1 files changed, 29 insertions, 0 deletions
diff --git a/scripts/testing/net-scenarios/10-nm-masked.sh b/scripts/testing/net-scenarios/10-nm-masked.sh
new file mode 100644
index 0000000..d3b382b
--- /dev/null
+++ b/scripts/testing/net-scenarios/10-nm-masked.sh
@@ -0,0 +1,29 @@
+# shellcheck shell=bash disable=SC2034  # sourced by run-net-scenarios.sh
+# Scenario: a masked NetworkManager is unmasked and started.
+#
+# Masking NetworkManager makes the generic "isn't running" verdict useless —
+# systemctl can't start a masked unit — so the doctor must name the mask and
+# unmask first. Break by masking; the fix's chain should unmask then start.
+SCENARIO_DESC="masked NetworkManager is unmasked and started"
+SCENARIO_GROUP="control-plane"
+
+scenario_break() {
+    nexec "systemctl mask NetworkManager"
+}
+
+# The verdict the read-only diagnose should produce before any fix runs.
+scenario_diagnose_expect() {
+    ndoctor_json ".outcome" | grep -qx fixable \
+        && ndoctor_json '.report.control_plane.nm_state' | grep -qx masked
+}
+
+scenario_fix() {
+    nfix   # net doctor --fix
+}
+
+scenario_assert() {
+    # Unmasked (the state flip, testable anywhere) AND active (needs a real
+    # NetworkManager, so a container without netlink can only show the unmask).
+    ! nexec "systemctl is-enabled NetworkManager | grep -qx masked" \
+        && nexec "systemctl is-active NetworkManager >/dev/null"
+}