STATUS_REPARSE

NTFSD
1

Were is the new(alternate) file name information returned in an
IRP_MJ_CREATE when STATUS_REPARSE is returned?

Also how can I tell whether the reparsing is due to? i.g. DFS point, NTFS
mount point, etc.

Thanks,
Ken

2

>Were is the new(alternate) file name information returned in an

IRP_MJ_CREATE when STATUS_REPARSE is returned?

In FileObject->FileName.

Max

3

Max,
That’s what I thought but it is not changing. The full path is
“C:\testdir\emount\test”, where “emount” is a mount point that represents
drive e:. On the way down the FO has “emount\test” and the related FO has
“\testdir”. After completion the FOs don’t change when the status is
returned as STATUS_REPARSE. I would expect to find “\test” in the FO.

Also, how is redirection to a different device indicated since the device is
not part of the name.

Ken

>Were is the new(alternate) file name information returned in an
>IRP_MJ_CREATE when STATUS_REPARSE is returned?
In FileObject->FileName.
Max

4

> Max,

That’s what I thought but it is not changing. The full path is
“C:\testdir\emount\test”, where “emount” is a mount point that represents
drive e:. On the way down the FO has “emount\test” and the related FO has
“\testdir”. After completion the FOs don’t change when the status is
returned as STATUS_REPARSE. I would expect to find “\test” in the FO.

The name in the file object would be “e:\test”.

Max

5

When you see STATUS_REPARSE look in
Irp->Tail.Overlay.AuxiliaryBuffer. You will find a pointer to a
REPARSE_DATA_BUFFER (see ntifs.h for definition). The reparse information
is contained there. Note that the format of the information depends on the
type of reparse point it is. NTIFS.H shows the format for symbolic links
and mount points.

-----Original Message-----
From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
Sent: Thursday, December 07, 2000 8:25 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

Max,
That’s what I thought but it is not changing. The full path is
“C:\testdir\emount\test”, where “emount” is a mount point that represents
drive e:. On the way down the FO has “emount\test” and the related FO has
“\testdir”. After completion the FOs don’t change when the status is
returned as STATUS_REPARSE. I would expect to find “\test” in the FO.

The name in the file object would be “e:\test”.

Max

You are currently subscribed to ntfsd as: xxxxx@veritas.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

6

This is not the case. Is there some other file object? Is the new name
behavior different when the file is at the root?

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: Thursday, December 07, 2000 10:25 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

Max,
That’s what I thought but it is not changing. The full path is
“C:\testdir\emount\test”, where “emount” is a mount point that represents
drive e:. On the way down the FO has “emount\test” and the related FO has
“\testdir”. After completion the FOs don’t change when the status is
returned as STATUS_REPARSE. I would expect to find “\test” in the FO.

The name in the file object would be “e:\test”.

Max

You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

7

Rick,
Ah, That is better! The one thing I still don’t know is were in the path
name the reparse (mount) point represents. If I pass down
“c:\testdir\mount\file” regardless of how it is split between the file
object and the related file object, the reparse point that is returned is
always "??\Volume(}". How do I know whether it is for
“testdir”, “mount” or “file” so I can construct the new name.

Thanks,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Rick Winter
Sent: Thursday, December 07, 2000 10:44 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

When you see STATUS_REPARSE look in
Irp->Tail.Overlay.AuxiliaryBuffer. You will find a pointer to a
REPARSE_DATA_BUFFER (see ntifs.h for definition). The reparse information
is contained there. Note that the format of the information depends on the
type of reparse point it is. NTIFS.H shows the format for symbolic links
and mount points.

8

In the reserved field of the REPARSE_DATA_BUFFER you will get a
ULONG that is an index into the original name. I think it is the offset to
the unparsed portion of the string.

-----Original Message-----
From: Ken Galipeau [mailto:xxxxx@legato.com]
Sent: Thursday, December 07, 2000 12:32 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

Rick,
Ah, That is better! The one thing I still don’t know is were in the path
name the reparse (mount) point represents. If I pass down
“c:\testdir\mount\file” regardless of how it is split between the file
object and the related file object, the reparse point that is returned is
always "??\Volume(}". How do I know whether it is for
“testdir”, “mount” or “file” so I can construct the new name.

Thanks,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Rick Winter
Sent: Thursday, December 07, 2000 10:44 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

When you see STATUS_REPARSE look in
Irp->Tail.Overlay.AuxiliaryBuffer. You will find a pointer to a
REPARSE_DATA_BUFFER (see ntifs.h for definition). The reparse information
is contained there. Note that the format of the information depends on the
type of reparse point it is. NTIFS.H shows the format for symbolic links
and mount points.

—
You are currently subscribed to ntfsd as: xxxxx@veritas.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

9

> When you see STATUS_REPARSE look in

Irp->Tail.Overlay.AuxiliaryBuffer. You will find a pointer to a
REPARSE_DATA_BUFFER (see ntifs.h for definition). The reparse

This is w2k-only thing not in NT4.
I had severe problems with reparse about 2 months ago - and I remember that
the reparsed name (the FULL object path starting with ??) must be placed
in the FileObject->FileName on CREATE IRP completion.
Also note that the OS will kill this file object and allocate the new one
for the subsequent CREATE.
There was also a problem with relative CREATE and reparse - the reparsed
CREATE will be sent as relative too, which is wrong (NT4 bug).
The workaround is to change the IopParseFile to your own function (which
will call the original IopParseFile then) - or to walk the stack frames and
zero some structure field.

Max

10

Rick,
It seems to be the # of bytes to subtracted off the end of the file name in
the File Object.
Thanks,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Rick Winter
Sent: Thursday, December 07, 2000 4:10 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

In the reserved field of the REPARSE_DATA_BUFFER you will get a
ULONG that is an index into the original name. I think it is the offset to
the unparsed portion of the string.

-----Original Message-----
From: Ken Galipeau [mailto:xxxxx@legato.com]
Sent: Thursday, December 07, 2000 12:32 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

Rick,
Ah, That is better! The one thing I still don’t know is were in the path
name the reparse (mount) point represents. If I pass down
“c:\testdir\mount\file” regardless of how it is split between the file
object and the related file object, the reparse point that is returned is
always "??\Volume(}". How do I know whether it is for
“testdir”, “mount” or “file” so I can construct the new name.

Thanks,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Rick Winter
Sent: Thursday, December 07, 2000 10:44 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_REPARSE

When you see STATUS_REPARSE look in
Irp->Tail.Overlay.AuxiliaryBuffer. You will find a pointer to a
REPARSE_DATA_BUFFER (see ntifs.h for definition). The reparse information
is contained there. Note that the format of the information depends on the
type of reparse point it is. NTIFS.H shows the format for symbolic links
and mount points.

—
You are currently subscribed to ntfsd as: xxxxx@veritas.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

—
You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)