inserting client ip address into header when using SNAT

The above rule was not complete. If the two extra bytes followed in a separate TCP packet, then the HTTP_RESPONSE_DATA would not have received them at the time it was evaluated. The following rule is more complete in this regard:

 
 rule handle_two_trailing_bytes { 
    when HTTP_REQUEST { 
       set two_byte_error 0 
       if { [HTTP::uri] contains "export.fetchFile" } { 
          set two_byte_error 1 
       } 
       HTTP::header insert ORIG_CLIENT_IP [IP::remote_addr] 
    } 
    when HTTP_RESPONSE { 
       if { $two_byte_error } { 
           Get the correct length 
          set content_len [HTTP::header Content-Length] 
           Collect the body and attempt to pick up the 2 extra bytes 
          HTTP::collect [expr $content_len + 2] 
       } 
    } 
    when HTTP_RESPONSE_DATA { 
        Determine how much we collected 
       set delta [expr $content_len + 2 - [HTTP::payload length]] 
       if { $delta < 2 } { 
           HTTP already received extra bytes, remove them here 
          HTTP::payload replace $content_len [expr 2 - $delta] "" 
          HTTP::header replace "Content-Length" $content_len 
       } 
       if { $delta > 0 } { 
           Have TCP layer collect and discard any extra bytes 
          TCP::collect $delta 
       } 
       HTTP::release 
    } 
    when SERVER_DATA { 
        Remove the extra bytes 
       TCP::payload replace 0 $delta "" 
       TCP::release 
    } 
 }