filtering: fix sort

internal/filtering/rewrites.go

@@ -118,23 +118,22 @@ func matchDomainWildcard(host, wildcard string) (ok bool) {
 //  2. wildcard > exact;
 //  3. lower level wildcard > higher level wildcard;
 func (rw *LegacyRewrite) Compare(b *LegacyRewrite) (res int) {
-	if rw.Type == dns.TypeCNAME && b.Type != dns.TypeCNAME {
-		return -1
-	} else if rw.Type != dns.TypeCNAME && b.Type == dns.TypeCNAME {
+	if rw.Type == dns.TypeCNAME {
+		if b.Type != dns.TypeCNAME {
+			return -1
+		}
+	} else if b.Type == dns.TypeCNAME {
 		return 1
 	}
 
-	aIsWld, bIsWld := isWildcard(rw.Domain), isWildcard(b.Domain)
-	if aIsWld == bIsWld {
+	if aIsWld, bIsWld := isWildcard(rw.Domain), isWildcard(b.Domain); aIsWld == bIsWld {
 		// Both are either wildcards or both aren't.
-		return len(rw.Domain) - len(b.Domain)
-	}
-
-	if aIsWld {
+		return len(b.Domain) - len(rw.Domain)
+	} else if aIsWld {
 		return 1
+	} else {
+		return -1
 	}
-
-	return -1
 }
 
 // prepareRewrites normalizes and validates all legacy DNS rewrites.

internal/filtering/rewrites_test.go

@@ -80,6 +80,12 @@ func TestRewrites(t *testing.T) {
 	}, {
 		Domain: "*.issue4016.com",
 		Answer: "sub.issue4016.com",
+	}, {
+		Domain: "*.sub.issue6226.com",
+		Answer: addr2v4.String(),
+	}, {
+		Domain: "*.issue6226.com",
+		Answer: addr1v4.String(),
 	}}
 
 	require.NoError(t, d.prepareRewrites())
@@ -182,6 +188,20 @@ func TestRewrites(t *testing.T) {
 		wantIPs:    nil,
 		wantReason: NotFilteredNotFound,
 		dtyp:       dns.TypeA,
+	}, {
+		name:       "issue6226",
+		host:       "www.issue6226.com",
+		wantCName:  "",
+		wantIPs:    []netip.Addr{addr1v4},
+		wantReason: Rewritten,
+		dtyp:       dns.TypeA,
+	}, {
+		name:       "issue6226_sub",
+		host:       "www.sub.issue6226.com",
+		wantCName:  "",
+		wantIPs:    []netip.Addr{addr2v4},
+		wantReason: Rewritten,
+		dtyp:       dns.TypeA,
 	}}
 
 	for _, tc := range testCases {