test

// Ad-hoc manual verification, not part of the checked-in test suite (SPF evaluation needs live

// DNS against real third-party domains, which would make a ctest-registered test flaky against

// this environment's network and against those domains' policies changing over time -- the

// same reason DkimAdapter::verify()/DmarcAdapter::evaluate() have no ctest coverage either).

#include "../src/security/SpfAdapter.h"

#include <iostream>

using proxyplus::security::SpfAdapter;

using proxyplus::security::SpfResult;

const char *name(SpfResult r) {

    switch (r) {

        case SpfResult::None: return "None";

        case SpfResult::Neutral: return "Neutral";

        case SpfResult::Pass: return "Pass";

        case SpfResult::Fail: return "Fail";

        case SpfResult::SoftFail: return "SoftFail";

        case SpfResult::TempError: return "TempError";

        case SpfResult::PermError: return "PermError";

    }

    return "?";

}

int main() {

    SpfAdapter spf;

    // google.com's record is "v=spf1 include:_spf.google.com ~all" -- an IP with no business

    // being in any of Google's ranges must fail (through the ~all catch-all), and a domain

    // with no SPF record at all must be None.

    std::cout << "google.com vs 203.0.113.1 (documentation range, TEST-NET-3, RFC 5737): "

              << name(spf.check("google.com", "203.0.113.1")) << " (expect SoftFail)\n";

    std::cout << "example.com vs 203.0.113.1 (no SPF record at all): "

              << name(spf.check("example.com", "203.0.113.1")) << " (expect None)\n";

    // A known Google Workspace outbound source range from _spf.google.com's own published

    // "include:_netblocks.google.com" (ip4:172.217.0.0/16 has stayed stable across Google's

    // ranges for years, since it's the core Google IPv4 block) -- exercises ip4 CIDR matching

    // through a real "include:" chain.

    std::cout << "google.com vs 172.217.1.1 (inside Google's own 172.217.0.0/16): "

              << name(spf.check("google.com", "172.217.1.1")) << " (expect Pass)\n";

    return 0;

}