Disable the Oplocks

NTFSD
1

I want to disable the oplocks ,I think there are two ways:
1.registry.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\Enable Oplocks =0;
So,the SRV will deny the oplocks request.
But,in Win2003,I found the SRV don’t deny it.

2.in my filter,deny any request for oplocks.
ULONG FsControlCode;
PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation( Irp );
FsControlCode = IrpSp->Parameters.FileSystemControl.FsControlCode;
if (FsControlCode==FSCTL_REQUEST_OPLOCK_LEVEL_1 ||
FsControlCode==FSCTL_REQUEST_OPLOCK_LEVEL_2 ||
FsControlCode==FSCTL_REQUEST_BATCH_OPLOCK ||
FsControlCode==FSCTL_REQUEST_FILTER_OPLOCK
)
{
KdPrint((“\r\nDeny the Oplocks Request:%x”,FsControlCode));
Irp->IoStatus.Status=STATUS_OPLOCK_NOT_GRANTED;
IoCompleteRequest(Irp, IO_NO_INCREMENT); //由我来完成这个IRP了
return STATUS_OPLOCK_NOT_GRANTED;
}
return PassThrough(pDevObj,Irp);

These two ways can work?

But,I find a very very strange case in the above two ways:
I will roll a Write (not paging) IRP before the last handle is closed(the last IRP_MJ_CLEANUP),So,my write will lead to a paging write(lazy write).
But,In my filter,I can’t catch the paging write until the last fileobject is closed(the last IRP_MJ_CLOSE).
Why?
And I use filespy to observe it,it can’t see it too.But,the data is written to the remote file,I’m sure.

2

>I will roll a Write (not paging) IRP before the last handle is closed(the

last IRP_MJ_CLEANUP),So,my write will >lead to a paging write(lazy write).
But,In my filter,I can’t catch the paging write until the last fileobject
is closed(the last IRP_MJ_CLOSE).
Why?
And I use filespy to observe it,it can’t see it too.But,the data is written
to the remote file,I’m sure.

As I understand, the sequence was

  • Receive IRP_MJ_CLEANUP
  • Send IRP_MJ_WRITE
  • Pass IRP_MJ_CLEANUP
  • Other requests( CREATE, READ … )
  • IRP_MJ_WRITE with the paging IO flag
  • last IRP_MJ_CLOSE

If so, then the data was written in the cache and was read from the cache.
The cache is not necessary flushed at last IRP_MJ_CLEANUP.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
I want to disable the oplocks ,I think there are two ways:
1.registry.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\Enable
Oplocks =0;
So,the SRV will deny the oplocks request.
But,in Win2003,I found the SRV don’t deny it.

2.in my filter,deny any request for oplocks.
ULONG FsControlCode;
PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation( Irp );
FsControlCode = IrpSp->Parameters.FileSystemControl.FsControlCode;
if (FsControlCode==FSCTL_REQUEST_OPLOCK_LEVEL_1 ||
FsControlCode==FSCTL_REQUEST_OPLOCK_LEVEL_2 ||
FsControlCode==FSCTL_REQUEST_BATCH_OPLOCK ||
FsControlCode==FSCTL_REQUEST_FILTER_OPLOCK
)
{
KdPrint((“\r\nDeny the Oplocks Request:%x”,FsControlCode));
Irp->IoStatus.Status=STATUS_OPLOCK_NOT_GRANTED;
IoCompleteRequest(Irp, IO_NO_INCREMENT); //???IRP?
return STATUS_OPLOCK_NOT_GRANTED;
}
return PassThrough(pDevObj,Irp);

These two ways can work?

But,I find a very very strange case in the above two ways:
I will roll a Write (not paging) IRP before the last handle is closed(the
last IRP_MJ_CLEANUP),So,my write will lead to a paging write(lazy write).
But,In my filter,I can’t catch the paging write until the last fileobject is
closed(the last IRP_MJ_CLOSE).
Why?
And I use filespy to observe it,it can’t see it too.But,the data is written
to the remote file,I’m sure.

3

no,I just use the filetest.ext and filespy.exe to test it.
There are two situation:
A. just Create a new file,it’s OK.

  1. I createfile in filetest.exe to create a new file—>lead to a IRP_MJ_CREATE in filespy.exe
  2. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a IRP_MJ_WRITE ,a IRP_MJ_CLOSE in filespy.exe.
    and this IRP_MJ_WRITE including my data(I roll a IRP_MJ_WRITE before IRP_MJ_CLEANUP).
    So,this is OK.

B. Open a file,and write it
A. just Create a new file,it’s OK.

  1. I createfile in filetest.exe to open a file—>lead to a IRP_MJ_CREATE in filespy.exe
  2. I write some data—>lead to two IRP_MJ_WRITE(one is not paging,one is paging) in filespy.exe
  3. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a IRP_MJ_CLOSE in filespy.exe.
    god,there is no my IRP_MJ_WRITE(but I roll my IRP_MJ_WRITE returns OK).
    So,it’s not OK.
    But,In server,I open the file,my data has been written!What a funny work!
4

> 3. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a

IRP_MJ_CLOSE in filespy.exe.
god,there is no my IRP_MJ_WRITE(but I roll my IRP_MJ_WRITE returns OK).

Which device object do you use to send IRP_MJ_WRITE? If you use an
underlying device object the filespy must attach its device object before
your driver attaches one, i.e. filespy’s DevObj must be under your DevObj.
You must observe paging IO before the last IRP_MJ_CLOSE.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> no,I just use the filetest.ext and filespy.exe to test it.
> There are two situation:
> A. just Create a new file,it’s OK.
> 1. I createfile in filetest.exe to create a new file—>lead to a
> IRP_MJ_CREATE in filespy.exe
> 2. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a
> IRP_MJ_WRITE ,a IRP_MJ_CLOSE in filespy.exe.
> and this IRP_MJ_WRITE including my data(I roll a IRP_MJ_WRITE before
> IRP_MJ_CLEANUP).
> So,this is OK.
>
> B. Open a file,and write it
> A. just Create a new file,it’s OK.
> 1. I createfile in filetest.exe to open a file—>lead to a IRP_MJ_CREATE
> in filespy.exe
> 2. I write some data—>lead to two IRP_MJ_WRITE(one is not paging,one is
> paging) in filespy.exe
> 3. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a
> IRP_MJ_CLOSE in filespy.exe.
> god,there is no my IRP_MJ_WRITE(but I roll my IRP_MJ_WRITE returns OK).
> So,it’s not OK.
> But,In server,I open the file,my data has been written!What a funny work!
>

5

It isn’t clear to me where these writes are occurring. From the
description, it sounds like you are doing the write on the client, which
suggests that RDBSS under you is converting the file to non-cached (so
you do your write and it goes directly to the server, not to the cache.)

This is known behavior for RDR (actually, the only *safe* way to protect
against this is to always write back to the server since you won’t know
what RDBSS is going to do when you send the write request.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Tuesday, September 05, 2006 7:07 AM
To: ntfsd redirect
Subject: RE:[ntfsd] Disable the Oplocks

no,I just use the filetest.ext and filespy.exe to test it.
There are two situation:
A. just Create a new file,it’s OK.

  1. I createfile in filetest.exe to create a new file—>lead to a
    IRP_MJ_CREATE in filespy.exe
  2. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a
    IRP_MJ_WRITE ,a IRP_MJ_CLOSE in filespy.exe.
    and this IRP_MJ_WRITE including my data(I roll a IRP_MJ_WRITE before
    IRP_MJ_CLEANUP).
    So,this is OK.

B. Open a file,and write it
A. just Create a new file,it’s OK.

  1. I createfile in filetest.exe to open a file—>lead to a
    IRP_MJ_CREATE in filespy.exe
  2. I write some data—>lead to two IRP_MJ_WRITE(one is not paging,one
    is paging) in filespy.exe
  3. I closehandle in filetest.exe –>lead to a IRP_MJ_CLEANUP ,a
    IRP_MJ_CLOSE in filespy.exe.
    god,there is no my IRP_MJ_WRITE(but I roll my IRP_MJ_WRITE returns
    OK).
    So,it’s not OK.
    But,In server,I open the file,my data has been written!What a funny
    work!

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Yes,it should be RDBSS,thanks tony~~~!
I have given up disable oplocks.That 's to say,the registry is original(enable oplocks),and my code don’t deny the request for oplocks.
But,I still see it! And,I have see the case:
I createfile in filetest.exe—>IRP_MJ_CREATE
I read the data in filetest.exe(offset 3,length 3111)—>IRP_MJ_Read (offset 3,length 3111)
I closehandle in filetest.exe—>IRP_MJ_Cleanup,IRP_MJ_Close

Yes,the IRP_MJ_Read is just send to server directly.didn’t cache it.
It’s so terrible.
I just only handle the paging IO.And because I have handled Paging IO,I can’t handle normal IO.
But these IO is normal(not paging),I can’t decide to encrypt/decrypt it or not.

7

Hi,

I am writing a filter driver that will encrypt/decrypt the file. The
problem i am facing is when some application uses *memory **mapped **files*
like MS Word or Wordpad to read the file. I cannot intercept the read
call for this kind of *files*, no IRP_MJ_READ for this kinda *files*. Is
there something special i have to do for this kind of *memory **mapped*
*files*.

Thanks and Regards,
Lokanadham R

On 9/6/06, xxxxx@hotmail.com wrote:
>
> Yes,it should be RDBSS,thanks tony~~~!
> I have given up disable oplocks.That 's to say,the registry is
> original(enable oplocks),and my code don’t deny the request for oplocks.
> But,I still see it! And,I have see the case:
> I createfile in filetest.exe—>IRP_MJ_CREATE
> I read the data in filetest.exe(offset 3,length 3111)—>IRP_MJ_Read
> (offset 3,length 3111)
> I closehandle in filetest.exe—>IRP_MJ_Cleanup,IRP_MJ_Close
>
> Yes,the IRP_MJ_Read is just send to server directly.didn’t cache it.
> It’s so terrible.
> I just only handle the paging IO.And because I have handled Paging IO,I
> can’t handle normal IO.
> But these IO is normal(not paging),I can’t decide to encrypt/decrypt it or
> not.
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Lokanadham R
Mobile:+91 9818476626

8

Why can’t you intercept the read calls? What it sounds like is you are
MISSING the read calls, no doubt because you are focused on looking at
the file object used by MS Word or other applications. This is a
classic issue and one that is covered in the FAQ (you did read the FAQ,
right?)

I’m assuming you are writing in filter manager. You need only associate
filter context with the files so that you can detect the paging I/O
(which might be against a different file object but will use the same
file context normally) and then you can restrict your focus to
non-cached I/O operations (so you catch *user* non-cached I/O operations
from databases like SQL or Access, as well as *paging* non-cached I/O
operations from fetches into any memory mapped structure.) If you are
writing a legacy filter, you can use filter contexts on most current OS
versions. If you have to support older platforms you’ll need to read up
on reference counting and proper tracking techniques (and nobody gives
away examples of these as far as I know…)

Building file system filters - especially for encryption - is a
challenging undertaking. We’ve been down this road numerous times
before and I’ve watched a lot of people start down the “how hard can it
be” approach. Let me note it is VERY hard. Our own toolkit (“Data
Modification Kit”) was designed to allow compression + encryption in a
nice clean layered fashion and let me just note that it’s a substantial
undertaking - there are tens of thousands of lines of code and it spans
something like 125 source files now. There are dozens of complex issues
to handle and while I believe we’ve got the right product architecture
this time around there are still numerous details that constantly
challenge us - not to mention something along the lines of several
hundred “basic configurations” that must be tested (and when you start
adding interop issues into the mix the whole process becomes seriously
daunting…) The highlights for me are when we get to “show off” some
of the interesting features that fall out of the implementation (like
alternate data streams and mount points on FAT. One of these days we’ll
add EA support back into FAT as well. And now we have two new local
file systems on the horizons - read/write UDFS (Vista) and EXFAT (not
sure on this release, but there is a beta program for it up on the MS
beta site.)

Best of luck on your project!

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lokanadham R
Sent: Tuesday, September 05, 2006 8:45 PM
To: ntfsd redirect
Subject: Re: [ntfsd] Disable the Oplocks

Hi,

I am writing a filter driver that will encrypt/decrypt the file. The
problem i am facing is when some application uses memory mapped files
like MS Word or Wordpad to read the file. I cannot intercept the read
call for this kind of files, no IRP_MJ_READ for this kinda files. Is
there something special i have to do for this kind of memory mapped
files.

Thanks and Regards,
Lokanadham R

On 9/6/06, xxxxx@hotmail.com wrote:

Yes,it should be RDBSS,thanks tony~~~!
I have given up disable oplocks.That 's to say,the registry is
original(enable oplocks),and my code don’t deny the request for oplocks.

But,I still see it! And,I have see the case:
I createfile in filetest.exe—>IRP_MJ_CREATE
I read the data in filetest.exe(offset 3,length 3111)—>IRP_MJ_Read
(offset 3,length 3111)
I closehandle in filetest.exe— >IRP_MJ_Cleanup,IRP_MJ_Close

Yes,the IRP_MJ_Read is just send to server directly.didn’t cache it.
It’s so terrible.
I just only handle the paging IO.And because I have handled Paging IO,I
can’t handle normal IO.
But these IO is normal(not paging),I can’t decide to encrypt/decrypt it
or not.

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Lokanadham R
Mobile:+91 9818476626 — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed
to ntfsd as: xxxxx@osr.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

9

I have read the article :Caching in Network File System.
That’s great.
And I will test it~~~
thanks ,tony~

10

in article:Caching in Network File System,it says the caller must acquire the FCB
resource,in order to avoid deadlocks while calling the redirector, it must
be owned exclusive (using the ERESOURCE in the FCB itself).

There are two ERESOUCE in FCB header:
Fcb->Resource
Fcb->PagingIoResource
what is the ERESOURCE the article refer to?

Should I call FsRtlEnterFileSystem() ?
If I must ExAcquireResourceExclusive the PagingIoResource, should I do polling loop?
(I think I don’t want to ExAcquireResourceExclusive the PagingIoResource,just want to ExAcquireResourceExclusive the Resource).

thanks again,tony~~

11

Thanks for reply…

When a program like notepad, uses Memory Mapped files to read content from a
file, our mini filter should intercept those calls and then change the
contents in memory that are received by notepad. Is it possible yes/no if
yes, then how?

Thanks & Regards,
lokanadham R

On 9/6/06, Tony Mason wrote:
>
> Why can’t you intercept the read calls? What it sounds like is you are
> MISSING the read calls, no doubt because you are focused on looking at the
> file object used by MS Word or other applications. This is a classic issue
> and one that is covered in the FAQ (you did read the FAQ, right?)
>
>
>
> I’m assuming you are writing in filter manager. You need only associate
> filter context with the files so that you can detect the paging I/O (which
> might be against a different file object but will use the same file context
> normally) and then you can restrict your focus to non-cached I/O operations
> (so you catch user non-cached I/O operations from databases like SQL
> or Access, as well as *paging *non-cached I/O operations from fetches
> into any memory mapped structure.) If you are writing a legacy filter, you
> can use filter contexts on most current OS versions. If you have to support
> older platforms you’ll need to read up on reference counting and proper
> tracking techniques (and nobody gives away examples of these as far as I
> know?)
>
>
>
> Building file system filters ? especially for encryption ? is a
> challenging undertaking. We’ve been down this road numerous times before
> and I’ve watched a lot of people start down the “how hard can it be”
> approach. Let me note it is VERY hard. Our own toolkit (“Data Modification
> Kit”) was designed to allow compression + encryption in a nice clean layered
> fashion and let me just note that it’s a substantial undertaking ? there are
> tens of thousands of lines of code and it spans something like 125 source
> files now. There are dozens of complex issues to handle and while I believe
> we’ve got the right product architecture this time around there are still
> numerous details that constantly challenge us ? not to mention something
> along the lines of several hundred “basic configurations” that must be
> tested (and when you start adding interop issues into the mix the whole
> process becomes seriously daunting?) The highlights for me are when we get
> to “show off” some of the interesting features that fall out of the
> implementation (like alternate data streams and mount points on FAT. One of
> these days we’ll add EA support back into FAT as well. And now we have two
> new local file systems on the horizons ? read/write UDFS (Vista) and EXFAT
> (not sure on this release, but there is a beta program for it up on the MS
> beta site.)
>
>
>
> Best of luck on your project!
>
>
>
> Tony
>
>
>
> Tony Mason
>
> Consulting Partner
>
> OSR Open Systems Resources, Inc.
>
> http://www.osr.com
>
>
>
>
> ------------------------------
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *Lokanadham R
> Sent: Tuesday, September 05, 2006 8:45 PM
> To: ntfsd redirect
> Subject: Re: [ntfsd] Disable the Oplocks
>
>
>
> Hi,
>
> I am writing a filter driver that will encrypt/decrypt the file. The
> problem i am facing is when some application uses memory mapped files
> like MS Word or Wordpad to read the file. I cannot intercept the read
> call for this kind of files, no IRP_MJ_READ for this kinda files. Is
> there something special i have to do for this kind of memory mapped
> files.
>
> Thanks and Regards,
> Lokanadham R
>
>
>
> On 9/6/06, xxxxx@hotmail.com wrote:
>
> Yes,it should be RDBSS,thanks tony~~~!
> I have given up disable oplocks.That 's to say,the registry is
> original(enable oplocks),and my code don’t deny the request for oplocks.
> But,I still see it! And,I have see the case:
> I createfile in filetest.exe—>IRP_MJ_CREATE
> I read the data in filetest.exe(offset 3,length 3111)—>IRP_MJ_Read
> (offset 3,length 3111)
> I closehandle in filetest.exe— >IRP_MJ_Cleanup,IRP_MJ_Close
>
> Yes,the IRP_MJ_Read is just send to server directly.didn’t cache it.
> It’s so terrible.
> I just only handle the paging IO.And because I have handled Paging IO,I
> can’t handle normal IO.
> But these IO is normal(not paging),I can’t decide to encrypt/decrypt it or
> not.
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> –
> Lokanadham R
> Mobile:+91 9818476626 — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: xxxxx@osr.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
>
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Lokanadham R
Mobile:+91 9818476626