A few changes for TTL processing:

- Cached messages that reach 0 TTL are considered expired. This prevents
  Unbound itself from issuing replies with TTL 0 and possibly causing a
  thundering herd at the last second. Upstream replies of TTL 0 still
  get the usual pass-through but they are not considered for caching
  from Unbound or any of its caching modules.
- 'serve-expired-reply-ttl' is changed and is now capped by the original
  TTL value of the record to try and make some sense when replying
  with expired records.
- TTL decoding was updated to adhere to RFC8767 section 4 where a set
  high-order bit means the value is positive instead of 0.

validator/val_neg.c

@@ -1066,11 +1066,7 @@ grab_nsec(struct rrset_cache* rrset_cache, uint8_t* qname, size_t qname_len,
 		qname, qname_len, qtype, qclass, flags, now, 0);
 	struct packed_rrset_data* d;
 	if(!k) return NULL;
-	d = (struct packed_rrset_data*)k->entry.data;
-	if(d->ttl < now) {
-		lock_rw_unlock(&k->entry.lock);
-		return NULL;
-	}
+	d = k->entry.data;
 	/* only secure or unchecked records that have signatures. */
 	if( ! ( d->security == sec_status_secure ||
 		(d->security == sec_status_unchecked &&

validator/val_utils.c

@@ -1310,6 +1310,7 @@ val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
 		/* DS rrset exists. Return it to the validator immediately*/
 		struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
 			rrset, region, *env->now);
+		struct packed_rrset_data* d = copy->entry.data;
 		lock_rw_unlock(&rrset->entry.lock);
 		if(!copy)
 			return NULL;
@@ -1319,6 +1320,7 @@ val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
 		msg->rep->rrsets[0] = copy;
 		msg->rep->rrset_count++;
 		msg->rep->an_numrrsets++;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 		return msg;
 	}
 	/* lookup in rrset and negative cache for NSEC/NSEC3 */