医学—modsecurity调研工作汇报.pptxVIP

Modsecurity调研报告;调研目的;内容;Modsecurity执行流程;读取规则;翻译规则;规则生效;规则格式;规则格式;指令哈希表;指令哈希表;哈希表结构体;建立规则引擎;规则引擎modsecurity;读取规则;读取规则;配置树 ap_conftree;翻译规则;翻译规则;翻译规则;翻译规则;翻译规则;规则集和规则;*规则存储*;动作和动作集;规则生效;规则生效;SecRule REMOTE_ADDR ^192\.168\.1\.105$ \redirect: ;SecRule REMOTE_ADDR ^192\.168\.1\.105$ \redirect: ;SecRule REMOTE_ADDR ^192\.168\.1\.105$ \redirect: ;重要结构体总结;执行流程总结;移植问题;移植问题;移植问题;Apache中定义模块的结构体;移植问题;Apache 配置信息的存储数据结构图解;Structure of the per–request configuration processor: The walk procedures;移植问题;移植问题;request_rec;*规则存储*;重要函数流程图;规则添加函数（规则翻译函数）及规则生效函数流程图;Apache2_config.c, Line 615;add_rule;;Apache2_config.c, Line 615;add_rule;;modsecurity.c, Line 659; modsecurity_process_phase;;modsecurity.c, Line 459; modsecurity_process_phase_request_headers;;re.c, Line 1078;msre_ruleset_process_phase;;re.c, Line 2849; msre_rule_process;;re.c, Line 2271;msre_rule_process_normal;;re.c, Line 2120;execute_operator;;hook_request_early 、hook_request_late、output_filter 三个函数的流程图;mod_security2.c, Line 638;  hook_request_early; /*初始化请求处理，在apache接收到请求头后马上执行。这个函数会创建新的modsec_rec类型结构体。*/;mod_security2.c, Line 350; create_tx_context;;modsecurity.c, Line 267; modsecurity_tx_init;;mod_security2.c, Line 676; hook_request_late;;Line 765-789; /* 检查请求体是否过长*/;Line 189; bb_in = apr_brigade_create(msr-mp, r-connection-bucket_alloc); /* */;Line 240; if (msr-reqbody_length + buflen (apr_size_t)msr-txcfg-reqbody_limit) { ; /* 检查请求体大小限制(should only trigger on chunked requests) */;Line 97; msre_reqbody_processor_metadata *metadata =; /*获取请求体处理器的元数据结构体*/;Line 56-74; /*为将请求体保存到磁盘中做准备*/;Line 653; msr-msc_reqbody_fd = open(msr-msc_reqbody_filename, O_RDONLY | O_BINARY); /*打开磁盘上将要存储请求体数据的文件*/;msc_reqbody.c, Line 687; modsecurity_request_body_retrieve;/*Returns one chunk of request body data. It stores a NULL in the chunk pointer when there is no data to return. The return code is 1 if more calls can be made to retrieve more data, 0 if there is no more data to retrieve, or -1 on error. The ca