From: Victor Julien <victor@inliniac.net>
Date: Tue, 7 Oct 2025 11:30:22 +0000 (+0200)
Subject: tests: add bug 7709 tests
X-Git-Tag: suricata-8.0.2~25
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F2684%2Fhead;p=thirdparty%2Fsuricata-verify.git

tests: add bug 7709 tests
---

diff --git a/tests/pop3-02-bug-7709/README.md b/tests/pop3-02-bug-7709/README.md
new file mode 100644
index 000000000..162b265a0
--- /dev/null
+++ b/tests/pop3-02-bug-7709/README.md
@@ -0,0 +1,4 @@
+Pcap
+====
+
+https://redmine.openinfosecfoundation.org/issues/7709
diff --git a/tests/pop3-02-bug-7709/input.pcap b/tests/pop3-02-bug-7709/input.pcap
new file mode 100644
index 000000000..f8cdd4654
Binary files /dev/null and b/tests/pop3-02-bug-7709/input.pcap differ
diff --git a/tests/pop3-02-bug-7709/test.yaml b/tests/pop3-02-bug-7709/test.yaml
new file mode 100644
index 000000000..d5745ab06
--- /dev/null
+++ b/tests/pop3-02-bug-7709/test.yaml
@@ -0,0 +1,62 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+      app_proto: pop3
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: true
+      pop3.response.status: "OK"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: false
+      pop3.response.header: "the password incorrect"
+      pop3.response.status: "ERR"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "LIST"
+      pop3.request.args: []
+      pop3.response.success: true
+      pop3.response.status: "OK"
+      pop3.response.header: "5 21639"
+      pop3.response.data[0]: "1 247"
+      pop3.response.data[1]: "2 6668"
+      pop3.response.data[2]: "3 6668"
+      pop3.response.data[3]: "4 1388"
+      pop3.response.data[4]: "5 6668"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "UIDL"
+      pop3.request.args: []
+      pop3.response.success: true
+      pop3.response.status: "OK"
+      pop3.response.header: ""
+      pop3.response.data[0]: "1 test.tt.com.cmailserver.1"
+      pop3.response.data[1]: "2 test.tt.com.cmailserver.2"
+      pop3.response.data[2]: "3 test.tt.com.cmailserver.3"
+      pop3.response.data[3]: "4 test.tt.com.cmailserver.4"
+      pop3.response.data[4]: "5 test.tt.com.cmailserver.5"
+
+- filter:
+    count: 2
+    match:
+      pop3.request.command: "QUIT"
+      pop3.response.success: true
+      pop3.response.status: "OK"
diff --git a/tests/pop3-03-bug-7709/README.md b/tests/pop3-03-bug-7709/README.md
new file mode 100644
index 000000000..162b265a0
--- /dev/null
+++ b/tests/pop3-03-bug-7709/README.md
@@ -0,0 +1,4 @@
+Pcap
+====
+
+https://redmine.openinfosecfoundation.org/issues/7709
diff --git a/tests/pop3-03-bug-7709/input.pcap b/tests/pop3-03-bug-7709/input.pcap
new file mode 100644
index 000000000..3b3b5869e
Binary files /dev/null and b/tests/pop3-03-bug-7709/input.pcap differ
diff --git a/tests/pop3-03-bug-7709/test.yaml b/tests/pop3-03-bug-7709/test.yaml
new file mode 100644
index 000000000..aca79125c
--- /dev/null
+++ b/tests/pop3-03-bug-7709/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+      app_proto: pop3
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: true
+      pop3.response.status: "OK"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: false
+      pop3.response.header: "the password incorrect"
+      pop3.response.status: "ERR"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "LIST"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "QUIT"
+      pop3.response.success: true
+      pop3.response.status: "OK"