How to detect reparse point in PreCreate?

NTFSD
1

Hello,

is it possible to detect somehow that file which is going to be opened is reparse point in PreCreate callback of minifilter?

Thanks.

2

In pre-create you are limited to retrieving the attribute of the file
and checking for the FILE_ATTRIBUTE_REPARSE_POINT. Of course this
requires opening the file or the parent of the file in question.

If you can perform the check in post-create then you can limit things a
bit by checking how the file was opened, either with the
OPEN_REPARSE_POINT flag or not, and the return status code. As well in
post create you can easily query the attributes for successful opens
since you have a file object.

Pete

On 10/16/2012 8:13 AM, xxxxx@centrum.cz wrote:

Hello,

is it possible to detect somehow that file which is going to be opened is reparse point in PreCreate callback of minifilter?

Thanks.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

3

AFAIK, this is not possible as the windows file system has not created the FileObject. Only once the system attempts to create/find the actual file will it know this is a reparse point.

4

I agree with Peter that you’d have to open the file and query its attributes. Alternatively, you could open the parent directory and query the file attributes from the directory (with all the usual limitations of this approach).

However, if you do open the file by name then you need to be aware that it’s possible that the user’s open will actually end up opening another file if renames happen and the namespace changes.

I would probably try to check for this in postCreate, though I’m not sure whether this would work for you.

One more thing to note is that even if a file is not a reparse point, there is no guarantee that a filter won’t return STATUS_REPARSE anyway.

Thanks,
Alex.

5

When my PreCreate callback is called I get full path of file which is to be opened. I need to know if to process it or not. If the file is in fact on another volume, then I will not process it and do it later when new create irp comes for target volume of the reparse. I want to avoid 2 times processing of the same file.

So if I get in PreCreate “\Device\HarddiskVolume1\ClusterStorage\Volume0\file” I want to know I should not process it, since “Volume0” is a mount point to “\Device\CSVVolume0”. Now if I query the file for attributes and check for FILE_ATTRIBUTE_REPARSE_POINT, I think it will not be there, since file itself is not reparse point. Right? It means I would have to parse the whole path and query each item of the path. What I need to know in PreCreate is the fact if I get STATUS_REPARSE in PostCreate, when I let the processing continue.

6

If you try to open “\Device\HarddiskVolume1\ClusterStorage\Volume0\file” using FltCreateFile and “Volume0” is a mount point then FltCreateFile will fail (see my post at http://fsfilters.blogspot.com/2012/02/reparsing-to-different-volume-in-win7.html).

But again, you can’t really know in preCreate whether you’ll get STATUS_REPARSE in postCreate even if you look at the file attributes, since other file system filters can return STATUS_REPARSE.

I would approach this by checking directly in postCreate to see if I got a STATUS_REPARSE.

Why do you need this information in preCreate ? What are you doing with it that can’t be done in postCreate (not saying there aren’t such things, I’m just asking what it is in your case) ?

Thanks,
Alex.

7

> If you try to open “\Device\HarddiskVolume1\ClusterStorage\Volume0\file” using FltCreateFile and “Volume0” is a mount point then FltCreateFile will fail

Thank you very much for this hint. So when FltCreateFile fails I will not process the file and then later when it comes on “\Device\CSVVolume0” I will process it.