Re[2]: STATUS_REPARSE and FILE_OPEN_REPARSE_POINT

Specifically, I would remove the flag from the Parameters.Options. In
general, I am not sure what re-issuing the request without the reparse
flag will get you. You are returning a STATUS_REPARSE in the pre-op when
you see a specific file/path, correct?

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@speedy.com.ar
To: “Windows File Systems Devs Interest List”
Sent: 2/17/2017 7:25:04 AM
Subject: RE:[ntfsd] STATUS_REPARSE and FILE_OPEN_REPARSE_POINT

>Hi Pete!
>One approach I am trying is this:
>
>In the IRP_MJ_CREATE pre-op I do:
>if (CreateOptions&FILE_OPEN_REPARSE_POINT) {
> return FLT_PREOP_SUCCESS_WITH_CALLBACK;
>}
>
>Then in the IRP_MJ_CREATE pre-op I do:
>if (Data->IoStatus.Status != STATUS_OBJECT_PATH_NOT_FOUND &&
>Data->IoStatus.Status != STATUS_OBJECT_NAME_NOT_FOUND) {
> return FLT_POSTOP_FINISHED_PROCESSING;
>}
>if
>((Data->Iopb->Parameters.Create.SecurityContext->FullCreateOptions&FILE_OPEN_REPARSE_POINT)
>== 0) {
> return FLT_POSTOP_FINISHED_PROCESSING;
>}
>Data->Iopb->Parameters.Create.SecurityContext->FullCreateOptions &=
>~FILE_OPEN_REPARSE_POINT;
>FltSetCallbackDataDirty(Data);
>FltReissueSynchronousIo(Data->Iopb->TargetInstance,Data);
>return FLT_POSTOP_FINISHED_PROCESSING;
>
>The goal is to reissue the event WITHOUT this FILE_OPEN_REPARSE_POINT
>creation flag. Is it doable on this way?
>
>However in process monitor I still see IRP_MJ_CREATE with “Result” to
>“NAME NOT FOUND”. Before when applying the status reparse it was “PATH
>NOT FOUND” and now it is “NAME NOT FOUND” with this new logic.
>
>Thanks
>
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>