all: upd chlog; filtering: imp tests; add docs;

CHANGELOG.md

@@ -44,7 +44,7 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 - The parsing of the `ech` parameter in DNS rewrite rules for the HTTPS record type ([#8276]).
 
-- The parsing of the `answer` field in DNS rewrite rules in case it is represented as CNAME.
+- Validation of the `answer` field in DNS rewrite rules in case it is represented as CNAME.
 
 - Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
 

internal/filtering/rewritehttp_test.go

@@ -161,9 +161,9 @@ func TestDNSFilter_HandleRewriteHTTP(t *testing.T) {
 		},
 		wantConfMod: false,
 		wantStatus:  http.StatusBadRequest,
-		wantBody: "normalizing: invalid CNAME target \"invalid_domain\": " +
-			"bad domain name \"invalid_domain\": bad top-level domain name label " +
-			"\"invalid_domain\": bad top-level domain name label rune '_'\n",
+		wantBody: `normalizing: invalid CNAME target "invalid_domain": bad domain name ` +
+			`"invalid_domain": bad top-level domain name label "invalid_domain": bad top-level ` +
+			`domain name label rune '_'` + "\n",
 		wantList: testRewrites,
 	}, {
 		name:        "delete",

internal/filtering/rewrites.go

@@ -99,6 +99,7 @@ func (rw *LegacyRewrite) normalize(ctx context.Context, l *slog.Logger) (err err
 		// name first.
 		err = netutil.ValidateDomainName(rw.Answer)
 		if err != nil {
+			// Use capital letters, as the error message is shown to the user.
 			return fmt.Errorf("invalid CNAME target %q: %w", rw.Answer, err)
 		}