fix: reverter should execute the reversion in reversed order (#6872)

Signed-off-by: Jason Joo <hblzxsj@gmail.com>

plugin/rewrite/README.md

@@ -51,6 +51,7 @@ will behave as follows:
 
    * `continue` will continue applying the next rule in the rule list.
    * `stop` will consider the current rule the last rule and will not continue.  The default behaviour is `stop`
+   * When multiple rules are matched, the request rewrite follows the line order in the configuration, while the response rewrite(`answer` option) is executed in reverse order.
 
 ## Examples
 

plugin/rewrite/reverter.go

@@ -90,8 +90,9 @@ func (r *ResponseReverter) WriteMsg(res1 *dns.Msg) error {
 }
 
 func (r *ResponseReverter) rewriteResourceRecord(res *dns.Msg, rr dns.RR) {
-	for _, rule := range r.ResponseRules {
-		rule.RewriteResponse(res, rr)
+	// The reverting rules need to be done in reversed order.
+	for i := len(r.ResponseRules) - 1; i >= 0; i-- {
+		r.ResponseRules[i].RewriteResponse(res, rr)
 	}
 }
 

plugin/rewrite/reverter_test.go

@@ -126,6 +126,24 @@ func TestValueResponseReverter(t *testing.T) {
 	rules = append(rules, r)
 
 	doValueReverterTests("suffix", rules, t)
+
+	// multiple rules
+	rules = []Rule{}
+	r, err = newNameRule("continue", "suffix", `.domain.uk`, ".domain.us", "answer", "auto")
+	if err != nil {
+		t.Errorf("cannot parse rule: %s", err)
+		return
+	}
+	rules = append(rules, r)
+
+	r, err = newNameRule("stop", "suffix", `.domain.us`, ".cluster.local", "answer", "auto")
+	if err != nil {
+		t.Errorf("cannot parse rule: %s", err)
+		return
+	}
+	rules = append(rules, r)
+
+	doValueReverterTests("suffix_multiple", rules, t)
 }
 
 func doValueReverterTests(name string, rules []Rule, t *testing.T) {