1 // Copyright (C) 2017 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //      http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include "frameworks/base/cmds/statsd/src/statsd_config.pb.h"
16 #include "matchers/matcher_util.h"
17 #include "stats_log_util.h"
18 #include "stats_util.h"
19 
20 #include <gtest/gtest.h>
21 #include <log/log_event_list.h>
22 #include <log/log_read.h>
23 #include <log/logprint.h>
24 
25 #include <stdio.h>
26 
27 using namespace android::os::statsd;
28 using std::unordered_map;
29 using std::vector;
30 
31 const int32_t TAG_ID = 123;
32 const int FIELD_ID_1 = 1;
33 const int FIELD_ID_2 = 2;
34 const int FIELD_ID_3 = 2;
35 
36 const int ATTRIBUTION_UID_FIELD_ID = 1;
37 const int ATTRIBUTION_TAG_FIELD_ID = 2;
38 
39 
40 #ifdef __ANDROID__
TEST(AtomMatcherTest,TestSimpleMatcher)41 TEST(AtomMatcherTest, TestSimpleMatcher) {
42     UidMap uidMap;
43 
44     // Set up the matcher
45     AtomMatcher matcher;
46     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
47     simpleMatcher->set_atom_id(TAG_ID);
48 
49     LogEvent event(TAG_ID, 0);
50     EXPECT_TRUE(event.write(11));
51     event.init();
52 
53     // Test
54     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
55 
56     // Wrong tag id.
57     simpleMatcher->set_atom_id(TAG_ID + 1);
58     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
59 }
60 
TEST(AtomMatcherTest,TestAttributionMatcher)61 TEST(AtomMatcherTest, TestAttributionMatcher) {
62     UidMap uidMap;
63     AttributionNodeInternal attribution_node1;
64     attribution_node1.set_uid(1111);
65     attribution_node1.set_tag("location1");
66 
67     AttributionNodeInternal attribution_node2;
68     attribution_node2.set_uid(2222);
69     attribution_node2.set_tag("location2");
70 
71     AttributionNodeInternal attribution_node3;
72     attribution_node3.set_uid(3333);
73     attribution_node3.set_tag("location3");
74     std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2,
75                                                               attribution_node3};
76 
77     // Set up the event
78     LogEvent event(TAG_ID, 0);
79     event.write(attribution_nodes);
80     event.write("some value");
81     // Convert to a LogEvent
82     event.init();
83 
84     // Set up the matcher
85     AtomMatcher matcher;
86     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
87     simpleMatcher->set_atom_id(TAG_ID);
88 
89     // Match first node.
90     auto attributionMatcher = simpleMatcher->add_field_value_matcher();
91     attributionMatcher->set_field(FIELD_ID_1);
92     attributionMatcher->set_position(Position::FIRST);
93     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
94         ATTRIBUTION_TAG_FIELD_ID);
95     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string("tag");
96 
97     auto fieldMatcher = simpleMatcher->add_field_value_matcher();
98     fieldMatcher->set_field(FIELD_ID_2);
99     fieldMatcher->set_eq_string("some value");
100 
101     // Tag not matched.
102     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
103     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
104         ->set_eq_string("location3");
105     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
106     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
107         ->set_eq_string("location1");
108     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
109 
110     // Match last node.
111     attributionMatcher->set_position(Position::LAST);
112     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
113     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
114         ->set_eq_string("location3");
115     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
116 
117     // Match any node.
118     attributionMatcher->set_position(Position::ANY);
119     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
120     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
121         ->set_eq_string("location1");
122     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
123     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
124         ->set_eq_string("location2");
125     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
126     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
127         ->set_eq_string("location3");
128     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
129     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
130         ->set_eq_string("location4");
131     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
132 
133     // Attribution match but primitive field not match.
134     attributionMatcher->set_position(Position::ANY);
135     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
136         ->set_eq_string("location2");
137     fieldMatcher->set_eq_string("wrong value");
138     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
139 
140     fieldMatcher->set_eq_string("some value");
141 
142     // Uid match.
143     attributionMatcher->set_position(Position::ANY);
144     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field(
145         ATTRIBUTION_UID_FIELD_ID);
146     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string("pkg0");
147     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
148 
149     uidMap.updateMap(
150             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
151             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
152              android::String16("v1"), android::String16("v2")},
153             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
154              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
155             {android::String16(""), android::String16(""), android::String16(""),
156              android::String16(""), android::String16("")});
157 
158     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
159     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
160         ->set_eq_string("pkg3");
161     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
162     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
163         ->set_eq_string("pkg2");
164     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
165     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
166         ->set_eq_string("pkg1");
167     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
168     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
169         ->set_eq_string("pkg0");
170     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
171 
172     attributionMatcher->set_position(Position::FIRST);
173     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
174         ->set_eq_string("pkg0");
175     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
176     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
177         ->set_eq_string("pkg3");
178     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
179     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
180         ->set_eq_string("pkg2");
181     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
182     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
183         ->set_eq_string("pkg1");
184     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
185 
186     attributionMatcher->set_position(Position::LAST);
187     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
188         ->set_eq_string("pkg0");
189     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
190     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
191         ->set_eq_string("pkg3");
192     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
193     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
194         ->set_eq_string("pkg2");
195     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
196     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
197         ->set_eq_string("pkg1");
198     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
199 
200     // Uid + tag.
201     attributionMatcher->set_position(Position::ANY);
202     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
203         ATTRIBUTION_TAG_FIELD_ID);
204     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
205         ->set_eq_string("pkg0");
206     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
207         ->set_eq_string("location1");
208     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
209     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
210         ->set_eq_string("pkg1");
211     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
212         ->set_eq_string("location1");
213     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
214     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
215         ->set_eq_string("pkg1");
216     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
217         ->set_eq_string("location2");
218     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
219     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
220         ->set_eq_string("pkg2");
221     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
222         ->set_eq_string("location3");
223     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
224     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
225         ->set_eq_string("pkg3");
226     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
227         ->set_eq_string("location3");
228     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
229     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
230         ->set_eq_string("pkg3");
231     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
232         ->set_eq_string("location1");
233     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
234 
235     attributionMatcher->set_position(Position::FIRST);
236     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
237         ->set_eq_string("pkg0");
238     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
239         ->set_eq_string("location1");
240     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
241     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
242         ->set_eq_string("pkg1");
243     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
244         ->set_eq_string("location1");
245     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
246     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
247         ->set_eq_string("pkg1");
248     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
249         ->set_eq_string("location2");
250     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
251     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
252         ->set_eq_string("pkg2");
253     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
254         ->set_eq_string("location3");
255     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
256     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
257         ->set_eq_string("pkg3");
258     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
259         ->set_eq_string("location3");
260     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
261     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
262         ->set_eq_string("pkg3");
263     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
264         ->set_eq_string("location1");
265     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
266 
267     attributionMatcher->set_position(Position::LAST);
268     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
269         ->set_eq_string("pkg0");
270     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
271         ->set_eq_string("location1");
272     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
273     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
274         ->set_eq_string("pkg1");
275     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
276         ->set_eq_string("location1");
277     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
278     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
279         ->set_eq_string("pkg1");
280     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
281         ->set_eq_string("location2");
282     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
283     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
284         ->set_eq_string("pkg2");
285     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
286         ->set_eq_string("location3");
287     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
288     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
289         ->set_eq_string("pkg3");
290     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
291         ->set_eq_string("location3");
292     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
293     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)
294         ->set_eq_string("pkg3");
295     attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1)
296         ->set_eq_string("location1");
297     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
298 }
299 
TEST(AtomMatcherTest,TestNeqAnyStringMatcher)300 TEST(AtomMatcherTest, TestNeqAnyStringMatcher) {
301     UidMap uidMap;
302     uidMap.updateMap(
303             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
304             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
305              android::String16("v1"), android::String16("v2")},
306             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
307              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
308             {android::String16(""), android::String16(""), android::String16(""),
309              android::String16(""), android::String16("")});
310 
311     AttributionNodeInternal attribution_node1;
312     attribution_node1.set_uid(1111);
313     attribution_node1.set_tag("location1");
314 
315     AttributionNodeInternal attribution_node2;
316     attribution_node2.set_uid(2222);
317     attribution_node2.set_tag("location2");
318 
319     AttributionNodeInternal attribution_node3;
320     attribution_node3.set_uid(3333);
321     attribution_node3.set_tag("location3");
322 
323     AttributionNodeInternal attribution_node4;
324     attribution_node4.set_uid(1066);
325     attribution_node4.set_tag("location3");
326     std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2,
327                                                               attribution_node3, attribution_node4};
328 
329     // Set up the event
330     LogEvent event(TAG_ID, 0);
331     event.write(attribution_nodes);
332     event.write("some value");
333     // Convert to a LogEvent
334     event.init();
335 
336     // Set up the matcher
337     AtomMatcher matcher;
338     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
339     simpleMatcher->set_atom_id(TAG_ID);
340 
341     // Match first node.
342     auto attributionMatcher = simpleMatcher->add_field_value_matcher();
343     attributionMatcher->set_field(FIELD_ID_1);
344     attributionMatcher->set_position(Position::FIRST);
345     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
346             ATTRIBUTION_UID_FIELD_ID);
347     auto neqStringList = attributionMatcher->mutable_matches_tuple()
348                                  ->mutable_field_value_matcher(0)
349                                  ->mutable_neq_any_string();
350     neqStringList->add_str_value("pkg2");
351     neqStringList->add_str_value("pkg3");
352 
353     auto fieldMatcher = simpleMatcher->add_field_value_matcher();
354     fieldMatcher->set_field(FIELD_ID_2);
355     fieldMatcher->set_eq_string("some value");
356 
357     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
358 
359     neqStringList->Clear();
360     neqStringList->add_str_value("pkg1");
361     neqStringList->add_str_value("pkg3");
362     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
363 
364     attributionMatcher->set_position(Position::ANY);
365     neqStringList->Clear();
366     neqStringList->add_str_value("maps.com");
367     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
368 
369     neqStringList->Clear();
370     neqStringList->add_str_value("PkG3");
371     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
372 
373     attributionMatcher->set_position(Position::LAST);
374     neqStringList->Clear();
375     neqStringList->add_str_value("AID_STATSD");
376     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
377 }
378 
TEST(AtomMatcherTest,TestEqAnyStringMatcher)379 TEST(AtomMatcherTest, TestEqAnyStringMatcher) {
380     UidMap uidMap;
381     uidMap.updateMap(
382             1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */,
383             {android::String16("v1"), android::String16("v1"), android::String16("v2"),
384              android::String16("v1"), android::String16("v2")},
385             {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"),
386              android::String16("Pkg2"), android::String16("PkG3")} /* package name list */,
387             {android::String16(""), android::String16(""), android::String16(""),
388              android::String16(""), android::String16("")});
389 
390     AttributionNodeInternal attribution_node1;
391     attribution_node1.set_uid(1067);
392     attribution_node1.set_tag("location1");
393 
394     AttributionNodeInternal attribution_node2;
395     attribution_node2.set_uid(2222);
396     attribution_node2.set_tag("location2");
397 
398     AttributionNodeInternal attribution_node3;
399     attribution_node3.set_uid(3333);
400     attribution_node3.set_tag("location3");
401 
402     AttributionNodeInternal attribution_node4;
403     attribution_node4.set_uid(1066);
404     attribution_node4.set_tag("location3");
405     std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2,
406                                                               attribution_node3, attribution_node4};
407 
408     // Set up the event
409     LogEvent event(TAG_ID, 0);
410     event.write(attribution_nodes);
411     event.write("some value");
412     // Convert to a LogEvent
413     event.init();
414 
415     // Set up the matcher
416     AtomMatcher matcher;
417     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
418     simpleMatcher->set_atom_id(TAG_ID);
419 
420     // Match first node.
421     auto attributionMatcher = simpleMatcher->add_field_value_matcher();
422     attributionMatcher->set_field(FIELD_ID_1);
423     attributionMatcher->set_position(Position::FIRST);
424     attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field(
425             ATTRIBUTION_UID_FIELD_ID);
426     auto eqStringList = attributionMatcher->mutable_matches_tuple()
427                                 ->mutable_field_value_matcher(0)
428                                 ->mutable_eq_any_string();
429     eqStringList->add_str_value("AID_ROOT");
430     eqStringList->add_str_value("AID_INCIDENTD");
431 
432     auto fieldMatcher = simpleMatcher->add_field_value_matcher();
433     fieldMatcher->set_field(FIELD_ID_2);
434     fieldMatcher->set_eq_string("some value");
435 
436     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
437 
438     attributionMatcher->set_position(Position::ANY);
439     eqStringList->Clear();
440     eqStringList->add_str_value("AID_STATSD");
441     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
442 
443     eqStringList->Clear();
444     eqStringList->add_str_value("pkg1");
445     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
446 
447     auto normalStringField = fieldMatcher->mutable_eq_any_string();
448     normalStringField->add_str_value("some value123");
449     normalStringField->add_str_value("some value");
450     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
451 
452     normalStringField->Clear();
453     normalStringField->add_str_value("AID_STATSD");
454     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
455 
456     eqStringList->Clear();
457     eqStringList->add_str_value("maps.com");
458     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
459 }
460 
TEST(AtomMatcherTest,TestBoolMatcher)461 TEST(AtomMatcherTest, TestBoolMatcher) {
462     UidMap uidMap;
463     // Set up the matcher
464     AtomMatcher matcher;
465     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
466     simpleMatcher->set_atom_id(TAG_ID);
467     auto keyValue1 = simpleMatcher->add_field_value_matcher();
468     keyValue1->set_field(FIELD_ID_1);
469     auto keyValue2 = simpleMatcher->add_field_value_matcher();
470     keyValue2->set_field(FIELD_ID_2);
471 
472     // Set up the event
473     LogEvent event(TAG_ID, 0);
474     EXPECT_TRUE(event.write(true));
475     EXPECT_TRUE(event.write(false));
476     // Convert to a LogEvent
477     event.init();
478 
479     // Test
480     keyValue1->set_eq_bool(true);
481     keyValue2->set_eq_bool(false);
482     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
483 
484     keyValue1->set_eq_bool(false);
485     keyValue2->set_eq_bool(false);
486     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
487 
488     keyValue1->set_eq_bool(false);
489     keyValue2->set_eq_bool(true);
490     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
491 
492     keyValue1->set_eq_bool(true);
493     keyValue2->set_eq_bool(true);
494     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
495 }
496 
TEST(AtomMatcherTest,TestStringMatcher)497 TEST(AtomMatcherTest, TestStringMatcher) {
498     UidMap uidMap;
499     // Set up the matcher
500     AtomMatcher matcher;
501     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
502     simpleMatcher->set_atom_id(TAG_ID);
503     auto keyValue = simpleMatcher->add_field_value_matcher();
504     keyValue->set_field(FIELD_ID_1);
505     keyValue->set_eq_string("some value");
506 
507     // Set up the event
508     LogEvent event(TAG_ID, 0);
509     event.write("some value");
510     // Convert to a LogEvent
511     event.init();
512 
513     // Test
514     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
515 }
516 
TEST(AtomMatcherTest,TestMultiFieldsMatcher)517 TEST(AtomMatcherTest, TestMultiFieldsMatcher) {
518     UidMap uidMap;
519     // Set up the matcher
520     AtomMatcher matcher;
521     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
522     simpleMatcher->set_atom_id(TAG_ID);
523     auto keyValue1 = simpleMatcher->add_field_value_matcher();
524     keyValue1->set_field(FIELD_ID_1);
525     auto keyValue2 = simpleMatcher->add_field_value_matcher();
526     keyValue2->set_field(FIELD_ID_2);
527 
528     // Set up the event
529     LogEvent event(TAG_ID, 0);
530     event.write(2);
531     event.write(3);
532 
533     // Convert to a LogEvent
534     event.init();
535 
536     // Test
537     keyValue1->set_eq_int(2);
538     keyValue2->set_eq_int(3);
539     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
540 
541     keyValue1->set_eq_int(2);
542     keyValue2->set_eq_int(4);
543     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
544 
545     keyValue1->set_eq_int(4);
546     keyValue2->set_eq_int(3);
547     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
548 }
549 
TEST(AtomMatcherTest,TestIntComparisonMatcher)550 TEST(AtomMatcherTest, TestIntComparisonMatcher) {
551     UidMap uidMap;
552     // Set up the matcher
553     AtomMatcher matcher;
554     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
555 
556     simpleMatcher->set_atom_id(TAG_ID);
557     auto keyValue = simpleMatcher->add_field_value_matcher();
558     keyValue->set_field(FIELD_ID_1);
559 
560     // Set up the event
561     LogEvent event(TAG_ID, 0);
562     event.write(11);
563     event.init();
564 
565     // Test
566 
567     // eq_int
568     keyValue->set_eq_int(10);
569     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
570     keyValue->set_eq_int(11);
571     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
572     keyValue->set_eq_int(12);
573     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
574 
575     // lt_int
576     keyValue->set_lt_int(10);
577     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
578     keyValue->set_lt_int(11);
579     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
580     keyValue->set_lt_int(12);
581     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
582 
583     // lte_int
584     keyValue->set_lte_int(10);
585     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
586     keyValue->set_lte_int(11);
587     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
588     keyValue->set_lte_int(12);
589     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
590 
591     // gt_int
592     keyValue->set_gt_int(10);
593     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
594     keyValue->set_gt_int(11);
595     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
596     keyValue->set_gt_int(12);
597     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
598 
599     // gte_int
600     keyValue->set_gte_int(10);
601     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
602     keyValue->set_gte_int(11);
603     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event));
604     keyValue->set_gte_int(12);
605     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event));
606 }
607 
TEST(AtomMatcherTest,TestFloatComparisonMatcher)608 TEST(AtomMatcherTest, TestFloatComparisonMatcher) {
609     UidMap uidMap;
610     // Set up the matcher
611     AtomMatcher matcher;
612     auto simpleMatcher = matcher.mutable_simple_atom_matcher();
613     simpleMatcher->set_atom_id(TAG_ID);
614 
615     auto keyValue = simpleMatcher->add_field_value_matcher();
616     keyValue->set_field(FIELD_ID_1);
617 
618     LogEvent event1(TAG_ID, 0);
619     keyValue->set_lt_float(10.0);
620     event1.write(10.1f);
621     event1.init();
622     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1));
623 
624     LogEvent event2(TAG_ID, 0);
625     event2.write(9.9f);
626     event2.init();
627     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2));
628 
629     LogEvent event3(TAG_ID, 0);
630     event3.write(10.1f);
631     event3.init();
632     keyValue->set_gt_float(10.0);
633     EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3));
634 
635     LogEvent event4(TAG_ID, 0);
636     event4.write(9.9f);
637     event4.init();
638     EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4));
639 }
640 
641 // Helper for the composite matchers.
addSimpleMatcher(SimpleAtomMatcher * simpleMatcher,int tag,int key,int val)642 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) {
643     simpleMatcher->set_atom_id(tag);
644     auto keyValue = simpleMatcher->add_field_value_matcher();
645     keyValue->set_field(key);
646     keyValue->set_eq_int(val);
647 }
648 
TEST(AtomMatcherTest,TestAndMatcher)649 TEST(AtomMatcherTest, TestAndMatcher) {
650     // Set up the matcher
651     LogicalOperation operation = LogicalOperation::AND;
652 
653     vector<int> children;
654     children.push_back(0);
655     children.push_back(1);
656     children.push_back(2);
657 
658     vector<MatchingState> matcherResults;
659     matcherResults.push_back(MatchingState::kMatched);
660     matcherResults.push_back(MatchingState::kNotMatched);
661     matcherResults.push_back(MatchingState::kMatched);
662 
663     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
664 
665     matcherResults.clear();
666     matcherResults.push_back(MatchingState::kMatched);
667     matcherResults.push_back(MatchingState::kMatched);
668     matcherResults.push_back(MatchingState::kMatched);
669 
670     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
671 }
672 
TEST(AtomMatcherTest,TestOrMatcher)673 TEST(AtomMatcherTest, TestOrMatcher) {
674     // Set up the matcher
675     LogicalOperation operation = LogicalOperation::OR;
676 
677     vector<int> children;
678     children.push_back(0);
679     children.push_back(1);
680     children.push_back(2);
681 
682     vector<MatchingState> matcherResults;
683     matcherResults.push_back(MatchingState::kMatched);
684     matcherResults.push_back(MatchingState::kNotMatched);
685     matcherResults.push_back(MatchingState::kMatched);
686 
687     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
688 
689     matcherResults.clear();
690     matcherResults.push_back(MatchingState::kNotMatched);
691     matcherResults.push_back(MatchingState::kNotMatched);
692     matcherResults.push_back(MatchingState::kNotMatched);
693 
694     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
695 }
696 
TEST(AtomMatcherTest,TestNotMatcher)697 TEST(AtomMatcherTest, TestNotMatcher) {
698     // Set up the matcher
699     LogicalOperation operation = LogicalOperation::NOT;
700 
701     vector<int> children;
702     children.push_back(0);
703 
704     vector<MatchingState> matcherResults;
705     matcherResults.push_back(MatchingState::kMatched);
706 
707     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
708 
709     matcherResults.clear();
710     matcherResults.push_back(MatchingState::kNotMatched);
711     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
712 }
713 
TEST(AtomMatcherTest,TestNandMatcher)714 TEST(AtomMatcherTest, TestNandMatcher) {
715     // Set up the matcher
716     LogicalOperation operation = LogicalOperation::NAND;
717 
718     vector<int> children;
719     children.push_back(0);
720     children.push_back(1);
721 
722     vector<MatchingState> matcherResults;
723     matcherResults.push_back(MatchingState::kMatched);
724     matcherResults.push_back(MatchingState::kNotMatched);
725 
726     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
727 
728     matcherResults.clear();
729     matcherResults.push_back(MatchingState::kNotMatched);
730     matcherResults.push_back(MatchingState::kNotMatched);
731     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
732 
733     matcherResults.clear();
734     matcherResults.push_back(MatchingState::kMatched);
735     matcherResults.push_back(MatchingState::kMatched);
736     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
737 }
738 
TEST(AtomMatcherTest,TestNorMatcher)739 TEST(AtomMatcherTest, TestNorMatcher) {
740     // Set up the matcher
741     LogicalOperation operation = LogicalOperation::NOR;
742 
743     vector<int> children;
744     children.push_back(0);
745     children.push_back(1);
746 
747     vector<MatchingState> matcherResults;
748     matcherResults.push_back(MatchingState::kMatched);
749     matcherResults.push_back(MatchingState::kNotMatched);
750 
751     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
752 
753     matcherResults.clear();
754     matcherResults.push_back(MatchingState::kNotMatched);
755     matcherResults.push_back(MatchingState::kNotMatched);
756     EXPECT_TRUE(combinationMatch(children, operation, matcherResults));
757 
758     matcherResults.clear();
759     matcherResults.push_back(MatchingState::kMatched);
760     matcherResults.push_back(MatchingState::kMatched);
761     EXPECT_FALSE(combinationMatch(children, operation, matcherResults));
762 }
763 #else
764 GTEST_LOG_(INFO) << "This test does nothing.\n";
765 #endif
766