#!/bin/bash
# -------------------------------------------------------------
#  SCENARIO C - Partial bypass: SPF pass but DMARC fail
# -------------------------------------------------------------
#
#  This is the key didactic scenario: SPF alone is NOT enough.
#
#  Flow:  swaks --> direct to receiver-mta
#         Envelope says thirdparty.lab (SPF pass)
#         Header From says legit.lab   (user sees legit.lab)
#         No DKIM signing
#
#  MAIL FROM: <mailer@thirdparty.lab>
#  From:      CEO <ceo@legit.lab>   -- impersonation!
#  To:        bob@receiver.lab
#  DKIM:      none
#
#  Expected results on receiver-mta:
#    SPF  = pass   (10.0.0.10 is authorized for thirdparty.lab)
#    DKIM = none   (no signature)
#    DMARC= fail   (From=legit.lab, SPF domain=thirdparty.lab -> mismatch)
#    Action: REJECT (legit.lab policy is p=reject)
#
#  Key insight: SPF passed on the envelope domain, but DMARC
#  checks alignment between SPF domain and From header domain.
#  They don't match -> DMARC fail despite SPF pass.
# -------------------------------------------------------------

set -e

echo ""
echo "---------------------------------------------------"
echo "  SCENARIO C - Partial Bypass (SPF pass,         "
echo "                DMARC fail due to alignment)      "
echo "---------------------------------------------------"
echo ""

# Send directly to receiver-mta from sender-mta IP (10.0.0.10)
# Envelope: thirdparty.lab (SPF will pass for this IP)
# Header:   legit.lab      (the domain the user sees)
swaks \
    --to bob@receiver.lab \
    --from mailer@thirdparty.lab \
    --h-From "CEO <ceo@legit.lab>" \
    --h-Subject "Invoice #12345 - please review" \
    --body "This email has SPF=pass (envelope is thirdparty.lab, authorized IP).\nBut the From header says legit.lab.\nDMARC catches the alignment mismatch and rejects." \
    --server 10.0.0.20 \
    --port 25 \
    --timeout 30 \
    || true   # swaks will exit non-zero on SMTP reject - that's expected

echo ""
echo "--- Scenario C sent. Check receiver-mta logs for alignment mismatch. ---"
echo "    Expected: spf=pass (thirdparty.lab), dkim=none, dmarc=fail"
echo "    Key point: SPF passed but for the WRONG domain!"
echo ""
