]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
detect: add test for email.date keyword
authorAlice Akaki <akakialice@gmail.com>
Fri, 28 Mar 2025 20:12:27 +0000 (16:12 -0400)
committerVictor Julien <victor@inliniac.net>
Sat, 29 Mar 2025 21:13:59 +0000 (22:13 +0100)
tests/detect-email-date/README.md [new file with mode: 0644]
tests/detect-email-date/test.rules [new file with mode: 0644]
tests/detect-email-date/test.yaml [new file with mode: 0644]

diff --git a/tests/detect-email-date/README.md b/tests/detect-email-date/README.md
new file mode 100644 (file)
index 0000000..4ceb453
--- /dev/null
@@ -0,0 +1,8 @@
+# Test Description
+Test mime email.date keyword
+
+## PCAP
+From ../mime/mime-dec-parse-full-msg-test02/input.pcap
+
+## Redmine Ticket
+https://redmine.openinfosecfoundation.org/issues/7591
diff --git a/tests/detect-email-date/test.rules b/tests/detect-email-date/test.rules
new file mode 100644 (file)
index 0000000..f4145a4
--- /dev/null
@@ -0,0 +1 @@
+alert smtp any any -> any any (msg:"Test mime email date"; email.date; content:"Fri, 21 Apr 2023 05:10:36 +0000"; startswith; endswith; bsize:31; sid:1;)
diff --git a/tests/detect-email-date/test.yaml b/tests/detect-email-date/test.yaml
new file mode 100644 (file)
index 0000000..54585f3
--- /dev/null
@@ -0,0 +1,16 @@
+requires:
+  min-version: 8
+
+pcap: ../mime/mime-dec-parse-full-msg-test02/input.pcap
+
+args:
+  - -k none --set stream.inline=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      email.date: Fri, 21 Apr 2023 05:10:36 +0000
+      pcap_cnt: 13
+      alert.signature_id: 1