caclulate nlabels and set *chainingp correctly

diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index 73066a881ebe8dd719370feb87f89cbe9178ff41..12d2819e30017f6115453863e08640afad0239ee 100755 (executable)
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -204,6 +204,7 @@ n=`expr $n + 1`
 echo_i "checking DNAME target filtering (deny) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp foo.baddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+grep "DNAME target foo.baddname.example.org denied for foo.baddname.example.net/IN" ns1/named.run >/dev/null || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index db539c5d8be14092b9d30af9d7420a22bcc73f94..0aca23253e766f9e56b1cb82bd4f5312aba7ecd1 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6640,13 +6640,14 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
                dns_name_init(&prefix, NULL);
                tname = dns_fixedname_initname(&fixed);
-               nlabels = dns_name_countlabels(qname) -
-                         dns_name_countlabels(rname);
-               INSIST(nlabels > 0);
+               nlabels = dns_name_countlabels(rname);
                dns_name_split(qname, nlabels, &prefix, NULL);
                result = dns_name_concatenate(&prefix, &dname.dname, tname,
                                              NULL);
                if (result == DNS_R_NAMETOOLONG) {
+                       if (chainingp != NULL) {
+                               *chainingp = true;
+                       }
                        return (true);
                }
                RUNTIME_CHECK(result == ISC_R_SUCCESS);