detect: add test for mime email keywords

Ticket: #7592

diff --git a/tests/detect-mime-email/README.md b/tests/detect-mime-email/README.md
new file mode 100644 (file)
index 0000000..34e0d24
--- /dev/null
+++ b/tests/detect-mime-email/README.md
@@ -0,0 +1,8 @@
+# Test Description
+Test mime email keywords
+
+## PCAP
+From ../mime/mime-dec-parse-full-msg-test02/input.pcap
+
+## Redmine Ticket
+https://redmine.openinfosecfoundation.org/issues/7592

diff --git a/tests/detect-mime-email/test.rules b/tests/detect-mime-email/test.rules
new file mode 100644 (file)
index 0000000..ace06cd
--- /dev/null
+++ b/tests/detect-mime-email/test.rules
@@ -0,0 +1,2 @@
+alert smtp any any -> any any (msg:"Test mime email from"; email.from; content:"toto <toto@gmail.com>"; sid:1;)
+alert smtp any any -> any any (msg:"Test mime email from"; email.from; content:"toto"; startswith; content:"com>"; endswith; bsize:21; sid:2;)
\ No newline at end of file

diff --git a/tests/detect-mime-email/test.yaml b/tests/detect-mime-email/test.yaml
new file mode 100644 (file)
index 0000000..d836d2e
--- /dev/null
+++ b/tests/detect-mime-email/test.yaml
@@ -0,0 +1,23 @@
+requires:
+  min-version: 8
+
+pcap: ../mime/mime-dec-parse-full-msg-test02/input.pcap
+
+args:
+  - -k none --set stream.inline=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      email.from: toto <toto@gmail.com>
+      pcap_cnt: 13
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      email.from: toto <toto@gmail.com>
+      pcap_cnt: 13
+      alert.signature_id: 2