From aaa957178c423db73ea2a7ae4ed28a1a786eaa56 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Tue, 7 Oct 2025 13:30:22 +0200
Subject: [PATCH] tests: add bug 7709 tests

---
 tests/pop3-02-bug-7709/README.md  |   4 ++
 tests/pop3-02-bug-7709/input.pcap | Bin 0 -> 10784 bytes
 tests/pop3-02-bug-7709/test.yaml  |  62 ++++++++++++++++++++++++++++++
 tests/pop3-03-bug-7709/README.md  |   4 ++
 tests/pop3-03-bug-7709/input.pcap | Bin 0 -> 2625 bytes
 tests/pop3-03-bug-7709/test.yaml  |  39 +++++++++++++++++++
 6 files changed, 109 insertions(+)
 create mode 100644 tests/pop3-02-bug-7709/README.md
 create mode 100644 tests/pop3-02-bug-7709/input.pcap
 create mode 100644 tests/pop3-02-bug-7709/test.yaml
 create mode 100644 tests/pop3-03-bug-7709/README.md
 create mode 100644 tests/pop3-03-bug-7709/input.pcap
 create mode 100644 tests/pop3-03-bug-7709/test.yaml

diff --git a/tests/pop3-02-bug-7709/README.md b/tests/pop3-02-bug-7709/README.md
new file mode 100644
index 000000000..162b265a0
--- /dev/null
+++ b/tests/pop3-02-bug-7709/README.md
@@ -0,0 +1,4 @@
+Pcap
+====
+
+https://redmine.openinfosecfoundation.org/issues/7709
diff --git a/tests/pop3-02-bug-7709/input.pcap b/tests/pop3-02-bug-7709/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..f8cdd465479847f58c80e4b3bb864af4f558de96
GIT binary patch
literal 10784
zc-pO+d2k!m9mhA0fyA{TY3U?0>6FDOC2k^lPhFO5blFxd$+9HpGz}|hZLN{Cj<h}$
zH4H7sKb^KSbQ;3Z($a8r$h1QX6exs0GT{g`GeAq}l%#YBw3C4}94#R;rTx8Kt+d*#
zHok1HrQP@ZdEfWj-}~-w*ZSj;-~7A<YsKnct=J0qeGh$2*80`UFdw`}8`j>{`=d4R
z`<+7{ufl>D#*B4chuwTBhOJt)s-+EEF}ME_tZ??!)xSWUZ*IY{4G&{jOY0?%tysCT
zWyOlt7DT-1s>`rmXzx{sz*4v}k*LJ3!}=~g_#Z?=RIIT7k@!y@jsx}J)ECd6eX*@d
ztkUiPnhiiUBYm63zG0~EAP^I=HRsQ6xL29w>w8vX0ssUfO}i>1vZiA?O$kJbtv`SE
z?Z+@|^Y9S<`mtv||J~=uKYadE+#lhDT!Jso@I{=pQh01QM&oE-Nb`7{=Q8DvHZ-tU
zT8$0Dn1e?0U1OV@%D){3es;sJFl;mtjN=ktlCF~^Yg)`J+{8@{+{OvHDsg#2r*#v$
z9oSC*_vDH9lnKr9IUw?QmM`)O_XKeLfb<*bWyiJ{>U{#(2Y~y?hF@Y>%$rEyBt<i<
zO+kL==G9mNXbB^!!Ae4wdQvC#0AP;*@>SHy5{yF#vOGS;l}fW>F@p<*v{)?iX-OI4
zPcVcV=x!s`)-j8r>LW1B<1oYzHr$V4Bcq|D!s`6)YOD`1eMWN0N>Y~lp-%4Oz<UW;
zFCXHS$fnAC9jB4jh}%>dm2scxaEE2w+Vd}el2TVJVmW|ivKFj{(|ied&%s)_O<fCv
z=9F#|%Gx^R1E84r2BD)I!U|9Q<JePXz9HUX8mX;vq|WIg^&DtB2D5wl6HXhcFW<V_
z%!9Vctbb`(hsL*ed;kicMjrIm-HjeZ-D(;!(r~U%1M!U3gZ}y3b~6v!E^9iX({u)r
zkO%!cuxJk&d8{4t!kAto`ScjoO#bCp%O3QQ#)A~#@u%C(%x8x@lXn_ta{1K&Jqo~g
zKbmP~K5Kv9Ze~8Tq0pnirkk42(P!G5CzZ9bQ<i#0CzS^5Yk++7wmTH53Tyn?b~Be@
z4CTEBJSVUoKrWL=daEvDKin|YMqO-Wm#phOoh~Qv-UQZbkN#KD#o`ocqn!#;IBY79
zHI(-zVEX}i0Lcr75><Ia&zZ^_ljXgulh+TtlfZiA(X%>v_X6_D{g~MzvKh)d30QO?
z{~lUIh;sY@hTVWE+XcenmFs0;FX)6NRAHZf8!Q~B7<)$>h1+a4M@Ji7ePwWxcEBrJ
z-M1>Le|Q&W7F2sv)%##P4h3~I6bLJ<_wL5ba`9UiT(gn(eZV^ftmkhVRC5ur9{R&d
zvuHXDb)5p<EfCFJYBcXVz7jhIfMZ6Ao~i7X746a~x<yrV`c4#0WD8cMG_j`h;7BFe
zk*p+&akEAW1-@A$jm}21Mh2atW{qs^yxsAIR_z6#F+RkYvsrwuSQlIW*$W#ELNW!D
zahz3X|7&l>1^_f*6enlp202bA8sl`uIv~CeaXNhXFUpxiiG_=4iI++W_MVPb?DQp=
zyy>x*yj9^4_CBW$yGh2bIe+-o?I4m*^TG_DapB`dF^|Xm7K)%~f~FiK#SoiFCuJpV
z4l79zR+1vRAbD1&%D56ad{&UM7hFUVkz}j~PiCjL;3SJjxH1kz7AG7oigYmqzL{_k
zL`PeIlX%y~yY+)A7v7l$nbq>O6L)L&dOO;ZB6QHyx6nbe2OSdAsY$5xT)3xiz(>&}
z)#vM*b_$FX5GT~v(sX!;3=GC*Cp?}$Pe)svABU?-A<dUuxEm=WSdt+eEJabIgK-cH
z%c=uxK|!hYAz66iB%BOOl0>sEjE$xkl5yIc&AQkKmatJYO)v~upUHMhtSE>@K`Og&
z8to2pC5u;*xOCQq7esUfoejR|!u!QJl-Ic3N?9q^O5538>B99LZ4n{QTekAWk{}jb
zIBA6#NBB~So8T>>Kz*((;h<o`w1c%f9JaawzgUp?f@DdSr{MJEr*o1p#TBJ)E+_HD
z0w+N(^`IOPrwbXbSoU;U;LEd{AjsWOeol%(Uy_7r!So#rL+tjT_RfwrIE`7Mgu@S~
zP%Q|H=M`yCuH%tVB#4iT#XKijQGbhNK4`sS33_%<<v5{$WTvxRvBXQBP9-loHNA^m
zp#&*l3Brv+Mkq|U@Dx|#Z44SZFd|0%6U0zpWNLEfwrFl-FiwQ?(V5f;F%<F=Ly~RC
z(OsGhi*|7$Gq81UCg>wFes(fN5mA4U7s?KLsFd1!BWj26PkPJI1ThQST-5KKi%yEO
zQ6QD2Z8gdcYU|`qI7ZHlN0>dsworIx$8>l^^BNY)(#Tv#+g?Ygs!h>&!T5q#)-V&Z
zhsrh}4aRe6I_}L3j!f^MoKj$94=t8vqUGWMx|j_?k3eWPGC3+m0<a}VCL+mETQsmE
z>Ms?y)+htf+zx6q>X%aV-r=FiX~A!&!U8c|e}!6-DHTT}>27~Le(+k*k1tNh8j5>2
zmm||a@?8*P$rgqy;@<S0xtZYv^zfD=fe;x^dSMF^p+JxvhL{FMibG_oMj>`?j}lsn
zHkKW2+9>K{C`W&E{xL)uQjel>3?mT3^u=OWMiGMyX^ffb{NHWC<W2AVEm9?god5ox
zH9G&5Z>blQcK9Qs$a|K!u(DD<x8QZPXIhl_jAg1Q6eKQ{<B<k8BK5kna1YY!&hrw7
zXC-OM!ta?DW;}GDGhM|=Fm@+i-9rs^8Mq<>ri2=*LVDdLshs0`Q(~r!SMZ!r;4N8R
zn8-@V3)vogUn(c2Z<HlLd!8#!2nCBIPPuSmYOV)h>amn4N$Apq4y(s<{5Wt3E6eAB
zlo4jE;KBi6M(e4xle9B-xYAV+Y+qH#ILyFO681tMNd^(+1LIs?$br>+{6UYG^7tK|
zV89a~J$}~X^Lhean4_2z!R(6@084Emw&3WetH)?!?rvr3?rtTjXyjfG;dO&f2+I^#
zfF|Vy!HTelT53INN8H&WE~8MqXN8QEb)k&>HDshoLFqCqnBE`XzHXCxkBcaOHm_*X
zaz$fr%<FZvil%=XhQTd^d`@b!hn-F(P%tl~d1H!AGnw&D90eR5AUkm`CrlL3dvp#v
z^>Kl>^(jZZ@qtj(g-)L`QvYx?Y3cVyLg5`Q9Lk^!SKz8g6QP|!7wQH~8K@~;s?k)U
z3@Kj?el6;nOstJvO|+z%kZR`nwAl!->fx|9A*;vYN?3#f+%^lUtgjbRrKz5(qK4U`
zTo8*HC@BhJf$ve?%PXQJ=7bEs(Z~9kKtHM^rlg)JE+a2$8tvgkI<IcZI4EW{a?BeD
zgrWnMcxYfS>B1dIx_T@e>{kzI<4D1QTC@QM0hhR}nCE)@!{On$Ya=0l_253Qe`p{+
zJQ{_PW+Rkx@Lh-dhLg$RNaKhAvm}RO^1*6M+^JrV&yE(J&+q9EqUGoJdAu~NJ$H9X
z4H-C7ksnvijgXT>7u24}bJSwAS5u3+ySd(aj5PxQ*B|isy&fNl1`9HpVE`tNgiORj
zuojY0MkZ}8g4NN05Ma&ZqCC4mv9`FD6VyOwz~<?<d;Fk{sxbkkVtqbOz~S-14+D0k
z+oRAQA!!U)SHH(kX)|9P2ViRMrE^@Vg!DCc&(0>!RW&Jq&C|Ke+@fj~09(3Ss8#{6
z1-L~+?r39H^Xa9#g=!T5Te@4QRspbuxCL_lx6Lb>j9k(Dw9)y$Qmbgzeu!blo>LX4
zSpQNzM==~UyJhek#c%+&9G;`(iL7kto}(BJ!1SKOx)|F+Jx7rXu;uU^g$c0b@EqkA
zGK&j5N6ko+T7;Kt5w<ZSud3A|mNJHE@8((3ZlhW9BF?2OW{|WT&ZXEEa@J*VE@cS-
zY&o1uEqa#4xn$cy$+{fQCEFHSMoX!48j2i%EraJ&4F_F6mhL%K!>L|#7w0+p6^yPQ
zOZS|r;Q&nIIRv#h&#B5q(`<0bi(BNvtY-mc)95rPHEIQp@?4N)DAqv{^RkIXk3hBE
z5^SQ;BT&`31e<8|2vqhj=yu5LUI<`IunC<<pw!UW1akhro7W=aaxHRiqw{~QR*MuK
zz_10Fjm~LMuoiDNI;TO|x_GnEISs&;U^aTE0rOu(fn&UM>o*UJF`Jsx&@RUA?p80p
zi!&RYH==v-MHDzaT2nz8dD{HxN>8(=E7vwWU3u{GR%`%rdcY{Jos|hWuit3Q>uWdF
zYV7Z0Sk2(nC|%U!8VnBJ*csYpXP5?40oeRJZaxMFu=#o1d<;&xZJ3A0&7%%dZ`Yc5
zTti#k@S3y%%&d8yZSq4v`DDruT<81n7d`$(-_`$>e(9Q4v;T3sn<ZzLGq(QR-|C;9
zLag;&t!AH|${PKrv<rQ%;Uh@VCm(Fre0mDuuHD>f_L(5T=yM2NJ{h<6{F7%^tDgx%
zENZjq8uS=W^CRH-V{6X6p{_yfs41n_gtE3yNj`5nuSt1cr*!l31L<S%gD20d(#~u0
k#WpiVeRV~y6W_dS|6N$&+?{{D?-lFEso0em_G4iEA1AOTW&i*H

literal 0
Hc-jL100001

diff --git a/tests/pop3-02-bug-7709/test.yaml b/tests/pop3-02-bug-7709/test.yaml
new file mode 100644
index 000000000..d5745ab06
--- /dev/null
+++ b/tests/pop3-02-bug-7709/test.yaml
@@ -0,0 +1,62 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+      app_proto: pop3
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: true
+      pop3.response.status: "OK"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: false
+      pop3.response.header: "the password incorrect"
+      pop3.response.status: "ERR"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "LIST"
+      pop3.request.args: []
+      pop3.response.success: true
+      pop3.response.status: "OK"
+      pop3.response.header: "5 21639"
+      pop3.response.data[0]: "1 247"
+      pop3.response.data[1]: "2 6668"
+      pop3.response.data[2]: "3 6668"
+      pop3.response.data[3]: "4 1388"
+      pop3.response.data[4]: "5 6668"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "UIDL"
+      pop3.request.args: []
+      pop3.response.success: true
+      pop3.response.status: "OK"
+      pop3.response.header: ""
+      pop3.response.data[0]: "1 test.tt.com.cmailserver.1"
+      pop3.response.data[1]: "2 test.tt.com.cmailserver.2"
+      pop3.response.data[2]: "3 test.tt.com.cmailserver.3"
+      pop3.response.data[3]: "4 test.tt.com.cmailserver.4"
+      pop3.response.data[4]: "5 test.tt.com.cmailserver.5"
+
+- filter:
+    count: 2
+    match:
+      pop3.request.command: "QUIT"
+      pop3.response.success: true
+      pop3.response.status: "OK"
diff --git a/tests/pop3-03-bug-7709/README.md b/tests/pop3-03-bug-7709/README.md
new file mode 100644
index 000000000..162b265a0
--- /dev/null
+++ b/tests/pop3-03-bug-7709/README.md
@@ -0,0 +1,4 @@
+Pcap
+====
+
+https://redmine.openinfosecfoundation.org/issues/7709
diff --git a/tests/pop3-03-bug-7709/input.pcap b/tests/pop3-03-bug-7709/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..3b3b5869e253d8f80d2095ccd7c75d339840183b
GIT binary patch
literal 2625
zc-ozoS!fec6oyZxNhUTfRRo2o%!6XB+M2CJkuJ8;)~#t%Q4p0{2O3OMGmXnw5Ur?4
zMO<D)MO<*HN*`QMP_ZJk;DbUdf{G|uP-_<#(3)uU+&igFhMW7)ff+I+_q*RY$@w$S
zAKy49fDwidBN*`NSU0_P+Zhuq!q?=4(X;Z8XW;ey_3sw&0JuUw3SqYyz+$lo>0sE=
z9Dv}oF-Ps>!@C6uY*zpTqv@6*Eln^Oi~=D>&YB<}-_O^G$kMo!I8QApgaY$rN+VPV
zHV4EzwR@22*fJq{r0r^)7^jUpXM$V=<+A)TLqC~*4kR{tGa_GXr?o13UyI;JfS={G
zR`n34OD}XzO@!o~96j=~3Sf5mGO6py{n(w@)35D6rQ#LU{(w(bw#ka*&UQ%Na<5Y&
z_x>7Ls+6lYsbkW~#yM|9D8)TXS^5h?gDLfIdnZR8*jfQr`8<_USZ)XxhQrx4^>rHe
z(1#>$azP8!#k8Owx`J*ay95i`^<uwP&~`b1L|Lkp6<OncL~b!6i&?(z&@ZNM39>uT
z_nNH*z+2?=Np^?R<<8ZR-#>}qLz<7J>QR?a)gGN{2VyHwH8j`_FxOLwEvS{HE!7PT
z+v}B0l0R5euPAa&Slc46M}&n)U&yk~4n>&O6}U||S|7HZ2dG$8R;97F_KHw|m;#or
zT`i@$e{{Ot$XkuNn=hKQ&TdrYVO)Y*GA>gsqtjs0;rb|Ud~|c4Ff_4*br4ycS%@;r
zT#dYboP~Wuvv876`OTq>AExB=iM-tSqodS8@W9%6=Xtr|?&o%DDeaU|*QtJVTjR~Z
zP8kwA1p^{4gO<@RF`B@t3(m;fiG~+Q1~u(X&Y(#H+>XVVwO&ACV`2t9oMPo=&~obZ
zOy|@{NF;+!%^h(DIj35o2=^>v={rMzQ|h<U47!|<K^pMebSp1>R?tcYbd|Is6oJuw
zCpM%CALk4!CwvrOinb!VEoJz8nQ2Y^qsmrSQq_n~wGFZNP<6-bMom>?b!J*QDWe#e
zdiRjmj(QhK%J`~^;wf`1E2-3EFSlAwy}s$Z+L8ANy_EHDH7}QBcg@eUYskSYuAacu
zdxY37)H^}+mY4bBdUxk=^}JN?t4^;AdH6RF4Xp2E=q;@p%NZgijj7jx*mpQY&18t2
zNO9dvhb#n;^DjN(6f+nsU?$Hs+C9;tM@y_F=E9X$|43H4aitg-$;v#k^0S%!>q}fo
s?k$#hd<`=a55k&)tRah}{tdB&1dIRF`M5IU74H#B8O7=RL;%wHe;F)*{{R30

literal 0
Hc-jL100001

diff --git a/tests/pop3-03-bug-7709/test.yaml b/tests/pop3-03-bug-7709/test.yaml
new file mode 100644
index 000000000..aca79125c
--- /dev/null
+++ b/tests/pop3-03-bug-7709/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: flow
+      app_proto: pop3
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: true
+      pop3.response.status: "OK"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "PASS"
+      pop3.response.success: false
+      pop3.response.header: "the password incorrect"
+      pop3.response.status: "ERR"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "LIST"
+
+- filter:
+    count: 1
+    match:
+      pop3.request.command: "QUIT"
+      pop3.response.success: true
+      pop3.response.status: "OK"
-- 
2.47.3