NPcap OEM 1.81-85 fails on `pcap_open` W2k8r2 when installed with `/prior_driver=yes`

[vitezslav-popovsky-solarwinds]

Describe the bug
Using the silent installation on Windows 2008 R2:

npcap-1.85-oem.exe /S /loopback_support=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /prior_driver=yes

results in an error The data area passed to a system call is too small. (122) in the following pcap_open code:

char errbuf[PCAP_ERRBUF_SIZE];
pcap_t* pcap = pcap_open(
    "rpcap://\Device\NPF_{E3ADBA6B-C6E7-461F-8344-0652A6973CCB}", // name of the device
    65536, // portion of the packet to capture
    0, // PCAP_OPENFLAG
    256, // read timeout
    nullptr, // authentication on the remote machine
    errbuf // error buffer
    );

To Reproduce
Steps to reproduce the behavior:

1. silent installation on Windows 2008 R2: npcap-1.85-oem.exe /S /loopback_support=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /prior_driver=yes
2. Installed driver:

C:\>wmic datafile where name='c:\\windows\\system32\\drivers\\npcap.sys' get version
Version
5.1.30.408

3. pcap_open fails on The data area passed to a system call is too small. (122)

Expected behavior
Silent installer and pcap_open works on Windows 2008 R2

Diagnostic information

• Windows version from winver
  Microsoft Windows Server 2008 R2 Enterprise Version 6.1 (Build 7601: Service Pack 1)
• Output of DiagReport
  DiagReport-20251129-181833.txt
• Installation logs
  install.log
  NPFInstall.log

[dmiller-nmap]

Looks like this is due to a3079a0 changing the size calculation for OID request buffers. I think we should be able to modify this based on the runtime-calculated version of the driver.

[guyharris]

Looks like this is due to a3079a0 changing the size calculation for OID request buffers. I think we should be able to modify this based on the runtime-calculated version of the driver.

So this is the result of a Packet32/driver mismatch, and would presumably also happen with

char errbuf[PCAP_ERRBUF_SIZE];
pcap_t* pcap = pcap_open(
    "\Device\NPF_{E3ADBA6B-C6E7-461F-8344-0652A6973CCB}", // name of the device
    65536, // portion of the packet to capture
    0, // PCAP_OPENFLAG
    256, // read timeout
    nullptr, // authentication on the remote machine
    errbuf // error buffer
    );

as the libpcap part of Npcap won't see another / after rpcap://, so it'll just say "this is just a capture device" and open using the string following the rpcap://.

[dmiller-nmap]

Here is the earlier change where we started using the more-correct size calculation within the driver: 549ffb2 . I anticipated this issue in that commit message, though I clearly forgot it when making the change I mentioned before:

Use FIELD_OFFSET, not sizeof, to size OID buffers

sizeof() includes alignment padding which may not be present. We could
do the same to Packet.dll, but then it wouldn't work with older drivers
that require the larger buffer size, and we use the older driver for
/prior_driver currently.

[dmiller-nmap]

Please note that Windows Server 2008 R2 reached the end of extended support in January 2020, and Extended Security Update (ESU) support ended in January 2024. The /prior_driver option only affects versions of Windows prior to Windows 10, the latest of which is Server 2012 R2, which reached end-of-life in October 2023 and has less than 1 year of ESU remaining.