Skip to content

Commit b4a4447

Browse files
coniohconioh
authored
Merge branch 'nmap:master' into fix_nonadmin_npcaphelper
2 parents 698d11b + d2a6548 commit b4a4447

File tree

23 files changed

+1811
-326
lines changed

23 files changed

+1811
-326
lines changed

‎CHANGELOG.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,53 @@
1+
## Npcap 1.84 [2025-10-02]
2+
3+
* Fixed a regression in #742 (previously fixed in Npcap 1.80). The fix changes
4+
to libpcap had been overwritten in our local branch, causing the same
5+
Application Verifier faults to recur.
6+
7+
* Resolve an issue in the installer/uninstaller where x64-emulated processes on
8+
ARM64 (and possibly 32-bit processes on both x64 and ARM64) that were using
9+
Npcap were not correctly terminated, leading to failed installations.
10+
11+
* New DriverQuery.exe diagnostic tool. This will be run as part of
12+
[DiagReport](https://npcap.com/guide/npcap-users-guide.html#npcap-issues-diagreport)
13+
on new installations, but can be run independently on older installations for
14+
better diagnosis of connection issues.
15+
16+
* Added performance metrics for time spent processing packets. These can be
17+
queried with the DriverQuery diagnostic tool or via `PacketGetInfo()` using
18+
the `NPF_GETINFO_STATS` query ID.
19+
20+
* Added additional checks to ensure data structures allocated when injecting
21+
packets are freed. No leaks were reported, but it is possible some packets
22+
could have been leaked when using the SendToRx feature.
23+
24+
* An experimental feature, adaptive buffer sizing, can be enabled in Packet.dll
25+
by setting the `PACKET_EXPERIMENTAL_OPTIMIZATION` environment variable.
26+
See ([#622](http://issues.npcap.org/622)).
27+
28+
## Npcap 1.83 [2025-08-01]
29+
30+
* \[SECURITY\] Rebuilt the Windows self-installer with NSIS 3.11, addressing
31+
CVE-2025-43715--a race condition in earlier NSIS versions that could allow
32+
local attackers to escalate to SYSTEM privileges when a vulnerable installer
33+
is run as SYSTEM. The Npcap installer does not run as SYSTEM by default.
34+
35+
* Added a check for malformed OID request objects. This should prevent the BSoD
36+
crashes that have been reported when setting up a PPPoE connection ([#296](http://issues.npcap.org/296)).
37+
38+
* Fixed an issue with SendToRx mode that resulted in packet injection calls
39+
hanging. Fixes [#785](http://issues.npcap.org/785).
40+
41+
* SendToRx mode, which causes injected packets to be indicated as receives
42+
instead of sends, can now be enabled per capture handle using the
43+
`pcap_setmode(handle, PACKET_MODE_SENDTORX)`. Since this feature was
44+
previously enabled globally via the Registry, user code can now opt out of it
45+
with `pcap_setmode(handle, PACKET_MODE_SENDTORX_CLEAR)`.
46+
47+
* The Npcap driver now can deliver packet timestamps using nanosecond
48+
precision. This feature will be made available via the portable libpcap API
49+
in the next Npcap SDK.
50+
151
## Npcap 1.82 [2025-04-21]
252

353
* Fixed an issue where Npcap 1.81 would incorrectly reject packets as too large

‎Common/Packet32.h‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,8 @@ typedef struct _AirpcapHandle* PAirpcapHandle;
141141
#define PACKET_DEPRECATED_INTERNAL_STRUCT_DEFINITION
142142
#endif
143143

144-
// Working modes, a bitfield
144+
// Working modes, a 32-bit integer
145+
// 0x000000ff: WinPcap legacy modes (least-significant byte)
145146
// 0b00000000
146147
// | ||_ STAT or CAPT
147148
// | |__ MON (TME extensions, not supported)
@@ -153,6 +154,14 @@ typedef struct _AirpcapHandle* PAirpcapHandle;
153154
#define PACKET_MODE_MON 0x2 ///< Monitoring mode
154155
#define PACKET_MODE_DUMP 0x10 ///< Dump mode
155156
#define PACKET_MODE_STAT_DUMP PACKET_MODE_DUMP | PACKET_MODE_STAT ///< Statistical dump Mode
157+
// 0x0000ff00: Npcap extensions
158+
// 0b00000000
159+
// |||_ SENDTORX
160+
// ||__ SENDTORX_CLEAR
161+
// |___ NANO
162+
#define PACKET_MODE_SENDTORX (1 << 8) /// SendToRx mode
163+
#define PACKET_MODE_SENDTORX_CLEAR (1 << 9) /// Disable SendToRx, overriding Registry
164+
#define PACKET_MODE_NANO (1 << 10) /// Nanosecond precision timestamps
156165

157166

158167
/// Alignment macro. Defines the alignment size.
@@ -314,7 +323,7 @@ extern "C"
314323
LPPACKET PacketAllocatePacket(void);
315324
VOID PacketInitPacket(_Out_ LPPACKET lpPacket, _In_reads_bytes_(Length) PVOID Buffer, _In_ UINT Length);
316325
VOID PacketFreePacket(_In_ _Post_invalid_ LPPACKET lpPacket);
317-
_Success_(return) BOOLEAN PacketReceivePacket(_In_ LPADAPTER AdapterObject, _Out_ LPPACKET lpPacket, _In_ BOOLEAN Sync);
326+
_Success_(return) BOOLEAN PacketReceivePacket(_In_ LPADAPTER AdapterObject, _Inout_updates_bytes_(lpPacket->Length) LPPACKET lpPacket, _In_ BOOLEAN Sync);
318327
_Success_(return) BOOLEAN PacketSetHwFilter(_In_ LPADAPTER AdapterObject, _In_ ULONG Filter);
319328
_Success_(return) BOOLEAN PacketGetAdapterNames(_Out_writes_opt_(_Old_(*BufferSize)) PCHAR pStr, _Inout_ PULONG BufferSize);
320329
_Success_(return) BOOLEAN PacketGetNetInfoEx(_In_ PCCH AdapterName, _Out_writes_to_(_Old_(*NEntries),*NEntries) npf_if_addr* buffer, _Inout_ PLONG NEntries);

‎Common/npcap-defs.h‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,5 +148,24 @@ C_ASSERT(sizeof(PACKET_OID_DATA) == 12);
148148
#define NPF_CONFIG_TESTMODE 0x40 /* TestMode */
149149
// BPF Extensions supported. Output is ULONG, max extension supported.
150150
#define NPF_GETINFO_BPFEXT 0x00000003
151+
// Supported mode bits for BIOCSMODE (PacketSetMode, pcap_setmode). Output is ULONG.
152+
#define NPF_GETINFO_MODES 0x00000004
153+
// Performance statistics for the filter module
154+
#define NPF_GETINFO_STATS 0x00000005
155+
// All of these are 2 USHORTs: average for last 10 and last 10K calls
156+
#define NPF_STATSINFO_RECVTIMES 0x00000001 /* ticks per recieve indication */
157+
#define NPF_STATSINFO_SENDTIMES 0x00000002 /* ticks per send indication */
158+
#define NPF_STATSINFO_DPCTIMES 0x00000003 /* ticks at DPC level, both dirs */
159+
// Internal debugging info unique to a filter module
160+
#define NPF_GETINFO_MODDBG 0x00000006
161+
// Subrequests of NPF_GETINFO_MODDBG
162+
#define NPF_MODDBG_PF_SUPPORTED 0x00000001
163+
#define NPF_MODDBG_PF_MY 0x00000002
164+
#define NPF_MODDBG_PF_HIGHER 0x00000003
165+
#define NPF_MODDBG_LA_MY 0x00000004
166+
#define NPF_MODDBG_LA_HIGHER 0x00000005
167+
#define NPF_MODDBG_BITS 0x00000006
168+
#define NPF_MODDBG_MAXFRAME 0x00000007
169+
#define NPF_MODDBG_NUMOPENS 0x00000008
151170

152171
#endif /* NPCAP_DEFS_H */

‎docs/npcap-api.xml‎

Lines changed: 206 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,17 @@
1818
<para>The Npcap API is exported by <filename>wpcap.dll</filename> and is the
1919
Windows port of <ulink url="https://www.tcpdump.org/">libpcap</ulink>.
2020
The API and functions are described in
21-
<ulink url="wpcap/pcap.html">the pcap(1) man page</ulink>.
21+
<ulink url="wpcap/pcap.html">the pcap(1) man page</ulink>.
22+
This port varies from the standard Unix libpcap API in just a few ways.
23+
First, the <literal>pcap_get_selectable_fd()</literal> and
24+
<literal>pcap_get_required_select_timeout()</literal>
25+
functions are not defined or exported. Second, as described in
26+
<xref linkend="npcap-api-extensions"/>, Npcap extends the libpcap API with
27+
a set of non-portable functions. Lastly, Npcap includes functions from the
28+
remote capture API of libpcap, which is described in
29+
<xref linkend="npcap-api-remote"/>.
2230
</para>
31+
2332
<sect2 id="npcap-api-extensions">
2433
<title>Extensions to libpcap for Windows</title>
2534
<para>
@@ -278,4 +287,200 @@
278287

279288
</variablelist>
280289
</sect2>
290+
291+
<sect2 id="npcap-api-remote">
292+
<title>The libpcap remote capture API</title>
293+
<para>
294+
WinPcap introduced several additional functions to the libpcap API in
295+
order to support remote capture. While the upstream libpcap project has
296+
absorbed these functions, they have not yet published documentation on
297+
them. Here is a brief overview.
298+
</para>
299+
<variablelist>
300+
<varlistentry>
301+
<term>
302+
<code>pcap_open</code>
303+
</term>
304+
<listitem>
305+
<para>
306+
Opens a remote or local capture handle.
307+
</para>
308+
<code>pcap_t* pcap_open(const char * source, int snaplen, int flags, int read_timeout, struct pcap_rmtauth *auth, char *errbuf);</code>
309+
<para>
310+
This routine can open a savefile, a local device, or a device on
311+
a remote machine running an RPCAP server.
312+
</para>
313+
<variablelist>
314+
<varlistentry>
315+
<term><code>source</code></term>
316+
<listitem>
317+
<para>
318+
Zero-terminated string containing the source name to open.
319+
The source name must be in one of the following formats:
320+
</para>
321+
<itemizedlist>
322+
<listitem><para><literal>file://path/to/file.pcap</literal></para></listitem>
323+
<listitem><para>
324+
<literal>rpcap://devicename</literal> (or the equivalent,
325+
<literal>devicename</literal>)
326+
</para></listitem>
327+
<listitem><para><literal>rpcap://host/devicename</literal></para></listitem>
328+
<listitem><para><literal>rpcap://host:port/devicename</literal></para></listitem>
329+
</itemizedlist>
330+
<para>
331+
Adapter names returned by <literal>pcap_findalldevs_ex()</literal>
332+
are already in this format. For convenience, compatible source
333+
strings can be built with the helper function,
334+
<literal>int pcap_createsrcstr(char *source, int type, const char *host, const char *port, const char *name, char *errbuf)</literal>,
335+
where <literal>type</literal> is one of
336+
<literal>PCAP_SRC_FILE</literal>,
337+
<literal>PCAP_SRC_IFLOCAL</literal>, or
338+
<literal>PCAP_SRC_IFREMOTE</literal>,
339+
and <literal>source</literal> is a user-allocated buffer of
340+
at least <literal>PCAP_BUF_SIZE</literal> bytes.
341+
</para>
342+
</listitem>
343+
</varlistentry>
344+
<varlistentry>
345+
<term><code>snaplen</code></term>
346+
<listitem>
347+
<para>
348+
See the documentation for
349+
<ulink url="wpcap/pcap_open_live.html">pcap_open_live()</ulink>.
350+
</para>
351+
</listitem>
352+
</varlistentry>
353+
<varlistentry>
354+
<term><code>flags</code></term>
355+
<listitem>
356+
<para>
357+
Keeps several flags that can be needed for capturing packets.
358+
The allowed flags are defined in the pcap_open() flags .
359+
</para>
360+
</listitem>
361+
</varlistentry>
362+
<varlistentry>
363+
<term><code>read_timeout></code></term>
364+
<listitem>
365+
<para>
366+
See the documentation for
367+
<ulink url="wpcap/pcap_open_live.html">pcap_open_live()</ulink>.
368+
</para>
369+
</listitem>
370+
</varlistentry>
371+
<varlistentry>
372+
<term><code>auth</code></term>
373+
<listitem>
374+
<para>
375+
A pointer to a 'struct pcap_rmtauth' that keeps the
376+
information required to authenticate the user on a remote
377+
machine. In case this is not a remote capture, this pointer
378+
can be set to NULL.
379+
</para>
380+
</listitem>
381+
</varlistentry>
382+
<varlistentry>
383+
<term><code>errbuf</code></term>
384+
<listitem>
385+
<para>
386+
<para>
387+
See the documentation for
388+
<ulink url="wpcap/pcap_open_live.html">pcap_open_live()</ulink>.
389+
</para>
390+
</listitem>
391+
</varlistentry>
392+
</variablelist>
393+
394+
<para>
395+
<emphasis>Portability notes:</emphasis> For opening a savefile, the
396+
<ulink url="wpcap/pcap_open_offline.html">pcap_open_offline</ulink>
397+
routines can be used, and will work just as well; code using them
398+
will work on more platforms than code using <literal>pcap_open()</literal>
399+
to open savefiles.
400+
</para>
401+
402+
<para>
403+
For opening a local device,
404+
<ulink url="wpcap/pcap_open_live.html">pcap_open_live()</ulink>
405+
can be used; it supports most of the capabilities than
406+
<literal>pcap_open()</literal> supports, and code using it will work
407+
on more platforms than code using <literal>pcap_open()</literal>.
408+
<ulink url="wpcap/pcap_create.html">pcap_create()</ulink> and
409+
<ulink url="wpcap/pcap_activate.html">pcap_activate()</literal>
410+
can also be used; they support all capabilities that
411+
<literal>pcap_open()</literal> supports, except for the Windows-only
412+
<literal>PCAP_OPENFLAG_NOCAPTURE_LOCAL</literal>,
413+
and they support additional capabilities.
414+
</para>
415+
416+
<para>
417+
For opening a remote capture, <literal>pcap_open()</literal> is
418+
currently the only API available.
419+
</para>
420+
</listitem>
421+
</varlistentry>
422+
<varlistentry>
423+
<term>
424+
<code>pcap_findalldevs_ex</code>
425+
</term>
426+
<listitem>
427+
<para>
428+
Lists local and remote capture sources.
429+
</para>
430+
<code>int pcap_findalldevs_ex(char *source, struct pcap_rmtauth *auth, pcap_if_t **alldevs, char *errbuf);</code>
431+
<variablelist>
432+
<varlistentry>
433+
<term><code>source</code></term>
434+
<listitem>
435+
<para>
436+
Zero-terminated string containing the source name to list.
437+
The source name must be in one of the following formats:
438+
</para>
439+
<itemizedlist>
440+
<listitem><para>
441+
<literal>file://path/to/directory</literal>
442+
- lists capture files in a directory
443+
</para></listitem>
444+
<listitem><para>
445+
<literal>rpcap://</literal> - lists local adapters
446+
</para></listitem>
447+
<listitem><para>
448+
<literal>rpcap://host[:port]</literal>
449+
- lists remote adapters
450+
</para></listitem>
451+
</itemizedlist>
452+
</listitem>
453+
</varlistentry>
454+
<varlistentry>
455+
<term><code>auth</code></term>
456+
<listitem>
457+
<para>See <literal>pcap_open()</literal>.</para>
458+
</listitem>
459+
</varlistentry>
460+
<varlistentry>
461+
<term><code>alldevs</code></term>
462+
<listitem>
463+
<para>
464+
See <ulink href="wpcap/pcap_findalldevs.html">pcap_findalldevs()</ulink>.
465+
</para>
466+
</listitem>
467+
</varlistentry>
468+
<varlistentry>
469+
<term><code>errbuf</code></term>
470+
<listitem>
471+
<para>
472+
See <ulink href="wpcap/pcap_findalldevs.html">pcap_findalldevs()</ulink>.
473+
</para>
474+
</listitem>
475+
</varlistentry>
476+
</variablelist>
477+
<para>
478+
As with <literal> pcap_findalldevs()</literal>, the buffer returned in
479+
<literal>alldevs</literal> must be freed using
480+
<ulink href="wpcap/pcap_freealldevs.html">pcap_freealldevs()</ulink>.
481+
</para>
482+
</listitem>
483+
</varlistentry>
484+
</variablelist>
485+
</sect2>
281486
</sect1>

0 commit comments

Comments
 (0)