Forum Discussion
cjunior
May 27, 2014Nacreous
I think it is because 'or' overrides 'and'. Place parentheses: if { ( (1 eq 1) or (2 eq 2) ) and !(2 eq 1) } { reject }
Try:
when HTTP_REQUEST {
if { ( ([lindex [split [HTTP::path] "/"] 2] contains "control" ) or ( [lindex [split [HTTP::path] "/"] 3] contains "control" ) or ( [lindex [split [HTTP::path] "/"] 1] contains "sql" ) ) and ![class match [IP::client_addr] equals ss_allowed_address] } { reject }
}