matches_regex and matchclass

Unfortunately, as you've found out, matchclass is limited to only the operators listed in that error. But, you aren't completely stuck. While it's not as elegant as a single matchclass line, classes are interpreted as TCL lists, so you can use the TCL list commands to loop through the elements and do whatever you want.

This should be equivalent (or close to it).

when HTTP_REQUEST {
  foreach path $::flaggedpaths {
    if { [HTTP::path] starts_with "/portal/$path" } {
      log local0. "matched [HTTP::path] in flaggedpaths class member '$path'"
      break
    }
  }
}

You could have used a matches_regexp but I went with the string comparison approach as that avoids the overhead associated with the regular expression comparison.

And, yes, it goes both ways with matchclass. You can also pass in a user created TCL lists instead of a class if you so desire...

-Joe