henrypp / simplewall

Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
GNU General Public License v3.0
6.37k stars 494 forks source link

Large Private Bytes memory leak after adding two rules for TorrentApp - simplewall 3.3.3 on Windows 7 x64 #937

Closed githwithit closed 3 years ago

githwithit commented 3 years ago

I have simplewall 3.3.3 on two Windows 7 x64 computers and since adding two rules to each of them, I have a very large Private Bytes memory leak.

The two added rules are for a torrenting application to only allow: 1) incoming on a port (something other than 12345) 2) outbound to a specific, non-routable IP range (something other than x.y.z.1-255)

TorrentApp ALLOW incoming local 12345 Protocol=any Family=IPv4 Direction=Inbound Action=Allow Rule(Local): 12345

TorrentApp ALLOW outbound local x.y.z.1-x.y.z.255 Protocol=any Family=IPv4 Direction=Outbound Action=Allow Rule(Local): x.y.z.1-x.y.z.255

After adding these two rules, I tested the TorrentApp and traffic only flows when the computers are connected to VPN gateways using non-routable IPs in the x.y.z.1-x.y.z.255 range.

Now if I start the TorrentApp while not on the VPN, no traffic flows. This is perfect and just what I wanted.

But...

I noticed on computer2 that the Private Byte usage as measured by Sysinternals Process Explorer had grown to 2GB and even 3GB after a day or more of usage.

Stopping and restarting simplewall-64.exe restarts the Private Bytes used figure at about 16KB but it usually grows quickly.

I created a Task Scheduler task that kills and then starts simplewall-64.exe every hour. This prevents the Private Bytes usage from growing beyond about 170900KB on either computer.

I recorded the Private Bytes usage for each computer just before and right after the kill/start task runs. The Private Bytes 1day estimate is simply based on multiplying a 1hour measurement in growth times 24hours.

computer1 leak over 1hour time simplewall-64.exe 3.3.3 private.bytes - kill/start.simplewall - private.bytes 169076-16260 ~3.5GB/day 159176-15632 ~3.3GB/day 20736-14552 no leak 16436-15192 no leak

computer2 leak over 1hour time simplewall-64.exe 3.3.3 private.bytes - kill/start.simplewall - private.bytes 153256-16000 ~3.1GB/day 138384-15052 ~2.8GB/day 170900-15792 ~3.6GB/day

The average is about 3.25GB/day and there were no leaks on computer1 for that day's two tests.

Both simplewall installs are configured the same. I use a portable install and just copy the computer1 folder to computer2.

Both computer1 and computer2 use the same TorrentApp and the same VPN provider but different VPN gateways. Both gateways use the x.y.z.1-x.y.z.255 IP range.

I could just set my rules and then close simplewall-64.exe to avoid the Private Bytes leak. I really only need the simplewall interface when I'm trying new apps out.

Instead, I made the kill/start script and run it every hour. It works well though I hope a future version of simplewall won't have this Private Bytes growth issue.

Thanks for looking at this and thanks for a great program!

henrypp commented 3 years ago

Hi, this issue is already observed #888