af-packet: add disable-hwtimestamp option

HW timestamping is not always reliable, so add an option to disable it.

Bug: #1954.
(cherry picked from commit 18a6a079da)

src/runmode-af-packet.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2011-2024 Open Information Security Foundation
+/* Copyright (C) 2011-2025 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -635,6 +635,19 @@ static void *ParseAFPConfig(const char *iface)
         aconf->promisc = 0;
     }
 
+    (void)SCConfGetChildValueBoolWithDefault(if_root, if_default, "disable-hwtimestamp", &boolval);
+    if (boolval) {
+#ifdef HAVE_HW_TIMESTAMPING
+        SCLogConfig("%s: disabling hardware timestamping", aconf->iface);
+#endif
+        aconf->flags |= AFP_DISABLE_HWTIMESTAMP;
+    }
+#ifdef HAVE_HW_TIMESTAMPING
+    if ((aconf->flags & AFP_DISABLE_HWTIMESTAMP) == 0) {
+        SCLogConfig("%s: enabling hardware timestamping", aconf->iface);
+    }
+#endif
+
     if (SCConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) {
         if (strcmp(tmpctype, "auto") == 0) {
             aconf->checksum_mode = CHECKSUM_VALIDATION_AUTO;

src/source-af-packet.c

@@ -1736,11 +1736,14 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname)
     }
 
 #ifdef HAVE_HW_TIMESTAMPING
-    int req = SOF_TIMESTAMPING_RAW_HARDWARE;
-    if (setsockopt(ptv->socket, SOL_PACKET, PACKET_TIMESTAMP, (void *) &req,
-                sizeof(req)) < 0) {
-        SCLogWarning("%s: failed to activate hardware timestamping on packet socket: %s", devname,
-                strerror(errno));
+    if ((ptv->flags & AFP_DISABLE_HWTIMESTAMP) == 0) {
+        int req = SOF_TIMESTAMPING_RAW_HARDWARE;
+        if (setsockopt(ptv->socket, SOL_PACKET, PACKET_TIMESTAMP, (void *)&req, sizeof(req)) < 0) {
+            SCLogWarning("%s: failed to activate hardware timestamping on packet socket: %s",
+                    devname, strerror(errno));
+        }
+    } else {
+        SCLogConfig("%s: hardware timestamping disabled", devname);
     }
 #endif
 

src/source-af-packet.h

@@ -56,7 +56,7 @@ struct ebpf_timeout_config {
 
 /* value for flags */
 #define AFP_NEED_PEER (1 << 0)
-// (1<<1) vacant
+#define AFP_DISABLE_HWTIMESTAMP (1 << 1)
 #define AFP_SOCK_PROTECT (1<<2)
 #define AFP_EMERGENCY_MODE (1<<3)
 #define AFP_TPACKET_V3 (1<<4)

suricata.yaml.in

@@ -731,6 +731,9 @@ af-packet:
     #copy-iface: eth1
     #  For eBPF and XDP setup including bypass, filter and load balancing, please
     #  see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.
+    # Disable HW timestamp support. HW timestamps can be unreliable, see
+    # https://redmine.openinfosecfoundation.org/issues/7585
+    #disable-hwtimestamp: false
 
   # Put default values here. These will be used for an interface that is not
   # in the list above.