tests: add pipelined rset and data reply regression test

Add a minimized capture for OSS-Fuzz testcase 5498180758994944.

Ticket: #8739

diff --git a/tests/smtp-pipelined-rset-data-replies/README.md b/tests/smtp-pipelined-rset-data-replies/README.md
new file mode 100644 (file)
index 0000000..7eebd2b
--- /dev/null
+++ b/tests/smtp-pipelined-rset-data-replies/README.md
@@ -0,0 +1,34 @@
+# Description
+
+Protocol-minimized regression test for Redmine Bug #8739:
+
+https://redmine.openinfosecfoundation.org/issues/8739
+
+Originally found by OSS-Fuzz testcase 5498180758994944:
+
+https://oss-fuzz.com/testcase?key=5498180758994944
+
+# PCAP
+
+The 13-packet capture is a protocol-minimized derivative of the original
+`fuzz_sigpcap_aware` input. The fuzzpcap stream was converted to a regular
+pcap and reduced to this SMTP dialog (`--->` client, `<---` server):
+
+```
+<--- 220 mail.example ESMTP ready
+
+---> EHLO client.example
+<--- 250-PIPELINING
+<--- 250 OK
+
+---> RSET
+---> DATA
+---> .
+
+<--- 250 reset
+<--- 354 continue
+<--- 250 queued
+```
+
+The `RSET`, `DATA`, and `.` lines are pipelined in one client packet. Each
+server reply is sent separately.

diff --git a/tests/smtp-pipelined-rset-data-replies/input.pcap b/tests/smtp-pipelined-rset-data-replies/input.pcap
new file mode 100644 (file)
index 0000000..061a656
Binary files /dev/null and b/tests/smtp-pipelined-rset-data-replies/input.pcap differ

diff --git a/tests/smtp-pipelined-rset-data-replies/test.yaml b/tests/smtp-pipelined-rset-data-replies/test.yaml
new file mode 100644 (file)
index 0000000..4ca96b3
--- /dev/null
+++ b/tests/smtp-pipelined-rset-data-replies/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  min-version: 9
+
+pcap: input.pcap
+
+# Disable checksum validation for the generated capture.
+args:
+  - -k none
+
+checks:
+  # The pipelined sequence produces one completed SMTP transaction object.
+  - filter:
+      count: 1
+      match:
+        event_type: smtp
+        tx_id: 0
+        smtp.helo: client.example
+        email.status: PARSE_DONE
+
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.app_proto: smtp
+        anomaly.event: INVALID_PIPELINED_SEQUENCE