1 // Copyright (C) 2017 The Android Open Source Project 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #include "frameworks/base/cmds/statsd/src/statsd_config.pb.h" 16 #include "matchers/matcher_util.h" 17 #include "stats_log_util.h" 18 #include "stats_util.h" 19 20 #include <gtest/gtest.h> 21 #include <log/log_event_list.h> 22 #include <log/log_read.h> 23 #include <log/logprint.h> 24 25 #include <stdio.h> 26 27 using namespace android::os::statsd; 28 using std::unordered_map; 29 using std::vector; 30 31 const int32_t TAG_ID = 123; 32 const int FIELD_ID_1 = 1; 33 const int FIELD_ID_2 = 2; 34 const int FIELD_ID_3 = 2; 35 36 const int ATTRIBUTION_UID_FIELD_ID = 1; 37 const int ATTRIBUTION_TAG_FIELD_ID = 2; 38 39 40 #ifdef __ANDROID__ 41 TEST(AtomMatcherTest, TestSimpleMatcher) { 42 UidMap uidMap; 43 44 // Set up the matcher 45 AtomMatcher matcher; 46 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 47 simpleMatcher->set_atom_id(TAG_ID); 48 49 LogEvent event(TAG_ID, 0); 50 EXPECT_TRUE(event.write(11)); 51 event.init(); 52 53 // Test 54 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 55 56 // Wrong tag id. 57 simpleMatcher->set_atom_id(TAG_ID + 1); 58 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 59 } 60 61 TEST(AtomMatcherTest, TestAttributionMatcher) { 62 UidMap uidMap; 63 AttributionNodeInternal attribution_node1; 64 attribution_node1.set_uid(1111); 65 attribution_node1.set_tag("location1"); 66 67 AttributionNodeInternal attribution_node2; 68 attribution_node2.set_uid(2222); 69 attribution_node2.set_tag("location2"); 70 71 AttributionNodeInternal attribution_node3; 72 attribution_node3.set_uid(3333); 73 attribution_node3.set_tag("location3"); 74 std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2, 75 attribution_node3}; 76 77 // Set up the event 78 LogEvent event(TAG_ID, 0); 79 event.write(attribution_nodes); 80 event.write("some value"); 81 // Convert to a LogEvent 82 event.init(); 83 84 // Set up the matcher 85 AtomMatcher matcher; 86 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 87 simpleMatcher->set_atom_id(TAG_ID); 88 89 // Match first node. 90 auto attributionMatcher = simpleMatcher->add_field_value_matcher(); 91 attributionMatcher->set_field(FIELD_ID_1); 92 attributionMatcher->set_position(Position::FIRST); 93 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field( 94 ATTRIBUTION_TAG_FIELD_ID); 95 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string("tag"); 96 97 auto fieldMatcher = simpleMatcher->add_field_value_matcher(); 98 fieldMatcher->set_field(FIELD_ID_2); 99 fieldMatcher->set_eq_string("some value"); 100 101 // Tag not matched. 102 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 103 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 104 ->set_eq_string("location3"); 105 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 106 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 107 ->set_eq_string("location1"); 108 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 109 110 // Match last node. 111 attributionMatcher->set_position(Position::LAST); 112 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 113 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 114 ->set_eq_string("location3"); 115 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 116 117 // Match any node. 118 attributionMatcher->set_position(Position::ANY); 119 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 120 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 121 ->set_eq_string("location1"); 122 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 123 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 124 ->set_eq_string("location2"); 125 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 126 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 127 ->set_eq_string("location3"); 128 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 129 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 130 ->set_eq_string("location4"); 131 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 132 133 // Attribution match but primitive field not match. 134 attributionMatcher->set_position(Position::ANY); 135 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 136 ->set_eq_string("location2"); 137 fieldMatcher->set_eq_string("wrong value"); 138 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 139 140 fieldMatcher->set_eq_string("some value"); 141 142 // Uid match. 143 attributionMatcher->set_position(Position::ANY); 144 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_field( 145 ATTRIBUTION_UID_FIELD_ID); 146 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0)->set_eq_string("pkg0"); 147 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 148 149 uidMap.updateMap( 150 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */, 151 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"), 152 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */); 153 154 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 155 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 156 ->set_eq_string("pkg3"); 157 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 158 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 159 ->set_eq_string("pkg2"); 160 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 161 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 162 ->set_eq_string("pkg1"); 163 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 164 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 165 ->set_eq_string("pkg0"); 166 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 167 168 attributionMatcher->set_position(Position::FIRST); 169 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 170 ->set_eq_string("pkg0"); 171 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 172 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 173 ->set_eq_string("pkg3"); 174 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 175 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 176 ->set_eq_string("pkg2"); 177 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 178 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 179 ->set_eq_string("pkg1"); 180 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 181 182 attributionMatcher->set_position(Position::LAST); 183 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 184 ->set_eq_string("pkg0"); 185 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 186 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 187 ->set_eq_string("pkg3"); 188 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 189 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 190 ->set_eq_string("pkg2"); 191 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 192 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 193 ->set_eq_string("pkg1"); 194 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 195 196 // Uid + tag. 197 attributionMatcher->set_position(Position::ANY); 198 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field( 199 ATTRIBUTION_TAG_FIELD_ID); 200 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 201 ->set_eq_string("pkg0"); 202 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 203 ->set_eq_string("location1"); 204 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 205 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 206 ->set_eq_string("pkg1"); 207 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 208 ->set_eq_string("location1"); 209 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 210 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 211 ->set_eq_string("pkg1"); 212 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 213 ->set_eq_string("location2"); 214 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 215 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 216 ->set_eq_string("pkg2"); 217 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 218 ->set_eq_string("location3"); 219 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 220 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 221 ->set_eq_string("pkg3"); 222 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 223 ->set_eq_string("location3"); 224 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 225 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 226 ->set_eq_string("pkg3"); 227 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 228 ->set_eq_string("location1"); 229 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 230 231 attributionMatcher->set_position(Position::FIRST); 232 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 233 ->set_eq_string("pkg0"); 234 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 235 ->set_eq_string("location1"); 236 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 237 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 238 ->set_eq_string("pkg1"); 239 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 240 ->set_eq_string("location1"); 241 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 242 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 243 ->set_eq_string("pkg1"); 244 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 245 ->set_eq_string("location2"); 246 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 247 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 248 ->set_eq_string("pkg2"); 249 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 250 ->set_eq_string("location3"); 251 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 252 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 253 ->set_eq_string("pkg3"); 254 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 255 ->set_eq_string("location3"); 256 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 257 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 258 ->set_eq_string("pkg3"); 259 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 260 ->set_eq_string("location1"); 261 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 262 263 attributionMatcher->set_position(Position::LAST); 264 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 265 ->set_eq_string("pkg0"); 266 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 267 ->set_eq_string("location1"); 268 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 269 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 270 ->set_eq_string("pkg1"); 271 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 272 ->set_eq_string("location1"); 273 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 274 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 275 ->set_eq_string("pkg1"); 276 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 277 ->set_eq_string("location2"); 278 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 279 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 280 ->set_eq_string("pkg2"); 281 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 282 ->set_eq_string("location3"); 283 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 284 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 285 ->set_eq_string("pkg3"); 286 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 287 ->set_eq_string("location3"); 288 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 289 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(0) 290 ->set_eq_string("pkg3"); 291 attributionMatcher->mutable_matches_tuple()->mutable_field_value_matcher(1) 292 ->set_eq_string("location1"); 293 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 294 } 295 296 TEST(AtomMatcherTest, TestNeqAnyStringMatcher) { 297 UidMap uidMap; 298 uidMap.updateMap( 299 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */, 300 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"), 301 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */); 302 303 AttributionNodeInternal attribution_node1; 304 attribution_node1.set_uid(1111); 305 attribution_node1.set_tag("location1"); 306 307 AttributionNodeInternal attribution_node2; 308 attribution_node2.set_uid(2222); 309 attribution_node2.set_tag("location2"); 310 311 AttributionNodeInternal attribution_node3; 312 attribution_node3.set_uid(3333); 313 attribution_node3.set_tag("location3"); 314 315 AttributionNodeInternal attribution_node4; 316 attribution_node4.set_uid(1066); 317 attribution_node4.set_tag("location3"); 318 std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2, 319 attribution_node3, attribution_node4}; 320 321 // Set up the event 322 LogEvent event(TAG_ID, 0); 323 event.write(attribution_nodes); 324 event.write("some value"); 325 // Convert to a LogEvent 326 event.init(); 327 328 // Set up the matcher 329 AtomMatcher matcher; 330 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 331 simpleMatcher->set_atom_id(TAG_ID); 332 333 // Match first node. 334 auto attributionMatcher = simpleMatcher->add_field_value_matcher(); 335 attributionMatcher->set_field(FIELD_ID_1); 336 attributionMatcher->set_position(Position::FIRST); 337 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field( 338 ATTRIBUTION_UID_FIELD_ID); 339 auto neqStringList = attributionMatcher->mutable_matches_tuple() 340 ->mutable_field_value_matcher(0) 341 ->mutable_neq_any_string(); 342 neqStringList->add_str_value("pkg2"); 343 neqStringList->add_str_value("pkg3"); 344 345 auto fieldMatcher = simpleMatcher->add_field_value_matcher(); 346 fieldMatcher->set_field(FIELD_ID_2); 347 fieldMatcher->set_eq_string("some value"); 348 349 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 350 351 neqStringList->Clear(); 352 neqStringList->add_str_value("pkg1"); 353 neqStringList->add_str_value("pkg3"); 354 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 355 356 attributionMatcher->set_position(Position::ANY); 357 neqStringList->Clear(); 358 neqStringList->add_str_value("maps.com"); 359 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 360 361 neqStringList->Clear(); 362 neqStringList->add_str_value("PkG3"); 363 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 364 365 attributionMatcher->set_position(Position::LAST); 366 neqStringList->Clear(); 367 neqStringList->add_str_value("AID_STATSD"); 368 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 369 } 370 371 TEST(AtomMatcherTest, TestEqAnyStringMatcher) { 372 UidMap uidMap; 373 uidMap.updateMap( 374 1, {1111, 1111, 2222, 3333, 3333} /* uid list */, {1, 1, 2, 1, 2} /* version list */, 375 {android::String16("pkg0"), android::String16("pkg1"), android::String16("pkg1"), 376 android::String16("Pkg2"), android::String16("PkG3")} /* package name list */); 377 378 AttributionNodeInternal attribution_node1; 379 attribution_node1.set_uid(1067); 380 attribution_node1.set_tag("location1"); 381 382 AttributionNodeInternal attribution_node2; 383 attribution_node2.set_uid(2222); 384 attribution_node2.set_tag("location2"); 385 386 AttributionNodeInternal attribution_node3; 387 attribution_node3.set_uid(3333); 388 attribution_node3.set_tag("location3"); 389 390 AttributionNodeInternal attribution_node4; 391 attribution_node4.set_uid(1066); 392 attribution_node4.set_tag("location3"); 393 std::vector<AttributionNodeInternal> attribution_nodes = {attribution_node1, attribution_node2, 394 attribution_node3, attribution_node4}; 395 396 // Set up the event 397 LogEvent event(TAG_ID, 0); 398 event.write(attribution_nodes); 399 event.write("some value"); 400 // Convert to a LogEvent 401 event.init(); 402 403 // Set up the matcher 404 AtomMatcher matcher; 405 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 406 simpleMatcher->set_atom_id(TAG_ID); 407 408 // Match first node. 409 auto attributionMatcher = simpleMatcher->add_field_value_matcher(); 410 attributionMatcher->set_field(FIELD_ID_1); 411 attributionMatcher->set_position(Position::FIRST); 412 attributionMatcher->mutable_matches_tuple()->add_field_value_matcher()->set_field( 413 ATTRIBUTION_UID_FIELD_ID); 414 auto eqStringList = attributionMatcher->mutable_matches_tuple() 415 ->mutable_field_value_matcher(0) 416 ->mutable_eq_any_string(); 417 eqStringList->add_str_value("AID_ROOT"); 418 eqStringList->add_str_value("AID_INCIDENTD"); 419 420 auto fieldMatcher = simpleMatcher->add_field_value_matcher(); 421 fieldMatcher->set_field(FIELD_ID_2); 422 fieldMatcher->set_eq_string("some value"); 423 424 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 425 426 attributionMatcher->set_position(Position::ANY); 427 eqStringList->Clear(); 428 eqStringList->add_str_value("AID_STATSD"); 429 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 430 431 eqStringList->Clear(); 432 eqStringList->add_str_value("pkg1"); 433 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 434 435 auto normalStringField = fieldMatcher->mutable_eq_any_string(); 436 normalStringField->add_str_value("some value123"); 437 normalStringField->add_str_value("some value"); 438 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 439 440 normalStringField->Clear(); 441 normalStringField->add_str_value("AID_STATSD"); 442 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 443 444 eqStringList->Clear(); 445 eqStringList->add_str_value("maps.com"); 446 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 447 } 448 449 TEST(AtomMatcherTest, TestBoolMatcher) { 450 UidMap uidMap; 451 // Set up the matcher 452 AtomMatcher matcher; 453 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 454 simpleMatcher->set_atom_id(TAG_ID); 455 auto keyValue1 = simpleMatcher->add_field_value_matcher(); 456 keyValue1->set_field(FIELD_ID_1); 457 auto keyValue2 = simpleMatcher->add_field_value_matcher(); 458 keyValue2->set_field(FIELD_ID_2); 459 460 // Set up the event 461 LogEvent event(TAG_ID, 0); 462 EXPECT_TRUE(event.write(true)); 463 EXPECT_TRUE(event.write(false)); 464 // Convert to a LogEvent 465 event.init(); 466 467 // Test 468 keyValue1->set_eq_bool(true); 469 keyValue2->set_eq_bool(false); 470 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 471 472 keyValue1->set_eq_bool(false); 473 keyValue2->set_eq_bool(false); 474 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 475 476 keyValue1->set_eq_bool(false); 477 keyValue2->set_eq_bool(true); 478 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 479 480 keyValue1->set_eq_bool(true); 481 keyValue2->set_eq_bool(true); 482 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 483 } 484 485 TEST(AtomMatcherTest, TestStringMatcher) { 486 UidMap uidMap; 487 // Set up the matcher 488 AtomMatcher matcher; 489 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 490 simpleMatcher->set_atom_id(TAG_ID); 491 auto keyValue = simpleMatcher->add_field_value_matcher(); 492 keyValue->set_field(FIELD_ID_1); 493 keyValue->set_eq_string("some value"); 494 495 // Set up the event 496 LogEvent event(TAG_ID, 0); 497 event.write("some value"); 498 // Convert to a LogEvent 499 event.init(); 500 501 // Test 502 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 503 } 504 505 TEST(AtomMatcherTest, TestMultiFieldsMatcher) { 506 UidMap uidMap; 507 // Set up the matcher 508 AtomMatcher matcher; 509 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 510 simpleMatcher->set_atom_id(TAG_ID); 511 auto keyValue1 = simpleMatcher->add_field_value_matcher(); 512 keyValue1->set_field(FIELD_ID_1); 513 auto keyValue2 = simpleMatcher->add_field_value_matcher(); 514 keyValue2->set_field(FIELD_ID_2); 515 516 // Set up the event 517 LogEvent event(TAG_ID, 0); 518 event.write(2); 519 event.write(3); 520 521 // Convert to a LogEvent 522 event.init(); 523 524 // Test 525 keyValue1->set_eq_int(2); 526 keyValue2->set_eq_int(3); 527 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 528 529 keyValue1->set_eq_int(2); 530 keyValue2->set_eq_int(4); 531 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 532 533 keyValue1->set_eq_int(4); 534 keyValue2->set_eq_int(3); 535 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 536 } 537 538 TEST(AtomMatcherTest, TestIntComparisonMatcher) { 539 UidMap uidMap; 540 // Set up the matcher 541 AtomMatcher matcher; 542 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 543 544 simpleMatcher->set_atom_id(TAG_ID); 545 auto keyValue = simpleMatcher->add_field_value_matcher(); 546 keyValue->set_field(FIELD_ID_1); 547 548 // Set up the event 549 LogEvent event(TAG_ID, 0); 550 event.write(11); 551 event.init(); 552 553 // Test 554 555 // eq_int 556 keyValue->set_eq_int(10); 557 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 558 keyValue->set_eq_int(11); 559 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 560 keyValue->set_eq_int(12); 561 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 562 563 // lt_int 564 keyValue->set_lt_int(10); 565 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 566 keyValue->set_lt_int(11); 567 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 568 keyValue->set_lt_int(12); 569 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 570 571 // lte_int 572 keyValue->set_lte_int(10); 573 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 574 keyValue->set_lte_int(11); 575 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 576 keyValue->set_lte_int(12); 577 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 578 579 // gt_int 580 keyValue->set_gt_int(10); 581 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 582 keyValue->set_gt_int(11); 583 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 584 keyValue->set_gt_int(12); 585 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 586 587 // gte_int 588 keyValue->set_gte_int(10); 589 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 590 keyValue->set_gte_int(11); 591 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event)); 592 keyValue->set_gte_int(12); 593 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event)); 594 } 595 596 TEST(AtomMatcherTest, TestFloatComparisonMatcher) { 597 UidMap uidMap; 598 // Set up the matcher 599 AtomMatcher matcher; 600 auto simpleMatcher = matcher.mutable_simple_atom_matcher(); 601 simpleMatcher->set_atom_id(TAG_ID); 602 603 auto keyValue = simpleMatcher->add_field_value_matcher(); 604 keyValue->set_field(FIELD_ID_1); 605 606 LogEvent event1(TAG_ID, 0); 607 keyValue->set_lt_float(10.0); 608 event1.write(10.1f); 609 event1.init(); 610 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event1)); 611 612 LogEvent event2(TAG_ID, 0); 613 event2.write(9.9f); 614 event2.init(); 615 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event2)); 616 617 LogEvent event3(TAG_ID, 0); 618 event3.write(10.1f); 619 event3.init(); 620 keyValue->set_gt_float(10.0); 621 EXPECT_TRUE(matchesSimple(uidMap, *simpleMatcher, event3)); 622 623 LogEvent event4(TAG_ID, 0); 624 event4.write(9.9f); 625 event4.init(); 626 EXPECT_FALSE(matchesSimple(uidMap, *simpleMatcher, event4)); 627 } 628 629 // Helper for the composite matchers. 630 void addSimpleMatcher(SimpleAtomMatcher* simpleMatcher, int tag, int key, int val) { 631 simpleMatcher->set_atom_id(tag); 632 auto keyValue = simpleMatcher->add_field_value_matcher(); 633 keyValue->set_field(key); 634 keyValue->set_eq_int(val); 635 } 636 637 TEST(AtomMatcherTest, TestAndMatcher) { 638 // Set up the matcher 639 LogicalOperation operation = LogicalOperation::AND; 640 641 vector<int> children; 642 children.push_back(0); 643 children.push_back(1); 644 children.push_back(2); 645 646 vector<MatchingState> matcherResults; 647 matcherResults.push_back(MatchingState::kMatched); 648 matcherResults.push_back(MatchingState::kNotMatched); 649 matcherResults.push_back(MatchingState::kMatched); 650 651 EXPECT_FALSE(combinationMatch(children, operation, matcherResults)); 652 653 matcherResults.clear(); 654 matcherResults.push_back(MatchingState::kMatched); 655 matcherResults.push_back(MatchingState::kMatched); 656 matcherResults.push_back(MatchingState::kMatched); 657 658 EXPECT_TRUE(combinationMatch(children, operation, matcherResults)); 659 } 660 661 TEST(AtomMatcherTest, TestOrMatcher) { 662 // Set up the matcher 663 LogicalOperation operation = LogicalOperation::OR; 664 665 vector<int> children; 666 children.push_back(0); 667 children.push_back(1); 668 children.push_back(2); 669 670 vector<MatchingState> matcherResults; 671 matcherResults.push_back(MatchingState::kMatched); 672 matcherResults.push_back(MatchingState::kNotMatched); 673 matcherResults.push_back(MatchingState::kMatched); 674 675 EXPECT_TRUE(combinationMatch(children, operation, matcherResults)); 676 677 matcherResults.clear(); 678 matcherResults.push_back(MatchingState::kNotMatched); 679 matcherResults.push_back(MatchingState::kNotMatched); 680 matcherResults.push_back(MatchingState::kNotMatched); 681 682 EXPECT_FALSE(combinationMatch(children, operation, matcherResults)); 683 } 684 685 TEST(AtomMatcherTest, TestNotMatcher) { 686 // Set up the matcher 687 LogicalOperation operation = LogicalOperation::NOT; 688 689 vector<int> children; 690 children.push_back(0); 691 692 vector<MatchingState> matcherResults; 693 matcherResults.push_back(MatchingState::kMatched); 694 695 EXPECT_FALSE(combinationMatch(children, operation, matcherResults)); 696 697 matcherResults.clear(); 698 matcherResults.push_back(MatchingState::kNotMatched); 699 EXPECT_TRUE(combinationMatch(children, operation, matcherResults)); 700 } 701 702 TEST(AtomMatcherTest, TestNandMatcher) { 703 // Set up the matcher 704 LogicalOperation operation = LogicalOperation::NAND; 705 706 vector<int> children; 707 children.push_back(0); 708 children.push_back(1); 709 710 vector<MatchingState> matcherResults; 711 matcherResults.push_back(MatchingState::kMatched); 712 matcherResults.push_back(MatchingState::kNotMatched); 713 714 EXPECT_TRUE(combinationMatch(children, operation, matcherResults)); 715 716 matcherResults.clear(); 717 matcherResults.push_back(MatchingState::kNotMatched); 718 matcherResults.push_back(MatchingState::kNotMatched); 719 EXPECT_TRUE(combinationMatch(children, operation, matcherResults)); 720 721 matcherResults.clear(); 722 matcherResults.push_back(MatchingState::kMatched); 723 matcherResults.push_back(MatchingState::kMatched); 724 EXPECT_FALSE(combinationMatch(children, operation, matcherResults)); 725 } 726 727 TEST(AtomMatcherTest, TestNorMatcher) { 728 // Set up the matcher 729 LogicalOperation operation = LogicalOperation::NOR; 730 731 vector<int> children; 732 children.push_back(0); 733 children.push_back(1); 734 735 vector<MatchingState> matcherResults; 736 matcherResults.push_back(MatchingState::kMatched); 737 matcherResults.push_back(MatchingState::kNotMatched); 738 739 EXPECT_FALSE(combinationMatch(children, operation, matcherResults)); 740 741 matcherResults.clear(); 742 matcherResults.push_back(MatchingState::kNotMatched); 743 matcherResults.push_back(MatchingState::kNotMatched); 744 EXPECT_TRUE(combinationMatch(children, operation, matcherResults)); 745 746 matcherResults.clear(); 747 matcherResults.push_back(MatchingState::kMatched); 748 matcherResults.push_back(MatchingState::kMatched); 749 EXPECT_FALSE(combinationMatch(children, operation, matcherResults)); 750 } 751 #else 752 GTEST_LOG_(INFO) << "This test does nothing.\n"; 753 #endif 754
