silently ignore additional keytag options

diff --git a/lib/ns/client.c b/lib/ns/client.c
index b71aa73eaa36b4bb2be8467a9660357e7cef2eec..321818bd2775098492fce04b916b516aa78038a0 100644 (file)
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -2079,6 +2079,12 @@ process_keytag(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
                return (DNS_R_OPTERR);
        }
 
+       /* Silently drop additional keytag options. */
+       if (client->keytag != NULL) {
+               isc_buffer_forward(buf, (unsigned int)optlen);
+               return (ISC_R_SUCCESS);
+       }
+
        client->keytag = isc_mem_get(client->mctx, optlen);
        if (client->keytag != NULL) {
                client->keytag_len = (uint16_t)optlen;