firehol: validate downloads before ipset swap

gateway/etc/cron.hourly/get_firehol_ip.sh

 #!/bin/sh
+set -eu
+
 firehol_name="firehol_level1"
 firehol_tmp="firehol_tmp"
-wget https://iplists.firehol.org/files/firehol_level1.netset -O $firehol_name
+workdir="$(mktemp -d /tmp/eterban-firehol.XXXXXX)"
+trap 'rm -rf "$workdir"' EXIT HUP INT TERM
+
+download="$workdir/firehol_level1.netset"
+wget --https-only --timeout=30 --tries=2 \
+    https://iplists.firehol.org/files/firehol_level1.netset -O "$download"
+
+test -s "$download"
+grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/[0-9]+)?$' "$download"
 
-ipset create $firehol_tmp hash:net
+ipset destroy "$firehol_tmp" 2>/dev/null || :
+ipset create "$firehol_tmp" hash:net
 
-( echo "create $firehol_tmp hash:net family inet hashsize 1024 maxelem 65536" ;\
-	cat $firehol_name | grep -v "^#" | sed -e "s|^\([0-9].*\)|add $firehol_tmp \1|" ) | ipset -exist restore
+(
+    echo "create $firehol_tmp hash:net family inet hashsize 1024 maxelem 65536"
+    sed -n -E 's/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(\/[0-9]+)?)$/add '"$firehol_tmp"' \1/p' "$download"
+) | ipset -exist restore
 
-ipset swap $firehol_tmp $firehol_name
-ipset destroy $firehol_tmp
+ipset swap "$firehol_tmp" "$firehol_name"
+ipset destroy "$firehol_tmp"