Re[2]: Re: STATUS_REPARSE and FILE_OPEN_REPARSE_POINT

And you can see in FileSpy that you are completing the requests with
this bit set and they are not getting reparsed? It seems like you are
still trying to reparse the request and propagating the
open_reparse_point bit over to the new open.

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@speedy.com.ar
To: “Windows File Systems Devs Interest List”
Sent: 2/16/2017 7:57:14 AM
Subject: RE:[ntfsd] Re: STATUS_REPARSE and FILE_OPEN_REPARSE_POINT

>Thanks Pete,
>However I did this:
>Data->IoStatus.Status = STATUS_REPARSE;
>if (CreateOptions&FILE_OPEN_REPARSE_POINT) {
> Data->IoStatus.Status = STATUS_NOT_A_REPARSE_POINT;
>}
>
>
>But I am still getting the error in Notepad and in Process Monitor the
>Result is “NOT REPARSE POINT” instead of “PATH NOT FOUND”
>
>
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

In ProcessMonitor (same than FileSpy) in the IRP_MJ_CREATE I get:
Desired Access: Read Attributes, Delete
Disposition: Open
Options: Non-Directory File, Open Reparse Point
Attributes: n/a
SharedMode: Read, Write, Delete
AllocationSize: n/a

If I use the “old” way:
Data->IoStatus.Status = STATUS_REPARSE;
Then the “Result” is “PATH NOT FOUND”.

If I use your suggestion:
Data->IoStatus.Status = STATUS_NOT_A_REPARSE_POINT;
Then the “Result” is “NOT REPARSE POINT”

My question is, if you open a file and you specify the FILE_OPEN_REPARSE_POINT creation flag, what is supposed to happen:
a+ The reparse is not done so in case you want to redirect the open of c:\file to c:\alternate, c:\file will be opened
b+ The reparse is well done “but internally” so in process monitor you will still see in the Path column the c:\file but internally talking c:\alternate is opened instead

It is also strange that it well works in other computers of after rebooting.

Is there any way to prevent propagating this FILE_OPEN_REPARSE_POINT flag?

Thanks

One thing that is strange:
just to test I implemented the post-operation for IRP_MJ_CREATE.
So I well see that I get the STATUS_OBJECT_PATH_NOT_FOUND error in this operation. But what is strange is that Data->Iopb->TargetFileObject->FileName points to the “redirected” path.

I mean, the goal of this logic is that when I try to open c:\file.txt it gets redirected to c:\myOtherFolder\other.txt (for example).
When I am called in the IRP_MJ_CREATE post event, Data->Iopb->TargetFileObject->FileName points to c:\myOtherFolder\other.txt and not to c:\myOtherFolder\other.txt.
Does it mean that the reparse was actually done?
The c:\myOtherFolder\other.txt file really exists, so that’s why I don’t understand why STATUS_OBJECT_PATH_NOT_FOUND is returned.

Thanks