From 05733d7402eef48f29f0ae47904c34e4d1697efe Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Wed, 8 Jul 2026 13:03:40 +1000
Subject: [PATCH] fix: WHITELIST_IPS validation and CSV load (2.3.1-SAC)

Parse whitelist from config via peek; validate IPv4 octets with BASH_REMATCH and 10# arithmetic.
---
 release/manifest-2.3.1-SAC.json | 11 +++++++++++
 ssh-monitor                     | 16 +++++++++++++---
 ssh-monitor-perms.sh            |  8 +++++---
 version.txt                     |  2 +-
 4 files changed, 30 insertions(+), 7 deletions(-)
 create mode 100644 release/manifest-2.3.1-SAC.json

diff --git a/release/manifest-2.3.1-SAC.json b/release/manifest-2.3.1-SAC.json
new file mode 100644
index 0000000..c67af9d
--- /dev/null
+++ b/release/manifest-2.3.1-SAC.json
@@ -0,0 +1,11 @@
+{
+  "version": "2.3.1-SAC",
+  "git_commit": "",
+  "files": {
+    "ssh-monitor": "sha256:0219054a824242ef800410fd17843e0c45e0572608dfa4825168fbcee0d97012",
+    "sac-client.sh": "sha256:4c481effd0e50b3db8cfa3baf3c5f228892530939df6f534a5d3d3d8a79db048",
+    "update_ssh_monitor.sh": "sha256:76c610ed229d510c41ddd0d10db2b68d48c08b89eb1c8252341ce85f088bf6cd",
+    "ssh-monitor-watchdog": "sha256:c03c50162b552a7790dd0a63eecec08d672ee04955281b5ec434ed92af5e0e2f",
+    "ssh-monitor-perms.sh": "sha256:a4e9be8b9d095abf036c1265186863c2e490baf6f05798010dd17c41197a29e4"
+  }
+}
diff --git a/ssh-monitor b/ssh-monitor
index 229c3b3..02f031f 100644
--- a/ssh-monitor
+++ b/ssh-monitor
@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="2.3.0-SAC"
+SSH_MONITOR_VERSION="2.3.1-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/ssh-monitor-perms.sh" ]; then
@@ -301,8 +301,18 @@ load_config() {
  BAN_CHECK_INTERVAL="${BAN_CHECK_INTERVAL:-$cfg_ban_check_interval}"
  MONITOR_INTERVAL="${MONITOR_INTERVAL:-$cfg_monitor_interval}"
 
- local whitelist_ips_csv="${WHITELIST_IPS:-$cfg_whitelist_ips_csv}"
- local whitelist_subnets_csv="${WHITELIST_SUBNETS:-$cfg_whitelist_subnets_csv}"
+ local whitelist_ips_csv=""
+ local whitelist_subnets_csv=""
+ if [ -f "$CONFIG_FILE" ]; then
+  whitelist_ips_csv="$(ssh_monitor_config_peek WHITELIST_IPS "$CONFIG_FILE" "$cfg_whitelist_ips_csv")"
+  whitelist_subnets_csv="$(ssh_monitor_config_peek WHITELIST_SUBNETS "$CONFIG_FILE" "$cfg_whitelist_subnets_csv")"
+ else
+  whitelist_ips_csv="$cfg_whitelist_ips_csv"
+  whitelist_subnets_csv="$cfg_whitelist_subnets_csv"
+ fi
+ unset -v WHITELIST_IPS WHITELIST_SUBNETS 2>/dev/null || true
+ WHITELIST_IPS=()
+ WHITELIST_SUBNETS=()
  csv_to_array "$whitelist_ips_csv" WHITELIST_IPS
  csv_to_array "$whitelist_subnets_csv" WHITELIST_SUBNETS
 
diff --git a/ssh-monitor-perms.sh b/ssh-monitor-perms.sh
index b2c8ad7..e5d33a9 100644
--- a/ssh-monitor-perms.sh
+++ b/ssh-monitor-perms.sh
@@ -135,15 +135,17 @@ ssh_monitor_config_load_file() {
 
 ssh_monitor_validate_ipv4() {
 	local ip="$1" o
-	[[ "$ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || return 1
-	for o in ${ip//./ }; do
-		[ "$o" -le 255 ] || return 1
+	ip="$(_ssh_monitor_config_trim "$ip")"
+	[[ "$ip" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
+	for o in "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}" "${BASH_REMATCH[4]}"; do
+		((10#$o <= 255)) || return 1
 	done
 	return 0
 }
 
 ssh_monitor_validate_cidr_v4() {
 	local cidr="$1" net mask
+	cidr="$(_ssh_monitor_config_trim "$cidr")"
 	[[ "$cidr" == */* ]] || return 1
 	net="${cidr%/*}"
 	mask="${cidr#*/}"
diff --git a/version.txt b/version.txt
index f53314a..640db42 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-2.3.0-SAC
+2.3.1-SAC