From: Jason Ish <jason.ish@oisf.net>
Date: Mon, 13 Jul 2026 17:04:14 +0000 (-0600)
Subject: tests: add pipelined rset and data reply regression test
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fsuricata-verify.git

tests: add pipelined rset and data reply regression test

Add a minimized capture for OSS-Fuzz testcase 5498180758994944.

Ticket: #8739
---

diff --git a/tests/smtp-pipelined-rset-data-replies/README.md b/tests/smtp-pipelined-rset-data-replies/README.md
new file mode 100644
index 000000000..7eebd2be5
--- /dev/null
+++ b/tests/smtp-pipelined-rset-data-replies/README.md
@@ -0,0 +1,34 @@
+# Description
+
+Protocol-minimized regression test for Redmine Bug #8739:
+
+https://redmine.openinfosecfoundation.org/issues/8739
+
+Originally found by OSS-Fuzz testcase 5498180758994944:
+
+https://oss-fuzz.com/testcase?key=5498180758994944
+
+# PCAP
+
+The 13-packet capture is a protocol-minimized derivative of the original
+`fuzz_sigpcap_aware` input. The fuzzpcap stream was converted to a regular
+pcap and reduced to this SMTP dialog (`--->` client, `<---` server):
+
+```
+<--- 220 mail.example ESMTP ready
+
+---> EHLO client.example
+<--- 250-PIPELINING
+<--- 250 OK
+
+---> RSET
+---> DATA
+---> .
+
+<--- 250 reset
+<--- 354 continue
+<--- 250 queued
+```
+
+The `RSET`, `DATA`, and `.` lines are pipelined in one client packet. Each
+server reply is sent separately.
diff --git a/tests/smtp-pipelined-rset-data-replies/input.pcap b/tests/smtp-pipelined-rset-data-replies/input.pcap
new file mode 100644
index 000000000..061a6563a
Binary files /dev/null and b/tests/smtp-pipelined-rset-data-replies/input.pcap differ
diff --git a/tests/smtp-pipelined-rset-data-replies/test.yaml b/tests/smtp-pipelined-rset-data-replies/test.yaml
new file mode 100644
index 000000000..4ca96b356
--- /dev/null
+++ b/tests/smtp-pipelined-rset-data-replies/test.yaml
@@ -0,0 +1,25 @@
+requires:
+  min-version: 9
+
+pcap: input.pcap
+
+# Disable checksum validation for the generated capture.
+args:
+  - -k none
+
+checks:
+  # The pipelined sequence produces one completed SMTP transaction object.
+  - filter:
+      count: 1
+      match:
+        event_type: smtp
+        tx_id: 0
+        smtp.helo: client.example
+        email.status: PARSE_DONE
+
+  - filter:
+      count: 1
+      match:
+        event_type: anomaly
+        anomaly.app_proto: smtp
+        anomaly.event: INVALID_PIPELINED_SEQUENCE