From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 11 Nov 2021 22:44:25 +0000 (-0600)
Subject: smtp-starttls: test logging of smtp txn after startssl
X-Git-Tag: suricata-6.0.5~48
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4e67f681718d9d3e4a340590e620ae28d7ab6eed;p=thirdparty%2Fsuricata-verify.git

smtp-starttls: test logging of smtp txn after startssl

For ticket https://redmine.openinfosecfoundation.org/issues/4817.
---

diff --git a/tests/smtp-startssl/README.md b/tests/smtp-startssl/README.md
new file mode 100644
index 000000000..1f879f768
--- /dev/null
+++ b/tests/smtp-startssl/README.md
@@ -0,0 +1,4 @@
+Tests that an SMTP transaction with STARTTLS still logs an SMTP event, even if
+no email is present.
+
+Ticket: https://redmine.openinfosecfoundation.org/issues/4817
diff --git a/tests/smtp-startssl/input.pcap b/tests/smtp-startssl/input.pcap
new file mode 100644
index 000000000..9a1046ad9
Binary files /dev/null and b/tests/smtp-startssl/input.pcap differ
diff --git a/tests/smtp-startssl/test.yaml b/tests/smtp-startssl/test.yaml
new file mode 100644
index 000000000..9a36190b9
--- /dev/null
+++ b/tests/smtp-startssl/test.yaml
@@ -0,0 +1,16 @@
+requires:
+  min-version: 7
+
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: smtp
+  - filter:
+      count: 1
+      match:
+        smtp.helo: "desktop.unx.ca"
+        not-has-key: "email"