Start nsd to provide answers for pfresolved.

Create zone file with A and AAAA records in zone regress.
Start nsd with zone file listening on 127.0.0.1.
Write hosts of regress zone into pfresolved config.
Start pfresolved with nsd as resolver.
Wait until pfresolved creates table regress-pfresolved.
Read IP addresses from pf table with pfctl.
Check that pfresolved added IPv4 and IPv6 addresses.
Check that pf table contains all IPv4 and IPv6 addresses.

regress/Makefile

@@ -9,7 +9,12 @@ PFRESOLVED ?=		${.CURDIR}/../pfresolved
 PERLS =			Proc.pm Pfresolved.pm funcs.pl pfresolved.pl
 ARGS !=			cd ${.CURDIR} && ls args-*.pl
 REGRESS_TARGETS =       ${ARGS:S/^/run-/}
-CLEANFILES =		*.log *.conf ktrace.out stamp-* *.pid *.ktrace
+CLEANFILES =		*.log *.conf ktrace.out stamp-* *.pid *.ktrace *.zone
+
+REGRESS_SETUP_ONCE =	chmod-obj
+chmod-obj:
+	# nsd user needs read permission for zone file
+	-chmod o+rx ${.OBJDIR}
 
 # Set variables so that make runs with and without obj directory.
 # Only do that if necessary to keep visible output short.

regress/Nsd.pm

@@ -0,0 +1,90 @@
+#	$OpenBSD$
+
+# Copyright (c) 2010-2023 Alexander Bluhm <[email protected]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+use strict;
+use warnings;
+
+package Nsd;
+use parent 'Proc';
+use Carp;
+use File::Basename;
+use Sys::Hostname;
+
+sub new {
+	my $class = shift;
+	my %args = @_;
+	$args{conffile} ||= "nsd.conf";
+	$args{down} ||= "shutting down";
+	$args{func} = sub { Carp::confess "$class func may not be called" };
+	$args{ktraceexec} = "ktrace" if $args{ktrace};
+	$args{ktraceexec} = $ENV{KTRACE} if $ENV{KTRACE};
+	$args{ktracefile} ||= "nsd.ktrace";
+	$args{logfile} ||= "nsd.log";
+	$args{serial} ||= time();
+	$args{up} ||= "nsd started";
+
+	my $self = Proc::new($class, %args);
+
+	my $test = basename($self->{testfile} || "");
+	open(my $fh, '>', $self->{conffile}) or die ref($self),
+	    " config file '$self->{conffile}' create failed: $!";
+	print $fh "# test $test\n";
+	print $fh "server:\n";
+	print $fh "	chroot: \"\"\n";
+	print $fh "	ip-address: $self->{addr}\n";
+	print $fh "	pidfile: \"\"\n";
+	print $fh "	port: $self->{port}\n";
+	print $fh "	verbosity: 3\n";
+	print $fh "	zonesdir: .\n";
+	print $fh "zone:\n";
+	# libunbound does not process invalid domain
+	print $fh "	name: regress.\n";
+	print $fh "	zonefile: nsd.zone\n";
+
+	open(my $fz, '>', "nsd.zone") or die ref($self),
+	    " zone file 'nsd.zone' create failed: $!";
+	print $fz "; test $test\n";
+	print $fz "\$ORIGIN	regress.\n";
+	print $fz "\$TTL	86400\n";
+	print $fz "\@	IN	SOA	pfresolved root.pfresolved (\n";
+	print $fz "		$args{serial}	; serial number\n";
+	print $fz "		7200		; refresh\n";
+	print $fz "		600		; retry\n";
+	print $fz "		86400		; expire\n";
+	print $fz "		3600		; minimum TTL\n";
+	print $fz "	)\n";
+	foreach my $r (@{$self->{record_list} || []}) {
+		print $fz "$r\n";
+	}
+
+	return $self;
+}
+
+sub child {
+	my $self = shift;
+	my @sudo = $ENV{SUDO} ? $ENV{SUDO} : ();
+
+	my @ktrace;
+	@ktrace = ($self->{ktraceexec}, "-i", "-f", $self->{ktracefile})
+	    if $self->{ktraceexec};
+	my @cmd = (@sudo, @ktrace, "/usr/sbin/nsd", "-d",
+	    "-c", $self->{conffile});
+	print STDERR "execute: @cmd\n";
+	exec @cmd;
+	die ref($self), " exec '@cmd' failed: $!";
+}
+
+1;

regress/Pfctl.pm

@@ -29,16 +29,20 @@ sub new {
 	$args{up} ||= "Table";
 
 	my $self = Proc::new($class, %args);
+
 	return $self;
 }
 
 sub child {
 	my $self = shift;
 	my $timeout = $self->{timeout} || 5;
-	my $updates = $self->{updates};
+	my $updated = $self->{updated};
 	my $pfresolved = $self->{pfresolved};
 
-	my $table = "updated addresses for pf table";
+	# make it possible to match on /added: 2,/ by passing array
+	my ($updates, $added) = ($updated->[0], $updated->[1]);
+
+	my $table = qr/updated addresses for pf table .*: added: $added,/;
 	my $tomsg = $timeout ? " after $timeout seconds" : "";
 	my $upmsg = $updates ? " for $updates times" : "";
 	$pfresolved->loggrep($table, $timeout, $updates)
@@ -53,7 +57,7 @@ sub func {
 	my $self = shift;
 	my @sudo = $ENV{SUDO} ? $ENV{SUDO} : ();
 
-	my @cmd = (@sudo, qw(pfctl -t regress-pfresolved -T show));
+	my @cmd = (@sudo, qw(/sbin/pfctl -t regress-pfresolved -T show));
 	system(@cmd)
 	    and die die ref($self), " command '@cmd' failed: $?";
 }

regress/Pfresolved.pm

@@ -20,32 +20,33 @@ use warnings;
 package Pfresolved;
 use parent 'Proc';
 use Carp;
-use Cwd;
 use File::Basename;
 use Sys::Hostname;
 
 sub new {
 	my $class = shift;
 	my %args = @_;
+	$args{conffile} ||= "pfresolved.conf";
+	$args{down} ||= "parent terminating";
+	$args{execfile} ||= $ENV{PFRESOLVED} ? $ENV{PFRESOLVED} : "pfresolved";
+	$args{func} = sub { Carp::confess "$class func may not be called" };
 	$args{ktraceexec} = "ktrace" if $args{ktrace};
 	$args{ktraceexec} = $ENV{KTRACE} if $ENV{KTRACE};
 	$args{ktracefile} ||= "pfresolved.ktrace";
 	$args{logfile} ||= "pfresolved.log";
 	$args{up} ||= "forwarder starting";
-	$args{down} ||= "parent terminating";
-	$args{func} = sub { Carp::confess "$class func may not be called" };
-	$args{execfile} ||= $ENV{PFRESOLVED} ? $ENV{PFRESOLVED} : "pfresolved";
-	$args{conffile} ||= "pfresolved.conf";
+
 	my $self = Proc::new($class, %args);
 
 	my $test = basename($self->{testfile} || "");
 	open(my $fh, '>', $self->{conffile}) or die ref($self),
 	    " config file '$self->{conffile}' create failed: $!";
 	print $fh "# test $test\n";
 	print $fh "regress-pfresolved {\n";
-	print $fh "\t", join(",", @{$self->{address_list}}), "\n"
-	    if $self->{address_list};
-	print $fh  "\n}\n";
+	foreach my $a (@{$self->{address_list} || []}) {
+		print $fh "	$a\n";
+	}
+	print $fh  "}\n";
 
 	return $self;
 }
@@ -68,8 +69,12 @@ sub child {
 	my @ktrace;
 	@ktrace = ($self->{ktraceexec}, "-i", "-f", $self->{ktracefile})
 	    if $self->{ktraceexec};
+	my $resolver;
+	$resolver = $self->{addr} if $self->{addr};
+	$resolver .= '@'.$self->{port} if $self->{port};
 	my @cmd = (@sudo, @ktrace, $self->{execfile}, "-dvvv",
 	    "-f", $self->{conffile});
+	push @cmd, "-r", $resolver if $resolver;
 	print STDERR "execute: @cmd\n";
 	exec @cmd;
 	die ref($self), " exec '@cmd' failed: $!";

regress/args-ip.pl

@@ -11,6 +11,7 @@
 	address_list => [qw(192.0.2.1 2001:DB8::1)],  # documentation IPs
     },
     pfctl => {
+	updated => [1, 2],
 	loggrep => {
 	    qr/^   192.0.2.1$/ => 1,
 	    qr/^   2001:db8::1$/ => 1,

regress/args-localhost.pl

@@ -16,7 +16,7 @@
 	},
     },
     pfctl => {
-	updates => 3,
+	updated => [1, 1],
 	loggrep => {
 	    qr/^   127.0.0.1$/ => 1,
 	    qr/^   ::1$/ => 1,

regress/args-nsd.pl

@@ -0,0 +1,40 @@
+# Create zone file with A and AAAA records in zone regress.
+# Start nsd with zone file listening on 127.0.0.1.
+# Write hosts of regress zone into pfresolved config.
+# Start pfresolved with nsd as resolver.
+# Wait until pfresolved creates table regress-pfresolved.
+# Read IP addresses from pf table with pfctl.
+# Check that pfresolved added IPv4 and IPv6 addresses.
+# Check that pf table contains all IPv4 and IPv6 addresses.
+
+use strict;
+use warnings;
+
+our %args = (
+    nsd => {
+	record_list => [
+	    "foo	IN	A	192.0.2.1",
+	    "bar	IN	AAAA	2001:DB8::1",
+	    "foobar	IN	A	192.0.2.2",
+	    "foobar	IN	AAAA	2001:DB8::2",
+	],
+    },
+    pfresolved => {
+	address_list => [ map { "$_.regress." } qw(foo bar foobar) ],
+	loggrep => {
+	    qr{added: 192.0.2.1/32,} => 1,
+	    qr{added: 2001:db8::1/128,} => 1,
+	    qr{added: 192.0.2.2/32,} => 1,
+	    qr{added: 2001:db8::2/128,} => 1,
+	},
+    },
+    pfctl => {
+	updated => [4, 1],
+	loggrep => {
+	    qr/^   192.0.2.[12]$/ => 2,
+	    qr/^   2001:db8::[12]$/ => 2,
+	},
+    },
+);
+
+1;

regress/funcs.pl

@@ -16,6 +16,28 @@
 
 use strict;
 use warnings;
+use IO::Socket::IP;
+
+sub find_ports {
+	my %args = @_;
+	my $num    = delete $args{num}    // 1;
+	my $domain = delete $args{domain} // AF_INET;
+	my $addr   = delete $args{addr}   // "127.0.0.1";
+	my $proto  = delete $args{proto}  // "udp";
+	$proto = "tcp" if $proto eq "tls";
+
+	my @sockets = (1..$num);
+	foreach my $s (@sockets) {
+		$s = IO::Socket::IP->new(
+		    Domain    => $domain,
+		    LocalAddr => $addr,
+		    Proto     => $proto,
+		) or die "find_ports: create and bind socket failed: $!";
+	}
+	my @ports = map { $_->sockport() } @sockets;
+
+	return wantarray ? @ports : $ports[0];
+}
 
 sub check_logs {
 	my ($n, $d, $s, %args) = @_;
@@ -29,7 +51,7 @@ sub check_loggrep {
 	my ($n, $d, $s, %args) = @_;
 
 	my %name2proc = (nsd => $n, pfresolved => $d, pfctl => $s);
-	foreach my $name (qw(pfresolved pfctl)) {
+	foreach my $name (qw(nsd pfresolved pfctl)) {
 		my $p = $name2proc{$name} or next;
 		my $pattern = $args{$name}{loggrep} or next;
 		$pattern = [ $pattern ] unless ref($pattern) eq 'ARRAY';

regress/pfresolved.pl

@@ -18,6 +18,7 @@
 use strict;
 use warnings;
 
+use Nsd;
 use Pfresolved;
 use Pfctl;
 require 'funcs.pl';
@@ -35,22 +36,29 @@ sub usage {
 }
 @ARGV == 0 or usage();
 
+my $n = Nsd->new(
+    addr		=> $args{nsd}{listen}{addr} //= "127.0.0.1",
+    port		=> scalar find_ports(%{$args{nsd}{listen}}),
+    %{$args{nsd}},
+    testfile		=> $testfile,
+) if $args{nsd};
 my $d = Pfresolved->new(
+    addr		=> $n && $n->{addr},
+    port		=> $n && $n->{port},
     %{$args{pfresolved}},
     testfile		=> $testfile,
 );
 my $s = Pfctl->new(
     %{$args{pfctl}},
     pfresolved		=> $d,
-);
-
-$d->run;
-$d->up;
+) if $args{pfctl};
 
-$s->run;
-$s->up;
+$n->run->up if $n;
+$d->run->up;
+$s->run->up if $s;
 
-$d->kill_child;
-$d->down;
+$s->down if $s;
+$d->kill_child->down;
+$n->kill_child->down if $n;
 
-check_logs(undef, $d, $s, %args);
+check_logs($n, $d, $s, %args);