Ondřej Surý 51774decd2 Reject negative and out-of-range TTLs in dnssec-* tools ... strtottl() parsed the operator's TTL string with strtol() and assigned the long directly to dns_ttl_t (uint32_t) with no sign or ERANGE check. The only validation was the "no digits parsed" branch, so a fully-consumed "-1" became UINT32_MAX (~136 years) and was silently written into DNSKEY/key files by dnssec-keygen -L, dnssec-signzone -t, dnssec-settime -L, etc. Any signing pipeline interpolating the TTL from a variable could mint a key with a multi-decade TTL and never see an error. Switch to strtoul(), reject a leading '-' explicitly (strtoul silently negates), check errno == ERANGE, and reject values exceeding UINT32_MAX before handing the result to time_units(). The pre-existing multiplication wrap inside time_units() is tracked separately. Assisted-by: Claude:claude-opus-4-7		2026-04-30 17:40:19 +02:00
..
signer	Continue removal of license headers from test zones	2026-04-15 19:26:23 +00:00
algroll.dnskey	move some test cases to different system tests	2025-07-31 12:55:40 -07:00
dsset-algroll.	move some test cases to different system tests	2025-07-31 12:55:40 -07:00
revkey.dnskey	move some test cases to different system tests	2025-07-31 12:55:40 -07:00
tests.sh	Reject negative and out-of-range TTLs in dnssec-* tools	2026-04-30 17:40:19 +02:00
tests_sh_dnssectools.py	Checking maximal sized compresses bit map works	2026-04-10 15:45:01 +10:00