pkg add-interfaces

Zeek
1

Used zkg to add the add-interfaces package to zeek 3.0

Seeing the following warning messages in stderr log:

[9] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[10] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[11] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[12] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[13] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[14] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[15] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

[16] => warning: non-void function returning without a value: AddInterfaces::interface_ext_func

Looking at the code for the function interface_ext_func looks like the condition is most likely failing and there is no return value specified.

function interface_ext_func(path: string): AddedFields

{

if ( Cluster::nodes[Cluster::node]?$interface )

return AddedFields($interface = Cluster::nodes[Cluster::node]$interface);

}

2

Hi Scot,

unfortunately I cannot reproduce the issue.

Looking at the code for the function interface_ext_func looks like the condition is most likely failing and there is no return value specified.

function interface_ext_func(path: string): AddedFields

     \{

     if \( Cluster::nodes\[Cluster::node\]?$interface \)

             return AddedFields\($interface = Cluster::nodes\[Cluster::node\]$interface\);

     \}

You might try to add something like the following to deal with timing issues:

else
   return AddedFields($interface = fmt("%s:unknown-interface", Cluster::node));

However, if the interfaces do not appear in the logs after an initial warm-up, there might be something else wrong.

Jan

3

Hmm… that code could run into an issue on non worker nodes… so if a manager or proxy logs something directly you will hit that edge case.