Forum Discussion
hooleylist
Feb 04, 2008Cirrostratus
Hi Joe,
You can use the catch command (Click here) to handle errors. In effect, you could use this at the beginning of your rule to determine which version of rules your rule is running on at run time. If you know that virtual only works in 9.4+, you could use something like this to confirm the version:
when CLIENT_ACCEPTED {
The command to test the version with
set test_cmd virtual
Execute the command, catching any error. If there isn't an error, save the output to $output
if {[catch {$test_cmd} output]}{
catch returned true, so the command generated an error
log local0. "test_cmd returned an error"
track that the rule is 9.4 or higher
set v9.4 1
} else {
catch returned false, so the command was valid
log local0. "\$output: $output"
track that the rule is 9.4 or higher
set v9.4 0
}
}
If there was a command that was valid in the RULE_INIT event that is version-specific, you'd only need to run this check once. Else, you're stuck running the logic for every TCP connection.
Aaron