From 49aeb22db8a66c533a6045d5a6944771a3365c12 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 2 Dec 2025 11:07:58 +0100
Subject: [PATCH] smtp: adds test for protocol recognition on quit

Ticket: 6591
---
 tests/smtp-quit/README.md  |  11 +++++++++++
 tests/smtp-quit/input.pcap | Bin 0 -> 556 bytes
 tests/smtp-quit/test.yaml  |  12 ++++++++++++
 3 files changed, 23 insertions(+)
 create mode 100644 tests/smtp-quit/README.md
 create mode 100644 tests/smtp-quit/input.pcap
 create mode 100644 tests/smtp-quit/test.yaml

diff --git a/tests/smtp-quit/README.md b/tests/smtp-quit/README.md
new file mode 100644
index 000000000..80878c432
--- /dev/null
+++ b/tests/smtp-quit/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test SMTP protocol detection with QUIT pattern (vs FTP)
+
+## PCAP
+
+This PCAP comes from redmine ticket https://redmine.openinfosecfoundation.org/issues/6591 with craft to change ports
+
+## Related issues
+
+Ticket https://redmine.openinfosecfoundation.org/issues/6591
diff --git a/tests/smtp-quit/input.pcap b/tests/smtp-quit/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..7ebec841d0196bb9a3b41cd6889a0e2521263094
GIT binary patch
literal 556
zc-p&ic+)~A1{MYcU}0bck}K_=rX1YF%-{rMgK*Z)(8rG&q9nI0I&zPL!Igo*r0S#t
zLjxNNA6GrYDb0s&haYn?NLG9n7Xz8m!1U`wD;EO;6ASAWMrLLXMn)DUkcpGOv%pP+
zm<2HxXrc#$2?K)zg8|#QevoM(QyC;5b2dL(zzH-}yg^88gX=`Fi4`EzfTl8nOq}tP
zg~0}BnhiELYE+#9yHOI&jp9I4xdH?j8E0RB`5I(aMkgDC8IWy;&2<`I`9ZF`*^TBp
zE|7Tvg4_`kD<G!WcC+Dg(P^-YB(S)M8|<R<$Syk3i^nXzsxx4-1hJYW!N~Z9mw_QL
i)H8&a3uM;63+#A&2Mzn#XujhHxg-FXJanEjFaQ8_)v0*^

literal 0
Hc-jL100001

diff --git a/tests/smtp-quit/test.yaml b/tests/smtp-quit/test.yaml
new file mode 100644
index 000000000..c35b2b8ca
--- /dev/null
+++ b/tests/smtp-quit/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+ - filter:
+     count: 1
+     match:
+       event_type: flow
+       app_proto: smtp
-- 
2.47.3