Forum Discussion

Peter_Baumann's avatar
Peter_Baumann
Icon for Cirrostratus rankCirrostratus
Feb 06, 2012

TCL error command returned bad code: 18 after upgrade to v11.1.0

This is driving me nuts!

 

 

I have the following iRule attached to a VS:

 

 

when CLIENT_ACCEPTED {

 

if {[class match [IP::client_addr] equals User_Internal]} {

 

SSL::profile clientssl_domain.net

 

} else {

 

SSL::profile clientssl_domain.net_cert

 

}

 

}

 

 

This iRule was working in version 10.2.1, after upgrading to v11.1.0 HF1 the exactly same iRule doesn't work anymore.

 

I get the following:

 

 

Feb 6 14:02:35 tmm err tmm[7218]: 01220001:3: TCL error: /Common/Require_SSL_Cert_domain.net - command returned bad code: 18 while executing "if {[class match [IP::client_addr] equals User_Internal]} { SSL::profile clientssl_domain.net } else { SSL::profile clientssl_domain.net_cert ..."

 

 

It seems impossible to troubleshoot this error. I cannot find any information about "bad code 18" or howto find out what is wrong with this code.

 

 

When we remove the SSL::profile the rule is working, so it is not the problem with the class match line.

 

 

Anyone have a hint how to solve this problem?

 

 

Thank you

 

application delivery
dev
devops
iRules
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Feb 06, 2012
    Bug 370572 - profile search does not use folder based common profile search mechanism and search failure does not return normal TCL_ERROR

    can you try this workaround? 

    root@ve1100(Active)(/Common)(tmos) list ltm rule myrule
ltm rule myrule {
    when CLIENT_ACCEPTED {
    if {[class match [IP::client_addr] equals User_Internal]} {
        SSL::profile /Common/clientssl_domain.net
    } else {
        SSL::profile /Common/clientssl_domain.net_cert
    }
}
}
  • Peter_Baumann's avatar
    Peter_Baumann
    Icon for Cirrostratus rankCirrostratus
    Feb 07, 2012
    Hi nitass,

     

    Thank you very much for your hint!

     

    This was exactly the problem.

     

     

    We changed now all the iRules to "full path" entries and we will try if this is working in version 10.2.1 to do a smooth upgrade in production environment to v11.1.0.
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Feb 07, 2012
    We changed now all the iRules to "full path" entries and we will try if this is working in version 10.2.1i do not think it works in 10.x. the bug 370572 is found on 11.0.0 HF1 and will be fixed in later release.
  • Peter_Baumann's avatar
    Peter_Baumann
    Icon for Cirrostratus rankCirrostratus
    Feb 07, 2012
    Well it seems that the "full path" is not working with 10.2.1, we get the following error:

     

     

    Feb 7 08:47:25 local/tmm err tmm[5116]: 01220001:3: TCL error: Require_SSL_Cert_domain.net - wrong args: should be "SSL::profile " while executing "SSL::profile /Common/clientssl_domain.net

     

     

    This is really bad to upgrade so many iRules in use with the "full path".

     

     

    Is there maybe a hotfix available so that we don't need to change so many iRules when we do the upgrade during the night at the maintenance window?

     

     

    Thank you
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Feb 07, 2012
    Is there maybe a hotfix available so that we don't need to change so many iRules when we do the upgrade during the night at the maintenance window? you have to open a support case and request for engineering hotfix.

     

     

    cheer!