Improve error message when receiving unexpected record content via Broker.

Broker sends record values as a vector of the corresponding fields. If
the received values doesn't match the actual record fields, Zeek has
so far been reporting this not-so-helpful error message:

    warning: failed to convert remote event 'got_result' arg #1, got vector, expected record

This change turns the latter part into a list of the field types we
actually received, which makes debugging much easier.

(No test, seems overkill to add a spawn a Broker client to exercise
this.)
This commit is contained in:
Robin Sommer 2022-03-04 16:46:53 +01:00
parent ff4f3f359c
commit 130d93f0de
No known key found for this signature in database
GPG key ID: 6BEDA4DA6B8B23E3

View file

@ -1391,17 +1391,35 @@ void Manager::ProcessEvent(const broker::topic& topic, broker::zeek::Event ev)
{ {
auto got_type = args[i].get_type_name(); auto got_type = args[i].get_type_name();
const auto& expected_type = arg_types[i]; const auto& expected_type = arg_types[i];
auto val = detail::data_to_val(std::move(args[i]), expected_type.get()); auto val = detail::data_to_val(args[i], expected_type.get());
if ( val ) if ( val )
vl.emplace_back(std::move(val)); vl.emplace_back(std::move(val));
else else
{ {
auto expected_name = type_name(expected_type->Tag()); auto expected_name = type_name(expected_type->Tag());
std::string msg_addl = util::fmt("got %s, expected %s", got_type, expected_name);
reporter->Warning("failed to convert remote event '%s' arg #%zu," if ( strcmp(expected_name, "record") == 0 && strcmp("vector", got_type) == 0 )
" got %s, expected %s", {
name.data(), i, got_type, expected_name); // This means the vector elements didn't align with the record
// fields. Produce an error message that shows what we
// received.
std::string elements;
for ( const auto& e : broker::get<broker::vector>(args[i]) )
{
if ( ! elements.empty() )
elements += ", ";
elements += e.get_type_name();
}
msg_addl = util::fmt("got mismatching field types [%s] for record type '%s'",
elements.c_str(), expected_type->GetName().c_str());
}
reporter->Warning("failed to convert remote event '%s' arg #%zu, %s", name.data(), i,
msg_addl.c_str());
// If we got a vector and expected a function this is // If we got a vector and expected a function this is
// possibly because of a mismatch between // possibly because of a mismatch between