File Writing on Network Location

NTFSD
1

Hi,

How does this works for writing a file on network location. [Shared Folder] ?

Application while writing a file of 4 bytes on to network location only Cache_Write comes with size 4 and no any NO_CACHE Write or SetInformation with EOF as 4.

In FileSpy Tool it shows:

IRP_MJ_CREATE - \device\lanmanredirector\shared_folder\1.cpp - FILE_OPEN_IF CreOpts: 00000060 Access: 00120196 Share: 00000003 Attrib: 00000080 Result: FILE_OPENED

IRP_MJ_SET_INFORMATION - \device\lanmanredirector\shared_folder\1.cpp - FileEndofFileInformation EndofFile 00000-0000

IRP_MJ_SET_INFORMATION - \device\lanmanredirector\shared_folder\1.cpp - FileAllocationInformation Allocationsize 00000-0000

IRP_MJ_WRITE (Cached) - \device\lanmanredirector\shared_folder\1.cpp - Offset 00000000-00000000 ToWrite 4 Written: 4

IRP_MJ_FLUSH_BUFFERS - \device\lanmanredirector\shared_folder\1.cpp

IRP_MJ_CLEANUP - \device\lanmanredirector\shared_folder\1.cpp

IRP_MJ_CLOSE - \device\lanmanredirector\shared_folder\1.cpp

How to handle such scenario ? Is Irp_Mj_Flush_Buffers doing some lazy writing on that network location ?

Any suggestions are appreciated.

Thanks
Mahesh

2

Probably the file is not cached at all on the client.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> Hi,
>
> How does this works for writing a file on network location. [Shared Folder]
?
>
> Application while writing a file of 4 bytes on to network location only
Cache_Write comes with size 4 and no any NO_CACHE Write or SetInformation with
EOF as 4.
>
>
> In FileSpy Tool it shows:
>
> IRP_MJ_CREATE - \device\lanmanredirector\shared_folder\1.cpp - FILE_OPEN_IF
CreOpts: 00000060 Access: 00120196 Share: 00000003 Attrib: 00000080 Result:
FILE_OPENED
>
> IRP_MJ_SET_INFORMATION - \device\lanmanredirector\shared_folder\1.cpp -
FileEndofFileInformation EndofFile 00000-0000
>
> IRP_MJ_SET_INFORMATION - \device\lanmanredirector\shared_folder\1.cpp -
FileAllocationInformation Allocationsize 00000-0000
>
> IRP_MJ_WRITE (Cached) - \device\lanmanredirector\shared_folder\1.cpp -
Offset 00000000-00000000 ToWrite 4 Written: 4
>
> IRP_MJ_FLUSH_BUFFERS - \device\lanmanredirector\shared_folder\1.cpp
>
> IRP_MJ_CLEANUP - \device\lanmanredirector\shared_folder\1.cpp
>
> IRP_MJ_CLOSE - \device\lanmanredirector\shared_folder\1.cpp
>
>
>
> How to handle such scenario ? Is Irp_Mj_Flush_Buffers doing some lazy writing
on that network location ?
>
>
> Any suggestions are appreciated.
>
>
> Thanks
> Mahesh
>

3

Hi,

Maxim, thanks for your reply.

I think,do you mean to say that, the Cache_Write which is seen on client m/c is a No_Cache Write ?

or am i misunderstood you, please correct me.

What’s the role of Flush_Buffers, i read that it is send by I/O manager when buffered data needs to be flushed to disk.

Is the Flush_Buffer, flushing the cached data on network location ?

Kindly, provide your suggestions.

Thanks
Mahesh

4

Cached/non-cached IRP means nothing for redirector. It has its own rules to decide if file is cached or not. It also depends on other clients, what is oplock etc…One of the rules is don’t cache write only files. I am too lazy decode 0x00120196 if it is write only handle.

-bg

5

Hi,

For Local disk [NTFS] , my filter works fine. It writes + data in the file. This writing is done in NO_CACHE Write operation. In Cache Write, i am just increasing the filesize.

As my mini-filter get attached to “\device\lanmanredirector” and network file calls are seen, so i think there is no need of writing any network redirector driver. Please correct me if i am wrong.

Now, only Cache_write is seen on client side, i am writing the +Data in this write only. It seems that, it is working fine for small size files. Need to check for large files.

But, is it a write way to do such thing in Cache_Write ? or only in No_Cache write this should be done.

Kindly provide your suggestions.

Thanks
Mahesh

6

I guess from description that you write encryption filter. Generaly I consider as a bad idea to encrypt data at a client side. What about sharing with other clients, etc…?

Now, only Cache_write is seen on client side, i am writing the +Data >in this write only. It seems that, it is working fine for small size files. Need to
>check for large files.
I don’t understand at all how it could work for existing file. Your header must be visible to application through memory mapped file. Does notepad work?

-bg

7

Hi,

Thanks Bronislav for replying.

Now, i tried writing a file on a network shared folder/mapped network drive. In this case, on my machine (Client m/c) i can see both the Cache and NO_CACHE write calls as expected, so everything works fine.

But, when i tried writing on Rational Clearcase repository server (which has its own Multi-Version File System) , only Cache write is seen.

Writing a file Network Shared folder or Mapped Network Drive shows the write calls as expected, and this is not the case for Clearcase repository server, why is it so?

Any idea/ clues are appreciated.

Thanks
Mahesh