Joe,
Thanks so much for converting our applet into a tcl script. It works great everywhere that we have deployed it. We did run into one issue deploying on a 3745 Router with 12.4(15)T9. When the policy was triggered, we received the following error:
error reading "stdin": Unknown error 134217728
while executing
"gets stdin"
invoked from within
"$slave eval $Contents"
(procedure "eval_script" line 7)
invoked from within
"eval_script slave $scriptname"
invoked from within
"if {$security_level == 1} { #untrusted script
interp create -safe slave
interp share {} stdin slave
interp share {} stdout slave
..."
(file "tmpsys:/lib/tcl/base.tcl" line 50)
Tcl policy execute failed: error reading "stdin": Unknown error 134217728
Tcl policy execute failed: error reading "stdin": Unknown error 134217728
I also pulled the specific script that it's referencing the error from:
# ----------------------------------
# base.tcl - Safe base script forinvoking safe-tcl on FM policies.
#
# August 2002, Jason Pfeifer
#
# Copyright (c) 2002, 2004-2006 bycisco Systems, Inc.
# All rights reserved.
# ----------------------------------
#
# Current security levels:
#
# 0 - trusted script, safe mode not enabled
# 1 - untrusted script, safe modeenabled
#################### Procedures ##################
proc TraceVariable { fromInterp fromVartoInterp toVar } {
set value [ interp eval $fromInterpset ::$fromVar]
interp eval $toInterp [list set::$toVar $value]
}
proc eval_script { slave scriptname } {
# Open script and evaluate it in slave
set F [open $scriptname]
set Contents [read $F]
close $F
$slave eval $Contents
}
#################### End of Procedures ##################
# main
# Process argv input:
set scriptname [lindex $argv 0]
set security_level [lindex $argv 1]
if {$security_level != 0 && $security_level != 1} {
set security_level 1
}
#Set Security level specific parameters
set errorInfo ""
set FM_TCLLIBDIR [info library]
if {$security_level == 1} { #untrusted script
interp create -safe slave
interp share {} stdin slave
interp share {} stdout slave
interp share {} stderr slave
lappend global_vars auto_path
lappend global_vars auto_oldpath
lappend global_vars tcl_library
foreach entry [info vars] {
if [array exists $entry] {
continue
}
if {[lsearch -exact$global_vars $entry] >= 0} {
continue;
}
TraceVariable {} $entry slave$entry
}
# uncomment to debug safe.tcl
#::safe::setLogCmd puts stderr
::safe::interpInit slave
# Hidden commands that are exposed to slave to ease restrictions.
interp alias slave exit {} exit
interp expose slave fconfigure
interp expose slave socket
eval_script slave $scriptname
close stdin
close stdout
close stderr
::safe::interpDelete slave
} else { #trusted script
interp create slave
interp share {} stdin slave
interp share {} stdout slave
interp share {} stderr slave
foreach entry [info vars] {
if [array exists $entry] {
continue
}
TraceVariable {} $entry slave$entry
}
if {[catch {::interp eval slave\
{source [file join$FM_TCLLIBDIR init.tcl]}} msg]} {
error "can't sourceinit.tcl into slave ($msg)"
}
eval_script slave $scriptname
interp delete slave
}
What ended up happening is the script stayed stuck in pending(no 'scheduler' commands in this early version of eem) and we eventually had to reboot the router(we waited until a regularly scheduled maintenance window, so it worked out fine). Since receiving this error, we haven't tried to run this particular script on this particular router. All other devices that we have deployed this on, including other 3745's running 12.4(15)T, have worked great. If anyone has some idea as to exactly what happened and what adjustments we need to perform to correct the problem, we would greatly appreciate it.
Thanks again for everyone's help.
