Re: unable to reliably get remote client CreateFile IRP in file filter driver

NTFSD
1

The network redirector may use FastIoGetNetworkOpenInformation call,
instead of IRP_MJ_CREATE.
Also, if You need is to distinguish the return value of IRP_MJ_CR (i.e.
Irp->IoStatus.Information field), You cannot, without tricks, as LanMan does
not set it.

Regards, Dejan.

xxxxx@erinet.com wrote:

Hi all,

My filesystem filter driver handle IRP_MJ_CREATE. In order to automate the
test, I tried to call CreateFile API from a remote client that map a local
disk protected by the filter driver. Immediately after that I use
CloseHandle to close it. This process is repeated for several different
files. Then it repeat itself again.

I noticed that I was unable to get the IRP_MJ_CREATE reliably except the
first loop. I tried to apply different flags e.g. FILE_FLAG_NO_BUFFERING |
FILE_FLAG_WRITE_THROUGH that do not seems help. Even restart the process
does not guarantee that the local filter get the IRP.

I do know that if I use explorer from remote client to open the file, I get
the IRP every time.

I know there is no problem when do the test locally.

I guess network redirector play some trick to reduce the network traffic.
Can anyone explain how this work and if there is workaround to get around
the problem. I want to use CreateFile because it allows me to specified the
exact access mode so that I can invoke the right policy in my filter
driver.

Thanks,

Jack Cheng

You are currently subscribed to ntfsd as: xxxxx@ptt.yu
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

–
Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
www.register.co.yu
E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
Professional file&system related components and libraries for Win32 developers.

Alfa Units - #1 file and system handling units for Delphi.
Alfa File Monitor - #1 file monitoring system for Win32 developers.
Alfa Interceptor - #1 file protection and hiding system for Win32 developers.

2

Thanks for the explanation !

Jack
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Friday, November 03, 2000 11:49 AM
Subject: [ntfsd] Re: unable to reliably get remote client CreateFile IRP in
file filter driver

>
> The network redirector may use FastIoGetNetworkOpenInformation call,
> instead of IRP_MJ_CREATE.
> Also, if You need is to distinguish the return value of IRP_MJ_CR
(i.e.
> Irp->IoStatus.Information field), You cannot, without tricks, as LanMan
does
> not set it.
>
> Regards, Dejan.
>
> xxxxx@erinet.com wrote:
>
> > Hi all,
> >
> > My filesystem filter driver handle IRP_MJ_CREATE. In order to automate
the
> > test, I tried to call CreateFile API from a remote client that map a
local
> > disk protected by the filter driver. Immediately after that I use
> > CloseHandle to close it. This process is repeated for several different
> > files. Then it repeat itself again.
> >
> > I noticed that I was unable to get the IRP_MJ_CREATE reliably except the
> > first loop. I tried to apply different flags e.g. FILE_FLAG_NO_BUFFERING
|
> > FILE_FLAG_WRITE_THROUGH that do not seems help. Even restart the process
> > does not guarantee that the local filter get the IRP.
> >
> > I do know that if I use explorer from remote client to open the file, I
get
> > the IRP every time.
> >
> > I know there is no problem when do the test locally.
> >
> > I guess network redirector play some trick to reduce the network
traffic.
> > Can anyone explain how this work and if there is workaround to get
around
> > the problem. I want to use CreateFile because it allows me to specified
the
> > exact access mode so that I can invoke the right policy in my filter
> > driver.
> >
> > Thanks,
> >
> > Jack Cheng
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@ptt.yu
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
> –
> Regards, Dejan M. CEO Alfa Co. http://www.alfaunits.co.yu and
> www.register.co.yu
> E-mail : xxxxx@alfaunits.co.yu ICQ# : 56570367
> Professional file&system related components and libraries for Win32
developers.
>
> Alfa Units - #1 file and system handling units for Delphi.
> Alfa File Monitor - #1 file monitoring system for Win32 developers.
> Alfa Interceptor - #1 file protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@erinet.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>

3

Thanks for the explanation !

Jack