From: Jason Ish <jason.ish@oisf.net>
Date: Fri, 3 Jul 2026 18:11:46 +0000 (-0600)
Subject: tests: update smtp-file-data-02 for tx progress changes
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cf41eaed81abe1d0c7d8bb73ceac548e36fce40f;p=thirdparty%2Fsuricata-verify.git

tests: update smtp-file-data-02 for tx progress changes

The SMTP TX now completes after the server response from DATA, not when
the client sends end of data. So the pcap_cnt for this test is now 53
instead of 51.
---

diff --git a/tests/smtp-file-data-02/test.yaml b/tests/smtp-file-data-02/test.yaml
index 9edb649b0..cdfc8ff77 100644
--- a/tests/smtp-file-data-02/test.yaml
+++ b/tests/smtp-file-data-02/test.yaml
@@ -8,6 +8,30 @@ args:
 
 checks:
 - filter:
+    requires:
+      min-version: 9
+    count: 1
+    match:
+      dest_ip: 74.53.140.153
+      dest_port: 25
+      email.attachment[0]: NEWS.txt
+      email.from: '"Gurpartap Singh" <gurpartap@patriots.in>'
+      email.status: PARSE_DONE
+      email.to[0]: <raj_deol2002in@yahoo.co.in>
+      event_type: smtp
+      pcap_cnt: 53
+      proto: TCP
+      smtp.helo: GP
+      smtp.mail_from: <gurpartap@patriots.in>
+      smtp.rcpt_to[0]: <raj_deol2002in@yahoo.co.in>
+      src_ip: 10.10.1.4
+      src_port: 1470
+      tx_id: 0
+# Pre-9 does not defer tx completion to the server response, so the
+# SMTP event lands two packets earlier. Remove when backported to 8.
+- filter:
+    requires:
+      lt-version: 9
     count: 1
     match:
       dest_ip: 74.53.140.153