From 073836905a9783f28ced010283174739ffd4b7d1 Mon Sep 17 00:00:00 2001
From: Tom Wilkie <tom@weave.works>
Date: Mon, 10 Aug 2015 12:19:21 +0000
Subject: [PATCH 1/2] Return NXDOMAIN when we don't have entries, and drop the
 non-authoritative special case for recursive dns.

---
 nameserver/dns.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nameserver/dns.go b/nameserver/dns.go
index 35e07a23..ae0a09e3 100644
--- a/nameserver/dns.go
+++ b/nameserver/dns.go
@@ -135,6 +135,10 @@ func (d *DNSServer) handleLocal(defaultMaxResponseSize int) func(dns.ResponseWri
 		}
 
 		addrs := d.ns.Lookup(hostname)
+		if len(addrs) == 0 {
+			d.errorResponse(req, dns.RcodeNameError, w)
+			return
+		}
 
 		response := dns.Msg{}
 		response.RecursionAvailable = true
@@ -234,10 +238,6 @@ func (d *DNSServer) handleRecursive(client *dns.Client, defaultMaxResponseSize i
 				d.ns.debugf("error trying %s: %v", server, err)
 				continue
 			}
-			if response.Rcode != dns.RcodeSuccess && !response.Authoritative {
-				d.ns.debugf("non-authoritative error trying %s: %v", server, response.Rcode)
-				continue
-			}
 			d.ns.debugf("response: %+v", response)
 			response.SetReply(req)
 			if err := w.WriteMsg(response); err != nil {

From c2d5b35cd6339f7c5befb1d4676fbed463dc679d Mon Sep 17 00:00:00 2001
From: Tom Wilkie <tom@weave.works>
Date: Mon, 10 Aug 2015 13:13:12 +0000
Subject: [PATCH 2/2] Add test for negative DNS queries

---
 nameserver/dns.go             |  2 +-
 test/250_dns_lookup_2_test.sh | 16 ----------------
 test/250_dns_negative_test.sh | 12 ++++++++++++
 3 files changed, 13 insertions(+), 17 deletions(-)
 delete mode 100755 test/250_dns_lookup_2_test.sh
 create mode 100755 test/250_dns_negative_test.sh

diff --git a/nameserver/dns.go b/nameserver/dns.go
index ae0a09e3..2a59df02 100644
--- a/nameserver/dns.go
+++ b/nameserver/dns.go
@@ -239,7 +239,7 @@ func (d *DNSServer) handleRecursive(client *dns.Client, defaultMaxResponseSize i
 				continue
 			}
 			d.ns.debugf("response: %+v", response)
-			response.SetReply(req)
+			response.Id = req.Id
 			if err := w.WriteMsg(response); err != nil {
 				d.ns.infof("error responding: %v", err)
 			}
diff --git a/test/250_dns_lookup_2_test.sh b/test/250_dns_lookup_2_test.sh
deleted file mode 100755
index aa7c283b..00000000
--- a/test/250_dns_lookup_2_test.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#! /bin/bash
-
-. ./config.sh
-
-C1=10.2.0.78
-
-start_suite "Cross host dns-lookup"
-
-weave_on $HOST1 launch
-weave_on $HOST2 launch $HOST1
-
-start_container $HOST1 $C1/24 --name c1
-
-assert "weave_on $HOST2 dns-lookup c1" $C1
-
-end_suite
diff --git a/test/250_dns_negative_test.sh b/test/250_dns_negative_test.sh
new file mode 100755
index 00000000..f89b6698
--- /dev/null
+++ b/test/250_dns_negative_test.sh
@@ -0,0 +1,12 @@
+#! /bin/bash
+
+. ./config.sh
+
+start_suite "Negative DNS queries"
+
+weave_on $HOST1 launch
+start_container_with_dns $HOST1 --name c1
+assert_raises "exec_on $HOST1 c1 dig A foo.weave.local | grep 'status: NXDOMAIN'"
+assert_raises "exec_on $HOST1 c1 dig A foo.invalid | grep 'status: NXDOMAIN'"
+
+end_suite