fix: WHITELIST_IPS validation and CSV load (2.3.1-SAC)

Parse whitelist from config via peek; validate IPv4 octets with BASH_REMATCH and 10# arithmetic.

release/manifest-2.3.1-SAC.json

@@ -0,0 +1,11 @@
+{
+  "version": "2.3.1-SAC",
+  "git_commit": "",
+  "files": {
+    "ssh-monitor": "sha256:0219054a824242ef800410fd17843e0c45e0572608dfa4825168fbcee0d97012",
+    "sac-client.sh": "sha256:4c481effd0e50b3db8cfa3baf3c5f228892530939df6f534a5d3d3d8a79db048",
+    "update_ssh_monitor.sh": "sha256:76c610ed229d510c41ddd0d10db2b68d48c08b89eb1c8252341ce85f088bf6cd",
+    "ssh-monitor-watchdog": "sha256:c03c50162b552a7790dd0a63eecec08d672ee04955281b5ec434ed92af5e0e2f",
+    "ssh-monitor-perms.sh": "sha256:a4e9be8b9d095abf036c1265186863c2e490baf6f05798010dd17c41197a29e4"
+  }
+}

ssh-monitor

@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="2.3.0-SAC"
+SSH_MONITOR_VERSION="2.3.1-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/ssh-monitor-perms.sh" ]; then
@@ -301,8 +301,18 @@ load_config() {
  BAN_CHECK_INTERVAL="${BAN_CHECK_INTERVAL:-$cfg_ban_check_interval}"
  MONITOR_INTERVAL="${MONITOR_INTERVAL:-$cfg_monitor_interval}"
 
- local whitelist_ips_csv="${WHITELIST_IPS:-$cfg_whitelist_ips_csv}"
- local whitelist_subnets_csv="${WHITELIST_SUBNETS:-$cfg_whitelist_subnets_csv}"
+ local whitelist_ips_csv=""
+ local whitelist_subnets_csv=""
+ if [ -f "$CONFIG_FILE" ]; then
+  whitelist_ips_csv="$(ssh_monitor_config_peek WHITELIST_IPS "$CONFIG_FILE" "$cfg_whitelist_ips_csv")"
+  whitelist_subnets_csv="$(ssh_monitor_config_peek WHITELIST_SUBNETS "$CONFIG_FILE" "$cfg_whitelist_subnets_csv")"
+ else
+  whitelist_ips_csv="$cfg_whitelist_ips_csv"
+  whitelist_subnets_csv="$cfg_whitelist_subnets_csv"
+ fi
+ unset -v WHITELIST_IPS WHITELIST_SUBNETS 2>/dev/null || true
+ WHITELIST_IPS=()
+ WHITELIST_SUBNETS=()
  csv_to_array "$whitelist_ips_csv" WHITELIST_IPS
  csv_to_array "$whitelist_subnets_csv" WHITELIST_SUBNETS
 

ssh-monitor-perms.sh

@@ -135,15 +135,17 @@ ssh_monitor_config_load_file() {
 
 ssh_monitor_validate_ipv4() {
 	local ip="$1" o
-	[[ "$ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || return 1
-	for o in ${ip//./ }; do
-		[ "$o" -le 255 ] || return 1
+	ip="$(_ssh_monitor_config_trim "$ip")"
+	[[ "$ip" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
+	for o in "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}" "${BASH_REMATCH[4]}"; do
+		((10#$o <= 255)) || return 1
 	done
 	return 0
 }
 
 ssh_monitor_validate_cidr_v4() {
 	local cidr="$1" net mask
+	cidr="$(_ssh_monitor_config_trim "$cidr")"
 	[[ "$cidr" == */* ]] || return 1
 	net="${cidr%/*}"
 	mask="${cidr#*/}"

version.txt

@@ -1 +1 @@
-2.3.0-SAC
+2.3.1-SAC