Filter dll starts, and runs, but never filters anything. RRS feed

  • Question

  • User-936241996 posted

    I have a 64 bit dll filter in IIS 10. The filter starts, and calls GetFilterVersion(). This is logged in the event viewer, as well as a process log. It also attaches and detaches threads. *pVer\dwFlags is set to SF_NOTIFY_PREPROC_HEADERS, 0x00004000, but HttpFilterProc() is NEVER called. I have event notifications firing whenever any function in the dll is called. Even the function TerminateFilter() is called correctly when iisreset is executed at the command prompt.

    I have a number of extensions that run fine. There are no errors in any logs, and no notifications in the event log. The filter dll has its own Application Pool. The website runs fine. It's just that HttpFilterProc() is never called, and I have no idea why. Can anyone help?

    Tuesday, June 4, 2019 12:08 AM

All replies

  • User-848649084 posted


    Could you please explain on which action you invoke HttpFilterProc?

    "No errors in the event viewer" does not mean "it's loaded fine".
    Depending on IIS version and whether the filter is global/site, filter
    DLL may not dynamically load and thus lack of errors in event viewer
    does not mean it's loaded fine. It may not have loaded at all.



    Tuesday, June 4, 2019 2:55 AM
  • User-936241996 posted

    In GetFilterVersion(), I set the dwFlags to SF_NOTIFY_PREPROC_HEADERS, 0x00004000. This is a site only filter, as I am also running Team Foundation Server, and the filter is never called during TFS activity. The IIS Server is version 10.

    In all of the exported functions, an event is sent to the event log, every time one of the functions is called. When running iisreset, the function TerminateFilter() is called, and an event goes to the event log. Once the website is reloaded, GetFilterVersion() adds an event asking IIS to notify it on SF_NOTIFY_PREPROC_HEADERS. As this was my first attempt at writing a filter, when and if HttpFilterProc() is called, the function would just send an event to the event log. No processing would be done on the header. 

    As I said, there are no errors in the IIS log, nor are there errors in the event log. There are informational events sent to the event log, for when the dll is loaded, GetFilterVersion() is called, as well as TerminateFilter(). These are events items I wrote in the program. All of those events are in the event log.

    So, dll filter loads, GetFilterVersion() is called, but HttpFilterProc() is never called.

    Tuesday, June 4, 2019 2:55 PM
  • User-848649084 posted

    If possible could you upload your code on one drive and share link for a test? 

    Wednesday, June 5, 2019 7:55 AM
  • User-936241996 posted

    Ok, so I was creating a small build, where I pulled out my code for initializing, authorizing, etc,, so that the filer would not need to be installed. Also, I realized I would need to replace the event creation code, otherwise in order to test, you would need to run 'eventcreate' with my event numbers. So, I replaced the event calls with OutputDebugString(), then used DebugView by the Master Mark Russinovich. You have to check "Capture Global Win32."

    Anyway, I was ran a quick test to make sure DebugView was capturing the calls, and I saw this: Could these missing registry keys (in bold below) be the problem?

    00000001 0.00000000 [10476] Trace Start:0End Index:8
    00000002 37.65449905 [10476] SidCache: Hits: 0, Misses: 0, Remote: 0, Cache Clears: 0, Failed: 0, RPC Avoided: 0, Entries: 0
    00000003 48.13929749 [11164] ots_isapi_filter.dll TerminateFilter() called
    00000004 55.16383362 [10792] 8948 iisutil!ReadDwordParameterValueFromAnyService [helpfunc.cxx @ 152]:Opening registry key failed
    00000005 55.16383362 [10792] Error(80070002): The system cannot find the file specified.
    00000006 55.16383362 [10792]
    00000007 55.16405869 [10792] 8948 iisutil!ReadStringParameterValueFromAnyService [helpfunc.cxx @ 384]:Inetinfo: Failed reading registry value
    00000008 55.16405869 [10792] Error(80070002): The system cannot find the file specified.
    00000009 55.16405869 [10792]
    00000010 55.16411591 [10792] 8948 iisutil!ReadMultiStringParameterValueFromAnyService [helpfunc.cxx @ 490]:Inetinfo: Failed reading registry value
    00000011 55.16411591 [10792] Error(80070002): The system cannot find the file specified.
    00000012 55.16411591 [10792]
    00000013 55.16415405 [10792] 8948 iisutil!ReadMultiStringParameterValueFromAnyService [helpfunc.cxx @ 490]:Inetinfo: Failed reading registry value
    00000014 55.16415405 [10792] Error(80070002): The system cannot find the file specified.
    00000015 55.16415405 [10792]
    00000016 61.25759888 [3136] ots_isapi_filter.dll AttachProcess() called
    00000017 61.25762558 [3136] GetFilterVersion() called, ISAPI Version: 0x000A0000, notifications requested: 0x00004000

    Wednesday, June 5, 2019 9:24 PM
  • User-936241996 posted


    Wednesday, June 5, 2019 11:05 PM
  • User-936241996 posted

    Here is the link to the slimmed down dll.

    Link to shared dll

    Use DebugView, with 'Capture Global Win32' checked.

    The exported functions will write to debug view. The notification flag is 'SF_NOTIFY_PREPROC_HEADERS'.

    Thursday, June 6, 2019 12:04 AM
  • User-936241996 posted

    I'm thinking I should follow the instructions on this page?


    Thursday, June 6, 2019 12:27 AM
  • User-848649084 posted

    check that you give permissions for your DLL, and any files, folders and registry keys you use so that these can be accessed by the account under which you are running your application.

    Thursday, June 6, 2019 8:28 AM
  • User690216013 posted

    HttpFilterProc should only be called when IIS decides that this filter applies to the request based on configuration. So in your case, run FRT to see if IIS decides not to call your filter, https://docs.microsoft.com/en-us/iis/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis Only then you know what might be wrong and how to move on.

    Tuesday, February 25, 2020 1:11 AM