From: Aram Sargsyan <aram@isc.org>
Date: Tue, 14 Jul 2026 11:26:50 +0000 (+0000)
Subject: Fix TSIG keys creation/eviction bug
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2e59e0da403af51b3fe18794373accc71a15628d;p=thirdparty%2Fbind9.git

Fix TSIG keys creation/eviction bug

When adding a new key to the SIEVE list, make the eviction decision
first, and then add the new key, so that it doesn't get evicted
immediately after insertion.
---

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index c1b5d450c07..5f17eaddb67 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -1556,12 +1556,17 @@ dns_tsigkeyring_add(dns_tsigkeyring_t *ring, dns_tsigkey_t *tkey) {
 		 * delete the least recently used one.
 		 */
 		if (tkey->generated) {
-			ISC_SIEVE_INSERT(ring->lrulist, tkey, lrulink);
 			if (++ring->generated > DNS_TSIG_MAXGENERATEDKEYS) {
 				dns_tsigkey_t *key = ISC_SIEVE_NEXT(
 					ring->lrulist, visited, lrulink);
 				dns__tsigkey_delete(ring, key);
 			}
+			/*
+			 * Insert the new key AFTER any possible eviction, so
+			 * that the key is not evicted immediately after the
+			 * insertion.
+			 */
+			ISC_SIEVE_INSERT(ring->lrulist, tkey, lrulink);
 		}
 	}
 	RWUNLOCK(&ring->lock, isc_rwlocktype_write);