X-Git-Url: https://git.tcpdump.org/libpcap/blobdiff_plain/a00254b88366b134c2a19648fe6e97d1afeaaa2c..09b51d326c38ea8e10ce4da09c09d50e08c5aeb8:/pcap-npf.c

diff --git a/pcap-npf.c b/pcap-npf.c
index 8d21690e..99b5981e 100644
--- a/pcap-npf.c
+++ b/pcap-npf.c
@@ -901,7 +901,7 @@ pcap_read_win32_dag(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 			}
 		}
 
-		/* No underlaying filtering system. We need to filter on our own */
+		/* No underlying filtering system. We need to filter on our own */
 		if (p->fcode.bf_insns)
 		{
 			if (pcap_filter(p->fcode.bf_insns, dp, packet_len, caplen) == 0)
@@ -985,8 +985,6 @@ pcap_breakloop_npf(pcap_t *p)
 }
 
 /*
- * Vendor-specific error codes.
- *
  * These are NTSTATUS values:
  *
  *    https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/87fba13e-bf06-450e-83b1-9241dc81e781
@@ -995,15 +993,28 @@ pcap_breakloop_npf(pcap_t *p)
  * mapped to Windows error values in userland; they're returned by
  * GetLastError().
  *
- * Attempting to set non-promiscuous mode on a Microsoft Surface Pro's
- * Mobile Broadband Adapter returns an error; that error can safely be
- * ignored, as it's always in non-promiscuous mode.
+ * Note that "driver" here includes the Npcap NPF driver, as various
+ * versions would take NT status values and set the "Customer" bit
+ * before returning the status code.  The commit message for the
+ * change that started doing that is
+ *
+ *    Returned a customer-defined NTSTATUS in OID requests to avoid
+ *    NTSTATUS-to-Win32 Error code translation.
+ *
+ * but I don't know why the goal was to avoid that translation.
+ *
+ * Attempting to set the hardware filter on a Microsoft Surface Pro's
+ * Mobile Broadband Adapter returns an error that appears to be
+ * NDIS_STATUS_NOT_SUPPORTED ORed with the "Customer" bit, so it's
+ * probably indicating that it doesn't support that.
  *
  * It is likely that there are other devices which throw spurious errors,
  * at which point this will need refactoring to efficiently check against
- * a list, but for now we can just check this one value.
+ * a list, but for now we can just check this one value.  Perhaps the
+ * right way to do this is compare against various NDIS errors with
+ * the "customer" bit ORed in.
  */
-#define NPF_SURFACE_MOBILE_NONPROMISC	0xe00000bb
+#define NT_STATUS_CUSTOMER_DEFINED	0x20000000
 
 static int
 pcap_activate_npf(pcap_t *p)
@@ -1293,7 +1304,13 @@ pcap_activate_npf(pcap_t *p)
 
 			/*
 			 * Suppress spurious error generated by non-compiant
-			 * MS Surface mobile adapters.
+			 * MS Surface mobile adapters that appear to
+			 * return NDIS_STATUS_NOT_SUPPORTED for attempts
+			 * to set the hardware filter.
+			 *
+			 * It appears to be reporting NDIS_STATUS_NOT_SUPPORTED,
+			 * but with the NT status value "Customer" bit set;
+			 * the Npcap NPF driver sets that bit in some cases.
 			 *
 			 * If we knew that this meant "promiscuous mode
 			 * isn't supported", we could add a "promiscuous
@@ -1315,8 +1332,17 @@ pcap_activate_npf(pcap_t *p)
 			 * and rejecting it with an error could disrupt
 			 * attempts to capture, as many programs (tcpdump,
 			 * *shark) default to promiscuous mode.
+			 *
+			 * Alternatively, we could return the "promiscuous
+			 * mode not supported" *warning* value, so that
+			 * correct code will either ignore it or report
+			 * it and continue capturing.  (This may require
+			 * a pcap_init() flag to request that return
+			 * value, so that old incorrect programs that
+			 * assume a non-zero return from pcap_activate()
+			 * is an error don't break.)
 			 */
-			if (errcode != NPF_SURFACE_MOBILE_NONPROMISC)
+			if (errcode != (NDIS_STATUS_NOT_SUPPORTED|NT_STATUS_CUSTOMER_DEFINED))
 			{
 				pcap_fmt_errmsg_for_win32_err(p->errbuf,
 				    PCAP_ERRBUF_SIZE, errcode,
@@ -1347,7 +1373,7 @@ pcap_activate_npf(pcap_t *p)
 			 * Suppress spurious error generated by non-compiant
 			 * MS Surface mobile adapters.
 			 */
-			if (errcode != NPF_SURFACE_MOBILE_NONPROMISC)
+			if (errcode != (NDIS_STATUS_NOT_SUPPORTED|NT_STATUS_CUSTOMER_DEFINED))
 			{
 				pcap_fmt_errmsg_for_win32_err(p->errbuf,
 				    PCAP_ERRBUF_SIZE, errcode,
@@ -2059,8 +2085,8 @@ get_if_flags(const char *name, bpf_u_int32 *flags, char *errbuf)
   #ifdef OID_GEN_PHYSICAL_MEDIUM_EX
 		OID_GEN_PHYSICAL_MEDIUM_EX,
   #endif
-  		OID_GEN_PHYSICAL_MEDIUM
-  	};
+		OID_GEN_PHYSICAL_MEDIUM
+	};
 #define N_GEN_PHYSICAL_MEDIUM_OIDS	(sizeof gen_physical_medium_oids / sizeof gen_physical_medium_oids[0])
 	size_t i;
 #endif /* OID_GEN_PHYSICAL_MEDIUM */
@@ -2372,7 +2398,7 @@ pcap_platform_finddevs(pcap_if_list_t *devlistp, char *errbuf)
 		desc++;
 
 	/*
- 	 * Found it - "desc" points to the first of the two
+	 * Found it - "desc" points to the first of the two
 	 * nulls at the end of the list of names, so the
 	 * first byte of the list of descriptions is two bytes
 	 * after it.