route-update: validate resolved IPs, filter garbage DNS responses

router/route-update.sh

@@ -472,7 +472,22 @@ resolve_list_file()
             grep -v '^#' "$_f" | grep -v '^$' >> "$_resolved_new.tmp"
         fi
     fi
-    sed 's|/32$||' "$_resolved_new.tmp" | sort -u > "$_resolved_new"
+    # Filter out invalid entries (garbage DNS responses, truncated lines)
+    if [ "$_ipcmd" = "ip -6" ] ; then
+        grep -E '^[0-9a-f:]+(/[0-9]+)?$' "$_resolved_new.tmp" | sort -u > "$_resolved_new"
+    else
+        # Validate IPv4: each octet 0-255, optional /prefix, strip /32
+        grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/[0-9]+)?$' "$_resolved_new.tmp" | \
+            sed 's|/32$||' | \
+            awk -F'[./]' '{ ok=1; for(i=1;i<=4;i++) if($i+0>255) ok=0; if(ok) print }' | \
+            sort -u > "$_resolved_new"
+    fi
+    # Warn about filtered garbage
+    local _bad=$(grep -vE '^(#|$)' "$_resolved_new.tmp" | grep -cvE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/[0-9]+)?$' || true)
+    if [ "$_ipcmd" = "ip -6" ] ; then
+        _bad=$(grep -vE '^(#|$)' "$_resolved_new.tmp" | grep -cvE '^[0-9a-f:]+(/[0-9]+)?$' || true)
+    fi
+    [ "$_bad" -gt 0 ] && log "$_tag$_label WARNING: filtered out $_bad invalid entries from DNS resolve" || true
     rm -f "$_resolved_new.tmp"
 
     # Accumulate resolve history (DNS round-robin)