From: Alice Akaki <akakialice@gmail.com>
Date: Wed, 9 Apr 2025 19:21:21 +0000 (-0400)
Subject: detect: add test for email.url keyword
X-Git-Tag: suricata-7.0.11~94
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ff7b78a889dc778c63ff61dc3b86ee37aff6b3e3;p=thirdparty%2Fsuricata-verify.git

detect: add test for email.url keyword

Ticket: #7597
---

diff --git a/tests/detect-email-url/README.md b/tests/detect-email-url/README.md
new file mode 100644
index 000000000..6f471bfb2
--- /dev/null
+++ b/tests/detect-email-url/README.md
@@ -0,0 +1,8 @@
+# Test Description
+Test mime email.url keyword.
+
+## PCAP
+From ../smtp-extract-url-schemes/input.pcap
+
+## Redmine Ticket
+https://redmine.openinfosecfoundation.org/issues/7597
diff --git a/tests/detect-email-url/test.rules b/tests/detect-email-url/test.rules
new file mode 100644
index 000000000..d379d7a51
--- /dev/null
+++ b/tests/detect-email-url/test.rules
@@ -0,0 +1,2 @@
+alert smtp any any -> any any (msg:"Test mime email url"; email.url; content:"test-site.org/blah/123/"; startswith; endswith; bsize:23; sid:1;)
+alert smtp any any -> any any (msg:"Test mime email url"; email.url; content:"google.com"; startswith; endswith; bsize:10; sid:2;)
diff --git a/tests/detect-email-url/test.yaml b/tests/detect-email-url/test.yaml
new file mode 100644
index 000000000..27f65e017
--- /dev/null
+++ b/tests/detect-email-url/test.yaml
@@ -0,0 +1,21 @@
+requires:
+  min-version: 8
+
+pcap: ../smtp-extract-url-schemes/input.pcap
+
+args:
+  - -k none --set stream.inline=true
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      email.url[0]: "test-site.org/blah/123/"
+      alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      email.url[1]: "google.com"
+      alert.signature_id: 2
\ No newline at end of file