Maltrail/Sensor: Allow to configure capture buffer size. (#2063)

Made CAPTURE_BUFFER option configurable since the fixed default (10% of RAM) is very large for RAM sizes above 4GB and causes high RAM & swap usage.

security/maltrail/Makefile

@@ -1,6 +1,5 @@
 PLUGIN_NAME=		maltrail
-PLUGIN_VERSION=		1.5
-PLUGIN_REVISION=	1
+PLUGIN_VERSION=		1.6
 PLUGIN_COMMENT=		Malicious traffic detection system
 PLUGIN_DEPENDS=		maltrail
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

security/maltrail/pkg-descr

@@ -11,6 +11,10 @@ WWW: https://github.com/stamparm/maltrail
 Changelog
 ---------
 
+1.6
+
+* Allow to set capture buffer size
+
 1.5
 
 * Change whitelisting format (by @jkellerer)

security/maltrail/src/opnsense/mvc/app/controllers/OPNsense/Maltrail/forms/sensor.xml

@@ -11,6 +11,12 @@
         <type>checkbox</type>
         <help>This will look into all IPv4 and IPv6 traffic. If disabled it will only look for traffic for icmp, udp, tcp syn packets and on known HTTP ports.</help>
     </field>
+    <field>
+        <id>sensor.capturebuffer</id>
+        <label>Capture Buffer Size</label>
+        <type>text</type>
+        <help>Size of the ring buffer (in MB) to memory-map into the sensor processes for sharing captured network traffic. An undersized buffer may reduce detection rates. Defaults to 10% of available RAM when left blank.</help>
+    </field>
     <field>
         <id>sensor.remoteserver</id>
         <label>Remote Server</label>

security/maltrail/src/opnsense/mvc/app/models/OPNsense/Maltrail/Sensor.xml

@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/maltrail/sensor</mount>
     <description>Maltrail sensor configuration</description>
-    <version>0.0.1</version>
+    <version>0.0.2</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
@@ -11,6 +11,12 @@
             <default>0</default>
             <Required>Y</Required>
         </captureall>
+        <capturebuffer type="IntegerField">
+            <MinimumValue>10</MinimumValue>
+            <MaximumValue>1000</MaximumValue>
+            <ValidationMessage>Please specify a buffer size between 10 and 1000 MB</ValidationMessage>
+            <Required>N</Required>
+        </capturebuffer>
         <remoteserver type="HostnameField">
             <Required>N</Required>
         </remoteserver>

security/maltrail/src/opnsense/service/templates/OPNsense/Maltrail/maltrail.conf

@@ -55,7 +55,11 @@ MONITOR_INTERFACE {{ interfaces|join(',') }}
 {% else %}
 MONITOR_INTERFACE any
 {% endif %}
+{% if helpers.empty('OPNsense.maltrail.sensor.capturebuffer') %}
 CAPTURE_BUFFER 10%
+{% else %}
+CAPTURE_BUFFER {{OPNsense.maltrail.sensor.capturebuffer}}MB
+{% endif %}
 {% if helpers.exists('OPNsense.maltrail.sensor.captureall') and OPNsense.maltrail.sensor.captureall == '1' %}
 CAPTURE_FILTER ip or ip6
 {% else %}