smtp: adds test for invalid replies

Ticket: 1125

diff --git a/tests/smtp-errors/README.md b/tests/smtp-errors/README.md
new file mode 100644 (file)
index 0000000..ba710d1
--- /dev/null
+++ b/tests/smtp-errors/README.md
@@ -0,0 +1,13 @@
+# Test Description
+
+Test some SMTP parser errors on unknown reply codes
+
+## PCAP
+
+extract from QA TLPW1
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/1125
+https://redmine.openinfosecfoundation.org/issues/5491
+https://redmine.openinfosecfoundation.org/issues/6821

diff --git a/tests/smtp-errors/smtperr.pcap b/tests/smtp-errors/smtperr.pcap
new file mode 100644 (file)
index 0000000..b8c3422
Binary files /dev/null and b/tests/smtp-errors/smtperr.pcap differ

diff --git a/tests/smtp-errors/test.yaml b/tests/smtp-errors/test.yaml
new file mode 100644 (file)
index 0000000..e03549c
--- /dev/null
+++ b/tests/smtp-errors/test.yaml
@@ -0,0 +1,43 @@
+requires:
+  min-version: 8
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.event: INVALID_REPLY
+        # 472 unusualz@prg-dc.dhl.com DNS A-record is empty
+        src_port: 49740
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.event: INVALID_REPLY
+        # 500 5.5.1 Command unrecognized: + junk on new line
+        src_port: 49274
+  - filter:
+      count: 3
+      match:
+        event_type: anomaly
+        anomaly.event: INVALID_REPLY
+        #no anomaly for 4.7.0 [IPTS04] Messages from 173.166.146.112 temporarily deferred due to user complaints because tx got closed before
+        #src_port: 49448
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.event: INVALID_REPLY
+        # client does tls hello, smtp server replies with
+        #400 4.5.2 Error: bad syntax
+        src_port: 50649
+  - filter:
+      count: 1
+      match:
+        event_type: stats
+        # no anomaly but error for 4.7.0
+        stats.app_layer.error.smtp.parser: 4