Fix TSIG keys creation/eviction bug

When adding a new key to the SIEVE list, make the eviction decision
first, and then add the new key, so that it doesn't get evicted
immediately after insertion.

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index c1b5d450c0705b626eb35f4af1066e9d608718b2..5f17eaddb67d4b87bd02993acd0caada64bd748b 100644 (file)
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -1556,12 +1556,17 @@ dns_tsigkeyring_add(dns_tsigkeyring_t *ring, dns_tsigkey_t *tkey) {
                 * delete the least recently used one.
                 */
                if (tkey->generated) {
-                       ISC_SIEVE_INSERT(ring->lrulist, tkey, lrulink);
                        if (++ring->generated > DNS_TSIG_MAXGENERATEDKEYS) {
                                dns_tsigkey_t *key = ISC_SIEVE_NEXT(
                                        ring->lrulist, visited, lrulink);
                                dns__tsigkey_delete(ring, key);
                        }
+                       /*
+                        * Insert the new key AFTER any possible eviction, so
+                        * that the key is not evicted immediately after the
+                        * insertion.
+                        */
+                       ISC_SIEVE_INSERT(ring->lrulist, tkey, lrulink);
                }
        }
        RWUNLOCK(&ring->lock, isc_rwlocktype_write);