Strange problem

I don’t see any logic in this problem, I hope someone can find it:

In my encryption driver based on sfilter (in the test version I’m
working on, I’m changing bytes, not blocks) I’m getting files corrupted
(few bytes), when winzip copies the file from the TEMP folder to the
chosen one.
Doing more tests, I have just one conclusion: The file is getting
corrupted only if the target folder name has spaces. If it doesn’t, the
file copy is OK.

This problem is happening on in WinXP, Win2k is ok.

Any idea?

Strauss

Incorrect file name comparison most probably.
Make sure you note whether a file is encrypted during IRP_MJ_CREATE, and that you
have correct FileObject / FsContext based hashing / tracking.
Also, you will probably need to take SFN/LFN into account, as well as Rename vs.
Move.

Regards, Dejan.

Rodrigo Strauss wrote:

I don’t see any logic in this problem, I hope someone can find it:

In my encryption driver based on sfilter (in the test version I’m
working on, I’m changing bytes, not blocks) I’m getting files corrupted
(few bytes), when winzip copies the file from the TEMP folder to the
chosen one.
Doing more tests, I have just one conclusion: The file is getting
corrupted only if the target folder name has spaces. If it doesn’t, the
file copy is OK.

This problem is happening on in WinXP, Win2k is ok.

Any idea?

Strauss


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

You’re right! Winzip opens the file with the short name if the folder
has spaces. During IRP_MJ_CREATE, I check to see if the name in my
tracking struct is different from the one in IRP. If it is, I assume the
FS is reusing the FsContext and I was not properly notified about the
previous file close. Now, I’m update my control struct in move/rename.
But I still have problems with SFN.

Thanks!

Strauss

Dejan Maksimovic wrote:

Incorrect file name comparison most probably.
Make sure you note whether a file is encrypted during IRP_MJ_CREATE, and that you
have correct FileObject / FsContext based hashing / tracking.
Also, you will probably need to take SFN/LFN into account, as well as Rename vs.
Move.

Regards, Dejan.

Rodrigo Strauss wrote:

> I don’t see any logic in this problem, I hope someone can find it:
>
> In my encryption driver based on sfilter (in the test version I’m
>working on, I’m changing bytes, not blocks) I’m getting files corrupted
>(few bytes), when winzip copies the file from the TEMP folder to the
>chosen one.
> Doing more tests, I have just one conclusion: The file is getting
>corrupted only if the target folder name has spaces. If it doesn’t, the
>file copy is OK.
>
> This problem is happening on in WinXP, Win2k is ok.
>
> Any idea?
>
>Strauss
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@alfasp.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com


Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@scua.com.br
To unsubscribe send a blank email to xxxxx@lists.osr.com

SFN you will most likely have to handle by letting an open succeed, and then asking for
the real file name, or just assuming the user would add both (however be ready to get 1 MB
of file paths this way:-)

Rodrigo Strauss wrote:

You’re right! Winzip opens the file with the short name if the folder
has spaces. During IRP_MJ_CREATE, I check to see if the name in my
tracking struct is different from the one in IRP. If it is, I assume the
FS is reusing the FsContext and I was not properly notified about the
previous file close. Now, I’m update my control struct in move/rename.
But I still have problems with SFN.

Thanks!

Strauss

Dejan Maksimovic wrote:
> Incorrect file name comparison most probably.
> Make sure you note whether a file is encrypted during IRP_MJ_CREATE, and that you
> have correct FileObject / FsContext based hashing / tracking.
> Also, you will probably need to take SFN/LFN into account, as well as Rename vs.
> Move.
>
> Regards, Dejan.
>
> Rodrigo Strauss wrote:
>
>
>> I don’t see any logic in this problem, I hope someone can find it:
>>
>> In my encryption driver based on sfilter (in the test version I’m
>>working on, I’m changing bytes, not blocks) I’m getting files corrupted
>>(few bytes), when winzip copies the file from the TEMP folder to the
>>chosen one.
>> Doing more tests, I have just one conclusion: The file is getting
>>corrupted only if the target folder name has spaces. If it doesn’t, the
>>file copy is OK.
>>
>> This problem is happening on in WinXP, Win2k is ok.
>>
>> Any idea?
>>
>>Strauss
>>
>>—
>>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>>
>>You are currently subscribed to ntfsd as: xxxxx@alfasp.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption services.
> Alfa File Protector - File protection and hiding library for Win32 developers.
> Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@scua.com.br
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

The sad thing is that recent iterations of the filesystems will always
return the path used to open the file (in response to a file name info
query), not the ‘canonical’ LFN. Basically one must give up the idea of
uniquely identifying a file via its pathname (even assuming you get the
LFN via an expensive directory query algorithm, files on network
volumes/UNC still may have multiple valid paths).

Dejan Maksimovic wrote:

SFN you will most likely have to handle by letting an open succeed, and then asking for
the real file name, or just assuming the user would add both (however be ready to get 1 MB
of file paths this way:-)

Rodrigo Strauss wrote:

> You’re right! Winzip opens the file with the short name if the folder
>has spaces. During IRP_MJ_CREATE, I check to see if the name in my
>tracking struct is different from the one in IRP. If it is, I assume the
>FS is reusing the FsContext and I was not properly notified about the
>previous file close. Now, I’m update my control struct in move/rename.
>But I still have problems with SFN.
>
>Thanks!
>
>Strauss
>
>Dejan Maksimovic wrote:
>
>> Incorrect file name comparison most probably.
>> Make sure you note whether a file is encrypted during IRP_MJ_CREATE, and that you
>>have correct FileObject / FsContext based hashing / tracking.
>> Also, you will probably need to take SFN/LFN into account, as well as Rename vs.
>>Move.
>>
>> Regards, Dejan.
>>
>>Rodrigo Strauss wrote:
>>
>>
>>
>>> I don’t see any logic in this problem, I hope someone can find it:
>>>
>>> In my encryption driver based on sfilter (in the test version I’m
>>>working on, I’m changing bytes, not blocks) I’m getting files corrupted
>>>(few bytes), when winzip copies the file from the TEMP folder to the
>>>chosen one.
>>> Doing more tests, I have just one conclusion: The file is getting
>>>corrupted only if the target folder name has spaces. If it doesn’t, the
>>>file copy is OK.
>>>
>>> This problem is happening on in WinXP, Win2k is ok.
>>>
>>> Any idea?
>>>
>>>Strauss
>>>
>>>—
>>>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>>>
>>>You are currently subscribed to ntfsd as: xxxxx@alfasp.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>–
>>Kind regards, Dejan M. MVP for DDK
>>http://www.alfasp.com E-mail: xxxxx@alfasp.com
>>Alfa Transparent File Encryptor - Transparent file encryption services.
>>Alfa File Protector - File protection and hiding library for Win32 developers.
>>Alfa File Monitor - File monitoring library for Win32 developers.
>>
>>
>>
>>—
>>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>>
>>You are currently subscribed to ntfsd as: xxxxx@scua.com.br
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@alfasp.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com


Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.


Nick Ryan (MVP for DDK)

What canonical LFN? Hard links …

Good point. Plus files opened by ID for which one doesn’t have the
permissions to query the directories in the path above.

Lyndon J. Clarke wrote:

What canonical LFN? Hard links …


Nick Ryan (MVP for DDK)

I wonder how the new Filter Driver Framework takes care of such things? Anyone
from MS care to comment?

Nick Ryan wrote:

Good point. Plus files opened by ID for which one doesn’t have the
permissions to query the directories in the path above.

Lyndon J. Clarke wrote:

> What canonical LFN? Hard links …


Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

Oh, now this starts to get interesting … Say the file was opened by id,
and so in completion of IRP_MJ_CREATE we ask for the filename, what do we
get, given that the file systems return the name that, err, umm, in this
case, was not used to open the file?

When querying for a name that has been opened by ID, if the file does
not have hardlinks, you will get the correct name. If it does have hard
links you will get one of the names. There is no way to know which one
of the hardlink paths will be returned.

Neal Christiansen
Microsoft File System Filter Group

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lyndon J. Clarke
Sent: Thursday, December 11, 2003 3:16 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Strange problem

Oh, now this starts to get interesting … Say the file was opened by
id,
and so in completion of IRP_MJ_CREATE we ask for the filename, what do
we
get, given that the file systems return the name that, err, umm, in this
case, was not used to open the file?


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

> When querying for a name that has been opened by ID, if the file does

not have hardlinks, you will get the correct name. If it does have hard
links you will get one of the names. There is no way to know which one
of the hardlink paths will be returned.

Thanks for the clarification here Neal. Of course, if there are hard
links, the all of the paths are correct!