Hello everyone
I’m developing a filesystem filter driver which main feature is to encrypt
and decrypt data during a read/write operations. In order to accomplish such
functionality it is necessary to deal only with data that either isn’t
cachable (IRP_NOCACHE flag set) or is triggered by a cache manager
(IRP_PAGING_IO flag). That way, the data stored in cache manager is decrypted
and only during actual device read/write operations the decryption and
encryption occur.
However, I’m experiencing some problems while copying a file to a network
share. Neither of flags mentioned above are set - which in my opinion means
that data should be processed by cache manager, but - it isn’t?! It goes
straight to device. And what’s worse, it goes there decrypted.
Can somebody please tell me why it is happening like that? Am I wrong about
this two flags, or is there some magic going around over there?
I’ve tried to find some differences between write operations on network
share that do cache, and the ones that don’t, without any success.
I’ll be grateful for all the help, because I’m actually stuck in that place
for a while now.
Best regards.
Adrian Korczynski
> In order to accomplish such functionality it is necessary to deal only
with data that either isn’t cachable (IRP_NOCACHE flag set) or is
triggered by a cache manager (IRP_PAGING_IO flag).
You are wrong.
which in my opinion means
that data should be processed by cache manager
This is only your opinion, but not FSD’s opinion.
Can somebody please tell me why it is happening like that? Am I wrong
about
this two flags, or is there some magic going around over there?
Search this forum.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Hello everyone
>
> I’m developing a filesystem filter driver which main feature is to encrypt
> and decrypt data during a read/write operations. In order to accomplish
> such
> functionality it is necessary to deal only with data that either isn’t
> cachable (IRP_NOCACHE flag set) or is triggered by a cache manager
> (IRP_PAGING_IO flag). That way, the data stored in cache manager is
> decrypted
> and only during actual device read/write operations the decryption and
> encryption occur.
>
> However, I’m experiencing some problems while copying a file to a network
> share. Neither of flags mentioned above are set - which in my opinion
> means
> that data should be processed by cache manager, but - it isn’t?! It goes
> straight to device. And what’s worse, it goes there decrypted.
>
> Can somebody please tell me why it is happening like that? Am I wrong
> about
> this two flags, or is there some magic going around over there?
>
> I’ve tried to find some differences between write operations on network
> share that do cache, and the ones that don’t, without any success.
>
> I’ll be grateful for all the help, because I’m actually stuck in that
> place
> for a while now.
> Best regards.
>
> Adrian Korczynski
>
In addition,
the difference between the Windows File System Layer and the most other OS’s
File System Layers is that in Windows the FSD decides if data will be
processed through the Cache Manager, while in other OSs the system( the
kernel ) decides whether to use the cache before calling the FSD to
get/retrieve data from/to the disk.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Hello everyone
>
> I’m developing a filesystem filter driver which main feature is to encrypt
> and decrypt data during a read/write operations. In order to accomplish
> such
> functionality it is necessary to deal only with data that either isn’t
> cachable (IRP_NOCACHE flag set) or is triggered by a cache manager
> (IRP_PAGING_IO flag). That way, the data stored in cache manager is
> decrypted
> and only during actual device read/write operations the decryption and
> encryption occur.
>
> However, I’m experiencing some problems while copying a file to a network
> share. Neither of flags mentioned above are set - which in my opinion
> means
> that data should be processed by cache manager, but - it isn’t?! It goes
> straight to device. And what’s worse, it goes there decrypted.
>
> Can somebody please tell me why it is happening like that? Am I wrong
> about
> this two flags, or is there some magic going around over there?
>
> I’ve tried to find some differences between write operations on network
> share that do cache, and the ones that don’t, without any success.
>
> I’ll be grateful for all the help, because I’m actually stuck in that
> place
> for a while now.
> Best regards.
>
> Adrian Korczynski
>