From 996be0bdd07a6d4a4568e4a7fb6f22a22843624b Mon Sep 17 00:00:00 2001
From: cschantz <admin@server.local>
Date: Wed, 24 Dec 2025 20:29:56 -0500
Subject: [PATCH] Fix integer expression error in subnet_bonus parsing

Bug: Line 2557 integer comparison failed
Error: [: 1|0|: integer expression expected

Root cause:
calculate_subnet_bonus() returns 'count|bonus|reason' format
Code was trying to compare full string '1|0|' as integer

Fix:
Parse the pipe-delimited output properly:
- IFS='|' read -r subnet_count subnet_bonus subnet_reason
- Use ${subnet_bonus:-0} for safe integer comparison
- Use subnet_reason instead of hardcoded 'SUBNET_ATTACK'

This matches the pattern used for other intelligence functions
(velocity_data, div_data, timing_result).
---
 modules/security/live-attack-monitor-v2.sh | 8 ++++----
 modules/security/live-attack-monitor.sh    | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/modules/security/live-attack-monitor-v2.sh b/modules/security/live-attack-monitor-v2.sh
index 968e5fc..5dad79c 100755
--- a/modules/security/live-attack-monitor-v2.sh
+++ b/modules/security/live-attack-monitor-v2.sh
@@ -2553,12 +2553,12 @@ monitor_network_attacks() {
                                     block_reasons="${block_reasons}${div_reason}"
                                 fi
 
-                                local subnet_bonus=$(calculate_subnet_bonus "$ip")
-                                if [ "$subnet_bonus" -gt 0 ]; then
+                                local subnet_data=$(calculate_subnet_bonus "$ip")
+                                IFS='|' read -r subnet_count subnet_bonus subnet_reason <<< "$subnet_data"
+                                if [ "${subnet_bonus:-0}" -gt 0 ]; then
                                     score=$((score + subnet_bonus))
-                                    local context_reason="SUBNET_ATTACK"
                                     [ -n "$block_reasons" ] && block_reasons="${block_reasons}+" || block_reasons=""
-                                    block_reasons="${block_reasons}${context_reason}"
+                                    block_reasons="${block_reasons}${subnet_reason}"
                                 fi
 
                                 # Detect timing patterns
diff --git a/modules/security/live-attack-monitor.sh b/modules/security/live-attack-monitor.sh
index 968e5fc..5dad79c 100755
--- a/modules/security/live-attack-monitor.sh
+++ b/modules/security/live-attack-monitor.sh
@@ -2553,12 +2553,12 @@ monitor_network_attacks() {
                                     block_reasons="${block_reasons}${div_reason}"
                                 fi
 
-                                local subnet_bonus=$(calculate_subnet_bonus "$ip")
-                                if [ "$subnet_bonus" -gt 0 ]; then
+                                local subnet_data=$(calculate_subnet_bonus "$ip")
+                                IFS='|' read -r subnet_count subnet_bonus subnet_reason <<< "$subnet_data"
+                                if [ "${subnet_bonus:-0}" -gt 0 ]; then
                                     score=$((score + subnet_bonus))
-                                    local context_reason="SUBNET_ATTACK"
                                     [ -n "$block_reasons" ] && block_reasons="${block_reasons}+" || block_reasons=""
-                                    block_reasons="${block_reasons}${context_reason}"
+                                    block_reasons="${block_reasons}${subnet_reason}"
                                 fi
 
                                 # Detect timing patterns