resolve: move the RRSIG after the all corresponding entries

Fixes #22002.

diff --git a/src/resolve/resolved-dns-answer.c b/src/resolve/resolved-dns-answer.c
index 54cc15b63154d1cec897b3b761750c5e462bce57..96ae9bc0057b07a8018a88c86eae87d5e3c8f0ee 100644 (file)
--- a/src/resolve/resolved-dns-answer.c
+++ b/src/resolve/resolved-dns-answer.c
@@ -205,6 +205,12 @@ int dns_answer_add(
                 }
 
                 exist->flags |= flags;
+
+                if (rr->key->type == DNS_TYPE_RRSIG) {
+                        /* If the rr is RRSIG, then move the rr to the end. */
+                        assert_se(ordered_set_remove(a->items, exist) == exist);
+                        assert_se(ordered_set_put(a->items, exist) == 1);
+                }
                 return 0;
         }