Getting file disposition : - Open or Create

OSR_Community_User · May 14, 2003, 1:56pm

Hi all,
I have two questions

Whenever I am opening or creating a file, I think first IRP_MJ_CREATE
is sent. Is there a way to tell, whether the I/O packet is for creating or
is for modification of the file. I know in completion routine we can get
the details, but I want to check it in the dispatch routine before sending
it to the next level driver.
Should I use a new self generated IRP.
In case of creation of a new file, if I cancel the IRP_MJ_CREATE does
the file created will get deleted automatically.

I know in case of ZwCreateFile we get dispostion information, so there
must be a way in which I can get the file packet type (for open or
modification).

Please help.
Lalit.

OSR_Community_User · May 14, 2003, 3:13pm

From the FastFat example:

ULONG Options = IrpSp->Parameters.Create.Options;
ULONG CreateDisposition = (Options >> 24) & 0x000000ff;

If you complete the Irp before sending it down you don’t have anything to cancel, if you want to cancel the Irp after sending it down (in you completion routine) it is more complex. Try IoCacnelOpen API (for 2k and XP).

Gilad

-----Original Message-----
From: Lalit S. Rana [mailto:xxxxx@epatra.com]
Sent: Wed, May 14, 2003 10:57 AM
To: File Systems Developers
Subject: [ntfsd] Getting file disposition : - Open or Create

Hi all,
I have two questions

Whenever I am opening or creating a file, I think first IRP_MJ_CREATE
is sent. Is there a way to tell, whether the I/O packet is for creating or
is for modification of the file. I know in completion routine we can get
the details, but I want to check it in the dispatch routine before sending
it to the next level driver.
Should I use a new self generated IRP.
In case of creation of a new file, if I cancel the IRP_MJ_CREATE does
the file created will get deleted automatically.

I know in case of ZwCreateFile we get dispostion information, so there
must be a way in which I can get the file packet type (for open or
modification).

Please help.
Lalit.

You are currently subscribed to ntfsd as: xxxxx@appstream.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · May 14, 2003, 3:23pm

You can look at file disposition (upper 8 bits of
pIrpSp->Parameters.Create.Options). This has the value FILE_OPEN, etc.
(see ntifs.h). However, some dispositions can cause either an open or
create (FILE_OPEN_IF), so you can’t tell apriori if an existing file
will be opened or a new one created. The overwrite/supersede disposition
will actually destroy any existing file, so if you want to prevent this
from happening based on the contents of the file, for example, you need
to open the file yourself before sending down the create.

Nick Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lalit S. Rana
Sent: Wednesday, May 14, 2003 10:57 AM
To: File Systems Developers
Subject: [ntfsd] Getting file disposition : - Open or Create

Hi all,
I have two questions

Whenever I am opening or creating a file, I think first
IRP_MJ_CREATE is sent. Is there a way to tell, whether the
I/O packet is for creating or is for modification of the
file. I know in completion routine we can get the details,
but I want to check it in the dispatch routine before sending
it to the next level driver. Should I use a new self
generated IRP. 2. In case of creation of a new file, if I
cancel the IRP_MJ_CREATE does the file created will get
deleted automatically.

I know in case of ZwCreateFile we get dispostion information,
so there must be a way in which I can get the file packet
type (for open or modification).

Please help.
Lalit.

You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · May 14, 2003, 4:32pm

I am not sure I understand what you mean by “the I/O packet is for
creating or is for modification of the file.” I suppose you want to know
if the file will be created or opened, right? It would be a good solution
to use a self-generated IRP in order to check in dispatch routine.
ZwCreateFile/ZwOpenFile will also do the job as long as you handle
reentrancy issues.
NO. If you send the IRP to the lower driver, you will have to manually
delete the file. However, it would be better to check before you send the
IRP down.

Best regards,
Razvan

Hi all,
I have two questions

Whenever I am opening or creating a file, I think first IRP_MJ_CREATE
is sent. Is there a way to tell, whether the I/O packet is for creating or
is for modification of the file. I know in completion routine we can get
the details, but I want to check it in the dispatch routine before sending
it to the next level driver.
Should I use a new self generated IRP.

In case of creation of a new file, if I cancel the IRP_MJ_CREATE does
the file created will get deleted automatically.

I know in case of ZwCreateFile we get dispostion information, so there
must be a way in which I can get the file packet type (for open or
modification).

Please help.
Lalit.

OSR_Community_User · May 15, 2003, 2:58am

The solution given by
Gilad Ben-Zeev & Nick Ryan
suggest that there is no way other than creating own IRP for checking
whether the file is created or opened.
The upper 8 bits of IrpSp->Parameters.Create.Options can never give
accurate answer.

NOW MY QUESTION

If I go with creating an IRP_MJ_CREATE I/O request with in IRP_MJ_CREATE
and setting the option to FILE_OPEN and depending upon IOStatus check
whether the file is opened or created.
I consider this model to be robust, is there any problem with it or a
better method available.

Please Suggest.

Regards
Lalit.

OSR_Community_User · May 15, 2003, 4:47am

> The solution given by

Gilad Ben-Zeev & Nick Ryan
suggest that there is no way other than creating own IRP for checking
whether the file is created or opened.
The upper 8 bits of IrpSp->Parameters.Create.Options can never give
accurate answer.

Note that LanMan will NOT set the Irp->IoStatus.Information
correctly to tell whether a file was opened or created (at least not on NT,
and I think 2K - never tested on XP).

If I go with creating an IRP_MJ_CREATE I/O request with in IRP_MJ_CREATE
and setting the option to FILE_OPEN and depending upon IOStatus check
whether the file is opened or created.
I consider this model to be robust, is there any problem with it or a
better method available.

I use this in one of my drivers, and it (seems to) works.
One thing you might need to note is the error code in case that both
a FILE_OPEN and FILE_CREATE calls fail (or FILE_OPEN and FILE_OVERWRITE).
The file system would return a different error code for the second calls
than what the OS expects - since it thinks you only try to create/overwrite,
so it returns a status that is not compatible with the original action.

Test it and you will see what I mean.

You can reuse the original IRP, just changing the Disposition, and
waiting for the result (return STATUS_MORE_PROCESSING_REQUIRED in the
completion). If the first call succeeds, call IoCompleteRequest and return.
If it fails, change the disposition, and resend the IRP. Call
IoCompleteRequest, modify the status code if needed, and return. (of course
after you do the processing)

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.