TCL error: invalid command name "1" on GTM

...

Hi again Aaron,

I have been having some problem with letting the iRule work correctly after the changes, and actually two of the changes that you suggested that I do, resulted in the iRule working incorrectly.

Firstly - you suggested to change in the last 'elseif'-line the outer braces to paratheses - it seems logical, I aggree on that, but the logic did not work as expected - when I put the braces back - this worked fine again:

So it works like this:

 elseif { not [[IP::addr [IP::remote_addr] equals 172.27.0.0/16]  or [IP::addr [IP::remote_addr] equals 89.104.128.0/19]] } {

but not like this:

elseif { not ([IP::addr [IP::remote_addr] equals 172.27.0.0/16]  or [IP::addr [IP::remote_addr] equals 89.104.128.0/19]) } {

Secondly - you said:

when using the IP::addr command, only put the /subnet on the network--not a host address like IP::remote_addr.

But that did not work either - I tested this out by putting in log local0. lines at every step.

So I had to have it like this:

elseif { [IP::addr [IP::remote_addr]/24 equals 89.104.145.0/24] } {

but it did not work like this :

elseif { [IP::addr [IP::remote_addr] equals 89.104.145.0/24] } {

This makes sense, because this is not "equal", and I don't think there is an operator that you could use for this.

We need an inversed "contains" operator.

Maybe it would work to reverse this and put :

elseif { [ 89.104.145.0/24 contains IP::addr [IP::remote_addr] ] } {

?? I haven't tried it, but that would make sense wouldn't ?

Regards,

Arnór

Hi Arnor,

 

 

Your post got munged as the forums don't handle multiple code blocks in the quick reply box. Can you just click Edit on your post and then Submit? This will force the post to be re-rendered correctly.

 

 

Thanks, Aaron

Posted By Arnor Arnason on 07/14/2011 04:32 AM

Hi again Aaron,

I have been having some problem with letting the iRule work correctly after the changes, and actually two of the changes that you suggested that I do, resulted in the iRule working incorrectly.

Firstly - you suggested to change in the last 'elseif'-line the outer braces to paratheses - it seems logical, I aggree on that, but the logic did not work as expected - when I put the braces back - this worked fine again:

So it works like this:

 elseif { not [[IP::addr [IP::remote_addr] equals 172.27.0.0/16]  or [IP::addr [IP::remote_addr] equals 89.104.128.0/19]] } {

but not like this:

elseif { not ([IP::addr [IP::remote_addr] equals 172.27.0.0/16]  or [IP::addr [IP::remote_addr] equals 89.104.128.0/19]) } {

Secondly - you said:

when using the IP::addr command, only put the /subnet on the network--not a host address like IP::remote_addr.

But that did not work either - I tested this out by putting in log local0. lines at every step.

So I had to have it like this:

elseif { [IP::addr [IP::remote_addr]/24 equals 89.104.145.0/24] } {

but it did not work like this :

elseif { [IP::addr [IP::remote_addr] equals 89.104.145.0/24] } {

This makes sense, because this is not "equal", and I don't think there is an operator that you could use for this.

We need an inversed "contains" operator.

Maybe it would work to reverse this and put :

elseif { [ 89.104.145.0/24 contains IP::addr [IP::remote_addr] ] } {

?? I haven't tried it, but that would make sense wouldn't ?

Regards,

Arnór test

Sorry - I didn't see your replay right away, but I think it should be readable now ?

If this case gets executed it will trigger a runtime error:

elseif { not [[IP::addr [IP::remote_addr] equals 172.27.0.0/16] or [IP::addr [IP::remote_addr] equals 89.104.128.0/19]] } {

as this:

[IP::addr [IP::remote_addr] equals 172.27.0.0/16] or [IP::addr [IP::remote_addr] equals 89.104.128.0/19]

will return either 0 or 1 depending on the client IP. Then the outer square braces mean that return value will get executed. So you'll get an error saying 1 or 0 isn't a valid command.

Using parentheses will allow you to negate the expression within:

if { not (0 and 1) } {
log local0. "true"
} else {
log local0. "false"
}

Log output: true

As for IP::addr and the slash notation: both should work if you're on 10.2.1:

: [IP::addr 89.104.145.10 equals 89.104.145.0/24]: 1

: [IP::addr 89.104.145.10/24 equals 89.104.145.0/24]: 1

But the first version where the subnet is only on the network address (not the host) will be more efficient (by up to 40%). See Jason's article on this:

http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086449/iRules-IP-Comparison-Considerations-with-IPaddr-Command.aspx

Aaron