From e638cbc9b958bd9cb63ccd22f79f904441592bae Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Wed, 8 Apr 2026 10:31:08 +0000 Subject: [PATCH] integration/tsic: accept via peer-relay in non-direct ping check When WithPingUntilDirect(false) is set, the Ping helper should accept any indirect path, but the substring check only matched "via DERP" and "via relay". Tailscale peer relay pings output pong from ... via peer-relay(ip:port:vni:N) in Nms which does not contain the "via relay" substring and was therefore rejected as errTailscalePingNotDERP. TestGrantCapRelay Phase 4 never passed because of this: even when the data plane was healthy the helper returned an error. Commit abe1a3e7 attempted to fix this by adding "via relay" alongside "via DERP" but missed the "peer-" prefix used by peer relay output. Add an explicit "via peer-relay" substring check so peer relay pongs are accepted alongside DERP and plain relay pongs. Updates #2180 --- integration/tsic/tsic.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/integration/tsic/tsic.go b/integration/tsic/tsic.go index 0a75e813..c0ea8174 100644 --- a/integration/tsic/tsic.go +++ b/integration/tsic/tsic.go @@ -1403,7 +1403,14 @@ func (t *TailscaleInContainer) Ping(hostnameOrIP string, opts ...PingOption) err } if !args.direct { - if strings.Contains(result, "via DERP") || strings.Contains(result, "via relay") { + // Non-direct mode accepts any indirect path: DERP, a plain + // tailscale relay, or a peer relay. Tailscale reports peer + // relay hops as "via peer-relay(ip:port:vni:N)", which does + // not contain the "via relay" substring and was previously + // rejected here. + if strings.Contains(result, "via DERP") || + strings.Contains(result, "via relay") || + strings.Contains(result, "via peer-relay") { return nil } else { return errTailscalePingNotDERP