From c4ff1401b9d0a85026edf5538f8609a78d82ee9c Mon Sep 17 00:00:00 2001
From: Carsten Beckmann <cbeck@genua.de>
Date: Tue, 23 Jan 2024 13:40:20 +0100
Subject: [PATCH] Add tests for negated addresses

Test that negated addresses are added into pf tables and that hosts
resolving to these addresses won't have their addresses added to the
table.
Test that networks cannot be negated.
Test that the same address cannot be specified in normal and negated
form.
---
 regress/Proc.pm                            |  4 +-
 regress/args-negated-address.pl            | 44 ++++++++++++++++++++++
 regress/args-negated-network.pl            | 22 +++++++++++
 regress/args-normal-and-negated-address.pl | 23 +++++++++++
 4 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 regress/args-negated-address.pl
 create mode 100644 regress/args-negated-network.pl
 create mode 100644 regress/args-normal-and-negated-address.pl

diff --git a/regress/Proc.pm b/regress/Proc.pm
index eb936cd..45e2bcc 100644
--- a/regress/Proc.pm
+++ b/regress/Proc.pm
@@ -146,9 +146,11 @@ sub loggrep {
 	my $end;
 	$end = time() + $timeout if $timeout;
 
+	my $expected_status = $self->{expected_status} || 0;
+
 	do {
 		my($kid, $status, $code) = $self->wait(WNOHANG);
-		if ($kid > 0 && $status != 0) {
+		if ($kid > 0 && $status >> 8 != $expected_status) {
 			# child terminated with failure
 			die ref($self), " child status: $status $code";
 		}
diff --git a/regress/args-negated-address.pl b/regress/args-negated-address.pl
new file mode 100644
index 0000000..d8e0e1a
--- /dev/null
+++ b/regress/args-negated-address.pl
@@ -0,0 +1,44 @@
+# Create zone file with A and AAAA records in zone regress.
+# Start nsd with zone file listening on 127.0.0.1.
+# Write hosts of regress zone into pfresolved config.
+# Write negated addresses for hosts in regress zone into pfresolved config.
+# Start pfresolved with nsd as resolver.
+# Wait until pfresolved creates table regress-pfresolved.
+# Read IP addresses from pf table with pfctl.
+# Check that pfresolved resolved IPv4 and IPv6 addresses.
+# Check that pf table only contains the negated IPv4 and IPv6 addresses.
+
+use strict;
+use warnings;
+use Socket;
+
+our %args = (
+    nsd => {
+        record_list => [
+            "foo        IN      A       192.0.2.1",
+            "foo        IN      AAAA    2001:DB8::1",
+        ],
+    },
+    pfresolved => {
+        address_list => [
+            "foo.regress.",
+            "! 192.0.2.1",
+            "! 2001:DB8::1",
+        ],
+        loggrep => {
+            qr{added: 192.0.2.1/32,} => 1,
+            qr{added: 2001:db8::1/128,} => 1,
+        },
+    },
+    pfctl => {
+        updated => [2, 0],
+        loggrep => {
+            qr/^  !192.0.2.1$/ => 1,
+            qr/^   192.0.2.1$/ => 0,
+            qr/^  !2001:db8::1$/ => 1,
+            qr/^   2001:db8::1$/ => 0,
+        },
+    },
+);
+
+1;
diff --git a/regress/args-negated-network.pl b/regress/args-negated-network.pl
new file mode 100644
index 0000000..89cd0d7
--- /dev/null
+++ b/regress/args-negated-network.pl
@@ -0,0 +1,22 @@
+# Write negated network into pfresolved config.
+# Start pfresolved.
+# Check that configuration parsing fails.
+
+use strict;
+use warnings;
+use Socket;
+
+our %args = (
+    pfresolved => {
+        address_list => [
+            "! 192.0.2.1/24",
+        ],
+        loggrep => {
+            qr{negation is not allowed for networks} => 1,
+        },
+        expected_status => 1,
+        down => "parent: parsing configuration failed",
+    },
+);
+
+1;
diff --git a/regress/args-normal-and-negated-address.pl b/regress/args-normal-and-negated-address.pl
new file mode 100644
index 0000000..ffbcb99
--- /dev/null
+++ b/regress/args-normal-and-negated-address.pl
@@ -0,0 +1,23 @@
+# Write the same address in normal and negated form into pfresolved config.
+# Start pfresolved.
+# Check that configuration parsing fails.
+
+use strict;
+use warnings;
+use Socket;
+
+our %args = (
+    pfresolved => {
+        address_list => [
+            "192.0.2.1",
+            "! 192.0.2.1",
+        ],
+        loggrep => {
+            qr{the same address cannot be specified in normal and negated form} => 1,
+        },
+        expected_status => 1,
+        down => "parent: parsing configuration failed",
+    },
+);
+
+1;