Add tests for negated addresses

Test that negated addresses are added into pf tables and that hosts
resolving to these addresses won't have their addresses added to the
table.
Test that networks cannot be negated.
Test that the same address cannot be specified in normal and negated
form.

regress/Proc.pm

@@ -146,9 +146,11 @@ sub loggrep {
 	my $end;
 	$end = time() + $timeout if $timeout;
 
+	my $expected_status = $self->{expected_status} || 0;
+
 	do {
 		my($kid, $status, $code) = $self->wait(WNOHANG);
-		if ($kid > 0 && $status != 0) {
+		if ($kid > 0 && $status != $expected_status << 8) {
 			# child terminated with failure
 			die ref($self), " child status: $status $code";
 		}

regress/args-negated-address.pl

@@ -0,0 +1,44 @@
+# Create zone file with A and AAAA records in zone regress.
+# Start nsd with zone file listening on 127.0.0.1.
+# Write hosts of regress zone into pfresolved config.
+# Write negated addresses for hosts in regress zone into pfresolved config.
+# Start pfresolved with nsd as resolver.
+# Wait until pfresolved creates table regress-pfresolved.
+# Read IP addresses from pf table with pfctl.
+# Check that pfresolved resolved IPv4 and IPv6 addresses.
+# Check that pf table only contains the negated IPv4 and IPv6 addresses.
+
+use strict;
+use warnings;
+use Socket;
+
+our %args = (
+    nsd => {
+        record_list => [
+            "foo        IN      A       192.0.2.1",
+            "foo        IN      AAAA    2001:DB8::1",
+        ],
+    },
+    pfresolved => {
+        address_list => [
+            "foo.regress.",
+            "! 192.0.2.1",
+            "! 2001:DB8::1",
+        ],
+        loggrep => {
+            qr{added: 192.0.2.1/32,} => 1,
+            qr{added: 2001:db8::1/128,} => 1,
+        },
+    },
+    pfctl => {
+        updated => [2, 0],
+        loggrep => {
+            qr/^  !192.0.2.1$/ => 1,
+            qr/^   192.0.2.1$/ => 0,
+            qr/^  !2001:db8::1$/ => 1,
+            qr/^   2001:db8::1$/ => 0,
+        },
+    },
+);
+
+1;

regress/args-negated-network.pl

@@ -0,0 +1,22 @@
+# Write negated network into pfresolved config.
+# Start pfresolved.
+# Check that configuration parsing fails.
+
+use strict;
+use warnings;
+use Socket;
+
+our %args = (
+    pfresolved => {
+        address_list => [
+            "! 192.0.2.1/24",
+        ],
+        loggrep => {
+            qr{negation is not allowed for networks} => 1,
+        },
+        expected_status => 1,
+        down => "parent: parsing configuration failed",
+    },
+);
+
+1;

regress/args-normal-and-negated-address.pl

@@ -0,0 +1,23 @@
+# Write the same address in normal and negated form into pfresolved config.
+# Start pfresolved.
+# Check that configuration parsing fails.
+
+use strict;
+use warnings;
+use Socket;
+
+our %args = (
+    pfresolved => {
+        address_list => [
+            "192.0.2.1",
+            "! 192.0.2.1",
+        ],
+        loggrep => {
+            qr{the same address cannot be specified in normal and negated form} => 1,
+        },
+        expected_status => 1,
+        down => "parent: parsing configuration failed",
+    },
+);
+
+1;