Errors Returned While Using 'update_server'

[TomOgs]

Hey team,

Apologise in advance if I've made a dumb/simple mistake here, but I seem to be have encountered an error with PyMISP's 'update_server' function that I haven't been able to troubleshoot my way through.

Attempts to execute the following code (simplified version that still returns same error shown below) has been giving me the subsequent error:

CODE

misp = PyMISP(url=url, key=api_key, ssl=verify) server = MISPServer() server.name = "test" misp.update_server(server, 2)

ERROR

Unknown error: the response is not in JSON. Something is broken server-side, please send us everything that follows (careful with the auth key): Request headers: {'User-Agent': 'PyMISP 2.4.160.1 - Python 3.8', 'Accept-Encoding': 'gzip, deflate', 'Accept': 'application/json', 'Connection': 'keep-alive', 'Cookie': 'MISP-49b47302-f263-49d7-959b-ad34c8adf7bf=f5tuu4qe0csiq748f5jq42g74qvdnke3', 'Content-Length': '16', 'content-type': 'application/json'} Request body: {"name": "test"} Response (if any): {"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"\/servers\/edit\/2"} Traceback (most recent call last): File "getsync.py", line 15, in misp.update_server(server, 2) File "/home/appadmin/.local/lib/python3.8/site-packages/pymisp/api.py", line 1862, in update_server updated_server = self._check_json_response(r) File "/home/appadmin/.local/lib/python3.8/site-packages/pymisp/api.py", line 3513, in _check_json_response r = self._check_response(response, expect_json=True) File "/home/appadmin/.local/lib/python3.8/site-packages/pymisp/api.py", line 3531, in _check_response raise MISPServerError(f'Error code 500:\n{response.text}') pymisp.exceptions.MISPServerError: Error code 500: {"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"\/servers\/edit\/2"}

I've also reviewed my servers error.log which contains the following indicating a potential JSON syntax issue:

2022-09-21 04:41:49 Error: [JsonException] Syntax error Request URL: /servers/edit/2 Stack Trace:

0 /var/www/MISP/app/Lib/Tools/JsonTool.php(31): json_decode()

1 /var/www/MISP/app/Model/AppModel.php(3552): JsonTool::decode()

2 /var/www/MISP/app/Controller/ServersController.php(506): AppModel->jsonDecode()

3 [internal function]: ServersController->edit()

4 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(499): ReflectionMethod->invokeArgs()

5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()

6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()

7 /var/www/MISP/app/webroot/index.php(99): Dispatcher->dispatch()

8 {main}

root@host:/home/user# 2022-09-21 04:41:49 Error: [JsonException] Syntax error

5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()

6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()

7 /var/www/MISP/app/webroot/index.php(99): Dispatcher->dispatch()

8 {main}

In terms of troubleshooting I've ensured my API key is correct, the URL is accessible, updated MISP and PyMISP (note - still seems to be out of date when upgrading with pip), and experimented with modifications to my code.

Please let me know if this is a extremely beginner mistake or if I've missed something in the documentation, any assistance is greatly appreciated.

Edit: Looks like it could be an issue with MISP itself. Attempts to use the API for the /server/update/X endpoint seem to be failing with the same error, while other endpoints such as /server/add are working as expected.

[TomOgs]

Found the issue.

Looks like the /server/edit/ endpoint requires a value of "push_rules" to be set in the query. This doesn't look to be intentional, but the code will check that field for valid JSON and if it is null will produce the error I've mentioned above (could be wrong regarding the code here tho).

Note: I'm unsure if my PyMISP snippet from above would actually work, but confirmed that passing the "push_rules" field in a CURL does produce the desired result

[Rafiot]

Hi, and sorry for the delay. Yeah, I think you're right, and I have a vague memory that we discussed that at some point (cc @iglocska @mokaddem @righel)

One way to solve this issue is to get all the servers (with pythonify=True will probably make things simpler), find the one you want to update, change the name, and push the MISPServer object to update_server (see this test case for an example: https://github.com/MISP/PyMISP/blob/main/tests/testlive_comprehensive.py#L2411)

[TomOgs]

Not a worry at all! Thank you very much for the advice and linked example :)