[Winpcap-announce] WinPcap 4.1 has been released

[Gianluca Varenni]

As of today, WinPcap 4.1 is available in the download section of the
WinPcap website.

This release contains a large series of improvements that were gradually
added to WinPcap during the various beta's.

First of all, this version includes full support for x64 platforms, both
in the driver and in the user level libraries.
Also, the long awaited support for Windows 7 (and Windows Server 2008 R2)
has been added to the long list of supported flavors of Windows.
The installer has been greatly improved and partially rewritten to better
handle error conditions and non-standard Windows configurations.
Finally, it included the latest version of libpcap (from
http://www.tcpdump.org/) in the 1.0 branch.
Full details of the changes can be found in the change log below.

As always, we profoundly thank all the users that tested the development
versions of WinPcap 4.1. Thanks!

Gianluca Varenni
WinPcap Team



Changelog from WinPcap 4.1 beta5
================================

- Several fixes and updates to the installer:
  + Added installation support for Windows 7 and Server 2008 R2
  + Added a new wizard page to choose if the driver should be started
    automatically on boot.
  + Fixed some issues when upgrading WinPcap on Windows Vista and Server
    2008 x64.
  + Better handle errors when Microsoft NetMon 2.x is not available.
  + Better detection of the target operating system, especially when the
    installer is run in compatibility mode.

- wpcap.dll has been updated to the 1.0 branch of libpcap from
  http://www.tcpdump.org.

- Updated the tools used for the compilation (WDK 6001.18002).

- Bug fixing:
  + Exported pcap_setdirection()
  + Fixed a bug in the compilation of rpcapd. This bug was causing the
    daemon not to capture any packets.


Changelog between WinPcap 4.1 beta4 and  WinPcap 4.1 beta5
==========================================================

- Starting from this build, WinPcap is completely compiled with Visual
  Studio 2005 SP1 (in order to have a single build environment for x86
  and x64) and WDK6000. While the projects for Visual Studio 6 are still
  available in the source package, they are no longer maintained.

- wpcap.dll has been updated to libpcap 1.0.0 from http://www.tcpdump.org.

- The new VS2005 project files for wpcap.dll and packet.dll have been
  simplified a lot (i.e. less configurations!).

- Big parts of the installer have been rewritten and cleaned up to account
  for the x64 binaries installation.

- The old WanPacket DLL has been removed. The code has been merged into
  packet.dll.

- The developer's pack includes LIB files for both x86 and x64 (for Visual
  Studio). At the moment we don't have the LIB files for Cygwin under x64.

- The samples have been ported to Visual Studio 2005, and they compile for
  both x86 and x64 architectures. The old Visual Studio 6 projects are
  still available but not actively maintained.

- Bug fixing:
  + Fixed the remote code to make it compile properly on Linux.
  + Fixed a problem with the icon in the windows control panel.
  + Fixed an installation bug under x64 for rpcapd.exe. When installing
    rpcapd on an x64 machine, the executable is located in c:\program files
    (x86), not in c:\program files.
  + Support an indefinite number of IP (v4 and v6) addresses associated with
    an adapter.
  + Check that IPv4 is bound to an adapter before getting the IPv4 addresses
    from the registry.
  + Fixed several compilation warnings in the samples.
  + Exported pcap_hopen_offline.
  + Added a missing definition of HAVE_UINT64 in the bittypes.h.
  + Fixed a bug in the filtering code for TurboCap adapters. The snaplen was
    completely ignored.


Changelog between WinPcap 4.1 beta3 and  WinPcap 4.1 beta4
==========================================================

- Added support for the CACE TurboCap boards within wpcap.dll.

- (from libpcap) Added the new functions pcap_create(),
  pcap_activate(), pcap_set_XXX() (still not completely documented on
  Windows).

- (from libpcap) Added support for various MAC addresses' syntaxes.
  Now the following syntaxes are supported:
  + 00:11:22:33:44:55
  + 00-11-22-33-44-55
  + 00.11.22.33.44.55
  + 001122334455.

- Bug fixing:
  + Use FILE_DEVICE_SECURE_OPEN as a parameter to IoCreateDevice()
    when creating the I/O device from within the driver on the OSes
    that support it.
  + Fixed a bug in pcap_open_live() and pcap_activate(). They were
    failing if called on a local adapter with the syntax
    rpcap://\\Device....
  + Added a missing input buffer check in the read handler of the
    driver when working in statistics mode.
  + Optimized the code in the driver that handles the BIOCGSTATS
    control code (map only the needed portion of the user buffer into
    an MDL).
  + Fixed a possible memory leak in one of the error paths of the
    driver when enumerating the available adapters.
  + Cleaned up some global variable names in the driver.


Changelog between WinPcap 4.1 beta2 and  WinPcap 4.1 beta3
==========================================================

- (from libpcap) Make some arguments of some pcap functions const
  pointers if that makes sense.

- (from libpcap) Add some additional checks to bpf_validate(), from
  OpenBSD.

- (from libpcap) Use bpf_validate() in install_bpf_program(), so we
  validate programs even when they're being processed by userland
  filters.

- (from libpcap) Get rid of BPF_MAXINSNS - we don't have a limit on
  program size in libpcap/WinPcap.

- (from libpcap) Support for the "addr1", "addr2", "addr3", and
  "addr4" link-layer address filtering keywords for 802.11.

- (from libpcap) Support for filtering over 802.11 frame types with
  the keywords "type" and "subtype".

- Bug fixing:
  + Fixed a bug when generating wireless filters in the form "link src
    host ...". The source address was not retrieved properly.
  + Added some more logic in the installer to account for errors while
    installing the Network Monitor component (NetMon). If NetMon is
    not available, we install a version of packet.dll that doesn't
    depend on it.
  + Fixed two bugs in the original OpenBSD filter validation code, one
    that caused it to reject all filters that used multiply
    instructions, and another that caused it to reject all filters
    that used divide instructions.
  + Fixed a bug in the filter engine in the driver. When the packet to
    filter is split into two buffers, under some circumstances the
    engine was not checking the right bytes in the packet.


Changelog between WinPcap 4.1 beta and  WinPcap 4.1 beta2
=========================================================

- Disabled support for monitor mode (also called TME, Table Management
  Extensions) in the driver. This module suffers from several security
  vulnerabilities that could result in BSODs or privilege escalation
  attacks. This fix addresses a security vulnerability reported by the
  iDefense Labs at
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=625

- Added a small script to integrate the libpcap sources into the
  WinPcap tree automatically.

- Moved the definition of all the I/O control codes to ioctls.h.

- Cleaned up and removed some build scripts for the developer's pack.

- Migrated the driver compilation environment to WDK 6000.

- Enabled PreFAST driver compilation for the x64 build.

- Added some doxygen directives to group the IOCTL codes and JIT
  definitions in proper groups.

- Integrated the IOCTL codes into one single set shared by packet.dll
  and driver.

- Modified the installer to return the win32 error code instead of -1
  in case of failure in the error messages.

- Added some #define directives to selectively disable the TME
  functionality for WAN (i.e. Netmon-assisted) devices.

- Added a VS2005 project to easily edit the files of the driver.

- Removed some useless #include directives in the driver and
  packet.dll.

- Migrated several conditional directives (#ifdef/#endif) to the
  defines of the DDK/WDK e.g. _X86_ and _AMD64_.

- Added a check to warn users that remote-ext.h should not be included
  directly.

- Removed ntddndis.h from the WinPcap sources. It's included into the
  Microsoft Platform SDK.

- Removed devioctl.h from the WinPcap sources. It's included into the
  Microsoft DDK/WDK.

- Removed ntddpack.h from the WinPcap sources. It's an old header file
  from the original DDK Packet sample, and it's not used by WinPcap.

- Removed several useless files from the WinPcap developer's pack:
  + all the TME extension header files
  + devioctl.h
  + gnuc.h
  + ntddndis.h
  + ntddpack.h
  + pcap-int.h.

- Bug fixing:
  + Fixed a possible buffer overrun on x64 machines with more that 32
    CPUs/cores.
  + Fixed an implicit cast problem compiling the driver on x64.
  + Fixed a bug in the installer causing a mis-detection of a previous
    WinPcap installation.
  + Fixed two bugs related to memory deallocation in packet.dll. We
    were using free() instead of GlobalFreePtr(), and there was a
    missing check as to when to deallocate a chunk of memory.
  + Added a missing NULL pointer check in pcap_open().
  + Moved a misplaced #ifdef WIN32 in pcap_open().
  + Fixed a bug in the send routine of the driver that could cause a
    crash under low resources conditions.


Changelog between WinPcap 4.0.1 and  WinPcap 4.1 beta
=====================================================

- Added support for the Per Packet Info (PPI) link type.

- wpcap.dll has been updated to the libpcap 0.9.6 branch from
  http://www.tcpdump.org.

- Bug fixing:
  + Fixed a bug in pcap_open_live() by which we were silently ignoring
    a failure when switching into promiscuous mode. This fix solves
    the outstanding issue of wireless cards that fail to go into
    promiscuous mode and do not capture any packet.
  + Experimental fixes to the BPF compiler (pcap_compile()) to better
    support filters over 802.11.
  + Minor fixes to remove several PFD (PreFAST for Drivers) warnings.
  + (from libpcap 0.9.6) added additional filter operations for 802.11
    frame types
  + (from libpcap 0.9.6) fixes to discard unread packets when changing
    filters.