 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
349 "location3");
350 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
351 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
352 "PkG3");
353 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
354 "location1");
355 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
356
357 attributionMatcher->set_position(Position::LAST);
358 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
359 "pkg0");
360 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
361 "location1");
362 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
363 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
364 "pkg1");
365 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
366 "location1");
367 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
368 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
369 "pkg1");
370 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
371 "location2");
372 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
373 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
374 "Pkg2");
375 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
376 "location3");
377 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
378 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
379 "PkG3");
380 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
381 "location3");
382 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
383 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string(
384 "PkG3");
385 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)->set_eq_string(
386 "location1");
387 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
388 }
389
TEST(AtomMatcherTest,TestUidFieldMatcher)390 TEST(AtomMatcherTest, TestUidFieldMatcher) {
391 sp<UidMap> uidMap = new UidMap();
392
393 UidData uidData;
394 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg0");
395 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg1");
396 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 2222, /*version*/ 2, "v2", "pkg1");
397 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 1, "v1", "Pkg2");
398 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 2, "v2", "PkG3");
399
400 uidMap->updateMap(1, uidData);
401
402 // Set up matcher
403 AtomMatcher matcher;
404 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
405 simpleMatcher->set_atom_id(TAG_ID);
406 simpleMatcher->add_field_value_matcher()->set_field(1);
407 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("pkg0");
408
409 // Make event without is_uid annotation.
410 LogEvent event1(/*uid=*/0, /*pid=*/0);
411 makeIntLogEvent(&event1, TAG_ID, 0, 1111);
412 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
413
414 // Make event with is_uid annotation.
415 LogEvent event2(/*uid=*/0, /*pid=*/0);
416 makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID_2, 1111, ASTATSLOG_ANNOTATION_ID_IS_UID,
417 true);
418
419 // Event has is_uid annotation, so mapping from uid to package name occurs.
420 simpleMatcher->set_atom_id(TAG_ID_2);
421 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
422
423 // Event has is_uid annotation, but uid maps to different package name.
424 simpleMatcher->mutable_field_value_matcher(0)->set_eq_string("Pkg2");
425 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
426 }
427
TEST_GUARDED(AtomMatcherTest,TestRepeatedUidFieldMatcher,__ANDROID_API_T__)428 TEST_GUARDED(AtomMatcherTest, TestRepeatedUidFieldMatcher, __ANDROID_API_T__) {
429 sp<UidMap> uidMap = new UidMap();
430
431 UidData uidData;
432 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg0");
433 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg1");
434 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 2222, /*version*/ 2, "v2", "pkg1");
435 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 1, "v1", "Pkg2");
436 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 2, "v2", "PkG3");
437
438 uidMap->updateMap(1, uidData);
439
440 // Set up matcher.
441 AtomMatcher matcher;
442 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
443 simpleMatcher->set_atom_id(TAG_ID);
444 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
445 fieldValueMatcher->set_field(FIELD_ID_1);
446
447 // No is_uid annotation, no mapping from uid to package name.
448 vector<int> intArray = {1111, 3333, 2222};
449 LogEvent event1(/*uid=*/0, /*pid=*/0);
450 makeRepeatedIntLogEvent(&event1, TAG_ID, intArray);
451
452 fieldValueMatcher->set_position(Position::FIRST);
453 fieldValueMatcher->set_eq_string("pkg0");
454 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
455
456 fieldValueMatcher->set_position(Position::LAST);
457 fieldValueMatcher->set_eq_string("pkg1");
458 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
459
460 fieldValueMatcher->set_position(Position::ANY);
461 fieldValueMatcher->set_eq_string("Pkg2");
462 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
463
464 // is_uid annotation, mapping from uid to package name.
465 LogEvent event2(/*uid=*/0, /*pid=*/0);
466 makeRepeatedUidLogEvent(&event2, TAG_ID, intArray);
467
468 fieldValueMatcher->set_position(Position::FIRST);
469 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
470 fieldValueMatcher->set_eq_string("pkg0");
471 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
472
473 fieldValueMatcher->set_position(Position::LAST);
474 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
475 fieldValueMatcher->set_eq_string("pkg1");
476 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
477
478 fieldValueMatcher->set_position(Position::ANY);
479 fieldValueMatcher->set_eq_string("pkg");
480 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
481 fieldValueMatcher->set_eq_string("Pkg2");
482 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
483 }
484
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_SingleString)485 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_SingleString) {
486 sp<UidMap> uidMap = new UidMap();
487
488 // Set up the matcher
489 AtomMatcher matcher;
490 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
491 simpleMatcher->set_atom_id(TAG_ID);
492
493 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
494 fieldValueMatcher->set_field(FIELD_ID_1);
495 StringListMatcher* neqStringList = fieldValueMatcher->mutable_neq_any_string();
496 neqStringList->add_str_value("some value");
497 neqStringList->add_str_value("another value");
498
499 // First string matched.
500 LogEvent event1(/*uid=*/0, /*pid=*/0);
501 makeStringLogEvent(&event1, TAG_ID, 0, "some value");
502 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
503
504 // Second string matched.
505 LogEvent event2(/*uid=*/0, /*pid=*/0);
506 makeStringLogEvent(&event2, TAG_ID, 0, "another value");
507 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
508
509 // No strings matched.
510 LogEvent event3(/*uid=*/0, /*pid=*/0);
511 makeStringLogEvent(&event3, TAG_ID, 0, "foo");
512 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3).matched);
513 }
514
TEST(AtomMatcherTest,TestNeqAnyStringMatcher_AttributionUids)515 TEST(AtomMatcherTest, TestNeqAnyStringMatcher_AttributionUids) {
516 sp<UidMap> uidMap = new UidMap();
517
518 UidData uidData;
519 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg0");
520 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg1");
521 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 2222, /*version*/ 2, "v2", "pkg1");
522 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 1, "v1", "Pkg2");
523 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 2, "v2", "PkG3");
524
525 uidMap->updateMap(1, uidData);
526
527 std::vector<int> attributionUids = {1111, 2222, 3333, 1066};
528 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
529
530 // Set up the event
531 LogEvent event(/*uid=*/0, /*pid=*/0);
532 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
533
534 // Set up the matcher
535 AtomMatcher matcher;
536 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
537 simpleMatcher->set_atom_id(TAG_ID);
538
539 // Match first node.
540 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
541 attributionMatcher->set_field(FIELD_ID_1);
542 attributionMatcher->set_position(Position::FIRST);
543 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
544 ATTRIBUTION_UID_FIELD_ID);
545 auto neqStringList = attributionMatcher->mutable_matches_tuple()
546 ->mutable_field_value_matcher(0)
547 ->mutable_neq_any_string();
548 neqStringList->add_str_value("Pkg2");
549 neqStringList->add_str_value("PkG3");
550
551 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
552 fieldMatcher->set_field(FIELD_ID_2);
553 fieldMatcher->set_eq_string("some value");
554
555 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
556
557 neqStringList->Clear();
558 neqStringList->add_str_value("pkg1");
559 neqStringList->add_str_value("PkG3");
560 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
561
562 attributionMatcher->set_position(Position::ANY);
563 neqStringList->Clear();
564 neqStringList->add_str_value("maps.com");
565 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
566
567 neqStringList->Clear();
568 neqStringList->add_str_value("PkG3");
569 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
570
571 attributionMatcher->set_position(Position::LAST);
572 neqStringList->Clear();
573 neqStringList->add_str_value("AID_STATSD");
574 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
575 }
576
TEST(AtomMatcherTest,TestEqAnyStringMatcher)577 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
578 sp<UidMap> uidMap = new UidMap();
579
580 UidData uidData;
581 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg0");
582 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg1");
583 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 2222, /*version*/ 2, "v2", "pkg1");
584 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 1, "v1", "Pkg2");
585 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 2, "v2", "PkG3");
586
587 uidMap->updateMap(1, uidData);
588
589 std::vector<int> attributionUids = {1067, 2222, 3333, 1066};
590 std::vector<string> attributionTags = {"location1", "location2", "location3", "location3"};
591
592 // Set up the event
593 LogEvent event(/*uid=*/0, /*pid=*/0);
594 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
595
596 // Set up the matcher
597 AtomMatcher matcher;
598 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
599 simpleMatcher->set_atom_id(TAG_ID);
600
601 // Match first node.
602 auto attributionMatcher = simpleMatcher->add_field_value_matcher();
603 attributionMatcher->set_field(FIELD_ID_1);
604 attributionMatcher->set_position(Position::FIRST);
605 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
606 ATTRIBUTION_UID_FIELD_ID);
607 auto eqStringList = attributionMatcher->mutable_matches_tuple()
608 ->mutable_field_value_matcher(0)
609 ->mutable_eq_any_string();
610 eqStringList->add_str_value("AID_ROOT");
611 eqStringList->add_str_value("AID_INCIDENTD");
612
613 auto fieldMatcher = simpleMatcher->add_field_value_matcher();
614 fieldMatcher->set_field(FIELD_ID_2);
615 fieldMatcher->set_eq_string("some value");
616
617 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
618
619 attributionMatcher->set_position(Position::ANY);
620 eqStringList->Clear();
621 eqStringList->add_str_value("AID_STATSD");
622 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
623
624 eqStringList->Clear();
625 eqStringList->add_str_value("pkg1");
626 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
627
628 auto normalStringField = fieldMatcher->mutable_eq_any_string();
629 normalStringField->add_str_value("some value123");
630 normalStringField->add_str_value("some value");
631 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
632
633 normalStringField->Clear();
634 normalStringField->add_str_value("AID_STATSD");
635 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
636
637 eqStringList->Clear();
638 eqStringList->add_str_value("maps.com");
639 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
640 }
641
TEST(AtomMatcherTest,TestBoolMatcher)642 TEST(AtomMatcherTest, TestBoolMatcher) {
643 sp<UidMap> uidMap = new UidMap();
644 // Set up the matcher
645 AtomMatcher matcher;
646 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
647 simpleMatcher->set_atom_id(TAG_ID);
648 auto keyValue1 = simpleMatcher->add_field_value_matcher();
649 keyValue1->set_field(FIELD_ID_1);
650 auto keyValue2 = simpleMatcher->add_field_value_matcher();
651 keyValue2->set_field(FIELD_ID_2);
652
653 // Set up the event
654 LogEvent event(/*uid=*/0, /*pid=*/0);
655 makeBoolLogEvent(&event, TAG_ID, 0, true, false);
656
657 // Test
658 keyValue1->set_eq_bool(true);
659 keyValue2->set_eq_bool(false);
660 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
661
662 keyValue1->set_eq_bool(false);
663 keyValue2->set_eq_bool(false);
664 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
665
666 keyValue1->set_eq_bool(false);
667 keyValue2->set_eq_bool(true);
668 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
669
670 keyValue1->set_eq_bool(true);
671 keyValue2->set_eq_bool(true);
672 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
673 }
674
TEST(AtomMatcherTest,TestStringMatcher)675 TEST(AtomMatcherTest, TestStringMatcher) {
676 sp<UidMap> uidMap = new UidMap();
677 // Set up the matcher
678 AtomMatcher matcher;
679 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
680 simpleMatcher->set_atom_id(TAG_ID);
681 auto keyValue = simpleMatcher->add_field_value_matcher();
682 keyValue->set_field(FIELD_ID_1);
683 keyValue->set_eq_string("some value");
684
685 // Set up the event
686 LogEvent event(/*uid=*/0, /*pid=*/0);
687 makeStringLogEvent(&event, TAG_ID, 0, "some value");
688
689 // Test
690 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
691 }
692
TEST_GUARDED(AtomMatcherTest,TestIntMatcher_EmptyRepeatedField,__ANDROID_API_T__)693 TEST_GUARDED(AtomMatcherTest, TestIntMatcher_EmptyRepeatedField, __ANDROID_API_T__) {
694 sp<UidMap> uidMap = new UidMap();
695
696 // Set up the log event.
697 LogEvent event(/*uid=*/0, /*pid=*/0);
698 makeRepeatedIntLogEvent(&event, TAG_ID, {});
699
700 // Set up the matcher.
701 AtomMatcher matcher;
702 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
703 simpleMatcher->set_atom_id(TAG_ID);
704 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
705 fieldValueMatcher->set_field(FIELD_ID_1);
706
707 // Match first int.
708 fieldValueMatcher->set_position(Position::FIRST);
709 fieldValueMatcher->set_eq_int(9);
710 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
711
712 // Match last int.
713 fieldValueMatcher->set_position(Position::LAST);
714 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
715
716 // Match any int.
717 fieldValueMatcher->set_position(Position::ANY);
718 fieldValueMatcher->set_eq_int(13);
719 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
720 }
721
TEST_GUARDED(AtomMatcherTest,TestIntMatcher_RepeatedIntField,__ANDROID_API_T__)722 TEST_GUARDED(AtomMatcherTest, TestIntMatcher_RepeatedIntField, __ANDROID_API_T__) {
723 sp<UidMap> uidMap = new UidMap();
724
725 // Set up the log event.
726 LogEvent event(/*uid=*/0, /*pid=*/0);
727 vector<int> intArray = {21, 9};
728 makeRepeatedIntLogEvent(&event, TAG_ID, intArray);
729
730 // Set up the matcher.
731 AtomMatcher matcher;
732 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
733 simpleMatcher->set_atom_id(TAG_ID);
734
735 // Match first int.
736 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
737 fieldValueMatcher->set_field(FIELD_ID_1);
738 fieldValueMatcher->set_position(Position::FIRST);
739 fieldValueMatcher->set_eq_int(9);
740 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
741
742 fieldValueMatcher->set_eq_int(21);
743 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
744
745 // Match last int.
746 fieldValueMatcher->set_position(Position::LAST);
747 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
748
749 fieldValueMatcher->set_eq_int(9);
750 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
751
752 // Match any int.
753 fieldValueMatcher->set_position(Position::ANY);
754 fieldValueMatcher->set_eq_int(13);
755 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
756
757 fieldValueMatcher->set_eq_int(21);
758 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
759
760 fieldValueMatcher->set_eq_int(9);
761 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
762 }
763
TEST_GUARDED(AtomMatcherTest,TestLtIntMatcher_RepeatedIntField,__ANDROID_API_T__)764 TEST_GUARDED(AtomMatcherTest, TestLtIntMatcher_RepeatedIntField, __ANDROID_API_T__) {
765 sp<UidMap> uidMap = new UidMap();
766
767 // Set up the log event.
768 LogEvent event(/*uid=*/0, /*pid=*/0);
769 vector<int> intArray = {21, 9};
770 makeRepeatedIntLogEvent(&event, TAG_ID, intArray);
771
772 // Set up the matcher.
773 AtomMatcher matcher;
774 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
775 simpleMatcher->set_atom_id(TAG_ID);
776
777 // Match first int.
778 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
779 fieldValueMatcher->set_field(FIELD_ID_1);
780 fieldValueMatcher->set_position(Position::FIRST);
781 fieldValueMatcher->set_lt_int(9);
782 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
783
784 fieldValueMatcher->set_lt_int(21);
785 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
786
787 fieldValueMatcher->set_lt_int(23);
788 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
789
790 // Match last int.
791 fieldValueMatcher->set_position(Position::LAST);
792 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
793
794 fieldValueMatcher->set_lt_int(9);
795 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
796
797 fieldValueMatcher->set_lt_int(8);
798 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
799
800 // Match any int.
801 fieldValueMatcher->set_position(Position::ANY);
802 fieldValueMatcher->set_lt_int(21);
803 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
804
805 fieldValueMatcher->set_lt_int(8);
806 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
807
808 fieldValueMatcher->set_lt_int(23);
809 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
810 }
811
TEST_GUARDED(AtomMatcherTest,TestStringMatcher_RepeatedStringField,__ANDROID_API_T__)812 TEST_GUARDED(AtomMatcherTest, TestStringMatcher_RepeatedStringField, __ANDROID_API_T__) {
813 sp<UidMap> uidMap = new UidMap();
814
815 // Set up the log event.
816 LogEvent event(/*uid=*/0, /*pid=*/0);
817 vector<string> strArray = {"str1", "str2", "str3"};
818 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
819
820 // Set up the matcher.
821 AtomMatcher matcher;
822 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
823 simpleMatcher->set_atom_id(TAG_ID);
824
825 // Match first int.
826 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
827 fieldValueMatcher->set_field(FIELD_ID_1);
828 fieldValueMatcher->set_position(Position::FIRST);
829 fieldValueMatcher->set_eq_string("str2");
830 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
831
832 fieldValueMatcher->set_eq_string("str1");
833 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
834
835 // Match last int.
836 fieldValueMatcher->set_position(Position::LAST);
837 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
838
839 fieldValueMatcher->set_eq_string("str3");
840 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
841
842 // Match any int.
843 fieldValueMatcher->set_position(Position::ANY);
844 fieldValueMatcher->set_eq_string("str4");
845 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
846
847 fieldValueMatcher->set_eq_string("str1");
848 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
849
850 fieldValueMatcher->set_eq_string("str2");
851 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
852
853 fieldValueMatcher->set_eq_string("str3");
854 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
855 }
856
TEST_GUARDED(AtomMatcherTest,TestEqAnyStringMatcher_RepeatedStringField,__ANDROID_API_T__)857 TEST_GUARDED(AtomMatcherTest, TestEqAnyStringMatcher_RepeatedStringField, __ANDROID_API_T__) {
858 sp<UidMap> uidMap = new UidMap();
859
860 // Set up the log event.
861 LogEvent event(/*uid=*/0, /*pid=*/0);
862 vector<string> strArray = {"str1", "str2", "str3"};
863 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
864
865 // Set up the matcher.
866 AtomMatcher matcher;
867 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
868 simpleMatcher->set_atom_id(TAG_ID);
869
870 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
871 fieldValueMatcher->set_field(FIELD_ID_1);
872 StringListMatcher* eqStringList = fieldValueMatcher->mutable_eq_any_string();
873
874 fieldValueMatcher->set_position(Position::FIRST);
875 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
876 fieldValueMatcher->set_position(Position::LAST);
877 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
878 fieldValueMatcher->set_position(Position::ANY);
879 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
880
881 eqStringList->add_str_value("str4");
882 fieldValueMatcher->set_position(Position::FIRST);
883 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
884 fieldValueMatcher->set_position(Position::LAST);
885 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
886 fieldValueMatcher->set_position(Position::ANY);
887 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
888
889 eqStringList->add_str_value("str2");
890 fieldValueMatcher->set_position(Position::FIRST);
891 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
892 fieldValueMatcher->set_position(Position::LAST);
893 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
894 fieldValueMatcher->set_position(Position::ANY);
895 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
896
897 eqStringList->add_str_value("str3");
898 fieldValueMatcher->set_position(Position::FIRST);
899 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
900 fieldValueMatcher->set_position(Position::LAST);
901 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
902 fieldValueMatcher->set_position(Position::ANY);
903 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
904
905 eqStringList->add_str_value("str1");
906 fieldValueMatcher->set_position(Position::FIRST);
907 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
908 fieldValueMatcher->set_position(Position::LAST);
909 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
910 fieldValueMatcher->set_position(Position::ANY);
911 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
912 }
913
TEST_GUARDED(AtomMatcherTest,TestNeqAnyStringMatcher_RepeatedStringField,__ANDROID_API_T__)914 TEST_GUARDED(AtomMatcherTest, TestNeqAnyStringMatcher_RepeatedStringField, __ANDROID_API_T__) {
915 sp<UidMap> uidMap = new UidMap();
916
917 // Set up the log event.
918 LogEvent event(/*uid=*/0, /*pid=*/0);
919 vector<string> strArray = {"str1", "str2", "str3"};
920 makeRepeatedStringLogEvent(&event, TAG_ID, strArray);
921
922 // Set up the matcher.
923 AtomMatcher matcher;
924 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
925 simpleMatcher->set_atom_id(TAG_ID);
926
927 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
928 fieldValueMatcher->set_field(FIELD_ID_1);
929 StringListMatcher* neqStringList = fieldValueMatcher->mutable_neq_any_string();
930
931 fieldValueMatcher->set_position(Position::FIRST);
932 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
933 fieldValueMatcher->set_position(Position::LAST);
934 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
935 fieldValueMatcher->set_position(Position::ANY);
936 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
937
938 neqStringList->add_str_value("str4");
939 fieldValueMatcher->set_position(Position::FIRST);
940 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
941 fieldValueMatcher->set_position(Position::LAST);
942 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
943 fieldValueMatcher->set_position(Position::ANY);
944 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
945
946 neqStringList->add_str_value("str2");
947 fieldValueMatcher->set_position(Position::FIRST);
948 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
949 fieldValueMatcher->set_position(Position::LAST);
950 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
951 fieldValueMatcher->set_position(Position::ANY);
952 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
953
954 neqStringList->add_str_value("str3");
955 fieldValueMatcher->set_position(Position::FIRST);
956 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
957 fieldValueMatcher->set_position(Position::LAST);
958 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
959 fieldValueMatcher->set_position(Position::ANY);
960 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
961
962 neqStringList->add_str_value("str1");
963 fieldValueMatcher->set_position(Position::FIRST);
964 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
965 fieldValueMatcher->set_position(Position::LAST);
966 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
967 fieldValueMatcher->set_position(Position::ANY);
968 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
969 }
970
TEST(AtomMatcherTest,TestMultiFieldsMatcher)971 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
972 sp<UidMap> uidMap = new UidMap();
973 // Set up the matcher
974 AtomMatcher matcher;
975 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
976 simpleMatcher->set_atom_id(TAG_ID);
977 auto keyValue1 = simpleMatcher->add_field_value_matcher();
978 keyValue1->set_field(FIELD_ID_1);
979 auto keyValue2 = simpleMatcher->add_field_value_matcher();
980 keyValue2->set_field(FIELD_ID_2);
981
982 // Set up the event
983 LogEvent event(/*uid=*/0, /*pid=*/0);
984 CreateTwoValueLogEvent(&event, TAG_ID, 0, 2, 3);
985
986 // Test
987 keyValue1->set_eq_int(2);
988 keyValue2->set_eq_int(3);
989 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
990
991 keyValue1->set_eq_int(2);
992 keyValue2->set_eq_int(4);
993 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
994
995 keyValue1->set_eq_int(4);
996 keyValue2->set_eq_int(3);
997 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
998 }
999
TEST(AtomMatcherTest,TestIntComparisonMatcher)1000 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
1001 sp<UidMap> uidMap = new UidMap();
1002 // Set up the matcher
1003 AtomMatcher matcher;
1004 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1005
1006 simpleMatcher->set_atom_id(TAG_ID);
1007 auto keyValue = simpleMatcher->add_field_value_matcher();
1008 keyValue->set_field(FIELD_ID_1);
1009
1010 // Set up the event
1011 LogEvent event(/*uid=*/0, /*pid=*/0);
1012 makeIntLogEvent(&event, TAG_ID, 0, 11);
1013
1014 // Test
1015
1016 // eq_int
1017 keyValue->set_eq_int(10);
1018 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1019 keyValue->set_eq_int(11);
1020 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1021 keyValue->set_eq_int(12);
1022 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1023
1024 // lt_int
1025 keyValue->set_lt_int(10);
1026 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1027 keyValue->set_lt_int(11);
1028 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1029 keyValue->set_lt_int(12);
1030 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1031
1032 // lte_int
1033 keyValue->set_lte_int(10);
1034 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1035 keyValue->set_lte_int(11);
1036 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1037 keyValue->set_lte_int(12);
1038 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1039
1040 // gt_int
1041 keyValue->set_gt_int(10);
1042 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1043 keyValue->set_gt_int(11);
1044 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1045 keyValue->set_gt_int(12);
1046 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1047
1048 // gte_int
1049 keyValue->set_gte_int(10);
1050 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1051 keyValue->set_gte_int(11);
1052 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1053 keyValue->set_gte_int(12);
1054 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1055 }
1056
TEST(AtomMatcherTest,TestFloatComparisonMatcher)1057 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
1058 sp<UidMap> uidMap = new UidMap();
1059 // Set up the matcher
1060 AtomMatcher matcher;
1061 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1062 simpleMatcher->set_atom_id(TAG_ID);
1063
1064 auto keyValue = simpleMatcher->add_field_value_matcher();
1065 keyValue->set_field(FIELD_ID_1);
1066
1067 LogEvent event1(/*uid=*/0, /*pid=*/0);
1068 makeFloatLogEvent(&event1, TAG_ID, 0, 10.1f);
1069 keyValue->set_lt_float(10.0);
1070 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
1071
1072 LogEvent event2(/*uid=*/0, /*pid=*/0);
1073 makeFloatLogEvent(&event2, TAG_ID, 0, 9.9f);
1074 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
1075
1076 LogEvent event3(/*uid=*/0, /*pid=*/0);
1077 makeFloatLogEvent(&event3, TAG_ID, 0, 10.1f);
1078 keyValue->set_gt_float(10.0);
1079 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3).matched);
1080
1081 LogEvent event4(/*uid=*/0, /*pid=*/0);
1082 makeFloatLogEvent(&event4, TAG_ID, 0, 9.9f);
1083 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4).matched);
1084 }
1085
1086 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)1087 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
1088 simpleMatcher->set_atom_id(tag);
1089 auto keyValue = simpleMatcher->add_field_value_matcher();
1090 keyValue->set_field(key);
1091 keyValue->set_eq_int(val);
1092 }
1093
TEST(AtomMatcherTest,TestAndMatcher)1094 TEST(AtomMatcherTest, TestAndMatcher) {
1095 // Set up the matcher
1096 LogicalOperation operation = LogicalOperation::AND;
1097
1098 vector<int> children;
1099 children.push_back(0);
1100 children.push_back(1);
1101 children.push_back(2);
1102
1103 vector<MatchingState> matcherResults;
1104 matcherResults.push_back(MatchingState::kMatched);
1105 matcherResults.push_back(MatchingState::kNotMatched);
1106 matcherResults.push_back(MatchingState::kMatched);
1107
1108 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1109
1110 matcherResults.clear();
1111 matcherResults.push_back(MatchingState::kMatched);
1112 matcherResults.push_back(MatchingState::kMatched);
1113 matcherResults.push_back(MatchingState::kMatched);
1114
1115 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1116 }
1117
TEST(AtomMatcherTest,TestOrMatcher)1118 TEST(AtomMatcherTest, TestOrMatcher) {
1119 // Set up the matcher
1120 LogicalOperation operation = LogicalOperation::OR;
1121
1122 vector<int> children;
1123 children.push_back(0);
1124 children.push_back(1);
1125 children.push_back(2);
1126
1127 vector<MatchingState> matcherResults;
1128 matcherResults.push_back(MatchingState::kMatched);
1129 matcherResults.push_back(MatchingState::kNotMatched);
1130 matcherResults.push_back(MatchingState::kMatched);
1131
1132 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1133
1134 matcherResults.clear();
1135 matcherResults.push_back(MatchingState::kNotMatched);
1136 matcherResults.push_back(MatchingState::kNotMatched);
1137 matcherResults.push_back(MatchingState::kNotMatched);
1138
1139 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1140 }
1141
TEST(AtomMatcherTest,TestNotMatcher)1142 TEST(AtomMatcherTest, TestNotMatcher) {
1143 // Set up the matcher
1144 LogicalOperation operation = LogicalOperation::NOT;
1145
1146 vector<int> children;
1147 children.push_back(0);
1148
1149 vector<MatchingState> matcherResults;
1150 matcherResults.push_back(MatchingState::kMatched);
1151
1152 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1153
1154 matcherResults.clear();
1155 matcherResults.push_back(MatchingState::kNotMatched);
1156 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1157 }
1158
TEST(AtomMatcherTest,TestNandMatcher)1159 TEST(AtomMatcherTest, TestNandMatcher) {
1160 // Set up the matcher
1161 LogicalOperation operation = LogicalOperation::NAND;
1162
1163 vector<int> children;
1164 children.push_back(0);
1165 children.push_back(1);
1166
1167 vector<MatchingState> matcherResults;
1168 matcherResults.push_back(MatchingState::kMatched);
1169 matcherResults.push_back(MatchingState::kNotMatched);
1170
1171 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1172
1173 matcherResults.clear();
1174 matcherResults.push_back(MatchingState::kNotMatched);
1175 matcherResults.push_back(MatchingState::kNotMatched);
1176 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1177
1178 matcherResults.clear();
1179 matcherResults.push_back(MatchingState::kMatched);
1180 matcherResults.push_back(MatchingState::kMatched);
1181 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1182 }
1183
TEST(AtomMatcherTest,TestNorMatcher)1184 TEST(AtomMatcherTest, TestNorMatcher) {
1185 // Set up the matcher
1186 LogicalOperation operation = LogicalOperation::NOR;
1187
1188 vector<int> children;
1189 children.push_back(0);
1190 children.push_back(1);
1191
1192 vector<MatchingState> matcherResults;
1193 matcherResults.push_back(MatchingState::kMatched);
1194 matcherResults.push_back(MatchingState::kNotMatched);
1195
1196 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1197
1198 matcherResults.clear();
1199 matcherResults.push_back(MatchingState::kNotMatched);
1200 matcherResults.push_back(MatchingState::kNotMatched);
1201 EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
1202
1203 matcherResults.clear();
1204 matcherResults.push_back(MatchingState::kMatched);
1205 matcherResults.push_back(MatchingState::kMatched);
1206 EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
1207 }
1208 //
TEST(AtomMatcherTest,TestUidFieldMatcherWithWildcardString)1209 TEST(AtomMatcherTest, TestUidFieldMatcherWithWildcardString) {
1210 sp<UidMap> uidMap = new UidMap();
1211 UidData uidData;
1212 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "package0");
1213 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 1111, /*version*/ 1, "v1", "pkg1");
1214 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 2222, /*version*/ 2, "v2", "pkg1");
1215 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 1, "v1", "package2");
1216 *uidData.add_app_info() = createApplicationInfo(/*uid*/ 3333, /*version*/ 2, "v2", "package3");
1217
1218 uidMap->updateMap(1, uidData);
1219
1220 // Set up matcher
1221 AtomMatcher matcher;
1222 auto simpleMatcher = matcher.mutable_simple_atom_matcher();
1223 simpleMatcher->set_atom_id(TAG_ID);
1224 simpleMatcher->add_field_value_matcher()->set_field(1);
1225 simpleMatcher->mutable_field_value_matcher(0)->set_eq_wildcard_string("pkg*");
1226
1227 // Event without is_uid annotation.
1228 LogEvent event1(/*uid=*/0, /*pid=*/0);
1229 makeIntLogEvent(&event1, TAG_ID, 0, 1111);
1230 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
1231
1232 // Event where mapping from uid to package name occurs.
1233 LogEvent event2(/*uid=*/0, /*pid=*/0);
1234 makeIntWithBoolAnnotationLogEvent(&event2, TAG_ID, 1111, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1235 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
1236
1237 // Event where uid maps to package names that don't fit wildcard pattern.
1238 LogEvent event3(/*uid=*/0, /*pid=*/0);
1239 makeIntWithBoolAnnotationLogEvent(&event3, TAG_ID, 3333, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1240 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event3).matched);
1241
1242 // Update matcher to match one AID
1243 simpleMatcher->mutable_field_value_matcher(0)->set_eq_wildcard_string(
1244 "AID_SYSTEM"); // uid 1000
1245
1246 // Event where mapping from uid to aid doesn't fit wildcard pattern.
1247 LogEvent event4(/*uid=*/0, /*pid=*/0);
1248 makeIntWithBoolAnnotationLogEvent(&event4, TAG_ID, 1005, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1249 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4).matched);
1250
1251 // Event where mapping from uid to aid does fit wildcard pattern.
1252 LogEvent event5(/*uid=*/0, /*pid=*/0);
1253 makeIntWithBoolAnnotationLogEvent(&event5, TAG_ID, 1000, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1254 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event5).matched);
1255
1256 // Update matcher to match multiple AIDs
1257 simpleMatcher->mutable_field_value_matcher(0)->set_eq_wildcard_string("AID_SDCARD_*");
1258
1259 // Event where mapping from uid to aid doesn't fit wildcard pattern.
1260 LogEvent event6(/*uid=*/0, /*pid=*/0);
1261 makeIntWithBoolAnnotationLogEvent(&event6, TAG_ID, 1036, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1262 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event6).matched);
1263
1264 // Event where mapping from uid to aid does fit wildcard pattern.
1265 LogEvent event7(/*uid=*/0, /*pid=*/0);
1266 makeIntWithBoolAnnotationLogEvent(&event7, TAG_ID, 1034, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1267 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event7).matched);
1268
1269 LogEvent event8(/*uid=*/0, /*pid=*/0);
1270 makeIntWithBoolAnnotationLogEvent(&event8, TAG_ID, 1035, ASTATSLOG_ANNOTATION_ID_IS_UID, true);
1271 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event8).matched);
1272 }
1273
TEST(AtomMatcherTest,TestWildcardStringMatcher)1274 TEST(AtomMatcherTest, TestWildcardStringMatcher) {
1275 sp<UidMap> uidMap = new UidMap();
1276 // Set up the matcher
1277 AtomMatcher matcher;
1278 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1279 simpleMatcher->set_atom_id(TAG_ID);
1280 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
1281 fieldValueMatcher->set_field(FIELD_ID_1);
1282 // Matches any string that begins with "test.string:test_" and ends with number between 0 and 9
1283 // inclusive
1284 fieldValueMatcher->set_eq_wildcard_string("test.string:test_[0-9]");
1285
1286 LogEvent event1(/*uid=*/0, /*pid=*/0);
1287 makeStringLogEvent(&event1, TAG_ID, 0, "test.string:test_0");
1288 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
1289
1290 LogEvent event2(/*uid=*/0, /*pid=*/0);
1291 makeStringLogEvent(&event2, TAG_ID, 0, "test.string:test_19");
1292 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event2)
1293 .matched); // extra character at end of string
1294
1295 LogEvent event3(/*uid=*/0, /*pid=*/0);
1296 makeStringLogEvent(&event3, TAG_ID, 0, "extra.test.string:test_1");
1297 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher,
1298 event3)
1299 .matched); // extra characters at beginning of string
1300
1301 LogEvent event4(/*uid=*/0, /*pid=*/0);
1302 makeStringLogEvent(&event4, TAG_ID, 0, "test.string:test_");
1303 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher,
1304 event4)
1305 .matched); // missing character from 0-9 at end of string
1306
1307 LogEvent event5(/*uid=*/0, /*pid=*/0);
1308 makeStringLogEvent(&event5, TAG_ID, 0, "est.string:test_1");
1309 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event5)
1310 .matched); // missing 't' at beginning of string
1311
1312 LogEvent event6(/*uid=*/0, /*pid=*/0);
1313 makeStringLogEvent(&event6, TAG_ID, 0, "test.string:test_1extra");
1314 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event6)
1315 .matched); // extra characters at end of string
1316
1317 // Matches any string that contains "test.string:test_" + any extra characters before or after
1318 fieldValueMatcher->set_eq_wildcard_string("*test.string:test_*");
1319
1320 LogEvent event7(/*uid=*/0, /*pid=*/0);
1321 makeStringLogEvent(&event7, TAG_ID, 0, "test.string:test_");
1322 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event7).matched);
1323
1324 LogEvent event8(/*uid=*/0, /*pid=*/0);
1325 makeStringLogEvent(&event8, TAG_ID, 0, "extra.test.string:test_");
1326 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event8).matched);
1327
1328 LogEvent event9(/*uid=*/0, /*pid=*/0);
1329 makeStringLogEvent(&event9, TAG_ID, 0, "test.string:test_extra");
1330 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event9).matched);
1331
1332 LogEvent event10(/*uid=*/0, /*pid=*/0);
1333 makeStringLogEvent(&event10, TAG_ID, 0, "est.string:test_");
1334 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event10).matched);
1335
1336 LogEvent event11(/*uid=*/0, /*pid=*/0);
1337 makeStringLogEvent(&event11, TAG_ID, 0, "test.string:test");
1338 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event11).matched);
1339 }
1340
TEST(AtomMatcherTest,TestEqAnyWildcardStringMatcher)1341 TEST(AtomMatcherTest, TestEqAnyWildcardStringMatcher) {
1342 sp<UidMap> uidMap = new UidMap();
1343
1344 // Set up the matcher
1345 AtomMatcher matcher;
1346 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1347 simpleMatcher->set_atom_id(TAG_ID);
1348
1349 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
1350 fieldValueMatcher->set_field(FIELD_ID_1);
1351 StringListMatcher* eqWildcardStrList = fieldValueMatcher->mutable_eq_any_wildcard_string();
1352 eqWildcardStrList->add_str_value("first_string_*");
1353 eqWildcardStrList->add_str_value("second_string_*");
1354
1355 // First wildcard pattern matched.
1356 LogEvent event1(/*uid=*/0, /*pid=*/0);
1357 makeStringLogEvent(&event1, TAG_ID, 0, "first_string_1");
1358 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
1359
1360 // Second wildcard pattern matched.
1361 LogEvent event2(/*uid=*/0, /*pid=*/0);
1362 makeStringLogEvent(&event2, TAG_ID, 0, "second_string_1");
1363 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
1364
1365 // No wildcard patterns matched.
1366 LogEvent event3(/*uid=*/0, /*pid=*/0);
1367 makeStringLogEvent(&event3, TAG_ID, 0, "third_string_1");
1368 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event3).matched);
1369 }
1370
TEST(AtomMatcherTest,TestNeqAnyWildcardStringMatcher)1371 TEST(AtomMatcherTest, TestNeqAnyWildcardStringMatcher) {
1372 sp<UidMap> uidMap = new UidMap();
1373
1374 // Set up the log event.
1375 std::vector<int> attributionUids = {1111, 2222, 3333};
1376 std::vector<string> attributionTags = {"location_1", "location_2", "location"};
1377 LogEvent event(/*uid=*/0, /*pid=*/0);
1378 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
1379
1380 // Set up the matcher. Match first tag.
1381 AtomMatcher matcher;
1382 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1383 simpleMatcher->set_atom_id(TAG_ID);
1384 FieldValueMatcher* attributionMatcher = simpleMatcher->add_field_value_matcher();
1385 attributionMatcher->set_field(FIELD_ID_1);
1386 attributionMatcher->set_position(Position::FIRST);
1387 FieldValueMatcher* attributionTagMatcher =
1388 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher();
1389 attributionTagMatcher->set_field(ATTRIBUTION_TAG_FIELD_ID);
1390 StringListMatcher* neqWildcardStrList =
1391 attributionTagMatcher->mutable_neq_any_wildcard_string();
1392
1393 // First tag is not matched. neq string list {"tag"}
1394 neqWildcardStrList->add_str_value("tag");
1395 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1396
1397 // First tag is matched. neq string list {"tag", "location_*"}
1398 neqWildcardStrList->add_str_value("location_*");
1399 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1400
1401 // Match last tag.
1402 attributionMatcher->set_position(Position::LAST);
1403
1404 // Last tag is not matched. neq string list {"tag", "location_*"}
1405 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1406
1407 // Last tag is matched. neq string list {"tag", "location_*", "location*"}
1408 neqWildcardStrList->add_str_value("location*");
1409 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1410
1411 // Match any tag.
1412 attributionMatcher->set_position(Position::ANY);
1413
1414 // All tags are matched. neq string list {"tag", "location_*", "location*"}
1415 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1416
1417 // Set up another log event.
1418 std::vector<string> attributionTags2 = {"location_1", "location", "string"};
1419 LogEvent event2(/*uid=*/0, /*pid=*/0);
1420 makeAttributionLogEvent(&event2, TAG_ID, 0, attributionUids, attributionTags2, "some value");
1421
1422 // Tag "string" is not matched. neq string list {"tag", "location_*", "location*"}
1423 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
1424 }
1425
TEST(AtomMatcherTest,TestEqAnyIntMatcher)1426 TEST(AtomMatcherTest, TestEqAnyIntMatcher) {
1427 sp<UidMap> uidMap = new UidMap();
1428
1429 // Set up the matcher
1430 AtomMatcher matcher;
1431 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1432 simpleMatcher->set_atom_id(TAG_ID);
1433
1434 FieldValueMatcher* fieldValueMatcher = simpleMatcher->add_field_value_matcher();
1435 fieldValueMatcher->set_field(FIELD_ID_1);
1436 IntListMatcher* eqIntList = fieldValueMatcher->mutable_eq_any_int();
1437 eqIntList->add_int_value(3);
1438 eqIntList->add_int_value(5);
1439
1440 // First int matched.
1441 LogEvent event1(/*uid=*/0, /*pid=*/0);
1442 makeIntLogEvent(&event1, TAG_ID, 0, 3);
1443 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event1).matched);
1444
1445 // Second int matched.
1446 LogEvent event2(/*uid=*/0, /*pid=*/0);
1447 makeIntLogEvent(&event2, TAG_ID, 0, 5);
1448 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2).matched);
1449
1450 // No ints matched.
1451 LogEvent event3(/*uid=*/0, /*pid=*/0);
1452 makeIntLogEvent(&event3, TAG_ID, 0, 4);
1453 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event3).matched);
1454 }
1455
TEST(AtomMatcherTest,TestNeqAnyIntMatcher)1456 TEST(AtomMatcherTest, TestNeqAnyIntMatcher) {
1457 sp<UidMap> uidMap = new UidMap();
1458
1459 // Set up the log event.
1460 std::vector<int> attributionUids = {1111, 2222, 3333};
1461 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1462 LogEvent event(/*uid=*/0, /*pid=*/0);
1463 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value");
1464
1465 // Set up the matcher. Match first uid.
1466 AtomMatcher matcher;
1467 SimpleAtomMatcher* simpleMatcher = matcher.mutable_simple_atom_matcher();
1468 simpleMatcher->set_atom_id(TAG_ID);
1469 FieldValueMatcher* attributionMatcher = simpleMatcher->add_field_value_matcher();
1470 attributionMatcher->set_field(FIELD_ID_1);
1471 attributionMatcher->set_position(Position::FIRST);
1472 FieldValueMatcher* attributionUidMatcher =
1473 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher();
1474 attributionUidMatcher->set_field(ATTRIBUTION_UID_FIELD_ID);
1475 IntListMatcher* neqIntList = attributionUidMatcher->mutable_neq_any_int();
1476
1477 // First uid is not matched. neq int list {4444}
1478 neqIntList->add_int_value(4444);
1479 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1480
1481 // First uid is matched. neq int list {4444, 1111}
1482 neqIntList->add_int_value(1111);
1483 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1484
1485 // Match last uid.
1486 attributionMatcher->set_position(Position::LAST);
1487
1488 // Last uid is not matched. neq int list {4444, 1111}
1489 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1490
1491 // Last uid is matched. neq int list {4444, 1111, 3333}
1492 neqIntList->add_int_value(3333);
1493 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1494
1495 // Match any uid.
1496 attributionMatcher->set_position(Position::ANY);
1497
1498 // Uid 2222 is not matched. neq int list {4444, 1111, 3333}
1499 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1500
1501 // All uids are matched. neq int list {4444, 1111, 3333, 2222}
1502 neqIntList->add_int_value(2222);
1503 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event).matched);
1504 }
1505
TEST(AtomMatcherTest,TestStringReplaceRoot)1506 TEST(AtomMatcherTest, TestStringReplaceRoot) {
1507 sp<UidMap> uidMap = new UidMap();
1508
1509 // Set up the log event.
1510 std::vector<int> attributionUids = {1111, 2222, 3333};
1511 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1512 LogEvent event(/*uid=*/0, /*pid=*/0);
1513 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
1514
1515 // Set up the matcher. Replace second field.
1516 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1517 FieldValueMatcher* fvm = matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1518 fvm->set_field(FIELD_ID_2);
1519 StringReplacer* stringReplacer = fvm->mutable_replace_string();
1520 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1521 stringReplacer->set_replacement("");
1522
1523 const auto [hasMatched, transformedEvent] =
1524 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1525 EXPECT_TRUE(hasMatched);
1526 ASSERT_NE(transformedEvent, nullptr);
1527
1528 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1529 ASSERT_EQ(fieldValues.size(), 7);
1530 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1531 EXPECT_EQ(fieldValues[1].mValue.str_value, "location1");
1532 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1533 EXPECT_EQ(fieldValues[3].mValue.str_value, "location2");
1534 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1535 EXPECT_EQ(fieldValues[5].mValue.str_value, "location3");
1536 EXPECT_EQ(fieldValues[6].mValue.str_value, "some value");
1537 }
1538
TEST(AtomMatcherTest,TestStringReplaceAttributionTagFirst)1539 TEST(AtomMatcherTest, TestStringReplaceAttributionTagFirst) {
1540 sp<UidMap> uidMap = new UidMap();
1541
1542 // Set up the log event.
1543 std::vector<int> attributionUids = {1111, 2222, 3333};
1544 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1545 LogEvent event(/*uid=*/0, /*pid=*/0);
1546 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
1547
1548 // Set up the matcher. Replace first attribution tag.
1549 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1550 FieldValueMatcher* attributionFvm =
1551 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1552 attributionFvm->set_field(FIELD_ID_1);
1553 attributionFvm->set_position(Position::FIRST);
1554 FieldValueMatcher* attributionTagFvm =
1555 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1556 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1557 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1558 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1559 stringReplacer->set_replacement("");
1560
1561 const auto [hasMatched, transformedEvent] =
1562 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1563 EXPECT_TRUE(hasMatched);
1564 ASSERT_NE(transformedEvent, nullptr);
1565 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1566 ASSERT_EQ(fieldValues.size(), 7);
1567 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1568 EXPECT_EQ(fieldValues[1].mValue.str_value, "location");
1569 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1570 EXPECT_EQ(fieldValues[3].mValue.str_value, "location2");
1571 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1572 EXPECT_EQ(fieldValues[5].mValue.str_value, "location3");
1573 EXPECT_EQ(fieldValues[6].mValue.str_value, "some value123");
1574 }
1575
TEST(AtomMatcherTest,TestStringReplaceAttributionTagLast)1576 TEST(AtomMatcherTest, TestStringReplaceAttributionTagLast) {
1577 sp<UidMap> uidMap = new UidMap();
1578
1579 // Set up the log event.
1580 std::vector<int> attributionUids = {1111, 2222, 3333};
1581 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1582 LogEvent event(/*uid=*/0, /*pid=*/0);
1583 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
1584
1585 // Set up the matcher. Replace last attribution tag.
1586 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1587 FieldValueMatcher* attributionFvm =
1588 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1589 attributionFvm->set_field(FIELD_ID_1);
1590 attributionFvm->set_position(Position::LAST);
1591 FieldValueMatcher* attributionTagFvm =
1592 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1593 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1594 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1595 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1596 stringReplacer->set_replacement("");
1597
1598 const auto [hasMatched, transformedEvent] =
1599 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1600 EXPECT_TRUE(hasMatched);
1601 ASSERT_NE(transformedEvent, nullptr);
1602
1603 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1604 ASSERT_EQ(fieldValues.size(), 7);
1605 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1606 EXPECT_EQ(fieldValues[1].mValue.str_value, "location1");
1607 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1608 EXPECT_EQ(fieldValues[3].mValue.str_value, "location2");
1609 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1610 EXPECT_EQ(fieldValues[5].mValue.str_value, "location");
1611 EXPECT_EQ(fieldValues[6].mValue.str_value, "some value123");
1612 }
1613
TEST(AtomMatcherTest,TestStringReplaceAttributionTagAll)1614 TEST(AtomMatcherTest, TestStringReplaceAttributionTagAll) {
1615 sp<UidMap> uidMap = new UidMap();
1616
1617 // Set up the log event.
1618 std::vector<int> attributionUids = {1111, 2222, 3333};
1619 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1620 LogEvent event(/*uid=*/0, /*pid=*/0);
1621 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
1622
1623 // Set up the matcher. Replace all attribution tags.
1624 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1625 FieldValueMatcher* attributionFvm =
1626 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1627 attributionFvm->set_field(FIELD_ID_1);
1628 attributionFvm->set_position(Position::ALL);
1629 FieldValueMatcher* attributionTagFvm =
1630 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1631 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1632 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1633 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1634 stringReplacer->set_replacement("");
1635
1636 const auto [hasMatched, transformedEvent] =
1637 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1638 EXPECT_TRUE(hasMatched);
1639 ASSERT_NE(transformedEvent, nullptr);
1640
1641 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1642 ASSERT_EQ(fieldValues.size(), 7);
1643 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1644 EXPECT_EQ(fieldValues[1].mValue.str_value, "location");
1645 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1646 EXPECT_EQ(fieldValues[3].mValue.str_value, "location");
1647 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1648 EXPECT_EQ(fieldValues[5].mValue.str_value, "location");
1649 EXPECT_EQ(fieldValues[6].mValue.str_value, "some value123");
1650 }
1651
TEST(AtomMatcherTest,TestStringReplaceNestedAllWithMultipleNestedStringFields)1652 TEST(AtomMatcherTest, TestStringReplaceNestedAllWithMultipleNestedStringFields) {
1653 sp<UidMap> uidMap = new UidMap();
1654
1655 // Set up the log event.
1656 std::vector<int> attributionUids = {1111, 2222, 3333};
1657 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1658 LogEvent event(/*uid=*/0, /*pid=*/0);
1659 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
1660
1661 // Manually change uid fields to string fields, as there is no direct way to create a
1662 // LogEvent with multiple nested string fields.
1663 (*event.getMutableValues())[0].mValue = android::os::statsd::Value("abc1");
1664 (*event.getMutableValues())[2].mValue = android::os::statsd::Value("xyz2");
1665 (*event.getMutableValues())[4].mValue = android::os::statsd::Value("abc3");
1666
1667 // Set up the matcher. Replace all attribution tags.
1668 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1669 FieldValueMatcher* attributionFvm =
1670 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1671 attributionFvm->set_field(FIELD_ID_1);
1672 attributionFvm->set_position(Position::ALL);
1673 FieldValueMatcher* attributionTagFvm =
1674 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1675 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1676 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1677 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1678 stringReplacer->set_replacement("");
1679
1680 const auto [hasMatched, transformedEvent] =
1681 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1682 EXPECT_TRUE(hasMatched);
1683 ASSERT_NE(transformedEvent, nullptr);
1684
1685 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1686 ASSERT_EQ(fieldValues.size(), 7);
1687 EXPECT_EQ(fieldValues[0].mValue.str_value, "abc1");
1688 EXPECT_EQ(fieldValues[1].mValue.str_value, "location");
1689 EXPECT_EQ(fieldValues[2].mValue.str_value, "xyz2");
1690 EXPECT_EQ(fieldValues[3].mValue.str_value, "location");
1691 EXPECT_EQ(fieldValues[4].mValue.str_value, "abc3");
1692 EXPECT_EQ(fieldValues[5].mValue.str_value, "location");
1693 EXPECT_EQ(fieldValues[6].mValue.str_value, "some value123");
1694 }
1695
TEST(AtomMatcherTest,TestStringReplaceRootOnMatchedField)1696 TEST(AtomMatcherTest, TestStringReplaceRootOnMatchedField) {
1697 sp<UidMap> uidMap = new UidMap();
1698
1699 // Set up the matcher. Replace second field and match on replaced field.
1700 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1701 FieldValueMatcher* fvm = matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1702 fvm->set_field(FIELD_ID_2);
1703 fvm->set_eq_string("bar");
1704 StringReplacer* stringReplacer = fvm->mutable_replace_string();
1705 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1706 stringReplacer->set_replacement("");
1707
1708 // Set up the log event.
1709 std::vector<int> attributionUids = {1111, 2222, 3333};
1710 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1711 {
1712 LogEvent event(/*uid=*/0, /*pid=*/0);
1713 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags,
1714 "some value123");
1715
1716 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1717 }
1718
1719 {
1720 LogEvent event(/*uid=*/0, /*pid=*/0);
1721 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "bar123");
1722 const auto [hasMatched, transformedEvent] =
1723 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1724 EXPECT_TRUE(hasMatched);
1725 ASSERT_NE(transformedEvent, nullptr);
1726 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1727 ASSERT_EQ(fieldValues.size(), 7);
1728 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1729 EXPECT_EQ(fieldValues[1].mValue.str_value, "location1");
1730 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1731 EXPECT_EQ(fieldValues[3].mValue.str_value, "location2");
1732 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1733 EXPECT_EQ(fieldValues[5].mValue.str_value, "location3");
1734 EXPECT_EQ(fieldValues[6].mValue.str_value, "bar");
1735 }
1736 }
1737
TEST(AtomMatcherTest,TestStringReplaceAttributionTagFirstOnMatchedField)1738 TEST(AtomMatcherTest, TestStringReplaceAttributionTagFirstOnMatchedField) {
1739 sp<UidMap> uidMap = new UidMap();
1740
1741 // Set up the matcher. Replace first attribution tag and match on that tag.
1742 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1743 FieldValueMatcher* attributionFvm =
1744 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1745 attributionFvm->set_field(FIELD_ID_1);
1746 attributionFvm->set_position(Position::FIRST);
1747 FieldValueMatcher* attributionTagFvm =
1748 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1749 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1750 attributionTagFvm->set_eq_string("bar");
1751 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1752 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1753 stringReplacer->set_replacement("");
1754
1755 // Set up the log event.
1756 std::vector<int> attributionUids = {1111, 2222, 3333};
1757 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1758 {
1759 LogEvent event(/*uid=*/0, /*pid=*/0);
1760 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags,
1761 "some value123");
1762
1763 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1764 }
1765
1766 {
1767 LogEvent event(/*uid=*/0, /*pid=*/0);
1768 attributionTags = {"bar1", "bar2", "bar3"};
1769 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "bar123");
1770 const auto [hasMatched, transformedEvent] =
1771 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1772 EXPECT_TRUE(hasMatched);
1773 ASSERT_NE(transformedEvent, nullptr);
1774 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1775 ASSERT_EQ(fieldValues.size(), 7);
1776 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1777 EXPECT_EQ(fieldValues[1].mValue.str_value, "bar");
1778 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1779 EXPECT_EQ(fieldValues[3].mValue.str_value, "bar2");
1780 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1781 EXPECT_EQ(fieldValues[5].mValue.str_value, "bar3");
1782 EXPECT_EQ(fieldValues[6].mValue.str_value, "bar123");
1783 }
1784 }
1785
TEST(AtomMatcherTest,TestStringReplaceAttributionTagLastOnMatchedField)1786 TEST(AtomMatcherTest, TestStringReplaceAttributionTagLastOnMatchedField) {
1787 sp<UidMap> uidMap = new UidMap();
1788
1789 // Set up the matcher. Replace last attribution tag and match on that tag.
1790 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1791 FieldValueMatcher* attributionFvm =
1792 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1793 attributionFvm->set_field(FIELD_ID_1);
1794 attributionFvm->set_position(Position::LAST);
1795 FieldValueMatcher* attributionTagFvm =
1796 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1797 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1798 attributionTagFvm->set_eq_string("bar");
1799 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1800 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1801 stringReplacer->set_replacement("");
1802
1803 // Set up the log event.
1804 std::vector<int> attributionUids = {1111, 2222, 3333};
1805 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1806 {
1807 LogEvent event(/*uid=*/0, /*pid=*/0);
1808 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags,
1809 "some value123");
1810
1811 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1812 }
1813
1814 {
1815 LogEvent event(/*uid=*/0, /*pid=*/0);
1816 attributionTags = {"bar1", "bar2", "bar3"};
1817 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "bar123");
1818 const auto [hasMatched, transformedEvent] =
1819 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1820 EXPECT_TRUE(hasMatched);
1821 ASSERT_NE(transformedEvent, nullptr);
1822 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1823 ASSERT_EQ(fieldValues.size(), 7);
1824 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1825 EXPECT_EQ(fieldValues[1].mValue.str_value, "bar1");
1826 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1827 EXPECT_EQ(fieldValues[3].mValue.str_value, "bar2");
1828 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1829 EXPECT_EQ(fieldValues[5].mValue.str_value, "bar");
1830 EXPECT_EQ(fieldValues[6].mValue.str_value, "bar123");
1831 }
1832 }
1833
TEST(AtomMatcherTest,TestStringReplaceAttributionTagAnyOnMatchedField)1834 TEST(AtomMatcherTest, TestStringReplaceAttributionTagAnyOnMatchedField) {
1835 sp<UidMap> uidMap = new UidMap();
1836
1837 // Set up the matcher. Replace all attribution tags but match on any tag.
1838 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1839 FieldValueMatcher* attributionFvm =
1840 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1841 attributionFvm->set_field(FIELD_ID_1);
1842 attributionFvm->set_position(Position::ANY);
1843 FieldValueMatcher* attributionTagFvm =
1844 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1845 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1846 attributionTagFvm->set_eq_string("bar");
1847 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1848 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1849 stringReplacer->set_replacement("");
1850
1851 // Set up the log event.
1852 std::vector<int> attributionUids = {1111, 2222, 3333};
1853 std::vector<string> attributionTags = {"location1", "location2", "location3"};
1854 {
1855 LogEvent event(/*uid=*/0, /*pid=*/0);
1856 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags,
1857 "some value123");
1858
1859 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1860 }
1861
1862 {
1863 LogEvent event(/*uid=*/0, /*pid=*/0);
1864 attributionTags = {"foo1", "bar2", "foo3"};
1865 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "bar123");
1866 const auto [hasMatched, transformedEvent] =
1867 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1868 EXPECT_TRUE(hasMatched);
1869 ASSERT_NE(transformedEvent, nullptr);
1870 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1871 ASSERT_EQ(fieldValues.size(), 7);
1872 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1873 EXPECT_EQ(fieldValues[1].mValue.str_value, "foo");
1874 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1875 EXPECT_EQ(fieldValues[3].mValue.str_value, "bar");
1876 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1877 EXPECT_EQ(fieldValues[5].mValue.str_value, "foo");
1878 EXPECT_EQ(fieldValues[6].mValue.str_value, "bar123");
1879 }
1880 }
1881
TEST(AtomMatcherTest,TestStringReplaceAttributionTagAnyAndRootOnMatchedFields)1882 TEST(AtomMatcherTest, TestStringReplaceAttributionTagAnyAndRootOnMatchedFields) {
1883 sp<UidMap> uidMap = new UidMap();
1884
1885 // Set up the matcher. Replace all attribution tags but match on any tag.
1886 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1887 FieldValueMatcher* attributionFvm =
1888 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1889 attributionFvm->set_field(FIELD_ID_1);
1890 attributionFvm->set_position(Position::ANY);
1891 FieldValueMatcher* attributionTagFvm =
1892 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1893 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1894 attributionTagFvm->set_eq_string("bar");
1895 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1896 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1897 stringReplacer->set_replacement("");
1898 FieldValueMatcher* rootFvm = matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1899 rootFvm->set_field(FIELD_ID_2);
1900 rootFvm->set_eq_string("blah");
1901 stringReplacer = rootFvm->mutable_replace_string();
1902 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1903 stringReplacer->set_replacement("");
1904
1905 {
1906 LogEvent event(/*uid=*/0, /*pid=*/0);
1907 makeAttributionLogEvent(&event, TAG_ID, 0, {1111, 2222, 3333} /* uids */,
1908 {"location1", "location2", "location3"} /* tags */,
1909 "some value123" /* name */);
1910
1911 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1912 }
1913
1914 {
1915 LogEvent event(/*uid=*/0, /*pid=*/0);
1916 makeAttributionLogEvent(&event, TAG_ID, 0, {1111, 2222, 3333} /* uids */,
1917 {"foo1", "bar2", "foo3"} /* tags */, "bar123" /* name */);
1918 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1919 }
1920
1921 {
1922 LogEvent event(/*uid=*/0, /*pid=*/0);
1923 makeAttributionLogEvent(&event, TAG_ID, 0, {1111, 2222, 3333} /* uids */,
1924 {"foo1", "bar2", "foo3"} /* tags */, "blah123" /* name */);
1925 const auto [hasMatched, transformedEvent] =
1926 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1927 EXPECT_TRUE(hasMatched);
1928 ASSERT_NE(transformedEvent, nullptr);
1929 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1930 ASSERT_EQ(fieldValues.size(), 7);
1931 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1932 EXPECT_EQ(fieldValues[1].mValue.str_value, "foo");
1933 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1934 EXPECT_EQ(fieldValues[3].mValue.str_value, "bar");
1935 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1936 EXPECT_EQ(fieldValues[5].mValue.str_value, "foo");
1937 EXPECT_EQ(fieldValues[6].mValue.str_value, "blah");
1938 }
1939 }
1940
TEST(AtomMatcherTest,TestStringReplaceAttributionTagAnyWithAttributionUidValueMatcher)1941 TEST(AtomMatcherTest, TestStringReplaceAttributionTagAnyWithAttributionUidValueMatcher) {
1942 sp<UidMap> uidMap = new UidMap();
1943
1944 // Set up the matcher. Replace all attribution tags but match on any uid and tag.
1945 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
1946 FieldValueMatcher* attributionFvm =
1947 matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
1948 attributionFvm->set_field(FIELD_ID_1);
1949 attributionFvm->set_position(Position::ANY);
1950 FieldValueMatcher* attributionUidFvm =
1951 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1952 attributionUidFvm->set_field(ATTRIBUTION_UID_FIELD_ID);
1953 attributionUidFvm->set_eq_int(2222);
1954 FieldValueMatcher* attributionTagFvm =
1955 attributionFvm->mutable_matches_tuple()->add_field_value_matcher();
1956 attributionTagFvm->set_field(ATTRIBUTION_TAG_FIELD_ID);
1957 attributionTagFvm->set_eq_string("bar");
1958 StringReplacer* stringReplacer = attributionTagFvm->mutable_replace_string();
1959 stringReplacer->set_regex(R"([0-9]+$)"); // match trailing digits, example "42" in "foo42".
1960 stringReplacer->set_replacement("");
1961
1962 {
1963 LogEvent event(/*uid=*/0, /*pid=*/0);
1964 makeAttributionLogEvent(&event, TAG_ID, 0, {1111, 2222, 3333} /* uids */,
1965 {"location1", "location2", "location3"} /* tags */,
1966 "some value123" /* name */);
1967
1968 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1969 }
1970
1971 {
1972 LogEvent event(/*uid=*/0, /*pid=*/0);
1973 makeAttributionLogEvent(&event, TAG_ID, 0, {1111, 3223, 3333} /* uids */,
1974 {"foo1", "bar2", "foo3"} /* tags */, "bar123" /* name */);
1975 EXPECT_FALSE(matchesSimple(uidMap, matcher.simple_atom_matcher(), event).matched);
1976 }
1977
1978 {
1979 LogEvent event(/*uid=*/0, /*pid=*/0);
1980 makeAttributionLogEvent(&event, TAG_ID, 0, {1111, 2222, 3333} /* uids */,
1981 {"foo1", "bar2", "foo3"} /* tags */, "bar123" /* name */);
1982 const auto [hasMatched, transformedEvent] =
1983 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
1984 EXPECT_TRUE(hasMatched);
1985 ASSERT_NE(transformedEvent, nullptr);
1986 const vector<FieldValue>& fieldValues = transformedEvent->getValues();
1987 ASSERT_EQ(fieldValues.size(), 7);
1988 EXPECT_EQ(fieldValues[0].mValue.int_value, 1111);
1989 EXPECT_EQ(fieldValues[1].mValue.str_value, "foo");
1990 EXPECT_EQ(fieldValues[2].mValue.int_value, 2222);
1991 EXPECT_EQ(fieldValues[3].mValue.str_value, "bar");
1992 EXPECT_EQ(fieldValues[4].mValue.int_value, 3333);
1993 EXPECT_EQ(fieldValues[5].mValue.str_value, "foo");
1994 EXPECT_EQ(fieldValues[6].mValue.str_value, "bar123");
1995 }
1996 }
1997
TEST(AtomMatcherTest,TestStringReplaceBadRegex)1998 TEST(AtomMatcherTest, TestStringReplaceBadRegex) {
1999 sp<UidMap> uidMap = new UidMap();
2000
2001 // Set up the log event.
2002 std::vector<int> attributionUids = {1111, 2222, 3333};
2003 std::vector<string> attributionTags = {"location1", "location2", "location3"};
2004 LogEvent event(/*uid=*/0, /*pid=*/0);
2005 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
2006
2007 // Set up the matcher. Replace second field.
2008 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
2009 FieldValueMatcher* fvm = matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
2010 fvm->set_field(FIELD_ID_2);
2011 StringReplacer* stringReplacer = fvm->mutable_replace_string();
2012 stringReplacer->set_regex(
2013 R"(*[0-9]+$)"); // bad regex: asterisk not preceded by any expression.
2014 stringReplacer->set_replacement("");
2015
2016 const auto [hasMatched, transformedEvent] =
2017 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
2018 EXPECT_TRUE(hasMatched);
2019 ASSERT_EQ(transformedEvent, nullptr);
2020 }
2021
TEST(AtomMatcherTest,TestStringReplaceRegexWithSubgroup)2022 TEST(AtomMatcherTest, TestStringReplaceRegexWithSubgroup) {
2023 sp<UidMap> uidMap = new UidMap();
2024
2025 // Set up the log event.
2026 std::vector<int> attributionUids = {1111, 2222, 3333};
2027 std::vector<string> attributionTags = {"location1", "location2", "location3"};
2028 LogEvent event(/*uid=*/0, /*pid=*/0);
2029 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
2030
2031 // Set up the matcher. Replace second field.
2032 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
2033 FieldValueMatcher* fvm = matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
2034 fvm->set_field(FIELD_ID_2);
2035 StringReplacer* stringReplacer = fvm->mutable_replace_string();
2036 stringReplacer->set_regex(R"(([a-z]+)[0-9]+$)"); // "([a-z]+)" is a subgroup.
2037 stringReplacer->set_replacement("");
2038
2039 const auto [hasMatched, transformedEvent] =
2040 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
2041 EXPECT_TRUE(hasMatched);
2042 ASSERT_EQ(transformedEvent, nullptr);
2043 }
2044
TEST(AtomMatcherTest,TestStringReplaceNoop)2045 TEST(AtomMatcherTest, TestStringReplaceNoop) {
2046 sp<UidMap> uidMap = new UidMap();
2047
2048 // Set up the log event.
2049 std::vector<int> attributionUids = {1111, 2222, 3333};
2050 std::vector<string> attributionTags = {"location1", "location2", "location3"};
2051 LogEvent event(/*uid=*/0, /*pid=*/0);
2052 makeAttributionLogEvent(&event, TAG_ID, 0, attributionUids, attributionTags, "some value123");
2053
2054 // Set up the matcher. Replace second field.
2055 AtomMatcher matcher = CreateSimpleAtomMatcher("matcher", TAG_ID);
2056 FieldValueMatcher* fvm = matcher.mutable_simple_atom_matcher()->add_field_value_matcher();
2057 fvm->set_field(FIELD_ID_2);
2058 StringReplacer* stringReplacer = fvm->mutable_replace_string();
2059 stringReplacer->set_regex(R"(this_pattern_should_not_match)");
2060 stringReplacer->set_replacement("");
2061
2062 const auto [hasMatched, transformedEvent] =
2063 matchesSimple(uidMap, matcher.simple_atom_matcher(), event);
2064 EXPECT_TRUE(hasMatched);
2065 ASSERT_EQ(transformedEvent, nullptr);
2066 }
2067
2068 #else
2069 GTEST_LOG_(INFO) << "This test does nothing.\n";
2070 #endif
2071