diff --git a/CHANGES b/CHANGES
index a0efa01a..f5aaea4f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,9 +6,9 @@
* Added rule file/line to audit log messages.
- * Added new parallel matching operators, @pm and @pmfile. These use
- an alternate set based matching engine to perform faster keyword
- type matches.
+ * Added new phrase matching operators, @pm and @pmFromFile. These use
+ an alternate set based matching engine to perform faster phrase
+ type matches such as black/white lists, spam keywords, etc.
* Cache transformations per-request/phase so they are not repeated.
diff --git a/apache2/re_operators.c b/apache2/re_operators.c
index 13806d63..257fa491 100644
--- a/apache2/re_operators.c
+++ b/apache2/re_operators.c
@@ -208,9 +208,9 @@ static int msre_op_pm_param_init(msre_rule *rule, char **error_msg) {
return 1;
}
-/* pmfile */
+/* pmFromFile */
-static int msre_op_pmfile_param_init(msre_rule *rule, char **error_msg) {
+static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
char errstr[1024];
char buf[HUGE_STRING_LEN + 1];
char *ptr = NULL;
@@ -242,12 +242,12 @@ static int msre_op_pmfile_param_init(msre_rule *rule, char **error_msg) {
/* Open file and read */
rc = apr_file_open(&fd, fn, APR_READ | APR_FILE_NOCLEANUP, 0, rule->ruleset->mp);
if (rc != APR_SUCCESS) {
- *error_msg = apr_psprintf(rule->ruleset->mp, "Could not open pmfile \"%s\": %s", fn, apr_strerror(rc, errstr, 1024));
+ *error_msg = apr_psprintf(rule->ruleset->mp, "Could not open phrase file \"%s\": %s", fn, apr_strerror(rc, errstr, 1024));
return 0;
}
#ifdef DEBUG_CONF
- fprintf(stderr, "Loading pmfile: \"%s\"\n", fn);
+ fprintf(stderr, "Loading phrase file: \"%s\"\n", fn);
#endif
/* Read one pattern per line skipping empty/commented */
@@ -271,7 +271,7 @@ static int msre_op_pmfile_param_init(msre_rule *rule, char **error_msg) {
if ((*ptr == '\0') || (*ptr == '#')) continue;
#ifdef DEBUG_CONF
- fprintf(stderr, "Adding pmfile pattern: \"%s\"\n", buf);
+ fprintf(stderr, "Adding phrase file pattern: \"%s\"\n", buf);
#endif
acmp_add_pattern(p, buf, NULL, NULL, strlen(buf));
@@ -299,10 +299,10 @@ static int msre_op_pm_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
/* This message will be logged. */
if (strlen(match_escaped) > 252) {
- *error_msg = apr_psprintf(msr->mp, "Matched substring \"%.252s ...\" at %s.",
+ *error_msg = apr_psprintf(msr->mp, "Matched phrase \"%.252s ...\" at %s.",
match_escaped, var->name);
} else {
- *error_msg = apr_psprintf(msr->mp, "Matched substring \"%s\" at %s.",
+ *error_msg = apr_psprintf(msr->mp, "Matched phrase \"%s\" at %s.",
match_escaped, var->name);
}
return 1;
@@ -1353,10 +1353,10 @@ void msre_engine_register_default_operators(msre_engine *engine) {
msre_op_pm_execute
);
- /* pmfile */
+ /* pmFromFile */
msre_engine_op_register(engine,
- "pmfile",
- msre_op_pmfile_param_init,
+ "pmFromFile",
+ msre_op_pmFromFile_param_init,
msre_op_pm_execute
);
diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml
index c6221372..6a108498 100644
--- a/doc/modsecurity2-apache-reference.xml
+++ b/doc/modsecurity2-apache-reference.xml
@@ -4290,9 +4290,10 @@ SecRule ARGS:route "!@endsWith %{REQUEST_ADDR}"
pm
- Description: Parallel Match
- operator. This operator uses a set based matching engine for faster
- matches of keyword lists.
+ Description: Phrase Match
+ operator. This operator uses a set based matching engine (Aho-Corasick)
+ for faster matches of keyword lists. It will match any one of its
+ arguments anywhere in the target value.
Example:
@@ -4304,13 +4305,16 @@ SecRule ARGS:route "!@endsWith %{REQUEST_ADDR}"
- pmfile
+ pmFromFile
- Description: Parallel Match
- operator. This operator uses a set based matching engine for faster
- matches of keyword lists. It is the same as @pm
- except that it takes a list of files arguments. The contents of the
- files should be one pattern per line.
+ Description: Phrase Match
+ operator. This operator uses a set based matching engine (Aho-Corasick)
+ for faster matches of keyword lists. This operator is the same as
+ @pm except that it takes a list of files as
+ arguments. It will match any one of the phrases listed in the file(s)
+ anywhere in the target value. The contents of the files should be one
+ phrase per line. End of line markers will be stripped from the phrases,
+ however, whitespace will not be trimmed from phrases in the file.
Example: