NetworkQueryOpen

NTFSD
1

I’m using reparse points to direct a cmd.exe shell to another location on the same volume. So the shell executes a ‘cd foo’, and ends up in c:\special_place\foo let’s say. Once the prompt is sitting there, at what it believes is c:\foo, I want it to be able to mkdir, cd, etc. I started coding this path and have a couple issues. What I’m wondering though, is: It is necessary to support the NetworkQueryOpen path while I’m faking up these dirs/files? I know what it does and, from what I’ve read it’s merely an optmization, but it seems that if I don’t support it, things won’t work right. That obviously could mean I have issues in my DirectoryControl handler, or not handling my reparses properly in my create path or something, but I’m just curious if NetworkQueryOpen is mandatory in some cases. Thanks for reading,

~billy

2

Ok, so to narrow it down to a simpler problem, while sitting at a C:\ prompt with my driver running I have:

C:\Fake_Dir which my driver reparses to C:\Reparse_Root\Fake_Dir
In C:\Reparse_Root\Fake_Dir I have a subdir, C:\Reparse_Root\Fake_Dir\SubDir1
If I do a dir, while sitting at a command prompt in C:\Fake_Dir, I’ll see SubDir1 (the create comes in, gets reparsed, the DirectoryControl with pattern “SubDir1” comes in, etc.).
Now, if I try:

C:\Fake_Dir> cd SubDir1

I get this:

FASTIO_QUERY_OPEN C:\Fake_Dir\SubDir1 NOT FOUND Attributes: Error
IRP_MJ_DIRECTORY_CONTROL C:\ SUCCESS FileBothDirectoryInformation: Fake_Dir
IRP_MJ_CREATE C:\Fake_Dir\ REPARSE Options: Open Directory Access: 00100001
IRP_MJ_CREATE C:\Reparse_Root\Fake_Dir SUCCESS Options: Open Directory Access: 00100001
IRP_MJ_CREATE C:\Reparse_Root\ SUCCESS Options: Open Directory Access: 00100000
IRP_MJ_CLEANUP C:\Reparse_Root\ SUCCESS
IRP_MJ_CLOSE C:\Reparse_Root\ SUCCESS
IRP_MJ_DIRECTORY_CONTROL C:\Reparse_Root\Fake_Dir SUCCESS FileBothDirectoryInformation: SubDir1
IRP_MJ_CLEANUP C:\Reparse_Root\Fake_Dir SUCCESS
IRP_MJ_CLOSE C:\Reparse_Root\Fake_Dir SUCCESS
FASTIO_QUERY_OPEN C:\Fake_Dir\SubDir1 NOT FOUND Attributes: Error

Now, if I enable my NetworkQueryOpen to provide the infor for SubDir1, it will succeed and I can change dir into SubDir1.
I don’t understand why this is. If the NetworkQueryOpen is an optimized create/query/cleanup/close, I’m wondering
why I’m not getting another chance here if it fails - i.e. why isn’t there a create on C:\Fake_Dir\SubDir1 so I can reparse it? Anyway, any info is appreciated, thanks,

~billy

3

If FastIo returns STATUS_NOT_IMPLEMENTED or STATUS_NOT_SUPPORTED, you will get another chance, but since NOT FOUND (STATUS_OBJECT_NOT_FOUND or similar) is a specific error which
instead says FastIo is supported, but the item requested is not found, you don’t get another chance.

xxxxx@gmail.com wrote:

Ok, so to narrow it down to a simpler problem, while sitting at a C:\ prompt with my driver running I have:

C:\Fake_Dir which my driver reparses to C:\Reparse_Root\Fake_Dir
In C:\Reparse_Root\Fake_Dir I have a subdir, C:\Reparse_Root\Fake_Dir\SubDir1
If I do a dir, while sitting at a command prompt in C:\Fake_Dir, I’ll see SubDir1 (the create comes in, gets reparsed, the DirectoryControl with pattern “SubDir1” comes in, etc.).
Now, if I try:

C:\Fake_Dir> cd SubDir1

I get this:

FASTIO_QUERY_OPEN C:\Fake_Dir\SubDir1 NOT FOUND Attributes: Error
IRP_MJ_DIRECTORY_CONTROL C:\ SUCCESS FileBothDirectoryInformation: Fake_Dir
IRP_MJ_CREATE C:\Fake_Dir\ REPARSE Options: Open Directory Access: 00100001
IRP_MJ_CREATE C:\Reparse_Root\Fake_Dir SUCCESS Options: Open Directory Access: 00100001
IRP_MJ_CREATE C:\Reparse_Root\ SUCCESS Options: Open Directory Access: 00100000
IRP_MJ_CLEANUP C:\Reparse_Root\ SUCCESS
IRP_MJ_CLOSE C:\Reparse_Root\ SUCCESS
IRP_MJ_DIRECTORY_CONTROL C:\Reparse_Root\Fake_Dir SUCCESS FileBothDirectoryInformation: SubDir1
IRP_MJ_CLEANUP C:\Reparse_Root\Fake_Dir SUCCESS
IRP_MJ_CLOSE C:\Reparse_Root\Fake_Dir SUCCESS
FASTIO_QUERY_OPEN C:\Fake_Dir\SubDir1 NOT FOUND Attributes: Error

Now, if I enable my NetworkQueryOpen to provide the infor for SubDir1, it will succeed and I can change dir into SubDir1.
I don’t understand why this is. If the NetworkQueryOpen is an optimized create/query/cleanup/close, I’m wondering
why I’m not getting another chance here if it fails - i.e. why isn’t there a create on C:\Fake_Dir\SubDir1 so I can reparse it? Anyway, any info is appreciated, thanks,

~billy

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

4

Yep, that’s what the problem was. Instead of returning FLT_PREOP_DISALLOW_FASTIO from my PreOp handler, I simply wasn’t registering the callback. Thanks :slight_smile:

~billy