From e44132608e80d04b14408b9257f9a4085ddc8ec6 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Sat, 22 Aug 2026 13:28:50 +0530 Subject: [PATCH 1/6] ipv6only: add tests for disallowing ranges Ticket: 8901 --- tests/iponly-ipv6-range-01/test.yaml | 2 +- tests/iponly-ipv6-range-02/test.yaml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/iponly-ipv6-range-01/test.yaml b/tests/iponly-ipv6-range-01/test.yaml index e7c141fe90..f7a947a880 100644 --- a/tests/iponly-ipv6-range-01/test.yaml +++ b/tests/iponly-ipv6-range-01/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 9 + min-version: 8.0.7 args: - -k none diff --git a/tests/iponly-ipv6-range-02/test.yaml b/tests/iponly-ipv6-range-02/test.yaml index 009475d413..60e9fd6532 100644 --- a/tests/iponly-ipv6-range-02/test.yaml +++ b/tests/iponly-ipv6-range-02/test.yaml @@ -1,11 +1,13 @@ requires: - min-version: 9 + min-version: 8.0.7 args: - --engine-analysis exit-code: 0 +pcap: false + checks: - filter: filename: rules.json From 6a274b55a80c7f06c41fcc68194f224a998ee587 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 23 Aug 2026 10:03:16 +0000 Subject: [PATCH 2/6] tests: add firewall ARP accept-arp config tests for 8.0.x Add minimal tests for firewall.policies.accept-arp true/false to validate ARP packets are accepted/dropped with default firewall policy. Ticket: #8314. --- .../firewall-arp-accept-false/firewall.rules | 1 + .../firewall-arp-accept-false/suricata.yaml | 28 +++++++++++++++++++ .../firewall-arp-accept-false/test.yaml | 22 +++++++++++++++ .../firewall-arp-accept-true/firewall.rules | 1 + .../firewall-arp-accept-true/suricata.yaml | 28 +++++++++++++++++++ .../firewall-arp-accept-true/test.yaml | 22 +++++++++++++++ 6 files changed, 102 insertions(+) create mode 100644 tests/firewall/firewall-arp-accept-false/firewall.rules create mode 100644 tests/firewall/firewall-arp-accept-false/suricata.yaml create mode 100644 tests/firewall/firewall-arp-accept-false/test.yaml create mode 100644 tests/firewall/firewall-arp-accept-true/firewall.rules create mode 100644 tests/firewall/firewall-arp-accept-true/suricata.yaml create mode 100644 tests/firewall/firewall-arp-accept-true/test.yaml diff --git a/tests/firewall/firewall-arp-accept-false/firewall.rules b/tests/firewall/firewall-arp-accept-false/firewall.rules new file mode 100644 index 0000000000..b52b60d181 --- /dev/null +++ b/tests/firewall/firewall-arp-accept-false/firewall.rules @@ -0,0 +1 @@ +# No explicit rules diff --git a/tests/firewall/firewall-arp-accept-false/suricata.yaml b/tests/firewall/firewall-arp-accept-false/suricata.yaml new file mode 100644 index 0000000000..bbba344568 --- /dev/null +++ b/tests/firewall/firewall-arp-accept-false/suricata.yaml @@ -0,0 +1,28 @@ +%YAML 1.1 +--- + +firewall: + enabled: true + policies: + accept-arp: false + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - drop: + alerts: yes + flows: all + - flow + +stream: + inline: yes + +logging: + default-log-level: notice + outputs: + - console: + enabled: yes diff --git a/tests/firewall/firewall-arp-accept-false/test.yaml b/tests/firewall/firewall-arp-accept-false/test.yaml new file mode 100644 index 0000000000..253d466a21 --- /dev/null +++ b/tests/firewall/firewall-arp-accept-false/test.yaml @@ -0,0 +1,22 @@ +requires: + min-version: 8.0.7 + lt-version: 9 + +pcap: ../../decode-arp-1/input.pcap + +args: + - --simulate-ips + - -k none + +checks: + - filter: + count: 1 + match: + event_type: drop + drop.reason: "firewall default packet policy" + + - filter: + count: 0 + match: + event_type: stats + stats.firewall.accepted: 1 diff --git a/tests/firewall/firewall-arp-accept-true/firewall.rules b/tests/firewall/firewall-arp-accept-true/firewall.rules new file mode 100644 index 0000000000..75af996b98 --- /dev/null +++ b/tests/firewall/firewall-arp-accept-true/firewall.rules @@ -0,0 +1 @@ +# No explicit firewall rules, rely on default drop policy and accept-arp config diff --git a/tests/firewall/firewall-arp-accept-true/suricata.yaml b/tests/firewall/firewall-arp-accept-true/suricata.yaml new file mode 100644 index 0000000000..52f287240b --- /dev/null +++ b/tests/firewall/firewall-arp-accept-true/suricata.yaml @@ -0,0 +1,28 @@ +%YAML 1.1 +--- + +firewall: + enabled: true + policies: + accept-arp: true + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - stats + - drop: + alerts: yes + flows: all + - flow + +stream: + inline: yes + +logging: + default-log-level: notice + outputs: + - console: + enabled: yes diff --git a/tests/firewall/firewall-arp-accept-true/test.yaml b/tests/firewall/firewall-arp-accept-true/test.yaml new file mode 100644 index 0000000000..e84ceaed3d --- /dev/null +++ b/tests/firewall/firewall-arp-accept-true/test.yaml @@ -0,0 +1,22 @@ +requires: + min-version: 8.0.7 + lt-version: 9 + +pcap: ../../decode-arp-1/input.pcap + +args: + - --simulate-ips + - -k none + +checks: + - filter: + count: 0 + match: + event_type: drop + drop.reason: "firewall default packet policy" + + - filter: + count: 1 + match: + event_type: stats + stats.firewall.accepted: 1 From ef6b403d9967c1ebfa280ee1832d4481899e56e7 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Sun, 23 Aug 2026 22:30:27 +0200 Subject: [PATCH 3/6] backport: support issue 8869 tests for 8 --- tests/ftp/ftp-ippair-leak-5204/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/ftp/ftp-ippair-leak-5204/test.yaml b/tests/ftp/ftp-ippair-leak-5204/test.yaml index b5bf69b323..bbb479fc5e 100644 --- a/tests/ftp/ftp-ippair-leak-5204/test.yaml +++ b/tests/ftp/ftp-ippair-leak-5204/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 9 + min-version: 8.0.7 args: - --runmode=single From a7738d71bc5617df9c653eb3e9e390e17fc74004 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Sun, 23 Aug 2026 22:30:28 +0200 Subject: [PATCH 4/6] backport: support issue 8761 tests for 8 --- tests/http2-deflate-case/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/http2-deflate-case/test.yaml b/tests/http2-deflate-case/test.yaml index 082cdd53f4..ae52ade982 100644 --- a/tests/http2-deflate-case/test.yaml +++ b/tests/http2-deflate-case/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 9 + min-version: 8.0.7 args: - -k none From dfa086c5537dac11133acb740e81fe5a7fbe7a45 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 25 Aug 2026 11:30:38 +0200 Subject: [PATCH 5/6] backport: support issue 8751 tests for 8 --- tests/nfs3-read-attr-follows-0/test.yaml | 2 +- tests/nfs3-read-attr-follows-1-control/test.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/nfs3-read-attr-follows-0/test.yaml b/tests/nfs3-read-attr-follows-0/test.yaml index 5f4297d2b6..0969e2157b 100644 --- a/tests/nfs3-read-attr-follows-0/test.yaml +++ b/tests/nfs3-read-attr-follows-0/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 9 + min-version: 8.0.7 checks: - filter: diff --git a/tests/nfs3-read-attr-follows-1-control/test.yaml b/tests/nfs3-read-attr-follows-1-control/test.yaml index d537a937f7..cdefdfc826 100644 --- a/tests/nfs3-read-attr-follows-1-control/test.yaml +++ b/tests/nfs3-read-attr-follows-1-control/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 9 + min-version: 8.0.7 checks: - filter: From 33e8a165131a61485ae8359236f1627ac9561ae6 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 25 Aug 2026 11:30:39 +0200 Subject: [PATCH 6/6] backport: support issue 8769 tests for 8 --- tests/datarep-8768/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/datarep-8768/test.yaml b/tests/datarep-8768/test.yaml index 1b68ebc8fa..bd05b094c3 100644 --- a/tests/datarep-8768/test.yaml +++ b/tests/datarep-8768/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 9 + min-version: 8.0.7 pcap: ../datarep-01/input.pcap