Restricting Traffic to IP Address and HTTP HOST

A data-group is a hashmap; that is, a set of keys and associated values. The keys must be unique. You can, however, make the value into, say, a comma-delimited list, as in:

10.10.10.10 := "sample.com,foobar.com",
10.10.10.11 := "foobar.com"

Your code, then, could use lsearch on a split (or, if you can guarantee non-overlap, you could use the contains operator, which is faster, but more likely to cause problems down the line).

Here is a(n untested) sample:

when RULE_INIT {
    set static::hmr_hosts_datagroup "dg-hostmatch"
}


when HTTP_REQUEST {
    set match_list [class match -value [IP::client_addr] equals $static::hmr_hosts_datagroup]
    if { $match_list eq "" or [lsearch [split $match_list ,] [string tolower [HTTP::host]]] == -1 } {
        HTTP::respond 405 content "... your content from above ..."
    }
}

I strongly recommend that you consider using High-Speed Logging rather than relying on syslog-ng via log.It may be faster, and more importantly, doesn't tie up local disk I/O cycles.