FLT_PREOP_SUCCESS_XXX vs. FLT_PREOP_COMPLETE with STATUS_REPARSE?

NTFSD
1

File Redirection: return FLT_PREOP_SUCCESS_XXX vs. return FLT_PREOP_COMPLETE with STATUS_REPARSE?

My current minifilter project aims to redirecting any file under directory X to directory Y. X and Y are located at the same volume.

In this case, I know the WDK sample SimRep works fine. However, I just wonder:

Is it feasible to modify the FileObject->FileName and return FLT_PREOP_SUCCESS_WITH_CALLBACK in such a case (i.e. in the same volume)?

Like the following pseudocode:

… PreCreate(…)
{
ReplaceFileName(FileObject->FileName, NewFileName);
FltSetCallbackDataDirty(Data);

return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

Any explanations?

Thanks!

2

It’s complicated. I would advise against it but I can’t say it will be wrong :). Here is one way you could get in trouble with other filters:

If there is a filter above yours that calls FltGetFileNameInformation from preCreate and gets a normalized name, that name will be based on the original name. That name will be cached by FltMgr and possibly by the minifilter itself, because a lot of mini filters like building their own name caches for some reason. That minifilter might not use FltGetTunneled name and get the new name from FltMgr and get into trouble later (even though I’m sure that everyone that’s calling FltGetFileNameInformation with FLT_FILE_NAME_NORMALIZED from preCreate is careful to call FltGetTunneledName from postCreate, right ? ? right ? ). See more details here:
http://fsfilters.blogspot.com/2011/03/names-in-minifilters-using.html

Basically, what you’re trying to do behaves a lot like a tunneled name, but I’m not convinced all minifilters handle tunneled names correctly :).

I can’t really thing of another scenario. However, the way I look at things is that if you’re going to implement a complete isolation filters then it’s ok to have filters above your filter see a different file name than filters below your filters. If you’re not implementing an isolation filter then you probably want all the filters (above and below) to see the same name, and using STATUS_REPARSE is an easy way to make that happen (since after all the reparses the final IRP_MJ_CREATE will have one name while it’s traveling through the filter stack). If you’re basing your sample on SimRep then you’re not really implementing an isolation filter.

Hope this helps with your decision.

Thanks,
Alex.
On Oct 25, 2013, at 2:34 AM, xxxxx@gmail.com wrote:

File Redirection: return FLT_PREOP_SUCCESS_XXX vs. return FLT_PREOP_COMPLETE with STATUS_REPARSE?

My current minifilter project aims to redirecting any file under directory X to directory Y. X and Y are located at the same volume.

In this case, I know the WDK sample SimRep works fine. However, I just wonder:

Is it feasible to modify the FileObject->FileName and return FLT_PREOP_SUCCESS_WITH_CALLBACK in such a case (i.e. in the same volume)?

Like the following pseudocode:

… PreCreate(…)
{
ReplaceFileName(FileObject->FileName, NewFileName);
FltSetCallbackDataDirty(Data);

return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

Any explanations?

Thanks!

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer