IIS 7 and Above
Filter dll starts, and runs, but never filters anything.
Last post Feb 25, 2020 01:11 AM by lextm
Jun 04, 2019 12:08 AM|richalgeni|LINK
I have a 64 bit dll filter in IIS 10. The filter starts, and calls GetFilterVersion(). This is logged in the event viewer, as well as a process log. It also attaches and detaches threads. *pVer\dwFlags is set to SF_NOTIFY_PREPROC_HEADERS, 0x00004000, but HttpFilterProc()
is NEVER called. I have event notifications firing whenever any function in the dll is called. Even the function TerminateFilter() is called correctly when iisreset is executed at the command prompt.
I have a number of extensions that run fine. There are no errors in any logs, and no notifications in the event log. The filter dll has its own Application Pool. The website runs fine. It's just that HttpFilterProc() is never called, and I have no idea why.
Can anyone help?
Jun 04, 2019 02:55 AM|Jalpa Panchal|LINK
Could you please explain on which action you invoke HttpFilterProc?
"No errors in the event viewer" does not mean "it's loaded fine".
Depending on IIS version and whether the filter is global/site, filter
DLL may not dynamically load and thus lack of errors in event viewer
does not mean it's loaded fine. It may not have loaded at all.
Jun 04, 2019 02:55 PM|richalgeni|LINK
In GetFilterVersion(), I set the dwFlags to SF_NOTIFY_PREPROC_HEADERS, 0x00004000. This is a site only filter, as I am also running Team Foundation Server, and the filter is never called during TFS activity. The IIS Server is version 10.
In all of the exported functions, an event is sent to the event log, every time one of the functions is called. When running iisreset, the function TerminateFilter() is called, and an event goes to the event log. Once the website is reloaded, GetFilterVersion()
adds an event asking IIS to notify it on SF_NOTIFY_PREPROC_HEADERS. As this was my first attempt at writing a filter, when and if HttpFilterProc() is called, the function would just send an event to the event log. No processing would be done on the header.
As I said, there are no errors in the IIS log, nor are there errors in the event log. There are informational events sent to the event log, for when the dll is loaded, GetFilterVersion() is called, as well as TerminateFilter(). These are events items I wrote
in the program. All of those events are in the event log.
So, dll filter loads, GetFilterVersion() is called, but HttpFilterProc() is never called.
Jun 05, 2019 07:55 AM|Jalpa Panchal|LINK
If possible could you upload your code on one drive and share link for a test?
Jun 05, 2019 09:24 PM|richalgeni|LINK
Ok, so I was creating a small build, where I pulled out my code for initializing, authorizing, etc,, so that the filer would not need to be installed. Also, I realized I would need to replace the event creation code, otherwise in order to test, you would
need to run 'eventcreate' with my event numbers. So, I replaced the event calls with OutputDebugString(), then used
DebugView by the Master Mark Russinovich. You have to check "Capture Global Win32."
Anyway, I was ran a quick test to make sure DebugView was capturing the calls, and I saw this: Could these missing registry keys (in bold below) be the problem?
00000001 0.00000000  Trace Start:0End Index:8
00000002 37.65449905  SidCache: Hits: 0, Misses: 0, Remote: 0, Cache Clears: 0, Failed: 0, RPC Avoided: 0, Entries: 0
00000003 48.13929749  ots_isapi_filter.dll TerminateFilter() called
00000004 55.16383362  8948 iisutil!ReadDwordParameterValueFromAnyService [helpfunc.cxx @ 152]:Opening registry key failed
00000005 55.16383362  Error(80070002): The system cannot find the file specified.
00000006 55.16383362 
00000007 55.16405869  8948 iisutil!ReadStringParameterValueFromAnyService [helpfunc.cxx @ 384]:Inetinfo: Failed reading registry value
00000008 55.16405869  Error(80070002): The system cannot find the file specified.
00000009 55.16405869 
00000010 55.16411591  8948 iisutil!ReadMultiStringParameterValueFromAnyService [helpfunc.cxx @ 490]:Inetinfo: Failed reading registry value
00000011 55.16411591  Error(80070002): The system cannot find the file specified.
00000012 55.16411591 
00000013 55.16415405  8948 iisutil!ReadMultiStringParameterValueFromAnyService [helpfunc.cxx @ 490]:Inetinfo: Failed reading registry value
00000014 55.16415405  Error(80070002): The system cannot find the file specified.
00000015 55.16415405 
00000016 61.25759888  ots_isapi_filter.dll AttachProcess() called
00000017 61.25762558  GetFilterVersion() called, ISAPI Version: 0x000A0000, notifications requested: 0x00004000
Jun 05, 2019 11:05 PM|richalgeni|LINK
Jun 06, 2019 12:04 AM|richalgeni|LINK
Here is the link to the slimmed down dll.
Link to shared dll
Use DebugView, with 'Capture Global Win32' checked.
The exported functions will write to debug view. The notification flag is 'SF_NOTIFY_PREPROC_HEADERS'.
Jun 06, 2019 12:27 AM|richalgeni|LINK
I'm thinking I should follow the instructions on this page?
Jun 06, 2019 08:28 AM|Jalpa Panchal|LINK
check that you give permissions for your DLL, and any files, folders and registry keys you use so that these can be accessed by the account under which you are running your application.
Feb 24, 2020 05:12 PM|Ricky_03|LINK
ISAPI (Internet Server Application Program Interface) is a set of Windows program calls that let you write a Web server application that will run faster than a common gateway interface (CGI) application. A disadvantage of a CGI application (or "executable
file," as it is sometimes called) is that each time it is run, it runs as a separate process with its own address space, resulting in extra instructions that have to be performed, especially if many instances of it are running on behalf of users. Using ISAPI,
you create a dynamic link library (DLL) application file that can run as part of the Hypertext Transport Protocol (HTTP) application's process and address space. The DLL files are loaded into the computer when HTTP is started and remain there as long as they
are needed; they don't have to be located and read into storage as frequently as a CGI application.
A special kind of ISAPI DLL is called an ISAPI filter, which can be designated to receive control for every HTTP request. You can create an ISAPI filter for encryption or decryption, for logging, for request screening, or for other purposes.
Feb 25, 2020 01:11 AM|lextm|LINK
HttpFilterProc should only be called when IIS decides that this filter applies to the request based on configuration. So in your case, run FRT to see if IIS decides not to call your filter,
https://docs.microsoft.com/en-us/iis/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis Only then you know what might be wrong and how to move on.