FLT_TAG_DATA_BUFFER structure (fltkernel.h)
The FLT_TAG_DATA_BUFFER structure contains information about a reparse point tag.
Syntax
typedef struct _FLT_TAG_DATA_BUFFER {
ULONG FileTag;
USHORT TagDataLength;
USHORT UnparsedNameLength;
union {
struct {
USHORT SubstituteNameOffset;
USHORT SubstituteNameLength;
USHORT PrintNameOffset;
USHORT PrintNameLength;
ULONG Flags;
WCHAR PathBuffer[1];
} SymbolicLinkReparseBuffer;
struct {
USHORT SubstituteNameOffset;
USHORT SubstituteNameLength;
USHORT PrintNameOffset;
USHORT PrintNameLength;
WCHAR PathBuffer[1];
} MountPointReparseBuffer;
struct {
UCHAR DataBuffer[1];
} GenericReparseBuffer;
struct {
GUID TagGuid;
UCHAR DataBuffer[1];
} GenericGUIDReparseBuffer;
};
} FLT_TAG_DATA_BUFFER, *PFLT_TAG_DATA_BUFFER;
Members
FileTag
Tag that uniquely identifies the reparse point. Can be one of the Microsoft-defined IO_REPARSE_TAG_XXX values defined in ntifs.h, or an ISV-defined value.
TagDataLength
Size, in bytes, of the reparse data pointed to by the DataBuffer member.
UnparsedNameLength
Length, in bytes, of the unparsed portion of the file name pointed to by the FileName member of the associated file object. For more information about the FileName member, see FILE_OBJECT.
SymbolicLinkReparseBuffer
When FileTag is IO_REPARSE_TAG_SYMLINK, you can use this structure to interpret the payload.
SymbolicLinkReparseBuffer.SubstituteNameOffset
Offset, in bytes, of the substitute name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
SymbolicLinkReparseBuffer.SubstituteNameLength
Length, in bytes, of the substitute name string. If this string is NULL_terminated, SubstituteNameLength does not include space for the UNICODE_NULL terminator.
SymbolicLinkReparseBuffer.PrintNameOffset
Offset, in bytes, of the print name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
SymbolicLinkReparseBuffer.PrintNameLength
Length, in bytes, of the print name string. If this string is NULL_terminated, PrintNameLength does not include space for the UNICODE_NULL terminator.
SymbolicLinkReparseBuffer.Flags
Indicates whether the symbolic link is absolute or relative. If Flags contains SYMLINK_FLAG_RELATIVE, the symbolic link contained in PathBuffer (at offset SubstituteNameOffset) is processed as a relative link; otherwise, it is processed as an absolute link.
SymbolicLinkReparseBuffer.PathBuffer[1]
First character of the path string. This character is followed in memory by the remainder of the string. The path string contains the substitute name string and print name string. The substitute name and print name strings can appear in any order in the PathBuffer. To locate the substitute name and print name strings in the PathBuffer, use the SubstituteNameOffset, SubstituteNameLength, PrintNameOffset, and PrintNameLength members.
MountPointReparseBuffer
When FileTag is IO_REPARSE_TAG_MOUNT_POINT, you can use this structure to interpret the payload.
MountPointReparseBuffer.SubstituteNameOffset
Offset, in bytes, of the substitute name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
MountPointReparseBuffer.SubstituteNameLength
Length, in bytes, of the substitute name string. If this string is NULL_terminated, SubstituteNameLength does not include space for the UNICODE_NULL terminator.
MountPointReparseBuffer.PrintNameOffset
Offset, in bytes, of the print name string in the PathBuffer array. Note that this offset must be divided by sizeof(WCHAR) to get the array index.
MountPointReparseBuffer.PrintNameLength
Length, in bytes, of the print name string. If this string is NULL_terminated, PrintNameLength does not include space for the UNICODE_NULL terminator.
MountPointReparseBuffer.PathBuffer[1]
First character of the path string. This character is followed in memory by the remainder of the string. The path string contains the substitute name string and print name string. The substitute name and print name strings can appear in any order in the PathBuffer. To locate the substitute name and print name strings in the PathBuffer, use the SubstituteNameOffset, SubstituteNameLength, PrintNameOffset, and PrintNameLength members.
GenericReparseBuffer
You can use this structure to interpret the payload for any Microsoft-defined IO_REPARSE_TAG_XXX tag.
GenericReparseBuffer.DataBuffer[1]
Pointer to a buffer that contains user-defined data for the reparse point.
GenericGUIDReparseBuffer
You can use this structure to interpret the payload for any IO_REPARSE_TAG_XXX tag.
GenericGUIDReparseBuffer.TagGuid
Globally unique identifier (GUID) that identifies the type of reparse point. If FileTag is not a Microsoft tag, this member cannot be NULL.
GenericGUIDReparseBuffer.DataBuffer[1]
Pointer to a buffer that contains user-defined data for the reparse point.
Remarks
A minifilter can use the FLT_TAG_DATA_BUFFER structure to store information about a reparse point tag.
From the union, you can use the GenericGUIDReparseBuffer structure to interpret the payload for any IO_REPARSE_TAG_XXX tag, or optionally use one of the other structures within the union as follows:
Use the GenericReparseBuffer structure for any Microsoft-defined IO_REPARSE_TAG_XXX tag.
Use the SymbolicLinkReparseBuffer structure when FileTag is IO_REPARSE_TAG_SYMLINK.
Use the MountPointReparseBuffer structure when FileTag is IO_REPARSE_TAG_MOUNT_POINT.
A pointer to an FLT_TAG_DATA_BUFFER structure that contains reparse point tag data for an operation is stored in the TagData member of the FLT_CALLBACK_DATA structure for the operation.
The FLT_TAG_DATA_BUFFER_HEADER_SIZE macro returns the size of the fixed portion of the FLT_TAG_DATA_BUFFER structure.
Requirements
Requirement | Value |
---|---|
Header | fltkernel.h (include FltKernel.h) |