Test suite: firewall leak detector is not reliable for scenarios that reboot

anonym
2025-08-06T15:08:02Z

In Scenario: I set up Additional Software when installing a package without persistent partition and the package is installed next time I start Tails I have seen this failure in the After hook due to the @check_tor_leaks tag:

undefined method `to_i' for false (NoMethodError)
./features/support/helpers/firewall_helper.rb:48:in `looks_like_slaac_packet?'
./features/support/helpers/firewall_helper.rb:147:in `block in pcap_connections_helper'
./features/support/helpers/firewall_helper.rb:135:in `map'
./features/support/helpers/firewall_helper.rb:135:in `pcap_connections_helper'
./features/support/helpers/firewall_helper.rb:163:in `assert_all_connections'
./features/support/helpers/firewall_helper.rb:178:in `assert_no_leaks'
./features/support/hooks.rb:528:in `After'

The failure is raised in looks_like_slaac_packet?() on this line:

low = ($vm.ipv6_address & 0xffffff).to_i.to_s(16).rjust(6, '0')

because $vm.ipv6_address is nil, and nil & 0xffffff is false.

This demonstrates that reboots (which occurs in this scenario) is problematic for looks_like_slaac_packet?() since it looks at the IPv6 address at the time it is run, which didn't exist in this case since we rebooted without network. And this makes me confused why we haven't seen this issue before, and why it's not an issue on jenkins... this should always fail.

Also, imagine if the network was plugged after the reboot and $vm.ipv6_address returns a non-nil address, then it likely is a different IPv6 address then what Tails had when the IPv6 packets were sent before the reboot.

So I think we need to record the list of all IPv6 addresses used during a scenario and make looks_like_slaac_packet?() test with all of them and accept if any of them matches.