From 1efdf15caddd3a8fa26fd4ea0a9634e04a1a2e8a Mon Sep 17 00:00:00 2001
From: Ermal <eri@pfsense.org>
Date: Thu, 12 Jul 2012 07:53:33 +0000
Subject: Allow to disable cksum checking pf(4) does this already

---
 config/snort/snort.inc                 |  6 +++++-
 config/snort/snort_interfaces_edit.php | 10 +++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

(limited to 'config')

diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index cf05be67..d9dec153 100644
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -1292,6 +1292,10 @@ EOD;
 		}
 	}
 
+	$cksumcheck = "all";
+	if ($snortcfg['cksumcheck'] == 'on')
+		$cksumcheck = "none";
+
 	/* build snort configuration file */
 	$snort_conf_text = <<<EOD
 
@@ -1313,7 +1317,7 @@ var PREPROC_RULE_PATH {$snortdir}/preproc_rules
 {$portvardef}
 
 # Configure the snort decoder  #
-config checksum_mode: all
+config checksum_mode: {$cksumcheck}
 config disable_decode_alerts
 config disable_tcpopt_experimental_alerts
 config disable_tcpopt_obsolete_alerts
diff --git a/config/snort/snort_interfaces_edit.php b/config/snort/snort_interfaces_edit.php
index 4e453fc7..06a1d6f4 100644
--- a/config/snort/snort_interfaces_edit.php
+++ b/config/snort/snort_interfaces_edit.php
@@ -106,6 +106,7 @@ if ($_POST["Submit"]) {
 		if ($_POST['tcpdumplog'] == "on") { $natent['tcpdumplog'] = 'on'; } else{ $natent['tcpdumplog'] = 'off'; }
 		if ($_POST['snortunifiedlog'] == "on") { $natent['snortunifiedlog'] = 'on'; }else{ $natent['snortunifiedlog'] = 'off'; }
 		if ($_POST['configpassthru']) $natent['configpassthru'] = base64_encode($_POST['configpassthru']); else unset($natent['configpassthru']);
+		if ($_POST['cksumcheck']) $natent['cksumcheck'] = 'on'; else $natent['cksumcheck'] = 'off';
 
 		$if_real = snort_get_real_interface($natent['interface']);
 		if (isset($id) && $a_rule[$id]) {
@@ -394,7 +395,14 @@ function enable_change(enable_change) {
 		will like this rule to use. </span><br/>&nbsp;<br/><span class="red">Note:</span><br/>&nbsp;Default
 		option disables suppression and filtering.</td>
 	</tr>
-
+	<tr>
+				<td width="22%" valign="top" class="vncell">Checksum checking</td>
+				<td width="78%" class="vtable">
+					<input name="cksumcheck" id="cksumcheck" type="checkbox" value="on" <?php if ($pconfig['cksumcheck'] == "on") echo "checked"; ?>>
+					<br/>If ticked checksum checking on snort will be disabled to improve performance.
+					<br/>Most of this is already done on the firewall/filter level
+				</td>
+	</tr>
 	<tr>
 		<td colspan="2" valign="top" class="listtopic">Choose the types of
 		logs snort should create.</td>
-- 
cgit v1.2.3