why I can't return STATUS_REPARSE in postcreate?

OSR_Community_User · March 29, 2009, 2:25am

In my minifilter project,I must reparse a create in postcreate.
I know the standard is return STATUS_REPARSE in precreate,but I do want return reparse in postcreate.

I do some tests for it:
1.return STATUS_REPARSE in precreate:
{
//modify targetfileobject->FileName
PFILE_OBJECT orifo= Data->Iopb->TargetFileObject;
//free target filename->Buffer,and reallocate it for source filename.nonpaged.
MyCopyUnicodeString(&orifo->FileName,filename,NonPagedPool);
orifo->RelatedFileObject =NULL;
//repase
Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;
return FLT_PREOP_COMPLETE ;
}
2.return STATUS_REPARSE in postcreate
{
//I have called FltCancelFileOpen for the fo,and cancelled all effects.
…
//modify targetfileobject->FileName
PFILE_OBJECT orifo= Data->Iopb->TargetFileObject;
//free target filename->Buffer,and reallocate it for source filename.nonpaged.
MyCopyUnicodeString(&orifo->FileName,filename,NonPagedPool);
orifo->RelatedFileObject =NULL;
//repase
Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;
return FLT_POSTOP_FINISHED_PROCESSING;
}

In test 1,it works well.
If I CreateFIle( C:\test\1.txt ),it will reparse,and all thinks is OK.
But in test2,it works strangely:
If I CreateFile ( C:\test\1.txt),it will reparse.My minifilter PreCreateRoutine will be called for the reparsed file,But the arguments is strangely.For example,the desiredaccess is 0!

Anybody can explain it?
And why I can’t return reparse in postcreate in details?
thanks.

If it is impossible,I must think a new idea in my project…

OSR_Community_User · March 29, 2009, 9:44am

xxxxx@hotmail.com wrote:

If I CreateFile ( C:\test\1.txt),it will reparse.My minifilter PreCreateRoutine will be called for the reparsed file,But the arguments is strangely.For example,the desiredaccess is 0!

Anybody can explain it?
And why I can’t return reparse in postcreate in details?
thanks.

Are you sure the values are not zero upon return from the underlying
file system in your post-create routine? I would guess that the
underlying file system is probably updating these values as they are
processed and when you see them in post-create they are modified. The
same thing can happen to the file name.

As an additional test, make a copy of the information to propagate in
the reparse and reset this information before returning in your
post-create routine.

Pete

If it is impossible,I must think a new idea in my project…

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

Petr_Kurtin · March 29, 2009, 9:59am

You can return STATUS_REPARSE only in pre-create operation callback. Note
that FltCancelFileOpen doesn’t undo any modifications to the file - e.g.
create requests with FILE_SUPERSEDE, FILE_OVERWRITE.

You can open the file in pre-create, do some checks and then eventually
reparse the create.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: 29. b?ezna 2009 8:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] why I can’t return STATUS_REPARSE in postcreate?

In my minifilter project,I must reparse a create in postcreate.
I know the standard is return STATUS_REPARSE in precreate,but I do want
return reparse in postcreate.

I do some tests for it:
1.return STATUS_REPARSE in precreate:
{
//modify targetfileobject->FileName
PFILE_OBJECT orifo= Data->Iopb->TargetFileObject;
//free target filename->Buffer,and reallocate it for source
filename.nonpaged.
MyCopyUnicodeString(&orifo->FileName,filename,NonPagedPool);
orifo->RelatedFileObject =NULL;
//repase
Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;
return FLT_PREOP_COMPLETE ;
}
2.return STATUS_REPARSE in postcreate
{
//I have called FltCancelFileOpen for the fo,and cancelled all effects.
…
//modify targetfileobject->FileName
PFILE_OBJECT orifo= Data->Iopb->TargetFileObject;
//free target filename->Buffer,and reallocate it for source
filename.nonpaged.
MyCopyUnicodeString(&orifo->FileName,filename,NonPagedPool);
orifo->RelatedFileObject =NULL;
//repase
Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;
return FLT_POSTOP_FINISHED_PROCESSING;
}

In test 1,it works well.
If I CreateFIle( C:\test\1.txt ),it will reparse,and all thinks is OK.
But in test2,it works strangely:
If I CreateFile ( C:\test\1.txt),it will reparse.My minifilter
PreCreateRoutine will be called for the reparsed file,But the arguments is
strangely.For example,the desiredaccess is 0!

Anybody can explain it?
And why I can’t return reparse in postcreate in details?
thanks.

If it is impossible,I must think a new idea in my project…

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

OSR_Community_User · March 29, 2009, 9:02pm

I have said:
I will cancel all effects on the file.
example:
If FILE_OVERWRITE,I will modify it to FILE_OPEN.And in postcreate,if success,I will overwrite it!
It works well for my project.

According to Peter,that’s to say,I can return reparse in postcreate theoretically speaking?

Daniel_Terhell · March 30, 2009, 3:06am

wrote in message news:xxxxx@ntfsd…
>I have said:
> I will cancel all effects on the file.
> example:
> If FILE_OVERWRITE,I will modify it to FILE_OPEN.And in postcreate,if
> success,I will overwrite it!
> It works well for my project.
>
> According to Peter,that’s to say,I can return reparse in postcreate
> theoretically speaking?
>

Theorerically this might be possible but it 's going to dramatically
complicate your driver (and likely create a lot of overhead) as this will
require a complex transactional system which needs to maintain lots of
administration about original requests (I think mess). What advantage you
think this gives you over doing required tests in precreate and take actions
there ?

//Daniel

OSR_Community_User · March 30, 2009, 3:54am

I have complete and test my cancel work in postcreate.It works well for me.
I have tested all possible IRP_MJ_CREATE in my test project.
I take this solution is for speed,and don’t issued more recursive calls(assume there are some filters below me).

OSR_Community_User · March 30, 2009, 4:14am

From my understanding, by returning STATUS_REPARSE in pre-create will
prevent the pre-create mini-filter handlers below you
from being invoked including all of their post-create handlers below you as
the original request works back
up the stack (which includes legacy filter’s Pre and Post Dispatch routines
that are below filter manager in the stack)…

Every time you reparse, the IO manager is Involved and a new IRP is created
whether you’ve created a legacy filter
or a mini-filter…

Could you explain how and why reparsing in post-create would be faster?

Once again, Good Luck (in explaining this)…

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Monday, March 30, 2009 2:55 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] why I can’t return STATUS_REPARSE in postcreate?

I have complete and test my cancel work in postcreate.It works well for me.
I have tested all possible IRP_MJ_CREATE in my test project.
I take this solution is for speed,and don’t issued more recursive
calls(assume there are some filters below me).

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

OSR_Community_User · March 30, 2009, 5:04am

> Every time you reparse, the IO manager is Involved and a new IRP is created

More so, the new file object is created too.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

OSR_Community_User · March 30, 2009, 9:25am

My project including very much works.
These works will be fast in post-create,not return reparse.

I will return reparse when meet my condition.These condition is seldom.
And on the other side,other works in my minifilter is very frequent.