OISF · victorjulien · Aug 26, 2026 · Aug 22, 2026 · Aug 23, 2026 · Aug 23, 2026
diff --git a/tests/datarep-8768/test.yaml b/tests/datarep-8768/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 pcap: ../datarep-01/input.pcap
 

diff --git a/tests/firewall/firewall-arp-accept-false/firewall.rules b/tests/firewall/firewall-arp-accept-false/firewall.rules
@@ -0,0 +1 @@
+# No explicit rules
diff --git a/tests/firewall/firewall-arp-accept-false/suricata.yaml b/tests/firewall/firewall-arp-accept-false/suricata.yaml
@@ -0,0 +1,28 @@
+%YAML 1.1
+---
+
+firewall:
+  enabled: true
+  policies:
+    accept-arp: false
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - drop:
+            alerts: yes
+            flows: all
+        - flow
+
+stream:
+  inline: yes
+
+logging:
+  default-log-level: notice
+  outputs:
+    - console:
+        enabled: yes
diff --git a/tests/firewall/firewall-arp-accept-false/test.yaml b/tests/firewall/firewall-arp-accept-false/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  min-version: 8.0.7
+  lt-version: 9
+
+pcap: ../../decode-arp-1/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: drop
+        drop.reason: "firewall default packet policy"
+
+  - filter:
+      count: 0
+      match:
+        event_type: stats
+        stats.firewall.accepted: 1
diff --git a/tests/firewall/firewall-arp-accept-true/firewall.rules b/tests/firewall/firewall-arp-accept-true/firewall.rules
@@ -0,0 +1 @@
+# No explicit firewall rules, rely on default drop policy and accept-arp config
diff --git a/tests/firewall/firewall-arp-accept-true/suricata.yaml b/tests/firewall/firewall-arp-accept-true/suricata.yaml
@@ -0,0 +1,28 @@
+%YAML 1.1
+---
+
+firewall:
+  enabled: true
+  policies:
+    accept-arp: true
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - stats
+        - drop:
+            alerts: yes
+            flows: all
+        - flow
+
+stream:
+  inline: yes
+
+logging:
+  default-log-level: notice
+  outputs:
+    - console:
+        enabled: yes
diff --git a/tests/firewall/firewall-arp-accept-true/test.yaml b/tests/firewall/firewall-arp-accept-true/test.yaml
@@ -0,0 +1,22 @@
+requires:
+  min-version: 8.0.7
+  lt-version: 9
+
+pcap: ../../decode-arp-1/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+  - filter:
+      count: 0
+      match:
+        event_type: drop
+        drop.reason: "firewall default packet policy"
+
+  - filter:
+      count: 1
+      match:
+        event_type: stats
+        stats.firewall.accepted: 1
diff --git a/tests/ftp/ftp-ippair-leak-5204/test.yaml b/tests/ftp/ftp-ippair-leak-5204/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 args:
   - --runmode=single

diff --git a/tests/http2-deflate-case/test.yaml b/tests/http2-deflate-case/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 args:
   - -k none

diff --git a/tests/iponly-ipv6-range-01/test.yaml b/tests/iponly-ipv6-range-01/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 args:
 - -k none

diff --git a/tests/iponly-ipv6-range-02/test.yaml b/tests/iponly-ipv6-range-02/test.yaml
@@ -1,11 +1,13 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 args:
 - --engine-analysis
 
 exit-code: 0
 
+pcap: false
+
 checks:
   - filter:
       filename: rules.json

diff --git a/tests/nfs3-read-attr-follows-0/test.yaml b/tests/nfs3-read-attr-follows-0/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 checks:
 - filter:

diff --git a/tests/nfs3-read-attr-follows-1-control/test.yaml b/tests/nfs3-read-attr-follows-1-control/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 9
+  min-version: 8.0.7
 
 checks:
 - filter:
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		# No explicit firewall rules, rely on default drop policy and accept-arp config