From: Philippe Antoine Date: Fri, 4 Jun 2021 13:02:12 +0000 (+0200) Subject: Adds test for SMTP with RFC2231 X-Git-Tag: suricata-6.0.5~66 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a11d294a2a6fe5b4160c412467516ccd0eeea29e;p=thirdparty%2Fsuricata-verify.git Adds test for SMTP with RFC2231 ie attachment filename split over multiple sections --- diff --git a/tests/smtp-rfc2231/README.md b/tests/smtp-rfc2231/README.md new file mode 100644 index 000000000..9f03744c1 --- /dev/null +++ b/tests/smtp-rfc2231/README.md @@ -0,0 +1,7 @@ +# Description + +Test smtp MIME parameter extension/continuation as defined in RFC2231. + +# PCAP + +The pcap comes from https://redmine.openinfosecfoundation.org/issues/4386 diff --git a/tests/smtp-rfc2231/input.pcap b/tests/smtp-rfc2231/input.pcap new file mode 100644 index 000000000..b2fb448a6 Binary files /dev/null and b/tests/smtp-rfc2231/input.pcap differ diff --git a/tests/smtp-rfc2231/test.yaml b/tests/smtp-rfc2231/test.yaml new file mode 100644 index 000000000..b2fdd929c --- /dev/null +++ b/tests/smtp-rfc2231/test.yaml @@ -0,0 +1,13 @@ +# disables checksum verification +args: + - -k none + +checks: + + # Check that there is one fileinfo/SMTP event with specific parameters. + - filter: + count: 1 + match: + event_type: fileinfo + app_proto: smtp + fileinfo.filename: smtptest-2021-02-25T13-54-22Z-aefb2fc1308d62f4b6c74769f69b13ddf80e995fd98ae442f3be499ea928c67f..zip