From 0a0bb4cf71fee2cd49a0f3ceb47044541b88ba94 Mon Sep 17 00:00:00 2001
From: Quentin McGaw <quentin.mcgaw@gmail.com>
Date: Wed, 24 Dec 2025 02:57:50 +0000
Subject: [PATCH] hotfix(healthcheck): only fallback to plain dns if icmp is
 not permitted on the very first try

---
 internal/healthcheck/checker.go | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/internal/healthcheck/checker.go b/internal/healthcheck/checker.go
index d7f8110a..39565c5f 100644
--- a/internal/healthcheck/checker.go
+++ b/internal/healthcheck/checker.go
@@ -25,7 +25,7 @@ type Checker struct {
 	smallCheckType string
 	configMutex    sync.Mutex
 
-	icmpNotPermitted bool
+	icmpNotPermitted *bool
 
 	// Internal periodic service signals
 	stop context.CancelFunc
@@ -70,7 +70,7 @@ func (c *Checker) Start(ctx context.Context) (runError <-chan error, err error)
 		panic("call Checker.SetConfig with non empty values before Checker.Start")
 	}
 
-	if c.icmpNotPermitted {
+	if c.icmpNotPermitted != nil && *c.icmpNotPermitted {
 		// restore forced check type to dns if icmp was found to be not permitted
 		c.smallCheckType = smallCheckDNS
 	}
@@ -154,11 +154,12 @@ func (c *Checker) smallPeriodicCheck(ctx context.Context) error {
 		}
 		ip := icmpTargetIPs[try%len(icmpTargetIPs)]
 		err := c.echoer.Echo(ctx, ip)
-		if errors.Is(err, icmp.ErrNotPermitted) {
-			c.icmpNotPermitted = true
+		if c.icmpNotPermitted == nil && errors.Is(err, icmp.ErrNotPermitted) {
+			c.icmpNotPermitted = new(bool)
+			*c.icmpNotPermitted = true
 			c.smallCheckType = smallCheckDNS
 			c.logger.Infof("%s; permanently falling back to %s checks",
-				smallCheckTypeToString(c.smallCheckType), err)
+				err, smallCheckTypeToString(c.smallCheckType))
 			return c.dnsClient.Check(ctx)
 		}
 		return err