nginx/php adjustments for issue #101, uploading very large pcap files…

… may fail
cisagov · Jan 20, 2020 · a26691a · a26691a
1 parent 2a10fc4
commit a26691a
Show file tree

Hide file tree

Showing 3 changed files with 33 additions and 16 deletions.
diff --git a/file-upload/nginx/sites-available/default b/file-upload/nginx/sites-available/default
@@ -3,10 +3,7 @@ server {
 
     sendfile on;
     client_max_body_size 20G;
-
-    proxy_buffer_size 128k;
-    proxy_buffers 4 256k;
-    proxy_busy_buffers_size 256k;
+    client_body_buffer_size 4M;
 
     root /var/www/upload;
     index index.php index.html index.htm;
@@ -19,7 +16,12 @@ server {
 
     location ~ \.php$ {
         include snippets/fastcgi-php.conf;
-        fastcgi_read_timeout 300;
+        fastcgi_buffers 16 64k;
+        fastcgi_buffer_size 256k;
+        fastcgi_read_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_busy_buffers_size 384k;
+        fastcgi_request_buffering off;
         fastcgi_pass unix:/run/php/php7.3-fpm.sock;
     }
 

diff --git a/file-upload/php/php.ini b/file-upload/php/php.ini
@@ -17,8 +17,8 @@ disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexi
 disable_classes =
 zend.enable_gc = On
 expose_php = Off
-max_execution_time = 600
-max_input_time = 600
+max_execution_time = 900
+max_input_time = 900
 memory_limit = 128M
 error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
 display_errors = Off
@@ -44,10 +44,10 @@ user_dir =
 enable_dl = Off
 file_uploads = On
 upload_max_filesize = 20G
-max_file_uploads = 20
+max_file_uploads = 8
 allow_url_fopen = On
 allow_url_include = Off
-default_socket_timeout = 60
+default_socket_timeout = 180
 
 [CLI Server]
 cli_server.color = On

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
@@ -10,14 +10,21 @@ http {
 
   include /etc/nginx/mime.types;
   sendfile on;
+
   client_max_body_size 20m;
-  fastcgi_buffers 16 16k;
-  fastcgi_buffer_size 32k;
-  fastcgi_read_timeout 600;
-  proxy_read_timeout 600;
-  proxy_buffer_size 128k;
-  proxy_buffers 4 256k;
-  proxy_busy_buffers_size 256k;
+
+  fastcgi_buffers 16 64k;
+  fastcgi_buffer_size 256k;
+  fastcgi_read_timeout 300s;
+  fastcgi_busy_buffers_size 384k;
+  fastcgi_request_buffering off;
+
+  proxy_connect_timeout 180s;
+  proxy_read_timeout 300s;
+  proxy_send_timeout 300s;
+  proxy_buffer_size 512k;
+  proxy_buffers 16 4m;
+  proxy_busy_buffers_size 16m;
 
   # if LDAP authentication is enabled, this will configure the ldap_server section
   include /etc/nginx/nginx_ldap_rt.conf;
@@ -89,9 +96,13 @@ http {
 
     # Malcolm file upload
     location /upload {
+      proxy_http_version 1.1;
+      proxy_set_header Connection "";
       proxy_pass http://docker-upload;
       proxy_redirect off;
       proxy_set_header Host upload.malcolm.local;
+      proxy_request_buffering off;
+      proxy_buffering off;
       client_max_body_size 20G;
     }
 
@@ -188,9 +199,13 @@ http {
     }
 
     location / {
+      proxy_http_version 1.1;
+      proxy_set_header Connection "";
       proxy_pass http://docker-upload;
       proxy_redirect off;
       proxy_set_header Host upload.malcolm.local;
+      proxy_request_buffering off;
+      proxy_buffering off;
       client_max_body_size 20G;
     }
   }