From 6a9da55d5eccfabe556db0db26b60d09832af2b8 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 19 Dec 2024 11:27:10 +0100
Subject: [PATCH] smtp: test protocol detection after TLS from client

Ticket: 7469
---
 tests/smtp-tls-protodetect/README.md  |  11 +++++++++++
 tests/smtp-tls-protodetect/input.pcap | Bin 0 -> 736 bytes
 tests/smtp-tls-protodetect/test.yaml  |  14 ++++++++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 tests/smtp-tls-protodetect/README.md
 create mode 100644 tests/smtp-tls-protodetect/input.pcap
 create mode 100644 tests/smtp-tls-protodetect/test.yaml

diff --git a/tests/smtp-tls-protodetect/README.md b/tests/smtp-tls-protodetect/README.md
new file mode 100644
index 000000000..53113b7bb
--- /dev/null
+++ b/tests/smtp-tls-protodetect/README.md
@@ -0,0 +1,11 @@
+# Test Description
+
+Test SMTP recognition from probing parser when client starts TLS
+
+## PCAP
+
+extract from QA TLPW1
+
+## Related issues
+
+https://redmine.openinfosecfoundation.org/issues/7469
diff --git a/tests/smtp-tls-protodetect/input.pcap b/tests/smtp-tls-protodetect/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..e584ef04ce1b4bb0532cdeca16e7e3f8f52d93a7
GIT binary patch
literal 736
zcmZvaOGs2v9LB$M&YkNxB7~YRDsHGWsdF_mA3Y$#M+M4&vlSDO8K_|djj~0E3m58U
zY~f}qr=oO%kO<oZ9f?F}HbR8Z#z*BM7bC75%>18w!N}{md~h!JoZtD*_ua3b-o`mJ
z{2L66UYhp4bq4&vHJU3KKg;JHZNbe?w7zkp8K^azu3|`ETk~Wc?={cHwCyNcnoWHE
zrAR~Ez|KQ}Yp!=p2sdLISH#dR$3^<CWV39pMXU^u(oTK-g`z1cTiTAcUk^?Zb>mh}
zIu%XWL`9nV!%;^NC5Jb!*=l+FeaPDe(c=DN>C{ZnzTxT~hcc|>pe&m=EK1{%l)`k1
zl>_;L;WY*JN{GdV!C{}Te*Rfc=l9jFl({poGS}T!Rvg(JyL9uz{TR?7D`hpFCTEh<
z$%L$sRd^yxr5Cqli9Ca#^vFCk%1oJy^LUIHuHZ5*pbCHKfEHvy6JQ)3dfYgP0u-ST
zC1gDt22SZr=elq)7k3Gb^45f4f(yYJ=UgD4))m;dJ_m7-oudVBc-(5?<)Iehvx$XC
zmEH7vn{v880|A06IVdgR35zm(B!#m3LYr!8s*S!#&x3((GZYE;`tF7L&AvNEb4Odi
ipY5^!m%AAUP96Pt&33DwAOH8WFi9<c^ydN3M}U1kjMxMK

literal 0
HcmV?d00001

diff --git a/tests/smtp-tls-protodetect/test.yaml b/tests/smtp-tls-protodetect/test.yaml
new file mode 100644
index 000000000..2430a559f
--- /dev/null
+++ b/tests/smtp-tls-protodetect/test.yaml
@@ -0,0 +1,14 @@
+requires:
+  min-version: 8
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: flow
+        app_proto: tls
+        app_proto_tc: smtp