Project

General

Profile

« Previous | Next » 

Revision a96f2d3d

Added by Ermal LUÇI over 12 years ago

Remove to parameters from system_generate_lighty_config that are unused and do a better job at tuning started php processes to not use less/more than needed. This also avoids DoS the system with php processes

View differences:

etc/inc/captiveportal.inc
411 411
	if (!isset($cpcfg['enable']))
412 412
		return;
413 413

  
414
	$use_fastcgi = true;
415

  
416 414
	if (isset($cpcfg['httpslogin'])) {
417 415
		$cert = lookup_cert($cpcfg['certref']);
418 416
		$crt = base64_decode($cert['crt']);
......
423 421
		$listenporthttps = $cpcfg['listenporthttps'] ? $cpcfg['listenporthttps'] : ($cpcfg['zoneid'] + 1);
424 422
		system_generate_lighty_config("{$g['varetc_path']}/lighty-{$cpzone}-CaptivePortal-SSL.conf",
425 423
			$crt, $key, $ca, "lighty-{$cpzone}-CaptivePortal-SSL.pid", $listenporthttps, "/usr/local/captiveportal",
426
			"cert-{$cpzone}-portal.pem", "ca-{$cpzone}-portal.pem", "1", $use_fastcgi, $cpzone);
424
			"cert-{$cpzone}-portal.pem", "ca-{$cpzone}-portal.pem", $cpzone);
427 425
	}
428 426

  
429 427
	/* generate lighttpd configuration */
430 428
	$listenporthttp = $cpcfg['listenporthttp'] ? $cpcfg['listenporthttp'] : $cpcfg['zoneid'];
431 429
	system_generate_lighty_config("{$g['varetc_path']}/lighty-{$cpzone}-CaptivePortal.conf",
432 430
		"", "", "", "lighty-{$cpzone}-CaptivePortal.pid", $listenporthttp, "/usr/local/captiveportal",
433
		"", "", "1", $use_fastcgi, $cpzone);
431
		"", "", $cpzone);
434 432

  
435 433
	/* attempt to start lighttpd */
436 434
	$res = mwexec("/usr/local/sbin/lighttpd -f {$g['varetc_path']}/lighty-{$cpzone}-CaptivePortal.conf");
etc/inc/system.inc
813 813
	$document_root = "/usr/local/www/",
814 814
	$cert_location = "cert.pem",
815 815
	$ca_location = "ca.pem",
816
	$max_requests = "2",
817
	$fast_cgi_enable = true,
818 816
	$captive_portal = false) {
819 817

  
820 818
	global $config, $g;
......
827 825
		echo "system_generate_lighty_config() being called $mt\n";
828 826
	}
829 827

  
830
	if($captive_portal !== false)  {
828
	if ($captive_portal !== false)  {
831 829
		$captiveportal = ",\"mod_rewrite\",\"mod_evasive\"";
832 830
		$captive_portal_rewrite = "url.rewrite-once = ( \"(.*captiveportal.*)\" => \"$1\", \"(.*)\" => \"/index.php?zone={$captive_portal}&redirurl=$1\" )\n";
833 831

  
834 832
		$maxprocperip = $config['captiveportal'][$captive_portal]['maxprocperip'];
835
		if(empty($maxprocperip))
833
		if (empty($maxprocperip))
836 834
			$maxprocperip = 10;
837 835
		$captive_portal_mod_evasive = "evasive.max-conns-per-ip = {$maxprocperip}";
838 836

  
......
848 846
		$server_max_request_size = "server.max-request-size    = 2097152";
849 847
	}
850 848
	
851
	if($port <> "")
852
		$lighty_port = $port;
853
	else
849
	if (empty($port))
854 850
		$lighty_port = "80";
851
	else
852
		$lighty_port = $port;
855 853

  
856 854
	$memory = get_memory();
857 855
	$avail = $memory[0];
858 856

  
859 857
	// Determine web GUI process settings and take into account low memory systems
860
	if($avail > 0 and $avail < 65) {
861
		$fast_cgi_enable = false;
862
	}
863
	if($avail > 64 and $avail < 256) {
864
		$max_procs = ($config['system']['webgui']['max_procs']) ? $config['system']['webgui']['max_procs'] : 1;
865
	}
866
	if($avail > 255 ) {
858
	if ($avail < 255)
859
		$max_procs = 1;
860
	else
867 861
		$max_procs = ($config['system']['webgui']['max_procs']) ? $config['system']['webgui']['max_procs'] : 2;
868
	}
869 862

  
870 863
	// Ramp up captive portal max procs, assuming each PHP process can consume up to 64MB RAM 
871 864
	if($captive_portal !== false)  {
872
		if($avail > 107 and $avail < 256) {
865
		if ($avail > 135 and $avail < 256) {
873 866
			$max_procs += 1; // 2 worker processes
874
		}
875
		if($avail > 255 and $avail < 320) {
876
			$max_procs += 1; // 3 worker processes
877
		}
878
		if($avail > 319 and $avail < 384) {
879
			$max_procs += 2; // 4 worker processes
880
		}
881
		if($avail > 383 and $avail < 448) {
882
			$max_procs += 3; // 5 worker processes
883
		}
884
		if($avail > 447) {
867
		} else if ($avail > 255 and $avail < 513) {
868
			$max_procs += 2; // 3 worker processes
869
		} else if ($avail > 512) {
885 870
			$max_procs += 4; // 6 worker processes
886 871
		}
872
		if ($max_procs > 1)
873
			$max_php_children = intval($max_procs/2);
874
		else
875
			$max_php_children = 1;
876

  
877
		$bin_environment =  <<<EOC
878
			"bin-environment" => (
879
				"PHP_FCGI_CHILDREN" => "{$max_php_children}",
880
				"PHP_FCGI_MAX_REQUESTS" => "500"
881
			),
882
EOC;
883
	} else {
887 884
		$bin_environment =  <<<EOC
885
			"bin-environment" => (
886
				"PHP_FCGI_CHILDREN" => "1",
887
				"PHP_FCGI_MAX_REQUESTS" => "500"
888
			),
888 889
EOC;
889 890
	}
890 891

  
......
892 893
		$fast_cgi_path = "{$g['tmp_path']}/php-fastcgi-{$captive_portal}.socket";
893 894
	else
894 895
		$fast_cgi_path = "{$g['tmp_path']}/php-fastcgi.socket";
896

  
895 897
	$fastcgi_config = <<<EOD
896 898
#### fastcgi module
897 899
## read fastcgi.txt for more info
898 900
fastcgi.server = ( ".php" =>
899
( "localhost" =>
900
	(
901
		"socket" => "{$fast_cgi_path}",
902
		"min-procs" => 0,
903
		"max-procs" => {$max_procs},
904
		"bin-environment" => (
905
			"PHP_FCGI_CHILDREN" => "1",
906
			"PHP_FCGI_MAX_REQUESTS" => "500"
907
		),
908
		"bin-path" => "/usr/local/bin/php"
901
	( "localhost" =>
902
		(
903
			"socket" => "{$fast_cgi_path}",
904
			"max-procs" => {$max_procs},
905
	{$bin_environment}
906
			"bin-path" => "/usr/local/bin/php"
907
		)
909 908
	)
910 909
)
911
)
912 910

  
913 911
EOD;
914 912

  
915
	$lighty_config = "";
916
	$lighty_config .= <<<EOD
913
	$lighty_config = <<<EOD
917 914
#
918 915
# lighttpd configuration file
919 916
#

Also available in: Unified diff