Mike_Maher
Mar 02, 2012Nimbostratus
TCL with iRule in v11.1
I have the following iRule that went through an upgrade from 10.2.0 to 11.1, and I now seeing some TCL errors. I am pretty sure it has to do with the way I am referencing the Data Group, but I am not sure how to resolve the issue. Any help is appreciated.
All logs are sent to /var/log/ltm
If the CN on the certificate or the Issuer changes, you can
add the new data under Data Group to either ExtQuotes_CN_List
or ExtQuotes_Issuer_List
when CLIENTSSL_CLIENTCERT {
Example Subject DN: /C=AU/ST=NSW/L=Syd/O=Your Organisation/OU=Your OU/CN=John Smith
set subject_dn [X509::subject [SSL::cert 0]]
log "Client Certificate Received: $subject_dn"
set inter_cert [X509::issuer [SSL::cert 0]]
log "Client Certificate Received: $inter_cert"
Check if the client certificate contains the correct CN and Issuer from Data Groups
if { ([matchclass $subject_dn contains $::ExtQuotes_CN_List])
and ([matchclass $inter_cert contains $::ExtQuotes_Issuer_List])} {
Accept the client cert
log "Client Certificate Accepted: $subject_dn"
} else {
log "No Matching Client Certificate or Issuer Was Found Using: $subject_dn or $inter_cert"
reject
}
}
Here is the error
TCL Error: /Common/ExtQuotes_Client_Cert_Auth - Can't Read "::ExtQuotes_CN_List" : no such variable while executing "matchclass $subject_dn contains $::ExtQuotes_CN_List"