Given a handle to a symbolic link (opened using NtCreateFile with FILE_OPEN_REPARSE_POINT), is it possible to open the target of that link using only that handle?
Ideally I'd like Windows to continue processing the reparse point as if FILE_OPEN_REPARSE_POINT hadn't been specified.
I've tried calling NtCreateFile omitting FILE_OPEN_REPARSE_POINT, with RootDirectory set to the reparse point handle and ObjectName set to an empty string. This seems to work (i.e. re-opens the same directory without requiring another path lookup) for non-reparse point handles but, for a symbolic link, it fails with STATUS_IO_REPARSE_DATA_INVALID.
Each file open request goes through the stack of filter drivers, then reaches the filesystem, gets processed by the filesystem, then it returns back to the application again via the stack of filter drivers. On each step, the request can be handled differently from any other request.
This means that when you open a reparse point, this operation is handled by some actor, and only it knows what this reparse point is pointing at. And the handle is associated with this actor. If you want to open the target of the reparse point, such a request may be handled by a different actor above or below than the first actor in the filter stack (or, it can be some filesystem). This second actor may not know anything about the first actor or how that actor would handle a reparse point.
So, in general, these two open operations are independent and cannot be linked via the same handle. Yes, in common cases they would related, but the whole idea of filters is that they should be able to handle each request, which requires that each request is sent "in full", without shortcuts.