packetbeat/beater: don't attempt to install npcap when already instal…

…led (#30509)

* don't attempt to install npcap when already installed
* unload DLL during install operation

CHANGELOG.next.asciidoc

@@ -140,7 +140,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30438[30438]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30438[30438] {pull}30493[30493]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*

packetbeat/beater/install_npcap.go

@@ -51,6 +51,9 @@ func installNpcap(b *beat.Beat) error {
 			log.Infof("npcap version: %s", npcapVersion)
 		}
 	}()
+	if !npcap.Upgradeable() {
+		return nil
+	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), installTimeout)
 	defer cancel()

packetbeat/npcap/npcap.go

@@ -68,6 +68,18 @@ func Install(ctx context.Context, log *logp.Logger, path, dst string, compat boo
 }
 
 func install(ctx context.Context, log *logp.Logger, path, dst string, compat bool) error {
+	if pcap.Version() != "" {
+		// If we are here there is a runtime Npcap DLL loaded. We need to
+		// unload this to prevent the application being killed during the
+		// install.
+		//
+		// See https://npcap.com/guide/npcap-users-guide.html#npcap-installation-uninstall-options.
+		err := unloadWinPCAP()
+		if err != nil {
+			return fmt.Errorf("npcap: failed to unload Npcap DLL: %w", err)
+		}
+	}
+
 	args := []string{"/S", "/winpcap_mode=no"}
 	if compat {
 		args[1] = "/winpcap_mode=yes"
@@ -96,7 +108,7 @@ func install(ctx context.Context, log *logp.Logger, path, dst string, compat boo
 		return fmt.Errorf("npcap: failed to install Npcap: %w", err)
 	}
 
-	return reloadWinPCAP()
+	return loadWinPCAP()
 }
 
 func Upgradeable() bool {

packetbeat/npcap/npcap_other.go

@@ -22,4 +22,4 @@ package npcap
 
 func loadWinPCAP() error { return nil }
 
-func reloadWinPCAP() error { return nil }
+func unloadWinPCAP() error { return nil }

packetbeat/npcap/npcap_windows.go

@@ -24,10 +24,4 @@ import "github.com/google/gopacket/pcap"
 
 func loadWinPCAP() error { return pcap.LoadWinPCAP() }
 
-func reloadWinPCAP() error {
-	err := pcap.UnloadWinPCAP()
-	if err != nil {
-		return err
-	}
-	return pcap.LoadWinPCAP()
-}
+func unloadWinPCAP() error { return pcap.UnloadWinPCAP() }