diff --git a/CHANGES b/CHANGES index a0efa01a..f5aaea4f 100644 --- a/CHANGES +++ b/CHANGES @@ -6,9 +6,9 @@ * Added rule file/line to audit log messages. - * Added new parallel matching operators, @pm and @pmfile. These use - an alternate set based matching engine to perform faster keyword - type matches. + * Added new phrase matching operators, @pm and @pmFromFile. These use + an alternate set based matching engine to perform faster phrase + type matches such as black/white lists, spam keywords, etc. * Cache transformations per-request/phase so they are not repeated. diff --git a/apache2/re_operators.c b/apache2/re_operators.c index 13806d63..257fa491 100644 --- a/apache2/re_operators.c +++ b/apache2/re_operators.c @@ -208,9 +208,9 @@ static int msre_op_pm_param_init(msre_rule *rule, char **error_msg) { return 1; } -/* pmfile */ +/* pmFromFile */ -static int msre_op_pmfile_param_init(msre_rule *rule, char **error_msg) { +static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) { char errstr[1024]; char buf[HUGE_STRING_LEN + 1]; char *ptr = NULL; @@ -242,12 +242,12 @@ static int msre_op_pmfile_param_init(msre_rule *rule, char **error_msg) { /* Open file and read */ rc = apr_file_open(&fd, fn, APR_READ | APR_FILE_NOCLEANUP, 0, rule->ruleset->mp); if (rc != APR_SUCCESS) { - *error_msg = apr_psprintf(rule->ruleset->mp, "Could not open pmfile \"%s\": %s", fn, apr_strerror(rc, errstr, 1024)); + *error_msg = apr_psprintf(rule->ruleset->mp, "Could not open phrase file \"%s\": %s", fn, apr_strerror(rc, errstr, 1024)); return 0; } #ifdef DEBUG_CONF - fprintf(stderr, "Loading pmfile: \"%s\"\n", fn); + fprintf(stderr, "Loading phrase file: \"%s\"\n", fn); #endif /* Read one pattern per line skipping empty/commented */ @@ -271,7 +271,7 @@ static int msre_op_pmfile_param_init(msre_rule *rule, char **error_msg) { if ((*ptr == '\0') || (*ptr == '#')) continue; #ifdef DEBUG_CONF - fprintf(stderr, "Adding pmfile pattern: \"%s\"\n", buf); + fprintf(stderr, "Adding phrase file pattern: \"%s\"\n", buf); #endif acmp_add_pattern(p, buf, NULL, NULL, strlen(buf)); @@ -299,10 +299,10 @@ static int msre_op_pm_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c /* This message will be logged. */ if (strlen(match_escaped) > 252) { - *error_msg = apr_psprintf(msr->mp, "Matched substring \"%.252s ...\" at %s.", + *error_msg = apr_psprintf(msr->mp, "Matched phrase \"%.252s ...\" at %s.", match_escaped, var->name); } else { - *error_msg = apr_psprintf(msr->mp, "Matched substring \"%s\" at %s.", + *error_msg = apr_psprintf(msr->mp, "Matched phrase \"%s\" at %s.", match_escaped, var->name); } return 1; @@ -1353,10 +1353,10 @@ void msre_engine_register_default_operators(msre_engine *engine) { msre_op_pm_execute ); - /* pmfile */ + /* pmFromFile */ msre_engine_op_register(engine, - "pmfile", - msre_op_pmfile_param_init, + "pmFromFile", + msre_op_pmFromFile_param_init, msre_op_pm_execute ); diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index c6221372..6a108498 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -4290,9 +4290,10 @@ SecRule ARGS:route "!@endsWith %{REQUEST_ADDR}"
<literal>pm</literal> - Description: Parallel Match - operator. This operator uses a set based matching engine for faster - matches of keyword lists. + Description: Phrase Match + operator. This operator uses a set based matching engine (Aho-Corasick) + for faster matches of keyword lists. It will match any one of its + arguments anywhere in the target value. Example: @@ -4304,13 +4305,16 @@ SecRule ARGS:route "!@endsWith %{REQUEST_ADDR}"
- <literal>pmfile</literal> + <literal>pmFromFile</literal> - Description: Parallel Match - operator. This operator uses a set based matching engine for faster - matches of keyword lists. It is the same as @pm - except that it takes a list of files arguments. The contents of the - files should be one pattern per line. + Description: Phrase Match + operator. This operator uses a set based matching engine (Aho-Corasick) + for faster matches of keyword lists. This operator is the same as + @pm except that it takes a list of files as + arguments. It will match any one of the phrases listed in the file(s) + anywhere in the target value. The contents of the files should be one + phrase per line. End of line markers will be stripped from the phrases, + however, whitespace will not be trimmed from phrases in the file. Example: