wgengine/tsdns: fix error response marshaling, improve bad query logs

Updates #995

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
(cherry picked from commit 741c513e51)

wgengine/tsdns/tsdns.go

@@ -381,6 +381,9 @@ func marshalResponse(resp *response) ([]byte, error) {
 
 	builder := dns.NewBuilder(nil, resp.Header)
 
+	isSuccess := resp.Header.RCode == dns.RCodeSuccess
+
+	if resp.Question.Type != 0 || isSuccess {
 		err := builder.StartQuestions()
 		if err != nil {
 			return nil, err
@@ -390,13 +393,14 @@ func marshalResponse(resp *response) ([]byte, error) {
 		if err != nil {
 			return nil, err
 		}
+	}
 
 	// Only successful responses contain answers.
-	if resp.Header.RCode != dns.RCodeSuccess {
+	if !isSuccess {
 		return builder.Finish()
 	}
 
-	err = builder.StartAnswers()
+	err := builder.StartAnswers()
 	if err != nil {
 		return nil, err
 	}
@@ -576,7 +580,11 @@ func (r *Resolver) respond(query []byte) ([]byte, error) {
 	err := parseQuery(query, resp)
 	// We will not return this error: it is the sender's fault.
 	if err != nil {
-		r.logf("parsing query: %v", err)
+		if errors.Is(err, dns.ErrSectionDone) {
+			r.logf("parseQuery(%02x): no DNS questions", query)
+		} else {
+			r.logf("parseQuery(%02x): %v", query, err)
+		}
 		resp.Header.RCode = dns.RCodeFormatError
 		return marshalResponse(resp)
 	}

wgengine/tsdns/tsdns_test.go

@@ -748,3 +748,13 @@ func BenchmarkFull(b *testing.B) {
 		})
 	}
 }
+
+func TestMarshalResponseFormatError(t *testing.T) {
+	resp := new(response)
+	resp.Header.RCode = dns.RCodeFormatError
+	v, err := marshalResponse(resp)
+	if err != nil {
+		t.Errorf("marshal error: %v", err)
+	}
+	t.Logf("response: %q", v)
+}