Hi
Few months ago my company decided to implement a legacy filter (in addition to an existing miniFilter) to add support for additional volumes unsupported by the Filter Manager.
Now, because of complications in the user mode code, the miniFilter will be completely discarded and the legacy filter is to be used.
I highly doubt the miniFilter will ever be resurrected.
FYI MS audience on this list.
Could you please share more about unsupported volumes by miniFilter? What kind of volumes are not supported by MiniFilter?
Hi,
Legacy filters didn’t support the kernel transaction manager last time I
checked?
J.
wrote in message news:xxxxx@ntfsd…
> Hi
>
> Few months ago my company decided to implement a legacy filter (in
> addition to an existing miniFilter) to add support for additional volumes
> unsupported by the Filter Manager.
>
> Now, because of complications in the user mode code, the miniFilter will
> be completely discarded and the legacy filter is to be used.
>
> I highly doubt the miniFilter will ever be resurrected.
>
> FYI MS audience on this list.
>
> Legacy filters didn’t support the kernel transaction manager last time I
checked?
They support everything.
FltMgr is just a legacy filter.
Legacy vs. minifilter is like using MFC or direct GDI/USER API for the UI. Use the framework (minifilter) or talk directly to the OS (legacy).
Same is KMDF.
Same is virtual STORPORT miniport vs. full storage port.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
Maxim S. Shatskih wrote:
> Legacy filters didn’t support the kernel transaction manager last time I
> checked?They support everything.
They don’t support named pipe filtering … they don’t support filtering
network redirectors which they don’t know about … they don’t support
filtering file systems which are not connected to physical volumes
(though FM does attach to them, FM does not allow filtering of them) …
All of these can be achieved through a legacy filter.
FltMgr is just a legacy filter.
Sure but that does not mean they allow filtering of everything they
attach to.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
> They don’t support named pipe filtering … they don’t support filtering
network redirectors which they don’t know about … they don’t support
filtering file systems which are not connected to physical volumes
(though FM does attach to them, FM does not allow filtering of them) …
Minifilters lack these support, but we are talking about legacy filter limitations (which are none).
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
I would like to clarify some of things mentioned on this thread (and I’m not looking to start a flame war):
Named pipes -> while NPFS is very similar to a file system and implements some of the same semantics, it is also different enough from a file system that I doubt that simply adding support in filter manager will enable any but the simplest filters to do anything meaningful. I mean, it could be argued that AFD.sys is a filesystem and that filter manager should filter it as well… That said, we are looking at the scenarios for filtering NPFS to see what would be the value proposition of adding filter manager support (and I would appreciate if you would let me know if you are currently working on such filters or did so in the past and can briefly describe them).
I’m not sure I know what network redirectors you are talking about. We do support filter all the redirectors that are handled through MUP (the newer model) as well as all the old model, where redirectors needed to register as file systems. This is the first time I heard this complaint so perhaps we could discuss this further offline ?
as far as I know we do support file systems that are not connected to physical volumes. Looking at the code I think that for a file systems that has an unusual (I’m not sure what the contract is so I’m not going to call it broken) CDO/VDO implementation FltMgr might not be able to figure out whether they need to be filtered or not, but I know of some “virtual” file systems that work well with filter manager so it’s clearly possible.
to address the OP, as far as I remember they were trying to attach to a file system that doesn’t support the FSRTL_ADVANCED_FCB_HEADER. This is needed for filter manager to function, it is fully documented, it has been supported since Win2K, there are examples on how to use it in the WDK and to add support for it for a file system that doesn’t have it is usually something on the order of 20-50 lines of code. I’m not sure why the developers of that FS chose not to support it. Moreover, I think I remember that in one of the older posts the OP discovered that the file system in question doesn’t even register as a file system with the OS. I think that is unfair to blame filter manager in this case. It would be like blaming a compiler that it doesn’t support including a .h file that uses a non-standard extension that that compiler doesn’t support.
You will always be able to control things at a finer level in a legacy filter (including how to shoot yourself in the foot), just as you will always have more control writing C code instead of Perl, or writing assembly instead of C, or writing bytecode instead of ASM instructions. Please don’t lose perspective of what you are trying to achieve in the process of selecting your tools.
I am sorry to hear that the OP could not make things work with the 3rd party FS they were using and I can understand their frustration. I believe that in this case their energy might be better spent on working with the developers of that FS to make it use the proper interfaces.
I would like to ask that, in order to better help future readers of this forum, instead of making blanket statements about how things are broken posters put a little more effort into describing the circumstances under which things are broken. For example, I believe that this post would be more valuable to the community if instead of saying this:
“Few months ago my company decided to implement a legacy filter (in addition to an existing miniFilter) to add support for additional volumes unsupported by the Filter Manager.”
the OP would have chosen something more like:
Few months ago my company decided to implement a legacy filter (in addition to an existing miniFilter) to add support for file system X, which does not use the FSRTL_ADVANCED_FCB_HEADER and does not register as a file system with the OS and is therefore unsupported by the Filter Manager.
I believe (this is just my oppinion, not fact) that the majority of the developers on this list agree that for a begininner file system filter developer the minifilter model is easier to tackle and I would caution against ambigous statements that might give them the wrong impression.
Happy New Year everyone!
Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.
>like blaming a compiler that it doesn’t support including a .h file that uses a non-standard extension
that that compiler doesn’t support.
The MS’s compiler supports this 
I use an .mch suffix for event log header files generated by mc.exe
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
xxxxx@microsoft.com wrote:
I would like to clarify some of things mentioned on this thread (and I’m not looking to start a flame war):
Alex,
Definitely did not intend to make blanket statements or cause any
problems, these are just my obervations.
- Named pipes -> while NPFS is very similar to a file system and implements some of the same semantics, it is also different enough from a file system that I doubt that simply adding support in filter manager will enable any but the simplest filters to do anything meaningful. I mean, it could be argued that AFD.sys is a filesystem and that filter manager should filter it as well… That said, we are looking at the scenarios for filtering NPFS to see what would be the value proposition of adding filter manager support (and I would appreciate if you would let me know if you are currently working on such filters or did so in the past and can briefly describe them).
Agree completely per our past discussions.
- I’m not sure I know what network redirectors you are talking about. We do support filter all the redirectors that are handled through MUP (the newer model) as well as all the old model, where redirectors needed to register as file systems. This is the first time I heard this complaint so perhaps we could discuss this further offline ?
Not a complaint, just stating that having implemented several ‘legacy’
redirectors, they required some changes for FM to work correctly with
them. They did not work ‘out of the box’. Primarily this was ensuring
that the redirectors registered as file systems as well as registering
with MUP.
- as far as I know we do support file systems that are not connected to physical volumes. Looking at the code I think that for a file systems that has an unusual (I’m not sure what the contract is so I’m not going to call it broken) CDO/VDO implementation FltMgr might not be able to figure out whether they need to be filtered or not, but I know of some “virtual” file systems that work well with filter manager so it’s clearly possible.
I have implemented several stand alone file system implementations where
they were targets of the much discussed reparse processing. In these
file systems, FM did mount them but a mini-filter would not be notified
of their existence.
to address the OP, as far as I remember they were trying to attach to a file system that doesn’t support the FSRTL_ADVANCED_FCB_HEADER. This is needed for filter manager to function, it is fully documented, it has been supported since Win2K, there are examples on how to use it in the WDK and to add support for it for a file system that doesn’t have it is usually something on the order of 20-50 lines of code. I’m not sure why the developers of that FS chose not to support it. Moreover, I think I remember that in one of the older posts the OP discovered that the file system in question doesn’t even register as a file system with the OS. I think that is unfair to blame filter manager in this case. It would be like blaming a compiler that it doesn’t support including a .h file that uses a non-standard extension that that compiler doesn’t support.
You will always be able to control things at a finer level in a legacy filter (including how to shoot yourself in the foot), just as you will always have more control writing C code instead of Perl, or writing assembly instead of C, or writing bytecode instead of ASM instructions. Please don’t lose perspective of what you are trying to achieve in the process of selecting your tools.
I am sorry to hear that the OP could not make things work with the 3rd party FS they were using and I can understand their frustration. I believe that in this case their energy might be better spent on working with the developers of that FS to make it use the proper interfaces.
I would like to ask that, in order to better help future readers of this forum, instead of making blanket statements about how things are broken posters put a little more effort into describing the circumstances under which things are broken. For example, I believe that this post would be more valuable to the community if instead of saying this:
“Few months ago my company decided to implement a legacy filter (in addition to an existing miniFilter) to add support for additional volumes unsupported by the Filter Manager.”
the OP would have chosen something more like:
Few months ago my company decided to implement a legacy filter (in addition to an existing miniFilter) to add support for file system X, which does not use the FSRTL_ADVANCED_FCB_HEADER and does not register as a file system with the OS and is therefore unsupported by the Filter Manager.I believe (this is just my oppinion, not fact) that the majority of the developers on this list agree that for a begininner file system filter developer the minifilter model is easier to tackle and I would caution against ambigous statements that might give them the wrong impression.
Definitely as a beginner the mini-filter model is miles beyond the
legacy model in terms of ease of design and implementation in most cases.
Pete
Happy New Year everyone!
Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295