HTTP 100 causes this rule to hang the connection

I finally got this set up in my lab, using the following code:

 

 

when HTTP_RESPONSE {
   if { [HTTP::header "Content-Type"] contains "text/html" && [HTTP::status] == 200 } {
      log local0. "Status [HTTP::status] Collecting [HTTP::header Content-Length]..."
      HTTP::collect [HTTP::header Content-Length]
      }
}

 

 

The behavior is the same, the browser receives a "HTTP/1.1 100 Continue", and the connection hangs.

 

 

Curiously, the log entry is:

 

 

Sep 27 12:16:58 tmm tmm[812]: Rule redirect_error : Status 200 Collecting 766...

 

 

The client sees a 100 status yet the rule sees a 200 status?

 

 

Update:

 

 

I added:

 

when HTTP_RESPONSE_CONTINUE {
   log local0. "Status [HTTP::status] continue"
}

 

 

 

And the logs say:

 

 

Sep 27 13:26:41 tmm tmm[812]: Rule redirect_error : Status 100 continue

 

Sep 27 13:26:41 tmm tmm[812]: Rule redirect_error : Status 200 Collecting 766..

 

 

Update:

 

 

The IIS logs say:

 

...POST /upload.asp 200 736 63 HTTP/1.1...

 

 

So for some reason the content-header is saying 766 bytes, but the actual content is 736 bytes? That must be why it's hanging, waiting for the last 30 bytes....