Npcap: support live capture "vlan" filter

Uses PacketGetInfo and NPF_GETINFO_BPFEXT to detect support of the
relevant BPF extension. Npcap SDK 1.15 will contain definitions for
SKF_AD_VLAN_TAG and other relevant constants.

Author: bonsaiviking

CMakeLists.txt

@@ -609,6 +609,7 @@ include_directories(
 include(CheckFunctionExists)
 include(CMakePushCheckState)
 include(CheckSymbolExists)
+include(CheckIncludeFile)
 
 if(WIN32)
 
@@ -626,8 +627,11 @@ if(WIN32)
         #
         cmake_push_check_state()
         set(CMAKE_REQUIRED_LIBRARIES ${Packet_LIBRARIES})
+        set(CMAKE_REQUIRED_INCLUDES ${Packet_INCLUDE_DIRS})
         check_function_exists(PacketIsLoopbackAdapter HAVE_PACKET_IS_LOOPBACK_ADAPTER)
         check_function_exists(PacketGetTimestampModes HAVE_PACKET_GET_TIMESTAMP_MODES)
+        check_function_exists(PacketGetInfo HAVE_PACKET_GET_INFO)
+        check_include_file(npcap-bpf.h HAVE_NPCAP_BPF_H)
         cmake_pop_check_state()
     endif(Packet_FOUND)
 
@@ -694,7 +698,6 @@ endif()
 #   Detect available platform features
 ###################################################################
 
-include(CheckIncludeFile)
 include(CheckIncludeFiles)
 include(CheckStructHasMember)
 include(CheckTypeSize)

cmakeconfig.h.in

@@ -90,7 +90,10 @@
 /* Define to 1 if Packet32 API (Npcap driver) is available */
 #cmakedefine HAVE_PACKET32 1
 
-/* Define to 1 if Npcap's version.h is available */
+/* Define to 1 if Npcap BPF extension definitions are available */
+#cmakedefine HAVE_NPCAP_BPF_H 1
+
+/* Define to 1 if NPcap's version.h is available */
 #cmakedefine HAVE_VERSION_H 1
 
 /* Define to 1 if you have a POSIX-style `strerror_r' function. */
@@ -200,6 +203,9 @@
 /* Define to 1 if you have the `PacketIsLoopbackAdapter' function. */
 #cmakedefine HAVE_PACKET_IS_LOOPBACK_ADAPTER 1
 
+/* Define to 1 if you have the `PacketGetInfo' function. */
+#cmakedefine HAVE_PACKET_GET_INFO 1
+
 /* IPv6 */
 #cmakedefine INET6 1
 

gencode.c

@@ -60,6 +60,10 @@
 #endif
 
 #ifdef _WIN32
+  #ifdef HAVE_NPCAP_BPF_H
+    /* Defines BPF extensions for Npcap */
+    #include <npcap-bpf.h>
+  #endif
   #ifdef INET6
     #if defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF)
 /* IPv6 address */

pcap-npf.c

@@ -830,6 +830,10 @@ pcap_activate_npf(pcap_t *p)
 	int status = 0;
 	struct bpf_insn total_insn;
 	struct bpf_program total_prog;
+#ifdef HAVE_PACKET_GET_INFO
+	char oid_data_buf[PACKET_OID_DATA_LENGTH(sizeof(ULONG))] = {0};
+	PACKET_OID_DATA *oid_data_arg = (PACKET_OID_DATA *)oid_data_buf;
+#endif
 
 	if (p->opt.rfmon) {
 		/*
@@ -1086,6 +1090,23 @@ pcap_activate_npf(pcap_t *p)
 	}
 #endif /* HAVE_PACKET_GET_TIMESTAMP_MODES */
 
+#if defined(HAVE_PACKET_GET_INFO) && defined(NPF_GETINFO_BPFEXT) && defined(SKF_AD_VLAN_TAG_PRESENT)
+
+	/* Can we generate special code for VLAN checks? */
+	oid_data_arg->Oid = NPF_GETINFO_BPFEXT;
+	oid_data_arg->Length = sizeof(ULONG);
+	if (PacketGetInfo(pw->adapter, oid_data_arg)) {
+		if (*((ULONG *)oid_data_arg->Data) >= SKF_AD_VLAN_TAG_PRESENT) {
+			/* Yes, we can.  Request that we do so. */
+			p->bpf_codegen_flags |= BPF_SPECIAL_VLAN_HANDLING;
+		}
+	}
+	else {
+		pcapint_fmt_errmsg_for_win32_err(p->errbuf, PCAP_ERRBUF_SIZE,
+		    GetLastError(), "Error calling PacketGetInfo");
+	}
+#endif /* HAVE_PACKET_GET_INFO */
+
 	/*
 	 * Turn a negative snapshot value (invalid), a snapshot value of
 	 * 0 (unspecified), or a value bigger than the normal maximum