offloading: make disabling offloading configurable

Add a generic 'capture' section to the YAML:

  # general settings affecting packet capture
  capture:
    # disable NIC offloading. It's restored when Suricata exists.
    # Enabled by default
    #disable-offloading: false
    #
    # disable checksum validation. Same as setting '-k none' on the
    # commandline
    #checksum-validation: none

diff --git a/src/suricata.c b/src/suricata.c
index 66d94ff78bf1e6881824b60f68d53870db6d801f..1a395ce3b3d3249314c20b3c1044798e83a94eea 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -2201,6 +2201,25 @@ static int PostConfLoadedSetup(SCInstance *suri)
 #endif
     SpmTableSetup();
 
+    int disable_offloading;
+    if (ConfGetBool("capture.disable-offloading", &disable_offloading) == 0)
+        disable_offloading = 1;
+    if (disable_offloading) {
+        LiveSetOffloadDisable();
+    } else {
+        LiveSetOffloadWarn();
+    }
+
+    if (suri->checksum_validation == -1) {
+        char *cv = NULL;
+        if (ConfGet("capture.checksum-validation", &cv) == 1) {
+            if (strcmp(cv, "none") == 0) {
+                suri->checksum_validation = 0;
+            } else if (strcmp(cv, "all") == 0) {
+                suri->checksum_validation = 1;
+            }
+        }
+    }
     switch (suri->checksum_validation) {
         case 0:
             ConfSet("stream.checksum-validation", "0");

diff --git a/suricata.yaml.in b/suricata.yaml.in
index f8be4b3d27478b94262058a0d43bd688c9da913f..9faf1f623a50bba636aa3a583fe7ab7c0b5ff5bf 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1446,6 +1446,16 @@ nflog:
 ## Advanced Capture Options
 ##
 
+# general settings affecting packet capture
+capture:
+  # disable NIC offloading. It's restored when Suricata exists.
+  # Enabled by default
+  #disable-offloading: false
+  #
+  # disable checksum validation. Same as setting '-k none' on the
+  # commandline
+  #checksum-validation: none
+
 # Netmap support
 #
 # Netmap operates with NIC directly in driver, so you need FreeBSD wich have