BE: SYNC API

Author: jokob-sk

docs/SECURITY.md

@@ -8,7 +8,7 @@ This includes (but is not limited to):
 - Running NetAlertX only on networks where you have legal authorization
 - Keeping your deployment up to date with the latest patches
 
-> NetAlertX is not responsible for misuse, misconfiguration, or insecure deployments. Always test and secure your setup before exposing it to the outside world. Users interacting with the UI are treated as trusted actors within the deployment model. Always properly secure and isolate your deployment before exposing it externally.
+> NetAlertX is not responsible for misuse, misconfiguration, or insecure deployments. Always test and secure your setup before exposing it to the outside world. Users interacting with the UI are treated as trusted actors within the deployment model.
 
 # 🔐 Securing Your NetAlertX Instance
 
@@ -36,7 +36,7 @@ NetAlertX is designed to be run on **private LANs**, not the open internet.
 
 ### ✅ Tailscale (Easy VPN Alternative)
 
-Tailscale sets up a private mesh network between your devices. It's fast to configure and ideal for NetAlertX.  
+Tailscale sets up a private mesh network between your devices. It's fast to configure and ideal for NetAlertX.
 👉 [Get started with Tailscale](https://tailscale.com/)
 
 ---
@@ -63,19 +63,19 @@ By default, NetAlertX does **not** require login. Before exposing the UI in any
 
 ## 🔥 Additional Security Measures
 
-- **Firewall / Network Rules**  
+- **Firewall / Network Rules**
   Restrict UI/API access to trusted IPs only.
 
-- **Limit Docker Capabilities**  
+- **Limit Docker Capabilities**
   Avoid `--privileged`. Use `--cap-add=NET_RAW` and others **only if required** by your scan method.
 
-- **Keep NetAlertX Updated**  
+- **Keep NetAlertX Updated**
   Regular updates contain bug fixes and security patches.
 
-- **Plugin Permissions**  
+- **Plugin Permissions**
   Disable unused plugins. Only install from trusted sources.
 
-- **Use Read-Only API Keys**  
+- **Use Read-Only API Keys**
   When integrating NetAlertX with other tools, scope keys tightly.
 
 ---

front/plugins/sync/sync.py

@@ -194,8 +194,7 @@ def main():
                     #   last_result.office.encoded.lab.log
                     # from being incorrectly parsed as PUSH artifacts.
                     is_push_artifact = (
-                        ('.decoded.' in file_name or '.encoded.' in file_name)
-                        and file_name.rsplit('.', 2)[1].isdigit()
+                        ('.decoded.' in file_name or '.encoded.' in file_name) and file_name.rsplit('.', 2)[1].isdigit()
                     )
 
                     if is_push_artifact:

server/api_server/sync_endpoint.py

@@ -1,3 +1,4 @@
+import json
 import os
 import base64
 from flask import jsonify, request
@@ -6,16 +7,14 @@
 from utils.datetime_utils import timeNowUTC
 from messaging.in_app import write_notification
 
-INSTALL_PATH = os.getenv("NETALERTX_APP", "/app")
-
 # Make sure log level is initialized correctly
 lggr = Logger(get_setting_value('LOG_LEVEL'))
 
 
 def handle_sync_get():
     """Handle GET requests for SYNC (NODE → HUB)."""
 
-    # get all dwevices from the api endpoint
+    # get all devices from the api endpoint
     api_path = os.environ.get('NETALERTX_API', '/tmp/api')
 
     file_path = f"/{api_path}/table_devices.json"
@@ -48,7 +47,7 @@ def handle_sync_get():
 def handle_sync_post():
     """Handle POST requests for SYNC (HUB receiving from NODE)."""
 
-    mylog("verbose", [
+    mylog("debug", [
         "[SYNC API] ENTER handle_sync_post",
         f"method={request.method}",
         f"content_type={request.content_type}",
@@ -59,41 +58,42 @@ def handle_sync_post():
     # ---- RAW BODY (critical for debugging encoding / encryption issues)
     try:
         raw = request.get_data(cache=False)
-        mylog("verbose", [
-            f"[SYNC API] raw_bytes_len={len(raw)}",
-            f"[SYNC API] raw_preview={raw[:200]}"
+        mylog("debug", [
+            f"[SYNC API] raw_bytes_len={len(raw)} raw_preview={raw[:200]}"
         ])
     except Exception as e:
         mylog("none", [f"[SYNC API] FAILED reading raw body: {e}"])
+        write_notification("[SYNC API] FAILED reading raw body - see app.log", 'alert', timeNowUTC())
         return jsonify({"error": "failed reading body"}), 400
 
-    # ---- JSON PARSE (this is a very common failure point)
+    # ---- JSON PARSE (from already-read raw bytes to avoid empty-stream re-read)
     try:
-        body = request.get_json(force=False, silent=False)
-        mylog("verbose", [f"[SYNC API] parsed_json={body}"])
+        body = json.loads(raw)
+        mylog("debug", [f"[SYNC API] parsed_json={body}"])
     except Exception as e:
-        mylog("none", [f"[SYNC API] JSON_PARSE_FAILED={e}"])
+        msg = f"[SYNC API] JSON_PARSE_FAILED={e}"
+        mylog("none", [msg])
+        write_notification(msg, 'alert', timeNowUTC())
         return jsonify({"error": "invalid json"}), 400
 
     # ---- EXTRACT FIELDS
     data = body.get("data", "")
     node_name = body.get("node_name", "")
     plugin = body.get("plugin", "")
 
-    mylog("verbose", [
-        f"[SYNC API] node_name={repr(node_name)}",
-        f"[SYNC API] plugin={repr(plugin)}",
-        f"[SYNC API] data_type={type(data).__name__}",
-        f"[SYNC API] data_len={len(data) if isinstance(data, str) else 'non-string'}"
+    mylog("debug", [
+        f"[SYNC API] node_name={repr(node_name)} plugin={repr(plugin)} data_type={type(data).__name__} data_len={len(data) if isinstance(data, str) else 'non-string'}"
     ])
 
-    storage_path = INSTALL_PATH + "/log/plugins"
+    storage_path = os.getenv("NETALERTX_PLUGINS_LOG", "/tmp/log/plugins")
 
     try:
         os.makedirs(storage_path, exist_ok=True)
-        mylog("verbose", [f"[SYNC API] storage_path_ready={storage_path}"])
+        mylog("debug", [f"[SYNC API] storage_path_ready={storage_path}"])
     except Exception as e:
-        mylog("none", [f"[SYNC API] MKDIR_FAILED={e}"])
+        msg = f"[SYNC API] MKDIR_FAILED={e}"
+        mylog("none", [msg])
+        write_notification(msg, 'alert', timeNowUTC())
         return jsonify({"error": "storage path error"}), 500
 
     # ---- FILE COUNT LOGIC
@@ -108,13 +108,11 @@ def handle_sync_post():
         ]
         file_count = len(encoded_files + decoded_files) + 1
 
-        mylog("verbose", [
-            f"[SYNC API] encoded_files={len(encoded_files)}",
-            f"[SYNC API] decoded_files={len(decoded_files)}",
-            f"[SYNC API] file_count={file_count}"
-        ])
+        mylog("debug", [f"[SYNC API] encoded_files={len(encoded_files)} decoded_files={len(decoded_files)} file_count={file_count}"])
     except Exception as e:
-        mylog("none", [f"[SYNC API] LISTDIR_FAILED={e}"])
+        msg = f"[SYNC API] LISTDIR_FAILED={e}"
+        mylog("none", [msg])
+        write_notification(msg, 'alert', timeNowUTC())
         return jsonify({"error": "listdir failed"}), 500
 
     # ---- FILE PATH
@@ -125,7 +123,6 @@ def handle_sync_post():
 
     mylog("verbose", [f"[SYNC API] file_path_new={file_path_new}"])
 
-    # ---- WRITE FILE (final critical point)
     try:
         if not isinstance(data, str):
             data = str(data)
@@ -134,15 +131,15 @@ def handle_sync_post():
             f.write(data)
 
     except Exception as e:
-        import traceback
-        mylog("none", [
-            f"[SYNC API] WRITE_FAILED={e}",
-            traceback.format_exc()
-        ])
+
+        msg = f"[Plugin: SYNC] Data write failed ({file_path_new}): {e}"
+        mylog("none", [msg])
+        write_notification(msg, 'alert', timeNowUTC())
         return jsonify({"error": str(e)}), 500
 
     msg = f"[Plugin: SYNC] Data received ({file_path_new})"
-    write_notification(msg, "info", timeNowUTC())
+    if lggr.isAbove('verbose'):
+        write_notification(msg, 'info', timeNowUTC())
     mylog("verbose", [msg])
 
     return jsonify({"message": "Data received and stored successfully"}), 200

server/plugin.py

@@ -824,8 +824,7 @@ def process_plugin_events(db, plugin, plugEventsArr):
                         # find corresponding object for the event and merge
                         if plugObj.idsHash == tmpObjFromEvent.idsHash:
                             if (
-                                plugObj.status == "missing-in-last-scan"
-                                or tmpObjFromEvent.status == "watched-changed"
+                                plugObj.status == "missing-in-last-scan" or tmpObjFromEvent.status == "watched-changed"
                             ):
                                 changed_this_cycle.add(tmpObjFromEvent.idsHash)
                             pluginObjects[index] = combine_plugin_objects(

test/plugins/test_sync_protocol.py

@@ -71,11 +71,18 @@ def _node_name_from_filename(file_name: str) -> str:
     """Mirror of the node-name extraction in sync.main() (Mode 3).
 
     Real file formats produced by the system:
-      PUSH (post-decode): last_result.PLUGIN.decoded.NodeName.N.log  → parts[3]
-      PULL:               last_result.NodeName.log                   → parts[1]
+      PUSH (post-decode): last_result.PLUGIN.decoded.NodeName.N.log
+        — split on '.decoded.' marker, strip .N.log with rsplit from the right
+      PULL:               last_result.NodeName.log
+        — strip 'last_result.' prefix and '.log' suffix
+
+    Both forms handle dots anywhere in PLUGIN or NodeName.
     """
-    parts = file_name.split(".")
-    return parts[3] if ("decoded" in file_name or "encoded" in file_name) else parts[1]
+    if '.decoded.' in file_name or '.encoded.' in file_name:
+        marker = '.decoded.' if '.decoded.' in file_name else '.encoded.'
+        _, after = file_name.split(marker, 1)
+        return after.rsplit('.', 2)[0]
+    return file_name[len('last_result.'):-len('.log')]
 
 
 def _should_delete_after_process(filename: str) -> bool:
@@ -339,6 +346,26 @@ def test_push_decoded_different_plugins(self):
             assert _node_name_from_filename(fname) == "HubNode", \
                 f"Expected 'HubNode' from {fname}"
 
+    # --- dot-in-identifier regression (fragile parts[3] fix) ---
+
+    def test_pull_node_name_with_dots(self):
+        # PULL mode: node name set to e.g. "node.home" or an IP like "192.168.1.82"
+        assert _node_name_from_filename("last_result.node.home.log") == "node.home"
+        assert _node_name_from_filename("last_result.192.168.1.82.log") == "192.168.1.82"
+
+    def test_push_decoded_node_name_with_dots(self):
+        # Node name "Node.Vlan01" must survive the filename round-trip intact
+        assert _node_name_from_filename("last_result.ARPSCAN.decoded.Node.Vlan01.1.log") == "Node.Vlan01"
+
+    def test_push_decoded_plugin_name_with_dots(self):
+        # Hypothetical plugin with a dot in its name must not shift the node index
+        assert _node_name_from_filename("last_result.MY.PLUGIN.decoded.NodeA.1.log") == "NodeA"
+
+    def test_push_both_identifiers_with_dots(self):
+        assert _node_name_from_filename(
+            "last_result.A.B.decoded.x.y.z.1.log"
+        ) == "x.y.z"
+
 
 # ===========================================================================
 # CurrentScan candidates filter (Mode 3 – RECEIVE)