af-packet: disable hwtimestamp by default

Add enable-hwtimestamp option to replace disable-hwtimestamp.

Ticket: #7585.

doc/userguide/capture-hardware/af-packet.rst

@@ -11,12 +11,12 @@ AF_PACKET is a capture interface to the Linux Kernel.
 Config Options
 **************
 
-disable-hwtimestamp
-===================
+enable-hwtimestamp
+==================
 
-Boolean option to disable hardware timestamping on an interface.
+Boolean option to enable hardware timestamping on an interface.
 
-By default the hardware timestamping support is enabled if the system support it.
+By default the hardware timestamping support is disabled.
 
 Hardware timestamping can lead to issue of the NIC and kernel getting out of sync. See 
 `ticket 7585 <https://redmine.openinfosecfoundation.org/issues/7585>`_.
@@ -26,6 +26,6 @@ Hardware timestamping can lead to issue of the NIC and kernel getting out of syn
     af-packet:
       - interface: eth0
         cluster-id: 99
-        disable-hwtimestamp: true
+        enable-hwtimestamp: true
         cluster-type: cluster_flow
 

src/runmode-af-packet.c

@@ -635,18 +635,13 @@ static void *ParseAFPConfig(const char *iface)
         aconf->promisc = 0;
     }
 
-    (void)SCConfGetChildValueBoolWithDefault(if_root, if_default, "disable-hwtimestamp", &boolval);
+    (void)SCConfGetChildValueBoolWithDefault(if_root, if_default, "enable-hwtimestamp", &boolval);
     if (boolval) {
 #ifdef HAVE_HW_TIMESTAMPING
-        SCLogConfig("%s: disabling hardware timestamping", aconf->iface);
-#endif
-        aconf->flags |= AFP_DISABLE_HWTIMESTAMP;
-    }
-#ifdef HAVE_HW_TIMESTAMPING
-    if ((aconf->flags & AFP_DISABLE_HWTIMESTAMP) == 0) {
         SCLogConfig("%s: enabling hardware timestamping", aconf->iface);
-    }
 #endif
+        aconf->flags |= AFP_ENABLE_HWTIMESTAMP;
+    }
 
     if (SCConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) {
         if (strcmp(tmpctype, "auto") == 0) {

src/source-af-packet.c

@@ -1737,11 +1737,13 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname)
     }
 
 #ifdef HAVE_HW_TIMESTAMPING
-    if ((ptv->flags & AFP_DISABLE_HWTIMESTAMP) == 0) {
+    if (ptv->flags & AFP_ENABLE_HWTIMESTAMP) {
         int req = SOF_TIMESTAMPING_RAW_HARDWARE;
         if (setsockopt(ptv->socket, SOL_PACKET, PACKET_TIMESTAMP, (void *)&req, sizeof(req)) < 0) {
             SCLogWarning("%s: failed to activate hardware timestamping on packet socket: %s",
                     devname, strerror(errno));
+        } else {
+            SCLogConfig("%s: hardware timestamping enabled", devname);
         }
     } else {
         SCLogConfig("%s: hardware timestamping disabled", devname);

src/source-af-packet.h

@@ -56,7 +56,7 @@ struct ebpf_timeout_config {
 
 /* value for flags */
 #define AFP_NEED_PEER (1 << 0)
-#define AFP_DISABLE_HWTIMESTAMP (1 << 1)
+#define AFP_ENABLE_HWTIMESTAMP (1 << 1)
 #define AFP_SOCK_PROTECT (1<<2)
 #define AFP_EMERGENCY_MODE (1<<3)
 #define AFP_TPACKET_V3 (1<<4)

suricata.yaml.in

@@ -731,9 +731,9 @@ af-packet:
     #copy-iface: eth1
     #  For eBPF and XDP setup including bypass, filter and load balancing, please
     #  see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.
-    # Disable HW timestamp support. HW timestamps can be unreliable, see
-    # https://redmine.openinfosecfoundation.org/issues/7585
-    #disable-hwtimestamp: true
+    # Enable HW timestamp support. HW timestamps can be unreliable and are disable
+    # by default, see https://redmine.openinfosecfoundation.org/issues/7585
+    #enable-hwtimestamp: true
 
   # Put default values here. These will be used for an interface that is not
   # in the list above.