file/directory change notification

NTFSD
1

Here is the scenario:

  • Explorer registers for directory change notification
    on C:\TEMP
  • Explorer enumerates the contents of C:\TEMP
  • I manipulate the results of this enumeration to
    include an extra file TEMP.TXT which really exists in
    C:\REDIR
  • I redirect IRP_MJ_CREATE requests for C:\TEMP.TXT
    using STATUS_REPARSE.

When the file TEMP.TXT is deleted, explorer does not
get notified because the deletion really happens in
C:\REDIR. If I redirect the request for directory
change notification to C:\REDIR, then explorer won’t
get notified of changes in C:\TEMP.

How can I make it so that a change in either directory
will result in explorer getting a change notification
for C:\TEMP?

Thanks,

Randy Cook
Lucid Systems Inc.

Do you Yahoo!?
U2 on LAUNCH - Exclusive greatest hits videos
http://launch.yahoo.com/u2

2

Hmm, this is tough. The change notify IRPs for C:\Temp are held pending
in a queue somewhere inside the FsRtl library. Such an IRP is only
completed when the filesystem informs FsRtl that a matching change has
occurred using FsRtlNotifyFullReportChange (or in several corner cases
such as premature closure of the file object).

What you want to have happen is to have the appropriate change notify
IRPs for C:\Temp complete prematurely if your extra file TEMP.TXT is
changed inside of this other directory C:\REDIR. Unfortunately you can’t
call FsRtlNotifyFullReportChange yourself, since it takes several
filesystem-private arguments.

Assuming you track the change notify IRPs pending for C:\Temp in your
own list, and can determine when you want one to be completed based on
what you see happening to C:\REDIR, you COULD try to cancel the IRP
using IoCancelIrp. Ideally FsRtl is registering an appropriate cancel
routine for the IRPs that it enqueues, like a good citizen should, and
thus the cancellation would simply cause FsRtl to disgorge the IRP from
its queue and complete it without complaint. You could then change the
IRP status from STATUS_CANCELLED to STATUS_SUCCESS in your own
completion routine, and the caller upstream from you should be happy.

If you try this, let us know what happens.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Wednesday, November 06, 2002 7:49 PM
To: File Systems Developers
Subject: [ntfsd] file/directory change notification

Here is the scenario:

  • Explorer registers for directory change notification
    on C:\TEMP
  • Explorer enumerates the contents of C:\TEMP
  • I manipulate the results of this enumeration to
    include an extra file TEMP.TXT which really exists in
    C:\REDIR
  • I redirect IRP_MJ_CREATE requests for C:\TEMP.TXT
    using STATUS_REPARSE.

When the file TEMP.TXT is deleted, explorer does not
get notified because the deletion really happens in
C:\REDIR. If I redirect the request for directory
change notification to C:\REDIR, then explorer won’t
get notified of changes in C:\TEMP.

How can I make it so that a change in either directory
will result in explorer getting a change notification
for C:\TEMP?

Thanks,

Randy Cook
Lucid Systems Inc.

Do you Yahoo!?
U2 on LAUNCH - Exclusive greatest hits videos
http://launch.yahoo.com/u2

You are currently subscribed
to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%

3

I have never tried this but one possible solution off the top of my head
is: pend the original change notification IRP in your filter (of course
putting a cancel routine on it) and then generating two of your own
change directory notification IRPs that you send down to each directory.
Then when either of the IRPs you generated complete, you complete the
original IRP. You should probably cancel the IRP for the directory that
didn’t signal you. If the original IRP is canceled, you should cancel
both the IRPs you generated. It is also possible for both of your
generated IRPs to complete at the same time. They are obviously several
different scenarios you need to handle.

Please be sure and read up on how to implement cancel routines because
it is one of those areas that is a little tricky and a lot of filter
people don’t get right on their first try.

Neal Christiansen
Microsoft File System Filter Group

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: Randy Cook [mailto:xxxxx@yahoo.com]
Sent: Wednesday, November 06, 2002 7:49 PM
To: File Systems Developers
Subject: [ntfsd] file/directory change notification

Here is the scenario:

  • Explorer registers for directory change notification
    on C:\TEMP
  • Explorer enumerates the contents of C:\TEMP
  • I manipulate the results of this enumeration to
    include an extra file TEMP.TXT which really exists in
    C:\REDIR
  • I redirect IRP_MJ_CREATE requests for C:\TEMP.TXT
    using STATUS_REPARSE.

When the file TEMP.TXT is deleted, explorer does not
get notified because the deletion really happens in
C:\REDIR. If I redirect the request for directory
change notification to C:\REDIR, then explorer won’t
get notified of changes in C:\TEMP.

How can I make it so that a change in either directory
will result in explorer getting a change notification
for C:\TEMP?

Thanks,

Randy Cook
Lucid Systems Inc.

Do you Yahoo!?
U2 on LAUNCH - Exclusive greatest hits videos
http://launch.yahoo.com/u2

You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to %%email.unsub%%