tests: add bug 7709 tests

diff --git a/tests/pop3-02-bug-7709/README.md b/tests/pop3-02-bug-7709/README.md
new file mode 100644 (file)
index 0000000..162b265
--- /dev/null
+++ b/tests/pop3-02-bug-7709/README.md
@@ -0,0 +1,4 @@
+Pcap
+====
+
+https://redmine.openinfosecfoundation.org/issues/7709

diff --git a/tests/pop3-02-bug-7709/input.pcap b/tests/pop3-02-bug-7709/input.pcap
new file mode 100644 (file)
index 0000000..f8cdd46
Binary files /dev/null and b/tests/pop3-02-bug-7709/input.pcap differ

diff --git a/tests/pop3-02-bug-7709/test.yaml b/tests/pop3-02-bug-7709/test.yaml
new file mode 100644 (file)
index 0000000..d5745ab
--- /dev/null
+++ b/tests/pop3-02-bug-7709/test.yaml
@@ -0,0 +1,62 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+      app_proto: pop3
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: true
+      pop3.response.status: "OK"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: false
+      pop3.response.header: "the password incorrect"
+      pop3.response.status: "ERR"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "LIST"
+      pop3.request.args: []
+      pop3.response.success: true
+      pop3.response.status: "OK"
+      pop3.response.header: "5 21639"
+      pop3.response.data[0]: "1 247"
+      pop3.response.data[1]: "2 6668"
+      pop3.response.data[2]: "3 6668"
+      pop3.response.data[3]: "4 1388"
+      pop3.response.data[4]: "5 6668"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "UIDL"
+      pop3.request.args: []
+      pop3.response.success: true
+      pop3.response.status: "OK"
+      pop3.response.header: ""
+      pop3.response.data[0]: "1 test.tt.com.cmailserver.1"
+      pop3.response.data[1]: "2 test.tt.com.cmailserver.2"
+      pop3.response.data[2]: "3 test.tt.com.cmailserver.3"
+      pop3.response.data[3]: "4 test.tt.com.cmailserver.4"
+      pop3.response.data[4]: "5 test.tt.com.cmailserver.5"
+
+- filter:
+    count: 2
+    match:
+      pop3.request.command: "QUIT"
+      pop3.response.success: true
+      pop3.response.status: "OK"

diff --git a/tests/pop3-03-bug-7709/README.md b/tests/pop3-03-bug-7709/README.md
new file mode 100644 (file)
index 0000000..162b265
--- /dev/null
+++ b/tests/pop3-03-bug-7709/README.md
@@ -0,0 +1,4 @@
+Pcap
+====
+
+https://redmine.openinfosecfoundation.org/issues/7709

diff --git a/tests/pop3-03-bug-7709/input.pcap b/tests/pop3-03-bug-7709/input.pcap
new file mode 100644 (file)
index 0000000..3b3b586
Binary files /dev/null and b/tests/pop3-03-bug-7709/input.pcap differ

diff --git a/tests/pop3-03-bug-7709/test.yaml b/tests/pop3-03-bug-7709/test.yaml
new file mode 100644 (file)
index 0000000..aca7912
--- /dev/null
+++ b/tests/pop3-03-bug-7709/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+      app_proto: pop3
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: true
+      pop3.response.status: "OK"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: false
+      pop3.response.header: "the password incorrect"
+      pop3.response.status: "ERR"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "LIST"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "QUIT"
+      pop3.response.success: true
+      pop3.response.status: "OK"