Adds test for SMTP with RFC2231

ie attachment filename split over multiple sections

diff --git a/tests/smtp-rfc2231/README.md b/tests/smtp-rfc2231/README.md
new file mode 100644 (file)
index 0000000..9f03744
--- /dev/null
+++ b/tests/smtp-rfc2231/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test smtp MIME parameter extension/continuation as defined in RFC2231.
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/4386

diff --git a/tests/smtp-rfc2231/input.pcap b/tests/smtp-rfc2231/input.pcap
new file mode 100644 (file)
index 0000000..b2fb448
Binary files /dev/null and b/tests/smtp-rfc2231/input.pcap differ

diff --git a/tests/smtp-rfc2231/test.yaml b/tests/smtp-rfc2231/test.yaml
new file mode 100644 (file)
index 0000000..b2fdd92
--- /dev/null
+++ b/tests/smtp-rfc2231/test.yaml
@@ -0,0 +1,13 @@
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+
+  # Check that there is one fileinfo/SMTP event with specific parameters.
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+        app_proto: smtp
+        fileinfo.filename: smtptest-2021-02-25T13-54-22Z-aefb2fc1308d62f4b6c74769f69b13ddf80e995fd98ae442f3be499ea928c67f..zip