Hi,
I am testing the rule with...
HTTP::payload replace 0 [HTTP::payload length] [regsub -all "https://10.104.30.55" [HTTP::payload] "http://10.104.30.55"]
I made a slight mistake in the rule so i know why it was putting in the double replace.
This is what i did wrong
HTTP::payload replace 0 [HTTP::payload length] [regsub -all "https://10.104.30.55" [HTTP::payload] "10.104.30.55"]
Anyway the rule is still corrupting any binary objects that are sent in the post. Fron the look of the headers everything is posted as it should be, the replace is happening ok and it works great if i upload a text file. But with images or pdf's for instace i just get a blank/missing file. With images i get the image url repeaded on the screan and FF lists it as an image of the correct type and filesize but with dimensions of 0px x 0px
The closest i every got it to working was with the sream rule. This actually showed some of the content of the image but with the rest of it greyed out. I am guessing this was because the content length without the replace was 10996 and after the replace it was set to 4808, so i guess [HTTP::payload length] was 4808. i tried to do an add on the content length
HTTP::header replace "Content-Length" [HTTP::header "Content-Length"] +1 but that gave me an invalid content length error. Maybe this is just a syntax thing that i have wrong.
when HTTP_REQUEST {
if { [HTTP::method] equals "POST" && [HTTP::header exists "Content-Length"] and [HTTP::header "Content-Length"] > 0} {
STREAM::expression "@https://10.104.30.55@http://10.104.30.55@"
HTTP::header replace "Content-Length" [HTTP::payload length]
STREAM::enable
} else {
STREAM::disable
}
}