OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 21.7 Legacy Series »
  • 21.7.1 Maltrail OOM / Possible fix
« previous next »
  • Print
Pages: 1 [2] 3

Author Topic: 21.7.1 Maltrail OOM / Possible fix  (Read 19323 times)

Leviathan

  • Newbie
  • *
  • Posts: 28
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #15 on: October 12, 2021, 11:09:57 pm »
Still no official solution to this problem?
Logged
A rainy day...

mimugmail

  • Hero Member
  • *****
  • Posts: 6479
  • Karma: 449
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #16 on: October 13, 2021, 06:16:08 am »
No
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

Leviathan

  • Newbie
  • *
  • Posts: 28
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #17 on: November 06, 2021, 12:29:56 am »
After 3 months still no solution... :-\
Logged
A rainy day...

mimugmail

  • Hero Member
  • *****
  • Posts: 6479
  • Karma: 449
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #18 on: November 06, 2021, 09:21:34 am »
You can try to build a port for pcapy-ng, then we can work on.
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

Northguy

  • Full Member
  • ***
  • Posts: 117
  • Karma: 11
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #19 on: November 06, 2021, 02:07:32 pm »
Quote from: mimugmail on September 11, 2021, 06:16:31 pm
It wont get fixed anytime soon as the pcapy lib is the root cause for it.

If it is pcapy that is offending, you are right. it seems unmaintained (last release 02 Jul 2019). Although Stamparm himself has forked pcapy and is maintaining pcapy-ng. I would assume that this was done to implement improvements in maltrail?
Logged

opn_nwo

  • Jr. Member
  • **
  • Posts: 66
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #20 on: November 18, 2021, 09:43:52 pm »
That's too bad. I had to disable the service on both my servers as it was getting too cumbersome to manually kill the runaway processes every day. Hopefully it will get fixed at some point.
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6479
  • Karma: 449
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #21 on: November 19, 2021, 06:56:29 am »
Quote from: Northguy on November 06, 2021, 02:07:32 pm
Quote from: mimugmail on September 11, 2021, 06:16:31 pm
It wont get fixed anytime soon as the pcapy lib is the root cause for it.

If it is pcapy that is offending, you are right. it seems unmaintained (last release 02 Jul 2019). Although Stamparm himself has forked pcapy and is maintaining pcapy-ng. I would assume that this was done to implement improvements in maltrail?

Yep, but this needs a FreeBSD port to integrate it. Sadly I dont have the time
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

javis

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #22 on: March 12, 2022, 08:14:03 am »
Quote from: mimugmail on November 19, 2021, 06:56:29 am
Quote from: Northguy on November 06, 2021, 02:07:32 pm
Quote from: mimugmail on September 11, 2021, 06:16:31 pm
It wont get fixed anytime soon as the pcapy lib is the root cause for it.

If it is pcapy that is offending, you are right. it seems unmaintained (last release 02 Jul 2019). Although Stamparm himself has forked pcapy and is maintaining pcapy-ng. I would assume that this was done to implement improvements in maltrail?

Yep, but this needs a FreeBSD port to integrate it. Sadly I dont have the time

Maltrail was almost completely unusable because of the memory leak. Unfortunately I have some company devices that generate crazy amount of telemetry requests, which greatly worsened the situation: 16GB of RAM and SWAP were completely filled up every half a day before my server box froze! Creating a cron job to restart the sensors actually accelerated the memory leak, because the old processes were simply orphaned rather than killed. This plugin in its current state is bound to crash your network sooner or later.

Thanks to the info in this thread, the fix is actually very simple (one doesn't have to install Python 2 to get it done) if people don't mind installing pip. Just follow Maltrail author's advice of using pcapy-ng, which simply added the PY_SSIZE_T_CLEAN macro definition to the abandoned pcapy codebase.

Code: [Select]
python3 -m ensurepip
pip3 install pcapy-ng

It's been a few days now, and my server box's memory usage has been very stable (around 30% ~ 60% without any swapping).

@mimugmail thank you for porting Maltrail to FreeBSD and creating the OPNsense plugin! If you don't have time bundling pcapy-ng with Maltrail (I'm not familiar with OPNsense development but it looks to me the plugin simply offers a web interface, and the actual Maltrail and its dependencies are pre-bundled into the system? How do folks go about submitting updates to them?), do you think you can revise the plugin description to include a short pcapy-ng installation guide? It shouldn't take one a couple days of crashing and researching to find out the culprit and the way to fix it :D
« Last Edit: March 12, 2022, 08:20:40 am by javis »
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6479
  • Karma: 449
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #23 on: March 12, 2022, 08:04:34 pm »
I already added a PR for pcapy-ng in December but noone with Commit bit merges it
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

javis

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #24 on: March 13, 2022, 09:51:57 pm »
Quote from: mimugmail on March 12, 2022, 08:04:34 pm
I already added a PR for pcapy-ng in December but noone with Commit bit merges it

I was trying to find your PR so did some digging (couldn't find it though), is this where OPNsense builds the Maltrail plugin: https://github.com/opnsense/ports/blob/91da3754f16f546456479e3a8790bccff33cf429/security/maltrail/Makefile#L11? Can we simply update this to depend on pcapy-ng or is there something else we need to do (like updating FreeBSD ports upstream etc)?
« Last Edit: March 13, 2022, 10:00:09 pm by javis »
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6479
  • Karma: 449
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #25 on: March 13, 2022, 09:59:27 pm »
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260732
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

javis

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #26 on: March 13, 2022, 10:09:23 pm »
Ah right, the GitHub repo is just a mirror, would need to submit a ticket on FreeBSD instead. Thx for bumping up that bug!
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6479
  • Karma: 449
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #27 on: March 14, 2022, 08:14:17 am »
Can you remind me in April again here? If its still not merged over there we can add it to opn mirror as an OPNsense port
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

javis

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #28 on: March 15, 2022, 03:09:57 am »
Sure, I'll set a reminder for myself on 4th.
Logged

javis

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: 21.7.1 Maltrail OOM / Possible fix
« Reply #29 on: April 05, 2022, 03:40:47 am »
Quote from: mimugmail on March 14, 2022, 08:14:17 am
Can you remind me in April again here? If its still not merged over there we can add it to opn mirror as an OPNsense port

Here's your friendly human alarm clock reporting that the FreeBSD ticket regarding pcapy-ng has been closed / fixed :) However, I started seeing the memory leak again recently so am not entirely sure if it's simply because pcapy-ng still can't work with Python 3 in its current state (although I see some fixes have been pushed to pcapy-ng since last conversation). I have disabled Maltrail for now and will check if the latest port, once available, fixes the memory issues.
« Last Edit: April 05, 2022, 10:03:44 am by javis »
Logged

  • Print
Pages: 1 [2] 3
« previous next »
  • OPNsense Forum »
  • Archive »
  • 21.7 Legacy Series »
  • 21.7.1 Maltrail OOM / Possible fix
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2