Move npf_sys_is_running() from wsutil to caputils.

It has nothing to do with controlling privileges; it only tests whether
the NPF or Npcap service (driver) is running, so it belongs in caputils.

While we're at it, fix its signature (in C, a function with no arguments
must have "void" as the argument list, for backwards compatibility with
pre-function-prototype C), and close the handles it opens, so we don't
have open handles leaked.

Change-Id: Ia99e99d81617ed2e8cda2c44e53061b4502a2b58
Reviewed-on: https://code.wireshark.org/review/15714
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>

2 files changed, 45 insertions, 1 deletions

diff --git a/caputils/capture-wpcap.c b/caputils/capture-wpcap.c
index 5094375e75..deff5f9da5 100644
--- a/caputils/capture-wpcap.c
+++ b/caputils/capture-wpcap.c
@@ -24,6 +24,10 @@
 
 #include "config.h"
 
+#include <windows.h>
+#include <wchar.h>
+#include <tchar.h>
+
 #include <stdio.h>
 #include <glib.h>
 #include <gmodule.h>
@@ -1082,6 +1086,40 @@ get_runtime_caplibs_version(GString *str)
 		g_string_append(str, "without WinPcap");
 }
 
+/*
+ * If npf.sys is running, return TRUE.
+ */
+gboolean
+npf_sys_is_running(void)
+{
+	SC_HANDLE h_scm, h_serv;
+	SERVICE_STATUS ss;
+
+	h_scm = OpenSCManager(NULL, NULL, 0);
+	if (!h_scm)
+		return FALSE;
+
+	h_serv = OpenService(h_scm, _T("npf"), SC_MANAGER_CONNECT|SERVICE_QUERY_STATUS);
+	if (!h_serv) {
+		h_serv = OpenService(h_scm, _T("npcap"), SC_MANAGER_CONNECT|SERVICE_QUERY_STATUS);
+		if (!h_serv) {
+			CloseServiceHandle(h_scm);
+			return FALSE;
+		}
+	}
+
+	if (QueryServiceStatus(h_serv, &ss)) {
+		if (ss.dwCurrentState & SERVICE_RUNNING) {
+			CloseServiceHandle(h_serv);
+			CloseServiceHandle(h_scm);
+			return TRUE;
+		}
+	}
+	CloseServiceHandle(h_serv);
+	CloseServiceHandle(h_scm);
+	return FALSE;
+}
+
 #else /* HAVE_LIBPCAP */
 
 void
diff --git a/caputils/capture-wpcap.h b/caputils/capture-wpcap.h
index 5e6b10c3ca..25378f3f3a 100644
--- a/caputils/capture-wpcap.h
+++ b/caputils/capture-wpcap.h
@@ -28,13 +28,19 @@ extern "C" {
 
 extern gboolean has_wpcap;
 
-
 extern void load_wpcap(void);
 
 /* error message, if WinPcap couldn't be loaded */
 /* will use g_strdup, don't forget to g_free the returned string! */
 extern char *cant_load_winpcap_err(const char *app_name);
 
+/**
+ * Check to see if npf.sys is running.
+ * @return TRUE if npf.sys is running, FALSE if it's not or if there was
+ * an error checking its status.
+ */
+gboolean npf_sys_is_running(void);
+
 #ifdef __cplusplus
 }
 #endif /* __cplusplus */