ot Payload data npassing with POST inspection

Hi,

I'd be suspicious about the default of collecting 256 bytes for POST requests without a Content-Length header. Can you add logging to that portion of the rule:

 
 ... 
 elseif { [HTTP::method] eq "POST" } { 
  
    log local0. "[IP::client_addr]:[TCP::client_port]: POST request to [HTTP::host][HTTP::uri]\ 
       with Content-Length: [HTTP::header Content-Length]" 
    if { [HTTP::header exists "Content-Length"] } { 
       HTTP::collect [HTTP::header Content-Length] 
       log local0. "[IP::client_addr]:[TCP::client_port]: Collecting [HTTP::header Content-Length] bytes" 
    } else { 
       HTTP::collect 256 
       log local0. "[IP::client_addr]:[TCP::client_port]: No Content-Length, collecting 256 bytes: Req: [HTTP::request]" 
    }  
 } 
 when HTTP_REQUEST_DATA { 
  
    log local0. "[IP::client_addr]:[TCP::client_port]: Collected [HTTP::payload length] bytes: [HTTP::payload]" 
  
     Parse the command from the request payload 
     set cmd [string tolower [getfield [lsearch -inline [split [HTTP::payload] "&"] command=*] = 2]] 
    set cmd [string tolower [URI::query "?[HTTP::payload]" command]] 
  
    if {[matchclass $::example_staging equals $cmd]} { 
       log local0. "[IP::client_addr]:[TCP::client_port]: Matched $cmd, replacing host header, path and setting pool." 
       HTTP::header replace "Host" $exampleHost 
       HTTP::path $examplePath 
       pool $examplePool 
    } 
 }  
 

Assuming you're parsing parameter names and values that are URL encoded in the format param1=value1&param2=value2, you could replace this line:

set cmd [string tolower [getfield [lsearch -inline [split [HTTP::payload] "&"] command=*] = 2]]

with this line:

set cmd [string tolower [URI::query "?[HTTP::payload]" command]]

I would guess the inbuilt processing of the parameters would be faster than the list commands.

Aaron