From 503546d2a95a80131e589c88ef1410108ae65fe8 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Tue, 3 May 2016 17:15:37 +0100
Subject: [PATCH] Return DNS no-error with empty answer if we have a matching
 name but the query is for a record type we don't support.

---
 nameserver/dns.go             | 10 ++++++++--
 test/250_dns_negative_test.sh |  5 ++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/nameserver/dns.go b/nameserver/dns.go
index 461cdfed..3a4aa987 100644
--- a/nameserver/dns.go
+++ b/nameserver/dns.go
@@ -134,7 +134,7 @@ func (d *DNSServer) createMux(client *dns.Client, defaultMaxResponseSize int) *d
 
 func (h *handler) handleLocal(w dns.ResponseWriter, req *dns.Msg) {
 	h.ns.debugf("local request: %+v", *req)
-	if len(req.Question) != 1 || req.Question[0].Qtype != dns.TypeA {
+	if len(req.Question) != 1 {
 		h.nameError(w, req)
 		return
 	}
@@ -149,6 +149,12 @@ func (h *handler) handleLocal(w dns.ResponseWriter, req *dns.Msg) {
 		h.nameError(w, req)
 		return
 	}
+	// Per RFC4074, if we have an A but another type was requested,
+	// return 'no error' with empty answer section
+	if req.Question[0].Qtype != dns.TypeA {
+		h.respond(w, h.makeResponse(req, nil))
+		return
+	}
 
 	header := dns.RR_Header{
 		Name:   req.Question[0].Name,
@@ -204,7 +210,7 @@ func (h *handler) handleRecursive(w dns.ResponseWriter, req *dns.Msg) {
 	h.ns.debugf("recursive request: %+v", *req)
 
 	// Resolve unqualified names locally
-	if len(req.Question) == 1 && req.Question[0].Qtype == dns.TypeA {
+	if len(req.Question) == 1 {
 		hostname := dns.Fqdn(req.Question[0].Name)
 		if strings.Count(hostname, ".") == 1 {
 			h.handleLocal(w, req)
diff --git a/test/250_dns_negative_test.sh b/test/250_dns_negative_test.sh
index bcab7baa..c879b6d2 100755
--- a/test/250_dns_negative_test.sh
+++ b/test/250_dns_negative_test.sh
@@ -7,9 +7,8 @@ start_suite "Negative DNS queries"
 weave_on $HOST1 launch
 start_container_with_dns $HOST1 --name c1
 
-# unsupported query types, unknown names, and unknown domains should
-# all trigger NXDOMAIN
-assert_raises "exec_on $HOST1 c1 dig MX c1.weave.local | grep -q 'status: NXDOMAIN'"
+# unsupported query types, unknown names, and unknown domains
+assert_raises "exec_on $HOST1 c1 dig MX c1.weave.local | grep -q 'status: NOERROR'"
 assert_raises "exec_on $HOST1 c1 dig A  xx.weave.local | grep -q 'status: NXDOMAIN'"
 assert_raises "exec_on $HOST1 c1 dig A  xx.invalid     | grep -q 'status: NXDOMAIN'"