WDK Mini Filter Example
MetadataManager/support.c
Go to the documentation of this file.
1 /*++
2 
3 Copyright (c) 1999 - 2002 Microsoft Corporation
4 
5 Module Name:
6 
7  operations.c
8 
9 Abstract:
10 
11  This is the support routines module of the kernel mode filter driver implementing
12  filter metadata management.
13 
14 
15 Environment:
16 
17  Kernel mode
18 
19 
20 --*/
21 
22 
23 
24 #include "pch.h"
25 
26 //
27 // Assign text sections for each routine.
28 //
29 
30 #ifdef ALLOC_PRAGMA
31 #pragma alloc_text(PAGE, FmmAllocateUnicodeString)
32 #pragma alloc_text(PAGE, FmmFreeUnicodeString)
33 #pragma alloc_text(PAGE, FmmTargetIsVolumeOpen)
34 #pragma alloc_text(PAGE, FmmIsImplicitVolumeLock)
35 #endif
36 
37 //
38 // Support Routines
39 //
40 
41 NTSTATUS
43  _Inout_ PUNICODE_STRING String
44  )
45 /*++
46 
47 Routine Description:
48 
49  This routine allocates a unicode string
50 
51 Arguments:
52 
53  String - supplies the size of the string to be allocated in the MaximumLength field
54  return the unicode string
55 
56 Return Value:
57 
58  STATUS_SUCCESS - success
59  STATUS_INSUFFICIENT_RESOURCES - failure
60 
61 --*/
62 {
63  PAGED_CODE();
64 
65  String->Buffer = ExAllocatePoolWithTag( PagedPool,
66  String->MaximumLength,
68 
69  if (String->Buffer == NULL) {
70 
71  DebugTrace( DEBUG_TRACE_ERROR,
72  ("[Fmm]: Failed to allocate unicode string of size 0x%x\n",
73  String->MaximumLength) );
74 
75  return STATUS_INSUFFICIENT_RESOURCES;
76  }
77 
78  String->Length = 0;
79 
80  return STATUS_SUCCESS;
81 }
82 
83 VOID
85  _Inout_ PUNICODE_STRING String
86  )
87 /*++
88 
89 Routine Description:
90 
91  This routine frees a unicode string
92 
93 Arguments:
94 
95  String - supplies the string to be freed
96 
97 Return Value:
98 
99  None
100 
101 --*/
102 {
103  PAGED_CODE();
104 
105  ExFreePoolWithTag( String->Buffer,
106  FMM_STRING_TAG );
107 
108  String->Length = String->MaximumLength = 0;
109  String->Buffer = NULL;
110 }
111 
112 
113 BOOLEAN
115  _In_ PFLT_CALLBACK_DATA Cbd
116  )
117 /*++
118 
119 Routine Description:
120 
121  This routine returns if the target object in this callback datastructure
122  is a volume. If the file object is NULL then assume this is NOT a volume
123  file object
124 
125 Arguments:
126 
127  Cbd - Supplies a pointer to the callbackData which
128  declares the requested operation.
129 
130 Return Value:
131 
132  TRUE - target is a volume
133  FALSE - target is not a volume
134 
135 --*/
136 {
137  PAGED_CODE();
138 
139  if ((Cbd->Iopb->TargetFileObject != NULL) &&
140  FlagOn( Cbd->Iopb->TargetFileObject->Flags, FO_VOLUME_OPEN )) {
141 
142  return TRUE;
143  } else {
144 
145  return FALSE;
146  }
147 }
148 
149 NTSTATUS
151  _In_ PFLT_CALLBACK_DATA Cbd,
152  _Out_ PBOOLEAN IsLock
153  )
154 /*++
155 
156 Routine Description:
157 
158  This routine determines if an open is a implcit volume lock.
159 
160 Arguments
161 
162  Cbd - Supplies a pointer to the callbackData which
163  declares the requested operation.
164 
165  IsLock - Supplies a pointer to a user allocated boolean
166  which is used to tell the user wheather the
167  operation is an implied volume lock.
168 Return Value:
169 
170  Returns STATUS_SUCCESS if the the function determined wheather or not
171  the operation was a volume lock. On STATUS_SUCCESS it is safe to check
172  IsLock to get the answer. Otherwise, the check failed and we dont know
173  if it is a lock or not. STATUS_INVALID_PARAMETER indicates that the
174  volume's file system type is unrecognized by the check function. This is
175  an error code.
176 
177 --*/
178 {
179  NTSTATUS status = STATUS_SUCCESS;
180  PFMM_INSTANCE_CONTEXT instanceContext = NULL;
181  USHORT shareAccess;
182  ACCESS_MASK prevAccess;
183 
184  PAGED_CODE();
185 
186  //
187  // Get the instance context so we know
188  // which file system we are attached to.
189  //
190 
191  status = FltGetInstanceContext( Cbd->Iopb->TargetInstance,
192  &instanceContext );
193 
194  if (!NT_SUCCESS( status )) {
195 
196  DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
197  ("[Fmm]: FmmIsImplicitVolumeLock -> Failed to get instance context.\n") );
198  goto FmmIsImplicitVolumeLockCleanup;
199  }
200 
201  FLT_ASSERT( instanceContext != NULL );
202 
203  //
204  // Now check to see if the open is an implied volume lock
205  // on this filesystem.
206  //
207 
208  shareAccess = Cbd->Iopb->Parameters.Create.ShareAccess;
209  prevAccess = Cbd->Iopb->Parameters.Create.SecurityContext->DesiredAccess;
210 
211  switch (instanceContext->FilesystemType) {
212 
213  case FLT_FSTYPE_REFS:
214  *IsLock = ((!BooleanFlagOn( shareAccess, FILE_SHARE_WRITE | FILE_SHARE_DELETE)) &&
215  (BooleanFlagOn( prevAccess,(FILE_WRITE_DATA | FILE_APPEND_DATA) )));
216  status = STATUS_SUCCESS;
217  break;
218 
219  case FLT_FSTYPE_NTFS:
220  *IsLock = ((!BooleanFlagOn( shareAccess, FILE_SHARE_WRITE | FILE_SHARE_DELETE)) &&
221  (BooleanFlagOn( prevAccess,(FILE_WRITE_DATA | FILE_APPEND_DATA) )));
222  status = STATUS_SUCCESS;
223  break;
224 
225  case FLT_FSTYPE_FAT:
226  *IsLock = (!BooleanFlagOn( shareAccess, FILE_SHARE_WRITE | FILE_SHARE_DELETE));
227  status = STATUS_SUCCESS;
228  break;
229 
230  default:
231  status = STATUS_INVALID_PARAMETER;
232  break;
233  }
234 
235 FmmIsImplicitVolumeLockCleanup:
236 
237  if (instanceContext != NULL ) {
238 
239  FltReleaseContext( instanceContext );
240  }
241 
242  return status;
243 }
244 
#define FMM_STRING_TAG
#define DebugTrace(Level, Data)
Definition: cancelSafe.c:36
FLT_ASSERT(IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject))
return TRUE
#define FlagOn(_F, _SF)
Definition: minispy.h:247
BOOLEAN FmmTargetIsVolumeOpen(_In_ PFLT_CALLBACK_DATA Cbd)
NTSTATUS FmmIsImplicitVolumeLock(_In_ PFLT_CALLBACK_DATA Cbd, _Out_ PBOOLEAN IsLock)
NcLoadRegistryStringRetry NULL
Definition: ncinit.c:53
VOID FmmFreeUnicodeString(_Inout_ PUNICODE_STRING String)
NTSTATUS FmmAllocateUnicodeString(_Inout_ PUNICODE_STRING String)
PAGED_CODE()
FLT_FILESYSTEM_TYPE FilesystemType

Social Network


Services Overview

Architect, implement and test file system filter drivers for a wide range of functionality. We can offer several levels of assistance to meet your specific.

Contact Us

You are welcome to contact us for salse or partnership.

Sales: sales@easefilter.com
Support: support@easefilter.com
Info: info@easefilter.com