question about redirect network access

NTFSD
1

Hello,

My filter driver is implemented to redirect an open file request
(IRP_MJ_CREATE) to another location by returning STATUS_REPARSE if the file
points to another file. The filter driver attaches to all NTFS volumes at
boot time. Now I have a problem for network access.
If an open file request comes from another computer on the network, the
filter driver can not catch the request at all.
Does the filter have to attach to \Device\LanmanRedirector, LanmanServer or
something else? My filter driver was implemented based on sfilter of IFSkit.
If my filter needs to attach to LanmanServer, what is the best time and
where is the attach point?

Thank you very much if you can post any response.

Shangwu

2

SRV (LanMan Server) is (from the file system perspective) an
“application”. It CALLS the file systems via their upper edge
interface. MRXSMB (LanMan Client) is a file system - it supports
applications that call the file systems API.

If your filter sits on top of NTFS, it sees calls from SRV (the
“application”). If your filter sits on top of MRXSMB, it sees calls
from applications accessing “network drives”.

So, if the request is coming “from another machine on the network” then
it is originating with SRV, then going through your filter and finally
to the underlying file system. If your filter is not seeing them, you
have an implementation problem within your filter driver. There are no
“secret handshake” interfaces. SRV, for all it can be painfully
challenging as a consumer of the file system services, is reasonably
well behaved in this regard.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class April
4, 2004 in Boston!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Thursday, January 27, 2005 4:45 PM
To: ntfsd redirect
Subject: [ntfsd] question about redirect network access

Hello,

My filter driver is implemented to redirect an open file request
(IRP_MJ_CREATE) to another location by returning STATUS_REPARSE if the
file
points to another file. The filter driver attaches to all NTFS volumes
at
boot time. Now I have a problem for network access.
If an open file request comes from another computer on the network, the
filter driver can not catch the request at all.
Does the filter have to attach to \Device\LanmanRedirector, LanmanServer
or
something else? My filter driver was implemented based on sfilter of
IFSkit.
If my filter needs to attach to LanmanServer, what is the best time and
where is the attach point?

Thank you very much if you can post any response.

Shangwu

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

No, if you are truly attached to all NTFS volumes, then all open requests to
the NTFS volume should be intercepted, regardless of the source (local or
network). If not, you’ve done something wrong.

However, if you need to know that the request is coming from the network,
you’ll need to detect that it is coming from a network source by checking
for a system thread impersonating someone. It’s a little tricky, but has
been discussed here several times.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Thursday, January 27, 2005 4:45 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] question about redirect network access

Hello,

My filter driver is implemented to redirect an open file request
(IRP_MJ_CREATE) to another location by returning STATUS_REPARSE if the file
points to another file. The filter driver attaches to all NTFS volumes at
boot time. Now I have a problem for network access.
If an open file request comes from another computer on the network, the
filter driver can not catch the request at all.
Does the filter have to attach to \Device\LanmanRedirector, LanmanServer or
something else? My filter driver was implemented based on sfilter of IFSkit.

If my filter needs to attach to LanmanServer, what is the best time and
where is the attach point?

Thank you very much if you can post any response.

Shangwu

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Thank you all for taking care of this. The problem was caused by my filter
driver. It checked if Irp->RequestorMode equals to UserMode. Because the
request comes from LanmanServer, the mode should be kernel mode.

Regards,

Shangwu

“Shangwu” wrote in message news:xxxxx@ntfsd…
> Hello,
>
> My filter driver is implemented to redirect an open file request
> (IRP_MJ_CREATE) to another location by returning STATUS_REPARSE if the
> file points to another file. The filter driver attaches to all NTFS
> volumes at boot time. Now I have a problem for network access.
> If an open file request comes from another computer on the network, the
> filter driver can not catch the request at all.
> Does the filter have to attach to \Device\LanmanRedirector, LanmanServer
> or something else? My filter driver was implemented based on sfilter of
> IFSkit. If my filter needs to attach to LanmanServer, what is the best
> time and where is the attach point?
>
> Thank you very much if you can post any response.
>
> Shangwu
>
>