so what broke the ordering was the RRSIGs interspersed with the answers. With this...

within the actual answer records.

diff --git a/pdns/misc.cc b/pdns/misc.cc
index 4c20b2cbd66b95acce719a0c050899ebdf0140a0..185a8ab3d51e1da44f668551430a0ef2f274cea5 100644 (file)
--- a/pdns/misc.cc
+++ b/pdns/misc.cc
@@ -561,7 +561,7 @@ void shuffle(vector<DNSRecord>& rrs)
     if(first->d_place==DNSResourceRecord::ANSWER && first->d_type != QType::CNAME) // CNAME must come first
       break;
   for(second=first;second!=rrs.end();++second)
-    if(second->d_place!=DNSResourceRecord::ANSWER)
+    if(second->d_place!=DNSResourceRecord::ANSWER || second->d_type == QType::RRSIG) // leave RRSIGs at the end
       break;
 
   if(second-first>1)
@@ -581,10 +581,12 @@ void shuffle(vector<DNSRecord>& rrs)
   // we don't shuffle the rest
 }
 
-static uint16_t mapCnameToFirst(uint16_t type)
+static uint16_t mapTypesToOrder(uint16_t type)
 {
   if(type == QType::CNAME)
     return 0;
+  if(type == QType::RRSIG)
+    return 65535;
   else
     return 1;
 }
@@ -594,7 +596,7 @@ static uint16_t mapCnameToFirst(uint16_t type)
 void orderAndShuffle(vector<DNSRecord>& rrs)
 {
   std::stable_sort(rrs.begin(), rrs.end(), [](const DNSRecord&a, const DNSRecord& b) { 
-      return std::make_tuple(a.d_place, mapCnameToFirst(a.d_type)) < std::make_tuple(b.d_place, mapCnameToFirst(b.d_type));
+      return std::make_tuple(a.d_place, mapTypesToOrder(a.d_type)) < std::make_tuple(b.d_place, mapTypesToOrder(b.d_type));
     });
   shuffle(rrs);
 }