File: firewall/whitelist.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# firewall/whitelist.sh ? Gestión de lista blanca
#=============================================================================
#
# Las IPs en whitelist se agregan al ipset SENTINELA_TRUSTED
# y están exentas de todos los bloqueos.
#=============================================================================

# shellcheck source=lib/common.sh
source "${SENTINELA_DIR}/lib/common.sh"
source "${SENTINELA_DIR}/lib/ssh-session.sh"

#=============================================================================
# Cargar whitelist desde configuración
#=============================================================================
whitelist_load() {
    if [[ -z "${WHITELIST}" ]]; then
        log_debug "Whitelist vacía en configuración"
        return 0
    fi

    log_info "Cargando whitelist desde configuración..."

    local IFS=' ,'
    for ip in ${WHITELIST}; do
        ip=$(echo "${ip}" | xargs)
        if is_valid_ip "${ip}"; then
            ${IPSET} add "${TRUSTED_IPSET}" "${ip}" timeout 0 2>/dev/null || true
            log_info "Whitelist: ${ip} agregada permanentemente"
        fi
    done
}

#=============================================================================
# Agregar IP a whitelist (config + ipset)
#=============================================================================
whitelist_add() {
    local ip="$1"

    if ! is_valid_ip "${ip}"; then
        log_error "IP inválida: ${ip}"
        return 1
    fi

    require_root

    # Agregar a ipset
    source "${SENTINELA_DIR}/lib/ssh-session.sh"
    ssh_trust_ip "${ip}"

    # Agregar a configuración para persistencia
    if [[ -f "${SENTINELA_CONFIG}" ]]; then
        if grep -q "^WHITELIST=" "${SENTINELA_CONFIG}"; then
            local current
            current=$(grep "^WHITELIST=" "${SENTINELA_CONFIG}" | cut -d'"' -f2)
            if echo "${current}" | grep -q "${ip}"; then
                log_info "IP ${ip} ya está en whitelist de configuración"
            else
                local new="${current} ${ip}"
                sed -i "s/^WHITELIST=.*/WHITELIST=\"${new}\"/" "${SENTINELA_CONFIG}"
                log_info "IP ${ip} agregada a whitelist en configuración"
            fi
        else
            echo "WHITELIST=\"${ip}\"" >> "${SENTINELA_CONFIG}"
        fi
    fi

    return 0
}

#=============================================================================
# Quitar IP de whitelist
#=============================================================================
whitelist_remove() {
    local ip="$1"

    if ! is_valid_ip "${ip}"; then
        log_error "IP inválida: ${ip}"
        return 1
    fi

    require_root

    # Quitar de ipset
    source "${SENTINELA_DIR}/lib/ssh-session.sh"
    ssh_untrust_ip "${ip}"

    # Quitar de configuración
    if [[ -f "${SENTINELA_CONFIG}" ]]; then
        if grep -q "^WHITELIST=" "${SENTINELA_CONFIG}"; then
            local current
            current=$(grep "^WHITELIST=" "${SENTINELA_CONFIG}" | cut -d'"' -f2)
            local new
            new=$(echo "${current}" | tr ' ' '\n' | grep -v "^${ip}$" | tr '\n' ' ' | xargs)
            sed -i "s/^WHITELIST=.*/WHITELIST=\"${new}\"/" "${SENTINELA_CONFIG}"
            log_info "IP ${ip} removida de whitelist en configuración"
        fi
    fi

    return 0
}

#=============================================================================
# Listar whitelist
#=============================================================================
whitelist_list() {
    echo "Lista blanca (WHITELIST):"
    echo "??????????????????????????????????????"
    if [[ -n "${WHITELIST}" ]]; then
        local IFS=' ,'
        for ip in ${WHITELIST}; do
            echo "  ${ip}"
        done
    else
        echo "  (vacía)"
    fi
    echo
    echo "IPs en TRUSTED ipset:"
    echo "??????????????????????????????????????"
    ${IPSET} list "${TRUSTED_IPSET}" 2>/dev/null | grep -E '^[0-9]' | sort -t' ' -k2 || echo "  (vacío)"
}